]> git.ipfire.org Git - ipfire-2.x.git/log
ipfire-2.x.git
7 months agowhatmask: update rootfile
Arne Fitzenreiter [Wed, 16 Oct 2024 19:29:15 +0000 (21:29 +0200)] 
whatmask: update rootfile

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
7 months agopkg-config: update rootfile
Arne Fitzenreiter [Wed, 16 Oct 2024 19:28:27 +0000 (21:28 +0200)] 
pkg-config: update rootfile
:
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
7 months agoperl-MIME-Tools: update rootfile
Arne Fitzenreiter [Wed, 16 Oct 2024 19:27:34 +0000 (21:27 +0200)] 
perl-MIME-Tools: update rootfile

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
7 months agoperl-Archive-Zip: update rootfile
Arne Fitzenreiter [Wed, 16 Oct 2024 19:26:16 +0000 (21:26 +0200)] 
perl-Archive-Zip: update rootfile

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
7 months agoautoconf-archive: update rootfile
Arne Fitzenreiter [Wed, 16 Oct 2024 19:25:17 +0000 (21:25 +0200)] 
autoconf-archive: update rootfile

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
7 months agocmake: update rootfile
Arne Fitzenreiter [Wed, 16 Oct 2024 19:24:16 +0000 (21:24 +0200)] 
cmake: update rootfile

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
7 months agomake.sh: Check for changes in logs
Michael Tremer [Wed, 16 Oct 2024 16:40:50 +0000 (16:40 +0000)] 
make.sh: Check for changes in logs

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agodhcpcd: Update to version 10.1.0
Adolf Belka [Tue, 15 Oct 2024 07:35:22 +0000 (09:35 +0200)] 
dhcpcd: Update to version 10.1.0

- Update from version 10.0.10 to 10.1.0
- Update of rootfile not required
- Changelog
    10.1.0
Bug Fixes
dhcp: get_option_uint32/16 only accept options with correct len by
 @taoyl-g in #357
Include frame header in buffer length by @acst1223 in #371
For full changelog see commits delta in
 https://github.com/NetworkConfiguration/dhcpcd/compare/v10.0.10...v10.1.0

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agosquid: Update to 6.12
Matthias Fischer [Sat, 12 Oct 2024 15:48:43 +0000 (17:48 +0200)] 
squid: Update to 6.12

For details see:
https://github.com/squid-cache/squid/commits/v6

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agomonit: Update to 5.34.2
Matthias Fischer [Sat, 12 Oct 2024 15:46:12 +0000 (17:46 +0200)] 
monit: Update to 5.34.2

For details see:
https://mmonit.com/monit/changes/

"Fixed: The network protocol test may occasionally fail with a
"Poll failed: Interrupted system call" error."

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agomake.sh: Avoid finding non-existant rootfiles
Michael Tremer [Mon, 14 Oct 2024 09:02:37 +0000 (09:02 +0000)] 
make.sh: Avoid finding non-existant rootfiles

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agokernel: Enable IO uring
Michael Tremer [Mon, 14 Oct 2024 09:00:21 +0000 (09:00 +0000)] 
kernel: Enable IO uring

This is a feature more and more tools start using now and will help to
keep performance of the OS up.

This was enabled on riscv64 already.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agotshark: Update to version 4.4.1
Adolf Belka [Thu, 10 Oct 2024 16:01:11 +0000 (18:01 +0200)] 
tshark: Update to version 4.4.1

- Update from version 4.2.7 to 4.4.1
- The 4.4.x series is the new Stable Release replascing the 4.2.x series which becomes
   the Old Stable Release.
- There is an sobump so find-dependencies was run for the three libraries with changes
   but all linked programs are within tshark.
- Changelog is too large to include here. Links provided
    4.4.1
https://www.wireshark.org/docs/relnotes/wireshark-4.4.1.html
    4.4.0
https://www.wireshark.org/docs/relnotes/wireshark-4.4.0.html

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agomake.sh: Show rootfiles that contain some architecture
Michael Tremer [Sat, 12 Oct 2024 09:34:45 +0000 (09:34 +0000)] 
make.sh: Show rootfiles that contain some architecture

Previously, make.sh just failed but did not explain why it was unhappy.

This patch adds a message which rootfiles contain which architecture.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agomympd: update to 18.0.0
Arne Fitzenreiter [Fri, 11 Oct 2024 11:30:13 +0000 (13:30 +0200)] 
mympd: update to 18.0.0

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
8 months agokernel: update to 6.6.56
Arne Fitzenreiter [Fri, 11 Oct 2024 11:17:53 +0000 (13:17 +0200)] 
kernel: update to 6.6.56

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
8 months agortl8812au: add missing rootfile.
Arne Fitzenreiter [Fri, 11 Oct 2024 11:12:17 +0000 (13:12 +0200)] 
rtl8812au: add missing rootfile.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
8 months agomonit: Update to 5.34.1
Matthias Fischer [Wed, 9 Oct 2024 12:42:00 +0000 (14:42 +0200)] 
monit: Update to 5.34.1

For details see:
https://mmonit.com/monit/changes/

"Fixed: The check program now avoids leaving zombie processes between cycles."

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agolcdproc: removal as discussed in Conf call 7th Oct
Adolf Belka [Tue, 8 Oct 2024 21:34:26 +0000 (23:34 +0200)] 
lcdproc: removal as discussed in Conf call 7th Oct

- removal of lfs, rootfile and config files
- backup includes file is also removed, althouigh it was an empty file, so not backing
   anything up.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agompfire: removal as discussed in Conf call 7th Oct
Adolf Belka [Tue, 8 Oct 2024 16:45:59 +0000 (18:45 +0200)] 
mpfire: removal as discussed in Conf call 7th Oct

- removal of lfs, rootfile, backup, paks, misc-progs, mpfire perl, language file
   content, mpfire.cgi, mpfire menu references and files, mpfire specific image,
   web-user-interface references and references in manualpages.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agocore190: Ship ppp
Michael Tremer [Wed, 9 Oct 2024 18:25:33 +0000 (18:25 +0000)] 
core190: Ship ppp

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoppp: Update to version 2.5.1
Adolf Belka [Tue, 8 Oct 2024 12:24:24 +0000 (14:24 +0200)] 
ppp: Update to version 2.5.1

- Update from version commit e1266c7 to 2.5.1
- Version 2.5.1 has around 34 additional commits from e1266c7. To me all look minor
   changes, some related to other system types such as Solaris that we don't use.
- Update of rootfile
- They have added example to the configuration files to prevent accidental overwriting
   of configuration systems.
- Changelog - There is no longer any changelog provided. Even the one that used to
   exist for version 2.5.0 has been removed. The only option now is to look through the
   commits - https://github.com/ppp-project/ppp/commits/master/?before=d5aeec65752d4a9b3bb46771d0b221c4a4a6539e+35
- Some of the patches had to be updated as the changes were enough that some hunks did
   not get found for patching. Patch file number 6 has been removed as the sed lines are
   no longer to be found in the configure file. The other files that patched successfully
   were renamed to 2.5.1

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoMerge branch 'master' into next
Michael Tremer [Tue, 8 Oct 2024 08:48:14 +0000 (08:48 +0000)] 
Merge branch 'master' into next

8 months agohostapd: update to git 64d60bb4 core189 v2.29-core189
Arne Fitzenreiter [Sun, 29 Sep 2024 16:03:58 +0000 (18:03 +0200)] 
hostapd: update to git 64d60bb4

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agowlanap.cgi: Fix copying configuration
Michael Tremer [Fri, 20 Sep 2024 12:12:07 +0000 (14:12 +0200)] 
wlanap.cgi: Fix copying configuration

This allows to uncheck checkboxes again.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agowlanap.cgi: Change broadcast SSID to hide SSID
Michael Tremer [Fri, 20 Sep 2024 11:55:40 +0000 (13:55 +0200)] 
wlanap.cgi: Change broadcast SSID to hide SSID

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agowlanap.cgi: Default to channel 0 for ACS
Michael Tremer [Fri, 20 Sep 2024 11:19:10 +0000 (13:19 +0200)] 
wlanap.cgi: Default to channel 0 for ACS

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agowlanap.cgi: Enable Neighbourhood Scan by default
Michael Tremer [Fri, 20 Sep 2024 11:17:59 +0000 (13:17 +0200)] 
wlanap.cgi: Enable Neighbourhood Scan by default

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agowlanap.cgi: Don't try to show status if there is no interface
Michael Tremer [Fri, 20 Sep 2024 11:16:44 +0000 (13:16 +0200)] 
wlanap.cgi: Don't try to show status if there is no interface

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agowlanap.cgi: Correctly show broadcast SSID status
Michael Tremer [Fri, 20 Sep 2024 11:13:41 +0000 (13:13 +0200)] 
wlanap.cgi: Correctly show broadcast SSID status

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agowlanap.cgi: Disable generating Perl warnings
Michael Tremer [Fri, 20 Sep 2024 10:30:03 +0000 (11:30 +0100)] 
wlanap.cgi: Disable generating Perl warnings

Reported-by: Waynie <waynet@ucpix.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agocore189: Ship rules.pl
Michael Tremer [Tue, 8 Oct 2024 08:43:39 +0000 (08:43 +0000)] 
core189: Ship rules.pl

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agofirewall: Flush SYN_FLOOD_PROTECTION
Michael Tremer [Mon, 7 Oct 2024 09:13:12 +0000 (09:13 +0000)] 
firewall: Flush SYN_FLOOD_PROTECTION

This chain was not flushed when the firewall was being reloaded which
made any ports appear as open when rules have been disabled or deleted.

This has no security implications, but nevertheless isn't right.

Reported-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agocore190: Ship ncat again (just to be sure)
Michael Tremer [Mon, 7 Oct 2024 10:24:09 +0000 (10:24 +0000)] 
core190: Ship ncat again (just to be sure)

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoMerge branch 'master' into next
Michael Tremer [Mon, 7 Oct 2024 10:23:22 +0000 (10:23 +0000)] 
Merge branch 'master' into next

8 months agocore189: Ship ncat
Michael Tremer [Mon, 7 Oct 2024 10:22:33 +0000 (10:22 +0000)] 
core189: Ship ncat

This is required for the new Unbound/DHCP Leases bridge to work.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoncat: Make this package part of the core system
Michael Tremer [Mon, 7 Oct 2024 10:18:57 +0000 (10:18 +0000)] 
ncat: Make this package part of the core system

The nc command is required for the Unbound/DHCP leases bridge.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agocore190: Ship Unbound again
Michael Tremer [Mon, 7 Oct 2024 09:15:40 +0000 (09:15 +0000)] 
core190: Ship Unbound again

This was a late addition to c189

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoMerge branch 'master' into next
Michael Tremer [Mon, 7 Oct 2024 09:15:04 +0000 (09:15 +0000)] 
Merge branch 'master' into next

8 months agocore190: Ship rules.pl
Michael Tremer [Mon, 7 Oct 2024 09:14:37 +0000 (09:14 +0000)] 
core190: Ship rules.pl

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agofirewall: Flush SYN_FLOOD_PROTECTION
Michael Tremer [Mon, 7 Oct 2024 09:13:12 +0000 (09:13 +0000)] 
firewall: Flush SYN_FLOOD_PROTECTION

This chain was not flushed when the firewall was being reloaded which
made any ports appear as open when rules have been disabled or deleted.

This has no security implications, but nevertheless isn't right.

Reported-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agocore189: Ship and restart Unbound
Michael Tremer [Fri, 4 Oct 2024 11:46:22 +0000 (11:46 +0000)] 
core189: Ship and restart Unbound

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agounbound: Update to 1.21.1
Matthias Fischer [Fri, 4 Oct 2024 08:41:17 +0000 (10:41 +0200)] 
unbound: Update to 1.21.1

For details see:
https://nlnetlabs.nl/projects/unbound/download/#unbound-1-21-1

"Fix CVE-2024-8508, unbounded name compression could lead to denial of service."

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agocore190: Ship Suricata & libhtp
Michael Tremer [Wed, 2 Oct 2024 16:02:32 +0000 (16:02 +0000)] 
core190: Ship Suricata & libhtp

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agosuricata: Update to 7.0.7
Matthias Fischer [Wed, 2 Oct 2024 13:41:33 +0000 (15:41 +0200)] 
suricata: Update to 7.0.7

Exerpt from changelog:
"7.0.7 -- 2024-10-01

Security #7289: http: missing hashtable random seed leads to potential DoS(CRITICAL - CVE 2024-47188)
Security #7268: ja4: non alphanumeric characters in alpn lead to panic (7.0.x backport)(HIGH - CVE 2024-47522)
Security #7258: thash: random factor not used; possible abusive hash collisions (7.0.x backport)(CRITICAL - CVE 2024-47187)
Security #7215: defrag: off by one leads to possible evasion (7.0.x backport)(HIGH - CVE 2024-45796)
Security #7196: datasets: rule with unset makes suricata abort (7.0.x backport)(HIGH - CVE 2024-45795)
Security #7192: http: quadratic complexity in headers processing/finding (7.0.x backport)(CRITICAL - CVE 2024-45797)
Bug #7290: tls: a rule stops working since 7.0.5 (7.0.x backport)
Bug #7286: eve/tls: enabling JA4 breaks custom field selection
Bug #7276: ja3: Error: ja3: Buffer should not be NULL (7.0.x backport)
Bug #7271: pgsql: track 'progress' in tx per direction (7.0.x backport)
Bug #7265: detect/flow: ACK with data on 3whs fails to match 'flow:established' (7.0.x backport)
Bug #7257: fuzz: CIFuzz is not fuzzing PRs as it is supposed to (7.0.x backport)
Bug #7242: app-layer-protocol: negated matching false positive (7.0.x backport)
Bug #7239: tls: Invalid ja3 due to double client hello (7.0.x backport)
Bug #7225: dataset: lookup function is not working with ip type (7.0.x backport)
Bug #7214: frames: stream frame is not always the first one registered (7.0.x backport)
Bug #7207: cbindgen: comptability with newer version 0.27 (7.0.x backport)
Bug #7198: log/rfb: inconsistent key value security_result or security-result
Bug #7194: output: jb context not closed on error in EvePacket
Bug #7188: detect: dcerpc logging and matching issues (7.0.x backport)
Bug #7182: fuzz: File confyaml.c is missing (7.0.x backport)
Bug #7173: detect/integers: do not bother to free NULL pointer on setup/parse failure (7.0.x backport)
Bug #7166: profiling: rule profiling doesn't support absolute paths (7.0.x backport)
Bug #7159: tcp: 'broken ack' event set on flow timeout (7.0.x backport)
Bug #7136: util/thash: debug assertion for memuse (7.0.x backport)
Bug #7122: smb/ntlmssp: nonsense smb.ntlmssp.version values (7.0.x backport)
Bug #7116: dpdk: timestamping packets through TSC does not yield the same time as kernel time (7.0.x backport)
Bug #7066: alert/metadata: no pgsql object encapsulation (7.0.x backport)
Bug #7054: bypass: cannot bypass udp flow from first packet (7.0.x backport)
Bug #7001: pgsql: trigger raw stream reassembly (7.0.x backport)
Bug #6608: file: do not store if filestore:both,flow is triggered after the file was set to nostore (7.0.x backport)
Bug #6555: eve/alert: payload/payload_printable misrepresent data in case of overlaps (7.0.x backport)
Bug #6541: landlock: coverity warnings (7.0.x backport)
Optimization #7134: detect/snmp.version: do not free NULL pointer
Optimization #7075: dns/tcp: allow triggering raw stream reassembly (7.0.x backport)
Feature #7102: iprep: support seeing if rule is part of a rep list (7.0.x backport)
Feature #6674: detect: allow alert-then-pass logic (7.0.x backport)
Task #7249: libhtp 0.5.49 (7.0.x backport)
Task #7168: dns: make the version field in a dns object required (7.0.x backport)
Documentation #6641: doc: add tcp timeout fix to upgrade guide (7.0.x backport)"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agolibhtp: Update to 0.5.49
Matthias Fischer [Wed, 2 Oct 2024 13:41:32 +0000 (15:41 +0200)] 
libhtp: Update to 0.5.49

For details see:
https://github.com/OISF/libhtp/releases/tag/0.5.49

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agohostapd: update to git 64d60bb4
Arne Fitzenreiter [Sun, 29 Sep 2024 16:03:58 +0000 (18:03 +0200)] 
hostapd: update to git 64d60bb4

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoMerge branch 'master' into next
Michael Tremer [Sun, 29 Sep 2024 11:29:11 +0000 (11:29 +0000)] 
Merge branch 'master' into next

8 months agompd: fix chown syntax
Arne Fitzenreiter [Sun, 29 Sep 2024 07:44:55 +0000 (09:44 +0200)] 
mpd: fix chown syntax

this remove a warning at boot that user and group should
seperated by ":" and not by "."

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoovpnmain.cgi: Remove using dropped &General::getlastip() function
Michael Tremer [Thu, 26 Sep 2024 20:40:04 +0000 (20:40 +0000)] 
ovpnmain.cgi: Remove using dropped &General::getlastip() function

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agodnsdist: Update to version 1.9.6
Adolf Belka [Tue, 24 Sep 2024 10:33:36 +0000 (12:33 +0200)] 
dnsdist: Update to version 1.9.6

- Update from version 1.9.4 to 1.9.6
- Tested building on riscv64 and it built without issues and rootfile is sam as for
   x86_64 & aarch64. So supported architectures has been removed and dnsdist is available
   on all three architectures.
- Update of rootfile not required
- Changelog
    1.9.6
New Features
    Add support for a callback when a new tickets key is added
     References: pull request 14449
Improvements
    Make the logging functions available to all Lua environments
     References: pull request 14438
    Handle Quiche >= 0.22.0
     References: pull request 14450
    Don’t include openssl/engine.h if it’s not going to be used (Sander Hoentjen)
     References: pull request 14452
Bug Fixes
    Dedup Prometheus help and type lines for custom metrics with labels¶
     References: #14395, pull request 14439
    Fix a race in the XSK/AF_XDP backend handling code
     References: pull request 14436
    dns.cc: use pdns::views::UnsignedCharView
     References: pull request 14437
    1.9.5
New Features
    Add a Lua FFI function to set proxy protocol values
     References: pull request 14338
    Add Lua FFI bindings to generate SVC responses
     References: pull request 14339
Bug Fixes
    Use the correct source IP for outgoing QUIC datagrams
     References: pull request 14166
    Reply to HTTP/2 PING frames immediately
     References: pull request 14163
    Log the correct amount of bytes sent for DoH w/ nghttp2
     References: pull request 14332
    Prevent a race when calling registerWebHandler at runtime
     References: pull request 14170
    Enforce a maximum number of HTTP request fields and a maximum HTTP request line size
     References: pull request 14333
    Fix a race condition with custom Lua web handlers
     References: pull request 14342
    Syslog should be enabled by default
     References: pull request 14331
    Fix a warning when compiling the unit tests without XSK¶
     References: pull request 14334
    autoconf: allow prerelease systemd versions (Chris Hofstaedtler)
     References: pull request 14335
    Edit the systemd unit file, CAP_BPF is no longer enough
     References: #14279, pull request 14336
    Fix â€˜Error creating TCP worker’ error message
     References: pull request 14337

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoheader.pl: Force browsers to reload rrdimage.js
Michael Tremer [Thu, 26 Sep 2024 14:13:10 +0000 (14:13 +0000)] 
header.pl: Force browsers to reload rrdimage.js

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoovpnmain.cgi: Fix IP address calculation with static pools
Michael Tremer [Sun, 22 Sep 2024 14:33:03 +0000 (14:33 +0000)] 
ovpnmain.cgi: Fix IP address calculation with static pools

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agominiupnpc: Required for build of transmission to replace bundled version
Adolf Belka [Tue, 24 Sep 2024 09:43:01 +0000 (11:43 +0200)] 
miniupnpc: Required for build of transmission to replace bundled version

- miniupnpc is required for the build of transmiossion but the bundled version was not
   working properly with version 4.0.6 and we prefer to not use bundled versions.
- Only used for the build so rootfile is 100% commented out. No miniupnpc installed
   on IPFire.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agotransmission: Update to version 4.0.6
Adolf Belka [Tue, 24 Sep 2024 09:43:00 +0000 (11:43 +0200)] 
transmission: Update to version 4.0.6

- Update from version 4.0.5 to 4.0.6
- Update of rootfile not required
- Bundled miniupnpc not working with build of 4.0.6 As we prefer not to use bundled
   packages where possible, this patch set builds miniupnpc prior to transmission. As
   miniupnpc is only required for the build of transmission, nothing is installed from
   miniupnpc.
- miniupnpc-2.2.8 has a problem with transmission and needs a patch to fix it. Added
   into the transmission lfs file
- Changelog
    4.0.6
All Platforms
    Improved parsing HTTP tracker announce response. (#6223)
    Fixed 4.0.0 bug that caused some user scripts to have an invalid TR_TORRENT_TRACKERS environment variable. (#6434)
    Fixed 4.0.0 bug where alt-speed-enabled had no effect in settings.json. (#6483)
    Fixed 4.0.0 bug where the GTK client's "Use authentication" option was not saved between's sessions. (#6514)
    Fixed 4.0.0 bug where the filename for single-file torrents aren't sanitized. (#6846)
macOS Client
    Fix: Sparkle support for handling beta version updates. (#5263)
    Fixed app unable to start when having many torrents and TimeMachine enabled. (#6523)
    Fix: Sparkle Version Comparator. (#6623)
Qt Client
    Fixed 4.0.0 bug where piece size description text and slider state in torrent creation dialog are not always up-to-date. (#6516)
GTK Client
    Fixed build when compiling with GTKMM 4. (#6393)
    Added developer name to metainfo files. (#6598)
    Added the launchable desktop-id to metainfo files. (#6779)
    Fixed build when compiling on BSD. (#6812)
Web Client
    Fixed a 4.0.0 bug where the infinite ratio symbol was displayed incorrectly in the WebUI. (#6491, #6500)
    Fixed layout issue in speed display. (#6570)
    General UI improvement related to filterbar and fixes download/upload speed info wrap. (#6761)
Daemon
    Fixed a couple of logging issues. (#6463)
Everything Else
    Updated flatpak release metainfo. (#6357)
    Fixed libtransmission build on very old cmake versions. (#6418)
    UTP peer connections follow user-defined speed limits better now. (#6551)
    Only use a single concurrent queue for timeMachineExclude instead of one queue per torrent (#6523). (#6558)
    Fixed 4.0.5 bug where svg and png icons in the WebUI might not be displayed. (#6563)
    Fixed 4.0.0 bug where alt-speed-enabled had no effect in settings.json. (#6564)
    Fixed 4.0.0 bugs where some RPC methods don't put torrents in recently-active anymore. (#6565)
    Improved parsing HTTP tracker announce response. (#6567)
    Fixed compatibility with clang-format 18. (#6690)
    Fixed build when compiling with mbedtls 3.x . (#6823)

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agocore190: Ship Compress::Raw::Zlib
Michael Tremer [Tue, 24 Sep 2024 10:01:44 +0000 (10:01 +0000)] 
core190: Ship Compress::Raw::Zlib

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoShip Compress/Raw/Zlib.pm
Jonatan Schlag [Tue, 24 Sep 2024 08:30:54 +0000 (10:30 +0200)] 
Ship Compress/Raw/Zlib.pm

This is needed for the captive portal. This was maybe caused by
008eca2c2f2a11739a70c754a367e7a5086773da .

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agocore190: Ship suricata changes for people who missed them from c189
Michael Tremer [Tue, 24 Sep 2024 08:56:53 +0000 (08:56 +0000)] 
core190: Ship suricata changes for people who missed them from c189

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoMerge branch 'master' into next
Michael Tremer [Tue, 24 Sep 2024 08:54:50 +0000 (08:54 +0000)] 
Merge branch 'master' into next

8 months agocore190: Ship squid
Michael Tremer [Mon, 23 Sep 2024 21:47:04 +0000 (21:47 +0000)] 
core190: Ship squid

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agosquid: Update to 6.11
Matthias Fischer [Mon, 23 Sep 2024 19:10:00 +0000 (21:10 +0200)] 
squid: Update to 6.11

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agocore189: Ship suricata changes
Michael Tremer [Tue, 24 Sep 2024 08:53:40 +0000 (08:53 +0000)] 
core189: Ship suricata changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agosuricata: Enable scanning IPsec packets
Michael Tremer [Tue, 24 Sep 2024 08:33:22 +0000 (10:33 +0200)] 
suricata: Enable scanning IPsec packets

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoids.cgi: Add UI to enable scanning on IPsec
Michael Tremer [Sun, 22 Sep 2024 15:22:48 +0000 (17:22 +0200)] 
ids.cgi: Add UI to enable scanning on IPsec

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agosuricata: Add support for zones having multiple interfaces
Michael Tremer [Sun, 22 Sep 2024 15:08:03 +0000 (17:08 +0200)] 
suricata: Add support for zones having multiple interfaces

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agosuricata: Split marking packets off into a separate chain
Michael Tremer [Sun, 22 Sep 2024 15:06:21 +0000 (17:06 +0200)] 
suricata: Split marking packets off into a separate chain

This is required so that we can have different policies for incoming and
outgoing packets.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agosuricata: Clear IPS bits after use
Michael Tremer [Sat, 21 Sep 2024 15:55:09 +0000 (17:55 +0200)] 
suricata: Clear IPS bits after use

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agosuricata: Always count the whitelisted packets
Michael Tremer [Sat, 21 Sep 2024 10:39:32 +0000 (12:39 +0200)] 
suricata: Always count the whitelisted packets

Even if there are no rules, if this does not exist, collectd will be
unhappy and we cannot generate the graph.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoids.cgi: Don't show the graph if there is no RRD data
Michael Tremer [Sat, 21 Sep 2024 10:37:09 +0000 (12:37 +0200)] 
ids.cgi: Don't show the graph if there is no RRD data

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoids.cgi: Fix empty states of tables
Michael Tremer [Sat, 21 Sep 2024 10:34:56 +0000 (12:34 +0200)] 
ids.cgi: Fix empty states of tables

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agographs.pl: Fix suricata graph name
Michael Tremer [Sat, 21 Sep 2024 10:28:50 +0000 (12:28 +0200)] 
graphs.pl: Fix suricata graph name

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agofirewall: Move the IPS back to INPUT/FORWARD/OUTPUT
Michael Tremer [Tue, 17 Sep 2024 02:04:07 +0000 (04:04 +0200)] 
firewall: Move the IPS back to INPUT/FORWARD/OUTPUT

We cannot use the PREROUTING/POSTROUTING chains here because Suricata
will fail to track NAT-ed connections.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agosuricata: Track whitelisted traffic and add it to the IPS graph
Michael Tremer [Fri, 13 Sep 2024 08:12:30 +0000 (10:12 +0200)] 
suricata: Track whitelisted traffic and add it to the IPS graph

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoIPS: Ada a graph that shows the IPS throughput
Michael Tremer [Tue, 10 Sep 2024 22:43:59 +0000 (00:43 +0200)] 
IPS: Ada a graph that shows the IPS throughput

This graph is split into three parts. One shows bypassed packets, the
next one shows the actually scanned packets and lastly we show the total
throughput.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agosuricata: Collect metrics on scanned and bypassed packets
Michael Tremer [Tue, 10 Sep 2024 21:45:53 +0000 (23:45 +0200)] 
suricata: Collect metrics on scanned and bypassed packets

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agosuricata: Force Suricata to write a PID file again
Michael Tremer [Tue, 10 Sep 2024 21:23:38 +0000 (23:23 +0200)] 
suricata: Force Suricata to write a PID file again

The PID file does not get written when Suricata is not being started in
daemon mode and therefore we need to pass it as a command line
parameter.

The initscript should not deal with the PID file when starting but needs
it to terminate the process and to check the process status.

The web UI can use the PID file again.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agosuricata: Fix syntax error in watcher script
Michael Tremer [Tue, 10 Sep 2024 21:23:18 +0000 (23:23 +0200)] 
suricata: Fix syntax error in watcher script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agosuricata: Remove debugging code
Michael Tremer [Tue, 10 Sep 2024 21:17:20 +0000 (23:17 +0200)] 
suricata: Remove debugging code

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agofirewall: Move the IPS after the NAT marking
Michael Tremer [Tue, 10 Sep 2024 09:37:38 +0000 (11:37 +0200)] 
firewall: Move the IPS after the NAT marking

This is because we might still land in the scenario where Suricata
crashes and NFQUEUE will simply ACCEPT all packets which will terminate
the processing of the mangle table.

Therefore the NFQUEUE rule should be the last one so that we never skip
any of the other processing.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoids.cgi: Fix detection for the Suricata process
Michael Tremer [Tue, 10 Sep 2024 09:35:18 +0000 (11:35 +0200)] 
ids.cgi: Fix detection for the Suricata process

We don't seem to have a PID file any more.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoids.cgi: Remove box from the top section
Michael Tremer [Tue, 10 Sep 2024 09:24:01 +0000 (11:24 +0200)] 
ids.cgi: Remove box from the top section

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoids.cgi: Sort whitelist entries
Michael Tremer [Tue, 10 Sep 2024 09:22:59 +0000 (11:22 +0200)] 
ids.cgi: Sort whitelist entries

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoids.cgi: Use new-style table for whitelist entries
Michael Tremer [Tue, 10 Sep 2024 09:17:33 +0000 (11:17 +0200)] 
ids.cgi: Use new-style table for whitelist entries

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoids.cgi: Use new style tables for rulesets
Michael Tremer [Tue, 10 Sep 2024 09:09:58 +0000 (11:09 +0200)] 
ids.cgi: Use new style tables for rulesets

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agosuricata: Fix broken spacing in the settings section
Michael Tremer [Tue, 10 Sep 2024 09:01:52 +0000 (11:01 +0200)] 
suricata: Fix broken spacing in the settings section

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agosuricata: Add option to scan WireGuard
Michael Tremer [Tue, 10 Sep 2024 08:50:15 +0000 (10:50 +0200)] 
suricata: Add option to scan WireGuard

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agosuricata: Don't load /var/ipfire/ethernet/settings
Michael Tremer [Tue, 10 Sep 2024 08:42:11 +0000 (10:42 +0200)] 
suricata: Don't load /var/ipfire/ethernet/settings

We no longer need this directly as it is being pulled in from the
network functions.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agosuricata: Remove superfluous bits from the initscript
Michael Tremer [Tue, 10 Sep 2024 08:41:19 +0000 (10:41 +0200)] 
suricata: Remove superfluous bits from the initscript

I don't know why these hacks are here.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agosuricata: Restore the interface selection
Michael Tremer [Tue, 10 Sep 2024 08:40:28 +0000 (10:40 +0200)] 
suricata: Restore the interface selection

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agosuricata: Start the new watcher in the background
Michael Tremer [Mon, 9 Sep 2024 21:08:11 +0000 (23:08 +0200)] 
suricata: Start the new watcher in the background

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agosuricata: Add a watcher to restart on unexpected termination
Michael Tremer [Mon, 9 Sep 2024 18:09:22 +0000 (20:09 +0200)] 
suricata: Add a watcher to restart on unexpected termination

This patch adds a watcher process that will restart suricata when it is
being killed by SIGKILL (e.g. by the OOM killer) or after a SEGV.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agosuricata: Be more efficient with marks
Michael Tremer [Mon, 9 Sep 2024 17:38:47 +0000 (19:38 +0200)] 
suricata: Be more efficient with marks

This patch changes that we introduce a new mark which allows us to
identify any newly bypassed connections and permanently store the bypass
flag.

We also only restore marks from the connection tracking when a packet
has no marks, yet.

Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agosuricata: Replace removed CPU count function
Michael Tremer [Mon, 9 Sep 2024 17:37:56 +0000 (19:37 +0200)] 
suricata: Replace removed CPU count function

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agosuricata: Add whitelist to iptables
Michael Tremer [Mon, 9 Sep 2024 10:46:23 +0000 (12:46 +0200)] 
suricata: Add whitelist to iptables

This allows us to workaround better against any problems in Suricata
because we never send any whitelisted packets to the IPS in the first
place.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agosuricata: Remove some unused constants
Michael Tremer [Mon, 9 Sep 2024 09:58:50 +0000 (11:58 +0200)] 
suricata: Remove some unused constants

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agosuricata: Use getconf to determine the number of processors
Michael Tremer [Mon, 9 Sep 2024 09:55:34 +0000 (11:55 +0200)] 
suricata: Use getconf to determine the number of processors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoinitscripts: Fix bash function definitions in suricata
Michael Tremer [Mon, 9 Sep 2024 09:54:04 +0000 (11:54 +0200)] 
initscripts: Fix bash function definitions in suricata

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agosuricata: Move the IPS into the mangle table
Michael Tremer [Mon, 9 Sep 2024 09:49:30 +0000 (11:49 +0200)] 
suricata: Move the IPS into the mangle table

This should make the IPS more efficient, we should have fewer rules and
the IPS will now sit at the edge of the networking stack as it will see
packets immediately when they come and and just before they leave.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agocore189: Ship cURL
Michael Tremer [Mon, 23 Sep 2024 21:22:22 +0000 (21:22 +0000)] 
core189: Ship cURL

This fixes a leaked SIGPIPE that makes transmission crash.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agocurl: Update to version 8.10.0
Adolf Belka [Fri, 13 Sep 2024 16:25:16 +0000 (18:25 +0200)] 
curl: Update to version 8.10.0

- Update from vesion 8.9.1 to 8.10.0
- Update of rootfile
- In previous versions if libpsl was not found then the build excluded it. Now it needs
   to be explicitly disabled otherwise the build will stop with a warning that it could
   not be found.
- Changelog
    8.10.0
      changes:
 o autotools: add `--enable-windows-unicode` option [103]
 o curl: --help [option] displays documentation for given cmdline option [19]
 o curl: add --skip-existing [54]
 o curl: for -O, use "default" as filename when the URL has none [34]
 o curl: make --rate accept "number of units" [4]
 o curl: make --show-headers the same as --include [6]
 o curl: support --dump-header % to direct to stderr [31]
 o curl: support embedding a CA bundle and --dump-ca-embed [20]
 o curl: support repeated use of the verbose option; -vv etc [35]
 o curl: use libuv for parallel transfers with --test-event [82]
 o getinfo: add CURLINFO_POSTTRANSFER_TIME_T [87]
 o mbedtls: add CURLOPT_TLS13_CIPHERS support [78]
 o rustls: add support for setting TLS version and ciphers [113]
 o vtls: stop offering alpn http/1.1 for http2-prior-knowledge [53]
 o wolfssl: add CURLOPT_TLS13_CIPHERS support [76]
 o wolfssl: add support for ssl cert blob / ssl key blob options [50]
      bugfixes:
 o asyn-thread: stop using GetAddrInfoExW on Windows [241]
 o autotools: fix MS-DOS builds [249]
 o autotools: fix typo in tests/data target [30]
 o aws_sigv4: fix canon order for headers with same prefix [74]
 o bearssl: fix setting tls version [203]
 o bearssl: improve shutdown handling [45]
 o BINDINGS: add zig binding [100]
 o build: add `iphlpapi` lib for libssh on Windows [166]
 o build: add `poll()` detection for cross-builds [244]
 o build: add options to disable SHA-512/256 hash algo [239]
 o build: check OS-native IDN first, then libidn2 [223]
 o build: delete unused `REQUIRE_LIB_DEPS` [226]
 o build: drop unused `NROFF` reference [253]
 o build: drop unused feature-detection code for Apple `poll()` [227]
 o build: generate `buildinfo.txt` for test logs [256]
 o build: improve compiler version detection portability
 o build: make `CURL_FORMAT_CURL_OFF_T[U]` work with mingw-w64 <=7.0.0 [207]
 o build: silence C4232 MSVC warnings in vcpkg ngtcp2 builds [137]
 o build: use -Wno-format-overflow [195]
 o buildconf.bat: fix tool_hugehelp.c generation [173]
 o cf-socket: fix pollset for listening [179]
 o cf-socket: prevent KEEPALIVE_FACTOR being set to 1000 for Windows [185]
 o cfilters: send flush [13]
 o CHANGES: rename to CHANGES.md, no longer generated [40]
 o CI: enable parallel testing in CI builds [18]
 o ci: Update actions/upload-artifact digest to 89ef406 [24]
 o cmake: `Libs.private` improvements [215]
 o cmake: add `CURL_USE_PKGCONFIG` option [138]
 o cmake: add Linux CI job, fix pytest with cmake [71]
 o cmake: add math library when using wolfssl and ngtcp2 [66]
 o cmake: add missing `pkg-config` hints to Find modules [158]
 o cmake: add missing version detection to Find modules [170]
 o cmake: add rustls [116]
 o cmake: add support for versioned symbols option [51]
 o cmake: add wolfSSH support [117]
 o cmake: allow `pkg-config` in more envs [147]
 o cmake: cleanup header paths [59]
 o cmake: default `CURL_DISABLE_LDAPS` to the value of `CURL_DISABLE_LDAP` [231]
 o cmake: delete MSVC warning suppression for tests/server [101]
 o cmake: detect `nghttp2` via `pkg-config`, enable by default [21]
 o cmake: detect and show VCPKG in platform flags [84]
 o cmake: distcheck for files in CMake subdir [9]
 o cmake: drop custom `CMakeOutput.log`/`CMakeError.log` logs [27]
 o cmake: drop libssh CONFIG-style detection [167]
 o cmake: drop no-op `tests/data/CMakeLists.txt` [26]
 o cmake: drop reference to undefined variable [25]
 o cmake: drop unused `HAVE_IDNA_STRERROR` [62]
 o cmake: drop unused internal variable [22]
 o cmake: exclude tests/http/clients builds by default [110]
 o cmake: fix `GSS_VERSION` for Heimdal found via pkg-config [77]
 o cmake: fix `pkg-config`-based detection in `FindGSS.cmake` [94]
 o cmake: fix and tidy up c-ares builds, enable in more CI jobs [156]
 o cmake: fix find rustls [148]
 o cmake: fixup linking libgsasl when detected via CMake-native
 o cmake: honor custom `CMAKE_UNITY_BUILD_BATCH_SIZE` [163]
 o cmake: limit `pkg-config` to UNIX and MSVC+vcpkg by default [188]
 o cmake: limit libidn2 `pkg-config` detection to `UNIX` [109]
 o cmake: migrate dependency detections to Find modules [183]
 o cmake: more small tidy-ups and fixes [80]
 o cmake: rename wolfSSL and zstd config variables to uppercase [151]
 o cmake: respect cflags/libdirs of native pkg-config detections [175]
 o cmake: show CMake platform/compiler flags [63]
 o cmake: show warning if libpsl is not found [154]
 o cmake: sync code between test/example targets [234]
 o cmake: sync up formatting in Find modules [129]
 o cmake: TLS 1.3 warning only for bearssl and sectranp [118]
 o cmake: update `curl-config.cmake.in` template var list
 o cmake: update list of "advanced" variables [119]
 o cmake: use numeric comparison for `HAVE_WIN32_WINNT` [69]
 o cmdline-opts: language fix for expect100-timeout.md and max-time.md [192]
 o configure: delete unused `CURL_DEFINE_UNQUOTED` function [224]
 o configure: delete unused `HAVE_OPENSSL3` macro [225]
 o configure: delete unused `m4/xc-translit.m4` [114]
 o configure: detect AppleIDN [70]
 o configure: fail if PSL is not disabled but not found [46]
 o configure: fix WinIDN builds targeting old Windows [210]
 o configure: remove USE_EXPLICIT_LIB_DEPS [199]
 o configure: replace nonportable grep -o with awk [111]
 o connect: always prefer ipv6 in IP eyeballing [209]
 o connect: limit update IP info [191]
 o cookie.md: try to articulate the two different uses this option has [92]
 o curl: allow 500MB data URL encode strings [38]
 o curl: find curlrc in XDG_CONFIG_HOME without leading dot [186]
 o curl: fix --proxy-pinnedpubkey [91]
 o curl: fix the -w urle.* variables [153]
 o curl: make the progress bar detect terminal width changes [169]
 o curl: warn on unsupported SSL options [106]
 o Curl_rand_bytes to control env override [17]
 o curl_sha512_256: fix symbol collisions with nettle library [131]
 o CURLMOPT_SOCKETFUNCTION.md: expand on the easy argument [216]
 o CURLOPT_XFERINFOFUNCTION: clarify the callback return codes [141]
 o dist: add missing `docs/examples/CMakeLists.txt` [58]
 o dist: add missing `FindNettle.cmake` [11]
 o dist: add missing `lib/optiontable.pl` [115]
 o dist: add missing `test_*.py` scripts [102]
 o dist: drop buildconf [65]
 o dist: fix reproducible build from release tarball [36]
 o dmaketgz: only run 'make distclean' if Makefile exists
 o docs/SSLCERTS: rewrite [174]
 o docs: add description of effect of --location-trusted on cookie [157]
 o docs: document the (weak) random value situation in rustls builds [252]
 o docs: fix some examples in man pages
 o docs: improve cipher options documentation [159]
 o docs: mention "@-" in more places [67]
 o docs: remove ALTSVC.md, HSTS.md, HTTP2.md and PARALLEL-TRANSFERS.md [105]
 o docs: update CIPHERS.md [140]
 o doh-url.md: point out DOH server IP pinning [37]
 o doh: remove redundant checks [242]
 o easy: fix curl_easy_upkeep for shared connection caches [52]
 o escape: allow curl_easy_escape to generate 3*input length output [39]
 o FEATURES.md: fix typo [180]
 o ftp: always offer line end conversions [219]
 o ftp: flush pingpong before response [73]
 o getinfo: return zero for unsupported options (when disabled) [189]
 o GHA/windows: enable MulitSSL in an MSVC job [2]
 o GHA: scan git repository and detect unvetted binary files [3]
 o gnutls/wolfssl: improve error message when certificate fails [125]
 o gnutls: send all data [230]
 o gtls: fix OCSP stapling management [206]
 o haproxy: send though next filter [222]
 o hash: provide asserts to verify API use [96]
 o http/2: simplify eos/blocked handling [90]
 o http2+h3 filters: fix ctx init [142]
 o http2: fix GOAWAY message sent to server [171]
 o http2: improve rate limiting of downloads [33]
 o http2: improved upload eos handling [41]
 o http3.md: mention how the fallback can be h1 or h2 [194]
 o hyper: call Curl_req_set_upload_done() [126]
 o idn: more strictly check AppleIDN errors [98]
 o idn: support non-UTF-8 input under AppleIDN [99]
 o INSTALL.md: MultiSSL and QUIC are mutually exclusive [7]
 o KNOWN_BUGS: "special characers" in URL works with aws-sigv4 [81]
 o krb5: add Linux/macOS CI tests, fix cmake GSS detection [83]
 o krb5: fix `-Wcast-align` [95]
 o lib: add eos flag to send methods [14]
 o lib: avoid macro collisions between wolfSSL and GnuTLS headers [133]
 o lib: convert some debugf()s into traces [8]
 o lib: delete stray undefs for `vsnprintf`, `vsprintf` [152]
 o lib: fix AIX build issues [112]
 o lib: fix building with wolfSSL without DES support [134]
 o lib: make SSPI global symbols use Curl_ prefix [251]
 o lib: prefer `CURL_SHA256_DIGEST_LENGTH` over the unprefixed name [132]
 o lib: remove the final strncpy() calls [240]
 o lib: remove use of RANDOM_FILE [235]
 o libcurl.def: move from / into lib [238]
 o libcurl.pc: add `Cflags.private` [10]
 o libcurl.pc: add reference to `libgsasl` [150]
 o libcurl/docs: expand on redirect following and secrets to other hosts [85]
 o llist: remove direct struct accesses, use only functions [72]
 o Makefile.dist: fix `ca-firefox` target [254]
 o Makefile.mk: fixup enabling libidn2 [61]
 o Makefile: remove 'scripts' duplicate from DIST_SUBDIRS
 o maketgz: accept option to include latest commit hash [5]
 o maketgz: fix RELEASE-TOOLS.md for daily tarballs [243]
 o maketgz: move from / into scripts [237]
 o managen: fix superfluous leading blank line in quoted sections [211]
 o managen: in man output, remove the leading space from examples [198]
 o managen: wordwrap long example lines in ASCII output [143]
 o manpage: ensure a maximum width for the text version [75]
 o max-filesize.md: mention zero disables the limit [93]
 o mbedtls: add more informative logging [162]
 o mbedtls: fix setting tls version [200]
 o mbedtls: no longer use MBEDTLS_SSL_VERIFY_OPTIONAL [181]
 o mime: avoid inifite loop in client reader [155]
 o mk-ca-bundle.pl: include a link to the caextract webpage [68]
 o multi: make the "general" list of easy handles a Curl_llist [97]
 o multi: on socket callback error, remove socket hash entry nonetheless [149]
 o ngtcp2/osslq: remove NULL pointer dereferences [213]
 o ngtcp2: use NGHTTP3 prefix instead of NGTCP2 for errors in h3 callbacks [79]
 o openssl quic: fix memory leak [229]
 o openssl: certinfo errors now fail correctly [250]
 o openssl: fix the data race when sharing an SSL session between threads [221]
 o openssl: improve shutdown handling [44]
 o pingpong: drain the input buffer when reading responses [193]
 o POP3: fix multi-line responses [168]
 o pop3: use the protocol handler ->write_resp [220]
 o printf: fix mingw-w64 format checks [228]
 o progress: ratelimit/progress tweaks [32]
 o pytests: add tests for HEAD requests in all HTTP versions [42]
 o rand: only provide weak random when needed [233]
 o runtests: if DISABLED cannot be read, error out [56]
 o runtests: log ignored but passed tests [130]
 o runtests: remove "has_textaware" [217]
 o rustls: fix setting tls version [202]
 o rustls: make all tests pass [1]
 o schannel: avoid malloc for CAinfo_blob_digest [247]
 o scorecard: tweak request measurements [139]
 o sectransp: fix setting tls version [204]
 o SECURITY: mention OpenSSF best practices gold badge [161]
 o setopt: allow CURLOPT_INTERFACE to be set to NULL [165]
 o setopt: let CURLOPT_ECH set to NULL reset to default [187]
 o setopt: make CURLOPT_TFTP_BLKSIZE accept bad values [184]
 o sha256: fix symbol collision between nettle (GnuTLS) and OpenSSL [135]
 o share: don't reinitialize conncache [214]
 o sigpipe: init the struct so that first apply ignores [49]
 o smb: convert superflous assign into assert [246]
 o smtp: add tracing feature [120]
 o splay: use access functions, add asserts, use Curl_timediff [121]
 o spnego_gssapi: implement TLS channel bindings for openssl [146]
 o src: delete `curlx_m*printf()` aliases [197]
 o src: fix potential macro confusion in cmake unity builds [208]
 o src: namespace symbols clashing with lib [248]
 o src: replace copy of printf mappings with an include [190]
 o ssh: deduplicate SSH backend includes (and fix libssh cmake unity build) [177]
 o system_win32: fix typo
 o test httpd: tweak cipher list [124]
 o test1521: verify setting options to NULL better [182]
 o test1707: output diff more for debugging differences in CI outputs
 o test556: improve robustness [64]
 o test579: improve robustness [60]
 o test587: improve robustness [123]
 o test649: improve robustness [122]
 o test677: improve robustness [47]
 o tests/runner: only allow [!A-Za-z0-9_-] in %if feature names [55]
 o tests: constrain http pytest to tests/http directory [205]
 o tests: don't mangle output if hostname or type unknown
 o tests: ignore QUIT from FTP protocol comparisons [108]
 o tests: provide docs as curldown, not nroff [12]
 o tidy-up: misc build, tests, `lib/macos.c` [172]
 o tidy-up: OS names [57]
 o tool_operhlp: fix  "potentially uninitialized local variable 'pc' used" [48]
 o tool_paramhlp: bump maximum post data size in memory to 16GB [128]
 o transfer: Curl_sendrecv() and event related improvements [164]
 o transfer: remove comments, add asserts [218]
 o transfer: skip EOS read when download done [196]
 o url: dns_entry related improvements [16]
 o url: fix connection reuse for HTTP/2 upgrades [236]
 o urlapi: verify URL *decoded* hostname when set [160]
 o urldata: introduce `data->mid`, a unique identifier inside a multi [127]
 o urldata: remove 'scratch' from the UrlState struct [86]
 o urldata: remove crlf_conversions counter [232]
 o urldata: remove proxy_connect_closed bit [178]
 o verify-release: shell script that verifies a release tarball [29]
 o version: fix shadowing a `libssh.h` symbol [176]
 o vtls: add SSLSUPP_CIPHER_LIST [107]
 o vtls: fix MSVC 'cast truncates constant value' warning [23]
 o vtls: fix static function name collisions between TLS backends [136]
 o vtls: init ssl peer only once [15]
 o websocket: introduce blocking sends [145]
 o wolfssl: avoid taking cached x509 store ref if sslctx already using it [88]
 o wolfssl: fix CURLOPT_SSLVERSION [144]
 o wolfssl: fix setting tls version [201]
 o wolfssl: improve shutdown handling [43]
 o ws: flags to opcodes should ignore CURLWS_CONT flag [104]
 o x509asn1: raise size limit for x509 certification information [28]

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>