7 files changed, 21 insertions, 12 deletions

diff --git a/.github/workflows/build-extra.yml b/.github/workflows/build-extra.yml
index dd0dc4da0..8754e7eff 100644
--- a/.github/workflows/build-extra.yml
+++ b/.github/workflows/build-extra.yml
@@ -54,7 +54,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@128a63446a954579617e875aaab7d2978154e969
+      uses: step-security/harden-runner@55d479fb1c5bcad5a4f9099a5d9f37c8857b2845
       with:
         egress-policy: block
         allowed-endpoints: >
@@ -84,7 +84,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@128a63446a954579617e875aaab7d2978154e969
+      uses: step-security/harden-runner@55d479fb1c5bcad5a4f9099a5d9f37c8857b2845
       with:
         egress-policy: block
         allowed-endpoints: >
@@ -110,7 +110,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@128a63446a954579617e875aaab7d2978154e969
+      uses: step-security/harden-runner@55d479fb1c5bcad5a4f9099a5d9f37c8857b2845
       with:
         egress-policy: block
         allowed-endpoints: >
@@ -132,7 +132,7 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@128a63446a954579617e875aaab7d2978154e969
+      uses: step-security/harden-runner@55d479fb1c5bcad5a4f9099a5d9f37c8857b2845
       with:
         egress-policy: block
         allowed-endpoints: >
@@ -150,7 +150,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@128a63446a954579617e875aaab7d2978154e969
+      uses: step-security/harden-runner@55d479fb1c5bcad5a4f9099a5d9f37c8857b2845
       with:
         egress-policy: block
         allowed-endpoints: >
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index afa8d1305..32dbaf8cc 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -46,7 +46,7 @@ jobs:
       SHELL: /bin/bash
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@128a63446a954579617e875aaab7d2978154e969
+      uses: step-security/harden-runner@55d479fb1c5bcad5a4f9099a5d9f37c8857b2845
       with:
         egress-policy: block
         allowed-endpoints: >
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index eec359f40..9b82ab240 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -75,7 +75,7 @@ jobs:
 
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@128a63446a954579617e875aaab7d2978154e969
+      uses: step-security/harden-runner@55d479fb1c5bcad5a4f9099a5d9f37c8857b2845
       with:
         disable-sudo: true
         egress-policy: block
@@ -93,7 +93,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@6c089f53dd51dc3fc7e599c3cb5356453a52ca9e
+      uses: github/codeql-action/init@f6e388ebf0efc915c6c5b165b019ee61a6746a38
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -104,7 +104,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@6c089f53dd51dc3fc7e599c3cb5356453a52ca9e
+      uses: github/codeql-action/autobuild@f6e388ebf0efc915c6c5b165b019ee61a6746a38
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -118,4 +118,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@6c089f53dd51dc3fc7e599c3cb5356453a52ca9e
+      uses: github/codeql-action/analyze@f6e388ebf0efc915c6c5b165b019ee61a6746a38
diff --git a/.github/workflows/profile-checks.yml b/.github/workflows/profile-checks.yml
index 8418a390b..0e7403508 100644
--- a/.github/workflows/profile-checks.yml
+++ b/.github/workflows/profile-checks.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@128a63446a954579617e875aaab7d2978154e969
+      uses: step-security/harden-runner@55d479fb1c5bcad5a4f9099a5d9f37c8857b2845
       with:
         disable-sudo: true
         egress-policy: block
diff --git a/RELNOTES b/RELNOTES
index bf56218f6..2922b7765 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -5,6 +5,7 @@ firejail (0.9.73) baseline; urgency=low
   * feature: a random hostname is assigned to each sandbox unless
     overwritten using --hostname command
   * feature: add IPv6 support for --net.print option
+  * feature: QUIC (HTTP/3) support in --nettrace
   * modif: Stop forwarding own double-dash to the shell (#5599 #5600)
   * modif: Prevent sandbox name (--name=) and host name (--hostname=)
     from containing only digits (#5578 #5741)
diff --git a/src/fnettrace/hostnames.c b/src/fnettrace/hostnames.c
index 878a67123..20c83803f 100644
--- a/src/fnettrace/hostnames.c
+++ b/src/fnettrace/hostnames.c
@@ -28,6 +28,10 @@ static char buf[MAXBUF];
 char *retrieve_hostname(uint32_t ip) {
         if (geoip_not_found)
                 return NULL;
+        if (access("/usr/bin/geoiplookup", X_OK)) {
+                geoip_not_found = 1;
+                return NULL;
+        }
         geoip_calls++;
 
         char *rv = NULL;
diff --git a/src/fnettrace/main.c b/src/fnettrace/main.c
index 178ac3631..3eb7a13f5 100644
--- a/src/fnettrace/main.c
+++ b/src/fnettrace/main.c
@@ -351,8 +351,10 @@ static void hnode_print(unsigned bw) {
                                 bwline = print_bw(ptr->bytes / bwunit);
 
                         const char *protocol = NULL;
-                        if (ptr->port_src == 443)
+                        if (ptr->port_src == 443 && ptr->protocol == 0x06) // TCP
                                 protocol = "(TLS)";
+                        else if (ptr->port_src == 443 && ptr->protocol == 0x11) // UDP
+                                protocol = "(QUIC)";
                         else if (ptr->port_src == 53)
                                 protocol = "(DNS)";
                         else if (ptr->port_src == 853) {
@@ -367,6 +369,8 @@ static void hnode_print(unsigned bw) {
                                 ;
                         else if (ptr->protocol == 0x11)
                                 protocol = "(UDP)";
+                        else if (ptr->protocol == 0x06)
+                                protocol = "(TCP)";
 
                         if (protocol == NULL)
                                 protocol = "";