liblldpctl: Fix const correctness of the receive callback

build: use a multi-stage build for Dockerfile

This should help when compiling for other architectures through QEMU as
the autogen.sh part is platform-independent.

build: untabify Dockerfile

release: 1.0.21

doc: be clearer about how to install on macOS

None of the above methods (notably the Docker one) would work.

build: add a few more Docker platforms

And make it more readable.

Fix #456.

build: fix hardcoded ghcr.io path

Related to #456

daemon/priv: factor out check of authorized paths

doc: fix libtool invocation

daemon: do not fallback to ioctl for wireless

Even very old kernels support this wireless directory.

daemon: use /sys/class/net/.../wireless to check wireless interface

IFLA_INFO_KIND never is "wireless" as wireless interfaces do not
implement `rtnl_link_ops`.

Fix #738

daemon: only keep one privileged op to remove both socket and lock

daemon: fix arbitrary file deletion in the privileged process

The `asroot_ctl_cleanup()` handler reads an arbitrary path from the
unprivileged process and deletes it. Instead, introduce
`asroot_ctl_cleanup_lock()` to only clean the lock and
`asroot_ctl_cleanup()` cleans the socket.

Fix #772

client: fix compilation warning about unterminated strings

With GCC 15, we get:

```
../../../src/client/json_writer.c: In function ‘json_element_dump’:
../../../src/client/json_writer.c:160:43: warning: initializer-string for array of ‘char’ truncates NUL terminator but destination lacks ‘nonstring’ attribute (3 chars into 2 available) [-Wunterminated-string-initialization]
  160 |         static const char pairs[2][2] = { "{}", "[]" };
      |                                           ^~~~
../../../src/client/json_writer.c:160:49: warning: initializer-string for array of ‘char’ truncates NUL terminator but destination lacks ‘nonstring’ attribute (3 chars into 2 available) [-Wunterminated-string-initialization]
  160 |         static const char pairs[2][2] = { "{}", "[]" };
      |                                                 ^~~~
```

This is a false positive as they are not used as strings, but let's
accomodate the compiler by using enough space for the NUL terminator.

doc: add NEWS entry for latest commit

interfaces: use ethtool link mode bits for accurate MAU type selection (#771)

* interfaces: use ethtool link mode bits for accurate MAU type selection

For speeds >= 10G, consult the ethtool supported link mode bitmask
to determine the correct MAU type instead of relying solely on
speed + port type. This fixes incorrect MAU type announcements
(e.g., 100G-SR4 transceivers being reported as 100G-LR4).

Fall back to the existing port-type approximation when no link mode
bit matches (e.g., legacy kernels without GLINKSETTINGS).

Add missing ethtool link mode bit definitions (bits 52-89) and speed
defines for 200G/400G to the local ethtool header.

Fixes: #477
* interfaces: move mau variable to function scope

Address review feedback: declare mau at the top of iflinux_macphy()
instead of inside each case block.

* interfaces: simplify mau assignment with combined if-assign pattern

daemon: fix path traversal vulnerability in asroot_iface_description_os()

`asroot_iface_description_os()` a sysfs path from an interface name
received from the unprivileged process. The validation only rejects `\0`
or `.` in first position. Add `/` to the list of rejected characters to
avoid path traversal.

Fix #773

daemon: fix path traversal vulnerability in asroot_open()

asroot_open() in src/daemon/priv-linux.c validates file paths against a
list of regex patterns using regexec(). The patterns are not anchored
with ^ or $, so regexec() performs substring matching. A path containing
an authorized pattern as a substring — with additional ../ traversal
components — passes validation but resolves to a different file when
passed to open().

For example, the pattern `/proc/net/bonding/[^.][^/]*` matches both:

- `/proc/net/bonding/bond0` (intended)
- `/proc/net/bonding/bond0/../../self/environ` (traversal — if bond0 is a directory)

Use anchors in the regex. Also, refuse any path containing `/..`, as it
is not possible to express with POSIX basic regular expression.

Fix #774.

build: bump actions/upload-artifact from 6 to 7

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6 to 7.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

build: bump actions/download-artifact from 7 to 8

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 7 to 8.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/v7...v8)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

docs: add NEWS entry for latest PR

Merge pull request #763 from thbtcllt/dev

Add lldp configuration option to send mac address for port id and interface alias for port description

test: add test for the new portdescription-source option

test result:
- 148 passed
- 7 skipped
- 0 failed

doc: add description of new portdescription-source option

interface: add alias on neighbors display

With previous commit it is possible to configure (PortID / Port Descr) to
provide the macaddress and the interface alias.
To help to retrieve the information the command 'lldpcli show neighbors'
provides the alias of the interface if present.

config: add portdescription-source option

This new option allows to control the port description source
(alias vs ifname) when the portidsubtype is macaddress.

Usage:
  lldpcli configure lldp portidsubtype macaddress
  lldpcli configure lldp portdescription-source alias

Result: PortID = MAC address, PortDescr = interface alias

fix: Swallow exceptions caused by user callbacks

Otherwise, the process will crash.

update: Remove ctx pointers from C++ wrapper change callbacks

Instead, use lambdas if private contexts are required. They are way more C++-idiomatic.

osx: sync HomeBrew formula

osx: update HomeBrew formula

fix: Avoid potential deadlock

Don't keep a mutex lock while running the user callbacks to avoid potential deadlocks caused by callbacks that the user code requires.

build: bump actions/upload-artifact from 5 to 6

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 5 to 6.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

build: bump cross-platform-actions/action from 0.30.0 to 0.32.0

Bumps [cross-platform-actions/action](https://github.com/cross-platform-actions/action) from 0.30.0 to 0.32.0.
- [Release notes](https://github.com/cross-platform-actions/action/releases)
- [Changelog](https://github.com/cross-platform-actions/action/blob/master/changelog.md)
- [Commits](https://github.com/cross-platform-actions/action/compare/v0.30.0...v0.32.0)

---
updated-dependencies:
- dependency-name: cross-platform-actions/action
  dependency-version: 0.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

build: bump actions/download-artifact from 6 to 7

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 6 to 7.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

daemon/protocols: fix typo in CDP_SWITCH_DEFAULT_POE_PD.

build: update automake/autoconf for OpenBSD

build: test more BSD versions

build: bump actions/checkout from 5 to 6

Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

build: bump cross-platform-actions/action from 0.29.0 to 0.30.0

Bumps [cross-platform-actions/action](https://github.com/cross-platform-actions/action) from 0.29.0 to 0.30.0.
- [Release notes](https://github.com/cross-platform-actions/action/releases)
- [Changelog](https://github.com/cross-platform-actions/action/blob/master/changelog.md)
- [Commits](https://github.com/cross-platform-actions/action/compare/v0.29.0...v0.30.0)

---
updated-dependencies:
- dependency-name: cross-platform-actions/action
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

build: bump actions/upload-artifact from 4 to 5

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 5.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

build: bump actions/download-artifact from 5 to 6

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 5 to 6.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

daemon/lldpd: handle empty case for PRETTY_NAME

Again, fix #751.

daemon/lldpd: fix off-by-one issue when PRETTY_NAME is empty

lldpd: fix leak in levent_snmp_read by cleaning up netsnmp_large_fd_set

daemon/lldpd: handle case where PRETTY_NAME is empty

Fix #751

Add missing compat.h header under src/client/

Under certain conditions, build would fail due to a missing reference to
\#include "../compat/compat.h" in text_writer.c, kv_writer.c and
xml_writer.c.

example:
---------------
lldpd-1.0.20/src/client/text_writer.c:157:9: fatal error: call to undeclared function 'rpl_malloc'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
        priv = malloc(sizeof(*priv));
               ^
../../config.h:316:16: note: expanded from macro 'malloc'
\#define malloc rpl_malloc
               ^
1 error generated.
make[2]: *** [lldpcli-text_writer.o] Error 1
make[1]: *** [install-recursive] Error 1
make: *** [stamp-x86_64] Error 2
---------------
lldpd-1.0.20/src/client/kv_writer.c:41:19: fatal error: call to undeclared function 'rpl_malloc'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
        if ((newprefix = malloc(s + 1)) == NULL) fatal(NULL, NULL);
                         ^
../../config.h:316:16: note: expanded from macro 'malloc'
\#define malloc rpl_malloc
               ^
1 error generated.
make[2]: *** [lldpcli-kv_writer.o] Error 1
make[1]: *** [install-recursive] Error 1
make: *** [stamp-x86_64] Error 2
---------------
lldpd-1.0.20/src/client/xml_writer.c:139:9: fatal error: call to undeclared function 'rpl_malloc'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
        priv = malloc(sizeof(*priv));
               ^
../../config.h:316:16: note: expanded from macro 'malloc'
\#define malloc rpl_malloc
               ^
1 error generated.
make[2]: *** [lldpcli-xml_writer.o] Error 1
make[1]: *** [install-recursive] Error 1
make: *** [stamp-x86_64] Error 2

release: 1.0.20

build: bump actions/download-artifact from 4 to 5

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4 to 5.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

build: bump actions/checkout from 4 to 5

Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 5.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

daemon/interfaces: fix management address selection when negative

When we had a negative IP address, and nothing positive, the address was
still selected as it didn't match an interface. When all negative, we
should only select an address if both IP and interface are allowed.

This mechanism is becoming a bit complex.

docs: add a NEWS entry for the previous change

add support for vlan-advertisements configuration (#740)

* add support for vlan-advertisements configuration

adding new configurations configure [ports ethx [,..]] lldp vlan-advertisements pattern and
unconfigure [ports ethx,[,...]] lldp vlan-advertisements pattern.
The commands enable control of which vlans are advertised

* Code review changes

Updated manual page.
Added add an example of invocation in tests/lldpcli.conf.
Added tests to tests/integration/test_dot1.py.
Vlan formatting fixes.

* more CR fixes

* Fix memory leak

fixing port->p_vlan_advertise_pattern memory leak

client: keep "configure med fast-start" working

People should now use "configure lldp fast-start", but we keep the
previous configuration working as well.

Add an entry in NEWS.

Fix #680 (well, previous commit did)

fix: Some cleanup in moving fast-start into LLDP core

fix: Move tx-fast config from MED to LLDP section

fix: Always TX fast start complient to IEEE802.1as-2009

daemon/interfaces: fix double-free when unable to initialize interface

When an interface is converted from one type to another and cannot be
initialized, we free it twice: once on the error and again when removing
unused interfaces.

Remove the first occurrence and ensure we get in a state where the
interface can be both cleaned up or reinstantiated in a later round.

autoconf: Use m4sh syntax where appropriate

This fixes an issue where when using the options

  --without-embedded-libevent --without-libbsd

configure errors out with missing libevent:

  checking for libevent >= 2.0.5... no
  configure: error: *** libevent not found

but succeeds to find libevent when using

  --without-embedded-libevent --with-libbsd

configure options instead.
See also: https://autotools.info/autoconf/m4sh.html

build: bump cross-platform-actions/action from 0.28.0 to 0.29.0

Bumps [cross-platform-actions/action](https://github.com/cross-platform-actions/action) from 0.28.0 to 0.29.0.
- [Release notes](https://github.com/cross-platform-actions/action/releases)
- [Changelog](https://github.com/cross-platform-actions/action/blob/master/changelog.md)
- [Commits](https://github.com/cross-platform-actions/action/compare/v0.28.0...v0.29.0)

---
updated-dependencies:
- dependency-name: cross-platform-actions/action
  dependency-version: 0.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #742 from rbu9fe/fix/error-category

fix: Error category handling

fix: Add missing include

fix: Add missing is_error_code_enum specialization

Directly pass error code to std::system_error.

fix: Error category handling

A std::error_code stores the error category only by reference, hence, we must use an object in static storage.
Add lldpcli::make_error_code for convenience similar to std::make_error_code.

build: bump cross-platform-actions/action from 0.27.0 to 0.28.0

Bumps [cross-platform-actions/action](https://github.com/cross-platform-actions/action) from 0.27.0 to 0.28.0.
- [Release notes](https://github.com/cross-platform-actions/action/releases)
- [Changelog](https://github.com/cross-platform-actions/action/blob/master/changelog.md)
- [Commits](https://github.com/cross-platform-actions/action/compare/v0.27.0...v0.28.0)

---
updated-dependencies:
- dependency-name: cross-platform-actions/action
  dependency-version: 0.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

lib/cpp: Fix memory leaks in LldpCtl

LldpCtl::GetInterfaces() and LldpAtom::GetAtomList() did not decrement ref for retrieved atoms
Ensure parent atom outlives its children atoms

lib/cpp: LldpCtl supports non default transports

added optional arg to lldpd unix socket for constructor

doc: add entry in NEWS for previous commit

daemon/priv: fix PACKET_IGNORE_OUTGOING

Switch from netpacket/packet.h to linux/if_packet.h to pick up both
sockaddr_ll and PACKET_IGNORE_OUTGOING.

Fixes case where PACKET_IGNORE_OUTGOING was compiled out due to ifdef
conditional, which caused Linux zerocopy to break.

Fixes #732

Signed-off-by: Jon Kohler <jon@nutanix.com>

build: bump cachix/install-nix-action from 30 to 31

Bumps [cachix/install-nix-action](https://github.com/cachix/install-nix-action) from 30 to 31.
- [Release notes](https://github.com/cachix/install-nix-action/releases)
- [Commits](https://github.com/cachix/install-nix-action/compare/v30...v31)

---
updated-dependencies:
- dependency-name: cachix/install-nix-action
  dependency-version: '31'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

build: Fix macos compile warning on macos >= 12

dmi-osx.c:37:40: warning: 'kIOMasterPortDefault' is deprecated: first deprecated in macOS 12.0 [-Wdeprecated-declarations]
        service = IOServiceGetMatchingService(kIOMasterPortDefault, matching);
                                              ^~~~~~~~~~~~~~~~~~~~
                                              kIOMainPortDefault

man: clarify what the power class numbers mean for 802.3at, in dot3

man: Amend keyword colour formatted as operations and not values.

comment cleanup and spelling fixes

differentiate between setup(n) and set(v) up

daemon: fix typo in comment

Add UnregisterInterfaceCallback

SetValue: Add various string-like type support

add more missing syscalls to seccomp profile

it turned out, adding just clock_gettime64()
from #710 has not been enough for ia32 platform.

iteratively added additional syscalls, that
prevented lldpd from starting up without
bailing out with SIGSYS

build: bump cross-platform-actions/action from 0.26.0 to 0.27.0

Bumps [cross-platform-actions/action](https://github.com/cross-platform-actions/action) from 0.26.0 to 0.27.0.
- [Release notes](https://github.com/cross-platform-actions/action/releases)
- [Changelog](https://github.com/cross-platform-actions/action/blob/master/changelog.md)
- [Commits](https://github.com/cross-platform-actions/action/compare/v0.26.0...v0.27.0)

---
updated-dependencies:
- dependency-name: cross-platform-actions/action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

daemon: add clock_gettime64 to seccomp profile

Fix #710

debian: also install C++ header in Debian package

fix: Add lldpctl.hpp to the include list

build: bump cross-platform-actions/action from 0.25.0 to 0.26.0

Bumps [cross-platform-actions/action](https://github.com/cross-platform-actions/action) from 0.25.0 to 0.26.0.
- [Release notes](https://github.com/cross-platform-actions/action/releases)
- [Changelog](https://github.com/cross-platform-actions/action/blob/master/changelog.md)
- [Commits](https://github.com/cross-platform-actions/action/compare/v0.25.0...v0.26.0)

---
updated-dependencies:
- dependency-name: cross-platform-actions/action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

lib: fix warning about uninitialized variable

This is not really the case, but older compilers may not be able to
detect there is no branch when this variable is uninitialized.

build: remove hacks around NetSNMP

The workaround for -D_FORTIFY_SOURCE was failing on Fedora because it
was not robust enough. The current version was tested with:

- Fedora 41
- Debian 10
- Ubuntu Trusty (14.04)
- CentOS 7

release: 1.0.19

doc: finalize changelog

lib: format *.hpp as well

feat: Add lldpctl C++ wrapper (#693)

* feat: Add lldpctl C++ wrapper

* fix: Call the new lldpctl_watch_sync_unblock() on watch termination

* fix: Category name

client: fix global tx hold and interval setting

In the following fixed commit, I forgot to fix the transmission (tx) hold
and interval range in the global configuration setting.

Fixes: 7b9abb819337 ("client: add range restriction for tx hold and interval")
Reported-by: Fei Liu <feliu@redhat.com>
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>

lldpd: fix ttl range on ports

In the following fixed commit, I forgot to fix the ttl range for
interfaces/ports.

Fixes: a73e04f46ebe ("lldpd: limit tx ttl to 65535")
Reported-by: Fei Liu <feliu@redhat.com>
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>

daemon: use code from sd_notify(3) for handling notify socket

This also fixes a compilation error about connect().

lib: fix formatting

lib: bump library version

Also fix versioning of lldpctl_watch_sync_unblock. And add a NEWS entry.

docs: add an entry for change about AppArmor

feat: Add lldpctl_watch_sync_unblock (#696)

* feat: Add lldpctl_watch_sync_unblock

* update: Replace select by epoll

* refactor: Replace epoll by poll to support non-Linux OS

* update: Let lldpcli terminate gracefully

fix: Typo

build: bump cachix/install-nix-action from 29 to 30

Bumps [cachix/install-nix-action](https://github.com/cachix/install-nix-action) from 29 to 30.
- [Release notes](https://github.com/cachix/install-nix-action/releases)
- [Commits](https://github.com/cachix/install-nix-action/compare/v29...v30)

---
updated-dependencies:
- dependency-name: cachix/install-nix-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

fix: add socket lock to AppArmor policy

build: query pkg-config for readline/libedit/libeditline

Fix #686