zerotier: update to 1.12.2

see changelog: https://github.com/zerotier/ZeroTierOne/releases/tag/1.12.2.

Signed-off-by: Leo Douglas <douglarek@gmail.com>

sing-box: update to 1.4.3

see changelog: https://github.com/SagerNet/sing-box/releases/tag/v1.4.3

Signed-off-by: Leo Douglas <douglarek@gmail.com>

tailscale: set nftables as default

This changes the default firewall method used by Tailscale to nftables.
The 'autodetection' mode is only supported by arm64 and amd64 for now[1].
This causes mips devices to not do proper detection and incorrectly default back to
iptables.

I added a fw_mode variable to the tailscale.conf file that could be
set to iptables for easy conversion for someone still using iptables.
I was able to test on an older mips device and my current aarch64
without issues.

Also a few readme updates to bring it up to the current status.

1. https://github.com/tailscale/tailscale/blob/dc7aa98b768bf82017aa5cc82a62dd4d685f811d/util/linuxfw/linuxfw_unsupported.go#L4C58-L4C58

Signed-off-by: Tyler Young <git@yfh.addy.io>

snort3: update to 3.1.70.0

Build system: x86/64
Build-tested: x86/64/AMD Cezanne
Run-tested: x86/64/AMD Cezanne

   ,,_     -*> Snort++ <*-
  o"  )~   Version 3.1.70.0
   ''''    By Martin Roesch & The Snort Team
           http://snort.org/contact#team
           Copyright (C) 2014-2023 Cisco and/or its affiliates. All rights reserved.
           Copyright (C) 1998-2013 Sourcefire, Inc., et al.
           Using DAQ version 3.0.12
           Using LuaJIT version 2.1.0-beta3
           Using OpenSSL 3.0.10 1 Aug 2023
           Using libpcap version 1.10.4 (with TPACKET_V3)
           Using PCRE version 8.45 2021-06-15
           Using ZLIB version 1.2.13
           Using Hyperscan version 5.4.2 2023-09-07

Signed-off-by: John Audia <therealgraysky@proton.me>

python-setuptools: Update to 68.2.0

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

python-build: Update to 1.0.3

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

Merge pull request #22095 from jefferyto/rust-arch-depends

rust: Move RUST_ARCH_DEPENDS into rust-values.mk

dnsdist: update to 1.8.1

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>

rust: Move RUST_ARCH_DEPENDS into rust-values.mk

This allows other packages access to RUST_ARCH_DEPENDS by including
rust-values.mk, instead of rust-package.mk which also sets
Build/Compile.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

mwan3: fix mwan3_connected ubus output

During the renameing of mwan3_connected_v4 to mwan3_connected_ipv4 and
mwan3_connected_v6 to mwan3_connected_ipv6 the adjustment in the ubus
call was forgotten. This commit fixes this.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

dawn: Add PKG_BUILD_FLAGS:=no-lto because lto causes strange SegFaults

Signed-off-by: Carsten Schuette <schuettecarsten@googlemail.com>

dawn: Update to 2023-05-14

Signed-off-by: Carsten Schuette <schuettecarsten@googlemail.com>

Merge pull request #22083 from jefferyto/golang-1.21.1

golang: Update to 1.21.1

golang: Update to 1.21.1

Includes fixes for:

* CVE-2023-39318: html/template: improper handling of HTML-like comments
  within script contexts

* CVE-2023-39319: html/template: improper handling of special tags
  within script contexts

* CVE-2023-39320: cmd/go: go.mod toolchain directive allows arbitrary
  execution

* CVE-2023-39321 and CVE-2023-39322: crypto/tls: panic when processing
  partial post-handshake message in QUICConn.HandleData

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

Merge pull request #21935 from G10h4ck/libssh-mbedtls

libssh: compile against MbedTLS instead of OpenSSL

Merge pull request #21958 from graysky2/ncdu

ncdu: update to 1.18.1

Merge pull request #21856 from AuthorReflex/ovpn-2.6.6

openvpn: update to 2.6.6

Merge pull request #22072 from commodo/python-updates1

chardet,numpy,django: bump versions

Merge pull request #22043 from jefferyto/python-crcmod-package-section

python-crcmod: Fix package section

Merge pull request #22067 from robimarko/dbus

dbus: update to 1.14.10 and take ower maintainership

Merge pull request #22030 from BKPepe/retake-packages

treewide: take maintainership from Karel

Merge pull request #22039 from jefferyto/xmltodict-0.13.0

xmltodict: Update to 0.13.0, rename source package

Merge pull request #22038 from jefferyto/ruamel-yaml-0.17.32

ruamel-yaml: Update to 0.17.32, rename source package

Merge pull request #22037 from jefferyto/python-zipp-3.16.2

python-zipp: Update to 3.16.2, update list of dependencies

Merge pull request #22036 from jefferyto/python-zeroconf-0.97.0

python-zeroconf: Update to 0.97.0, update list of dependencies

Merge pull request #22035 from jefferyto/python-yaml-6.0.1

python-yaml: Update to 6.0.1

Merge pull request #22034 from jefferyto/python-build-1.0.0

python-build: Update to 1.0.0

Merge pull request #22041 from jefferyto/python-cryptodomex-3.18.0

python-cryptodomex: Update to 3.18.0, refresh patches

Merge pull request #22040 from jefferyto/python-cryptodome-3.18.0

python-cryptodome: Update to 3.18.0, refresh patches

Merge pull request #22042 from jefferyto/python-pyserial-3.5

python-pyserial: Update to 3.5, update list of dependencies

Merge pull request #22069 from commodo/sudo

sudo: bump to verison 1.9.14p3

django: bump to version 4.2.5

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>

numpy: bump to version 1.25.2

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>

python-chardet: bump to 5.2.0

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>

sudo: bump to verison 1.9.14p3

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>

unbound: update to 1.18.0

Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>

dbus: take maintainership of the package

Since it seems that this nobody wants to be the maintainer of dbus,
I can take the responsibility.

I am no dbus expert, but can runtime test it and see if change seems
sane.

Signed-off-by: Robert Marko <robimarko@gmail.com>

dbus: update to 1.14.10 stable

Current stable branch for dbus is 1.14 and that is recommended to be used.
1.13 was a development branch and not meant for production use.

1.14.10 is the latest stable, so lets move to it.

Signed-off-by: Robert Marko <robimarko@gmail.com>

dbus: drop CMake patches

CMake is not being used to build dbus as it does not respect endinaness
under CMake and 1.14 branch.

So, lets drop the patches as they will not apply to future 1.14 update.

Signed-off-by: Robert Marko <robimarko@gmail.com>

Merge pull request #22062 from mhei/php8-update-to-8.2.10

php8: update to 8.2.10

pdns: update to 4.8.2

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>

haproxy: update to v2.8.3

- Update haproxy PKG_VERSION and PKG_HASH
- See changes: http://git.haproxy.org/?p=haproxy-2.8.git;a=shortlog

Signed-off-by: Christian Lachner <gladiac@gmail.com>

python3: Update to 3.11.5, refresh patches

Includes fix for CVE-2023-40217 (Bypass TLS handshake on closed
sockets).

This also:

* Remove 027-install-python3-symlink-after-stdlib.patch

  This was merged upstream in
  https://github.com/python/cpython/pull/104693.

* Remove fix for unnecessary linking with libbsd
  (60bf01cb606344619e002901646171da1e69c0f9)

  This was fixed upstream in
  https://github.com/python/cpython/pull/105236.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

slang2: Remove pcre module

pcre is obsolete and upstream has not yet migrated to pcre2.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

slang2: Avoid building dependencies unless necessary

This also hides the module packages in menuconfig unless the libslang2
package is selected.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

syncthing: update to 1.24.0

This package can be built with Go 1.21 and QUIC can be enabled.

Signed-off-by: Van Waholtz <brvphoenix@gmail.com>

Merge pull request #20803 from G-M0N3Y-2503/cache-domains-fix

cache-domains: Fixed config files being outside of jail

Merge pull request #22055 from pprindeville/modem-manager-fix-no-mbim-install

modemmanager: handle no *.conf files being installed

modemmanager: handle no *.conf files being installed

To begin with, there are only a couple of .conf files, and
one of them is for testing, and the other is only installed
when MBIM is enabled, so if you build without MBIM you'll
have a failing install:

  install -m0644 /home/pprindeville/work/openwrt/build_dir/target-x86_64_musl/modemmanager-1.20.6/ipkg-install/usr/share/ModemManager/*.conf /home/pprindeville/work/openwrt/build_dir/target-x86_64_musl/modemmanager-1.20.6/.pkgdir/modemmanager/usr/share/ModemManager
  install: cannot stat '/home/pprindeville/work/openwrt/build_dir/target-x86_64_musl/modemmanager-1.20.6/ipkg-install/usr/share/ModemManager/*.conf': No such file or directory
  make[2]: *** [Makefile:161: /home/pprindeville/work/openwrt/build_dir/target-x86_64_musl/modemmanager-1.20.6/.pkgdir/modemmanager.installed] Error 1
  make[2]: Leaving directory '/home/pprindeville/work/openwrt/feeds/packages/net/modemmanager'

So make sure there's anything there to copy over first.

Signed-off-by: Philip Prindeville <pprindeville@netgate.com>

v2ray-geodata: Update to latest version

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

v2raya: Update to 2.2.4

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

libedit: update to version 20230828-3.1

Signed-off-by: Jan Hák <jan.hak@nic.cz>

Merge pull request #21992 from osedl/pr/20230901-modemmanager-fix-permission-denied

modemmanager: Fix Permission Denied error

Merge pull request #21994 from danielpinto8zz6/fix-desec-update-dns

ddns-scripts: desec.io - update url to https

cache-domains: Fixed config files being outside of jail

This fix dnsmasq failing to startup once configured since the
cache-domains config files are not included in the jail that dnsmasq
runs inside.

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

lua-eco: update to 2.5.1

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>

ddns-scripts: desec.io - update url to https

Signed-off-by: Daniel Pinto <danielpinto8zz6@gmail.com>
desec.io ddns update is not working, after testing the endpoint I got a 301, after a bit of search I found out we are
supposed to use https instead of http
more info here: https://talk.desec.io/t/301-from-update-dedyn-io/644/2

bump PKG_RELEASE

python-crcmod: Fix package section

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

python-pyserial: Update to 3.5, update list of dependencies

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

python-cryptodomex: Update to 3.18.0, refresh patches

This also updates the list of dependencies.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

python-cryptodome: Update to 3.18.0, refresh patches

This also updates the list of dependencies.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

xmltodict: Update to 0.13.0, rename source package

This renames the source package to python-xmltodict to match other
Python packages.

This also updates the list of dependencies.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

ruamel-yaml: Update to 0.17.32, rename source package

This renames the source package to python-ruamel-yaml to match other
Python packages.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

python-zipp: Update to 3.16.2, update list of dependencies

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

python-zeroconf: Update to 0.97.0, update list of dependencies

The package changed to the poetry-core build backend (and also requiring
python-cython/host).

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

python-yaml: Update to 6.0.1

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

php8: update to 8.2.10

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

python-build: Update to 1.0.0

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

treewide: change my no longer used email

Since February 2023, I decided to no longer work with Turris, I mean CZ.NIC company
due to some reasons how the development goes and since that day my work address is not
available and not sure if there is some redirect to someone else, but if anyone wants to
reach me, use my email address, where they can find me.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

treewide: take maintainership from Karel

Both of us were working for Turris and using these devices on daily basis.
A few of these packages are still required and used by Turris. It would be great if
Turris people will take maintainership of these packages, but if they decide not to,
I can step in and take them.

Since Karel switched from using OpenWrt to NixOS and hopefully, I didn't reveal some
secret here, let's take maintainership of his packages.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

python-websockets: Update to 11.0.3, update list of dependencies

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

python-wcwidth: Update to 0.2.6

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

python-voluptuous-serialize: Update to 2.6.0

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

python-voluptuous: Update to 0.13.1, update list of dependencies

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

python-urllib3: Update to 2.0.4

The package changed to the hatchling build backend.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

python-ubus: Update to 0.1.2

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

Merge pull request #21965 from jonasjelonek/croc

croc: new package

Merge pull request #21943 from stangri/master-adblock-fast

adblock-fast: initial commit

Merge pull request #22015 from stangri/master-https-dns-proxy

https-dns-proxy: fix dns resolution not working on boot

https-dns-proxy: fix dns resolution not working on boot

* fix dns resolution not working on boot
* add hotplug-online script
* reorganizes files/ and Makefile to reflect files destinations

Signed-off-by: Stan Grishin <stangri@melmac.ca>

python-websocket-client: update to 1.6.2

 - Add support for SSLKEYLOGFILE environment variable
 - Add support for callable header arguments
 - Change handling of proxy environment variables, is_secure set to
 true now prevents http_proxy from getting used

Signed-off-by: Javier Marcet <javier@marcet.info>

docker-compose: Update to version 2.21.0

Signed-off-by: Javier Marcet <javier@marcet.info>

python-ble2mqtt: update to 0.2.0

Signed-off-by: Quintin Hill <stuff@quintin.me.uk>

python-dbus-fast: update to 1.94.1

Signed-off-by: Quintin Hill <stuff@quintin.me.uk>

snort3: update to 3.1.69.0

Upstream bump

Build system: x86/64
Build-tested: x86/64/AMD Cezanne
Run-tested: x86/64/AMD Cezanne

Signed-off-by: John Audia <therealgraysky@proton.me>

mhz: respect CC and CFLAGS passed by buildsystem

It seems that the Makefile has both CC and CFLAGS hardcoded and does not
allow overriding them by ones being passed by the buildsystem.

This works fine until CONFIG_PKG_ASLR_PIE_ALL is selected, then building
will fail with:
arm-openwrt-linux-muslgnueabi/bin/ld.bfd: mhz.o: relocation R_ARM_MOVW_ABS_NC against `a local symbol' can not be used when making a shared object; recompile with -fPIC
arm-openwrt-linux-muslgnueabi/bin/ld.bfd: mhz.o(.text+0x75c): unresolvable R_ARM_CALL relocation against symbol `__aeabi_l2d@@GCC_3.5

So, lets add a patch pending upstream that allows both CC and CFLAGS to be
overriden so that ones passed by the buildsystem are actually respected.

Fixes: 89123b308f98 ("mhz: add new package")
Signed-off-by: Robert Marko <robimarko@gmail.com>

libucontext: Add package

Description (from libucontext github page):
libucontext (https://https://github.com/kaniini/libucontext) is a
library which provides the ucontext.h C API. Unlike other
implementations, it faithfully follows the kernel process ABI when
doing context swaps. libucontext is used on almost all musl
distributions to provide the legacy ucontext.h API.

This package is meant as a development package. There is no need
to install a package on the router if an application or library
is linked against the static libraries. Though, shared libraries
are provided also.

It is used to link libraries/applications against it which need the
system calls

* makecontext
* swapcontext
* getcontext
* setcontext

E.g. the asynchronous API of libmariadb (c-connector) uses this
system calls. Because libmusl didn't provide that system calls this
synchronous API is currently (without libucontexe) not working - it
segfaults.

Co-developed-by: Tianling Shen <cnsztl@immortalwrt.org>
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Signed-off-by: Volker Christian <me@vchrist.at>

knot-resolver: update to version 5.7.0

Changelog:
https://www.knot-resolver.cz/2023-01-26-knot-resolver-5.6.0.html
https://www.knot-resolver.cz/2023-08-22-knot-resolver-5.7.0.html

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

tor: update to 0.4.8.4 stable

First release of the 0.4.8.x series, see the changelog [1] for what's new.

[1] https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.8.4/ChangeLog

Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>

dmx_usb_module: use upstream commit to fix compilation with kernel 6.2+

Recently, there was pushed patch, which fixed only part to get it working with
Linux kernel 6.2+, but it was only local change and it did not use the changes,
which are going to be included in the upcoming dmx_usb_module release.

This commit use the commit from the upstream repository:
https://github.com/lowlander/dmx_usb_module/commit/eeecf40c3eb3dbdf1981c508080ab3aa61e105e2

Fixes: e15d9f75dac2888b9d863c6f2d1c19637631c1fb ("dmx_usb_module: fix compilation warning")
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

jool: update package to version 4.1.10

Update jool to version 4.1.10 and remove a no longer needed patch.
There was also a need to backport a patch to fix compile in some archs.

Signed-off-by: Tiago Gaspar <tiagogaspar8@gmail.com>

lua-eco: update to 2.5.0

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>

v2raya: Update to 2.2.2

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

libre2: fix install

Need the suffixed library too.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

collectd-mod-ipstatistics: fix handling of long `/proc` lines

`/proc/net/netstat` `TcpExt:` line is 2064 chars long on linux 6.1

Signed-off-by: Alex Shumsky <alexthreed@gmail.com>
[PKG_RELEASE bump added]

modemmanager: Fix Permission Denied error

The proto_send_update function is sending a notification to netifd
during the teardown section. However, netifd filters link update
notifications executed during teardown, as indicated here:
https://git.openwrt.org/?p=project/netifd.git;a=blob;f=proto-shell.c#l515
This was leading to a Permission Denied error due to its behavior,
making proto_send_update ineffective during teardown.

To address the issue, the proto_send_update function has been removed
from the teardown section. This prevents the Permission Denied error
while ensuring proper operation during teardown.

Additionally, in the 10-report-down helper script, a check has been
implemented to determine if the interface is already down. This check
is crucial to avoid triggering a Permission Denied error, especially
in cases where netifd is already aware of a controlled ifdown operation.

Signed-off-by: Oliver Sedlbauer <osedlbauer@tdt.de>

libre2: fix pkgconfig paths

Upstream broke them.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

croc: new package

croc is a tool written in Go for sending files from one device to
another over the internet using a relay. It runs on multiple platforms,
provides end-to-end encryption and works without port forwarding and
fixed IP/DynDNS.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>

nss: update to 3.93

Signed-off-by: Lucian Cristian <lucian.cristian@gmail.com>

libreswan: update to 4.12
fix CVE-2023-38710, CVE-2023-38711, CVE-2023-38712

Signed-off-by: Lucian Cristian <lucian.cristian@gmail.com>