apfree-wifidog: Update to 7.07.2018

Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>

apfree-wifidog: support wildcard domain

Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>

luajit2: update to v2.1-20240626

 - change: disable hash computation optimization because of the
 possibility of severe degradation.

Signed-off-by: Javier Marcet <javier@marcet.info>

Merge pull request #24533 from bretello/fix-lua-cjson-pkg-src-url

lua-cjson: fix broken PKG_SOURCE_URL

shadowsocks-libev: drop the package

The upstream project is declared as bugfix-only and received no update
for about 2 years.  The developement focus there has shifted.  It does
not compile with current openwrt main branch.

Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>

dnsproxy: Update to 0.72.0

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

node: July 8, 2024 Security Releases

This is a security release.

Notable Changes

    CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)
    CVE-2024-22020 - Bypass network import restriction via data URL (Medium)
    CVE-2024-22018 - fs.lstat bypasses permission model (Low)
    CVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low)
    CVE-2024-37372 - Permission model improperly processes UNC paths (Low)

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

luasocket: Enable serial module

Includes the serial module for luasockets (which is already being built)
in the final package. This allows using socket.select() on a serial port
(eg /dev/ttyACM0) which is the easiest way to use a serial-port with
coroutines.

Signed-off-by: Geoffrey Hausheer <rc2012@pblue.org>

lua-cjson: fix broken PKG_SOURCE_URL

See https://github.com/mpx/lua-cjson/commit/718f27293a981fb5e9e662e9aec0b7cf78317da6

Signed-off-by: brethil bretello <bretello@distruzione.org>

xtables-addons: bump to 3.26

extensions/ACCOUNT/Makefile.am
change ${top_srcdir} to ../../ (used in 3.24) to fix the following error
cp: cannot stat '/Volumes/x64/openwrt/build_dir/target-x86_64_musl/linux-x86_64/xtables-addons-3.26/ipkg-install/usr/lib/iptables/libxt_ACCOUNT.so': No such file or directory

Signed-off-by: Georgi Valkov <gvalkov@gmail.com>

xtables-addons: merge patches

Merge the following patches
201-fix-lua-packetscript.patch
210-freebsd-build-fix.patch
since they modify files created by 200-add-lua-packetscript.patch

Signed-off-by: Georgi Valkov <gvalkov@gmail.com>

xtables-addons: fix build error with target x64

Fixes
make[6]: Entering directory '/Volumes/x64/openwrt/build_dir/target-x86_64_musl/linux-x86_64/linux-6.6.36'
  CC [M]  /Volumes/x64/openwrt/build_dir/target-x86_64_musl/linux-x86_64/xtables-addons-3.24/extensions/LUA/prot_buf_ip.o
In file included from /Volumes/x64/openwrt/build_dir/target-x86_64_musl/linux-x86_64/xtables-addons-3.24/extensions/LUA/prot_buf_ip.c:20:
./include/net/checksum.h: In function 'csum_shift':
./include/net/checksum.h:90:40: error: implicit declaration of function 'ror32' [-Werror=implicit-function-declaration]
   90 |                 return (__force __wsum)ror32((__force u32)sum, 8);
      |                                        ^~~~~
In file included from ./include/linux/kernel.h:22,
                 from ./include/linux/skbuff.h:13,
                 from ./include/linux/tcp.h:17,
                 from ./include/net/tcp.h:20,
                 from /Volumes/x64/openwrt/build_dir/target-x86_64_musl/linux-x86_64/xtables-addons-3.24/extensions/LUA/prot_buf_ip.c:21:
./include/linux/bitops.h: At top level:
./include/linux/bitops.h:135:21: error: conflicting types for 'ror32'; have '__u32(__u32,  unsigned int)' {aka 'unsigned int(unsigned int,  unsigned int)'}
  135 | static inline __u32 ror32(__u32 word, unsigned int shift)
      |                     ^~~~~
./include/net/checksum.h:90:40: note: previous implicit declaration of 'ror32' with type 'int()'
   90 |                 return (__force __wsum)ror32((__force u32)sum, 8);
      |                                        ^~~~~
cc1: some warnings being treated as errors

Signed-off-by: Georgi Valkov <gvalkov@gmail.com>

Revert "postgresql: update to version 16.3"

This reverts commit 6a46887e60d969cf718de3a212aa1847277ed4b3
from PR https://github.com/openwrt/packages/pull/24327

Postgresql version upgrade fails in buildbot for all targets
with error like:

[236/1612] Generating src/fe_utils/psqlscan with a custom command
FAILED: src/fe_utils/psqlscan.c
/builder/shared-workdir/build/sdk/staging_dir/host/bin/python3 ../src/tools/pgflex --builddir . --srcdir .. --privatedir src/fe_utils/psqlscan.c.p --flex /builder/shared-workdir/build/sdk/staging_dir/host/bin/flex --perl /builder/shared-workdir/build/sdk/staging_dir/host/bin/perl -i ../src/fe_utils/psqlscan.l -o src/fe_utils/psqlscan.c --no-backup --fix-warnings -- -Cfe -p -p
flex: fatal internal error, exec of /builder/shared-workdir/build/staging_dir/host/bin/m4 failed
[237/1612] Compiling C object src/interfaces/libpq/libpq.so.5.16.p/pqexpbuffer.c.o
ninja: build stopped: subcommand failed.
make[3]: *** [Makefile:264: /builder/shared-workdir/build/sdk/build_dir/target-aarch64_cortex-a53_musl/postgresql-16.3/.built] Error 1

Several dozen packages depend upon postgresql, so the fallout is
rather large. Let's revert the upgrade until a fix is found.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

Merge pull request #24537 from JetVarimax/patch-1

banip: Correct Mb to MB when referring to RAM in README.md

lolcat: bump to 1.5

No changelog, but only a single commit since last version, fixing uncoloured stderr
interleaved with coloured stdout.

Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>

golang: Update to 1.22.5

go1.22.5 (2024-07-02) includes security fixes to the net/http package,
as well as bug fixes to the compiler, cgo, the go command, the linker,
the runtime, and the crypto/tls, go/types, net, net/http, and os/exec.

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

libfmt: bump to new release 11.0.1

Signed-off-by: Othmar Truniger <github@truniger.ch>

banip: Correct Mb to MB when referring to RAM in README.md

Signed-off-by: JetVarimax <140423365+JetVarimax@users.noreply.github.com>

transmission: fix compilation with miniupnpc 2.2.8

Backport pending patch, which was submitted to upstream via GitHub
to use modified function to compile it against miniupnpc 2.2.8.

Signed-off-by: Karol Kolacinski <kolacinskikarol@live.com>

transmission: update to version 4.0.6

Release notes:
https://github.com/transmission/transmission/releases/tag/4.0.6

Remove temporary patch included in 4.0.6 release.

Signed-off-by: Karol Kolacinski <kolacinskikarol@live.com>

pcsc-lite: install libpcsclite_real.{a,so*}, too

74ee2fa4899 failed to notice that libpcsclite now supports redirection, as of
https://salsa.debian.org/rousseau/PCSC/-/commit/1faab672aa1f926cf943d8b814ae15636dddd22c
(first present in upstream release 2.1.0).  It's important to include the real
implementation, even if redirection permits loading others.

Signed-off-by: Nathaniel Wesley Filardo <nwfilardo@gmail.com>

motion: add non/ffmpeg variants

With ffmpeg support, motion can encode videos and process network camera
streams. It is a small code base and buinding it twice will not
significantly impact a full build.

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

wifischedule: completely overhaul the script

Squashed using these commits:

 - wifischedule: use `service` instead of direct path
 - wifischedule: use `sort -u` instead of `uniq`
 - wifischedule: restart cron only at the end of batch instead of after every change
 - wifischedule: remove `[[` bash-isms
 - wifischedule: trim trailing ws
 - wifischedule: reduce `if` blocks
 - wifischedule: quote variables and remove some more bash-isms
 - wifischedule: simplify _get_uci_value`
 - wifischedule: don't exit whole script just because `uci get somekey` fails somewhere
 - wifischedule: revamp `_should_enable_wifi()`
 - wifischedule: revamp `_format_daysofweek_list()`
 - wifischedule: revamp `_enable_wifi_schedule()`
 - wifischedule: minor refactoring
 - wifischedule: mega revamp
 - wifischedule: fixes
 - wifischedule: touch-ups
 - wifischedule: use only `awk` in `_cfg_list_entries()` to filter `uci`
 - wifischedule: improve code docs
 - wifischedule: inline `_crontab_format_dow_field()`
 - wifischedule: refactor `_crontab_append_line()`
 - wifischedule: add `_uci_bool()` and refactor `_arith_bool()`
 - wifischedule: rename some functions
 - wifischedule: refactor using shellcheck
 - wifischedule: refactor `_wifi_get_interfaces()`
 - wifischedule: refactor `_wifi_get_devices()`
 - wifischedule: shellcheck fixes
 - wifischedule: use logger instead of a logfile
 - wifischedule: refactor global consts
 - wifischedule: introduce main() func
 - wifischedule: bump version

Signed-off-by: Jan Chren ~rindeal <dev.rindeal@gmail.com>

pdns-recursor: update to 5.0.7

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>

netbird: update to 0.28.4

Signed-off-by: Wesley Gimenes <wehagy@proton.me>

jq: Add PKG_CPE_ID

Signed-off-by: Andreas Gnau <andreas.gnau@iopsys.eu>

uwsgi: Add PKG_CPE_ID

Signed-off-by: Andreas Gnau <andreas.gnau@iopsys.eu>

mxml: Add PKG_CPE_ID

Signed-off-by: Andreas Gnau <andreas.gnau@iopsys.eu>

openssh: fix incompatible ptr type error GCC 14.1

The `ssh_systemd_notify` function is causing compilation errors
when built against GCC 14.1. This is due to an incompatible pointer
type being passed to the connect function.

The connect function expects a pointer to `struct sockaddr`, but
was receiving a pointer to `struct sockaddr_un`.

Signed-off-by: Sean Khan <datapronix@protonmail.com>

libs/glib2: remove pcre2 fallback workaround

pcre2 can now be properly linked statically. Hence, remove both
the patch and -Dforce_fallback_for=libpcre2-8 option.

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>

libs/glib2: remove the upstream patch

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>

libs/glib2: remove the deprecated option force_posix_threads

Resolves the following warning:

glib-2.80.3/meson.build:2053:
WARNING: DEPRECATION: Option 'force_posix_threads' is deprecated and
will be removed after GLib 2.72; please file an issue with your use case
if you still require it

For more information, see the following merge request:

https://gitlab.gnome.org/GNOME/glib/-/merge_requests/2474

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>

eza: update to 0.18.21

Release notes:
0.18.19: https://github.com/eza-community/eza/releases/tag/v0.18.19
0.18.20: https://github.com/eza-community/eza/releases/tag/v0.18.20
0.18.21: https://github.com/eza-community/eza/releases/tag/v0.18.21

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>

croc: update to 10.0.9

Release notes:
https://github.com/schollz/croc/releases/tag/v10.0.9

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>

netbird: update to 0.28.3

Signed-off-by: Wesley Gimenes <wehagy@proton.me>

tailscale: Update to 1.68.2

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

openvpn: fix startup with script-security lower than 2

External scripts may only be specified with script-security 2 or higher,
otherwise OpenVPN fails at tunnel startup with an error.
This changes the previously hardcoded hotplug scripts to only be added if
script-security is 2 or higher is used.

Signed-off-by: Clemens Hopfer <openwrt@wireloss.net>

utils: lpac: fix passing CMAKE options

Turns out that having a comment for QMI over QRTR in the CMAKE_OPTIONS will
drop anything after it, so lets move the comment above CMAKE_OPTIONS.

Fixes: 34f9d96b4cc3 ("lpac: make APDU backends configurable")
Signed-off-by: Robert Marko <robert.marko@sartura.hr>

rust: select correct architecture for armv5

Currently, armv5 and armv6 targets are both using armv6 rustc.
Without this patch, rust programs in armv5 targets throw illegal instruction
error.

Signed-off-by: Lu jicong <jiconglu58@gmail.com>

v2ray-geodata: Update to latest version

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

i2csfp: add package

Add i2csfp utility which comes handy when dealing with some SFP modules.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

postgresql: update to version 16.3

Switch to new major version 16.
Use meson to build for target, however, old autotools-style configure is
needed to clean the source directory before being able to run meson, and
host build of the timezone compiler ('zic') also still requires using the
old build system.

See also https://www.postgresql.org/docs/16/release-16.html

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

lpac: make APDU backends configurable

Currently, lpac will be built with the PCSC and AT APDU backends by default
and its not configurable in OpenWrt.

Since smart card reads are not really common on OpenWrt devices lets
disable PCSC backend by default so we dont have to include PCSC lib and
daemon by default.

AT backend is left enabled by default since it has no external dependecies
and all modems have it.

QMI over QRTR backend is not selectable even though it is part of the 2.0.2
relase since it requires unstable libqmi 1.35.4 or newer and we are still
using 1.34 stable branch.

Signed-off-by: Robert Marko <robert.marko@sartura.hr>

miniupnpc: Update to 2.2.8

Updated binary path, rebased patches.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

libnatpmp: Update to 20230423

Rebased patches.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

openssh: bump to 9.8p1

Release notes: https://www.openssh.com/txt/release-9.8

* 9.8p1 fixes CVE-2024-6387
* Adjusted Makefile to provide /usr/lib/sshd-session
* Given the troubles with -fzero-call-used-regs and all the
  broken checks, makes sense to skip it

Build system: x86/64
Build-tested: x86/64/AMD Cezanne
Run-tested: x86/64/AMD Cezanne

Signed-off-by: John Audia <therealgraysky@proton.me>

libs/glib2: update to 2.80.3

Explicitly disable gobject introspection option.

Set runtime_dir to /var/run as current glib2 version sets this option
to /run by default.

Add a patch removing the Python packaging module dependency.

Refresh patches.

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>

owut: update to 2024.07.01

- bugs
  https://github.com/efahl/owut/commit/1ed0c8d6c61988b400d963ba2a5efb857d3efdf6 partial fix for 'what-provides'
  https://github.com/efahl/owut/commit/189b27210ff32ac0a75c92fb0501d6674786d0fb bad sutype

Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>

Merge pull request #24497 from p-w-p/patch-5

docker: Update to 27.0.3

dockerd: Update to 27.0.3

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

docker: Update to 27.0.3

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

lpac: update to 2.0.2

Release notes:
https://github.com/estkme-group/lpac/releases/tag/v2.0.2

Signed-off-by: Robert Marko <robimarko@gmail.com>

adblock: update 4.1.5-11

* removed an accidentally commited flag of the upcoming adblock 5.x, this fixes a startup regression without trigger interface

Signed-off-by: Dirk Brenken <dev@brenken.org>

Merge pull request #24488 from neheb/k

p11-kit: update to 0.25.3

apinger: fix time_t format

Needs to be 64-bit.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

libtalloc: update to 2.42

Refresh patch.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

unixobdc: fix compilation with GCC14 again

Use upstream backport.

Remove autoreconf for speed. Nothing is being patched anyway.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

p11-kit: update to 0.25.3

Upstream backport fixing 32-bit -Wformat warning.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

xmlrpc-c: update to 1.59.03

Add nls.mk as libxml2 needs it.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

jool: update to 4.1.12

Update jool to 4.1.12
Changelog: https://github.com/NICMx/Jool/releases/tag/v4.1.12

Signed-off-by: Goetz Goerisch <ggoerisch@gmail.com>

lxc: update to 6.0.1

Changelog: https://discuss.linuxcontainers.org/t/lxc-6-0-lts-has-been-released/19567

Required libdbus as a depends for liblxc.  I verified that both
lxc-create and lxc-checkconfig work with the rebases to the
following patches but do please review:

  020-lxc-checkconfig.patch
  025-remove-unsupported-option.patch

Build system: x86/64
Build-tested: x86/64/AMD Cezanne
Run-tested: x86/64/AMD Cezanne

Signed-off-by: John Audia <therealgraysky@proton.me>

hwinfo: remove uuid hacks

util-linux uuid is used now.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

sumo: update to 1.16.0

Add patch for GCC14.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

alist: Update to 3.35.0

Add GO_PKG_EXCLUDES to fix build on non-64bit (arm64/amd64) system.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

dnsproxy: Update to 0.71.2

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

docker: Update to 27.0.2

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

runc: Update to 1.1.13

This is the thirteenth patch release in the 1.1.z release branch of runc.
Itbrings in Go 1.22.x compatibility and fixes a few issues,
including anoccasional wrong nofile rlimit in runc exec,
and a race between runc list and runc delete.

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

dockerd: Update to 27.0.2

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

fx: update to 35.0.0

Signed-off-by: Fabian Lipken <dynasticorpheus@gmail.com>

Merge pull request #24468 from ne20002/master-crowdsec

Update crowdsec to latest upstream release version 1.6.2

knot: update to version 3.3.7

Signed-off-by: Jan Hák <jan.hak@nic.cz>

crowdsec: Update to latest upstream release version 1.6.2

Signed-off-by: S. Brusch <ne20002@gmx.ch>
Maintainer: Kerma Gérald <gandalf@gk2.net>
Package tested: with manual install on different partition tested

Description: update to latest version of upstream

adblock: update 4.1.5-10

* made the DNS Reporting / tcpdump parsing code more capable
* small init fixes
* update readme

Signed-off-by: Dirk Brenken <dev@brenken.org>

freeradius3: add PKG_BUILD_PARALLEL:=0

freeradius-3.2.4 had a build failure in the snapshoot release but it builds successfully when doing a pull request
https://downloads.openwrt.org/snapshots/faillogs/aarch64_generic/packages/freeradius3/compile.txt

https://github.com/openwrt/packages/pull/24417

as a solution we need to add

PKG_BUILD_PARALLEL:=0

to prevent freeradius3 from doing the build in parallel

Signed-off-by: Esaaprilia Salsabila <esaapriliasalsabila@gmail.com>

auc: remove package

With 'owut' there is now a much better alternative available.
Retire and remove 'auc' in favor of 'owut'.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

snort3: improve date filtering in report

 - Take advantage of bug fix in jsonfilter to get rid of array hack, should
   improve memory footprint quite a bit

 - Implement substring matching in dates so you can collect data for a specific
   day, hour or run bin reports for histograms

 - Report title now contains specified date range, footer percentages

Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>

docker-compose: Update to version 2.28.1

Release notes:
https://github.com/docker/compose/releases/tag/v2.28.1

Signed-off-by: Javier Marcet <javier@marcet.info>

owut: update to 2024.06.24

- fix up versioning in Makefile
- change package description doc link to wiki entry instead of github
- changes
  https://github.com/efahl/owut/commit/73b70e52e912527dc0e2b52e8723d930c519a116
  https://github.com/efahl/owut/commit/714c462cc8ee6bd683ffec9a488c706dd5ac755c
  https://github.com/efahl/owut/commit/1b222bdcb803d3a762eaedac93a91e05272ef56d

Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>

cloudflared: Fix incorrect uci config syntax

Fix incorrect uci config syntax, caused by a careless newbie contributer.
Modify function append_param_arg() in init script, to support hyphenated
arguments.
Add more command parameters as uci options, no value is set to keep it default.

Signed-off-by: Ryan Keane <the.ra2.ifv@gmail.com>

dnslookup: Update to 1.11.1

Fixed unnecessary error when running with no arguments.

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

miniupnpd: Update package to 2.3.6

and change title to term used in LuCi

Signed-off-by: Self Hosting Group <155233284+Self-Hosting-Group@users.noreply.github.com>

qrencode: add support for PNG output

Added menuconfig option to enable PNG output. Default=disabled.

Signed-off-by: Marius Dinu <m95d+git@psihoexpert.ro>

net-snmp: include ipv6 address & route mibs

description: Since IPv6 is present in everyday use, we need to include
  information about IPv6 addresses & routes in SNMP

example:
  IP-MIB::ipAddressOrigin.ipv6

  IP-MIB::ipAddressOrigin[ipv6]["00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:01"] = manual
  IP-MIB::ipAddressOrigin[ipv6]["fd:00:00:09:02:55:00:00:00:00:00:00:00:00:01:01"] = manual
  IP-MIB::ipAddressOrigin[ipv6]["fe:80:00:00:00:00:00:00:0c:00:09:ff:fe:06:01:01"] = linklayer
  IP-MIB::ipAddressOrigin[ipv6]["fe:80:00:00:00:00:00:00:0c:02:09:ff:fe:00:01:01"] = linklayer
  IP-MIB::ipAddressOrigin[ipv6]["fe:80:00:00:00:00:00:00:ae:84:c6:ff:fe:25:8c:ce"] = linklayer

tested:
  23.05-snapshot
  master snapshot
  with LibreNMS, OpenWRT device IPv6 Addresses & Routes are properly recognized

Signed-off-by: Peca Nesovanovic <peca.nesovanovic@sattrakt.com>

gatling: Add procd files

This commit adds a uci configuration file and makes the gatling server
controllable by procd.

Co-authored-by: Moritz Warning <moritzwarning@web.de>
Signed-off-by: Martin Hübner <martin.hubner@web.de>

databag: add package

Signed-off-by: Roland Osborne <roland.osborne@gmail.com>

modemmanager: add sourcefilter option support

This make source based IPv6 routing option available for
modemmanager case dhcpv6

Signed-off-by: Chen Minqiang <ptpt52@gmail.com>

speedtest-netperf: add idle latency measurement

Allow measuring ping latency and CPU details at idle as a baseline before
measuring under data transfer loading. This allows better determination of
Latency Under Load, a critical bufferbloat parameter. The CPU details can
also be used to verify idle conditions or examine CPU frequency against
ping variations and jitter.

Change the default test duration to 30 seconds, which is adequate for SQM
tuning while reducing bandwidth consumption for upstream netperf servers.

Change the default ping host from gstatic.com to one.one.one.one, which is
widely available and generally shows lower latency.

When warning of internal netperf errors, suggest running netperf directly
to view error details.

Other minor updates include:
  - clear tmp file names for safety in case of traps
  - simplify ping code, argument parsing and number validation
  - fix cases of wrong protocol usage with hostname as ping target
  - drop unneeded egrep usage

Also update README accordingly, with clearer usage text and terminology.

Signed-off-by: Tony Ambardar <itugrok@yahoo.com>

tinyproxy: fix upstream config generation

Signed-off-by: Daniel Kucera <daniel.kucera@gmail.com>

tinc: fix regression bring by commit fd61f2d

Signed-off-by: Erwan MAS <erwan@mas.nom.fr>

knot: fix EXTRA_DEPENDS for APK version schema

EXTRA_DEPENDS now requires an `r` before the `PKG_RELEASE` because of
https://github.com/openwrt/openwrt/commit/e8725a932e16eaf6ec51add8c084d959cbe32ff2.

Fixes https://github.com/openwrt/packages/issues/23735

Signed-off-by: Christopher Ng <facboy@gmail.com>

dockerd: Update to 26.1.4

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

zabbix: update to 7.0.0

License has been changed to AGPL-3.0-only

Signed-off-by: Yanase Yuki <dev@zpc.st>

zabbix: update to 6.4.15

Signed-off-by: Yanase Yuki <dev@zpc.st>

zabbix: update to 6.4.14

Signed-off-by: Yanase Yuki <dev@zpc.st>

zabbix: update to 6.4.13

Signed-off-by: Yanase Yuki <dev@zpc.st>

zabbix: update to 6.4.12

Signed-off-by: Yanase Yuki <dev@zpc.st>

zabbix: zabbix-agentd: depend on libevent2-pthreads

zabbix-agentd requires libevent2-pthreads to build
correctly, so add it to DEPENDS.

Signed-off-by: Yanase Yuki <dev@zpc.st>

nginx-util: Rework ptr cleanup and error handling

As per @Ansuel's not about ctx cleanup in error path, decided to rework
the patch.

Changes and Improvements:

Smart Pointers for Memory Management:
* The `EVP_PKEY_ptr` and `X509_NAME_ptr` smart pointers
  are used to manage the memory of `EVP_PKEY` and `X509_NAME`
  objects respectively to ensure proper cleanup.

Error Handling:
* Improved error messages and exception handling to provide
  more information about what went wrong.

Resource Cleanup:
* Ensured all allocated resources are now properly freed
  in case of an error to prevent memory leaks.

Signed-off-by: Sean Khan <datapronix@protonmail.com>

nginx-util: fix deprecated openssl 3.0 functions

Since upstream openwrt has been using openssl 3.0 for quite some time,
figured we could clean up some of the legacy code.

This PR updates the code for EC/RSA key generation.

nginx-util currently only generates 'ecc' keys, even though the
framework is there for rsa as well.

In order properly test the changes, I created two binaries:

'nginx-util-ssl'     (generates ec keys)
'nginx-util-ssl-rsa' (generates rsa keys)

where I would change line:455 in `src/nginx-ssl-util.hpp`

`auto pkey = gen_eckey(NID_secp384r1)` to `auto pkey = gen_rsakey(2048)`

Example with UCI config

```
config server '_rsa'
list listen '443 ssl default_server'
list listen '[::]:443 ssl default_server'
option server_name '_rsa'
list include 'restrict_locally'
list include 'conf.d/*.locations'
option uci_manage_ssl 'self-signed'
option key_type 'rsa'
option ssl_certificate '/etc/nginx/conf.d/_rsa.crt'
option ssl_certificate_key '/etc/nginx/conf.d/_rsa.key'
option ssl_session_cache 'shared:SSL:32k'
option ssl_session_timeout '64m'
option access_log 'off; # logd openwrt'
```

➤ /opt/bin/nginx-ssl-util-rsa add_ssl _rsa
Adding SSL directives to UCI server: nginx._rsa
uci_manage_ssl='self-signed'
Created self-signed SSL certificate '/etc/nginx/conf.d/_rsa.crt' with key '/etc/nginx/conf.d/_rsa.key'.

[04/14/24 18:37:15](K-6.6.27)
root@WRX36 ~
➤ openssl x509 -in /etc/nginx/conf.d/_rsa.crt -text -noout
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6d:55:a6:cd:52:25:31:fd:3c:78:66:24:82:5f:bb:b6:a6:fe:8f:c7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = ZZ, ST = Somewhere, L = None, CN = OpenWrt, O = OpenWrtBF399B64ACF71BC3
        Validity
            Not Before: Apr 14 22:37:15 2024 GMT
            Not After : Jul 16 22:37:15 2027 GMT
        Subject: C = ZZ, ST = Somewhere, L = None, CN = OpenWrt, O = OpenWrtBF399B64ACF71BC3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:ac:52:71:af:25:e9:05:0a:a5:d7:86:d3:8d:0b:
                    66:e0:09:cf:2a:cd:a1:63:57:36:46:61:04:16:fe:
                    94:84:d0:20:ab:01:15:55:aa:a1:89:c2:85:a9:84:
                    47:ba:84:d7:1f:a9:0c:c0:f0:67:2f:81:1d:1b:3b:
                    31:d5:94:6e:a0:f0:e6:ec:26:91:4a:e2:fd:58:4c:
                    ac:b5:9e:a1:cd:7d:91:51:29:81:1d:3e:4a:d9:d1:
                    d5:f1:2f:34:2f:ca:95:dc:42:d5:c4:d3:d6:b2:91:
                    d5:19:61:a2:b5:b1:90:f0:83:88:ef:92:c9:bf:a4:
                    59:a9:d6:00:6f:1c:0d:70:16:40:cc:cb:c0:de:c4:
                    8f:00:83:a3:2f:77:ca:18:cd:7b:d4:77:96:47:78:
                    1b:c1:ff:08:86:93:79:91:8f:a7:95:71:46:06:69:
                    fc:cc:65:64:e7:99:11:cc:82:bb:39:6b:12:27:73:
                    0e:d1:e7:65:51:9e:ad:dc:b3:ff:3f:ba:b0:72:4f:
                    22:ad:7e:41:bb:3c:c7:80:30:81:5f:8b:32:f4:7f:
                    22:48:3f:3d:a9:eb:28:27:12:db:a9:63:c9:7e:e2:
                    ed:36:de:e7:68:31:4e:9c:c0:36:e8:f2:d9:3f:50:
                    09:50:a3:e8:7a:03:00:4f:8d:e1:10:eb:a1:87:44:
                    be:23
                Exponent: 65537 (0x10001)
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        06:7d:84:00:ac:8f:8b:a6:b6:b7:b5:ed:ee:7f:61:76:6d:ee:
        11:53:f6:d1:f8:95:ad:6c:d7:d0:3e:01:ac:bb:d7:7a:8d:59:
        80:ec:ba:b2:7b:78:5c:4f:5e:3f:f1:74:ad:d9:8c:a2:6b:08:
        9c:bf:b1:42:fd:8d:a6:35:48:4d:a7:2d:92:c9:45:66:77:32:
        a4:e0:ea:eb:e0:4a:42:f5:dd:ea:a2:c0:0a:66:5a:32:03:1d:
        e7:87:3a:7f:1e:00:ed:d0:21:01:d5:f9:e2:b1:e6:b7:cb:1c:
        67:11:de:69:7f:a2:ce:d0:fc:2d:f2:6c:33:84:4c:3d:f4:f6:
        60:6b:2e:31:b7:0c:41:2c:73:31:7e:94:19:a2:2b:6a:56:3f:
        07:37:71:97:28:58:91:63:b2:58:97:b2:aa:1e:d5:d9:6d:af:
        6f:a0:02:e0:06:39:b0:c9:f5:50:41:b5:58:41:6a:30:72:89:
        9a:67:7e:a1:7a:a5:02:b9:2a:f3:f8:93:4f:59:6e:b1:27:54:
        86:d1:ec:96:7a:dd:d1:44:6b:1e:3b:17:cf:15:64:ad:83:6b:
        63:20:2d:42:c3:28:68:14:de:12:4e:8a:c3:f3:10:c8:4b:4f:
        c7:d8:2b:a8:45:fb:3a:bd:9d:bd:08:71:08:09:ed:ea:9b:b9:
        3b:33:a6:a6

[04/14/24 18:37:27](K-6.6.27)
root@WRX36 ~
➤ /opt/bin/nginx-ssl-util add_ssl _ec
Adding SSL directives to UCI server: nginx._ec
uci_manage_ssl='self-signed'
Created self-signed SSL certificate '/etc/nginx/conf.d/_ec.crt' with key '/etc/nginx/conf.d/_ec.key'.

[04/14/24 18:37:43](K-6.6.27)
root@WRX36 ~
➤ openssl x509 -in /etc/nginx/conf.d/_ec.crt -text -noout
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            55:32:fe:07:09:79:d1:40:d7:43:2e:45:3d:98:4a:77:65:d0:29:41
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = ZZ, ST = Somewhere, L = None, CN = OpenWrt, O = OpenWrt2EDD40F41960C8C1
        Validity
            Not Before: Apr 14 22:37:43 2024 GMT
            Not After : Jul 16 22:37:43 2027 GMT
        Subject: C = ZZ, ST = Somewhere, L = None, CN = OpenWrt, O = OpenWrt2EDD40F41960C8C1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                pub:
                    04:97:d2:b2:f0:c9:60:60:89:7e:ea:6f:48:1c:90:
                    8e:6d:1d:d8:58:46:8c:de:e9:50:e2:74:ea:d8:dd:
                    8c:d9:ed:f4:4c:b7:41:95:55:98:38:5a:9e:66:83:
                    b9:7c:79:71:9b:ec:18:ed:d9:09:3c:f7:64:32:ae:
                    59:ad:92:de:d7:c4:15:2e:e5:89:65:f4:29:8a:62:
                    a0:85:21:95:22:3a:38:e3:11:e6:f2:01:f6:50:62:
                    01:ed:68:0d:d0:0c:d4
                ASN1 OID: secp384r1
                NIST CURVE: P-384
    Signature Algorithm: ecdsa-with-SHA256
    Signature Value:
        30:65:02:30:78:af:d1:4f:57:b1:97:2b:87:aa:7f:a2:26:39:
        19:30:5c:4f:9c:f0:d7:ee:24:8e:a2:39:ec:70:af:16:eb:a6:
        72:96:d4:a7:2f:c1:38:f4:65:ed:ed:bf:22:c6:a4:6d:02:31:
        00:bc:ec:19:0e:3d:6a:d1:5a:ae:6d:5c:a3:ec:96:60:32:f9:
        6a:88:06:92:ed:c1:a7:44:2c:33:7a:22:72:0f:2a:ce:83:f0:
        f2:04:9e:49:60:ef:83:b4:7f:8b:af:61:c9

```

Maintainer: Peter Stadler <peter.stadler@student.uibk.ac.at>
Compile tested: aarch64, qualcommax, Master Branch
Run tested: aarch64, Dynalink DL-WRX36, Master Branch

Signed-off-by: Sean Khan <datapronix@protonmail.com>

mwan3: "use" action: run process via `exec` and handle whitespace

Previously the "use" command had the following shortcomings:
* a subprocess was created instead of replacing the shell process
* whitespace in arguments was not handled correctly

Implementation detail:
In shell context the `"$@"` expression should be used (instead of `$*`).
This allows the safe handling of arguments containing whitespace.

Closes: #20001
Signed-off-by: Lars Kruse <devel@sumpfralle.de>