snort3: update to 3.1.57.0

Upstream bump

Signed-off-by: John Audia <therealgraysky@proton.me>

sqlite3: Update to 3.41.1

Removed `SQLITE3_JSON1` option as it was dropped by upstream.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

Merge pull request #20621 from banburybill/ddns-mythic-v2

ddns-scripts: Add v2 API for mythic-beasts.com provider

dockerd: Disabled MIPS
* Buildkit doesn't appear to compile

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

dockerd: Update to 23.0.1

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

docker: Update to 23.0.1

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

containerd: Update to 1.6.16 for dockerd

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

libnetwork: Remove unused package

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

zerotier: update to 1.10.4

Signed-off-by: Moritz Warning <moritzwarning@web.de>

rust-lang: update to 1.68.0

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

netbird: update to 0.14.3

Bug fixes & refactor

Release notes:
 - Fix: send remote agents updates when peer re-authenticates

Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>

CI: update build architectures

Removed arc_archs - archs38 was marked as source-only [1].
Renamed powerpc_8540 to powerpc_8548 [2].

1. https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=c01641bcc7236d2e2de3ea65444b0cf2898df351
2. https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=2cad88b99fdae9766de84e6c1cb56f111eb53748

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

v2ray-geodata: Update to latest version

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

xray-core: Update to 1.8.0

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

Merge pull request #20261 from pprindeville/strongswan-update-5.9.9

strongswan: Update to 5.9.9

strongswan: Update to 5.9.9

Add patch to remove definition of RNG leaking in from wolfssl.h.

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>

libdaq3: update to 3.0.11

Upstream bump

Build system: x86_64
Build-tested: bcm2711/RPi4B
Run-tested: bcm2711/RPi4B

Signed-off-by: John Audia <therealgraysky@proton.me>

snort3: update to 3.1.56.0

Upstream bump

Build system: x86_64
Build-tested: bcm2711/RPi4B
Run-tested: bcm2711/RPi4B

Signed-off-by: John Audia <therealgraysky@proton.me>

lolcat: update to version 1.4

Bump to the latest stable release.

Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>

Merge pull request #20645 from stangri/master-simple-adblock

simple-adblock: update init file and config

Merge pull request #20648 from champtar/mv88e6xxx_dump_update

mv88e6xxx_dump: update to 2023.03.08

mv88e6xxx_dump: update to 2023.03.08

This fixes 2 issues where mv88e6xxx_dump was displaying
data incorrectly for --vtu and --global2

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>

simple-adblock: update init file and config

* move network.sh and jshn.sh includes into load_validate_config function
  to prevent errors when adding the package to image with the Image Builder
* add @bongochong compressed domains block-list to the config

Signed-off-by: Stan Grishin <stangri@melmac.ca>

netifyd: update to v4.4.1

- Explicitly request the C++11 standard (codebase is not C++17 compliant).
- Removed categories.json from conffiles -- it's not a configuration
  file.
- Removed commented-out convenience git hash place-holder -- for some
  reason it irritates people.
- Added radix header file to devel files.
- Removed redundant call to Build/Configure (not needed).

Co-authored-by: Tianling Shen <cnsztl@gmail.com>
Signed-off-by: Darryl Sokoloski <darryl@sokoloski.ca>

protobuf-c: update to 1.4.1

Signed-off-by: Rosen Penev <rosenp@gmail.com>

ksmbd-tools: update to 3.4.7

Remove upstreamed patches.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

icu: fix ccache issue

build error with ccache:
https://github.com/openwrt/packages/issues/20618

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

Revert "libgpiod: update to 2.0"

This reverts commit 983835afe6fad074b347a8ff1dc8986d40773de5.

I merged the library update to v2.0 to fast, it breaks openocd build
due to API change.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

Revert "libgpiod: introduce libgpiodcxx package for C++ binding"

This reverts commit 82ea104b978dcd84919dfe5d1ee630791d85df10.

I merged the library update to v2.0 to fast, it breaks openocd build
due to API change.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

Merge pull request #20609 from mhei/libgpiod-update-2.0

libgpiod: update to 2.0 and introduce C++ binding

banip: update 0.8.2-2

* fix the auto-detection for pppoe and 6in4 tunnel interfaces
* add the new 'ban_nftpolicy' option to expose the nft set policy, values: memory (default), performance
* add the new 'ban_nftlogevel' option to expose the nft syslog level, values: emerg, alert, crit, err, warn (default),
  notice, info, debug, audit
* status optimizations
* logging optimizations
* update the readme

Signed-off-by: Dirk Brenken <dev@brenken.org>

rust-lang: Add an Host/Compile helper as well

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

rust-lang: Apply suggestions from code review

Co-authored-by: Tianling Shen <cnsztl@gmail.com>
Signed-off-by: Luca Barbato <luca.barbato@gmail.com>

maturin: Add package

Build tool for rust-python packages.

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

ripgrep: Add the package

Based on work from Donald Hoskins <grommish@gmail.com>.
Testcase for the rust language support.

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

rust-lang: Add the rust language support

Based on work from Donald Hoskins <grommish@gmail.com>.

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

lua-eco: update to 2.2.0

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>

Merge pull request #20594 from stintel/miniupnpd

miniupnpd: bump to 2.3.3

miniupnpd: bump to 2.3.3

Fixes: #19637
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>

openblas: don't allow ccache use

Fixes https://github.com/openwrt/packages/issues/20596

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>

ddns-scripts: Add v2 API for mythic-beasts.com provider

Use USERNAME as the key, PASSWORD as the secret.

Signed-off-by: Jim Hague <jim.hague@acm.org>

udp-broadcast-relay-redux-openwrt: add cgroupsns to jail

Added `cgroupsns` to jail, otherwise you get this failure:
```
Mon Mar  6 14:46:05 2023 user.err : jail: Not using namespaces, capabilities or seccomp !!!
```
Error is here, seems to indicate that we're running a jail without using any capability.
https://lxr.openwrt.org/source/procd/jail/jail.c#L2847

Decided to use minimal effort approach

Signed-off-by: BackSlasher <nitz.raz@gmail.com>

cni-protocol: new package

simple protocol support script for netifd.

netifd protocol support for cni networks makes
defining network for podman and other similar
systems using cni networking much easier and simpler.

with cni protocol support, on a cni network, where firewall
and portmapper is disabled, you may control firewalling
with openwrt's standard firewall configuration.

for example, create a container that hosts web content on
port 80 with static ip on your cni network, if your
network is 10.88.0.0/16, use for eg. 10.88.0.101 as
your containers static ip address. Create a zone, cni
to your firewall and add your interface to it.

Now you can easily set up redirectiong to 10.88.0.101:80
to expose it's port 80 to wan for serving your website.

Protocol has only one setting: device, on podman this
often is cni-podman0. This protocol may also be used
on other equillavents, such as netavark (cni replacement
in podman), where device as default is podman0.

Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>

pdns-recursor: update to 4.8.3

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>

Merge pull request #20584 from mpeleshenko/samba4-4.17.5

samba4: update to 4.17.5

libgpiod: introduce libgpiodcxx package for C++ binding

This adds a new package for the C++ binding.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

libgpiod: update to 2.0

This updates this library to the latest major version.

Since the Python binding build changed in this version,
let's switch to the Py3Package infrastructure.

Also the older v1 kernel interface is not used anymore,
so we can drop this part of the kernel configuration.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

modemmanager: bump to 1.20.6

Signed-off-by: Kuan-Yi Li <kyli@abysm.org>

libqmi: bump to 1.32.4

Signed-off-by: Kuan-Yi Li <kyli@abysm.org>

libmbim: bump to 1.28.4

Signed-off-by: Kuan-Yi Li <kyli@abysm.org>

frp: update to 0.48.0

Changelog: https://github.com/fatedier/frp/releases/tag/v0.48.0

Signed-off-by: Van Waholtz <brvphoenix@gmail.com>

frp: update to 0.47.0

A restart is only required if `$conf_file` has been modified.

Signed-off-by: Van Waholtz <brvphoenix@gmail.com>

samba4: update to 4.17.5

* update to 4.17.5
* changelog: https://www.samba.org/samba/history/samba-4.17.5
* refresh patch

* CVE-2022-42898: Samba's Kerberos libraries and AD DC failed to guard against integer overflows when parsing a PAC on a 32-bit system, which allowed an attacker with a forged PAC to corrupt the heap.
 https://www.samba.org/samba/security/CVE-2022-42898.html

* CVE-2022-37966: This is the Samba CVE for the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability disclosed by Microsoft on Nov 8 2022.

  A Samba Active Directory DC will issue weak rc4-hmac session keys for use between modern clients and servers despite all modern Kerberos implementations supporting the aes256-cts-hmac-sha1-96 cipher.

  On Samba Active Directory DCs and members 'kerberos encryption types = legacy' would force rc4-hmac as a client even if the server supports aes128-cts-hmac-sha1-96 and/or aes256-cts-hmac-sha1-96.
  https://www.samba.org/samba/security/CVE-2022-37966.html

* CVE-2022-37967: This is the Samba CVE for the Windows Kerberos Elevation of Privilege Vulnerability disclosed by Microsoft on Nov 8 2022.

  A service account with the special constrained delegation permission could forge a more powerful ticket than the one it was presented with.
  https://www.samba.org/samba/security/CVE-2022-37967.html

* CVE-2022-38023: The "RC4" protection of the NetLogon Secure channel uses the same algorithms as rc4-hmac cryptography in Kerberos, and so must also be assumed to be weak.
  https://www.samba.org/samba/security/CVE-2022-38023.html

* BUG 15210: synthetic_pathref AFP_AfpInfo failed errors.
  This resolves errors logged during macOS TimeMachine backups.
  https://bugzilla.samba.org/show_bug.cgi?id=15210

Signed-off-by: Michael Peleshenko <mpeleshenko@gmail.com>

lua-eco: update to 2.1.0

* updated description
* switched default SSL engine to mbedtls
* added new network module

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>

tmate-ssh-server: fix build against msgpack-c 6.0

This patch is taken from
https://git.alpinelinux.org/aports/commit/?id=f923597f4bdea424dc28b1d026269df060596fac

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

tmate: fix build against msgpack-c 6.0

This patch is taken from
https://git.alpinelinux.org/aports/commit/?id=f923597f4bdea424dc28b1d026269df060596fac

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

msgpack-c: Update to 6.0.0

Removed 010-no-gtest.patch as upstream no longer detects it.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

banip: release 0.8.2-1

* major performance improvements: clean-up/optimize all nft calls
* add a new "ban_reportelements" option,
  to disable the (time consuming) Set element count in the report (enabled by default)
* update the readme

Signed-off-by: Dirk Brenken <dev@brenken.org>

yt-dlp: update to 2023.3.4

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>

adguardhome: bump to 0.107.25

* Full changelog available at:
  * https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.25

Signed-off-by: Dobroslaw Kijowski <dobo90@gmail.com>

adguardhome: enable legacy openssl provider for nodejs

Currently compilation fails because of:
```
  opensslErrorStack: [ 'error:03000086:digital envelope routines::initialization error' ],
  library: 'digital envelope routines',
  reason: 'unsupported',
  code: 'ERR_OSSL_EVP_UNSUPPORTED'
```

What's interesting package gets built but when trying to access UI there's
`404: page not found` error.

It has been reported in multiple places:
* https://github.com/AdguardTeam/AdGuardHome/issues/5559
* https://github.com/AdguardTeam/AdGuardHome/issues/4595

Signed-off-by: Dobroslaw Kijowski <dobo90@gmail.com>

Merge pull request #20608 from micmac1/tiff-no-deflate

tiff: force libdeflate support to off

v2raya: switch to use nftables

Backport a pending PR to add nftables support.
Upstream PR: https://github.com/v2rayA/v2rayA/pull/805

As nftables merged ipv4/ipv6 support into a single command, so simply
enable ipv6 support by default.

While at it, backport a upstreamed fix for simple-obfs plugin.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

perl-ack: Update to 3.7.0

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 26b92db22c9a051447ee445acaa11a795fb35a4e)

tiff: force libdeflate support to off

Commit 81d2b72 added a package providing libdeflate. Tiff by default
links to it, causing a build error.

Package libtiff is missing dependencies for the following libraries:
libdeflate.so.0

This commit forces libdeflate use off to avoid this. No revision bump is
done because the package is currently not compiling anyway.

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>

netbird: update to 0.14.2

Update from 0.12.0 -> 0.14.2
Release notes: https://github.com/netbirdio/netbird/releases

Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>

conmon: update to 2.1.7

 - Fix leaking symbolic links in the opt_socket_path directory
 - cgroup: Stumble on if we can't set up oom handling

Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>

coremark: bump to 2023-01-25

Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>

transmission: update to version 4.0.1

This is a major release, both in numbering and in effort! It's been in
active development for over a year and has a huge list of changes --
over a thousand commits -- since Transmission 3.00.

For more information about the release see
https://github.com/transmission/transmission/releases/tag/4.0.0
https://github.com/transmission/transmission/releases/tag/4.0.1

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

libutp: add package

Add Transmission version of the uTorrent Transport Protocol library.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

libdht: add package

Add Kademlia Distributed Hash Table (DHT) library.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

libdeflate: add package

Add package for libdeflate which is a library for fast, whole-buffer
DEFLATE-based compression and decompression.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

libb64: add package

Add generic base64 encode/decode (static) library.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

banip: update 0.8.1-3

* finalized the LuCI frontend preparation (this is the minmal version to use the forthcoming LuCI frontend)
* added a Set survey, to list all elements of a certain set
* changed the default logterm for asterisk
* update the readme

Signed-off-by: Dirk Brenken <dev@brenken.org>

sing-box: update to 1.1.6

Signed-off-by: Van Waholtz <brvphoenix@gmail.com>

sing-box: add necessary dependencies and cleanup Makefile

1. Add `kmod-inet-diag` as a dependency since it is needed for https://sing-box.sagernet.org/configuration/dns/rule/#process_name
2. Remove redundant `default n` (https://github.com/openwrt/openwrt/commit/8bc72ea7be3976711dacc09f0fdab061d6e5152a)

Signed-off-by: Van Waholtz <brvphoenix@gmail.com>

haproxy: update to v2.6.9

- Update haproxy download URL and hash
- This release fixes a critial flaw known as CVE-2023-25725. See:
  http://git.haproxy.org/?p=haproxy-2.6.git;a=commit;h=73be199c4f5f1ed468161a4c5e10ca77cd5989d8

Signed-off-by: Christian Lachner <gladiac@gmail.com>

Merge pull request #20570 from pprindeville/isc-dhcp-allow-no-default-route

isc-dhcp: allow no default route

netbird: new package

Netbird is similar vpn service as tailscale and zerotier.

Description:
NetBird is an open-source VPN management platform built on top of WireGuard® making it easy to create secure private networks for your organization or home.
It requires zero configuration effort leaving behind the hassle of opening ports, complex firewall rules, VPN gateways, and so forth.

Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>

open-vm-tools: update to 12.1.5

added also --disable-glibc-check to configure args to allow building
on hosts that use musl.

Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>

acme: fix incompatibilty with image builder

Signed-off-by: Glen Huang <i@glenhuang.com>

Merge pull request #20563 from paper42/clamav-0.104.4

clamav: update to 0.104.4

v2raya: drop wrong patches

These patches should not be backported to OpenWrt, otherwise tproxy
won't work for devices connected to br-lan (bypassed by the fw rules).

We have introduced a new compile-time flag for new version (which
is not released yet), but it's unnecessray to backport redudant
patches as here is still at the old version.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

yq: Update to 4.31.2

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

cloudflared: Update to 2023.3.0

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

isc-dhcp: allow suppression of default gateway

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>

isc-dhcp: make indent consistent in config

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>

acme: merge cli into init script

Signed-off-by: Glen Huang <i@glenhuang.com>

qemu: update to 7.2.0

drop disas and bios patches
refresh patches

qemu: vhost-scsi does not exist, drop unsupported vhost options

qemu: disable VDUSE by default

qemu: slirp and vnc-png option gone

Note: libpng still needed if vnc enabled.

Link: https://github.com/openwrt/packages/pull/18623
Signed-off-by: Vladimir Ermakov <vooon341@gmail.com>
(squash commits)
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>

nfs-kernel-server: update to v2.6.2

Also added patch that is from alpine's same package to assist building on musl.
Hostpkg build on musl also kept failing, so I added few more overrides, which
made it work perfectly.

Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>

lua-eco: update to 2.0.0

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>

cloudflared: Update to 2023.2.2

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

sed: remove old libpcre dependency

Signed-off-by: Alan Swanson <reiver@improbability.net>

podman: update to v4.4.2

Security:
 - This release fixes CVE-2023-0778, which allowed a malicious user to potentially replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.

Bugfixes:
 - Fixed a bug where containers started via the podman-kube systemd template would always use the "passthrough" log driver (#17482).
 - Fixed a bug where pulls would unexpectedly encounter an EOF error. Now, Podman automatically transparently resumes aborted pull connections.
 - Fixed a race condition in Podman's signal proxy.

Misc:
 - Updated the containers/image library to v5.24.1.

Patch also refreshed

Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>

Merge pull request #20467 from tobiaspc/njalla

ddns-scripts: Add njal.la provider

Merge pull request #20540 from stangri/master-curl

curl: update to 7.88.1

node: bump to v18.14.2

Update to v18.14.2
Support for OpenSSL v3.0.x

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

i2pd: update to version 2.46.1

Maintainer   : @yangfl (David Yang)
Build system : Arch Linux x86_64
Build tested : r7800 OpenWrt git master (r22104-01262c921c)
Run tested   : r7800 OpenWrt git master (r22104-01262c921c)

Signed-off-by: Daniel Bermond <danielbermond@gmail.com>

perl-www-curl: add patch to ensure compatibility with curl 7.88

Patch comes from
https://github.com/openwrt/packages/pull/20540#issuecomment-1439537287

Fixes:
/home/username/works/openwrt/staging_dir/target-x86_64_glibc_custom/usr/include/curl/curl.h:2515:3: note: declared here
 2515 |   CURLFORM_CONTENTTYPE     CURL_DEPRECATED(7.56.0, "Use curl_mime_type()"),
      |   ^~~~~~~~~~~~~~~~~~~~
make[3]: *** [Makefile:347: Curl.o] Error 1

Signed-off-by: Stan Grishin <stangri@melmac.ca>

crowdsec: update to 1.4.6
Update crowdsec to latest upstream release version 1.4.6

Signed-off-by: S. Brusch <ne20002@gmx.ch>
Maintainer: Kerma Gérald <gandalf@gk2.net>
Run tested: ipq40xx/generic, Fritzbox 4040, Openwrt 22.03.3