netbird: update to 0.21.7

1. Release notes:
   https://github.com/netbirdio/netbird/releases/tag/v0.21.2
   https://github.com/netbirdio/netbird/releases/tag/v0.21.3
   https://github.com/netbirdio/netbird/releases/tag/v0.21.4
   https://github.com/netbirdio/netbird/releases/tag/v0.21.5
   https://github.com/netbirdio/netbird/releases/tag/v0.21.6
   https://github.com/netbirdio/netbird/releases/tag/v0.21.7
2. Update GO_PKG_LDFLAGS, because of https://github.com/netbirdio/netbird/commit/292ee260ad564d1e65199b1cb3430b0cd7ba9646
3. Define the configuration file.

Signed-off-by: Salem Huang <solohoh@hotmail.com>
(cherry picked from commit 35b668b6ca432425e3b10b080f43344c15903380)

netbird: update to 0.21.1

Release notes: https://github.com/netbirdio/netbird/releases

Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit 9bc2733f31fb9ef083d7b2ed8235ffef9dbc3b21)

netbird: update to 0.14.5

Release Notes

Management

 - Introduce a new ACL engine based on Rego (Open Policy Agent) for firewall control
 - Personal access tokens generation as a first iteration toward public API release
 - Add Keycloak support as an IDP manager

Agent

 - Introduce a Firewall interface to apply granular access control (e.g., connection direction, port, or protocol level)
 - Make the agent run on Android (mobile support)

Changelog

 - Feat rego default policy
 - Don't drop Rules from file storage after migration to Policies
 - Add version info command to signal server
 - Feat firewall controller interface
 - Adding Personal Access Token generation
 - Exchange proxy mode via signal
 - Fix connstate indication
 - Mobile
 - PAT persistence
 - Add Keycloak Idp Manager
 - Adjustments for the change server flow
 - Disable peer expiration of peers added with setup keys
 - Add JWT middleware validation failure log

Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit 12f8ebc4b1adf63989c366c36509b54da59ba426)

netbird: update to 0.14.4

Bug fixes & refactor
Fix: send remote agents updates when peer re-authenticates

Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit ab573bdb4d7b30d5dc46e70941cb025800d4cabd)

netbird: update to 0.14.3

Bug fixes & refactor

Release notes:
 - Fix: send remote agents updates when peer re-authenticates

Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit f9e3af87f516b285daffc01636083f2db369c27b)

netbird: update to 0.14.2

Update from 0.12.0 -> 0.14.2
Release notes: https://github.com/netbirdio/netbird/releases

Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit 58fcaf8fc4d56c929a43be14fcd5c10d349502ec)

netbird: new package

Netbird is similar vpn service as tailscale and zerotier.

Description:
NetBird is an open-source VPN management platform built on top of WireGuard® making it easy to create secure private networks for your organization or home.
It requires zero configuration effort leaving behind the hassle of opening ports, complex firewall rules, VPN gateways, and so forth.

Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit a4d8d2459aa4fc0de453b23c34355311366f8d3b)

crowdsec: new upstream release version 1.5.4

Update crowdsec to latest upstream release version 1.5.4

Signed-off-by: S. Brusch <ne20002@gmx.ch>
Maintainer: Kerma Gérald <gandalf@gk2.net>
Build tested: package build checked, no run test due to limited space

Description: update to latest version of upstream
(cherry picked from commit 7528bf76821eb9234d4665752371c85496ca5b89)

apfree-wifidog: Update to v6.08.1950

Fixed some memory leak bug

Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>
(cherry picked from commit 5b3e517be4a1d2674fc12ea81a60ba885423758a)

xfrpc: update to version 2.9.644

Release notes:
https://github.com/liudf0716/xfrpc/releases/tag/2.9.644

Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>
(cherry picked from commit 6cd80e07273d7e7f291f15601f0cf77f88732351)

git: update to version 2.34.8

Fixes CVE:
CVE-2023-25652
CVE-2023-25815
CVE-2023-29007

Release notes:
https://github.com/git/git/commit/abcb63fb70a69956a892fa830f3866098797787c

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

samba4: update to 4.18.6

Update to the version of samba4 from 23.05 as version 4.14 is no longer
supported by upstream since 2022-09-13:

https://wiki.samba.org/index.php/Samba_Release_Planning#General_information

Signed-off-by: Michal Hrusecky <michal.hrusecky@turris.com>

czmq: drop libpcre dependency

It seems like the libpcre dependency was added by mistake.
While checking in the source code of czmq (Makefile.am, CMakeLists.txt),
I see there are several dependencies, but there isn't PCRE.

Fixes: 936a48a ("czmq: add new package")
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit e3ab95185cb67e6d5753b2d7380bac74c4ef4acd)

mg: switch pcre to pcre2

Switch pcre to pcre2
https://github.com/openwrt/packages/issues/22006

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry picked from commit 3d11e5c197e250f0a32ca813ff07d480b59311d0)

msmtp: update to version 1.8.24

Release notes:
https://github.com/marlam/msmtp-mirror/commit/ef62463e4d0dc1f8e7f1db4f8dd35650999c13f9X

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 29a9a6a4a7b797097992eb7ff2cfd84d11920b25)

postfix: Fix compile against glibc 2.36

This backports a change from postfix 3.8, I do not know exactly why it
detects Linux 6 here, but this is needed to fix compilation with glibc
2.36.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 33786efe661f8aef720914926c6f5ad2f0ba8187)

glib2: disable gnulib printf

A compiler bug (suspiciously) blocks gnulib compilation for
mipsel_24kc_24kf. While we had this patch to disable gnulib, it was
accidentally removed by 5d27631d9fbca076eb6377fc8c10f474ce9f4fea. Add it
back to fix the long broken build for mipsel_24kc_24kf.

Fixes: #19511
Signed-off-by: Jitao Lu <dianlujitao@gmail.com>
(cherry picked from commit 68f23a9c333671e9ea69e014824943e2e00aaa41)

glib2: fix host build offline download

If buildsystem does not have a internet connection, then the build
fails. This is because of the fact, that glib2 is downloading and building
the missing dependencies during host compilation.

This cannot be allowed to happen. The package must also be built without
an internet connection.

Adding the missing host build dependency and removing the 'forcefallback'
fixes this issue.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit c664b83535c24df35d6a1ec46440b4fb04d270ec)

fastd: update repository URL

I've changed my username to neocturne.

Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
(cherry picked from commit ac897e05dd6a30be498897494843962db4633436)

libuecc: update repository URL

I've changed my username to neocturne.

Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
(cherry picked from commit 1df594bc01b0c7be34cd6eb477ebd1621959d15d)

bind: update to version 9.18.18

Release notes:
https://downloads.isc.org/isc/bind9/9.18.18/doc/arm/html/notes.html#notes-for-bind-9-18-18
https://downloads.isc.org/isc/bind9/9.18.17/doc/arm/html/notes.html#notes-for-bind-9-18-17

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 6a8d3565f0a99fe22cac6db9a8bbf553b7dff5a5)

rclone: Update to 1.64.0

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 1b75de7e5ca20280ba9e0b4672506abd1a7e2823)

samba4: update to 4.14.14
* update to 4.14.14
* fixes: CVE-2022-2031, CVE-2022-32744, CVE-2022-32745, CVE-2022-32746, CVE-2022-32742

Signed-off-by: Andrew Sim <andrewsimz@gmail.com>
(cherry picked from commit 5cf95dbf051e1072833e9a3d770c51feaa140985)

samba4: drop maintainership

drop maintainership:
* samba4
* ksmbd-tools
* perl-parse-yapp
* libtirpc
* softethervpn5
* wsdd2
* rpcsvc-proto

Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
(cherry picked from commit cd49a8fb277f58d013b4bfc229aef6db18252146)

samba4: fix build on macos

This commit fixes two issues on macos:
1. Added a patch to fix 'echo -n' issue with MacOS shell
(backported from upstream)
2. Redefined sys.platform='linux' for target build if build host is
MacOS (otherwise, build script tries to use MacOS logic for
OpenWrt(Linux) target build)

Signed-off-by: Sergey V. Lobanov <sergey@lobanov.in>
(cherry picked from commit 510d44d988282abef81011b7281591b1bca88c90)

emailrelay: update to v2.4.1

The patch seems not needed anymore.
Also remove deprecated PKG_RELEASE:=$(AUTORELEASE)

Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
(cherry picked from commit 735cba83ce3851e0a6fdf279a51683ed9bd00481)

alpine: disable parallel build

Parallel build does not work because it may reach a point where OSTYPE
might be needed before it is actually built.  They appear to run
parallel to each other:

echo slx > OSTYPE
[...]
cat: OSTYPE: No such file or directory
sh: line 1: test: too many arguments
cat: OSTYPE: No such file or directory
Already built for -- you must do "make clean" first
make[6]: *** [Makefile:706: rebuild] Error 1
make[6]: *** Waiting for unfinished jobs....

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 0e652e244928afd3ac9490589542de0263b89e44)

alpine: fix old URL

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 40c685e616f5a83202da1c6e91744bd9c3e39e76)

ipfs-http-client: remove package

This package lacks proper maintenance in both upstream and here.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 72c8977b3b4b3b8c905bd53db7557cf6bc8963db)

sudo: bump to verison 1.9.14p3

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit a1edb560836c4710b6f536b34df042ee4549fdf2)

sudo: bump to verison 1.9.14p1

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 7953466d7f78ba4ff28a9a4b705f09e46585e2eb)

sudo: bump to verison 1.9.13p3

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 2d9e475444a12240013c68dcfbf89776bdab5c4f)

sudo: bump to version 1.9.12p2

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 18ce78753061e44b18e49513f352c25c5578f056)

sudo: bump to verison 1.9.12p1

Fixes: https://github.com/openwrt/packages/issues/19816
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
(cherry picked from commit 8e2091c6adc9b0dd78369f76e224867a40757ef1)

sudo: bump to version 1.9.12

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
(cherry picked from commit b40372da41303711bcc6c5b7640f7a3c00c47d54)

sudo: don't build with MIPS16

GCC12 doesn't implement some security flags used by sudo.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 97e986e5eda7de83e0c725586ef00f575d76b8be)

sudo: bump to verison 1.9.11p3

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
(cherry picked from commit b083d9b82bb89e3f27d3783dddd906f3fabeb693)

knot: update to version 3.3.1

Signed-off-by: Jan Hák <jan.hak@nic.cz>
(cherry picked from commit 2a6dc24882721b6c93623c8d55175de04c76852c)

libreswan: update to 4.12
fix CVE-2023-38710, CVE-2023-38711, CVE-2023-38712

Signed-off-by: Lucian Cristian <lucian.cristian@gmail.com>
(cherry picked from commit 5a1b878010217c0404483099b52e3cd30319ced2)

libreswan: update to 4.11

Fixes https://libreswan.org/security/CVE-2023-30570

Signed-off-by: Lucian Cristian <lucian.cristian@gmail.com>
(cherry picked from commit a5c2eececb64037a96163c62d41135b893f36ba8)

ffmpeg: update to version 5.1.3

Fixes CVEs:
CVE-2022-3964 [1]
CVE-2022-3965 [2]

[1] https://nvd.nist.gov/vuln/detail/CVE-2022-3964
[2] https://nvd.nist.gov/vuln/detail/CVE-2022-3965

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 87b2a2bb57c42b3c91393a387cd02367e59910f5)

Merge pull request #22123 from stangri/openwrt-22.03-https-dns-proxy

[22.03] https-dns-proxy: improve boot up startup

https-dns-proxy: improve boot up startup

Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 22d21e28a79a5246e4f6068cbc0be59e5226c486)

Merge pull request #22116 from stangri/openwrt-22.03-curl

[22.03] curl: update to version 8.3.0

unbound: update to version 1.17.1

- Refreshed one patch
- Removed deprecated AUTORELEASE

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 97e69ec89c8bdb1c6d092eb5e8491467a06a9963)

ffmpeg: update to 5.1.2

Bump to latest upstream version

Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 6b71d2fbde0be2f2f332ac542be09e37b3cb3ca9)

ffmpeg: update to 5.1.1

Bump to latest upstream version

Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 73e02994fbd8176b43fe8138fb876329538b611d)

python-sentry-sdk: Update to 1.29.2, update list of dependencies

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit f279ae9418fff4f83bd16b353ef008e548d82cd7)

treewide: change my no longer used email

Since February 2023, I decided to no longer work with Turris, I mean CZ.NIC company
due to some reasons how the development goes and since that day my work address is not
available and not sure if there is some redirect to someone else, but if anyone wants to
reach me, use my email address, where they can find me.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 1e1b2051db47a82513f4eb4e9da892207785b7e2)

curl: update to version 8.3.0

Release notes:
https://curl.se/changes.html#8_3_0

Fixes:
CVE-2023-38039 [1]

[1] https://curl.se/docs/CVE-2023-38039.html

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 07c0a5eab8fe073fabcba999e6176fec93bd696b)

nextdns: Update to version 1.40.1

Signed-off-by: Olivier Poitrey <rs@nextdns.io>

openssh: update to 9.3p2

Signed-off-by: Sibren Vasse <github@sibrenvasse.nl>
(cherry picked from commit 731f0d70a8392f1d3abf1877334cfe25c6a0786f)

openssh: sftp no longer needs crypto or zlib.

OpenSSH 9.1p1 removed remaining dependencies and stopped linking sftp,
sftp-server and scp against libcrypto or libz.  This change moves those
package dependencies from the default to those that still need them.
In particular, this will allow sftp-server to be installed for use with
Dropbear without needing to install zlib or openssl.

Signed-off-by: Darren Tucker <dtucker@dtucker.net>
(cherry picked from commit 74c4ad2c0c0e2d7c277cda212ffe7027582214e9)

openssh: Use CDN first for source downloads.

Also point to https for website.

Signed-off-by: Darren Tucker <dtucker@dtucker.net>
(cherry picked from commit 1daddd582f7fec1058ecb2ecf0d66e6a2951f56c)

openssh: preserve authorized_keys

The root user is usually the user that clients ssh into with, so in most
cases its authorized_keys determines what clients are allowed to ssh
into this device. Without preserving this file, they could potentially
be locked out after upgrading.

Signed-off-by: Glen Huang <me@glenhuang.com>
(cherry picked from commit e36a55c9ed293bd608d18918cdda8dceffad9d96)

openssh: update to 9.3p1

Signed-off-by: Sibren Vasse <github@sibrenvasse.nl>
(cherry picked from commit 2c755759dfabf5414f38b12914677c871e744824)

openssh: actually build openssh-server-pam with pam support

Signed-off-by: Sibren Vasse <github@sibrenvasse.nl>
(cherry picked from commit d41e918a36026ef9319084930fa411e81f93ac26)

openssh: update to 9.2p1

Signed-off-by: Sibren Vasse <github@sibrenvasse.nl>
(cherry picked from commit 5c43c1bade7a4cedfb0966e1f1bba2f1bf9c17e4)

openssh: update to 9.1p1

Signed-off-by: Sibren Vasse <github@sibrenvasse.nl>
(cherry picked from commit ba8cb7c16c45bed6404cac9c76b4959c540d7db6)

openssh: update to 9.0p1
Remove upstreamed patches.

Signed-off-by: Sibren Vasse <github@sibrenvasse.nl>
(cherry picked from commit 08b45115d7aa6291de0bb0b885750fa63a3a6e2f)

glib2: update to 2.74.0

Remove upstreamed patch and delete pointless one.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 5d27631d9fbca076eb6377fc8c10f474ce9f4fea)

glib2: remove libiconv/host build dependency

No longer present. The original reason for having it was an unfortunate
side effect of the way meson uses HOST_LDFLAGS. Since the transistion to
use dependency('iconv'), this is no longer relevant.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 568669dc46e982563eb77b898da7b7cbacd90d85)

syslog-ng: update to version 4.3.1

Makefile changes:
- Since version 4.3.0, there is required to use pcre2 instead of pcre
Reference: https://github.com/syslog-ng/syslog-ng/pull/4537

- Disable c++ support by default to avoid picking libstdcpp dependency
Reference: https://github.com/syslog-ng/syslog-ng/pull/4484

Config changes:
- Bump version in config file

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit c43599b0c885bbb3b6aae2cac34aa8d526fb8274)

Merge pull request #22084 from jefferyto/golang-1.19.13-openwrt-22.03

[openwrt-22.03] golang: Update to 1.19.13

golang: Update to 1.19.13

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

python3: Update to 3.10.13

Includes fix for CVE-2023-40217 (Bypass TLS handshake on closed
sockets).

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

transmission: add syscalls to seccomp filter

Add missing syscalls found using `/etc/init.d/transmission trace`.

fix crash on adding torrent on x86_64 platform

Signed-off-by: Liangbin Lian <jjm2473@gmail.com>

zerotier: update to 1.12.1

* split up "fix makefile" patch logical distinct parts
* add libatomic dependency needed for prometheus-cpp-lite-1.0
* refresh patch series
* improve warning message in init script

Signed-off-by: Moritz Warning <moritzwarning@web.de>
(cherry picked from commit 6cf39ba626e35474b5b3c59754610f20c240d202)

zerotier: do not allow executable stack

zerotier as default has executable stack.
[   11.343143] process '/usr/bin/zerotier-one' started with executable stack

executable stacks are not recommend, possibly provide a threat and there
seems to be no advantage of executable stack with zerotier-one - so let's
build it without instead.

Stack is executable on x86_64, but not on all archs, such as ramips.

Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit 56f30520f2413f9f1434def5b533a265912aea1c)

zerotier: update to 1.10.4

Signed-off-by: Moritz Warning <moritzwarning@web.de>
(cherry picked from commit b5cde91594a858b823270e50fed27bb7985ddebe)

vnstat2: update to version 2.11

This release breaks the noexit patch, because the code for removing old
now returns an error when no interfaces are configured. As it is run on
startup, the daemon exits in this case. To avoid this, add an additional
check so an error is only returned in an actual error case.

Signed-off-by: Jan Hoffmann <jan@3e8.eu>
(cherry picked from commit 98719797074637cecdff6a0cdb782a1e807a13e9)

vnstat2: update to version 2.10

Signed-off-by: Jan Hoffmann <jan@3e8.eu>
(cherry picked from commit 4edbd1afe7df62a980c085bef48d0f2df8ec19c7)

Merge pull request #22018 from stangri/openwrt-22.03-https-dns-proxy

[22.03] https-dns-proxy: fix dns resolution not working on boot

https-dns-proxy: fix dns resolution not working on boot

* fix dns resolution not working on boot
* add hotplug-online script
* reorganizes files/ and Makefile to reflect files destinations

Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 9a2c5ae18c5a4bce20d1a8c572d1261b191701dc)

wget: use pcre2

Pcre (1) is unmaintained and reached its end of life in 2021.
The base system provides pcre2 exclusively since May.

Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
(cherry picked from commit 379946951c22ea774e4e22b4379571da604ded4b)

knot-resolver: update to version 5.7.0

Changelog:
https://www.knot-resolver.cz/2023-01-26-knot-resolver-5.6.0.html
https://www.knot-resolver.cz/2023-08-22-knot-resolver-5.7.0.html

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit a5314681149259827c1eec074ae11fe6b7a80961)

knot: enable QUIC support

Signed-off-by: Jan Hák <jan.hak@nic.cz>
(cherry picked from commit dea3e7acb6b4ef4b83defc2d40ad4dfeb10d1df4)

knot: update to version 3.3.0

Signed-off-by: Jan Hák <jan.hak@nic.cz>
(cherry picked from commit e79e4415139fd1bc475200a8e408dce9a7f89dc2)

knot: update to version 3.2.9

Signed-off-by: Jan Hák <jan.hak@nic.cz>
(cherry picked from commit f6aa1198eb14487d57bb5cb88fcc359376bfd3ed)

knot: update to version 3.2.8

Signed-off-by: Jan Hák <jan.hak@nic.cz>
(cherry picked from commit 9517ef080a88812b96ef55e55ddc83ada0a6a829)

knot: update to version 3.2.7

Signed-off-by: Jan Hák <jan.hak@nic.cz>
(cherry picked from commit 439694a0128739e493d5ff2d20a8cbd4d4ca253e)

knot: update to version 3.2.6

Signed-off-by: Jan Hák <jan.hak@nic.cz>
(cherry picked from commit bb946a19cd3203e288f99db666e123c92f7e3d0d)

tmate: fix build against msgpack-c 6.0

This patch is taken from
https://git.alpinelinux.org/aports/commit/?id=f923597f4bdea424dc28b1d026269df060596fac

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 928710813baba4f6f5130d936f0cab44c0033b90)

msgpack-c: Update to 6.0.0

Removed 010-no-gtest.patch as upstream no longer detects it.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 394cc366b3210924ed270c3745d37a7be3d1965b)

tmate-ssh-server: fix build against msgpack-c 6.0

This patch is taken from
https://git.alpinelinux.org/aports/commit/?id=f923597f4bdea424dc28b1d026269df060596fac

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit c49a1dad52f6556757dc93f787c84cac76629435)

tang: do not require bash and curl (backport from 23.05)

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

tang: corrected hash for v14

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

natmap: update to 20230820

Signed-off-by: Ray Wang <r@hev.cc>
(cherry picked from commit d5b99f9e8a0958be7f8eef66515bd98e4a7b4d96)

tang: updated to v14

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

tang: create user tang

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

tang: use sbin instead of libexec

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

tang: remove post-installation key generation

The keys will be generated on startup.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

tang: updated to version 12

This version enables standalone operation.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

strongswan: fix compilation against updated WolfSSL 5.6.3

After OpenWrt base updated WolfSSL to version 5.6.3, the strongswan wolfssl
plugin fails to compile due to a header conflict.

The error reported by the builders is:

    In file included from .../usr/include/wolfssl/openssl/asn1.h:27,
                     from .../usr/include/wolfssl/ssl.h:4123,
                     from wolfssl_common.h:64,
                     from wolfssl_ec_private_key.c:23:
    ../../../../src/libstrongswan/asn1/asn1.h:43:9: error: 'WOLFSSL_ASN1_STRING' redeclared as different kind of symbol
       43 |         ASN1_UTF8STRING =               0x0C,
          |         ^~~~~~~~~~~~~~~
    In file included from wolfssl_common.h:64,
                     from wolfssl_ec_private_key.c:23:
    .../usr/include/wolfssl/ssl.h:212:41: note: previous declaration of 'WOLFSSL_ASN1_STRING' with type 'WOLFSSL_ASN1_STRING'
      212 | typedef struct WOLFSSL_ASN1_STRING      WOLFSSL_ASN1_STRING;
          |                                         ^~~~~~~~~~~~~~~~~~~
    make[9]: *** [Makefile:621: wolfssl_ec_private_key.lo] Error 1

Solve this issue by adding a local path that remaps `ASN1_UTF8STRING`
during wolfssl header inclusion, like it is done already for other
conflicting defines.

Ref: https://forum.openwrt.org/t/x/169580
Signed-off-by: Jo-Philipp Wich <jo@mein.io>

net/mosquitto: bump to 2.0.17

This is a security and bug fix release.

Security:
- CVE-2023-28366: Fix memory leak in broker when clients send multiple QoS 2
  messages with the same message ID, but then never respond to the PUBREC
  commands.
- CVE-2023-0809: Fix excessive memory being allocated based on malicious
  initial packets that are not CONNECT packets.
- CVE-2023-3592: Fix memory leak when clients send v5 CONNECT packets with a
  will message that contains invalid property types.
- Broker will now reject Will messages that attempt to publish to $CONTROL/.
- Broker now validates usernames provided in a TLS certificate or TLS-PSK
  identity are valid UTF-8.
- Fix potential crash when loading invalid persistence file.
- Library will no longer allow single level wildcard certificates, e.g. *.com

Bugfixes of note or relevance to OpenWrt:
- Fix bridges with non-matching cleansession/local_cleansession being expired
  on start after restoring from persistence. Closes #2634.
Client library:
- Use CLOCK_BOOTTIME when available, to keep track of time. This solves the
  problem of the client OS sleeping and the client hence not being able to
  calculate the actual time for keepalive purposes. Closes #2760.

Full changelog available at: https://github.com/eclipse/mosquitto/blob/v2.0.16/ChangeLog.txt
plus: https://github.com/eclipse/mosquitto/blob/v2.0.17/ChangeLog.txt
(2.0.17 fixes regressions from the 2.0.16 release)

Signed-off-by: Karl Palsson <karlp@tweak.au>

tunneldigger-broker: update to v0.4.0

Include new hook script to build

Signed-off-by: Perry Melange <isprotejesvalkata@gmail.com>
(cherry picked from commit 93a102e21a8a80bf98957531c96ac06474ac089f)

tunneldigger-broker: add rate-limit hook

Signed-off-by: Perry Melange <isprotejesvalkata@gmail.com>
(cherry picked from commit 0d1085fe9eae61d96ae69c80d3e44a9f36e21cb7)

tunneldigger-broker: add option to isolate bridge ports

Add new option to a config bridge section to indicate
if a bridge port added to the bridge should be isolated
or not.  The default is 0 (no isolation).

example

config bridge
     option interface 'br-mybridge1446'
     option mtu '1446'
     option isolate '1' # default '0'

Signed-off-by: Perry Melange <isprotejesvalkata@gmail.com>
(cherry picked from commit 49cdf15da458c384d6c0cd19b228e2d84ba205f4)

tunneldigger-broker: update lib functions

Use config_foreach instead of config_cb

Signed-off-by: Perry Melange <isprotejesvalkata@gmail.com>
(cherry picked from commit ab2b1ade2792c4218725ff5f0851141197ac0188)

tunneldigger-broker: update config file and init for v0.4.0

Signed-off-by: Perry Melange <isprotejesvalkata@gmail.com>
(cherry picked from commit 99dfea773019fc8fb194a22e7beba4e94ed8df66)