powertop: update to 2.15

Release mainly focuses on bug fixes and patching compatibility issues.
Also, adds support to multiple platforms.
Removed obsolete patch as upstream has fixed.

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

xray-core: update to 1.8.16

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>
(cherry picked from commit f84ed39a615011d029077335578ba1d4db795e5d)

xray-core: update to 1.8.15

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>
(cherry picked from commit 4cbfd4709e1050a85f51b42fafab3753a0329901)

natmap: reset PKG_RELEASE to 1

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>
(cherry picked from commit 1d542b8919a0e98836055bdd251e0345b80a0bc6)

natmap: update to 20240603

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>
(cherry picked from commit b0a4fd300f23f99bc678162165c23e93bb1e24e8)

banip: update 1.0.0-4

* relax the firewall pre-check if fw4 is not running
* replace former stale tor feed source with 'https://www.dan.me.uk/torlist/?exit'
* add openvpn log term/search pattern example to the readme
* the default config now includes only log terms for dropbear and LuCI, all others are optional
* readme update

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit d17f661aee8aab300bd73d682748eac61bea27a2)

golang: Update to 1.21.11

go1.21.11 (released 2024-06-04) includes
security fixes to the archive/zip and net/netip packages,
as well as bug fixes to the compiler,
the go command, the runtime, and the os package.

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

lighttpd: fix missing dependency for OpenSSL crypto library

This change will provide the necessary dependency resolution, fixing:

  Package lighttpd is missing dependencies for the following libraries:
  libcrypto.so.3

Fixes: #23794
Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
(cherry picked from commit a300185d49e87848f9b8027393196631841b32f6)

lighttpd: add option to use OpenSSL crypto library

Currently, it is not feasible to configure lighttpd to use OpenSSL as
its internal crypto library. Instead, one must rely on alternative
crypto libraries such as Nettle or mbedTLS. This setup is not ideal in
scenarios where a single crypto library is preferred. To address this
issue, lets propose introducing OpenSSL as an additional configuration
option.  Similarly, propose GnuTLS as additional configuration option.

Closes: #24004
Co-developed-by: Glenn Strauss <gstrauss@gluelogic.com>
Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 8c9597f1dcb0ab5965a5ecdb506e234c5da61a3e)

schroot: fix compilation with GCC14

GCC now does not allow assigning an std::locale to an std::string. No
idea why it worked originally.

Also fixed compilation with full NLS.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit c3e2dcc128adde5af8b0d07c38962cc4fd8b3a3b)

stlink: fix compilation with GCC 14

Switch to local git tarballs. Smaller.

Upstream backport and a local patch.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 41a5880f01529c7226af5c1fece9b8e0017c5132)

prometheus-node-exporter-lua: Add optional mwan3 collector

Supports interface metrics exposed by mwan3. The performance is a
little slow compared to other collectors (~300ms) as the ubus call is
where most of the time is spent. Any future speedups are likely better
put into mwan3's rpcd binary.

Signed-off-by: Ryan Doyle <ryan@doylenet.net>
[rename metrics,bump version]
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit c279efb760ca516db7cdaee32216344df47f2203)

prometheus-node-exporter-lua: Add "node_textfile_mtime_seconds" metric

…for textfile collector, to make it more consistent with the upstream
Prometheus node-exporter

Signed-off-by: Rob Hoelz <rob@hoelz.ro>
[bump version]
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit 4edae8449946f46bbb3943eb0af066048ef37c54)

prometheus-node-exporter-lua: remove duplicated nat samples

Merge duplicate src/dest samples by suming their value (bytes count)

Fixes #24166

Signed-off-by: Antoine C <hi@acolombier.dev>
[bump version number]
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit cd8f67298c588a6e80c5991b6921222eea10a06f)

prometheus-node-exporter-lua: fix netclass duplicate TYPE lines

Fixes a315c40b7232bbc83582685c98e41466d84d7a35

[initial fix]
Signed-off-by: René Treffer <treffer@measite.de>
[fixup René version]
Signed-off-by: PichetGoulu <pichet@nosuid.be>
[actual commit]
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit aa7ea7938f4b39fef4b8a0a3f9ab14c1119be515)

prometheus-node-exporter-lua-hostapd_stations: fix not reporting metrics

- fix incorrect interface name mapping in hostapd_stations exporter

Signed-off-by: Balázs Urbán <szalab9@gmail.com>
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit 1930d39a15113a8ede7d2794e394678e87697f5d)

prometheus-node-exporter-lua: add missing libubus-lua dependency

Fixes a315c40b7232bbc83582685c98e41466d84d7a35

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit fe489585c260a40832ce76ab1236751cf6561da8)

prometheus-node-exporter-lua: bump package version

Signed-off-by: Ivan Mironov <mironov.ivan@gmail.com>
(cherry picked from commit 41975220c0b177892bd0184387a354bc036bc983)

prometheus-node-exporter-lua: add basic hwmon exporter

This collector supports following metrics:

 * node_hwmon_temp_celsius
 * node_hwmon_pwm

and following auxiliary mappings:

 * node_hwmon_chip_names
 * node_hwmon_sensor_label

Tested on:

 * Banana Pi BPI-r3 / OpenWrt 23.05.0-rc2
 * TP-Link Archer C7 v5 / OpenWrt 22.03.5

Signed-off-by: Ivan Mironov <mironov.ivan@gmail.com>
(cherry picked from commit 431fefbdea559625c5b46ff2011237fefcbf1c1c)

prometheus-node-exporter-lua: Add thermal collector

Signed-off-by: Joel Pettersson <me@joelpet.se>
(cherry picked from commit 1eeb1dc2de82c093e2cd1ccc71ffd36a449301f9)

banip: update 1.0.0-3

* fixed a regression in the split Set function (reported in the forum)
* fixed regex for urlhaus feed

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 2cc7cf3ca0aa6ad2cf5d67a66632ca5a516eb07b)

apfree-wifidog: update to 7.06.2008

Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>
(cherry picked from commit a1b1bd87bf87643e8a3b9235c3b21a3099722658)

apfree-wifidog: support rule group and websocket&dns proxy flag

Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>
(cherry picked from commit a34f47e7bb067f98419c217d132e529549d2ecc5)

ruby: update to 3.2.4

The 3.2.3 release includes many bug-fixes. This release also includes
the update of uri.gem to 0.12.2 which contains the security fix.

- CVE-2023-36617: ReDoS vulnerability in URI

See: https://www.ruby-lang.org/en/news/2024/01/18/ruby-3-2-3-released/

The 3.2.4 release includes security fixes. Please check the topics below
for details.

- CVE-2024-27282: Arbitrary memory address read vulnerability with Regex search
- CVE-2024-27281: RCE vulnerability with .rdoc_options in RDoc
- CVE-2024-27280: Buffer overread vulnerability in StringIO

See: https://www.ruby-lang.org/en/news/2024/04/23/ruby-3-2-4-released/

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

banip: update 1.0.0-2

* fixed a possible "Argument list too long" error in the f_log function
* fixed multiple, incomplete digit character classes
* fixed/optimized split file handling
* cosmetics

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 059a5303296cd8a56aa6777ef5c9a61bef5dd48a)

sing-box: update to 1.9.3

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>
(cherry picked from commit 128c0f03ef0d166f9f6d2fe83cea55a6d80789df)

sing-box: update to 1.9.2

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>
(cherry picked from commit b82a70dd191f8e401d3aeb710d2aeb0530895b05)

sing-box: update to 1.9.1

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>
(cherry picked from commit 909ec005b605857d529bc449843206195a4c1e32)

unbound: pull in adblock-fast generated adb_list

* adblock-fast can generate the compatible adb_list-file, but it's
  only pulled if net/adblock installed, this patch also pulls in the
  adb_list file if net/adblock-fast is installed.
* also bump PKG_RELEASE

Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit d7d1743c834dffeb7e3ea0c9ee16ec587788f0ca)

Merge pull request #24340 from mhei/23.05-php8-update-to-8.2.20

[23.05] php8: update to 8.2.20

iperf3: fix usage with big endian

Upstream submissions.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 37ade7efabae535bb4612177bc4cf0a32353b8e9)

iperf3: update to 3.17.1

Changelogs since last release:
https://github.com/esnet/iperf/releases/tag/3.17
https://github.com/esnet/iperf/releases/tag/3.17.1

Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit b450fbc5eaf7bcfeac1b0e8641f5d46a5d3f821c)

banip: release 1.0

* made sure, that the domain lookup always add the found IPs to the underlying allow-/blocklist-Set
* major readme update

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit cc709768b5a243d0f021834a9cc4ca872e5f84bb)

php8: update to 8.2.20

This fixes:
    - CVE-2024-4577
    - CVE-2024-5458
    - CVE-2024-5585

Changelog: https://www.php.net/ChangeLog-8.php#8.2.20

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

libpfring: backport patch fixing compilation error for sa_data

Backport patch fixing compilation error for sa_data not well defined.
This is triggered only on platform that makes use of fortify string and
cause compilation error due to the fact that sa_data is not well defined
and his size is arbitrary.

Patch has been accepted in the PF_RING project and this is just a
backport.

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit c3a50a9fac8f9d8665f8b012abd85bb9e461e865)

libpfring: update to 8.4.0

Release notes:
https://github.com/ntop/PF_RING/releases/tag/8.4.0

Signed-off-by: John Thomson <git@johnthomson.fastmail.com.au>
(cherry picked from commit 534bd518f3fff6c31656a1edcd7e10922f3e06e5)

hev-socks5-server: update to 2.6.6

Signed-off-by: Ray Wang <r@hev.cc>
(cherry picked from commit c6777c6ecc2a5097d3ef12b142c1d330f226cbf4)

Merge pull request #24317 from p-w-p/xray-core_update

[23.05] xray-core: update to 1.8.13

xray-core: update to 1.8.13

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 6a9b65119d95ebddd5875135ffaca1fc77a28e5f)

node: bump to v18.20.3

Notable changes
This release fixes a regression introduced in Node.js 18.19.0 where http.server.close() was incorrectly closing idle connections.
A fix has also been included for compiling Node.js from source with newer versions of Clang.
The list of keys used to sign releases has been synchronized with the current list from the main branch.

Updated dependencies
* acorn updated to 8.11.3.
* acorn-walk updated to 8.3.2.
* ada updated to 2.7.8.
* c-ares updated to 1.28.1.
* corepack updated to 0.28.0.
* nghttp2 updated to 1.61.0.
* ngtcp2 updated to 1.3.0.
* npm updated to 10.7.0. Includes a fix from npm@10.5.1 to limit the number of open connections npm/cli#7324.
* simdutf updated to 5.2.4.
* zlib updated to 1.3.0.1-motley-7d77fb7.

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

sing-box: update to 1.9.0

Signed-off-by: Anya Lin <hukk1996@gmail.com>
(cherry picked from commit 087fe17bf746fa1edc6f452c02ac05d75fa93daf)

banip: update 0.9.6-3

* fixed concurrent, too high nft loads during feed processing (seen in LuCI frontend)

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 3584187f69f954e0e70dc86ffcf7d46d0df37452)

apache: add compile fix for libxml-2.12.x

libxml2 restructured includes, thus another include is now required
otherwise build fails.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 7009c6be73cdb1535c4e13bd86bbccb623cade87)

banip: update 0.9.6-2

* fix regex for nixspam and sslbl feed
* list the pre-routing limits in the banIP status
* small fixes and log improvements

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 27e86ef42e832545a9a66d479c4bbd99afaab5c5)

xfrpc: update to 3.05.661

This version is compatible with FRPS 0.58.0

Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>
(cherry picked from commit d5c22612a90e9a0fd09d4307e567240562a10287)

xfrpc: Revised the config file and adjusted the corresponding init file

Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>
(cherry picked from commit e39af317532bd67580e6d12d4b4c9590cafa574e)

ocserv: use a more neutral character for sed

This resolves a startup issue.

Resolves: #24203

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

nextdns: Update to version 1.43.5

Signed-off-by: Olivier Poitrey <rs@nextdns.io>

sing-box: update to 1.8.14

Signed-off-by: Van Waholtz <brvphoenix@gmail.com>
(cherry picked from commit 2b7369c323ac232ccb39f0321c5b86053a29b263)

dnsdist: update to 1.9.4

fixes CVE-2024-25581

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>

haproxy: update to v2.8.9

- Update haproxy PKG_VERSION and PKG_HASH
- See changes: http://git.haproxy.org/?p=haproxy-2.8.git;a=shortlog

Signed-off-by: Christian Lachner <gladiac@gmail.com>

banip: release 0.9.6-1

* refine IPv4 parsing, skip rough feed entries like loopback addresses
* better error logging during banIP nftables initialization and Set loading
* cosmetics

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit ccca9c832540d9eea78d5a438c14142f8e087735)

openconnect: introduced URI parameter

This allows specifying a camouflage string in ocserv.

Fixes: #23364
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

openconnect: backport fix for anyconnect compatibility

Fixes: #21135
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

gptfdisk: update to 1.0.10

- Delete upstreamed patch

Signed-off-by: krant <aleksey.vasilenko@gmail.com>
(cherry picked from commit ad6344d0455038e374f57a7fb15d3d1ace8d889b)

golang: Update to 1.21.10

go1.21.10 (released 2024-05-07) includes security fixes to the go
command, as well as bug fixes to the net/http package.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

Merge pull request #24139 from stangri/openwrt-23.05-adblock-fast

[23.05] adblock-fast: update to 1.1.2-1

pdns-recursor: update to 4.8.8

fixes CVE-2024-25583; also includes changes from 4.8.7 that
fix regressions introduced with the security fixes in 4.8.6

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>

adblock-fast: update to 1.1.2-1

* move extra_command and EXTRA_HELP to the top of the init file
* add packageCompat variable for compatibility check with WebUI
* add OutputFilter variables for supported resolvers
* simplify adb_check with the use of OutputFilter variables
* add show_blocklist command to display currently blocked domains

Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit fb151d5b8269f458cd54b75975d6a63ad8401b35)

ocserv: updated to 1.3.0

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

banip: update 0.9.5-5

* fix a processing race condition
* it's now possible to disable the icmp/syn/udp safeguards in pre-routing - set the threshold to '0'.

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 083554094b169ad79ce4d4054e227f0829722de7)

docker: Update to 26.1.0
* Removed unnecessary GO lang variables

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

dockerd: Update to 26.1.0
* Removed unnecessary GO lang variables

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

containerd: Update to 1.7.15
* Explicitly list GO_PKG_INSTALL_EXTRA
* Removed unnecessary GO lang variables

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

uspot: update to Git HEAD (2024-05-03)

5e2d15a110bb treewide: remove tip_mode
e2dbdef4cf1e treewide: rename spotfilter -> uspotfilter
ef0f5291365b uspot/uspotfilter: implement disconnect_delay
92d3356d3fb3 update README

Update the package Makefile to reflect the changes from the following
above-listed commit:

e2dbdef4cf1e treewide: rename spotfilter -> uspotfilter

(cherry picked from commit 5181ce4a483711791329a13e07d29f9321d85178)
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>

xray-core: Update to 1.8.11

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 0db33e866b108b9d0768f6b9f488c2d99c2363bf)
[added a patch to fix build with go 1.21]
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

xray-core: Update to 1.8.10

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 1b59556d06059cc87945ad52bdbccbfc06f93d9e)

xray-core: Update to 1.8.9

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 09c4a4b1bab44a4d15a38907e4c48a9a09bb916d)

v2ray-core: Update to 5.16.0

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit c0608d93befc062e33fb7dc2adbb70abe262c8cf)

v2ray-geodata: Update to latest version

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 3f7a3e4edfcd5c37abd68fdc19b25e7795589345)

acme-acmesh: use validation_method option instead of guessing

The new validation_method option can be: dns, webroot or standalone.
Previously we guessed the challenge type:
1. if the DNS provider is specified then it's dns
2. if standalone=1
3. fallback to webroot

The logic is preserved and if the validation_method wasn't set explicitly we'll guess it in old manner.

Signed-off-by: Sergey Ponomarev <stokito@gmail.com>

hev-socks5-server: add new package

HevSocks5Server is a high-performance socks5 server for Unix.

More details: https://github.com/heiher/hev-socks5-server

Signed-off-by: Ray Wang <r@hev.cc>
(cherry picked from commit 8d36908aead7a37416ff4ac74d7c6ff59ded505e)

nano: update to 8.0

Update nano editor to version 8.0

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 69166dbbb709625a848f327c9822c667db39744f)

banip: update 0.9.5-4

* optimized adding suspicious IPs to Sets in the log monitor
* re-added ipblackhole feed

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 4d7c38c7708110cb1d0290f50ef48129192dd76a)

nextdns: Update to version 1.43.3

Signed-off-by: Olivier Poitrey <rs@nextdns.io>

dnsproxy: add three new features

This commit adds the following features:
1. UCI support for local DNS over HTTPS/TLS/QUIC server.
2. UCI support for using private reverse DNS.
3. procd jail with CAP_NET_BIND_SERVICE, allowing
   dnsproxy to serve on standard ports directly.

Signed-off-by: Emily H. <battery_tag708@simplelogin.com>
(cherry picked from commit 5df794e34303ed2d1832c0626291ad392a228e8c)

msmtp: update to version 1.8.25

Release notes:
https://marlam.de/msmtp/news/msmtp-1-8-25/

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 490866d752b41bc90661b10d2c9c41884575bf8b)

transmission: update to version 4.0.5

Release notes:
https://github.com/transmission/transmission/releases/tag/4.0.5

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 19a424aede70ddaedb1153144216db6423fa09e2)

sing-box: update to 1.8.12

Signed-off-by: Van Waholtz <brvphoenix@gmail.com>
(cherry picked from commit 3fefdbf34bbe2601fcd677fd887e4156214b37ac)

Merge pull request #24023 from rs/nextdns-1.43.0-openwrt-23.05

[23.05] nextdns: Update to version 1.43.0

nextdns: Update to version 1.43.0

Signed-off-by: Olivier Poitrey <rs@nextdns.io>

libndpi: backport patch for PCRE2 support

Backport patch for PCRE2 support as PCRE is EOL and won't receive any
support updates anymore.

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit baa0d5127062929fd26671adb5388f9b30b61a36)

openssh: bump to 9.7p1

Release notes: https://www.openssh.com/txt/release-9.7

Removed upstreamed patch: 010-better_fzero-call-detection.patch

Build system: x86/64
Build-tested: x86/64/AMD Cezanne
Run-tested: x86/64/AMD Cezanne

Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 6be0617c00bdf5e9309ad3738d09fe498cb9fb0a)

librespeed-go: improve the description

This swaps the order of the lines in the description so that when LuCI displays only the first line, it still offers some helpful information.

Signed-off-by: Nathan Friedly <nathan@nfriedly.com>
(cherry picked from commit 06ea66c55866aa409ab567a593a22bd24e727f04)

librespeed-go: Reload the daemon after modifying the tls certificate

Make the daemon reload after the tls certificate is updated

Signed-off-by: Anya Lin <hukk1996@gmail.com>
(cherry picked from commit fd1d506fff9462b3329585bdd148a6fd78cbd27a)

v2ray-core: Update to 5.15.3

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit ebed42fcb0e7e9bffee3c47b93244494377595ee)

banip: update 0.9.5-3

* allow multiple protocol/port definitions per feed, e.g. 'tcp udp 80 443 50000'
* removed the default protocol/port limitation from asn feed

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 2c6d5adac049a55ca067255da90dc938b5604249)

banip: update 0.9.5-2

* fixed possible Set search race condition (initiated from LuCI frontend)
* fixed the "no result" Set search problem in LuCI
* removed abandoned feeds: spamhaus edrop (was merged with spamhaus drop)

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit ad755e0c4ddb63f8b8ed2204043ce750a4d4b928)

banip: release 0.9.5-1

* added a DDoS protection rules in a new pre-routing chain to prevent common ICMP, UDP and SYN flood attacks and drop spoofed tcp flags & invalid conntrack packets, flood tresholds are configured via 'ban_icmplimit' (default 10/s), 'ban_synlimit' (default 10/s) and 'ban_udplimit' (default 100/s)
* the new pre-routing rules are tracked via named nft counters and are part of the standard reporting, set 'ban_logprerouting' accordingly
* block countries dynamically by Regional Internet Registry (RIR)/regions, e.g. all countries related to ARIN. Supported service regions are: AFRINIC, ARIN, APNIC, LACNIC and RIPE, set 'ban_region' accordingly
* it's now possible to always allow certain protocols/destination ports in wan-input and wan-forward chains, set 'ban_allowflag' accordingly - e.g. ' tcp 80 443-445'
* filter/convert possible windows line endings of external feeds during processing
* the cpu core autodetection is now limited to max. 16 cores in parallel, set 'ban_cores' manually to overrule this limitation
* set the default nft priority to -100 for banIP input/forward chains (pre-routing is set to -150)
* update readme
* a couple of bugfixes & performance improvements
* removed abandoned feeds: darklist, ipblackhole
* added new feeds: becyber, ipsum, pallebone, debl (changed URL)
* requires a LuCI frontend update as well (separate PR/commit)

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit fa80fefe22d0c7ca1c1e34deb52683b54af1ed17)

syslog-ng: update to version 4.7.1

Release notes:
- https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.7.0
- https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.7.1

Also bump version in the config file to avoid warning

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 9d49df0dabcdd9135bf0b86374695b69cb4bf5b6)

CI: remove CircleCI for now

The GitHub CI offers currenlty more architecture and the Signed-of-by
test is covered via the DOC CI test. In case GitHub ever changes
policies, we can simply switch back.

Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit 26c101edc3e918be4fbfe76b3514d1c8398f7d31)

Merge pull request #24014 from stangri/openwrt-23.05-adblock-fast

[23.05] adblock-fast: bugfix: unbound-related fixes

adblock-fast: bugfix: unbound-related fixes

* include `server:` directive at the top of unbound file
* update unbound-related outputGzip variable to include full path
* return always_nxdomain for blocked domains
* also update copyright stamp/license

Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 474587a1f44db8b66caca8bdde9c2dd64b480638)

Merge pull request #24006 from stangri/openwrt-23.05-nebula

[23.05] nebula: Use APK style release number

nebula: Use APK style release number

Maintainer: Stan Grishin <stangri@melmac.ca>

Run tested: aarch64, Dynalink DL-WRX36, Master Branch

Signed-off-by: Sean Khan <datapronix@protonmail.com>
(cherry picked from commit 3cbb7474c3fad4b01f8ee065b1c045c4b7fb523f)

natmap: add log_std{out,err} options

Introduce `log_stdout` and `log_stderr` options for managing logging output.

Signed-off-by: Ray Wang <r@hev.cc>
(cherry picked from commit 5abbd3bcb2362963a2cc49c0a9de78dd5c5af185)

node: bump to v18.20.2

This is a security release.

Notable Changes
* CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

ntpd: update to version 4.2.8p17

Also some spell fixes for README.md

Drop patch-0001 - ntpd >= 4.2.8p16 patched this behaviour. See:

https://bugs.ntp.org/show_bug.cgi?id=3741 (and the linked diff there)
https://git.nwtime.org/websites/ntpwww/commit/d2a7faef2fea5f10b28cc2ee1d842e4b241f414f

Signed-off-by: Paul Donald <newtwen@gmail.com>
(cherry picked from commit b2742ed05d5404d1c2cada7c51607126d19fa3f6)

uwsgi: bump to latest 2.0.25.1 release

Bump to latest 2.0.25.1 release

Drop upstream PCRE2 patch and alarm memory leak fix.
Rework and refresh patch due to release bump.

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit a9371952c916423876d3d380837b7b47ef08eb69)

uwsgi: add experimental pcre2 patch and drop pcre

Add experimental pcre2 patch and drop pcre in favor of pcre2 library.

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 4374c3250f424f1e57b175961adb41f24489510d)