https-dns-proxy: prepare migration to APK

Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit dae56fd2a5d4ac579dff5d151cefe45b8d873bd6)

django: bump to version 4.2.11

Addresses a bunch of CVEs.
A more recent one: https://nvd.nist.gov/vuln/detail/CVE-2024-24680

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>

Merge pull request #23691 from EricLuehrsen/unbound_1193_wrt23

[23.05] Backport Unbound 1.19.3 and script fixes to stable

unbound: update to 1.19.3

Signed-off-by: Jan Klos <jan@klos.xyz>

unbound: spell fix

Closes openwrt/luci#6993

Signed-off-by: Paul Donald <newtwen@gmail.com>

unbound: add file parameter to service instance

that way, procd does not needlessly restart unbound on triggers when
everything remains the same - changes in non-default included
configuration files will not be registered, however

Signed-off-by: Jan Klos <jan@klos.xyz>

unbound: remove date/time from config headers

so that procd can decide whether to restart unbound based on config
file changes

Signed-off-by: Jan Klos <jan@klos.xyz>

travelmate: update 2.1.2-6

* fix vpn semaphore handling (#23643), thanks to @brianjmurrell
* disable vpn processing by default

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit b8c47eae98929ea61d124af0e554daad8cc4feae)

p910nd: restart daemon even if no driver file is needed

Not all USB printers need a blob loading; restart the daemon
independently of driver loading.

Closes openwrt/packages#23588

Signed-off-by: Paul Donald <newtwen@gmail.com>
Tested-by: minicx <minicx@disroot.org>
(cherry picked from commit 685ef7d97b345c09edd428250794dd9fce07a174)

shared-mime-info: update to 2.4

Signed-off-by: W. Michael Petullo <mike@flyn.org>
(cherry picked from commit 09bfc9483dfb437904b2a9e77670e2addbe83738)

shared-mime-info: update to 2.2

Signed-off-by: W. Michael Petullo <mike@flyn.org>
(cherry picked from commit 4f608bb99852c96772dee55f0cb2ddbc17f2fd76)

shadowsocks-libev: add remote server ips to dst bypass ipset

To align with old iptables-based ss-rules implementation.

Supersedes openwrt/packages#20239

Link: https://github.com/openwrt/packages/pull/20239
Signed-off-by: Luis Liou <liouluis@gmail.com>
[minor fixup on commit title, version bump, etc.]
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry picked from commit 85b634f0b4f03d057613d45553ca272af877c27e)

libwslay: remove, nothing depends on it since h2o is gone

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>
(cherry picked from commit e1b6bac484e1a1d45f9001c4c0778f6136492a6c)

dnsdist: disable XSK to fix the build

XSK support is set to auto by default and on some hosts it is detected as
on and leads to:

```
In file included from dnsdist-backend.cc:32:
xsk.hh:28:10: fatal error: bits/types/struct_timespec.h: No such file or
directory
   28 | #include <bits/types/struct_timespec.h>
```

Here we disable XSK so configure will behave more deterministically and
hopefully fix the builders.

Signed-off-by: krant <aleksey.vasilenko@gmail.com>
(cherry picked from commit f8dcc36af4f2f40076e4d07b1acd1a0177a7dbcb)

dnsdist: update to 1.9.0

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>
(cherry picked from commit aa4fb5151a38e5ac0a495882b423f1d4f679ac0b)

dnsdist: Enable custom load-balancing policies in the light version

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
(cherry picked from commit 738937a9c60079b8b15979cd79614d79ef132cff)

dnsdist: update to 1.8.3

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>
(cherry picked from commit b6b9519975318cb2177710aafe6286bbdf583d83)

h2o: remove, nothing depends on it anymore

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>
(cherry picked from commit d30a34bac1376a90f5767bfefa6e5eeaf4a945a7)

nghttp3: fix pkgconfig file

CMake build is passing host paths in pkgconfig.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit fa79aaad5f79447b579b98ea2e418486be71261d)

clamav: update to 1.3.0

- Add build-time Rust dependency
- Don't set default and rename changed CMake options

Signed-off-by: krant <aleksey.vasilenko@gmail.com>
(cherry picked from commit a9a1e7c3a68fab5317153835de90db8cd5c9ec3c)

knot: update to version 3.3.5

Signed-off-by: Jan Hák <jan.hak@nic.cz>
(cherry picked from commit d660dc6e7ca497bf83b09865570d5c3b37b2609e)

acme-common: use validation_method option instead of guessing

The new validation_method option can be: dns, webroot or standalone.
Previously we guessed the challenge type:
1. if the DNS provider is specified then it's dns
2. if standalone=1
3. fallback to webroot

The logic is preserved and if the validation_method wasn't set explicitly we'll guess it in old manner.

Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
(cherry picked from commit 7d07c75154d8d77b39db1012493a21ef02cbf5bb)

ntpclient: remove

ntp sources are dead and gone. The most important functionality is now
provided by ntpd.

Signed-off-by: Paul Donald <newtwen@gmail.com>
(cherry picked from commit 2cd10d81134b5ff4b6350c477da3c9196e1b7489)

syslog-ng: update to version 4.6.0

1. Bump version config to 4.6
2. Updated to 4.6.0 version
https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.6.0
https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.5.0

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit cf4df28d06e3ffa9ce0971fb29f9212cb97cfbee)

syslog-ng: conf: fix deprecated stats_freq

The deprecated stats_freq() replaced with stats(freq(0)).

Also make comments shorter.
Fix tabs.

Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
(cherry picked from commit 37d2d69595e2e454c2562c3d963dc8065a24db70)

v2ray-core: Update to 5.14.1

Including security fixes, see release note:
https://github.com/v2fly/v2ray-core/releases/tag/v5.14.1

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 9834d79ea17a2fed3d7e84d225de03b512310a88)

c-ares: update to 1.27.0

- Update package URL
- Don't set default CMake options

Signed-off-by: krant <aleksey.vasilenko@gmail.com>
(cherry picked from commit 0858accfda87e09df019c2e8ba4ab51f6323f17e)

apfree-wifidog: update to 7.02.1977

Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>

apfree-wifidog: fix some bugs in the wifidogx.init file

Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>

Merge pull request #23573 from stangri/openwrt-23.05-https-dns-proxy

[23.05] https-dns-proxy: update to upstream 2023-11-19

banip: update 0.9.4-3

* fix another logical glitch in the logfile monitor

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 4356180197a7a32236a05b332eebf6cf1329cb25)

natmap: update to 20240303

Signed-off-by: Ray Wang <r@hev.cc>
(cherry picked from commit 7bbd9156cc478ab133d142f05f243eb3061d0c8d)

v2raya: Update to 2.2.5.1

Hot fix for a frontend failure bug.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit ab2f10233ed984b0c8935005a0d26efa57c7a4d1)

dnsproxy: Update to 0.65.2

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit b5290ace07891fe744863a0858290bc627bbff01)

golang: Update to 1.21.7

go1.21.6 (released 2024-01-09) includes fixes to the compiler,
the runtime, and the crypto/tls, maps, and runtime/pprof packages.

go1.21.7 (released 2024-02-06) includes fixes to the compiler,
the go command, the runtime, and the crypto/x509 package.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 34867e83ca666094114d1f53c2831d2da221c428)

v2raya: Update to 2.2.5

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 381d1af34796bbc2254581360243e56ea3766e19)

banip: update 0.9.4-2

* fix a long standing problem in the logfile-parser with dropbear and compressed IPv6 addresses

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 7b06b1d312ed3a43d2d030b55b6932a55365b5bd)

banip: release 0.9.4-1

* add support for destination port & protocol limitations for external feeds (see readme for details),
  useful for lan-forward ad- or DoH-blocking, e.g. only tcp ports 80 and 443
* add turris sentinel blocklist feed
* update readme

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 730ad59cb960bd10c1a3a7597cafaabf080dcf7a)

rclone: add fuse3-utils as dependency

rclone has switched to use fuse3 since v1.62.0.

Reported-by: qiuzi <gxfclql@gmail.com>
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit df9d076d600a3d02da198af4a625980ed0633d2a)

yq: Update to 4.42.1

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit fa54dbc72a8aa25830b1c2e341876182ea19b455)

v2fly-geodata: Update to latest version

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 120fc57d553ef76ce144fccec1426b7ce1bc4c73)

cloudflared: Update to 2024.2.1

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 18aef55126916334e35fe24d3a9268fac6cb9e76)

btop: Update to 1.3.2

Synced LDFLAGS from upstream Makefile.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 187b52c95afc826213ba3e204e43ed009d8e8908)

v2raya: Update to 2.2.4.7

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 870d09c5dd577a05cd850228b4a2e4aaa3f4362c)

yq: Update to 4.41.1

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 69d963df9e7fc580d7efa11ccaf372b2b2dc8986)

yq: Update to 4.40.7

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit aec476691327417dd1b5576fad1600ae53b03697)

cloudflared: Update to 2024.2.0

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 87bd747652ad03a07ea550db79797563e132da00)

v2ray-geodata: Update to latest version

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 21a8b968d16cb1655eb8bed516a334be198a0c7c)

https-dns-proxy: update to upstream 2023-11-19

* update to upstream 2023-11-19
  (changes: https://github.com/aarond10/https_dns_proxy/commit/489c57efd46983e688579974a2ab7aeaa7df8d83)
* bugfix: include resolveip dependency in Makefile
  (fixes https://github.com/openwrt/packages/issues/23567)
* minor update for failed healthcheck logging

Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit bd501dd89c65857c060ca1ac034bc2fe7846b4e7)

rtl-sdr: update to v2.0.1

Signed-off-by: Edmunt Pienkowsky <roed@onet.eu>
(cherry picked from commit c623291b383495a71dcddbbb866d5aa6c9ccb1a4)
Signed-off-by: Edmunt Pienkowsky <roed@onet.eu>

rtl_433: update to 23.11

Signed-off-by: Edmunt Pienkowsky <roed@onet.eu>
(cherry picked from commit 0bb9240f6be9b695d1eebf9f0d96092957efe85c)
Signed-off-by: Edmunt Pienkowsky <roed@onet.eu>

travelmate: update 2.1.2-5

* final vpn tweaks

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit bec5f35dea7ac5b4b4b7d75a931be470a19d4f22)

adblock: update 4.1.5-9

* minimal fix with reporting interface 'any'

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 0af6e8d15898f62c0c5080877af4fd8557bb4731)

ragel: new package to build vectorscan

This is a new package for ragel which is a dependency for another
new package vectorscan

Co-authored-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit fa76c4df5c857ee564bf2f2eaeedfea5b497b1e7)

snort3: build against gperftools-runtime

Should provide increases in snort3 performance thanks to thread-
caching malloc provided by gperftools.  Avg CPU usage is down.
Another user reported higher throughput achieved with snort3
compiled with this on samba transfers on system with CPU-limited
snort3 performance.[1]

1. https://forum.openwrt.org/t/some-help-with-a-makefile-gperftools/165656/22

Build system: x86/64
Build-tested: x86/64/AMD Cezanne
Run-tested: x86/64/AMD Cezanne

Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 4295bd7f45943b92e6e12ba91aac5f701b2da5a3)

snort3: update to 3.1.81.0

Changelog: https://github.com/snort3/snort3/releases/tag/3.1.81.0

   ,,_     -*> Snort++ <*-
  o"  )~   Version 3.1.81.0
   ''''    By Martin Roesch & The Snort Team
           http://snort.org/contact#team
           Copyright (C) 2014-2024 Cisco and/or its affiliates. All rights reserved.
           Copyright (C) 1998-2013 Sourcefire, Inc., et al.
           Using DAQ version 3.0.14
           Using LuaJIT version 2.1.0-beta3
           Using OpenSSL 3.0.13 30 Jan 2024
           Using libpcap version 1.10.4 (with TPACKET_V3)
           Using PCRE version 8.45 2021-06-15
           Using ZLIB version 1.3.1
           Using Hyperscan version 5.4.2 2024-02-16
           Using LZMA version 5.4.6

Build system: x86/64
Build-tested: x86/64/AMD Cezanne
Run-tested: x86/64/AMD Cezanne

Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit a7b5bfbfb75c07f05072e52224d3259648165916)

gperftools: add new package

Thread-caching malloc provided by this package improves snort3
performance.  I have been running with this for over seven months
without issues.  Avg CPU usage is down.  Another user reported
higher throughput achieved with snort3 compiled with this on
samba transfers on system with CPU-limited snort performance.[1]

1. https://forum.openwrt.org/t/some-help-with-a-makefile-gperftools/165656/22

Build system: x86/64
Build-tested: x86/64
Run-tested: x86/64

Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit c1b4e80825d6855d66899dc32490b0ce9537aff5)

hyperscan: new package for speeding up regex ops

Hyperscan is a high performance regular expression matching
library from Intel that runs on x86 platforms and offers
support for Perl Compatible Regular Expressions (PCRE) syntax,
simultaneous matching of groups of regular expressions, and
streaming operations.

This has utility in speeding up snort3.

Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 1db5c5461778223c661ae9206f3c5d6929081b84)

dockerd: Update to 25.0.3

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

docker: Update to 25.0.3

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

containerd: Update to 1.7.13

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

runc: Update to 1.1.12

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

tailscale: Update to 1.58.2

https://github.com/tailscale/tailscale/releases/tag/v1.58.2

Signed-off-by: Zephyr Lykos <git@mochaa.ws>
(cherry picked from commit a37a6e17035f67c8f6c3e4325d0bae116e0fcf2a)

tailscale: Update to 1.58.0

https://github.com/tailscale/tailscale/releases/tag/v1.58.0

Signed-off-by: Zephyr Lykos <git@mochaa.ws>
(cherry picked from commit 0b0a13ed3338e7111f28c14c296a00a4f6b9123c)

travelmate: update 2.1.2-4

* more re-connections tweaks
* made travelmate generated emails responsive

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit bd8829b341b8e86147280ba5aa2c4523f3adc2af)

Merge pull request #23485 from mhei/23.05-php8-update-to-8.2.16

[23.05] php8: update to 8.2.16

travelmate: update 2.1.2-3

* various vpn optimizations
* remove obsololete trm_maxscan option
* small fixes for net status and captive portal handling
* add an additional login variant to the h-hotels login script
* fix the wifibahn login script work again with wifionice hotspots again
* update readme

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 6e4ea63b7e701298807babecfc8d319327d6a4ad)

git: update to 2.43.2

- Refresh a patch

Signed-off-by: krant <aleksey.vasilenko@gmail.com>
(cherry picked from commit f9e16375f6ab491be91b506e6c9a7828ee9f7adf)

git: update to 2.43.0

- Refresh patches

Signed-off-by: krant <aleksey.vasilenko@gmail.com>
(cherry picked from commit 158b76119385cc5d4bacdde9b903da8cabd44706)

lighttpd: update to lighttpd 1.4.74 release hash

Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
(cherry picked from commit 4d8bb07b734391d11318cb319548a17273820685)

ovn: bump to 22.03.5

Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry picked from commit 4d1c7a144ab06dfdad6b11a90a364e7f88a976c3)

openvswitch: bump to 2.17.9

Refresh and backport patches so that

 - ./python path in the source code takes precedence over the same dir in hostpkg
 - OVN LTS version 22.03.5 which depends on Open vSwitch 3.0 can compile
   with Open vSwitch 2.17

Fixes: https://github.com/openwrt/packages/issues/22744
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry picked from commit 7ccbb9a66cfadba035e2ad95a7931877e5faf504)

squid: fix configure options

- Remove non-existing 'dlmalloc' option
- Use 'with-cap' instead of 'with-libcap'
- Use 'with-xml2' instead of 'with-libxml2'
- Patch configure.ac to properly handle 'with-nettle'

Signed-off-by: krant <aleksey.vasilenko@gmail.com>
(cherry picked from commit f58be51721fb0e2c5aa0747bce36a19deb7392dd)

unbound: update to latest upstream release version 1.19.1

Maintainer: @EricLuehrsen
Fixes: CVE-2023-50387, CVE-2023-50868
Release notes: https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/
Run tested: BPi-R3, mediatek/filogic, OpenWrt 23.05.2 with updated packages from snapshot
Signed-off-by: S. Brusch <ne20002@gmx.ch>
(cherry picked from commit 35ba14e50c6c90b3cc32538573d02a3b4f5b9184)

libuv: fix CVE-2024-24806

Update to 1.48.0
CVE-2024-24806 : Improper Domain Lookup that potentially leads to SSRF attacks

Vulnerabilities fixed
* CVE-2024-24806 / GHSA-f74f-cvh7-c6q6 0f2d7e7, 3530bcc and e0327e1
Notable Changes
* linux: disable io_uring on ppc64 and ppc64le #4285
* linux: disable io_uring on hppa below kernel 6.1.51 #4224
* win/spawn: optionally run executable paths with no file extension #4292 (We recommend that most users consider setting this by default)
Important Bugs Fixed
* unix,win: fix busy loop with zero timeout timers #4250, #4304.

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry picked from commit 02a982bc10e8278905d0b76ac073b82192576433)

haproxy: update to v2.8.6

- Update haproxy PKG_VERSION and PKG_HASH
- See changes: http://git.haproxy.org/?p=haproxy-2.8.git;a=shortlog

Signed-off-by: Christian Lachner <gladiac@gmail.com>

ocserv: updated config

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

ocserv: use better separator for sed

This prevents clashes with network addresses that
contain '/'.

Resolves: #18589

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

openconnect: make host dependency more resilient

Retry when resolveip fails as it seems to be causing issues
on startup depending on various unpredictable parameters.

Resolves: #23185

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

openconnect: update to 9.12

Remove upstream backport and fix libxml 1.12 compilation.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

openconnect: add support for option --pfs

Add support for the OpenConnect option `--pfs`.
Designed to require perfect forward secrecy.

Signed-off-by: Vladislav Grigoryev <vg.aetera@gmail.com>

php8: update to 8.2.16

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

lxc: update to 5.0.3

Bump to latest upstream release.

Build system: x86/64
Build-tested: x86/64/AMD Cezanne
Run-tested: x86/64/AMD Cezanne

Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 1b5ee689f3f8fa68580206274b5b67c06db3ec91)

zabbix: update to version 6.4.7

Switch to current stable version 6.4.7.
See release notes:
https://www.zabbix.com/rn/rn6.4.7

So that the new version builds cleanly. The 'libevent2-pthreads' must be
added as dependency.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 4f9ced5cf9d411dc54a815beb365b539c561bbfb)

yt-dlp: bump to version 2023.12.30

Signed-off-by: Alexander Egorenkov <egorenar-dev@posteo.net>
(cherry picked from commit 5d3424f992b09602f2abd4e71cb163a3af8f3e7c)

yt-dlp: bump to version 2023.11.16

Signed-off-by: Alexander Egorenkov <egorenar-dev@posteo.net>
(cherry picked from commit 707e87884d67650c26fda2c30c790d5832e319d7)

yt-dlp: add missing dependencies

Added missing python3-{logging,uuid} dependencies.

Signed-off-by: Rani Hod <rani.hod@gmail.com>
(cherry picked from commit 40a680ffd7d155798123a9eadcc3411f7a201259)

node: February 14 2024 Security Releases

Update to v18.19.1
This is a security release.

Notable changes
* CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High)
* CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
* CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
* CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)
* undici version 5.28.3
* npm version 10.2.4

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

Merge pull request #23407 from stangri/openwrt-23.05-adblock-fast

[23.05] adblock-fast: add force_dns_interface setting

bind: bump to 9.18.24

Fixes CVEs:

- CVE-2023-50387: Validating DNS messages containing a lot of DNSSEC signatures
  could cause excessive CPU load, leading to a denial-of-service condition.
- CVE-2023-50868: Preparing an NSEC3 closest encloser proof could cause
  excessive CPU load, leading to a denial-of-service condition.
- CVE-2023-4408: Parsing DNS messages with many different names could cause
  excessive CPU load.
- CVE-2023-5517: Specific queries could cause named to crash with an assertion
  failure when nxdomain-redirect was enabled.
- CVE-2023-5679: A bad interaction between DNS64 and serve-stale could cause
  named to crash with an assertion failure, when both of these features were
  enabled.

Signed-off-by: Noah Meyerhans <frodo@morgul.net>
(cherry picked from commit d277e41e78972130f75dc816ebcbd7931f582519)

bind: bump to 9.18.19

Fixes CVEs:

CVE-2023-3341 - Previously, sending a specially crafted message over the
control channel could cause the packet-parsing code to run out of available
stack memory, causing named to terminate unexpectedly.

CVE-2023-4236 - A flaw in the networking code handling DNS-over-TLS queries
could cause named to terminate unexpectedly due to an assertion failure under
significant DNS-over-TLS query load.

Signed-off-by: Noah Meyerhans <frodo@morgul.net>
(cherry picked from commit 835b1051511b592d69bc0b8a7d5d993337f890da)

bind: update to version 9.18.18

Release notes:
https://downloads.isc.org/isc/bind9/9.18.18/doc/arm/html/notes.html#notes-for-bind-9-18-18
https://downloads.isc.org/isc/bind9/9.18.17/doc/arm/html/notes.html#notes-for-bind-9-18-17

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 6a8d3565f0a99fe22cac6db9a8bbf553b7dff5a5)

bind: bump to 9.18.16

Fixes CVEs:

- CVE-2023-2828: The overmem cleaning process has been improved, to
  prevent the cache from significantly exceeding the configured
  max-cache-size limit.
- CVE-2023-2911: A query that prioritizes stale data over lookup
  triggers a fetch to refresh the stale data in cache. If the fetch is
  aborted for exceeding the recursion quota, it was possible for named
  to enter an infinite callback loop and crash due to stack overflow.

The complete list of changes is available in the upstream release
notes at
https://ftp.isc.org/isc/bind9/cur/9.18/doc/arm/html/notes.html#notes-for-bind-9-18-16

Signed-off-by: Noah Meyerhans <frodo@morgul.net>
(cherry picked from commit 9ac79ad46966908d2ceb64c0e0d8a0bff435767a)

pdns-recursor: update to 4.8.6 (fixes CVE-2023-50387, CVE-2023-50868)

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>

Merge pull request #23415 from systemcrash/p910nd_picks

P910nd v23.05 picks

squid: update to 6.7

- Switch URL to HTTPS
- Remove default/obsolete configure options
- Fix and refresh the patch

Signed-off-by: krant <aleksey.vasilenko@gmail.com>
(cherry picked from commit 4007a08529a86b600b4ce6476cf6367de577a645)

p910nd: bump release

Signed-off-by: Paul Donald <newtwen@gmail.com>
(cherry picked from commit 9dad4285d3c2de30cf27baa2b299246bda514577)

p910nd: hotplug shellcheck fixes

Signed-off-by: Paul Donald <newtwen@gmail.com>
(cherry picked from commit 58e7bfc41f02118e5d8b6f5b08a021d9bc351e00)

p910nd: init: check device (/dev/usb/lpX) existence

this prevents the daemon exiting when a configured device
is not plugged in.

Signed-off-by: Paul Donald <newtwen@gmail.com>
(cherry picked from commit dabeaa76439260a6a41942365b2526c69dc728aa)

p910nd: init: partial fix for openwrt/packages#10496

Harmless to carry this fix until procd.sh adds the param

This parameter will mean umdns advertises not just "OpenWrt" but a more
appropriate string:

"Apple LaserWriter Pro 630"

Signed-off-by: Paul Donald <newtwen@gmail.com>
(cherry picked from commit ac501c908d1a6a607f89373d4667a6949b88ca55)