Commit Graph

33836 Commits

Author SHA1 Message Date
Sergey Ponomarev
66b7e522ca tor-hs: bump version to 0.1.0
Add me as a second maintainer.
Remove outdated README.md but put a link to a Wiki instead.
Use Onion Service instead of Hidden Service.

Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
2025-05-20 13:20:46 +02:00
Sergey Ponomarev
0c0536b2b3 tor-hs: keep /etc/tor config folder
Mark the /etc/tor folder to keep during sysupgrade.
The folder contains hidden_services folder with keys.

Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
2025-05-20 13:20:46 +02:00
Sergey Ponomarev
94de72970e tor-hs: put torrc_generated into in-memory folder /var/run/
On each tor-hs service restart it generates a config file /etc/tor/torrc_generated.
The /etc/ is stored on a disk and kills it and slow.

Instead create a dedicated tor service Runtime Dir in the temp /var/run/.
It will be accessible only to the tor user.

Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
2025-05-20 13:20:46 +02:00
Sergey Ponomarev
2f505ed7d8 tor-hs: create hs folder only if not exists
Previously the chown/chmod was performed each time even if the folder already existed.

Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
2025-05-20 13:20:46 +02:00
Sergey Ponomarev
07f37d9dcc tor-hs: add validation
Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
2025-05-20 13:20:46 +02:00
Sergey Ponomarev
4f3c7711af tor-hs: Use config_get_bool for enable_hs
Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
2025-05-20 13:20:46 +02:00
Sergey Ponomarev
a97989f0c2 tor-hs: reformat and cleanup
Remove unused description.
Quote variables.
Use hostname_file variable.
Remove unnecessary quotes around "common".
Use echo -n to truncate a TORRC_FILE.

Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
2025-05-20 13:20:46 +02:00
Sergey Ponomarev
783b92d5b3 tor-hs: cleanup tor-hs.conf
Replace boolean "true"/"false" with more frequently used 1/0.
This may avoid configuration mistakes which is critical for Tor.
The Luci app anyway will set it as 1/0.

Make sections named. This is not required but again safes from mistakes when executing uci command.

Uncomment sections but disable them by default.
Then in a Luci app a user can quickly figure out what to change.
Ideally a user may just enable the config and start using it.

In the nextcloud config use a single 80 instead of 80;80.
This simpler configuration is now supported.

Instead of "Hidden service" the Tor team now uses "Onion service".

Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
2025-05-20 13:20:46 +02:00
Sergey Ponomarev
eee8f9e1e7 tor-hs: tor-hs.init skip onion service when Name empty
The Name is used as a HS folder name and can't be empty.

Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
2025-05-20 13:20:46 +02:00
Sergey Ponomarev
1f591bcc1c tor-hs: tor-hs.init remove unused clean_hs()
Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
2025-05-20 13:20:46 +02:00
Sergey Ponomarev
c709e7a09f tor-hs: tor-hs.init handle_hs_ports_conf split ports
Using substring instead of awk.
It changes behaviour when only one port is specified.
Previously:
value="80" => public="80" local=""
Now:
value="80" => public="80" local="80"

It simplifies configuration of one-to-one ports.

Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
2025-05-20 13:20:46 +02:00
Sergey Ponomarev
910041d39f tor-hs: tor-hs.init handle_hs_ports_conf: remove unused name var
Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
2025-05-20 13:20:46 +02:00
Fabrice Fontaine
3d32c62444 admin/syslog-ng: fix PKG_CPE_ID
oneidentity:syslog-ng is a better CPE ID than balabit:syslog-ng as
this CPE ID has the latest CVEs (whereas balabit:syslog-ng only
has a CVE from 2000):
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:oneidentity:syslog-ng

Fixes: 5f07bb1094 (syslog-ng: update to version 3.19.1)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
2025-05-20 13:09:26 +02:00
John Audia
f5089fc6c2 fscrypt: add new package
Fscrypt is a high-level tool for the management of Linux native
filesystem encryption. fscrypt manages metadata, key generation, key
wrapping, PAM integration, and provides a uniform interface for creating
and modifying encrypted directories.

Upstream url: https://github.com/google/fscrypt/blob/master/README.md

Build system: x86/64
Build-tested: bcm27xx/bcm2712
Run-tested: bcm27xx/bcm2712

Signed-off-by: John Audia <therealgraysky@proton.me>
2025-05-20 09:27:34 +02:00
Wei-Ting Yang
ae56deff2c treewide: assign some PKG_CPE_IDs
Assign some PKG_CPE_IDs to enhance CVE coverage.

https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=aardvark-dns
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=alpine_project
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=boringssl
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=ecdsautils
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=file_project
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=knot_resolver
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=libwrap
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=lsof_project
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=nfdump
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=nlnetlabs%20name_server_daemon
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=rclone
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=setserial
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=tang_project
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=tesseract_project
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=tmate-ssh-server
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=ttyd
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=uw-imap
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=v2ray-core
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=zstandard

Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
2025-05-20 08:57:12 +02:00
Goetz Goerisch
d66e7cbad1 jool: update to 4.1.14
Changelog: https://github.com/NICMx/Jool/releases/tag/v4.1.14

Signed-off-by: Goetz Goerisch <ggoerisch@gmail.com>
2025-05-20 08:03:48 +02:00
Jonathan Smith
4917148a13 smartdns: Update to version 46.1
Change package source to github codeload.

Trim "Release" prefix from upstream versioning
to make it at least somewhat semantic compliant.

Add two additional folders and two default
config files based on upstream changes.

Signed-off-by: Jonathan Smith <sphere_accompany616@simplelogin.com>
2025-05-20 08:01:31 +02:00
Wesley Gimenes
cffbe8b32a netbird: update to 0.44.0
changelog: https://github.com/netbirdio/netbird/releases/tag/v0.44.0

Signed-off-by: Wesley Gimenes <wehagy@proton.me>
2025-05-19 12:29:17 +02:00
Robert Marko
b0c4fe0b9a semodule-utils: update to 3.8.1
Update to latest 3.8.1 version.

Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-05-19 11:44:34 +02:00
Robert Marko
f62a91c782 selinux-python: update to 3.8.1
Update to latest 3.8.1 version and drop upstreamed patch[1].

[1] 1a29c28afb

Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-05-19 11:44:34 +02:00
Robert Marko
f8bb47257e python-semanage: update to 3.8.1
Update to latest 3.8.1 version and backport a patch to fix compilation[1].

[1] a339594da6

Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-05-19 11:44:34 +02:00
Robert Marko
b6d9fcd1c8 python-selinux: update to 3.8.1
Bump to latest 3.8.1 version.
Import the required backported patches from libselinux.

Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-05-19 11:44:34 +02:00
John Audia
fec25ff6fe lm-sensors: update to v3.6.2
Change source URL to reflect active mirror as old one has not been
updated in ~4 years and bump to latest upstream release.

% sensors --version
sensors version 3.6.2 with libsensors version 3.6.2

Build system: x86/64
Build-tested: x86/64
Run-tested: x86/64

Signed-off-by: John Audia <therealgraysky@proton.me>
2025-05-19 10:57:15 +02:00
Dane Murphy
e1d8da1877 iperf3: update to 3.19
Updates iperf3 to the latest upstream release, 3.19

Changelog: https://github.com/esnet/iperf/releases/tag/3.19

Signed-off-by: Dane Murphy <danem7@gmail.com>
2025-05-19 10:55:51 +02:00
Fabian Lipken
4632f4553f fx: update to 36.0.2
Signed-off-by: Fabian Lipken <dynasticorpheus@gmail.com>
2025-05-19 08:21:24 +02:00
Rosen Penev
a2f30ef123 alpine: fix compilation with GCC14
Wrong function prototypes.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
2025-05-19 09:50:34 +08:00
Rosen Penev
6d9d871660 rtorrent: update to 0.15.3
Rebase patch.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
2025-05-19 09:50:17 +08:00
Rosen Penev
13a058bed6 libtorrent: update to 0.15.3
Add patch to allow rtorrent to link statically.

Aligned is no longer needed with C++17.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
2025-05-19 09:50:17 +08:00
Philip Prindeville
77de6687df bind: bump to 9.20.8
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
2025-05-18 19:21:49 -04:00
Robert Marko
d5bf5358df lua-openssl: bump to 0.10.0-0
Update lua-openssl to 0.10.0-0 fix compilation.

Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-05-18 20:44:03 +02:00
Kevin Locke
5be8d85937 strongswan: swanctl: Add support for send_certreq
Support the [send_certreq] connection configuration option to disable
offering trusted root CA certificates and reduce the size of the initial
IKE packets.

This work is based on a patch by @aleks-mariusz in
https://forum.openwrt.org/t/confusion-regarding-setting-up-ikev2-vpn-service-with-strongswan-using-ipsec-and-swanctl/169587/9

[send_certreq]: https://docs.strongswan.org/docs/latest/swanctl/swanctlConf.html#_connections

Signed-off-by: Kevin Locke <kevin@kevinlocke.name>
2025-05-18 11:35:35 -06:00
Thlv Alivs
7c268c3ac2 zabbix: update to 7.0.12
also fix build error

Signed-off-by: Thlv Alivs <zgmzzzz18@gmail.com>
2025-05-18 16:25:10 +02:00
Robert Marko
a8c89a0c77 strongswan: mark UCI plugin as broken
UCI plugin in strongswan has been broken for years, and now its causing
strongswan to fail compilation.

So, instead of the whole strongswan package to be failing and missing from
feeds simply make UCI plug depend on @BROKEN.

Signed-off-by: Robert Marko <robimarko@gmail.com>
2025-05-18 16:13:24 +02:00
Matthew Cather
8419c5c532 tcp_wrappers: update patches for gcc14
The portable way is to use `socklen_t`. This fixes both glibc and
musl based builds.

Signed-off-by: Matthew Cather <mattbob4@gmail.com>
2025-05-18 10:55:38 +02:00
Eric Fahlgren
444353f7ce owut: update to 2025.05.12
Bug fixes:
    efahl/owut@8353c4e9e2 argparse: add a file path parser type
    efahl/owut@724c990d6c owut: avoid redirects on upstream queries

Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>
2025-05-18 10:55:14 +02:00
Michael Heimpold
f21bc7f170 php8: adapt test.sh for upcoming opkg -> apk transition
We used to rely on opkg to install the CLI tool for testing
PHP modules, but when opkg is not available anymore, we have to
use apk. The (simple) switch logic assumes, that only one
of both package manager tools is installed.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
2025-05-17 17:25:18 +02:00
Michael Heimpold
8d999cfc50 php8: update to 8.4.7
Upstream changelog:
https://www.php.net/ChangeLog-8.php#8.4.7

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
2025-05-17 17:25:18 +02:00
Tianling Shen
c26204d36a cloudflared: Update to 2025.5.0
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2025-05-17 21:41:34 +08:00
Tianling Shen
bd4e40fb04 dnsproxy: Update to 0.75.5
Add sysctl conf to increase UDP send/receive buffers for QUIC-GO.
Same as a920f9ec9c ("adguardhome: increase UDP send/receive buffers").

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2025-05-17 21:40:49 +08:00
Clair-Loup Sergent
87175e4ca3 wifi-presence: fix reading mqttID from config
Typo error in mqttID config value

Signed-off-by: Clair-Loup Sergent <sergent.cl@laposte.net>
2025-05-16 14:05:26 +01:00
Matthias Schiffer
6766939892 perl: do not set LD_LIBRARY_PATH for cross compile
We don't want to set LD_LIBRARY_PATH to a directory filled with target
libraries when running a host perl. When the host and target
architecture are the same, some libraries will be loaded from this
path, resulting in the build to break because of glibc/musl mismatch.

Reported-by: John Audia <therealgraysky@proton.me>
Fixes: e7b5a35e5c ("perl: drop 110-always_use_miniperl.patch")
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
2025-05-16 10:01:27 +02:00
Fabian Lipken
d8a233f90a fx: update to 36.0.1
Signed-off-by: Fabian Lipken <dynasticorpheus@gmail.com>
2025-05-16 10:53:33 +03:00
Florian Eckert
0d18846dab xtables-addons: remove not needed iptables install dependency for RTSP helpers
The RTSP conntrack and nat does not dependent on iptables, but only on
nf_conntrack and nf_nat. The RTSP conntrack module is used as a helper in
firewall4 [1]. Previously, it was not possible to install RTSP kernel module
without also installing the not needed iptables modules. However, as firewall4
is based on nftables and not on iptables, this dependency is not necessary.

[1] https://github.com/openwrt/firewall4/blob/master/root/usr/share/firewall4/helpers#L89

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2025-05-15 14:34:32 +02:00
Florian Eckert
d221309637 modemmanager: backport fixes for version 1.24.0
The following commits were added shortly after the release of Modemmanager
version '1.24.0'.

Patch: 0002-modem-helpers-cinterion-allow-spaces-in-SXRAT-test-r.patch
Backport: 6b6997362b
Issue: https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/issues/974

Patch: 0003-modem-helpers-fix-checking-of-CDMA-EVDO-access-techn.patch
Backport: 9e205f4784
Issue: no

Patch: 0004-iface-modem-voice-recheck-call-state-polling-when-ca.patch
Backport: 92e666e1c9
Issue: no

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2025-05-15 14:33:22 +02:00
Wesley Gimenes
c91e9322ce netbird: update to 0.43.3
changelog: https://github.com/netbirdio/netbird/releases/tag/v0.43.3

Signed-off-by: Wesley Gimenes <wehagy@proton.me>
2025-05-15 09:24:20 +02:00
Andris PE
d63d5c202a net/bcp38: Add cgnat shared space to bcp38 list
Add CG-NAT address space to non-routable list
Mmake dhcp filter stricter

Signed-off-by: Andris PE <neandris@gmail.com>
2025-05-14 16:58:11 +02:00
Til Kaiser
536e1ff8d0 mstflint: update to 4.32.0
This commit updates the mstflint package to
the latest 4.32.0 release.

It also includes a patch to fix a musl build error that
has been merged into the upstream development branch [1],
but is not yet part of any official release.

Obsolete patches have been removed,
as they are now included in this version.

Additionally, three new binaries introduced
in 4.32.0 have been added to the package.

[1] https://github.com/Mellanox/mstflint/pull/1239

Signed-off-by: Til Kaiser <mail@tk154.de>
2025-05-14 17:20:44 +03:00
Alexandru Ardelean
48a24c73f7 numpy: bump to version 2.2.5
Also needing to treat 'incompatible-pointer-types' as warnings.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2025-05-14 15:14:18 +03:00
Alexandru Ardelean
224a35ee4a django-restframework: bump to version 3.16.0
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2025-05-14 15:14:18 +03:00
Alexandru Ardelean
362d15d047 python-evdev: bump to version 1.9.2
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2025-05-14 15:14:18 +03:00