gatling: Add procd files

This commit adds a uci configuration file and makes the gatling server
controllable by procd.

Co-authored-by: Moritz Warning <redacted>
Signed-off-by: Martin Hübner <redacted>

databag: add package

Signed-off-by: Roland Osborne <redacted>

modemmanager: add sourcefilter option support

This make source based IPv6 routing option available for
modemmanager case dhcpv6

Signed-off-by: Chen Minqiang <redacted>

speedtest-netperf: add idle latency measurement

Allow measuring ping latency and CPU details at idle as a baseline before
measuring under data transfer loading. This allows better determination of
Latency Under Load, a critical bufferbloat parameter. The CPU details can
also be used to verify idle conditions or examine CPU frequency against
ping variations and jitter.

Change the default test duration to 30 seconds, which is adequate for SQM
tuning while reducing bandwidth consumption for upstream netperf servers.

Change the default ping host from gstatic.com to one.one.one.one, which is
widely available and generally shows lower latency.

When warning of internal netperf errors, suggest running netperf directly
to view error details.

Other minor updates include:
  - clear tmp file names for safety in case of traps
  - simplify ping code, argument parsing and number validation
  - fix cases of wrong protocol usage with hostname as ping target
  - drop unneeded egrep usage

Also update README accordingly, with clearer usage text and terminology.

Signed-off-by: Tony Ambardar <redacted>

tinyproxy: fix upstream config generation

Signed-off-by: Daniel Kucera <redacted>

tinc: fix regression bring by commit fd61f2d

Signed-off-by: Erwan MAS <redacted>

knot: fix EXTRA_DEPENDS for APK version schema

EXTRA_DEPENDS now requires an `r` before the `PKG_RELEASE` because of
https://github.com/openwrt/openwrt/commit/e8725a932e16eaf6ec51add8c084d959cbe32ff2.

Fixes https://github.com/openwrt/packages/issues/23735

Signed-off-by: Christopher Ng <redacted>

dockerd: Update to 26.1.4

Signed-off-by: Milinda Brantini <redacted>

zabbix: update to 7.0.0

License has been changed to AGPL-3.0-only

Signed-off-by: Yanase Yuki <redacted>

zabbix: update to 6.4.15

Signed-off-by: Yanase Yuki <redacted>

zabbix: update to 6.4.14

Signed-off-by: Yanase Yuki <redacted>

zabbix: update to 6.4.13

Signed-off-by: Yanase Yuki <redacted>

zabbix: update to 6.4.12

Signed-off-by: Yanase Yuki <redacted>

zabbix: zabbix-agentd: depend on libevent2-pthreads

zabbix-agentd requires libevent2-pthreads to build
correctly, so add it to DEPENDS.

Signed-off-by: Yanase Yuki <redacted>

nginx-util: Rework ptr cleanup and error handling

As per @Ansuel's not about ctx cleanup in error path, decided to rework
the patch.

Changes and Improvements:

Smart Pointers for Memory Management:
* The `EVP_PKEY_ptr` and `X509_NAME_ptr` smart pointers
  are used to manage the memory of `EVP_PKEY` and `X509_NAME`
  objects respectively to ensure proper cleanup.

Error Handling:
* Improved error messages and exception handling to provide
  more information about what went wrong.

Resource Cleanup:
* Ensured all allocated resources are now properly freed
  in case of an error to prevent memory leaks.

Signed-off-by: Sean Khan <redacted>

nginx-util: fix deprecated openssl 3.0 functions

Since upstream openwrt has been using openssl 3.0 for quite some time,
figured we could clean up some of the legacy code.

This PR updates the code for EC/RSA key generation.

nginx-util currently only generates 'ecc' keys, even though the
framework is there for rsa as well.

In order properly test the changes, I created two binaries:

'nginx-util-ssl'     (generates ec keys)
'nginx-util-ssl-rsa' (generates rsa keys)

where I would change line:455 in `src/nginx-ssl-util.hpp`

`auto pkey = gen_eckey(NID_secp384r1)` to `auto pkey = gen_rsakey(2048)`

Example with UCI config

```
config server '_rsa'
list listen '443 ssl default_server'
list listen '[::]:443 ssl default_server'
option server_name '_rsa'
list include 'restrict_locally'
list include 'conf.d/*.locations'
option uci_manage_ssl 'self-signed'
option key_type 'rsa'
option ssl_certificate '/etc/nginx/conf.d/_rsa.crt'
option ssl_certificate_key '/etc/nginx/conf.d/_rsa.key'
option ssl_session_cache 'shared:SSL:32k'
option ssl_session_timeout '64m'
option access_log 'off; # logd openwrt'
```

➤ /opt/bin/nginx-ssl-util-rsa add_ssl _rsa
Adding SSL directives to UCI server: nginx._rsa
uci_manage_ssl='self-signed'
Created self-signed SSL certificate '/etc/nginx/conf.d/_rsa.crt' with key '/etc/nginx/conf.d/_rsa.key'.

[04/14/24 18:37:15](K-6.6.27)
root@WRX36 ~
➤ openssl x509 -in /etc/nginx/conf.d/_rsa.crt -text -noout
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6d:55:a6:cd:52:25:31:fd:3c:78:66:24:82:5f:bb:b6:a6:fe:8f:c7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = ZZ, ST = Somewhere, L = None, CN = OpenWrt, O = OpenWrtBF399B64ACF71BC3
        Validity
            Not Before: Apr 14 22:37:15 2024 GMT
            Not After : Jul 16 22:37:15 2027 GMT
        Subject: C = ZZ, ST = Somewhere, L = None, CN = OpenWrt, O = OpenWrtBF399B64ACF71BC3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:ac:52:71:af:25:e9:05:0a:a5:d7:86:d3:8d:0b:
                    66:e0:09:cf:2a:cd:a1:63:57:36:46:61:04:16:fe:
                    94:84:d0:20:ab:01:15:55:aa:a1:89:c2:85:a9:84:
                    47:ba:84:d7:1f:a9:0c:c0:f0:67:2f:81:1d:1b:3b:
                    31:d5:94:6e:a0:f0:e6:ec:26:91:4a:e2:fd:58:4c:
                    ac:b5:9e:a1:cd:7d:91:51:29:81:1d:3e:4a:d9:d1:
                    d5:f1:2f:34:2f:ca:95:dc:42:d5:c4:d3:d6:b2:91:
                    d5:19:61:a2:b5:b1:90:f0:83:88:ef:92:c9:bf:a4:
                    59:a9:d6:00:6f:1c:0d:70:16:40:cc:cb:c0:de:c4:
                    8f:00:83:a3:2f:77:ca:18:cd:7b:d4:77:96:47:78:
                    1b:c1:ff:08:86:93:79:91:8f:a7:95:71:46:06:69:
                    fc:cc:65:64:e7:99:11:cc:82:bb:39:6b:12:27:73:
                    0e:d1:e7:65:51:9e:ad:dc:b3:ff:3f:ba:b0:72:4f:
                    22:ad:7e:41:bb:3c:c7:80:30:81:5f:8b:32:f4:7f:
                    22:48:3f:3d:a9:eb:28:27:12:db:a9:63:c9:7e:e2:
                    ed:36:de:e7:68:31:4e:9c:c0:36:e8:f2:d9:3f:50:
                    09:50:a3:e8:7a:03:00:4f:8d:e1:10:eb:a1:87:44:
                    be:23
                Exponent: 65537 (0x10001)
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        06:7d:84:00:ac:8f:8b:a6:b6:b7:b5:ed:ee:7f:61:76:6d:ee:
        11:53:f6:d1:f8:95:ad:6c:d7:d0:3e:01:ac:bb:d7:7a:8d:59:
        80:ec:ba:b2:7b:78:5c:4f:5e:3f:f1:74:ad:d9:8c:a2:6b:08:
        9c:bf:b1:42:fd:8d:a6:35:48:4d:a7:2d:92:c9:45:66:77:32:
        a4:e0:ea:eb:e0:4a:42:f5:dd:ea:a2:c0:0a:66:5a:32:03:1d:
        e7:87:3a:7f:1e:00:ed:d0:21:01:d5:f9:e2:b1:e6:b7:cb:1c:
        67:11:de:69:7f:a2:ce:d0:fc:2d:f2:6c:33:84:4c:3d:f4:f6:
        60:6b:2e:31:b7:0c:41:2c:73:31:7e:94:19:a2:2b:6a:56:3f:
        07:37:71:97:28:58:91:63:b2:58:97:b2:aa:1e:d5:d9:6d:af:
        6f:a0:02:e0:06:39:b0:c9:f5:50:41:b5:58:41:6a:30:72:89:
        9a:67:7e:a1:7a:a5:02:b9:2a:f3:f8:93:4f:59:6e:b1:27:54:
        86:d1:ec:96:7a:dd:d1:44:6b:1e:3b:17:cf:15:64:ad:83:6b:
        63:20:2d:42:c3:28:68:14:de:12:4e:8a:c3:f3:10:c8:4b:4f:
        c7:d8:2b:a8:45:fb:3a:bd:9d:bd:08:71:08:09:ed:ea:9b:b9:
        3b:33:a6:a6

[04/14/24 18:37:27](K-6.6.27)
root@WRX36 ~
➤ /opt/bin/nginx-ssl-util add_ssl _ec
Adding SSL directives to UCI server: nginx._ec
uci_manage_ssl='self-signed'
Created self-signed SSL certificate '/etc/nginx/conf.d/_ec.crt' with key '/etc/nginx/conf.d/_ec.key'.

[04/14/24 18:37:43](K-6.6.27)
root@WRX36 ~
➤ openssl x509 -in /etc/nginx/conf.d/_ec.crt -text -noout
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            55:32:fe:07:09:79:d1:40:d7:43:2e:45:3d:98:4a:77:65:d0:29:41
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = ZZ, ST = Somewhere, L = None, CN = OpenWrt, O = OpenWrt2EDD40F41960C8C1
        Validity
            Not Before: Apr 14 22:37:43 2024 GMT
            Not After : Jul 16 22:37:43 2027 GMT
        Subject: C = ZZ, ST = Somewhere, L = None, CN = OpenWrt, O = OpenWrt2EDD40F41960C8C1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                pub:
                    04:97:d2:b2:f0:c9:60:60:89:7e:ea:6f:48:1c:90:
                    8e:6d:1d:d8:58:46:8c:de:e9:50:e2:74:ea:d8:dd:
                    8c:d9:ed:f4:4c:b7:41:95:55:98:38:5a:9e:66:83:
                    b9:7c:79:71:9b:ec:18:ed:d9:09:3c:f7:64:32:ae:
                    59:ad:92:de:d7:c4:15:2e:e5:89:65:f4:29:8a:62:
                    a0:85:21:95:22:3a:38:e3:11:e6:f2:01:f6:50:62:
                    01:ed:68:0d:d0:0c:d4
                ASN1 OID: secp384r1
                NIST CURVE: P-384
    Signature Algorithm: ecdsa-with-SHA256
    Signature Value:
        30:65:02:30:78:af:d1:4f:57:b1:97:2b:87:aa:7f:a2:26:39:
        19:30:5c:4f:9c:f0:d7:ee:24:8e:a2:39:ec:70:af:16:eb:a6:
        72:96:d4:a7:2f:c1:38:f4:65:ed:ed:bf:22:c6:a4:6d:02:31:
        00:bc:ec:19:0e:3d:6a:d1:5a:ae:6d:5c:a3:ec:96:60:32:f9:
        6a:88:06:92:ed:c1:a7:44:2c:33:7a:22:72:0f:2a:ce:83:f0:
        f2:04:9e:49:60:ef:83:b4:7f:8b:af:61:c9

```

Maintainer: Peter Stadler <redacted>
Compile tested: aarch64, qualcommax, Master Branch
Run tested: aarch64, Dynalink DL-WRX36, Master Branch

Signed-off-by: Sean Khan <redacted>

mwan3: "use" action: run process via `exec` and handle whitespace

Previously the "use" command had the following shortcomings:
* a subprocess was created instead of replacing the shell process
* whitespace in arguments was not handled correctly

Implementation detail:
In shell context the `"$@"` expression should be used (instead of `$*`).
This allows the safe handling of arguments containing whitespace.

Closes: #20001
Signed-off-by: Lars Kruse <redacted>

shairport-sync: fixed diagnostics settings

shairport-sync expects statistics/log_verbosity/log_output_to settings
to be in the diagnostics section of shairport-sync's native config.

Prior to this commit, these settings were either missing (log_output_to)
or generated in the incorrect (general) native config section bloc.

Signed-off-by: David Andreoletti <redacted>

libjwt: add package

Add package for JWT C Library built against OpenSSL.

Signed-off-by: Daniel Golle <redacted>

lua-ffi: Add package

Lua-ffi is a portable lightweight C FFI for Lua, based on libffi
and aiming to be mostly compatible with LuaJIT FFI, but written
from scratch in C language.

Signed-off-by: Jianhui Zhao <redacted>

sane-backends: update to 1.3.1

Many changes since 1.0.31. See:

- https://gitlab.com/sane-project/backends/-/releases/1.0.32
- https://gitlab.com/sane-project/backends/-/releases/1.1.1
- https://gitlab.com/sane-project/backends/-/releases/1.2.1
- https://gitlab.com/sane-project/backends/-/releases/1.3.1

Signed-off-by: Luiz Angelo Daros de Luca <redacted>

owut: add new package

owut (OpenWrt Update Tool) is a command line program that gathers
information from the various openwrt.org build sites and reports
status on various aspects of builds and package availability.
It also shows many details about your current configuration and
installed packages, allowing it to create, download, verify and
install new images containing the user-installed packages.

It is written completely in 'ucode', allowing for user customization
on the installed device, without the need for compilers and linkers.

Documentation is available at https://github.com/efahl/owut
Forum thread at https://forum.openwrt.org/t/owut-openwrt-upgrade-tool/200035

Signed-off-by: Eric Fahlgren <redacted>

nfs-kernel-server: do not export /mnt by default

Currently, the nfs-kernel-server package exports /mnt by default after
it is installed. This is not a good default behavior, as it may expose
sensitive data to the network if a user mounts something on /mnt. This
commit commented out the line that exports /mnt, so the user has to
enable it explicitly.

Signed-off-by: Yangyu Chen <redacted>

opensc: update to version 0.25.1

* New in 0.25.1; 2024-04-05
** General improvements
* Add missing file to dist tarball to build documentation (#3063)

** minidriver
* Fix RSA decryption with PKCS#1 v1.5 padding (#3077)
* Fix crash when app is not set (#3084)

* New in 0.25.0; 2024-03-06
** Security
* [CVE-2023-5992](https://github.com/OpenSC/OpenSC/wiki/CVE-2023-5992): Side-channel leaks while stripping encryption PKCS#1.5 padding in OpenSC (#2948)
* [CVE-2024-1454](https://github.com/OpenSC/OpenSC/wiki/CVE-2024-1454): Potential use-after-free in AuthentIC driver during card enrollment in pkcs15init (#2962)

** General improvements
* Update OpenSSL 1.1.1 to 3.0 in MacOS build (#2930)
* Remove support for old card drivers Akis, GPK, Incrypto34 and Westcos, disable Cyberflex driver (#2885)
* Fix 64b to 32b conversions (#2993)
* Improvements for the p11test (#2991)
* Fix reader initialization without SCardControl (#3007)
* Make RSA PKCS#1 v1.5 depadding constant-time (#2948)
* Add option for disabling PKCS#1 v1.5 depadding (type 01 and 02) on the card (#2975)
* Enable MSI signing via Signpath CI integration for Windows (#2799)
* Fixed various issues reported by OSS-Fuzz and Coverity in drivers, PKCS#11 and PKCS#15 layer

** minidriver
* Fix wrong hash selection (#2932)

** pkcs11-tool
* Simplify printing EC keys parameters (#2960)
* Add option to import GENERIC key (#2955)
* Add support for importing Ed25518/448 keys (#2985)
** drust-tool
* Add tool for D-Trust cards (#3026, #3051)
** IDPrime
* Support uncompressed certificates on IDPrime 940 (#2958)
* Enhance IDPrime logging (#3003)
* Add SafeNet 5110+ FIPS token support (#3048)
** D-Trust Signature Cards
* Add support for RSA D-Trust Signature Card 4.1 and 4.4 (#2943)
** EstEID
* Remove expired EstEID 3.* card support (#2950)
** ePass2003
* Allow SW implementation with more SHA2 hashes and ECDSA (#3012)
* Fix EC key generation (#3045)
** SmartCard-HSM
* Fix SELECT APDU command (#2978)
** MyEID
* Update for PKCS#15 profile (#2965)
** Rutoken
* Support for RSA 4096 key algorithm (#3011)
** OpenPGP

Signed-off-by: Daniel Golle <redacted>

pcsc-tools: update to version 1.7.1

Adds a bunch of new ATRs.

Signed-off-by: Daniel Golle <redacted>

pcsc-lite: update to version 2.2.3

Switch to meson build system instead of autotools.

Changes since version 2.0.1:

2.2.3: Ludovic Rousseau
26 May 2024
- meson:
  . Fix build on Slackware 15
  . fail if both libusb and libudev are used
- Fix memory leak on exit
- libpcscspy: dump an output buffer only if the call succeeded
- Some code cleanup

2.2.2: Ludovic Rousseau
20 May 2024
- Serial support is ENABLED by default

2.2.1: Ludovic Rousseau
8 May 2024
- fix meson related issues
- Some code cleanup

2.2.0: Ludovic Rousseau
3 May 2024
- provide files for meson build tool (replaces autoconf/auoomake)
- fix a missing symbol in libpcscspy (bug introduced by the previous version)
- fix shutdown issues with hotplug_libusb
- update pcsc-spy manpage
- update copyright date
- Some other minor improvements

2.1.0: Ludovic Rousseau
12 April 2024
- LIBPCSCLITE_DELEGATE is used to redirect to another libpcsclite library
- setup_spy.sh displays the LIBPCSCLITE_DELEGATE value to use for spying
- provides libfake.c as a sample source code
- Some other minor improvements

2.0.3: Ludovic Rousseau
3 March 2024
- add SCARD_E_UNKNOWN_RES_MNG back

2.0.2: Ludovic Rousseau
3 March 2024
- SCardConnect() & SCardReconnect(): restrict the protocol used
- negotiate PTS also for the backup protocol
- pcscd.8:
  . document --disable-polkit
  . add "CONFIGURATION FILE" section
- Some other minor improvements

Signed-off-by: Daniel Golle <redacted>

containerd: Update to 1.7.18

Signed-off-by: Milinda Brantini <redacted>

docker: Update to 26.1.4

Signed-off-by: Milinda Brantini <redacted>

kafs-client: introduce package

Signed-off-by: Nathaniel Wesley Filardo <redacted>

keyutils: package into the right directories

The kernel knows about /sbin/request-key *at that path*, and the shipped
configuration file presumes that /sbin/key.dns_resolver and /bin/keyctl are the
correct paths.

Signed-off-by: Nathaniel Wesley Filardo <redacted>

node: bump to v20.15.0

Notable Changes
* test_runner: support test plans
* inspector: introduce the --inspect-wait flag
* zlib: expose zlib.crc32()
* cli: allow running wasm in limited vmem with --disable-wasm-trap-handler

Signed-off-by: Hirokazu MORIKAWA <redacted>

netatalk: update to 3.2.0.

Commit restores package after it was removed from OpenWrt 21.02.
Signed-off-by: Antonio Pastor <redacted>

monit: update to 5.34.0
Compile tested: x86_64, PC Engines APU4, OpenWrt 22.03.5/main
Run tested: x86_64, PC Engines APU4, OpenWrt 22.03.5/main, div. tests

* update from 5.33.0 to 5.34.0 (See changelog: https://mmonit.com/monit/changes/)
* remove upstream (obsolete) patch

Signed-off-by: Yaroslav Petrov <redacted>

moreutils: fix depencies for ts

Signed-off-by: Erwan MAS <redacted>

boost: Updates package to version 1.85.0

This commit updates boost to version 1.85.0

New available libraries:
* *Charconv:* A high quality implementation of <charconv> in C++11,
  from Matt Borland. [2]
* *Scope:* A collection of scope guard utilities and a
  unique_resource wrapper, from Andrey Semashev. [3]

More info about Boost 1.85.0 can be found at the usual place [1].

[1]: https://www.boost.org/users/history/version_1_85_0.html
[2]: https://www.boost.org/libs/charconv/
[3]: https://www.boost.org/libs/scope/

Signed-off-by: Carlos Miguel Ferreira <redacted>

docker-compose: Update to version 2.28.0

Release notes:
https://github.com/docker/compose/releases/tag/v2.28.0

Signed-off-by: Javier Marcet <redacted>

docker-compose: Update to version 2.27.3

Release notes:
https://github.com/docker/compose/releases/tag/v2.27.3

Signed-off-by: Javier Marcet <redacted>

banip: update 1.0.0-4

* relax the firewall pre-check if fw4 is not running
* replace former stale tor feed source with 'https://www.dan.me.uk/torlist/?exit'
* add openvpn log term/search pattern example to the readme
* the default config now includes only log terms for dropbear and LuCI, all others are optional
* readme update

Signed-off-by: Dirk Brenken <redacted>

freeradius3: update version 3.2.4

https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_2_4

don't make the DH file. It's not needed for OpenSSL >=1.1.0
FreeRADIUS/freeradius-server@afbf93b

update freeradius version 3.2.4

added freeradius3 package module

Signed-off-by: Esaaprilia Salsabila <redacted>

openvpn: update to 2.6.11

This is a bugfix release containing several security fixes.

Security fixes
--------------
 - CVE-2024-4877: Windows: harden interactive service pipe.
   Security scope: a malicious process with "some" elevated privileges
   could open the pipe a second time, tricking openvn GUI
   into providing user credentials (tokens),  getting full access
   to the account openvpn-gui.exe runs as.

 - CVE-2024-5594: control channel: refuse control channel messages
   with nonprintable characters in them.
   Security scope: a malicious openvpn peer can send garbage to openvpn log,
   or cause high CPU load.

 - CVE-2024-28882: only call schedule_exit() once (on a given peer).
   Security scope: an authenticated client can make the server "keep the session"
   even when the server has been told to disconnect this client

Bug fixes
---------
 - fix connect timeout when using SOCKS proxies

 - work around LibreSSL crashing on OpenBSD 7.5 when enumerating ciphers

 - Add bracket in fingerprint message and do not warn about missing verification

For details refer to https://github.com/OpenVPN/openvpn/blob/v2.6.11/Changes.rst

Signed-off-by: Ivan Pavlov <redacted>

dnsdist: add config options for --uid and --gid

These options allow running dnsdist as a non-root user.

Signed-off-by: Sebastian Hamann <redacted>

docker-compose: Update to version 2.27.2

Release notes:
https://github.com/docker/compose/releases/tag/v2.27.2

Signed-off-by: Javier Marcet <redacted>

xray-core: update to 1.8.16

Signed-off-by: Milinda Brantini <redacted>

natmap: reset PKG_RELEASE to 1

Signed-off-by: Milinda Brantini <redacted>

qbee-agent: new package qbee-agent 2024.23

Signed-off-by: Jon Henrik Bjørnstad <redacted>

yt-dlp: Update to 2024.5.27

Set PYPI_SOURCE_NAME for downloading.
Add python-hatchling as host build dependencies.

Signed-off-by: Ryan Keane <redacted>

aardvark-dns: update to 1.11.0

changelogs:
https://github.com/containers/aardvark-dns/compare/v1.10.0...v1.11.0

Signed-off-by: Milinda Brantini <redacted>

tailscale: Update to 1.68.1

Signed-off-by: Zephyr Lykos <redacted>

dnsdist: update to 1.9.5

Signed-off-by: Peter van Dijk <redacted>

perl: update version 5.40.0

https://metacpan.org/release/HAARG/perl-5.40.0

remove bytes_heavy.pl
Perl/perl5#22047

perl update version 5.40.0

Signed-off-by: Esaaprilia Salsabila <redacted>

delve: Remove maintainership

Signed-off-by: Niels Widger <redacted>
Signed-off-by: Niels Widger <redacted>

delve: update to 1.22.1

Signed-off-by: Aleksey Kolosov <redacted>

Merge pull request #24414 from Ra2-IFV/curl

curl: upstream backports for mbedtls

curl: upstream backports for mbedtls

tlsv1.3 support is broken in curl 8.8.0 with mbedtls 3.6.0.
See curl/curl#13653 and Mbed-TLS/mbedtls#9210 for more details.
A workaround was implemented in upsteam code, see curl/curl@0c4b4c1 and curl/curl@5f9017d
This commit includes patches generated from upstream commits.

fix #24365 #24386

Signed-off-by: Ryan Keane <redacted>

cloudflared: Add more run parameters in UCI

https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-run-parameters/

Close #24122

Signed-off-by: Ryan Keane <redacted>

v2raya: update to 2.2.5.5

Fix: docker dev environment build.
Remove is-text in button style.
Add tun mode with sing-tun.
Publish docker images on Github Container Registry.
Ci: add separated singtun workflow.

Signed-off-by: Milinda Brantini <redacted>

yggdrasil: bump to 0.5.6

Signed-off-by: William Fleurant <redacted>

yggdrasil-jumper: bump to 0.3.1

Signed-off-by: Remy D. Farley <redacted>

ngtcp2: Update to 1.6.0

Signed-off-by: Ryan Keane <redacted>

nghttp3: Update to 1.4.0

Signed-off-by: Ryan Keane <redacted>

cloudflared: Update to 2024.6.1

Signed-off-by: Milinda Brantini <redacted>

dnslookup: Update to 1.11.0

Signed-off-by: Milinda Brantini <redacted>

frr: link zlib in host build

Due to changes in elfutils in order to
simplify the build for static libraries only,
the zlib functions that libelf depends on
are no longer linked within the static libelf library.

If frr were to use pkg-config, no change would be necessary,
however, the AC_CHECK_LIB macro is used, so add the link manually.

Signed-off-by: Michael Pratt <redacted>

banip: update 1.0.0-3

* fixed a regression in the split Set function (reported in the forum)
* fixed regex for urlhaus feed

Signed-off-by: Dirk Brenken <redacted>

xray-core: update to 1.8.15

Signed-off-by: Milinda Brantini <redacted>

knxd: bump to new release 0.14.62

Signed-off-by: Othmar Truniger <redacted>

knot: update to version 3.3.6

Signed-off-by: Jan Hák <redacted>

nginx: bump to 1.26.1 release

Bump nginx to 1.26.1 release.

Signed-off-by: Christian Marangi <redacted>

uwsgi: bump to latest 2.0.26 release

Bump to latest 2.0.26 release

apache2/mod_proxy_uwsgi: let httpd handle CL/TE for non-http handlers CVE-2024-24795 (Eric Covener)
remove race-condition over termination of uWSGI process when using need-app and lazy-apps (Hanan .T)
fix 32-bit compilation with GCC14 (Rosen Penev)
uwsgiconfig: get compiler version with -dumpfullversion (Riccardo Magliocchetti)
Fix uwsgi_regexp_match() with pcre2 (Alexandre Rossi)

Signed-off-by: Christian Marangi <redacted>

libcbor: fix license info in Makefile

libcbor is licensed under the MIT license as per:
https://github.com/PJK/libcbor/tree/master#license

Update package Makefile to reflect the same

Signed-off-by: Rahul Thakur <redacted>

tgt: update to 1.0.92

refresh patches and build flags according to the upstream changes

Signed-off-by: Maxim Storchak <redacted>

libfido2: fix license info in Makefile

libfido2 is licensed under the BSD 2-clause license as per:
https://github.com/Yubico/libfido2/

Update package Makefile to correctly reflect this.

Signed-off-by: Rahul Thakur <redacted>

tailscale: Update to 1.68.0

Signed-off-by: Milinda Brantini <redacted>

ruby: update to 3.3.3

Ruby 3.3 adds a new parser named Prism, uses Lrama as a parser
generator, adds a new pure-Ruby JIT compiler named RJIT, and many
performance improvements especially YJIT.

See: https://www.ruby-lang.org/en/news/2023/12/25/ruby-3-3-0-released/

The 3.3.1 release includes security fixes.

- CVE-2024-27282: Arbitrary memory address read vulnerability with Regex search
- CVE-2024-27281: RCE vulnerability with .rdoc_options in RDoc
- CVE-2024-27280: Buffer overread vulnerability in StringIO

See: https://www.ruby-lang.org/en/news/2024/04/23/ruby-3-3-1-released/

The 3.3.2 release includes many bug-fixes.

See: https://www.ruby-lang.org/en/news/2024/05/30/ruby-3-3-2-released/

Packaging changes since 3.2.2:
- New packages: ruby-prism and ruby-rjit
- Added /usr/bin/rdbg to ruby-debug
- Added /usr/bin/syntax_suggest to ruby-syntax_suggest

The 3.3.3 release includes:

- RubyGems 3.5.11
- Bundler 2.5.11
- REXML 3.2.8
- strscan 3.0.9
- --dump=prism_parsetree is replaced by --parser=prism --dump=parsetree
- Invalid encoding symbols raise SyntaxError instead of EncodingError
- Memory leak fix in Ripper parsing
- Bugfixes for YJIT, **{}, Ripper.tokenize,
- RubyVM::InstructionSequence#to_binary, --with-gmp, and some build
  environments

See: https://www.ruby-lang.org/en/news/2024/06/12/ruby-3-3-3-released/

Signed-off-by: Luiz Angelo Daros de Luca <redacted>

haproxy: update to v3.0.2

- Update haproxy PKG_VERSION and PKG_HASH
- See changes: http://git.haproxy.org/?p=haproxy-3.0.git;a=shortlog

Signed-off-by: Christian Lachner <redacted>

unbound: Update to 1.20.0

Updated 010-configure-uname.patch as source changed.
Removed 100-example-conf-in.patch as not needed any more.

Release message:

This release has a fix for the DNSBomb issue CVE-2024-33655. This has a
low severity for Unbound, since it makes Unbound complicit in targeting
others, but does not affect Unbound so much.

To mitigate the issue new configuration options are introduced.
The options discard-timeout: 1900, wait-limit: 1000
and wait-limit-cookie: 10000 are enabled by default. They limit the
number of outstanding queries that a querier can have. This limits
the reply pulse, and make Unbound less favorable for the issue.
With the config wait-limit-netblock and wait-limit-cookie-netblock
the parameters can be fine tuned for specific destinations.
More information on the attack and Unbound's mitigations are
presented further down.

Other fixes in this release are that Unbound no longer follows symlinks
when truncating the pidfile. Unbound also does not chown the pidfile,
this is for safety reasons. There are also a number of fixes for RPZ, in
handling CNAMEs. There is a memory leak fix for the edns client subnet
cache. For DNSSEC validation a case is fixed when the query is of type
DNAME. The unbound-anchor program is fixed to first write to a temporary
file, before replacing the original. This handles disk full situations,
and because of it unbound-anchor needs permission to create that file,
in the same directory as the original file. There is also a fix for
IP_DONTFRAG, to disable fragmentation instead of the opposite.

The option cache-min-negative-ttl can be used to set the minimum TTL
for negative responses in the cache. It complements existing options to
set the maximum ttl for negative responses and to set the minimum and
maximum ttl but not specifically for negative responses.

The option cachedb-check-when-serve-expired option makes Unbound use
cachedb to check for expired responses, when serve-expired is enabled,
and cachedb is used. It is enabled by default.

The -q option for unbound-checkconf can be added to silence it when
there are no errors.

Signed-off-by: Ryan Keane <redacted>

powertop: update to 2.15

Release mainly focuses on bug fixes and patching compatibility issues.
Also, adds support to multiple platforms.
Removed obsolete patch as upstream has fixed.

Signed-off-by: Milinda Brantini <redacted>

hplip: update to 3.23.12

See: https://developers.hp.com/hp-linux-imaging-and-printing/release_notes

Signed-off-by: Luiz Angelo Daros de Luca <redacted>

libvpx: update to 1.14.1

This release includes enhancements and bug fixes.
This release is ABI compatible with the previous release.

See: https://github.com/webmproject/libvpx/releases/tag/v1.14.1

Signed-off-by: Luiz Angelo Daros de Luca <redacted>

squid: update to 6.10

Remove one patch - instead of messing with BUILDCXXFLAGS there we
properly define it via CONFIGURE_ARGS inside Makefile of the package.

Refresh remaining patch.

Signed-off-by: Aleksey Vasilenko <redacted>

banip: update 1.0.0-2

* fixed a possible "Argument list too long" error in the f_log function
* fixed multiple, incomplete digit character classes
* fixed/optimized split file handling
* cosmetics

Signed-off-by: Dirk Brenken <redacted>

sqm-scripts-extra: remove the ancient package

Remove the ancient package with experimental cake options,
from time when cake was not yet officially here.

Signed-off-by: Hannu Nyman <redacted>

prometheus-node-exporter-lua: Add optional mwan3 collector

Supports interface metrics exposed by mwan3. The performance is a
little slow compared to other collectors (~300ms) as the ubus call is
where most of the time is spent. Any future speedups are likely better
put into mwan3's rpcd binary.

Signed-off-by: Ryan Doyle <redacted>
[rename metrics,bump version]
Signed-off-by: Etienne Champetier <redacted>

prometheus-node-exporter-lua: Add "node_textfile_mtime_seconds" metric

…for textfile collector, to make it more consistent with the upstream
Prometheus node-exporter

Signed-off-by: Rob Hoelz <redacted>
[bump version]
Signed-off-by: Etienne Champetier <redacted>

haproxy: update to v3.0.1

- Update haproxy PKG_VERSION and PKG_HASH
- See changes: http://git.haproxy.org/?p=haproxy-3.0.git;a=shortlog

Signed-off-by: Christian Lachner <redacted>

croc: update to 10.0.8

release notes:
10.0.6: https://github.com/schollz/croc/releases/tag/v10.0.6
10.0.7: https://github.com/schollz/croc/releases/tag/v10.0.7
10.0.8: https://github.com/schollz/croc/releases/tag/v10.0.8

Signed-off-by: Jonas Jelonek <redacted>

eza: update to 0.18.18

release notes:
0.18.16: https://github.com/eza-community/eza/releases/tag/v0.18.16
0.18.17: https://github.com/eza-community/eza/releases/tag/v0.18.17
0.18.18: https://github.com/eza-community/eza/releases/tag/v0.18.18

Signed-off-by: Jonas Jelonek <redacted>

lua-eco: update to 3.5.2

Signed-off-by: Jianhui Zhao <redacted>

prometheus-node-exporter-lua: remove duplicated nat samples

Merge duplicate src/dest samples by suming their value (bytes count)

Fixes #24166

Signed-off-by: Antoine C <redacted>
[bump version number]
Signed-off-by: Etienne Champetier <redacted>

apfree-wifidog: update to 7.06.2008

Signed-off-by: Dengfeng Liu <redacted>

apfree-wifidog: support rule group and websocket&dns proxy flag

Signed-off-by: Dengfeng Liu <redacted>

btrfs-progs: update to 6.9

GCC14 is now supported in this release.
Release notes: https://github.com/kdave/btrfs-progs/releases/tag/v6.9

Signed-off-by: Ryan Keane <redacted>

Merge pull request #24370 from osedlbauer/pr/20240611-modemmanager-force-connection

modemmanager: improve reconnect handling

Merge pull request #24367 from mhei/php8-update-to-8.3.8-with-libgd-fixup

php8: workaround libgd capability detection (refs #23846)

tor: update to 0.4.8.12 stable

Minor release, see the changelog [1] for what's new.

[1] https://gitlab.torproject.org/tpo/core/tor/-/blob/tor-0.4.8.12/ChangeLog

Signed-off-by: Rui Salvaterra <redacted>

modemmanager: remove status message from errors

The message 'MM_CONNECT_IN_PROGRESS' is a status message, not an error
message. To avoid confusion, the message has been removed.

Signed-off-by: Oliver Sedlbauer <redacted>

modemmanager: add option to force connection

This commit improves the automatic reconnect logic. If the modem cannot
establish a connection, for example due to poor reception, the
proto_block_restart prevents the interface from trying to reconnect.
To enforce the connection, this commit adds a new option that allows the
system to attempt to establish a connection indefinitely.

Signed-off-by: Oliver Sedlbauer <redacted>

adguardhome: Update to 0.107.51

View the release notes for more information:
https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.51

Signed-off-by: Milinda Brantini <redacted>

collectd: fix compilation with GCC14

Upstream backport.

Signed-off-by: Rosen Penev <redacted>

softethervpn5: update to 5.02.5184

Fixes compilation with GCC14.

Signed-off-by: Rosen Penev <redacted>