It seems this software is no longer maintained.
- The latest upstream commit is 4 years ago.
- Author didn't respond security issue report. (CVE-2023-39141)
No packages depend on this.
Signed-off-by: Yanase Yuki <dev@zpc.st>
(cherry picked from commit 9d6d44487f)
Addresses the following security issues:
- CVE-2025-8677: DNSSEC validation fails if matching but invalid
DNSKEY is found.
- CVE-2025-40778: Address various spoofing attacks.
- CVE-2025-40780: Cache-poisoning due to weak pseudo-random number
generator.
Full upstream changelog at
https://ftp.isc.org/isc/bind9/9.18.41/doc/arm/html/changelog.html
Signed-off-by: Noah Meyerhans <frodo@morgul.net>
For some reason, pip builds a broken Cython, which segfaults on attempting
to install wheel. Work around this by allowing to use precompiled wheels.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit d798ccce9a)
ZNC can modify its own config file (znc.conf) during runtime, for
example using controlpanel or webadmin modules. Manually editing the
znc.conf file while znc is running is strongly discouraged.
Thus prodc should not watch this file, it would just lead to znc being
restarted unnecessarily.
As it happens, no restarts were done, because the watched path was
specified incorrectly. It used ZNC_CONFIG instead of ZNC_CONFIG_DIR,
and so it watched /tmp/etc/znc/configs/znc.conf/configs/znc.conf which
does not exist.
Remove the watch of znc.conf as it is not needed.
Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org>
(cherry picked from commit 00feb12444)
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Using the broker_selection param makes it possible to decide by use (default),
always use the first available broker to connect or select a random broker
See also: 51a5e46ad1/client/l2tp_client.c (L1331-L1333)
Signed-off-by: Florian Maurer <f.maurer@outlook.de>
(cherry picked from commit 296c15c1f2)
Introduce `RUST_{HOST,PKG}_LOCKED` flag (enabled by default) to respect
upstream lockfile. This can be disabled by setting it to 0 if you want
to have up-to-date dependencies.
This change also adds new `CARGO_{HOST,PKG}_ARGS` variable to pass extra
build arguments to cargo.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 1000e99185)
Knot Resolver 5.7.4 (2024-07-23)
================================
Security
--------
- reduce buffering of transmitted data, especially TCP-based in userspace
Also expose some of the new tweaks in lua:
(require 'ffi').C.the_worker.engine.net.tcp.user_timeout = 1000
(require 'ffi').C.the_worker.engine.net.listen_{tcp,udp}_buflens.{snd,rcv}
Improvements
------------
- add the fresh DNSSEC root key KSK-2024 already, Key ID 38696
Incompatible changes
--------------------
- libknot 3.0.x support is dropped
Upstream last maintained 3.0.x in spring 2022.
Knot Resolver 5.7.3 (2024-05-30)
================================
Improvements
------------
- stats: add separate metrics for IPv6 and IPv4
Bugfixes
--------
- fix NSEC3 records missing in answer for positive wildcard expansion
with the NSEC3 having over-limit iteration count
Knot Resolver 5.7.2 (2024-03-27)
================================
Bugfixes
--------
- fix on 32-bit systems with 64-bit time_t
Signed-off-by: Jan Hák <jan.hak@nic.cz>
(cherry picked from commit 6e208887e3)
It needs to be group writable or session.key can't be written once
named drops privileges.
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
(cherry picked from commit b82574b31c)
Update nano editor to version 8.5.
Upstream has fixed the gnulib related cross-compilation problem,
so remove the config hack that was added at the 8.4 update.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit cfdf5fffec)
Files in `/etc/profile.d/` are marked as user configs and won't be
replaced to new version when update the package, so add a migration
script for this.
Fixes: #26709
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit ae33358c4f)
Add missing syscalls found with `/etc/init.d/transmission trace`.
fix crash on boot on x86_64 platform
Signed-off-by: Liangbin Lian <jjm2473@gmail.com>
(cherry picked from commit d827297546)
Have no idea why such dependency was added.
No documentation from transmission that they need
such dependency on build time. On the other hand
saves vast of time during build
Signed-off-by: Serhii Ivanov <icegood1980@gmail.com>
(cherry picked from commit a06829b0a2)
Fixes podman build breakage which was caused by podman depending on
netavark, which in turn depends on rust-iptables.
rust-iptables requires rust 1.85.0 since commit 75825cd
75825cd9c1
Signed-off-by: Jonathan McCrohan <jmccrohan@gmail.com>
(cherry picked from commit c675028528)
[refresh patches]
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
ack would always set a return code of 1 if -c was used. Now it properly
returns 1 if no files match, and 0 if any files match.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit b6b9cd38fa)
- This release contains fixes for CVE-2024-45490,
CVE-2024-45491, CVE-2024-45492.
- Since official place for expat development moved from SourceForge
to GitHub, SourceForge was removed from PKG_SOURCE_URL.
- Use gzip archive to avoid xz usage.
- Remove DOCBOOK_TO_MAN=OFF from CMAKE_OPTIONS because
we already have EXPAT_BUILD_DOCS=OFF, which has same effect.
Signed-off-by: Yanase Yuki <dev@zpc.st>
(cherry picked from commit b0b5b8bf67)
Update nano edit to version 8.4.
Add configure flags to overcome upstream bug 66978, where the newly added
gnulib module for strcasecmp always fails in the configure step when
cross-compiling.
https://savannah.gnu.org/bugs/?66978b2927d1b1f
The added flags disable the strcasecmp function from gnulib.
If upstream (gnulib?) fixes things later, the flags should be removed.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 3d055f8dfb)
libxml2 was updated in OpenWrt Git tree with commit dec59db8fb1f
("libxml2: update to 2.13.6"), which fixed several CVEs.
Unfortunately this version bump included removal of some features, which
leads to build issues of libxslt:
libxslt-1.1.37/xsltproc/xsltproc.c:733:39: error: assignment of read-only variable 'xmlParserMaxDepth'
733 | xmlParserMaxDepth = value;
So lets fix it by backporting an upstream "fix", which removes that
deprecated functionality.
Fixes: dec59db8fb1f ("libxml2: update to 2.13.6")
References: https://github.com/openwrt/openwrt/pull/18280
Signed-off-by: Petr Štetiar <ynezz@true.cz>
rust-iptables 0.5.3+ requires rust 1.85.0 to build, use the version
defined in Cargo.toml instead.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Including CVE fixes for:
CVE-2024-12084
CVE-2024-12085
CVE-2024-12086
CVE-2024-12087
CVE-2024-12088
CVE-2024-12747
The patch list is based on rsync_3.2.7-1+deb12u2 from Debian.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
The following error occurs when creating storage configuration in WEBUI:
```
Failed to save config after 10 tries: failed to create temp file for new config: open /etc/rclone/rclone.conf4258227003: permission denied
```
we should set the owner of the parent directory of the configuration
file to rclone.
Signed-off-by: Liangbin Lian <jjm2473@gmail.com>
[split chown command, wrap commit message]
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit bcd87dd8b6)
Notable Changes
CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)
Dependency update:
CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
Commit 66894032d4 ("acme: standardize key_type") failed to bump the
package release, so the update won't be automatically installed. Bump
PKG_RELEASE to make sure users get the updated version.
Opt for adding a PKG_RELEASE instead of bumping the version to avoid
having different packages (from different branches) with the same
PKG_VERSION.
Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
Summary of three PRs regarding new adblock sources with minor changes/additions:
- add new source reg_lithuania, PR provided by @Myginas
- add new source certpl, PR provided by @jkostorz
- add new source oisd_nsfw_small, PR provided by @Turjoy9
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit cd89956c13)
* remove indentation in postinst/prerm/postrm scripts to fix issues with APK
* rework hijack logic to redirect port 53 to the port of active/selected dnsmasq instances
Signed-off-by: Stan Grishin <stangri@melmac.ca>
Currently we're seeing random build failures, caused by autofoo being
called on very ancient bundled autofoo:
cd . && aclocal
aclocal.real: warning: autoconf input should be named 'configure.ac', not 'configure.in'
acinclude.m4:2: warning: underquoted definition of AC_REPLACE_GNU_GETOPT
acinclude.m4:2: run info Automake 'Extending aclocal'
acinclude.m4:2: or see https://www.gnu.org/software/automake/manual/automake.html#Extending-aclocal
configure.in:106: error: automatic de-ANSI-fication support has been removed
For some reason that `touch` based neutralization introduced in commit
6d6c4b21b5 ("lrzsz: update to v0.12.21rc and fix a CVE") doesn't
always work.
So lets fix it by removing the autofoo bits from the bundled Makefile.in
and while at it remove processing of man and testsuite subdirs to save
some computing cycles.
Fixes: #25543
Fixes: 6d6c4b21b5 ("lrzsz: update to v0.12.21rc and fix a CVE")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 3e61258604)
Maintainer: Antonio Pastor / @APCCV
Compile tested: ipq806x (24.10-rc2, snapshot)
Run tested: ipq806x - C2600 (snapshot): install apk, start/stop sfpd service & review logs
Description:
Bump to version 4.0.7
Signed-off-by: Antonio Pastor <antonio.pastor@gmail.com>
Maintainer: Antonio Pastor / @APCCV
Compile tested: ipq806x (23.05.3, snapshot)
Run tested: ipq806x - C2600: start server, connect from MacOS, read/write files to home share, create/update TimeMachine backups
Description:
No changes to package other than using latest available upstream code base. Starting Netatalk 4.x build uses meson instead of autotools.
Signed-off-by: Antonio Pastor <antonio.pastor@gmail.com>
Removed old uclibc patches. Not relevant with modern musl or glibc.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit c9ff829fdb)
- manually refresh patch 030-glib.patch
Major changes are:
fix adduser / addshare prompting on musl libc
fix use of veto files as global share parameter
lookup primary group and don't recurse in ksmbd.conf @group handling
fix a leak and an intermittent auth failure in Kerberos 5
add global parameter kerberos support
detailed changelog here: https://github.com/cifsd-team/ksmbd-tools/releases/tag/3.5.3
Signed-off-by: Andrea Pesaresi <andreapesaresi82@gmail.com>
(cherry picked from commit 5b058c9949)
Major changes are:
- Add durable handles parameter to ksmbd.conf.
- Add payload_sz in ksmbd_share_config_response to validate ipc
response.
- Fix UAF and cleanups.
Signed-off-by: Andrea Pesaresi <andreapesaresi82@gmail.com>
(cherry picked from commit 9cf0eae9bc)
Since 3fa5ee0b28
OpenWrt no longer disables SCTP support by default.
It caused the leak of libsctp dependency to iperf3.
Here we disable it explicitly to fix the build.
Signed-off-by: Aleksey Vasilenko <aleksey.vasilenko@gmail.com>
(cherry picked from commit 6c1ce8ccc7)
* correctly parse json objects with hyphens in the autodetection functions
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 823633c0e6)
* optimized procd settings for better performance
* reworked autodetection functions (still broken in master due to apk migration)
* made the tld function optional, set 'adb_tld' accordingly (enabled by default)
* reworked count function
* various code improvements
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 8afc26fafb)
* correctly parse json objects with hyphens in the autodetection function
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 3140259fc6)
* optimized procd settings for better performance
* made the log monitor working again (even on master with apk migration issues)
* reworked the fetch autodetection function (still broken in master due to apk migration)
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 8609a5bbe5)
Previously, `PKG_SOURCE_VERSION` in the Makefile was incorrectly
set to `0.1.1` instead of tracking `PKG_VERSION`. This mismatch
caused compilation issues for the package.
This fix ensures `PKG_SOURCE_VERSION` dynamically aligns with
`PKG_VERSION` to prevent future discrepancies.
Signed-off-by: Gagan Deep <pandafy.dev@gmail.com>
Commit 5e69da4ccb upgraded openwisp-monitoring
to version 0.2.0 but missed necessary Makefile adjustments, causing the
package to break in OpenWrt feeds.
This patch updates the Makefile to ensure proper functionality of
openwisp-monitoring with the 0.2.0 release.
Signed-off-by: Gagan Deep <pandafy.dev@gmail.com>
(cherry picked from commit 886b3fa36d)
Update configuration in Makefile to fix#25168.
Add "/etc/openwisp/" to conf files.
Signed-off-by: Gagan Deep <pandafy.dev@gmail.com>
(cherry picked from commit 67d4fa3b05)
- Automatically refresh one patch
- Other patch is unchanged
Signed-off-by: Aleksey Vasilenko <aleksey.vasilenko@gmail.com>
(cherry picked from commit 541060ee56)
zabbix-agentd requires libevent2-pthreads to build
correctly, so add it to DEPENDS.
Signed-off-by: Yanase Yuki <dev@zpc.st>
(cherry picked from commit e61c3ea01c)
* fixed gathering/printing of system information in travelmate status
* make use of a central command selector function
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 5af7612c51)
* fixed gathering/printing of system information in adblock status
* added missing hagezi category (samsung tracker)
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit bbaa72d739)
* fixed gathering/printing of system information in banIP status
* removed broken iblocklist.com feeds
* updated readme
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit fb19c14696)
* Updating package to 2.54.0
* Changed Makefile to install binary to /usr/bin (as in upstream)
* Updated init.rc script with new path
Signed-off-by: R4SAS I2P <r4sas@i2pmail.org>
(cherry picked from commit f28940dded)
* supports comments (introduced with a #), for MAC addresses
in the allow and block list, e.g. 26:5e:a0:6a:9c:da # Test
* added hagezi threat ip feed
* added an adguard logterm to the readme
* removed the broken talos feed
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 270e6f1264)
* fixed adblock status reporting
* optimized the mail template
* removed unanswered DNS requests from reporting
* various small fixes
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 1294b54471)
add config options to set http porxy for dockerd, refer to
https://docs.docker.com/engine/daemon/proxy/ for details
use the *_proxy environment variable as the default value, so in most
cases, dockerd can use the system proxy settings just like opkg.
Signed-off-by: Joe Zheng <joe.zheng@intel.com>
(cherry picked from commit e795bab253)
This is the fourteenth patch release in the 1.1.z release branch of
runc. It includes a fix for a low severity security issue
(CVE-2024-45310) as well as some minor build-related fixes (including Go
1.23 support).
Fix CVE-2024-45310, a low-severity attack that allowed
maliciously configured containers to create empty files and directories on
the host.
Add support for Go 1.23.
Revert "allow overriding VERSION value in Makefile" and add EXTRA_VERSION.
rootfs: consolidate mountpoint creation logic.
Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>
(cherry picked from commit c1e6edfa86)
* BUGFIX: correctly identify available RAM
* BUGFIX: properly store remote list filesize in config
* shellcheck updates
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 4bdaea90d6)
* fixed auto allow-/blocklist-issue with IPv6 addresses in CIDR notation
* removed edrop feed from readme (had been removed from feeds for a while)
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit aeda25086e)
The tag is now prefixed with v; update PKG_SOURCE_URL and PKG_BUILD_DIR
to reflect this.
Drop upstreamed patches. Refresh leftover patch.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
(cherry picked from commit 4bdf55d352)
* automatic blocking of IP ranges via RDAP request now supports multiple CIDRs
* cosmetics
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit b157e03e80)
Sometimes the wan connection needs time to be established (e.g. cold
boot after power loss) and the service may crash as the internet is
yet available. Add a trigger to reload the service once the wan
interface is up.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 52037eb625)
[based upon 23.05 branch]
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Bump glib2 to 2.74.7 which fixes CVE-2023-29499, CVE-2023-32611,
CVE-2023-32636, CVE-2023-32643, CVE-2023-32665 and on top of that
backport CVE-2024-34397 fix from Debian Bookworm glib2 package
2.74.6-2+deb12u2. While at it refresh the patches so they apply cleanly.
References: https://security-tracker.debian.org/tracker/source-package/glib2.0
Fixes: CVE-2023-29499, CVE-2023-32611, CVE-2023-32636, CVE-2023-32643, CVE-2023-32665, CVE-2024-34397
Signed-off-by: Petr Štetiar <ynezz@true.cz>
1. to address the isssue of incomplement firwall rules
2. added support for gateway settings
Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>
(cherry picked from commit d552c5733a)
* bugfix: users reported unexpected side effects with the newly introduced rpc-sys ubus service, reverted that part
*bugfix: made "tcpdump" optional
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 4803143a91)
* removal of a superfluous opkg code block (missed in the last commit)
* cosmetics
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 9428ef4320)
* get rid of the opkg dependency
* fixed remaining hagezi category issues
* adblock still depends on 'gawk', but also accepts busybox awk. The readme describes two officially unsupported installation variants.
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 34db79bcd5)
Fixes CVEs:
- CVE-2024-1975: remove sig 0 support
- CVE-2024-4076: qctx-zversion was not being cleared when it should have been
leading to an assertion failure if it needed to be reused.
- CVE-2024-1737: An excessively large number of rrtypes per owner can slow
down database query processing, so a limit has been placed on the number of
rrtypes that can be stored per owner (node) in a cache or zone database. This
is configured with the new "max-rrtypes-per-name" option, and defaults to 100.
- CVE-2024-1737: Excessively large rdatasets can slow down database query
processing, so a limit has been placed on the number of records that can be
stored per rdataset in a cache or zone database. This is configured with the
new "max-records-per-type" option, and defaults to 100.
- CVE-2024-0760: Malicious DNS client that sends many queries over TCP but
never reads responses can cause server to respond slowly or not respond at
all for other clients.
Signed-off-by: Noah Meyerhans <frodo@morgul.net>
This commit follows the upstream project's change of license from GPLv3
to MIT.
Link: 3175713e77
Signed-off-by: Ray Wang <r@hev.cc>
(cherry picked from commit 003b4e3696)
This version is the final version supporting iptables and:
* it separates the old iptables/nft-capable init script from the new nft-only init script
* the new nft-script is a significant rewrite of the old recursive calls/policy parsing
and tries to create inline nft sets which offers performance improvements
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 920d64734a)
Signed-off-by: Stan Grishin <stangri@melmac.ca>
* update license to AGPL-3.0-or-later
* rename pbr_get_gateway to pbr_get_gateway4 for better readability
* improve IPv6 "gateway" detection/display on start
* prevent IPv6 interface errors on start
* revert release format
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 717a800ec5)
* delete obsolete files/etc/init.d/pbr.init
* add files/etc/uci-defaults/91-pbr-iptables to help update from older OpenWrt
* add files/etc/uci-defaults/91-pbr-nft to help update from older OpenWrt
* update files/etc/uci-defaults/91-pbr-netifd to only add tables to supported ifaces
* re-organize variants in the Makefile so that they hopefull work this time
* update prerm for all variants for better user experience
* update the -netifd prerm to remove leftofver entries from network and rt_tables file
In the init script:
* add decorations for netifd-interfaces related operations (blue ticks)
* add rtTablesFile variables instead of hard-coding the rt_tables file
* add function to check if the table is netifd-derived
* add error messages/hints for failed interface setup and failed WAN discovery
* make cleanup_rt_tables the netifd-compatible
* streamline interface_process function with a clearer case statement
* rename the interface_process `pre-init` option to `pre_init` to conform to the other
functions options naming style
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit bb5de23743)
This update includes the following changes:
1. Makefile
* update copyright
* attempt to implement the proper variants to avoid luci-app dependency on both variants
* quietly stop service on uninstall
2. Config-file
* add the list of dnsmasq instances to target in supported dnsmasq modes
* for default pbr variant, set the `resolver_set` to `dnsmasq.nftset`
* for iptables pbr variant, set the `resolver_set` to `dnsmasq.ipset`
* add the `nft_file_support` (disabled by default)
* introduce `procd_boot_delay` to delay service start on boot
* introduce the following nft set creation options:
* nft_set_auto_merge
* nft_set_counter
* nft_set_flags_interval
* nft_set_flags_timeout
* nft_set_gc_interval
* nft_set_policy
* nft_set_timeout
* add the pbr.user.wg_server_and_client custom user script to allow running wg server and
client at the same time
* add the "Ignore Local Requests" sample policy
3. Hotplug firewall/interface scripts
* better logged messages
4. The pbr and pbr-iptables uci defaults script
* use functions from the init script
* improve vpn-policy-routing migration
5. The pbr-netifd uci defaults script
* use functions from the init script
* improve uci operations
6. Introduce the firewall.include file
7. Improve pbr.user.aws custom user script
8. Improve pbr.user.netflix custom user script
9. Introduce pbr.user.wg_server_and_client custom user script
10. Update the init file:
* refactor some code to allow the init script file to be sourced by the uci defaults scripts
and the luci rpcd script for shared functions
* add support for `nft_file_mode` in which service prepares the fw4-compatible atomic nft/include
file for faster operations on service reload
* improve Tor support (nft mode only)
* implement support for nft set options
* update validation functions for new options/parameters
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 790753f6a6)
Update the options to match the master branch. This drops options of no
longer supported GCC versions.
Signed-off-by: Richard Muzik <richard.muzik@nic.cz>
* added full 1Hosts feed support (4 categories)
* changed the OISD list sources to alternate wildcard domains syntax
* used only the adguard source in default config
* fixed a needless reload delay plus a few cosmetics
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 875fcf3f12)
* new gawk dependency
* full hagezi support (all 32 categories)
* refine Stevenblack support
* refine whitelist handling
* fixed tcpdump command line for ports other than 53 (see #24685)
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 7b18f22e73)
go1.21.13 (released 2024-08-06) includes fixes to the go command,
the covdata command, and the bytes package.
Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>
This version brings two significant updates:
* support for text labels/names for the external lists
* better processing of the config update files, which cleans up
entries with missing URLs
Also:
* new config file contains names for all lists
* it tries to match existing URLs with the names from the new config file
and update user config as part of uci-defaults script
* contains minor updates to copyright/license/upstream URL/README
* updates the config update script to remove sysctl.org list as it's outdated
* adds two new remote lists: Hagezi and 1Hosts
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 50e85ed27f)
Cherry-pick commit has been updated to reflect a different hash required for 23.05
Makefile:
* update to latest upstream version
* remove PKG_SOURCE_DATE/PKG_SOURCE_RELEASE as they are no longer needed
* set TARGET_CFLAGS/TARGET_LDFLAGS
* update CMAKE_OPTIONS
* add CONFIGURE_ARGS to prepare for building with HTTP/3
* update package URL to upstream repo instead of documentation
* update package/description
* add README.md with link to documentation
init-script:
* do not run within image builder
* add a line which can be uncommented to remove outdated doh_server entries
020-src-options.c-add-version.patch:
* remove it, as it's no longer needed with version set in CMAKE_OPTIONS
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 9e600ac071)
Remove the ancient package with experimental cake options,
from time when cake was not yet officially here.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 217e4ecb35)
Updated 010-configure-uname.patch as source changed.
Removed 100-example-conf-in.patch as not needed any more.
Release message:
This release has a fix for the DNSBomb issue CVE-2024-33655. This has a
low severity for Unbound, since it makes Unbound complicit in targeting
others, but does not affect Unbound so much.
To mitigate the issue new configuration options are introduced.
The options discard-timeout: 1900, wait-limit: 1000
and wait-limit-cookie: 10000 are enabled by default. They limit the
number of outstanding queries that a querier can have. This limits
the reply pulse, and make Unbound less favorable for the issue.
With the config wait-limit-netblock and wait-limit-cookie-netblock
the parameters can be fine tuned for specific destinations.
More information on the attack and Unbound's mitigations are
presented further down.
Other fixes in this release are that Unbound no longer follows symlinks
when truncating the pidfile. Unbound also does not chown the pidfile,
this is for safety reasons. There are also a number of fixes for RPZ, in
handling CNAMEs. There is a memory leak fix for the edns client subnet
cache. For DNSSEC validation a case is fixed when the query is of type
DNAME. The unbound-anchor program is fixed to first write to a temporary
file, before replacing the original. This handles disk full situations,
and because of it unbound-anchor needs permission to create that file,
in the same directory as the original file. There is also a fix for
IP_DONTFRAG, to disable fragmentation instead of the opposite.
The option cache-min-negative-ttl can be used to set the minimum TTL
for negative responses in the cache. It complements existing options to
set the maximum ttl for negative responses and to set the minimum and
maximum ttl but not specifically for negative responses.
The option cachedb-check-when-serve-expired option makes Unbound use
cachedb to check for expired responses, when serve-expired is enabled,
and cachedb is used. It is enabled by default.
The -q option for unbound-checkconf can be added to silence it when
there are no errors.
Signed-off-by: Ryan Keane <the.ra2.ifv@gmail.com>
(cherry picked from commit d421db0527)
Backport pending patch, which was submitted to upstream via GitHub
to use renamed function to compile it against MbedTLS 3.x.
Signed-off-by: Seo Suchan <tjtncks@gmail.com>
(cherry picked from commit 42140c67e0)
The output format of `khost` has changed. This commit fixes the regexp
for IPv4. It fixes the issue of using a custom DNS to resolve current
address.
```bash
root@localhost:~# khost ns2.afraid.org
ns2.afraid.org. has IPv4 address 69.65.50.223
ns2.afraid.org. has IPv6 address 2001:1850:1:5:800::6b
Host ns2.afraid.org. has no MX record
root@localhost:~# khost --version
khost (Knot DNS), version 3.3.5
```
Signed-off-by: Denis Shulyaka <Shulyaka@gmail.com>
(cherry picked from commit ebeae334d9)
Remove upstreamed patch 300-avoid-time-printf.patch
Exim/exim@9ae8613607
Exim version 4.98
-----------------
JH/01 Support list of dkim results in the dkim_status ACL condition, making
it more usable in the data ACL.
JH/02 Bug 3040: Handle error on close of the spool data file during reception.
Previously This was only logged, on the assumption that errors would be
seen for a previous fflush(). However, a fuse filesystem has been
reported as showing this an error for the fclose(). The spool is now in
an uncertain state, and we have logged and responded acceptance. Change
this to respond with a temp-reject, wipe spoolfiles, and log the error
detail.
JH/03 Bug 3030: Fix handling of DNS servfail respons for DANE TLSA. When hit
during a recipient verify callout, a QUIT command was attempted on the
now-closed callout channel, causing a paniclog entry.
JH/04 Bug 3039: Fix handling of of an empty log_reject_target, with
a connection_reject log_selector, under tls_on_connect. Previously
with this combination, when the connect ACL rejected, a spurious
paniclog entry was made.
JH/05 Fix TLS resumption for TLS-on-connect. This was broken by the advent
of loadbalancer-detection for resumption, in 4.96 - which tries to
use the EHLO response. SMTPS does not have one at the time it is starting
TLS. Change the default for the smtp transport host_name_extract option
to be a static string, for TLS-on-connect cases; meaning that resumption
will always be attempted (unless deliberately overriden).
JH/06 Bug 3054: Fix dnsdb lookup for a TXT record with multiple chunks, with a
chunk-separator specification. This was broken by hardening introduced
for Bug 3031.
JH/07 Bug 3050: Fix -bp for old message_id format spoolfiles. Previously it
included the -H with the id; this also messed up exiqgrep.
JH/08 Bug 3056: Tighten up parsing of DKIM DNS records. Previously, whitespace
was not properly skipped and empty elements would cause mis-parsing.
Tighten parsing of DKIM header records. Previously, all but lowercase
alpha chars would be ignored in potential tag names.
JH/09 Bug 3057: Add heuristic for spotting mistyped IPv6 addresses in lists
being searched. Previously we only had one for IPv4 addresses. Per the
documentation, the error results by default in a no-match result for the
list. It is logged if the unknown_in_list log_selector is used.
JH/10 Bug 3058: Ensure that a failing expansion in a router "set" option defers
the routing operation. Previously it would silently stop routing the
message.
JH/11 Bug 3046: Fix queue-runs. Previously, the arrivel of a notification or
info-request event close in time to a scheduled run timer could result in
the latter being missed, and no further queue scheduled runs being
initiated. This ouwld be more likely on high-load systems.
JH/12 Refuse to accept a line "dot, LF" as end-of-DATA unless operating in
LF-only mode (as detected from the first header line). Previously we did
accept that in (normal) CRLF mode; this has been raised as a possible
attack scenario (under the name "smtp smuggling").
JH/13 Add an fdatasync call for the received message data file in spool, before
loggging reception and sending the SMTP ack. Previously we only flushed
the stdio buffer so there was still the possibility of a disk error.
JH/14 Bug 3061: Avoid a split log line when trying to rewrite a malformed
address. Previously, for the last address in a header line (commonly
there is only one) the terminating newline was part of the logged
information.
JH/15 Bug 3061: Ensure a log line is written for a malformed address in a
header, when parsing for address-qualification. Previously one was only
written if there were rewrite rules.
JH/16 Two-phase queue runs are now reported in the daemon startup log line and
in exiwhat output.
JH/17 Bug 3064: Fix combination of "-q<period> -R <recipients>". Introduction of
the multiple-queue-runners facility for 4.97 broke this, giving only a
one-time run of the queue.
JH/18 Bug 3068: Log a warning for use of deprecated syntax in query-style
lookups.
JH/19 Fix TLS startup. When the last expansion done before the initiation of a
TLS session resulted in a forced-fail, a misleading error was logged for
the expansino of tls_certificates. This would affect the common case of
that option being set (main-section options) but not having any variable
parts. It could also potentially affect tls_privatekeys. The underlyding
coding errors go back to 4.90 but were only exposed in 4.97.
JH/20 Bug 3047: A recent (somewhere between 10.34 and 10.42) version of the
pcre2 library starting allocating 20kB rather than 112 bytes per match
call, which broke the 2GB total limitation on Exim's memory management
when a user had over 104207 messages stored and the appendfile
maildir_quota_directory_regex option is in use. Release the allocated
memory every thosand files to avoid this.
The same issue arises with the ACL regex condition, which is applied
to every line of a received message.
JH/21 Bug 3059: Fix crash in smtp transport. When running for a message for
which all recipients had been handled (itself an issue) a null-pointer
deref was done on trying to write a retry record. Fix that by counting
the outstanding recipients before trying to transmit the message.
The situation arose for a second MX try within a transport run, when the
first had perm-rejected a recipient (the only one for the connection, in
the case seen) during pipelining, and then closed the TCP connection.
The transport classified that as an I/O error, leaving the message
outstanding but having marked up the recipient as dealt-with. It then
tried another MX because of the I/O error. Fix this by converting the
message-level status to ok if there was a close but all recipients were
dealt with. Thanks to Wolfgand Breyha for debug runs.
JH/22 The ESMTP_LIMITS facility (RFC 9422) is promoted from experimental status
and is now controlled by the build-time option DISABLE_ESMTP_LIMITS.
JH/23 Bug 3066: Avoid leaking lookup database credentials to log.
JH/24 Bug 3081: Fix a delivery process crash. When the router "errors_to"
option specified a fixed address, later rewriting on that address would
trip on the configuration data being readonly. Instead of modifying
in-place, copy data. Found and fixed by Peter Benie.
JH/25 Bug 3079: Fix crash in dbmnz. When a key was present for zero-length
data a null pointer was followed. Find and testcase by Sebastian Bugge.
JH/26 Fix encoding for an AUTH parameter on a MAIL FROM command. Previously
decimal 127 chars were not encoded, and lowercase hex was used for
encoded values. Outstanding since at least 1999.
JH/27 Fix crash in logging. When a message with a large number of recipients
had been received, and logging of recipients is enabled, the buffer used
for logging could reach limit. A read using a null pointer would then
be done, resulting in a crash of the receiving process before an SMTP
ACK for the message was returned to the sending system. Duplicate
messages were created as a result.
Find and debug help by Mateusz Krawczyk
JH/28 Bug 3086: Fix exinext for ipv6. Change the format of keys in the retry
DB, wrapping transport record bare-ip "host names" and ipv6
"host addresses" in square-brackets. This makes the parsing that
exinext does more reliable.
JH/29 Bug 3087: Fix SRS encode. A zero-length quoted element in the local-part
would cause a crash.
JH/30 Bug 3029: Avoid feeding Resent-From: to DMARC.
JH/31 Bug 3027: For -bh / -bhc tests change to using the compressed form of
ipv6 addresses for the sender. Previously the uncompressed form was used,
and if used in textual form this would result in behavior difference
versus non-bh.
JH/32 Bug 3096: MAIL before HELO/EHLO, where required by hosts_require_helo, is
now classed as a protocol error and subject to smtp_max_synprot_errors.
JH/33 Bug 2994: A subdir dsearch lookup should permit a directory name that starts
".." and has following characters.
JH/34 Fix delivery ordering for 2-phase queue run combined with
queue_run_in_order.
JH/35 Bug 3099: fix parsing of MIME filename= split over multiple paramemters.
Previously the $mime_filename variable would have an incorrect value.
While in the code, extend coverage to name= which previously was only
supported for single parameters, despite also filling in $mime_filename.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 00c4a7f9c3)
ci: Fix up Docker images' tag from version number
chore(deps): bump github.com/gin-contrib/cors from 1.3.1 to 1.6.0
Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>
(cherry picked from commit ccccd5c92d)
Fixes the following CVEs when compared to the last-packaged version,
1.20.1:
CVE-2024-37370
CVE-2024-37371
CVE-2023-36054
Signed-off-by: W. Michael Petullo <mike@flyn.org>
This should allow the service to be activated even earlier during
the boot process and also avoids race condition against network.
Signed-off-by: Hiếu Lê <leorize+oss@disroot.org>
(cherry picked from commit d00131e2a0)
chore(deps): bump golang.org/x/net from 0.18.0 to 0.23.0 in /service
Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>
(cherry picked from commit 5a05a3a2b9)
python-paho-mqtt is licensed under EPL-2.0, not EPL-1.0, since version
1.6.0 and
fabe7500fb
While at it, add LICENSE.txt to PKG_LICENSE_FILES
Fixes: 784f2a519b (python-paho-mqtt: bump to version 1.6.1)
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
(cherry picked from commit 3380427f29)
libgd is licensed under its own "GD" license and not MIT
Fixes: 60feea09c9 (libgd: import from oldpackages, add myself as maintainer, add license...)
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
(cherry picked from commit 41c998224d)
tiff is licensed under its own "libtiff" license and not BSD-3-Clause
Fixes: 364de5bc3f (tiff: add licensing information)
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
(cherry picked from commit ae165deaf5)
libev is licensed under BSD-2-Clause or GPL-2.0-or-later since its
addition to openwrt
While at it, assign PKG_LICENSE_FILES
Fixes: 67b39f8f9b
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
(cherry picked from commit 070fc8021c)
This is a security release.
Notable Changes
CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)
CVE-2024-22020 - Bypass network import restriction via data URL (Medium)
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
go1.21.12 (2024-07-02) includes security fixes to the net/http package,
as well as bug fixes to the compiler, the go command, the runtime,
and the crypto/x509, net/http, net/netip, and os packages.
Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>
Currently, armv5 and armv6 targets are both using armv6 rustc.
Without this patch, rust programs in armv5 targets throw illegal instruction
error.
Signed-off-by: Lu jicong <jiconglu58@gmail.com>
(cherry picked from commit 84464a656c)
If the download directory is on another filesystem (NFS), then the
current implementation of bootstrapping rust fails. Because the 'syscall'
(rename) does not work on crossing filesystem boundary.
This chnage was already merged upstream to the github main rust repository.
rust-lang/rust#124975
The patch has been rebased so that it can be applied correctly.
No functional change.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 6b6c74dca8)
- Switch back to .gz tarball
- Replace local bootstrap cache hack with upstreamed option
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit c1b3e0440f)
PKG_CPE_ID was missing ":lrzsz"
Fixes: 6d6c4b21b5 (lrzsz: update to v0.12.21rc and fix a CVE)
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
(cherry picked from commit da56ee5bed)
Release notes: https://www.openssh.com/txt/release-9.8
* 9.8p1 fixes CVE-2024-6387
* Adjusted Makefile to provide /usr/lib/sshd-session
* Given the troubles with -fzero-call-used-regs and all the
broken checks, makes sense to skip it
Build system: x86/64
Build-tested: x86/64/AMD Cezanne
Run-tested: x86/64/AMD Cezanne
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 75674f0439)
This is the thirteenth patch release in the 1.1.z release branch of runc.
Itbrings in Go 1.22.x compatibility and fixes a few issues,
including anoccasional wrong nofile rlimit in runc exec,
and a race between runc list and runc delete.
Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>
(cherry picked from commit c49a117238)
* removed an accidentally commited flag of the upcoming adblock 5.x, this fixes a startup regression without trigger interface
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit b76f6e1c16)
* corrected the documentation links for upstream
* fixed style to be correctly rendered
* add reference to OpenWrt tutorial
Signed-off-by: Goetz Goerisch <ggoerisch@gmail.com>
(cherry picked from commit 8b08b29271)
Update jool to version 4.1.10 and remove a no longer needed patch.
There was also a need to backport a patch to fix compile in some archs.
Signed-off-by: Tiago Gaspar <tiagogaspar8@gmail.com>
(cherry picked from commit 26bf35bb43)
Fix incorrect uci config syntax, caused by a careless newbie contributer.
Modify function append_param_arg() in init script, to support hyphenated
arguments.
Add more command parameters as uci options, no value is set to keep it default.
Signed-off-by: Ryan Keane <the.ra2.ifv@gmail.com>
(cherry picked from commit 2d711c8fbd)
[rebased upon 23.05 branch]
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
* made the DNS Reporting / tcpdump parsing code more capable
* small init fixes
* update readme
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit a029f01d81)
Release mainly focuses on bug fixes and patching compatibility issues.
Also, adds support to multiple platforms.
Removed obsolete patch as upstream has fixed.
Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>
* relax the firewall pre-check if fw4 is not running
* replace former stale tor feed source with 'https://www.dan.me.uk/torlist/?exit'
* add openvpn log term/search pattern example to the readme
* the default config now includes only log terms for dropbear and LuCI, all others are optional
* readme update
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit d17f661aee)
go1.21.11 (released 2024-06-04) includes
security fixes to the archive/zip and net/netip packages,
as well as bug fixes to the compiler,
the go command, the runtime, and the os package.
Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>
This change will provide the necessary dependency resolution, fixing:
Package lighttpd is missing dependencies for the following libraries:
libcrypto.so.3
Fixes: #23794
Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
(cherry picked from commit a300185d49)
Currently, it is not feasible to configure lighttpd to use OpenSSL as
its internal crypto library. Instead, one must rely on alternative
crypto libraries such as Nettle or mbedTLS. This setup is not ideal in
scenarios where a single crypto library is preferred. To address this
issue, lets propose introducing OpenSSL as an additional configuration
option. Similarly, propose GnuTLS as additional configuration option.
Closes: #24004
Co-developed-by: Glenn Strauss <gstrauss@gluelogic.com>
Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 8c9597f1dc)
GCC now does not allow assigning an std::locale to an std::string. No
idea why it worked originally.
Also fixed compilation with full NLS.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit c3e2dcc128)
Switch to local git tarballs. Smaller.
Upstream backport and a local patch.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 41a5880f01)
Supports interface metrics exposed by mwan3. The performance is a
little slow compared to other collectors (~300ms) as the ubus call is
where most of the time is spent. Any future speedups are likely better
put into mwan3's rpcd binary.
Signed-off-by: Ryan Doyle <ryan@doylenet.net>
[rename metrics,bump version]
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit c279efb760)
…for textfile collector, to make it more consistent with the upstream
Prometheus node-exporter
Signed-off-by: Rob Hoelz <rob@hoelz.ro>
[bump version]
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit 4edae84499)
Merge duplicate src/dest samples by suming their value (bytes count)
Fixes#24166
Signed-off-by: Antoine C <hi@acolombier.dev>
[bump version number]
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit cd8f67298c)
* fixed a regression in the split Set function (reported in the forum)
* fixed regex for urlhaus feed
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 2cc7cf3ca0)
The 3.2.3 release includes many bug-fixes. This release also includes
the update of uri.gem to 0.12.2 which contains the security fix.
- CVE-2023-36617: ReDoS vulnerability in URI
See: https://www.ruby-lang.org/en/news/2024/01/18/ruby-3-2-3-released/
The 3.2.4 release includes security fixes. Please check the topics below
for details.
- CVE-2024-27282: Arbitrary memory address read vulnerability with Regex search
- CVE-2024-27281: RCE vulnerability with .rdoc_options in RDoc
- CVE-2024-27280: Buffer overread vulnerability in StringIO
See: https://www.ruby-lang.org/en/news/2024/04/23/ruby-3-2-4-released/
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
* fixed a possible "Argument list too long" error in the f_log function
* fixed multiple, incomplete digit character classes
* fixed/optimized split file handling
* cosmetics
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 059a530329)
* adblock-fast can generate the compatible adb_list-file, but it's
only pulled if net/adblock installed, this patch also pulls in the
adb_list file if net/adblock-fast is installed.
* also bump PKG_RELEASE
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit d7d1743c83)
* made sure, that the domain lookup always add the found IPs to the underlying allow-/blocklist-Set
* major readme update
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit cc709768b5)
Backport patch fixing compilation error for sa_data not well defined.
This is triggered only on platform that makes use of fortify string and
cause compilation error due to the fact that sa_data is not well defined
and his size is arbitrary.
Patch has been accepted in the PF_RING project and this is just a
backport.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit c3a50a9fac)
Notable changes
This release fixes a regression introduced in Node.js 18.19.0 where http.server.close() was incorrectly closing idle connections.
A fix has also been included for compiling Node.js from source with newer versions of Clang.
The list of keys used to sign releases has been synchronized with the current list from the main branch.
Updated dependencies
* acorn updated to 8.11.3.
* acorn-walk updated to 8.3.2.
* ada updated to 2.7.8.
* c-ares updated to 1.28.1.
* corepack updated to 0.28.0.
* nghttp2 updated to 1.61.0.
* ngtcp2 updated to 1.3.0.
* npm updated to 10.7.0. Includes a fix from npm@10.5.1 to limit the number of open connections npm/cli#7324.
* simdutf updated to 5.2.4.
* zlib updated to 1.3.0.1-motley-7d77fb7.
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* fixed concurrent, too high nft loads during feed processing (seen in LuCI frontend)
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 3584187f69)
libxml2 restructured includes, thus another include is now required
otherwise build fails.
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 7009c6be73)
* fix regex for nixspam and sslbl feed
* list the pre-routing limits in the banIP status
* small fixes and log improvements
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 27e86ef42e)
go1.21.10 (released 2024-05-07) includes security fixes to the go
command, as well as bug fixes to the net/http package.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
fixes CVE-2024-25583; also includes changes from 4.8.7 that
fix regressions introduced with the security fixes in 4.8.6
Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>
* move extra_command and EXTRA_HELP to the top of the init file
* add packageCompat variable for compatibility check with WebUI
* add OutputFilter variables for supported resolvers
* simplify adb_check with the use of OutputFilter variables
* add show_blocklist command to display currently blocked domains
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit fb151d5b82)
* fix a processing race condition
* it's now possible to disable the icmp/syn/udp safeguards in pre-routing - set the threshold to '0'.
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 083554094b)
The new validation_method option can be: dns, webroot or standalone.
Previously we guessed the challenge type:
1. if the DNS provider is specified then it's dns
2. if standalone=1
3. fallback to webroot
The logic is preserved and if the validation_method wasn't set explicitly we'll guess it in old manner.
Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
This commit adds the following features:
1. UCI support for local DNS over HTTPS/TLS/QUIC server.
2. UCI support for using private reverse DNS.
3. procd jail with CAP_NET_BIND_SERVICE, allowing
dnsproxy to serve on standard ports directly.
Signed-off-by: Emily H. <battery_tag708@simplelogin.com>
(cherry picked from commit 5df794e343)
Backport patch for PCRE2 support as PCRE is EOL and won't receive any
support updates anymore.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit baa0d51270)
This swaps the order of the lines in the description so that when LuCI displays only the first line, it still offers some helpful information.
Signed-off-by: Nathan Friedly <nathan@nfriedly.com>
(cherry picked from commit 06ea66c558)
* fixed possible Set search race condition (initiated from LuCI frontend)
* fixed the "no result" Set search problem in LuCI
* removed abandoned feeds: spamhaus edrop (was merged with spamhaus drop)
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit ad755e0c4d)
* added a DDoS protection rules in a new pre-routing chain to prevent common ICMP, UDP and SYN flood attacks and drop spoofed tcp flags & invalid conntrack packets, flood tresholds are configured via 'ban_icmplimit' (default 10/s), 'ban_synlimit' (default 10/s) and 'ban_udplimit' (default 100/s)
* the new pre-routing rules are tracked via named nft counters and are part of the standard reporting, set 'ban_logprerouting' accordingly
* block countries dynamically by Regional Internet Registry (RIR)/regions, e.g. all countries related to ARIN. Supported service regions are: AFRINIC, ARIN, APNIC, LACNIC and RIPE, set 'ban_region' accordingly
* it's now possible to always allow certain protocols/destination ports in wan-input and wan-forward chains, set 'ban_allowflag' accordingly - e.g. ' tcp 80 443-445'
* filter/convert possible windows line endings of external feeds during processing
* the cpu core autodetection is now limited to max. 16 cores in parallel, set 'ban_cores' manually to overrule this limitation
* set the default nft priority to -100 for banIP input/forward chains (pre-routing is set to -150)
* update readme
* a couple of bugfixes & performance improvements
* removed abandoned feeds: darklist, ipblackhole
* added new feeds: becyber, ipsum, pallebone, debl (changed URL)
* requires a LuCI frontend update as well (separate PR/commit)
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit fa80fefe22)
The GitHub CI offers currenlty more architecture and the Signed-of-by
test is covered via the DOC CI test. In case GitHub ever changes
policies, we can simply switch back.
Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit 26c101edc3)
* include `server:` directive at the top of unbound file
* update unbound-related outputGzip variable to include full path
* return always_nxdomain for blocked domains
* also update copyright stamp/license
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 474587a1f4)
This is a security release.
Notable Changes
* CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
Bump to latest 2.0.25.1 release
Drop upstream PCRE2 patch and alarm memory leak fix.
Rework and refresh patch due to release bump.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit a9371952c9)
Add experimental pcre2 patch and drop pcre in favor of pcre2 library.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 4374c3250f)
Bump to release 2.0.22 to make it easier to apply patch for pcre2
support.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 94ded8ff31)
IPv6 has accidentally been disabled in all Exim builds since the
package was introduced in OpenWrt due to a faulty `sed` script. This
has now been fixed, so beware that IPv6 is now enabled when updating
from previous releases.
Upstream changes since version 4.96.2 (bottom up):
JH/s1 Refuse to accept a line "dot, LF" as end-of-DATA unless operating in
LF-only mode (as detected from the first header line). Previously we did
accept that in (normal) CRLF mode; this has been raised as a possible
attack scenario (under the name "smtp smuggling", CVE-2023-51766).
JH/01 The hosts_connection_nolog main option now also controls "no MAIL in
SMTP connection" log lines.
JH/02 Option default value updates:
- queue_fast_ramp (main) true (was false)
- remote_max_parallel (main) 4 (was 2)
JH/03 Cache static regex pattern compilations, for use by ACLs.
JH/04 Bug 2903: avoid exit on an attempt to rewrite a malformed address.
Make the rewrite never match and keep the logging. Trust the
admin to be using verify=header-syntax (to actually reject the message).
JH/05 Follow symlinks for placing a watch on TLS creds files. This means
(under Linux) we watch the dir containing the final file; previously
it would be the dir with the first symlink. We still do not monitor
the entire path.
JH/06 Check for bad chars in rDNS for sender_host_name. The OpenBSD (at least)
dn_expand() is happy to pass them through.
JH/07 OpenSSL Fix auto-reload of changed server OCSP proof. Previously, if
the file with the proof had an unchanged name, the new proof(s) were
loaded on top of the old ones (and nover used; the old ones were stapled).
JH/08 Bug 2915: Fix use-after-free for $regex<n> variables. Previously when
more than one message arrived in a single connection a reference from
the earlier message could be re-used. Often a sigsegv resulted.
These variables were introduced in Exim 4.87.
Debug help from Graeme Fowler.
JH/09 Fix ${filter } for conditions that modify $value. Previously the
modified version would be used in construction the result, and a memory
error would occur.
JH/10 GnuTLS: fix for (IOT?) clients offering no TLS extensions at all.
Find and fix by Jasen Betts.
JH/11 OpenSSL: fix for ancient clients needing TLS support for versions earlier
than TLSv1,2, Previously, more-recent versions of OpenSSL were permitting
the systemwide configuration to override the Exim config.
HS/01 Bug 2728: Introduce EDITME option "DMARC_API" to work around incompatible
API changes in libopendmarc.
JH/12 Bug 2930: Fix daemon startup. When started from any process apart from
pid 1, in the normal "background daemon" mode, having to drop process-
group leadership also lost track of needing to create listener sockets.
JH/13 Bug 2929: Fix using $recipients after ${run...}. A change made for 4.96
resulted in the variable appearing empty. Find and fix by Ruben Jenster.
JH/14 Bug 2933: Fix regex substring match variables for null matches. Since 4.96
a capture group which obtained no text (eg. "(abc)*" matching zero
occurrences) could cause a segfault if the corresponding $<n> was
expanded.
JH/15 Fix argument parsing for ${run } expansion. Previously, when an argument
included a close-brace character (eg. it itself used an expansion) an
error occurred.
JH/16 Move running the smtp connect ACL to before, for TLS-on-connect ports,
starting TLS. Previously it was after, meaning that attackers on such
ports had to be screened using the host_reject_connection main config
option. The new sequence aligns better with the STARTTLS behaviour, and
permits defences against crypto-processing load attacks, even though it
is strictly an incompatible change.
Also, avoid sending any SMTP fail response for either the connect ACL
or host_reject_connection, for TLS-on-connect ports.
JH/17 Permit the ACL "encrypted" condition to be used in a HELO/EHLO ACL,
Previously this was not permitted, but it makes reasonable sense.
While there, restore a restriction on using it from a connect ACL; given
the change JH/16 it could only return false (and before 4.91 was not
permitted).
JH/18 Fix a fencepost error in logging. Previously (since 4.92) when a log line
was exactly sized compared to the log buffer, a crash occurred with the
misleading message "bad memory reference; pool not found".
Found and traced by Jasen Betts.
JH/19 Bug 2911: Fix a recursion in DNS lookups. Previously, if the main option
dns_again_means_nonexist included an element causing a DNS lookup which
itself returned DNS_AGAIN, unbounded recursion occurred. Possible results
included (though probably not limited to) a process crash from stack
memory limit, or from excessive open files. Replace this with a paniclog
whine (as this is likely a configuration error), and returning
DNS_NOMATCH.
JH/20 Bug 2954: (OpenSSL) Fix setting of explicit EC curve/group. Previously
this always failed, probably leading to the usual downgrade to in-clear
connections.
JH/21 Fix TLSA lookups. Previously dns_again_means_nonexist would affect
SERVFAIL results, which breaks the downgrade resistance of DANE. Change
to not checking that list for these lookups.
JH/22 Bug 2434: Add connection-elapsed "D=" element to more connection
closure log lines.
JH/23 Fix crash in string expansions. Previously, if an empty variable was
immediately followed by an expansion operator, a null-indirection read
was done, killing the process.
JH/24 Bug 2997: When built with EXPERIMENTAL_DSN_INFO, bounce messages can
include an SMTP response string which is longer than that supported
by the delivering transport. Alleviate by wrapping such lines before
column 80.
JH/25 Bug 2827: Restrict size of References: header in bounce messages to 998
chars (RFC limit). Previously a limit of 12 items was made, which with
a not-impossible References: in the message being bounced could still
be over-large and get stopped in the transport.
JH/26 For a ${readsocket } in TLS mode, send a TLS Close Alert before the TCP
close. Previously a bare socket close was done.
JH/27 Fix ${srs_encode ..}. Previously it would give a bad result for one day
every 1024 days.
JH/28 Bug 2996: Fix a crash in the smtp transport. When finding that the
message being considered for delivery was already being handled by
another process, and having an SMTP connection already open, the function
to close it tried to use an uninitialized variable. This would afftect
high-volume sites more, especially when running mailing-list-style loads.
Pollution of logs was the major effect, as the other process delivered
the message. Found and partly investigated by Graeme Fowler.
JH/29 Change format of the internal ID used for message identification. The old
version only supported 31 bits for a PID element; the new 64 (on systems
which can use Base-62 encoding, which is all currently supported ones
but not Darwin (MacOS) or Cygwin, which have case-insensitive filesystems
and must use Base-36). The new ID is 23 characters rather than 16, and is
visible in various places - notably logs, message headers, and spool file
names. Various of the ancillary utilities also have to know the format.
As well as the expanded PID portion, the sub-second part of the time
recorded in the ID is expanded to support finer precision. Theoretically
this permits a receive rate from a single comms channel of better than the
previous 2000/sec.
The major timestamp part of the ID is not changed; at 6 characters it is
usable until about year 3700.
Updating from previously releases is fully supported: old-format spool
files are still usable, and the utilities support both formats. New
message will use the new format. The one hints-DB file type which uses
message-IDs (the transport wait- DB) will be discarded if an old-format ID
is seen; new ones will be built with only new-format IDs.
Optionally, a utility can be used to convert spool files from old to new,
but this is only an efficiency measure not a requirement for operation
Downgrading from new to old requires running a provided utility, having
first stopped all operations. This will convert any spool files from new
back to old (losing time-precision and PID information) and remove any
wait- hints databases.
JH/30 Bug 3006: Fix handling of JSON strings having embedded commas. Previously
we treated them as item separators when parsing for a list item, but they
need to be protected by the doublequotes. While there, add handling for
backslashes.
JH/31 Bug 2998: Fix ${utf8clean:...} to disallow UTF-16 surrogate codepoints.
Found and fixed by Jasen Betts. No testcase for this as my usual text
editor insists on emitting only valid UTF-8.
JH/32 Fix "tls_dhparam = none" under GnuTLS. At least with 3.7.9 this gave
a null-indirection SIGSEGV for the receive process.
JH/33 Fix free for live variable $value created by a ${run ...} expansion during
-bh use. Internal checking would spot this and take a panic.
JH/34 Bug 3013: Fix use of $recipients within arguments for ${run...}.
In 4.96 this would expand to empty.
JH/35 Bug 3014: GnuTLS: fix expiry date for an auto-generated server
certificate. Find and fix by Andreas Metzler.
JH/36 Add ARC info to DMARC hostory records.
JH/37 Bug 3016: Avoid sending DSN when message was accepted under fakereject
or fakedefer. Previously the sender could discover that the message
had in fact been accepted.
JH/38 Taint-track intermediate values from the peer in multi-stage authentation
sequences. Previously the input was not noted as being tainted; notably
this resulted in behaviour of LOGIN vs. PLAIN being inconsistent under
bad coding of authenticators.
JH/39 Bug 3023: Fix crash induced by some combinations of zero-length strings
and ${tr...}. Found and diagnosed by Heiko Schlichting.
JH/40 Bug 2999: Fix a possible OOB write in the external authenticator, which
CVE-2023-42115
JH/41 Bug 3000: Fix a possible OOB write in the SPA authenticator, which could
be triggered by externally-controlled input. Found by Trend Micro.
CVE-2023-42116
JH/42 Bug 3001: Fix a possible OOB read in the SPA authenticator, which could
be triggered by externally-controlled input. Found by Trend Micro.
CVE-2023-42114
JH/43 Bug 2903: avoid exit on an attempt to rewrite a malformed address.
Make the rewrite never match and keep the logging. Trust the
admin to be using verify=header-syntax (to actually reject the message).
JH/44 Bug 3033: Harden dnsdb lookups against crafted DNS responses.
CVE-2023-42219
could be triggered by externally-supplied input. Found by Trend Micro.
CVE-2023-42115
JH/41 Bug 3000: Fix a possible OOB write in the SPA authenticator, which could
be triggered by externally-controlled input. Found by Trend Micro.
CVE-2023-42116
JH/42 Bug 3001: Fix a possible OOB read in the SPA authenticator, which could
be triggered by externally-controlled input. Found by Trend Micro.
CVE-2023-42114
JH/43 Bug 2903: avoid exit on an attempt to rewrite a malformed address.
Make the rewrite never match and keep the logging. Trust the
admin to be using verify=header-syntax (to actually reject the message).
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit e8600462c7)
LVM2 Version 2.03.17 - 10th November 2022
=========================================
Add new options (--fs, --fsmode) for FS handling when resizing LVs.
Fix 'lvremove -S|--select LV' to not also remove its historical LV right away.
Fix lv_active field type to binary so --select and --binary applies properly.
Switch to use mallinfo2 and use it only with glibc.
Error out in lvm shell if using a cmd argument not supported in the shell.
Fix lvm shell's lastlog command to report previous pre-command failures.
Extend VDO and VDOPOOL without flushing and locking fs.
Add --valuesonly option to lvmconfig to print only values without keys.
Updates configure with recent autoconf tooling.
Fix lvconvert --test --type vdo-pool execution.
Add json_std output format for more JSON standard compliant version of output.
Fix vdo_slab_size_mb value for converted VDO volume.
Fix many corner cases in device_id, including handling of S/N duplicates.
Fix various issues in lvmdbusd.
DM Version 1.02.187 - 10th November 2022
========================================
Add DM_REPORT_GROUP_JSON_STD for more JSON standard compliant output format.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 20cc530004)
This release marks a noteworthy milestone in that it includes a
completely new transport layer. It lays the groundwork for fixing some
major design issues and may also already alleviate a variety of issues
seen in previous releases related to connectivity. This change also
deprecates our testbed and ATS subsystem.
This is a new major release. It breaks protocol compatibility with the
0.20.x versions. Please be aware that Git master is thus henceforth
(and has been for a while) INCOMPATIBLE with the 0.20.x GNUnet
network, and interactions between old and new peers will result in
issues. In terms of usability, users should be aware that there are
still a number of known open issues in particular with respect to ease
of use, but also some critical privacy issues especially for mobile
users. Also, the nascent network is tiny and thus unlikely to provide
good anonymity or extensive amounts of interesting information. As a
result, the 0.21.0 release is still only suitable for early adopters
with some reasonable pain tolerance.
v0.21.0:
- Reworked PEERSTORE API
- Added record flag for maintenance records
- ensure traits can be generated with subsystem-specific prefixes for
the symbols
- libgnunettesting first major testing NG refactor towards getting
dependency structure streamlined
- Remove single-use API macro GNUNET_VA_ARG_ENUM
- major revision of blind signature API
- Introduced closure to hold store context when caling function to add
hello in peerstore.
- Added DDLs for handling GNUNET_PEERSTORE_StoreHelloContext
- Removed old hello functionality.
- Refactoring components under src/ into lib/, plugin/, cli/ and
service/
- add support for encoding/decoding double values as part of JSON to
libgnunetjson
- Changed method GNUNET_HELLO_builder_get_expiration_time to not need
parameter GNUNET_HELLO_Builder.
- Code moved to the core package to get rid of circular dependencies.
- Moved code to testing to have more generic test setup, which can be
used not only from within transport.
- The old hello design replaced by the new hello design.
- Added api to get notified when hellos are stored with peerstore
service.
- Added api to store hellos with peerstore service.
- Changed new hello uri api to allow to change the expiration time
- Moved start peer command to testing subsystem.
- Removed all usage of old transport api, beside peerinfo tool,
gnunet-transport cli and usage in transport layer itself.
- Added __attribute__((deprecated)) to the old transport API
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 31e9aea1b6)
v0.20.0:
- GNUNET_TESTING_get_testname_from_underscore renamed to GNUNET_STRINGS_get_suffix_from_binary_name and moved from libgnunettesting to libgnuneutil
- Move GNUNET_s into libgnunetutil.
- re-introduce compiler annotation for array size in signature
- function-signature adjustment due to compiler error
- GNUNET_PQ_get_oid removed, GNUNET_PQ_get_oid_by_name improved
- Added GNUNET_PQ_get_oid_by_name
- added GNUNET_PQ_get_oid()
- Added new CCA-secure KEM and use in IDENTITY encryption
- Add KEM API to avoid ephemeral private key management
- Add new GNUNET_PQ_event_do_poll() API to gnunet_pq_lib.h
- Added API to support arrays in query results
- Improve PQ API documentation.
- API for array types extended for times
- API extended for array query types
- relevant array-types in queries (not results) in postgresql added
- just style fixes, int to enum
- initial steps towards support of array-types in posgresql
- adds GNUNET_JSON_spec_object_const() and GNUNET_JSON_spec_array_const()
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit dbae7f9493)
v0.19.4:
- No changes
v0.19.3:
- We now detect MySQL's strange, version-dependent my_bool type on configure.
- Add pkg-config definitions for gnunet messenger.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit bef5da553f)
- Missing --without-nghttp3 was leaking host includes and breaking the build
- Remove or rename deprecated configure options
- Add --disable-libcurl-option to reduce package size
- Use .xz instead of .bz2 for PKG_SOURCE
Signed-off-by: Aleksey Vasilenko <aleksey.vasilenko@gmail.com>
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 30fe2d99ab)
go1.21.9 (released 2024-04-03) includes a security fix to the net/http
package, as well as bug fixes to the linker, and the go/types and
net/http packages.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
1. Update it to version 3.16.3
Release notes: https://github.com/LuaLanes/lanes/releases/tag/v3.16.3
2. Change to download tarball instead of checking out Git sources
In the previous commit (in the Fixes tag), it was changed to Git sources without any reason. Let's revert it back. Let's use again tagged release.
Fixes: b93e5b45b1 ("lualanes: Version bump to v3.16.2")
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 8b7040b6de)
Update the PKG_VERSION and PKG_SOURCE_VERSION to pull version 3.16.2
from upstream. The upstream version includes fixes for the
`pthread_yield: symbol not found` issue.
Removed patches 100-musl-compat.patch and 200-fix-redef-error.patch
as fixes were implemented upstream.
Build tested on aarch64, arm_cortex_a15/a9, i386, mips[el]_24kc,
powerpc_464fp/8548, riscv64, x86_64. Confirmed on x86_64.
Signed-off-by: Mark Baker <mark@vpost.net>
(cherry picked from commit 08e51ab50a)
Changelog: https://github.com/snort3/snort3/releases/tag/3.1.82.0
Removed patches/010-gcc13.patch
,,_ -*> Snort++ <*-
o" )~ Version 3.1.82.0
'''' By Martin Roesch & The Snort Team
http://snort.org/contact#team
Copyright (C) 2014-2024 Cisco and/or its affiliates. All rights reserved.
Copyright (C) 1998-2013 Sourcefire, Inc., et al.
Using DAQ version 3.0.14
Using LuaJIT version 2.1.0-beta3
Using OpenSSL 3.0.13 30 Jan 2024
Using libpcap version 1.10.4 (with TPACKET_V3)
Using PCRE version 8.45 2021-06-15
Using ZLIB version 1.3.1
Using Hyperscan version 5.4.2 2024-03-06
Using LZMA version 5.4.6
Build system: x86/64
Build-tested: x86/64/AMD Cezanne
Run-tested: x86/64/AMD Cezanne
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit fdebb16619)
Notable Changes
* CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash- (High)
* CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium)
* llhttp version 9.2.1
* undici version 5.28.4
Changed to use gz according to main-snapshot
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
Update irqbalance to version 1.9.4.
* refresh version in meson patch
* remove EINVAL handling patch as upstream seems to have silenced
the log spam for unmanageable IRQs
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit b8d0049e7c)
I have some strange issues with irqbalance sometimes overwritin
smp_affinity values for banned/ignored IRQs. The issue is reproduceable
and is mitigated when I change theway how the irqbalance command line is
built. The only difference between the resulting command is that there
is only one space between the -t parameter and the first -i parameter
value.
Also see https://github.com/Irqbalance/irqbalance/issues/297
Signed-off-by: Carsten Schuette <schuettecarsten@googlemail.com>
(cherry picked from commit 41e5b979f5)
Text between interpreter line and start of first directive should only
highlighted as uninterpreted when running in template mode, so adjust
the match rule accordingly.
Fixes: #23761
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 8f9564387d)
Introduce local syntax highlighting support for ucode scripts, like
it is done already for uci configuration files.
Ref: https://github.com/jow-/ucode/issues/178
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit d8a574f7f0)
* update to 8.7.1: https://curl.se/changes.html#8_7_1
* use the new --disable-docs flag for configure
* update 200-no_docs_tests.patch
* switch to APK-compatible revision
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 227c8daa15)
Instead of checking Git sources, we will use now tagged releases.
This solve the strange version 0~3.5.1-r1, now will be 3.5.2-r2
Signed-off-by: Andrea Pesaresi <andreapesaresi82@gmail.com>
(cherry picked from commit f8a7ee7f47)
Various fixes for ksmbd, most notably a visibility fix for the latest
ksmbd code.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit e9e1ae2386)
Before this change, the tarball was downloaded as vVERSION.tar.gz.
For example, it was v2.26.1.tar.gz and that file was put into the dl folder
within the OpenWrt build system.
After this change, the tarball is properly downloaded as NAME-vVERSION.tar.gz.
In this case, it will look like this: docker-compose-v.2.26.1.tar.gz
The advantages of using this:
- Users, developers will know that what they downloaded (it has name and version)
- The tarball will not be overwritten by another package with the same version.
Signed-off-by: Javier Marcet <javier@marcet.info>
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
[added commit message]
(cherry picked from commit 261b38c14b)
keylength, being an acme.sh value type, uses pure numbers for rsa keys.
This can be disorienting for other acme clients. This change introduces
a new option "key_type" that aims to remove this ambiguity, and makes
all key type names follow the same pattern, making acme-common more
client agnostic.
Signed-off-by: Glen Huang <me@glenhuang.com>
(cherry picked from commit 6d61014e51)
Backport config changes from commit 04ac8c177d ("acme-common: simplify config
example") from master, and apply the subsequent fixup. This should fix the issue
with ACME not working in Luci (resolving #23756).
Keep the version number bump as a bugfix (1.0.4) since we have not backported
all the ACME changes to 23.05.
Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
56eebdad085e uspot: wrap spotfilter device under tip_mode
1a96d57e5fe0 uspot: client_enable() wrap spotfilter data in tip_mode
fe12f9a7abde uspot: clear ratelimit state on startup/shutdown
976badc4d0b6 update README
53b8cb88a94a Makefile: require minimum ucode version
ff6163190d5a uspot/portal: report client_enable() failure
8601d9199233 include sample radcli dictionaries
c670f6c4b48f update README
094f0df88150 uspot: work around ucode#191 missing in 23.05
Update the package Makefile to reflect the changes from the following
above-listed commit:
53b8cb88a94a Makefile: require minimum ucode version
Fixes: https://github.com/f00b4r0/uspot/issues/4
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
(cherry picked from commit bc33522715)
Compile tested: (ramips, rb760igs, 23.05 snapshot)
Run tested: (ramips, rb760igs, 23.05 snapshot, tests done)
Description:
In case we have multiple device defined in /etc/config/p910nd then init script will try to start multiple instance with same instance name
drop instance name as resolution
tested on 23.05 snapshot with 2 USB printers
Signed-off-by: Peca Nesovanovic <peca.nesovanovic@sattrakt.com>
(cherry picked from commit 152d80ce13)
go1.21.8 (released 2024-03-05) includes security fixes to the crypto/x509,
html/template, net/http, net/http/cookiejar, and net/mail packages,
as well as bug fixes to the go command and the runtime.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Since version 4.4.0, syslog-ng added compression to http() destination
using zlib from curl. [1] However, zlib is currently disabled in curl [2]
and it prevented syslog-ng to start.
This commit changes the configuration opinion to enable http module only if
zlib support is enabled for curl and as well it adds dependency for zlib (in that case).
If the zlib is disabled, then it disables http module, so syslog-ng can start
and thus zlib dependency is not required.
[1] https://gitlab.nic.cz/turris/os/packages/-/issues/932
[2] 93cbaacbfb/net/curl/Config.in (L134)
Fixes: 4dd49d7c3c ("syslog-ng: update to version 4.4.0")
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 1e14d95d78)
With the commit 01e5cfc "CI: Add target/arch tags (no suffix) for
snapshot images"[1] the os/platform is set for all images, which is usually
different from what the GitHub action runner uses (x86). The Docker
deamon still tries to fetch the x86 version and fails.
This commit explicitly sets the fitting arch.
[1]: 01e5cfccd7
Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit d359fa04ed)
- Fixes CVE-2023-50868 and CVE-2023-50387
- Also, the resolver has not been called 'Knot DNS Resolver' for quite
some time, so fix that, too.
Signed-off-by: Michal Hrusecky <michal.hrusecky@turris.com>
(cherry picked from commit 1131acf57f)
'dnstap' module will be built but not loaded by default at runtime
(configuration must be provided for it to be loaded). It is still possible to
disable dnstap build manually using menuconfig.
"The dnstap module supports logging DNS requests and responses to a unix socket
in dnstap format using fstrm framing library. This logging is useful if you need
effectively log all DNS traffic."[^1]
Adds dependency on 'protobuf', 'protobuf-c', 'libfstrm'. Listed packages are
available from OpenWrt packages, have uncomplicated manifests and
while 'protobuf-c' doesn't have a maintainer since spring 2020, all the
packages (including 'protobuf-c') seem to be maintained - the last
updates of all of them in autumn 2021.
As stated by Vladimír Čunát from Knot Resolver team they build dnstap
while packaging for majority of standard Linux distributions.
Therefore this change brings us closer to expected default.
[^1]: https://knot-resolver.readthedocs.io/en/stable/modules-dnstap.html
Signed-off-by: Šimon Bořek <simon.borek@nic.cz>
(cherry picked from commit a68397ff77)
It was possible to enable dnstap in menuconfig, but the configuration
only added dependencies while leaving dnstap module build disabled.
Signed-off-by: Šimon Bořek <simon.borek@nic.cz>
(cherry picked from commit af521478f8)
that way, procd does not needlessly restart unbound on triggers when
everything remains the same - changes in non-default included
configuration files will not be registered, however
Signed-off-by: Jan Klos <jan@klos.xyz>
XSK support is set to auto by default and on some hosts it is detected as
on and leads to:
```
In file included from dnsdist-backend.cc:32:
xsk.hh:28:10: fatal error: bits/types/struct_timespec.h: No such file or
directory
28 | #include <bits/types/struct_timespec.h>
```
Here we disable XSK so configure will behave more deterministically and
hopefully fix the builders.
Signed-off-by: krant <aleksey.vasilenko@gmail.com>
(cherry picked from commit f8dcc36af4)
The new validation_method option can be: dns, webroot or standalone.
Previously we guessed the challenge type:
1. if the DNS provider is specified then it's dns
2. if standalone=1
3. fallback to webroot
The logic is preserved and if the validation_method wasn't set explicitly we'll guess it in old manner.
Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
(cherry picked from commit 7d07c75154)
ntp sources are dead and gone. The most important functionality is now
provided by ntpd.
Signed-off-by: Paul Donald <newtwen@gmail.com>
(cherry picked from commit 2cd10d8113)
The deprecated stats_freq() replaced with stats(freq(0)).
Also make comments shorter.
Fix tabs.
Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
(cherry picked from commit 37d2d69595)
go1.21.6 (released 2024-01-09) includes fixes to the compiler,
the runtime, and the crypto/tls, maps, and runtime/pprof packages.
go1.21.7 (released 2024-02-06) includes fixes to the compiler,
the go command, the runtime, and the crypto/x509 package.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 34867e83ca)
* fix a long standing problem in the logfile-parser with dropbear and compressed IPv6 addresses
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 7b06b1d312)
* add support for destination port & protocol limitations for external feeds (see readme for details),
useful for lan-forward ad- or DoH-blocking, e.g. only tcp ports 80 and 443
* add turris sentinel blocklist feed
* update readme
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 730ad59cb9)
This is a new package for ragel which is a dependency for another
new package vectorscan
Co-authored-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit fa76c4df5c)
Should provide increases in snort3 performance thanks to thread-
caching malloc provided by gperftools. Avg CPU usage is down.
Another user reported higher throughput achieved with snort3
compiled with this on samba transfers on system with CPU-limited
snort3 performance.[1]
1. https://forum.openwrt.org/t/some-help-with-a-makefile-gperftools/165656/22
Build system: x86/64
Build-tested: x86/64/AMD Cezanne
Run-tested: x86/64/AMD Cezanne
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 4295bd7f45)
Changelog: https://github.com/snort3/snort3/releases/tag/3.1.81.0
,,_ -*> Snort++ <*-
o" )~ Version 3.1.81.0
'''' By Martin Roesch & The Snort Team
http://snort.org/contact#team
Copyright (C) 2014-2024 Cisco and/or its affiliates. All rights reserved.
Copyright (C) 1998-2013 Sourcefire, Inc., et al.
Using DAQ version 3.0.14
Using LuaJIT version 2.1.0-beta3
Using OpenSSL 3.0.13 30 Jan 2024
Using libpcap version 1.10.4 (with TPACKET_V3)
Using PCRE version 8.45 2021-06-15
Using ZLIB version 1.3.1
Using Hyperscan version 5.4.2 2024-02-16
Using LZMA version 5.4.6
Build system: x86/64
Build-tested: x86/64/AMD Cezanne
Run-tested: x86/64/AMD Cezanne
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit a7b5bfbfb7)
Thread-caching malloc provided by this package improves snort3
performance. I have been running with this for over seven months
without issues. Avg CPU usage is down. Another user reported
higher throughput achieved with snort3 compiled with this on
samba transfers on system with CPU-limited snort performance.[1]
1. https://forum.openwrt.org/t/some-help-with-a-makefile-gperftools/165656/22
Build system: x86/64
Build-tested: x86/64
Run-tested: x86/64
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit c1b4e80825)
Hyperscan is a high performance regular expression matching
library from Intel that runs on x86 platforms and offers
support for Perl Compatible Regular Expressions (PCRE) syntax,
simultaneous matching of groups of regular expressions, and
streaming operations.
This has utility in speeding up snort3.
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 1db5c54617)
* various vpn optimizations
* remove obsololete trm_maxscan option
* small fixes for net status and captive portal handling
* add an additional login variant to the h-hotels login script
* fix the wifibahn login script work again with wifionice hotspots again
* update readme
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 6e4ea63b7e)
Refresh and backport patches so that
- ./python path in the source code takes precedence over the same dir in hostpkg
- OVN LTS version 22.03.5 which depends on Open vSwitch 3.0 can compile
with Open vSwitch 2.17
Fixes: https://github.com/openwrt/packages/issues/22744
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry picked from commit 7ccbb9a66c)
Update to 1.48.0
CVE-2024-24806 : Improper Domain Lookup that potentially leads to SSRF attacks
Vulnerabilities fixed
* CVE-2024-24806 / GHSA-f74f-cvh7-c6q6 0f2d7e7, 3530bcc and e0327e1
Notable Changes
* linux: disable io_uring on ppc64 and ppc64le #4285
* linux: disable io_uring on hppa below kernel 6.1.51 #4224
* win/spawn: optionally run executable paths with no file extension #4292 (We recommend that most users consider setting this by default)
Important Bugs Fixed
* unix,win: fix busy loop with zero timeout timers #4250, #4304.
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry picked from commit 02a982bc10)
Retry when resolveip fails as it seems to be causing issues
on startup depending on various unpredictable parameters.
Resolves: #23185
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
Switch to current stable version 6.4.7.
See release notes:
https://www.zabbix.com/rn/rn6.4.7
So that the new version builds cleanly. The 'libevent2-pthreads' must be
added as dependency.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 4f9ced5cf9)
Update to v18.19.1
This is a security release.
Notable changes
* CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High)
* CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
* CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
* CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)
* undici version 5.28.3
* npm version 10.2.4
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
Fixes CVEs:
- CVE-2023-50387: Validating DNS messages containing a lot of DNSSEC signatures
could cause excessive CPU load, leading to a denial-of-service condition.
- CVE-2023-50868: Preparing an NSEC3 closest encloser proof could cause
excessive CPU load, leading to a denial-of-service condition.
- CVE-2023-4408: Parsing DNS messages with many different names could cause
excessive CPU load.
- CVE-2023-5517: Specific queries could cause named to crash with an assertion
failure when nxdomain-redirect was enabled.
- CVE-2023-5679: A bad interaction between DNS64 and serve-stale could cause
named to crash with an assertion failure, when both of these features were
enabled.
Signed-off-by: Noah Meyerhans <frodo@morgul.net>
(cherry picked from commit d277e41e78)
Fixes CVEs:
CVE-2023-3341 - Previously, sending a specially crafted message over the
control channel could cause the packet-parsing code to run out of available
stack memory, causing named to terminate unexpectedly.
CVE-2023-4236 - A flaw in the networking code handling DNS-over-TLS queries
could cause named to terminate unexpectedly due to an assertion failure under
significant DNS-over-TLS query load.
Signed-off-by: Noah Meyerhans <frodo@morgul.net>
(cherry picked from commit 835b105151)
Fixes CVEs:
- CVE-2023-2828: The overmem cleaning process has been improved, to
prevent the cache from significantly exceeding the configured
max-cache-size limit.
- CVE-2023-2911: A query that prioritizes stale data over lookup
triggers a fetch to refresh the stale data in cache. If the fetch is
aborted for exceeding the recursion quota, it was possible for named
to enter an infinite callback loop and crash due to stack overflow.
The complete list of changes is available in the upstream release
notes at
https://ftp.isc.org/isc/bind9/cur/9.18/doc/arm/html/notes.html#notes-for-bind-9-18-16
Signed-off-by: Noah Meyerhans <frodo@morgul.net>
(cherry picked from commit 9ac79ad469)
this prevents the daemon exiting when a configured device
is not plugged in.
Signed-off-by: Paul Donald <newtwen@gmail.com>
(cherry picked from commit dabeaa7643)
Harmless to carry this fix until procd.sh adds the param
This parameter will mean umdns advertises not just "OpenWrt" but a more
appropriate string:
"Apple LaserWriter Pro 630"
Signed-off-by: Paul Donald <newtwen@gmail.com>
(cherry picked from commit ac501c908d)
Commit driver_home defaults before continuing
Fix missing path for serial number acquisition
Store current device if no previously configured device had one.
Also set CHAR_DEV so the printer can get its driver sent on first run.
Signed-off-by: Paul Donald <newtwen@gmail.com>
(cherry picked from commit 5bc581e698)
replace -a with &&
shorten uci commands via variables
add optional ieee1284_id parameters
Signed-off-by: Paul Donald <newtwen@gmail.com>
(cherry picked from commit 6e886cd434)
The spec https://developer.apple.com/bonjour/printing-specification/bonjourprinting-1.2.1.pdf
notes:
... if the meaning of any of the TXT record keys is changed, the txtvers value
will be incremented. The current value of this key is “1”, and if this key does not exist in
the TXT record, the default value of “1” is assumed. The txtvers SHOULD be the first
key/value pair in the TXT record.
Signed-off-by: Paul Donald <newtwen@gmail.com>
(cherry picked from commit 069cc8dc81)
Don't run procd with a name of p9100d or p9101d etc.
Use the original binary name: p910nd.
This way, all supplied parameters should be visible via e.g.:
ps
xargs -0 < /proc/{procid}/cmdline
Revise all p910nd strings to the variable DAEMON_NAME or CONFIG where
appropriate.
Signed-off-by: Paul Donald <newtwen@gmail.com>
(cherry picked from commit 34a35c93ce)
* allow users to specify list of interfaces/networks to force the
DNS Hijacking on
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit eafdd63d67)
stlink is an open source toolset to program and debug STM32 devices
and boards manufactured by STMicroelectronics.
Resulting binary packages:
* stlink - library and shared chip info data
* st-info - a programmer and chip information tool
* st-flash - a flash manipulation tool
* st-trace - a logging tool to record information on execution
* st-util - a GDB server
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit e609f6acdf)
Update crowdsec to latest upstream release version 1.6.0
Signed-off-by: S. Brusch <ne20002@gmx.ch>
Maintainer: Kerma Gérald <gandalf@gk2.net>
Package tested: not able to test run due to limited space (package is big)
Description: update to latest version of upstream
(cherry picked from commit c08dac5ec5)
Modify Makefile to combine tailscale and tailscaled according to
Tailscale documentatio (https://tailscale.com/kb/1207/small-tailscale)
This resulted for x86_64 in an exec of 31MB + the symlink. Before it
was 29MB (tailscaled) and 10MB (tailscale).
Signed-off-by: Thomas Kupper <thomas.kupper@gmail.com>
(cherry picked from commit 7bef195bba)
b3b0cc8 version 0.2.2
85515cd roidmi: initial support for NEX2 Pro
62addc2 isort imports
8695649 README: update other govee to govee_ht
33f6ade ruuvitag: remove device class for counter
2099607 Rename key govee->govee_ht
12acacd codestyle updates
dbba43d ruuvitag: drop redundant import
84878e0 base: add and use HumidityTemperatureSensor
e9f0046 xiaomi_lywsd03_atc: make send_custom a class variable
2f4809a base: use lowercase for instance variable
5b1af17 govee: add manufacturer
7891691 ruuvitag: add manufacturer
cfd799b ruuvitag: remove inheritance from SubscribeAndSetDataMixin
7be28a1 codestyle updates
bffcf5e Add Govee H5074 temperature/humidity sensor support (#77)
Signed-off-by: Quintin Hill <stuff@quintin.me.uk>
(cherry picked from commit 268ed6d347)
Maintainer: @neheb
Compile tested: armv7, cortexA15, OpenWRT 23.05
Run tested: Linksys EA8500
Compile tested: armv8, cortexA53, OpenWRT main
Run tested: Dynalink DL-WRX36
Description:
Script-security is always 2 and cannot be changed from the openvpn config file due to a missing rule in openvpn.init.
This is discussed in issue #23014
This patch adds the missing rule in openvpn.init to parse script-security from the openvpn config file.
Signed-off-by: Erik Conijn <egc112@msn.com>
(cherry picked from commit 7b40d179bc)
The config.yml is an example of a tunnel local configuration.
But the cloudlfared treat it as a real config and fails to start.
So to avoid problems let's comment all the statements.
The `url: http://localhost:8000` is not a valid config option.
Additionally add a smale of configuring ingres rules.
The cloudflared.config has missing option token.
Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
(cherry picked from commit b3580a76d8)
[23.05] yggdrasil: overhaul package with netifd support
Compile tested: none, see below
Run tested: all package compiling and qa testing done in snapshots
Description: we must backport v0.5 into 23.05 because the breaking protocol situation with v.0.4. the counterpart package, luci-proto-yggdrasil is already in 23.05 feeds.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
The following fixes have been applied to Makefile:
* fix the nebula license type
* add PKG_CPE_ID
* remove unneeded call to Build/Compile
* add leading spaces to descriptions
* add Package/nebula/conffiles definition
* remove unneeded /lib/upgrade/keep.d files
* no longer install actual license file
* add the README file
Kudos to @BKPepe and @1715173329 for feedback which lead to these fixes
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit ae22bea8dd)
Dependency introduced by 21094e67cf
and
3c1fac9773
(And only for python versions below 3.12.)
Fixes: 64fa106 (python3-bleak: bump version to 0.21.1)
Signed-off-by: Quintin Hill <stuff@quintin.me.uk>
(cherry picked from commit fcb02c264b)
We need stable path to persist configurations and read log from LuCI.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 272cff0d1c)
Maintainer: @mkrkn @neheb
Compile tested: aarch64, cortex-a53, OpenWRT Master
Run tested: Dynalink DL-WRX36
Description:
[A previous commit](f8a8b71e26) has added more script event options.
However it looked like that commit was not complete as it stops the use of the script events route-up, route-pre-down, and ipchange when those are placed in the openvpn config file.
This PR fixes a regression that makes it problematic to specify certain event options in the OpenVPN configuration file.
Discussion in [this thread](https://forum.openwrt.org/t/openvpn-custom-route-up-script-in-23-05-rc2/167105/13) and [here](https://forum.openwrt.org/t/openvpn-route-up-and-route-pre-down-broken-in-23-05/176568)
Please have a look and consider implementing or make it possible to use all script event options in the openvpn config file in another way.
Pull request has been discussed and improved with the help of @AuthorReflex, see: https://github.com/openwrt/packages/pull/21732
Signed-off-by: Erik Conijn <egc112@msn.com>
(cherry picked from commit 7735cdfe60)
* somehow parts of the code of the init script got different between the
main branch and release branch, this PR fixes that.
Signed-off-by: Stan Grishin <stangri@melmac.ca>
New features for v1.8.0:
1. Migrate cache file from Clash API to independent options
2. Introducing Rule Set
3. Add `sing-box geoip`, `sing-box geosite` and `sing-box rule-set` commands
4. Allow nested logical rules
5. Independent `source_ip_is_private` and `ip_is_private` rules
6. Add context to JSON decode error message
7. Reject internal fake-ip queries
8. Add GSO support for TUN and WireGuard system interface
9. The legacy LWIP stack has been deprecated and removed
10. Add `idle_timeout` for URLTest outbound
11. Added some new uTLS fingerprints
...
Release notes: https://github.com/SagerNet/sing-box/releases/tag/v1.8.0
The new version has some breaking changes and may stop working after upgrading if use the original config.
Please see the migration manual to migrate the config: https://sing-box.sagernet.org/migration/
Signed-off-by: Anya Lin <hukk1996@gmail.com>
(cherry picked from commit 8fe2f68485)
Users might configure their own env variables on the host, and sometimes
it can lead build failure or unexpected behavior.
Fixes: #22889
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 9f01010958)
0cffba9458d3 treewide: add support for RADIUS Reply-Message
c9fb744fdee8 treewide: add support for 'lang=' & ChilliSpot-Lang
584a162cb19a handler-uam: ensure that 'seconds_remaining' is always set
bd1f7c5de1ae Makefile: align with packages feed one
0ea6ad3c4e54 Makefile: mark uspot-www and uspotfilter "PKGARCH:=all"
e6a286ccfdbf uspot/uspotfilter: use 'logger -t'
427ed16cfde5 uspot: expose ratelimits in client data
4ba1dd9c5135 uspot: don't send NAS-Port-Type
78a37ef49b85 templates: add id="replymsg" to reply msg header
e3f4e179fd17 templates: show remaining time in "connected"
398762dff711 radius-client: correctly use str_to_hex()
730ef800d9da templates: simplify HTML
6bb39282fd8f Documentation update
b6c802adac19 portal: handle_request() logic refactoring
1aa1a5eb28d7 uspotfilter: implement peer_lookup()
ba5547ec61f1 portal: speedup peer lookup by leveraging spotfilter
d551376c29bb templates: added html5 time tag to timeleft output
154c98e0b77b uspotfilter: mark client as active when set()
8dcb03a37a77 uspotfilter: rework neigh management
cfb2ce7909da uspotfilter: use client_remove() where applicable
8411314dbf90 Documentation update
8dacf3df9935 uspot: use a single operation for client removal
297b7857c1e0 uspotfilter: fix DELNEIGH processing
76003917c205 uspotfilter: client_set() only clear idle when allowing
f46a855c5085 uspotfilter: remove botched IPv6 "support"
4ff31cbf0e2b uspot: client_remove(): stay in sync with spotfilter
edc9ad7e60a3 uspot/uspotfilter: use ucode-mod-log for logging
52e24aecf2db uspotfilter: use ucode '??=' syntax
c4b6f2f0bb1e Update README
Update the package Makefile to reflect the changes from the following
above-listed commits:
0ea6ad3c4e54 Makefile: mark uspot-www and uspotfilter "PKGARCH:=all"
edc9ad7e60a3 uspot/uspotfilter: use ucode-mod-log for logging
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
(cherry picked from commit ab20c1bd90)
* fix a possible re-connection issue/cornercase seen on single radio units
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 4518ecf60b)
* the pause command used to incorrectly cause block-lists reload, this
has been fixed in this version
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit dfeeabbebf)
* made the default mail template "responsive" to get a better view esp. on mobile devices
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 6c9cd77596)
* fix a station scanning issue on single radio units (mainly a LuCI/JS issue) reported in the forum by multiple users
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit ce20f8d88b)
- package is bumped to 0.5.2
- new protocol changes prevent peering with 0.4.x peers
- @turretkeeper revamps package with netifd support
- do not use with luci-app-yggdrasil please install luci-proto-yggdrasil
Signed-off-by: William Fleurant <meshnet@protonmail.com>
(cherry picked from commit 99c7c36ce1)
Fixes#20848
Add interface triggers if interfaces to listen to are specified in
`/etc/config/ipsec`. This fixes the "running with no instances" scenario
after rebooting a router.
Signed-off-by: Joel Low <joel@joelsplace.sg>
(cherry picked from commit f2d209e4ff)
* rework the device/interface auto-detection (only layer-3 network devices will be detetcted correctly), disable the auto-detection e.g. for special tunnel interfaces
* supports now full gawk (preferred, if installed) and busybox awk
* raise the default boot timeout to 20 seconds (if 'ban_triggerdelay' is not set)
* various small fixes and improvements
* readme update
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 5af101564a)
* provides an option to transfer log events on remote servers via cgi interface (disabled by default), see readme for details
* refine the allowlist check to support IP intervals as well before adding an IP to the blocklist
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit df81585cea)
Recent version of WolfSSL dropped CyaSSL shims and made the package not
compilable. Converting it to the WolfSSL library is simple enough as the
API used are very basic and can be converted directly. Add patch that
fully convert the package to WolfSSL and doesn't use the compat shim
anymore.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit b38e3cd257)
* move reload/restart logic from json() to config_cache()
* improve fw4 restart decision logic
* no longer store reload/restart info in ubus/status json file
* rename variables pointing to run-time information
* create dns_set_output_values to reuse code in principal all and luci app
* improve append_url to store collected URLs in an alternative variable
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit bab17f480c)
The function `create_host_record_from_host` fails if the `dns` option
is not set in the host entry.
This sets a default to the `dns` variable in order to fix this error.
Fixes: #22691
Signed-off-by: Julien Cassette <julien.cassette@gmail.com>
(cherry picked from commit 8d60419251)
The "Extra DNS" option allows to create records from the DHCP
"Hostnames" configuration entries.
This allows to create such records from the DHCP "Static leases"
configuration entries too.
Fixes: #22593
Signed-off-by: Julien Cassette <julien.cassette@gmail.com>
(cherry picked from commit b4a31f92de)
Includes fix for CVE-2023-39326 (net/http: limit chunked data overhead).
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit b8254cdac4)
* improve allow-listing reliability by running sed from the script-file
instead of the command-line
* fix user for smartdns files ownership
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 693287e961)
* remove empty lines from the combined list to allo optimization code
to work properly
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 1914114ed3)
Switched back to tar.gz archive to avoid potential permission issue.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 255e244980)
41.0.6 included a fix for CVE-2023-49083 (loading certificates from a
PKCS#7 bundle could lead to a null-pointer-dereference and segfault).
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 5f829ad162)
This also adds a CPE ID for the package and updates the test.sh script
to use an assert.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit c4a223ed87)
* do not use standalone grep-package dependent syntax to get the remote
file size
* various bugfixes to prevent attempts to change/commit if dnsmasq/smartdns
are not installed
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 496d9b71ab)
This package was intended to provide the experimental multithreading
support for iperf3. With the update to 3.16, multithreading is available
in mainline iperf3. Thus, remove this package.
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
(cherry picked from 4fb1bdc86c)
* bugfix: correct URL to config-update file
* bugfix: check if uci configs exist before chacking for changes
* add support for smartdns ipset-based blocking
* add support for smartfns nftset-based blocking
* disallow non-ascii symbols for smartdns blocking
* add check wherever fw4 restart is needed before calling
procd_set_config_changed firewall
* improve clean-up code in resolver()
* improve case code for different resolver settings
* modify load_validate_config to allow smartdns.ipset and smartdns.nftset
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 28cd5ecf6e)
uspot is an OpenWrt-native captive portal system.
It leverages existing OpenWrt tools such as uhttpd, dnsmasq, firewall4,
ucode, without needing any external kernel module.
It can achieve the maximum performance allowed by nftables (flow
offloading works).
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
(cherry picked from commit e6e8e58ae0)
Fix the problem that cannot create new task after clearing checksum option
Other bug fix and user interface optimization
Support overriding aria2 global settings with empty content when create new download task (#712)
Other bug fix and user interface optimization
Update Traditional Chinese translation (#705, thx @ChiaYen-Kan)
Other bug fix and user interface optimization
Add check-integrity to task settings tab (#693, thx @raytrap)
Fix a spelling mistake (#696, thx @rusq)
fix due to the index.html (1.3.6) cite these 2 png files. To keep the page looks fine without 404, added these 2 png files.
Signed-off-by: Ariel Xiong <ArielHeleneto@outlook.com>
(cherry picked from commit 904438be39)
Changelog:
- update trust-dns to hickory
- never report an error when the syslog init fails
- dependency updates
Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit 88ed83a55b)
Changes:
- add firewalld-reload subcommand
- bridge: force static mac on bridge interface
- dependency updates
- numerous fixes to test suite
Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit aa3abde67e)
Changelog: https://github.com/containers/podman/releases
I also updated containers.conf - it has gotten quite a many new
options. I added crun to depends, every other distribution
seems to ship it with podman, and after all it is a default
OCI Container Runtime for podman anyway and has a super low
footprint, so shouldn't be a problem for anyone running
containers, after all you need some storage for that anyway.
Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit 9ab2b8a04d)
Commit 18d3c529fa caused CI_HELPER to be
set to "''" (two single quotes), leading to an error when test.sh tries
to source $CI_HELPER.
CI_HELPER is not set anywhere else and not passed into the container
environment, so there is no need to test if it has a value.
This fixes the value of CI_HELPER.
Fixes: 18d3c529fa ("github-ci: error on any shell errors")
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 562f5df67f)
Notable Changes
* npm updated to v10
* ESM and customization hook changes
* New node:module API register for module customization hooks; new initialize hook
* import.meta.resolve unflagged
* --experimental-default-type flag to flip module defaults
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
After the change from PCRE to PCRE2 when enabling POSTFIX_PCRE the
resulting postfix build no longer reports pcre as an available module.
(postfconf -m). This is caused by using the wrong syntax for the
HAS_PCRE build flag (HAS_PCRE2 vs HAS_PCRE=2). This fixes the build flag
to use the correct syntax.
Signed-off-by: Felix Matouschek <felix@matouschek.org>
cni-protocol can be used for both cni and netavark
and also for many other things, such as vpn's that
lack customized protocol supports for openwrt as a
general externally managed protocol, so it was due
to rename it.
I also added one extra option, search domain, which
is optional and updated scripts retrieving ip address
and routing information.
Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit a0d7e40494)
* fix: accidently upload a faulty urlhaus feed regex in the former commit
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit e7979d6b04)
* fix boot()
* reintroduce procd_boot_delay variable to control delay of service
start on boot
* introduce `check_lists` command to check enabled block-lists for
domain(s)
* use config_get_bool instead of config_get for boolean options
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 96ad0ab6fd)
Update crowdsec to latest upstream release version 1.5.5
Signed-off-by: S. Brusch <ne20002@gmx.ch>
Maintainer: Kerma Gérald <gandalf@gk2.net>
Package tested. not able to test run due to limited space (package is big)
Description: update to latest version of upstream
(cherry picked from commit 6ff496d113)
Replace the PYTHON3_PYMYSQL_SHA_PASSWORD_SUPPORT option, which is
causing circular dependencies, with a meta-package that installs both
python3-pymysql and python3-cryptography.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 79b173a0c5)
If pcre is built before freeradius, then freeradius' configure will
detect pcre and freeradius will be built with pcre functionality
enabled. This causes a "missing dependencies" error at the end of
package build.
This passes --without-pcre to configure to disable this autodetection.
This also removes the dependency on libpcre2 as freeradius v3 does not
have support for pcre2.
Fixes: 19ec30255f ("freeradius3: switch to pcre2")
Fixes: https://github.com/openwrt/packages/issues/22574
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 92aadf7e4a)
Includes fixes for CVE-2023-45283 and CVE-2023-45284 (path/filepath:
insecure parsing of Windows paths).
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 0ebc715981)
* ensure downloaded block-lists end with newline
* turn free/total RAM checks into functions calls
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 3787b41355)
* support backup/restore for remote allowlists
* report the used log variant in status message
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 2411bcffaf)
* the log file monitor now supports standard log files used by other log daemons like syslog-ng
Set 'ban_logreadfile' accordingly, by default it points to /var/log/messages
* removed logd dependency, closes#21932
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit c4e8140740)
* update Makefile copyright info
* organize functions shared between the init script, uci-defaults and
luci app in alphabetical order
* update error, warning and status messaging
* use single quotes instead double quotes for static text labels
* better warning for missing recommended packages
* rename dns function to resolver to better reflect its purpose
* improve resolver cleanup code
* move _resolver_config function inside resolver function to improve code readlibity
* rename _process_file_url to process_file_url_wrapper to better reflect its purpose
* add preflight check for available RAM vs total size of block lists
* move _config_add_url_size function inside adb_sizes function to improve code readlibity
* remove uci validation from status_service function to improve performance
* source init script from uci-defaults to include shared functions
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 11df396a18)
The initial fix was done in a2e76e497.
Later we could revert it with 5779ae4c5 since a global fix
in gcc was deployed.
But now, PHP itself applied a workaround/fix in 8.2.8,
so that we now require the initial fix again.
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 43b10ad9c1)
* added ujail for crowdsec-firewall-bouncer
* set nice to reduce priority for process
Signed-off-by: S. Brusch <ne20002@gmx.ch>
Maintainer: Kerma Gérald <gandalf@gk2.net>
Run tested: mediatek/filogic, BPI-R3, Openwrt 23.05.0
(cherry picked from commit a8df73ce72)
This adds a multithreaded variant of iperf3 as a package. This variant
is still experimental, developed in the mt branch of the iperf
repository and expected to be merged when it is considered stable.
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
(cherry picked from commit f369a2aaa9)
1. Add new options:
--http3 Enable HTTP/3 support (H3 first)
--timeout Timeout for outbound DNS queries to remote upstream servers in a human-readable form (default: 10s)
2. Allows listen on multiple interfaces and ports
Signed-off-by: Anya Lin <hukk1996@gmail.com>
(cherry picked from commit 47b4ebc5cb)
Backport patch merged upstream for PCRE2 support and move package to
pcre2.
Also add an additional patch pending to fix linking both pcre and pcre2
if autotools detect both library. (aircrack-ng prefer pcre2 in presence
of both)
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit cb1f7c7ee4)
Bump aircrack-ng to release 1.7
Changelog from [1]
Airdecap-ng: Endianness fixes
Airdecap-ng: Output PCAP as little endian
Airodump-ng: Fixed blank encryption field when APs have TKIP (and/or CCMP) with WPA2
Airodump-ng: Updated encryption filter (-t/--encrypt) for WPA3 and OWE
Airodump-ng: Fixed out-of-order timestamp captures
Airodump-ng: Ignore NULL PMKID
Airodump-ng: Fixed dropping management frames with zeroed timestamp
Airodump-ng: Fixed sorting where sometimes it started with a different field
Airodump-ng: Allow setting colors only in AP selection mode
Airodump-ng: Fix crash on 4K Linux console
Airodump-ng: Fixed issue where existing clients not linked to an AP become hidden when hitting 'o'
Airodump-ng: Allow use of WiFi 6E 6GHz frequencies
Airodump-ng: Look for oui.txt in /usr/share/hwdata
Airgraph-ng: Fixed graphviz package conflict
Airgraph-ng: Fixed downloading OUI with python3
Airgraph-ng: Ensure support/ directory is created when installing
Aircrack-ng: Fixed static compilation
Aircrack-ng: Fix handshake replay counter logic
Aircrack-ng: Handle timeout when parsing EAPOL
Aircrack-ng: Fixed WEP display
Aircrack-ng: Fixed spurious EXIT messages
Aircrack-ng: Improved handshake selection by fixing EAPOL timing and clearing state
Aircrack-ng: Ignore NULL PMKID
Aircrack-ng: Added Apple M1 detection
Aireplay-ng: In test mode, detect tampering of sequence number by firmware/driver
Aireplay-ng: Fixed incorrectly rewritten loops affecting fragmentation attack, and in some cases, SKA fake auth
Aireplay-ng: Fixed a bunch of instances where packets had their duration updated instead of the sequence number
Airmon-ng: Fix avahi killing
Airmon-ng: rewrite service stopping entirely
Airmon-ng: Codestyle fixes and code cleanup
Airmon-ng: Added a few Raspberry Pi hardware revisions
Airmon-ng: Fixes for 8812au driver
Airmon-ng: Fix iwlwifi firmware formatting
Airmon-ng: Remove broken KVM detection
Airmon-ng: Show regdomain in verbose mode
Airmon-ng: Updated Raspberry Pi hardware revisions
Airmon-ng: Document frequency usage
Airmon-ng: Add a sleep to help predictable names due to udev sometimes renaming interface
Airmon-ng: Added warning for broken radiotap headers in kernel 5.15 to 5.15.4
Airmon-ng: shellcheck fixes
Airmon-ng: support systemctl as some systems don't support 'service' anymore
Airmon-ng: Fixes for pciutils 3.8, backward compatible
Airbase-ng: use enum for frame type/subtype
Airbase-ng: remove a few IE in association responses
Besside-ng: Support and detect all channels in 5GHz in Auto-Channel mode
OSdep: Search additional IE for channel information
OSdep: Android macro fixes
Patches: Add missing patches that were on https://patches.aircrack-ng.org but not in repo
Patches: Updated freeradius-wpe patch for v3.2.0
Patches: Updated hostapd-wpe patch for v2.10
Patches: Added docker containers to test WPE patches
Autotools: make dist now creates VERSION file
Autotools: Added maintainer mode
Autotools: Initial support for Link Time Optimization (LTO) builds
Integration tests: Added a new test, and improved some existing ones
Airgraph-ng: switch airodump-join to Python 3
Manpages: Fixes (typos, tools name, etc.) and improvements
README: Updated dependencies and their installation on various distros in README.md and INSTALLING
README: Fixed typos and spelling in README.md and INSTALLING
Packages: Packages on PackageCloud now support any distro using .deb and .rpm, however, it requires reinstalling repo (BREAKING CHANGE)
General: Fix compilation with LibreSSL 3.5
General: Fix issues reported by Infer
General: Updated buildbots
General: Add Linux uclibc support
General: Compilation fixes on macOS with the Apple M1 CPU
General: Removed TravisCI and AppVeyor
General: Use Github Actions for CI (Linux, Win, macOS, code style, and PVS-Studio)
General: Added vscode devcontainer and documentation
General: Fix warnings from PVS-Studio and build with pedantic (See PR2174)
General: Shell script fixes thanks to shellcheck
General: Fixes for GCC 10 and 11
General: Fixed cross-compilation
General: Code refactoring, deduplication, cleanup, and misc code improvements
General: Coverity Scan fixes, which includes memory leaks, race conditions, division by 0, and other issues
General: PVS Studio improvements,fixes and updates
General: Code formatting/style fixes
General: Various fixes and improvements (code, CI, integration tests, coverity)
General: Update bug reporting template and update the process
[1] https://aircrack-ng.blogspot.com/2022/05/aircrack-ng-17.html
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 41922f33b5)
4.0.36 included a change to decimal parsing[1] that requires the decimal
module. Trying to load the pyodbc module without python3-decimal
installed would lead to a segmentation fault.
This adds python3-decimal as a dependency.
This also adds python3-uuid as a dependency as the module can accept and
return uuid objects[2].
[1]: 6b107a2bca
[2]: 2ad7a9ced7
Fixes: f02f3ee8c7 ("pyodbc: Update to 4.0.39")
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 668a0f9dd8)
changes:
- fixes a bug where science notations (exponentials) are displayed during tests during high speed bursts
Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit 58d8f92721)
Bump to release 4.8 to make it easier to backport PCRE2 support patch.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 97a7165e72)
Move to PCRE2 as PCRE is EOL and won't receive any more security update
anymore.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit f25f4d395d)
setuptools provides a local copy of distutils and when building a C
extension, this distutils will add the target LIBDIR (/usr/lib) to the
list of library paths.
If the build system has a libpython3.11.so in /usr/lib, then the linker
will try to link to this shared library and fail.
This adapts 008-distutils-use-python-sysroot.patch for host setuptools
to add the correct library directory.
Fixes: https://github.com/openwrt/packages/issues/22330
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 624fb95561)
Currently aircrack-ng try to link with libbsd if it does detect the
library in staging_dir. This is the case with buildbot where every
package is selected and compiled.
Fix this by adding a pending patch that permits to disable libbsd
inclusion even if detected and set the related config flag.
aircrack-ng use 2 function of libbsd and it's not worth to include the
entire library for 2 simple function for string manipulation.
Also add an additional patch that permits to use musl or glibc version
of these string functions.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit bd21652b79)
Move to PCRE2 library as PCRE is not EOL and won't receive any security
updates anymore.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 3dfb00c6c6)
Move to PCRE2 library as PCRE is EOL and won't receive any security
updates anymore.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit f585559690)
Bump postfix to 3.8.2 release.
Refresh patches and drop patch 502-detect-glibc.patch as it got merged
upstream.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 4b7d365b86)
Update to release 2.2 and switch to PCRE2. New release switched from
PCRE to PCRE2 and is now required.
Drop patch merged upstream and backport 2 additional patch that fix a
user-after-free and a PCRE2 bug.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 13982c13d0)
Drop support for PCRE as it's now EOL and won't receive any security
updates anymore.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 9ea2ec7cd1)
Gettext is a prerequisite to build OpenWrt according to:
https://openwrt.org/docs/guide-developer/toolchain/install-buildsystem
but github automated tests fail without this explicit dependency:
2023-06-19T08:02:45.1940511Z checking for py module gzip ... ok
2023-06-19T08:02:45.1968662Z checking for /builder/staging_dir/host/bin/pkg-config ...ok
2023-06-19T08:02:45.1998491Z ERROR: no gettext binaries found
2023-06-19T08:02:45.1999746Z checking for xgettext ... fail
2023-06-19T08:02:45.2008403Z make[2]: *** [Makefile:263: /builder/build_dir/target-arm_cortex-a9+vfpv3-d16_musl_eabi/tvheadend-2023-06-05/.configured_a17fb5ef857664f03cd0ce37cc5ea591] Error 1
Signed-off-by: Marius Dinu <m95d+git@psihoexpert.ro>
(cherry picked from commit fb68d07bfa)
Update to git master 2023-06-05 and removed unneeded compatibility patch.
Signed-off-by: Marius Dinu <m95d+git@psihoexpert.ro>
(cherry picked from commit dedf51702e)
use libpcre2 as dependency for freeradius3-common
because PCRE is EOL with no further updates
Compile & run tested on mediatek mt76 ubnt-ui6-lr-v1 with musl
Signed-off-by: Martin Strobel <arctus@crza.de>
(cherry picked from commit 19ec30255f)
Currently, rust fails to build for mipsel_24kc+24kf with "opcode not
supported on this processor: mips1 (mips1)" errors when building
libunwind.
Because mipsel_24kc+24kf is hard-float, a certain section of
src/llvm-project/libunwind/src/UnwindRegistersRestore.S is selected to
be compiled; the instructions in this section require MIPS II.
mipsel_24kc+24kf is compiled for MIPS32 Release 2 (MIPS32 is based on
MIPS II), but the C flags used to select this architecture were not
passed to the rust bootstrap (to be passed back to gcc).
This passes the C flags to rust bootstrap to fix this compile error.
This also adds PKG_BUILD_FLAGS:=no-mips16 as attempting to generate
MIPS16 code leads to a different compile error.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 54616e7049)
The rust bootstrap downloads files into a "tmp" directory then moves the
files into the "cache" directory using std::fs::rename. There are no
issues in the original/unpatched case as "tmp" and "cache" are
subdirectories in the build directory ($(HOST_BUILD_DIR)/build) and so
are nearly guaranteed to be on the same filesystem.
35768bf31e changed where files are
saved/cached (in $(DL_DIR)/rustc). If HOST_BUILD_DIR and DL_DIR are on
separate filesystems, then using std::fs::rename to move the files will
fail.[1]
This updates 0002-rustc-bootstrap-cache.patch to account for this case,
i.e. if std::fs::rename fails, fall back to copying the file then
removing the original.
[1]: https://github.com/openwrt/packages/pull/22457
Fixes: 35768bf31e ("rust: Cache bootstrap downloads to $(DL_DIR)/rustc")
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit f9f1e0220f)
* various vpn/wireguard improvements & fixes
* improved compatibility with new netifd
* added open STA improvements by @brianjmurrell
* closes#22227#22288#22357
Signed-off-by: Dirk Brenken dev@brenken.org
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 81658c5823)
* update to 2023-10-25 upstream version which fixes the crashes on logging on ath79
* remove no longer needed 030-src-logging.c-fix-crash.patch
* update 010-cmakelists-remove-cflags.patch to work with a new version
* update 020-src-options.c-add-version.patch to work with a new version
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 6b92b6c6d2)
* add new package to allow building of curl with HTTP/3 support
* switch to using cmake
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit f6e5797640)
* add new package to allow building of curl with HTTP/3 support
* switch to using cmake
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit b1d4241cdf)
If a firmware build with curl without mbedtls, install transmission from openwrt official repo will fail to start
Signed-off-by: Liangbin Lian <jjm2473@gmail.com>
(cherry picked from commit 2311e79218)
Fixes vulnerabilities:
- Improper Neutralization of Special Elements (CVE-2023-42117)
- dnsdb Out-Of-Bounds Read (CVE-2023-42119)
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 86ec7b19bc)
Cryptsetup 2.6.1 Release Notes
==============================
Stable bug-fix release with minor extensions.
All users of cryptsetup 2.6.0 should upgrade to this version.
Changes since version 2.6.0
~~~~~~~~~~~~~~~~~~~~~~~~~~~
* bitlk: Fixes for BitLocker-compatible on-disk metadata parser
(found by new cryptsetup OSS-Fuzz fuzzers).
- Fix a possible memory leak if the metadata contains more than
one description field.
- Harden parsing of metadata entries for key and description entries.
- Fix broken metadata parsing that can cause a crash or out of memory.
* Fix possible iteration overflow in OpenSSL2 PBKDF2 crypto backend.
OpenSSL2 uses a signed integer for PBKDF2 iteration count.
As cryptsetup uses an unsigned value, this can lead to overflow and
a decrease in the actual iteration count.
This situation can happen only if the user specifies
--pbkdf-force-iterations option.
OpenSSL3 (and other supported crypto backends) are not affected.
* Fix compilation for new ISO C standards (gcc with -std=c11 and higher).
* fvault2: Fix compilation with very old uuid.h.
* verity: Fix possible hash offset setting overflow.
* bitlk: Fix use of startup BEK key on big-endian platforms.
* Fix compilation with latest musl library.
Recent musl no longer implements lseek64() in some configurations.
Use lseek() as 64-bit offset is mandatory for cryptsetup.
* Do not initiate encryption (reencryption command) when the header and
data devices are the same.
If data device reduction is not requsted, this leads to data corruption
since LUKS metadata was written over the data device.
* Fix possible memory leak if crypt_load() fails.
* Always use passphrases with a minimal 8 chars length for benchmarking.
Some enterprise distributions decided to set an unconditional check
for PBKDF2 password length when running in FIPS mode.
This questionable change led to unexpected failures during LUKS format
and keyslot operations, where short passwords were used for
benchmarking PBKDF2 speed.
PBKDF2 benchmark calculations should not be affected by this change.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 5c21b26a93)
Remove downstream patch 004-missing-includes.patch which was merged
upstream in version 2.03.19
LVM2 changelog since version 2.03.17
version 2.03.22 - 02nd August 2023
==================================
Fix pv_major/pv_minor report field types so they are integers, not strings.
Add lvmdevices --delnotfound to delete entries for missing devices.
Always use cachepool name for metadata backup LV for lvconvert --repair.
Make metadata backup LVs read-only after pool's lvconvert --repair.
Improve VDO and Thin support with lvmlockd.
Handle 'lvextend --usepolicies' for pools for all activation variants.
Fix memleak in vgchange autoactivation setup.
Update py-compile building script.
Support conversion from thick to fully provisioned thin LV.
Cache/Thin-pool can use error and zero volumes for testing.
Individual thin volume can be cached, but cannot take snapshot.
Better internal support for handling error and zero target (for testing).
Resize COW above trimmed maximal size is does not return error.
Support parsing of vdo geometry format version 4.
Add lvm.conf thin_restore and cache_restore settings.
Handle multiple mounts while resizing volume with a FS.
Handle leading/trailing spaces in sys_wwid and sys_serial used by deivce_id.
Enhance lvm_import_vdo and use snapshot when converting VDO volume.
Fix parsing of VDO metadata.
Fix failing -S|--select for non-reporting cmds if using LV info/status fields.
Allow snapshots of raid+integrity LV.
Fix multisegment RAID1 allocator to prevent using single disk for more legs.
version 2.03.21 - 21st April 2023
=================================
Fix activation of vdo-pool for with 0 length headers (converted pools).
Avoid printing internal init messages when creation integration devices.
Allow (write)cache over raid+integrity LV.
version 2.03.20 - 21st March 2023
=================================
Fix segfault if using -S|--select with log/report_command_log=1 setting.
Configure now fails when requested lvmlockd dependencies are missing.
Add some configure Gentoo enhancements for static builds.
version 2.03.19 - 21st February 2023
====================================
Configure supports --with-systemd-run executed from udev rules.
Enhancement for build with MuslC systemd and non-bash system shells (dash).
Do not reset SYSTEMD_READY variable in udev for PVs on MD and loop devices.
Ensure udev is processing origin LV before its thick snapshots LVs.
Fix and improve runtime memory size detection for VDO volumes.
version 2.03.18 - 22nd December 2022
====================================
Fix issues reported by coverity scan.
Fix warning for thin pool overprovisioning on lvextend (2.03.17).
Add support for writecache metadata_only and pause_writeback settings.
Fix missing error messages in lvmdbusd.
DM changelog since version 1.02.187:
Version 1.02.196 - 02nd August 2023
===================================
Version 1.02.195 - 21st April 2023
==================================
Version 1.02.193 - 21st March 2023
==================================
Version 1.02.191 - 21st February 2023
=====================================
Improve parallel creation of /dev/mapper/control device node.
Import previous ID_FS_* udev records in 13-dm-disk.rules for suspended DM dev.
Remove NAME="mapper/control" rule from 10-dm.rules to avoid udev warnings.
Version 1.02.189 - 22nd December 2022
=====================================
Improve 'dmsetup create' without given table line with new kernels.
(Version 1.02.188 is missing)
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 4db53132ba)
* update service triggers so that procd_add_raw_trigger is only
executed on boot and not on other service actions
* remove outdated iface hotplug script
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 5dd08fe23f)
procd requires init script name, not the path to executable
Signed-off-by: ValdikSS ValdikSS <iam@valdikss.org.ru>
(cherry picked from commit af58942738)
Refreshed 001-disable-extra-stressors.patch
Dropped 002-disable-compiler-test.patch
- no longer needed since commit a24c7f2048
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit f4df9c1786)
Merged patches into a single one.
Disabling libmpfr (which got added recently).
To avoid potentially new build failures.
And disabling test-compiler check.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 8168fc84df)
Convert package to PCRE2 by porting a pending patch from a closed PR.
The PR is old but the code never changed and is simple enough to check
the changes. The patch apply directly with no changes (aside from
commenting out the travis CI file)
The PR was never merged as PCRE2 at times was too new and they were
trying to find a better regex lib.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit db305165c9)
This package is not maintained anymore in the OpenWrt packages feed
and since we updated Go to 1.21 version, it is not compiled either.
Let's hope that with removing this package from our feed,
someone will step it and become a maintainer to take care of this package.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 5a917a2a1c)
* fix sed to properly purge allowed domains from block-lists
* ensure resolver is restarted on allow command
* reduce pause default/max in attempt to make it work with luci
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 42cc50eec8)
Patch the target triple for Rust with glibc to include hard floating
point support.
The GNU target triple used elsewhere does not include hard float support,
instead `-mfloat-abi=hard` is passed separately. For Rust it must be
included in the target triple. This was already being done for musl,
this commit adds the same patching for glibc.
Without this patch Rust compilation fails with an error like this
(abbreviated to fit the line length):
ld: error: libstd.so uses VFP register arguments, ... does not
ld: failed to merge target specific data of file ...
Signed-off-by: Drew Young <dyoung@viridiparente.com>
(cherry picked from commit 3d799c3eee)
This is a security release.
Notable Changes
The following CVEs are fixed in this release:
* CVE-2023-44487: nghttp2 Security Release (High) (Depends on shared library provided by OpenWrt)
* CVE-2023-45143: undici Security Release (High)
* CVE-2023-38552: Integrity checks according to policies can be circumvented (Medium)
* CVE-2023-39333: Code injection via WebAssembly export names (Low)
More detailed information on each of the vulnerabilities can be found in October 2023 Security Releases blog post.
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry picked from commit 9101a21e53)
The samples in the repo are useful for configuring cenrtain aspects of
ddns, and their inclusion is hinted at within their source code
Signed-off-by: Julian Grinblat <julian@dotcore.co.il>
(cherry picked from commit 565fda4105)
`dnsdist-full` has all optional features enabled, but is a big package
in term of both flash and memory footprint.
`dnsdist` only keeps the features that make the most sense
on embeded devices, but can also be customised to match the
user's needs, up to the point where it matches `dnsdist-full`.
Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
(cherry picked from commit ca01c1bf59)
The only package using this library, dnsdist, does not require it
so let's save space and PSS memory.
Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
(cherry picked from commit 23a9cd519c)
In preparation to PCRE2 fixup, use autoreconf PKG_FIXUP as a better
configure system instead of configure script. This is needed to reduce
upcoming patch to migrate to PCRE2 library.
To correctly use autoreconf it's needed to declare empty
PKG_REMOVE_FILES.
zsh include custom macro in the default aclocal.m4
When autoreconf PKG_FIXUP is used, if PKG_REMOVE_FILES is not defined,
it's set to remove the file aclocal.m4 by default resulting in problem
with the custom macro AC_PROG_LN.
Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
[ split to 2 commit, add PKG_REMOVE_FILES, reword commit description ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit a7f837c98b)
Backport PCRE2 patches from upstream and move package to PCRE2 library
as PCRE is EOL and won't receive any security update anymore.
Patch are backported with minimal change, only the Changelog change is
commented out as it would conflict and makes no sense to adapt for the
purpose of backport patches.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 5b929fde5f)
Includes fix for CVE-2023-39325 (net/http, x/net/http2: rapid stream
resets can cause excessive work).
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit f151ab8c0e)
Notable Changes
This release addresses some regressions that appeared in Node.js 18.18.0:
(Windows) FS can not handle certain characters in file name #48673
18 and 20 node images give error - Text file busy (after re-build images) nodejs/docker-node#1968
libuv update in 18.18.0 breaks webpack's thread-loader #49911
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry picked from commit b2079b87d1)
Changes to protocol file and it's description.
Works better now and restarts firewall automaticly
when tunnel comes available. More informative/guiding
description.
Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit ff93e4a19d)
Bugfixes
- Fixed a bug involving non-English locales of Windows where machine installs using user-mode networking were rejected due to erroneous version detection (#20209).
- Fixed a regression in --env-file handling (#19565).
- Fixed a bug where podman inspect would fail when stat'ing a device failed.
API
- The network list compat API endpoint is now much faster (#20035).
Openwrt updates: added patch to allow building with musl-1.2.4
Patch source is from gentoo c4c349f11a/app-containers/podman/files/podman-4.5.0-fix-build-with-musl-1.2.4.patch
Issue was discussed by @jefferyto at mattn/go-sqlite3#1177
remarks:
removed musl-1.2.4 patch from commit, since that version of musl
is not available with openwrt-23.05
Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit e25d417f1a)
changelog:
- iptables: improve error when ip6?tables commands are missing
- docs: Convert markdown with go-md2man instead of mandown
- iptables: drop invalid packages
- bump rust edition to 2021
- Add ACCEPT rules in firewall for bridge network with internal dns
- Add vrf support for bridges
Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit b788f77db4)
v1.2.2 changes:
- Enabled reproducible builds
v1.2.1 changes:
- sandbox: Add support for escaping resolv.conf symlinks. This fixes usage in WSL environments which symlinks /etc/resolv.conf under a shared location under /mnt.
Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit 8b3bf5bb88)
changelog 1.9.2:
- cgroup: reset the inherited cpu affinity after moving to cgroup. Old kernels do that automatically, but new kernels remember the affinity that was set before the cgroup move, so we need to reset it in order to honor the cpuset configuration.
changelog 1.9.1:
- utils: ignore ENOTSUP when chmod a symlink. It fixes a problem on Linux 6.6 that always refuses chmod on a symlink.
- build: fix build on CentOS 7
- linux: add new fallback when mount fails with EBUSY, so that there is not an additional tmpfs mount if not needed.
- utils: improve error message when a directory cannot be created as a component of the path is already existing as a non directory.
Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit bb3af8acb9)
This adds a patch (submitted upstream in
https://github.com/PyO3/setuptools-rust/pull/364), to read the profile
to pass to cargo from an environment variable.
This also updates the Python include files to set the environment
variable based on values from rust-values.mk.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 29ca9797a6)
Using sccache makes recompilation of rustc and Rust packages faster.
This also makes the rust package visible in menuconfig, in order for the
sccache options to be accessible.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit b4ec017398)
This allows cargo to use make's jobserver when building packages, by
marking the cargo command as recursive (with the + prefix[1]) and
setting MAKEFLAGS.
This also:
* Give cargo/x.py the build directory instead of having to change the
current directory (and opening subshells)
* Set PKG_BUILD_PARALLEL/HOST_BUILD_PARALLEL for Rust packages to enable
the use of make's jobserver
[1]: https://www.gnu.org/software/make/manual/html_node/POSIX-Jobserver.html
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 0dfc1b508d)
[omit changes to arp-whisper and procs]
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
This consolidates all environment variables for cargo into:
* CARGO_HOST_CONFIG_VARS / CARGO_PKG_CONFIG_VARS
These contain all cargo-specific environment variables, i.e. without
"common" variables like CC.
* CARGO_HOST_VARS / CARGO_PKG_VARS (renamed from CARGO_VARS)
These contain all environment variables to be passed to cargo.
This also:
* Set the CARGO_BUILD_TARGET environment variable instead of using the
--target command-line option
* Update Python include files to use CARGO_HOST_CONFIG_VARS /
CARGO_PKG_CONFIG_VARS
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 9db7284d58)
As CARGO_HOME mainly functions as a download and source cache[1], moving
it into $(DL_DIR) allows it to persist and be reused between different
buildroots/sdks (when DL_DIR is set to a custom/external location).
[1]: https://doc.rust-lang.org/cargo/guide/cargo-home.html
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 853c9c9e86)
This also:
* Modify the "release" profile in place of adding the "stripped" profile
Only the profile for target is modified; there are no file size
constraints for host.
* For host, build with the "release" profile
* For target, build with either the "dev" or "release" profile based on
CONFIG_DEBUG
There is no environment variable to specify the "strip" option, but
enabling this option is not necessary as the build system will already
strip binaries based on CONFIG_NO_STRIP / CONFIG_USE_STRIP /
CONFIG_USE_SSTRIP.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 5c5123f0f6)
This allows rustc/cargo/etc to be called without having to set PATH, as
$(STAGING_DIR)/host/bin is already in PATH.
This also fixes CARGO_HOME not being set during Host/Configure and
Host/Compile.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 49aaf19c65)
* Compress dist archives with gzip instead of xz; gzip is faster to
compress and decompress
* Use a for loop instead of calling find to extract archives
* Use libdeflate's gzip to decompress instead of gzip
* Limit search for install scripts to top level of extracted archives
This also runs the install scripts with bash instead of sh, in
accordance with the shebang lines inside the scripts.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 855623d8cc)
Features to be enabled for host may not be the same as those for target.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit d24095b8fc)
This also updates the list of dependencies and adds a test.sh script for
the packages feed CI.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 7e8f7b28d7)
"Iran Hosted Domains" is a comprehensive list of Iranian domains and services that are hosted within the country.
Signed-off-by: Kaveh Dadgar <Kavehdadgar666@protonmail.com>
(cherry picked from commit b1fc3754b3)
Add upstream patch adding support for pcre2 and update dependency to
require libpcre2 instead of libpcre.
--with-pcre2-8 is now needed to exclude support for pcre and only
require pcre2 as net-snmp still use and try to use pcre by default.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit daf29ecbb2)
v1.13.0
This release includes more Neon and AVX2 optimizations, adds a new codec
control to set per frame QP, upgrades GoogleTest to v1.12.1, and includes
numerous bug fixes.
v1.13.1
This release contains two security related fixes. One each for VP8 and VP9.
- https://crbug.com/1486441 (CVE-2023-5217)
- Fix bug with smaller width bigger size (CVE-2023-44488)
Fixes#22318
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
(cherry picked from commit 36566a99af)
This is a security release.
JH/01 Bug 2999: Fix a possible OOB write in the external authenticator, which
could be triggered by externally-supplied input. Found by Trend Micro.
CVE-2023-42115
JH/02 Bug 3000: Fix a possible OOB write in the SPA authenticator, which could
be triggered by externally-controlled input. Found by Trend Micro.
CVE-2023-42116
JH/03 Bug 3001: Fix a possible OOB read in the SPA authenticator, which could
be triggered by externally-controlled input. Found by Trend Micro.
CVE-2023-42114
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 7c8f4a2a1c)
Includes fix for CVE-2023-39323 (cmd/go: line directives allows
arbitrary execution during build).
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit a8374204bb)
Move the order in which BuildPackage is called, so that the libpython
package is built ahead of the module packages, to avoid forcing a
clean-build of the package when 'make package/python3/compile' is called
a second time without changes.
The library must be built first, so that when the buildsystem checks for
ABI version changes using libpython3.version, its timestamp should be
older than the dependent package's STAMP_PREPARED file.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit c230d7bd7f)
* drop packets silently on input and forwardwan chains or actively reject the traffic, set 'ban_blocktype' accordingly
* optimized banIP boot/reload handling
* removed pppoe quirk in device detection
* small fixes and optimizations
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 00cad2980c)
Move atftp to PCRE2 as PCRE is flagged as EOL and won't receive security
updates anymore.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit f81a1a1212)
Bump to release 0.8.0. Autorecong is now needed to correctly compile the
package.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 364fe00b17)
Otherwise one cannot produce *.avi containers needed for some H.264
camera codecs.
Signed-off-by: Jan Kratochvil <jan@jankratochvil.net>
(cherry picked from commit 62f01d7b36)
This includes a patch to unpin the version of setuptools required for
build; the required version is newer than the version bundled with
Python 3.11. This patch should not be necessary when Python 3.12 is
available.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit dd5af62695)
* improve processing of dnsmasq config files
* do not run sed/show error if allow_filter is empty
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit f3b8e569a5)
In the OpenWrt routing feed, package bmx6 and luci-app-bmx6 were removed because the LuCI app was vulnerable to several CVEs, as found by dependabot. It has been reporting it for a few months and has even created an issue. These two packages are not maintained in OpenWrt as well in upstream.
Users should switch to the bmx7 package.
Fixes: 9fb9d9343ea27d6dbb5008ece10c0c843dd2c781 ("bmx6: drop package") in the routing feed
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 9c2bf85900)
* quic-go v0.36.x cannot be compiled with Go 1.21. Update that
AdGuardHome dependency to latest one from v0.37 series.
* It fixes following compilation error:
go-mod-cache/github.com/quic-go/quic-go@v0.36.2/internal/qtls/go121.go:5:13: cannot use "The version of quic-go you're using can't be built on Go 1.21 yet. For more details, please see https://github.
com/quic-go/quic-go/wiki/quic-go-and-Go-versions." (untyped string constant "The version of quic-go you're using can't be built on Go 1.21 yet.
Signed-off-by: Dobroslaw Kijowski <dobo90@gmail.com>
(cherry picked from commit 11230bb580)
This includes a patch to update the version of ouroboros (Rust crate)
used, to fix RUSTSEC-2023-0042[1]. Upstream has switch from ouroboros to
self_cell so this patch should only be necessary for cryptography 41.
[1]: https://rustsec.org/advisories/RUSTSEC-2023-0042.html
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 9fdff3ea94)
From the README:
setuptools-rust is a plugin for setuptools to build Rust Python
extensions implemented with PyO3 or rust-cpython.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit f467f47f0c)
From the README:
This small python library provides a few tools to handle SemVer in
Python. It follows strictly the 2.0.0 version of the SemVer scheme.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit b078e01f0c)
Apply preliminary hotfix for some (three?) of the 0-day
vulnerabilities reported by ZDI.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit db85d9ead6)
* improve processing of dnsmasq config files
* do not run sed/show error if allow_filter is empty
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 0dc2aa2e7d67b6b4bce3d3bae9b14e67b90ff0c1)
This hack was added for Go 1.20 as it did not take minor version.
Now we have Go 1.21, this hack can go away.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
This package is no longer maintained in OpenWrt even though it is maintained by upstream.
The last update was done in August 2016 and because we have 2023, drop this package
without replacement.
If anyone from the community wants to step in and retake the maintainership together with the update,
feel free to do it.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 52def58084)
This package can be built with Go 1.21 and QUIC can be enabled.
Signed-off-by: Van Waholtz <brvphoenix@gmail.com>
(cherry picked from commit 86522d77f1)
Everything is working on pure upstream code.
Patching is not longer needed.
Added entire /etc/tailscale/ directory to conffiles for persistent ssh
host key & https certificate across sysupgrades.
Signed-off-by: Zephyr Lykos <git@mochaa.ws>
(cherry picked from commit 750faf5942)
Move apache to PCRE2 now that PCRE is flagged EOL and won't receive any
security update.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit d14fe0c51c)
Bump apache to release 2.4.57 and refresh patch automatically.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 86f9af41c1)
This renames the source package to python-networkx to match other Python
packages.
This also updates the list of dependencies.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 77cebb0d03)
The package no longer has a build dependency on setuptools-scm.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 0434413108)
Upstream has updated the Go compiler to not use gold when building for
arm, and is waiting for a fix to binutils (released in 2.41) before
doing the same for aarch64.[1]
Based on the above, it does not appear that
https://github.com/golang/go/pull/49748 will be merged. This removes the
patch from that pull request.
[1]: https://github.com/golang/go/issues/22040
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit a80af7e443)
The openvswitch build trips over a number of warnings during the
manpage-check step if groff 1.23 is installed on the build host,
resulting in a failed build.
As this check is optional, and we don't even install the manpages, simply
override the groff configure check to never detect groff.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
(cherry picked from commit db34f33cc7)
opkg requires monotonically increasing version numbers to know which
version of a package is newer. As git commit IDs do not satisfy this
condition, PKG_SOURCE_DATE must be set to the date of the referenced
commit, resulting in the complete version number '2021-03-08-4f72b305-1'.
As the source date also becomes part of the paths inside the download
archive, the source hash must be updated as well.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
(cherry picked from commit 0a3e5dd122)
The group can be used for policy routing and similar purposes.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
(cherry picked from commit 21dd77f6c4)
* bugfix: better detect ABP lists
* update Makefile with BUSYBOX features dependencies
* update the type of dnsmasq_instance setting
* add error message when file type can't be detected
* add reporting when file type can't be detected
* bugfix: include URL on errors related to URL processing/parsing
* rename resolver function to resolver_config to better reflect its use
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit cfe85fbde3)
Update crowdsec to latest upstream release version 1.5.4
Signed-off-by: S. Brusch <ne20002@gmx.ch>
Maintainer: Kerma Gérald <gandalf@gk2.net>
Build tested: package build checked, no run test due to limited space
Description: update to latest version of upstream
(cherry picked from commit 7528bf7682)
The asynchronous API of libmariadb uses cooperative multi threading
by using the system calls
* makecontext
* swapcontext
* getcontext
* setcontext
of the ucontext.h C-API.
Thus additionally link libmariadb to libucontext which is a library
providing these system calls on platforms not supporting them out of
the box - like musl based platforms.
Signed-off-by: Volker Christian <me@vchrist.at>
(cherry picked from commit 6748f95168)
It seems like the libpcre dependency was added by mistake.
While checking in the source code of czmq (Makefile.am, CMakeLists.txt),
I see there are several dependencies, but there isn't PCRE.
Fixes: 936a48a ("czmq: add new package")
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit e3ab95185c)
In order to use $(RUSTC_TARGET_ARCH) in HOST_BUILD_DIR, the line to
include rust-values.mk in the Rust makefile was moved in
f489e019ac, causing it to be included
before package.mk is included.
This had the side effect of preventing "-lssp_nonshared" from being
added to RUSTC_LDFLAGS, because PKG_SSP is indirectly set by package.mk
(package.mk includes hardening.mk, hardening.mk sets PKG_SSP).
There is a deeper issue; it is the Rust package's PKG_SSP value that
causes RUSTC_LDFLAGS to be set and written to the Cargo config file. For
packages that use Rust to build, their PKG_SSP value does not affect the
linker flag.
This sets rustflags with the RUSTFLAGS environment variable, instead of
writing the value to the Cargo config file, allowing PKG_SSP from the
package being built to be used and for the package being built to modify
the rustflags used.
This also:
* Fix "-lssp_nonshared" being added to TARGET_CFLAGS instead of
RUSTC_LDFLAGS, when CONFIG_PKG_CC_STACKPROTECTOR_STRONG is set.
* Remove the use of $(RUSTC_TARGET_ARCH) in HOST_BUILD_DIR and move the
include line for rust-values.mk back to after package.mk.
Since the host build directory was moved under the target build
directory in efdbac38dc, it is no longer
necessary to separate build directories with RUSTC_TARGET_ARCH;
$(BUILD_DIR) already separates build directories by target.
* Add BUILDONLY:=1, as the Rust package does not build a target package.
* Install the Cargo config file as "config.toml" instead of "config", as
this is the preferred form[1].
* Rename RUST_CFLAGS to RUSTC_CFLAGS and CONFIG_HOST_SUFFIX to
RUSTC_HOST_SUFFIX, for consistency.
* Allow CARGO_VARS to be set before rust-values.mk is included.
[1]: https://doc.rust-lang.org/cargo/reference/config.html#hierarchical-structure
Fixes: f489e019ac ("rust: compile host package per target")
Fixes: 83785a7ce0 ("rust-lang: Add the rust language support")
Fixes: https://github.com/openwrt/packages/issues/22133
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 37762abcb4)
Parallel build does not work because it may reach a point where OSTYPE
might be needed before it is actually built. They appear to run
parallel to each other:
echo slx > OSTYPE
[...]
cat: OSTYPE: No such file or directory
sh: line 1: test: too many arguments
cat: OSTYPE: No such file or directory
Already built for -- you must do "make clean" first
make[6]: *** [Makefile:706: rebuild] Error 1
make[6]: *** Waiting for unfinished jobs....
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 0e652e2449)
We currently have more package architectures supporting
CPU frequency scaling than earlier, and the package architecture
vs. CPU target SDK matching does not fully reflect that.
(E.g. aarch64_cortex-a53 is currently using bcm27xx/bcm2710)
Simplify things by removing the target dependency and let the plugin
be built for all architectures.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 87a9305ddd)
It's not possible to configure custom Transmission web home as corresponding
env var gets overwritten by the command that sets CA bundle env var.
Signed-off-by: Leonid Bogdanov <leonidbogdanov86@gmail.com>
(cherry picked from commit c662aefd9a)
* fix sed command to properly remove allowed domains from block-file
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit bce310bfcd)
Since February 2023, I decided to no longer work with Turris, I mean CZ.NIC company
due to some reasons how the development goes and since that day my work address is not
available and not sure if there is some redirect to someone else, but if anyone wants to
reach me, use my email address, where they can find me.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 1e1b2051db)
Description (from libucontext github page):
libucontext (https://https://github.com/kaniini/libucontext) is a
library which provides the ucontext.h C API. Unlike other
implementations, it faithfully follows the kernel process ABI when
doing context swaps. libucontext is used on almost all musl
distributions to provide the legacy ucontext.h API.
This package is meant as a development package. There is no need
to install a package on the router if an application or library
is linked against the static libraries. Though, shared libraries
are provided also.
It is used to link libraries/applications against it which need the
system calls
* makecontext
* swapcontext
* getcontext
* setcontext
E.g. the asynchronous API of libmariadb (c-connector) uses this
system calls. Because libmusl didn't provide that system calls this
synchronous API is currently (without libucontexe) not working - it
segfaults.
Co-developed-by: Tianling Shen <cnsztl@immortalwrt.org>
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Signed-off-by: Volker Christian <me@vchrist.at>
(cherry picked from commit 635a702255)
Most distros allow dropping site configuration files into
/etc/sshd_config.d/ so that you don't have to tweak the main
server configuration file.
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
(cherry picked from commit ead95a26b6)
This allows other packages access to RUST_ARCH_DEPENDS by including
rust-values.mk, instead of rust-package.mk which also sets
Build/Compile.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 985738b399)
This renames the source package to python-ruamel-yaml to match other
Python packages.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit fdff92f085)
During the renameing of mwan3_connected_v4 to mwan3_connected_ipv4 and
mwan3_connected_v6 to mwan3_connected_ipv6 the adjustment in the ubus
call was forgotten. This commit fixes this.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit a56e111c49)
The package changed to the poetry-core build backend (and also requiring
python-cython/host).
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 8957d34d09)
This renames the source package to python-xmltodict to match other
Python packages.
This also updates the list of dependencies.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 4872c32580)
This also hides the module packages in menuconfig unless the libslang2
package is selected.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 03ef02f0f4)
This removes 014-remove-platform-so-suffix.patch and
016-adjust-config-paths.patch, restoring the platform triplet to paths
for:
* C extensions (*.cpython-311-*.so)
* Build config data directory (/usr/lib/python3.11/config-3.11-*/)
* sysconfig data file (/usr/lib/python3.11/_sysconfigdata_*.py)
Setting `_PYTHON_SYSCONFIGDATA_NAME` during package builds ensures that
sysconfig data for target Python is loaded, in particular so that C
extensions built will have the correct extension / platform triplet.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 0fe1011420)
Currently, configure does not find the correct platform triplet for musl
as the default build/host values passed by OpenWrt buildroot does not
contain the text "linux-musl".
This backports
c163d7f0b6
to add detection for mips soft float and musl.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 5a0055df06)
* Support wildcards in install (`+`) paths
* Add fourth parameter to set directory permissions
If file permissions are given (third parameter), these will now apply
to files only.
* Add non-recursive set permissions command (`==`)
* Be more strict about filespec format
Blank lines and lines starting with `#` will be ignored. Other errors
(unknown command, missing path parameter, etc.) will cause the script
to exit.
* Be more strict about ensuring paths exist for all commands
* Avoid spawning subshells
This also removes outdated filespec paths in the python3 package; these
paths delete files that are no longer present.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 2ffb87726b)
* Fix default Python package description not included in individual
package descriptions
* Update default Python package description text (from General Python
FAQ, "What is Python?")
* Add package descriptions for Python module packages
* Reduce duplication in package titles
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 329f9a1391)
There is no need to use Py3Package for python3 as it does not package
any Python files; it is an empty package with dependencies to install
the full Python installation.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 87631ecdd4)
This release breaks the noexit patch, because the code for removing old
now returns an error when no interfaces are configured. As it is run on
startup, the daemon exits in this case. To avoid this, add an additional
check so an error is only returned in an actual error case.
Signed-off-by: Jan Hoffmann <jan@3e8.eu>
(cherry picked from commit 9871979707)
* this package replaces simple-adblock package
* it was impossible to keep existing config structure and continue
improving the simple-adblock the way I wanted, hence the new
package name
* the migration script for existing simple-adblock config is included in
the uci-defaults file
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit be69e34ce3)
* fix dns resolution not working on boot
* add hotplug-online script
* reorganizes files/ and Makefile to reflect files destinations
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 9a2c5ae18c)
As of OpenWrt main branch commit e505873e65f72 ("armsr: armv8:
enable KVM host") [merged 2023-08-15], armsr/armv8 has
KVM host support. We can now enable QEMU host for this
target.
For example, you can run OpenWrt armsr/armv8 as a guest
like so:
qemu-system-aarch64 -nographic -M virt -cpu host --enable-kvm \
-bios u-boot.bin -smp 1 -m 1024 \
-drive file=openwrt-armsr-armv8-generic-ext4-combined.img,format=raw,index=0,media=disk
A compatible u-boot.bin can be obtained from u-boot-qemu_armv8/u-boot.bin
that is built with the armsr target and available from
downloads.openwrt.org.
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(cherry picked from commit 821bbcdf8b)
ver 0.23.13 (2023/05/22)
* input
- curl: fix busy loop after connection failed
- curl: hide "404" log messages for non-existent ".mpdignore" files
* archive
- zzip: fix crash bug
* database
- simple: reveal hidden songs after deleting containing CUE
* decoder
- ffmpeg: reorder to a lower priority than "gme"
- gme: require GME 0.6 or later
* output
- pipewire: fix corruption bug due to missing lock
* Linux
- shut down if parent process dies in --no-daemon mode
- determine systemd unit directories via pkg-config
* support libfmt 10
ver 0.23.12 (2023/01/17)
* input
- curl: require CURL 7.55.0 or later
* decoder
- mad: fix integer underflow with very small files
* tags
- fix crash bug due to race condition
* output
- pipewire: adjust to PipeWire 0.3.64 API change
* fix build failures with GCC 13
Removed upstreamed patch.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit f43e7a5067)
It seems that the Makefile has both CC and CFLAGS hardcoded and does not
allow overriding them by ones being passed by the buildsystem.
This works fine until CONFIG_PKG_ASLR_PIE_ALL is selected, then building
will fail with:
arm-openwrt-linux-muslgnueabi/bin/ld.bfd: mhz.o: relocation R_ARM_MOVW_ABS_NC against `a local symbol' can not be used when making a shared object; recompile with -fPIC
arm-openwrt-linux-muslgnueabi/bin/ld.bfd: mhz.o(.text+0x75c): unresolvable R_ARM_CALL relocation against symbol `__aeabi_l2d@@GCC_3.5
So, lets add a patch pending upstream that allows both CC and CFLAGS to be
overriden so that ones passed by the buildsystem are actually respected.
Fixes: 89123b308f ("mhz: add new package")
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 6c28f46f37)
`/proc/net/netstat` `TcpExt:` line is 2064 chars long on linux 6.1
Signed-off-by: Alex Shumsky <alexthreed@gmail.com>
[PKG_RELEASE bump added]
(cherry picked from commit b5bf5927f7)
Bottom is a top/htop workalike with few additional features, written in
rust.
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit f3a6491674)
Currently, the run-test code tries to find the package source directory
based on the directory name only. This fails for the Go compiler package
because there is more than one directory named "golang".
This uses the full path listed in the "Source:" line of the control file
to find the package source directory.
This also:
* Checks for the test script earlier, to avoid installing and removing
ipk files when there is no test script to be run
* Makes PKG_VERSION parsing more lenient, as the package may not have a
PKG_RELEASE, e.g. attendedsysupgrade-common
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 5422bd6218)
The package is terribly outdated and bundling it with the web UI is a
task I don't find myself willing to take. Dropping it.
FIX: #16008
Signed-off-by: Paul Spooren <paul.spooren@rhebo.com>
In order to use the dbus interfaces via the command gdbus-codegen, the
xml files must be copied into the building staging directory, so that other
programmes can use them during compilation.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 161fd74fa2)
Fixes#21583
zstdlib and lzlib support is currently not neccessary for OpenWRT.
Thus, Explicitly disable zstdlib and lzlib as they would be enabled
automatically in case they are already installed.
Signed-off-by: Volker Christian <me@vchrist.at>
(cherry picked from commit 3ee4f030b5)
Executables depending on binary package libmagic segfault in case
package file is not installed. Libmagic needs file
/usr/share/misc/magic to not segfault. Thus, install
/usr/share/misc/magic along with libmagic and not with file.
Signed-off-by: Volker Christian <me@vchrist.at>
(cherry picked from commit 5362b272cb)
Compile tested: OpenWRT-23.05-rc2, arm_cortex-a7_neon-vfpv4, mips_24kc
Run tested: arm_cortex-a7_neon-vfpv4 (Linksys MR8300), mips_24kc (tplink_archer-a7), OpenWrt 23.05-rc2)
* Update package nlohmannjson to version 3.11.2.
* Version 3.11.2 is source compatible with 3.10.2 so no package should fail to compile
* From version 3.11.2 on forward template declarations are collected in the file
json_fwd.hpp. The json.hpp still contains all template definitions.
Because in most compilation units of a software package only the file json_fwd.hpp
needs to be included, the compilation process is accelerated a lot.
Signed-off-by: Volker Christian <me@vchrist.at>
(cherry picked from commit 8bd6e23fad)
* remove firewall4.include file as it is not needed and procuces a firewall
error on service miniupnpd restart
* remove the uci-defaults file as its sole purpose was to install the
firewall include file
* modify the Makefile to reflect the deleted files
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 4c934aea71)
Update to version 9.97.1 of easyloggingpp
Changelog from upstream
* Ensuring the build on ARM64 works
* Update gtest and cmake now requires C++14 because of that
Compile tested: arm_cortex-a7_neon-vfpv4, mips_24kc, aarch64_cortex-a53
Run tested: Linksys MR8300 (arm_cortex-a7_neon-vfpv4)
GL.iNet GL-A1800 (arm_cortex-a7_neon-vfpv4)
TP-Link_Archer A7 (mips_24kc),
GL.iNet GL-MT3000 (aarch64_cortex-a53)
Signed-off-by: Volker Christian <me@vchrist.at>
(cherry picked from commit d8df885ac6)
Maintainer: me@vchrist.at
Compile tested: OpenWRT-23.05-rc2, arm_cortex-a7_neon-vfpv4, mips_24kc
Run tested: arm_cortex-a7_neon-vfpv4 (Linksys MR8300), mips_24kc (tplink_archer-a7), OpenWrt 23.05-rc2
Description:
Easylogging++ is single header efficient logging library for C++ applications. It is extremely powerful,
highly extendable and configurable to user's requirements.
Signed-off-by: Volker Christian <me@vchrist.at>
(cherry picked from commit 2611e7c798)
This is a security and bug fix release.
Security:
- CVE-2023-28366: Fix memory leak in broker when clients send multiple QoS 2
messages with the same message ID, but then never respond to the PUBREC
commands.
- CVE-2023-0809: Fix excessive memory being allocated based on malicious
initial packets that are not CONNECT packets.
- CVE-2023-3592: Fix memory leak when clients send v5 CONNECT packets with a
will message that contains invalid property types.
- Broker will now reject Will messages that attempt to publish to $CONTROL/.
- Broker now validates usernames provided in a TLS certificate or TLS-PSK
identity are valid UTF-8.
- Fix potential crash when loading invalid persistence file.
- Library will no longer allow single level wildcard certificates, e.g. *.com
Bugfixes of note or relevance to OpenWrt:
- Fix bridges with non-matching cleansession/local_cleansession being expired
on start after restoring from persistence. Closes#2634.
Client library:
- Use CLOCK_BOOTTIME when available, to keep track of time. This solves the
problem of the client OS sleeping and the client hence not being able to
calculate the actual time for keepalive purposes. Closes#2760.
Full changelog available at: https://github.com/eclipse/mosquitto/blob/v2.0.16/ChangeLog.txt
plus: https://github.com/eclipse/mosquitto/blob/v2.0.17/ChangeLog.txt
(2.0.17 fixes regressions from the 2.0.16 release)
Signed-off-by: Karl Palsson <karlp@tweak.au>
Add new option to a config bridge section to indicate
if a bridge port added to the bridge should be isolated
or not. The default is 0 (no isolation).
example
config bridge
option interface 'br-mybridge1446'
option mtu '1446'
option isolate '1' # default '0'
Signed-off-by: Perry Melange <isprotejesvalkata@gmail.com>
(cherry picked from commit 49cdf15da4)
Support for Go 1.20 was removed in 1.48.0+, so
revert this update.
Sorry for the mistake.
This reverts commit 0047d0507d.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Everything is working on pure upstream code.
Patching is not longer needed.
Added entire /etc/tailscale/ directory to conffiles for persistent ssh
host key & https certificate across sysupgrades.
Signed-off-by: Zephyr Lykos <git@mochaa.ws>
(cherry picked from commit 750faf5942)
The patch is no longer required as host setuptools is now new enough.
Signed-off-by: Quintin Hill <stuff@quintin.me.uk>
(cherry picked from commit d7a4754b75)
100_add_cross_platform_build_ability.patch was submitted upstream in
https://github.com/giampaolo/psutil/pull/2068, but that pull request was
closed without being merged.
This replaces that patch with a simpler version that only updates
setup.py, leaving the run-time library code unchanged.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 56bac94a03)
rust/host failed to compile on macOS running on Apple Silicon M1 Pro
because the host target triple is autogenerated to be
'arm64-unknown-linux-'. Rust doesn't have such a target triple, thus the
build fails because there are no pre-built artifacts for bootstrapping.
Fix this by setting RUSTC_HOST_ARCH to 'aarch64-apple-darwin' in case
our host is HOST_ARCH=arm64 and HOST_OS=darwin.
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
(squashed 105fa3920e and c287e98af2)
Pcre (1) is unmaintained and reached its end of life in 2021.
The base system provides pcre2 exclusively since May.
Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
(cherry picked from commit 379946951c)
This also updates the Python dependency from python3 to python3-light.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit cde28d04e6)
* 0.10.0 (Jun 04, 2023)
- Add arm7 and aarch64 support for FreeBSD
* 0.9.0 (Jun 12, 2022)
- Add RISCV64 support on Linux
- Fix tty-stealing on PowerPC
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 4792b6405b)
* fix validation for force_dns_port when missing in config
* fix validation for dns_instance when * or - are used
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit ad8aa084c1)
Fixed by defining TARGET=linux, as suggested in the README.
By default TARGET is derived from the host using uname -s,
which produces build errors on a non-linux hosts:
TARGET is not set; trying to determine target based on host OS....
Detected OS is Darwin
Build target is macos
...
x86_64-openwrt-linux-musl-g++: error: unrecognized command-line option '-arch'
Helped-by: Tianling Shen <cnsztl@immortalwrt.org>
Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
(cherry picked from commit 94315cfaa8)
Fix missing dependencies for 'collectd-mod-disk' to 'libudev' if
collectd-mod-smart is not enabled.
Package collectd-mod-disk is missing dependencies for the following
libraries:
libudev.so.1
The package 'collect-mod-disk' is now build always with 'libudev' support,
independent of the enable/disable build state of 'collectd-mod-smart'.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 79201361b0)
Update to v18.17.1
This is a security release.
Notable Changes
The following CVEs are fixed in this release:
* CVE-2023-32002: Policies can be bypassed via Module._load (High)
* CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium)
* CVE-2023-32559: Policies can be bypassed via process.binding (Medium)
* OpenSSL Security Releases (Depends on shared library provided by OpenWrt)
* OpenSSL security advisory 14th July.
* OpenSSL security advisory 19th July.
* OpenSSL security advisory 31st July
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry picked from commit 153f0b3d83)
On host PC using GCC 13, stackctrl.c fails to compile
with the following error:
../py/stackctrl.c: In function 'mp_stack_ctrl_init':
../py/stackctrl.c:32:32: error: storing the address of
local variable 'stack_dummy'
in 'mp_state_ctx.thread.stack_top' [-Werror=dangling-pointer=]
32 | MP_STATE_THREAD(stack_top) = (char *)&stack_dummy;
../py/stackctrl.c:31:18: note: 'stack_dummy' declared here
31 | volatile int stack_dummy;
| ^~~~~~~~~~~
In file included from ../py/runtime.h:29,
from ../py/stackctrl.c:27:
../py/mpstate.h:296:23: note: 'mp_state_ctx' declared here
296 | extern mp_state_ctx_t mp_state_ctx;
| ^~~~~~~~~~~~
cc1: all warnings being treated as errors
Fixed accordingly by ignoring -dangling-pointer warning
inside mp_stack_ctrl_init function.
Signed-off-by: Jean-Paul Etienne <fractalclone@gmail.com>
(cherry picked from commit 4c1b74ede3)
If 'collectd-mod-smart' is not enabled, the use of lubudev does not need
to be explicitly disabled. This library could be a dependency for other
modules in the future. If this is explicitly disabled, then the other
module cannot be built.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 1aac8ada87)
mqtt plugin is already built and shipped in
collectd-mod-mqtt, however it is not possible to configure it via
uci currently, instead having to rely on populating the config file manually.
Add support by adding 2 functions, process_mqtt() and
process_mqtt_block(). First one just enables/disables the plugin.
The second one, in the spirit of the curl plugin, adds support for
populating multiple <Publish> and <Subscribe> blocks under <Plugin mqtt>
with support for some parameters. Those are:
* blocktype. Publish or Subscribe. Mandatory
* name. The name of the block. Mandatory
* Host. Mandatory
* Port. Optional
* User. Optional
* Password. Optional
* ClientId. Optional
* QoS. Optional
* Prefix. Optional
* Retain. Optional
* StoreRates. Optional
* CleanSession. Optional
* Topic. Optional
Bump PKG_RELEASE per comments in PR
Signed-off-by: Alexandros Kosiaris <akosiaris@gmail.com>
(cherry picked from commit 530ccbc90d)
Includes fix for CVE-2023-29409 (crypto/tls: verifying certificate
chains containing large RSA keys is slow).
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit fb9c8f8b89)
Version 1.71.1 (2023-08-03)
===========================
- Fix CVE-2023-38497: Cargo did not respect the umask when extracting dependencies
- Fix bash completion for users of Rustup
- Do not show `suspicious_double_ref_op` lint when calling `borrow()`
- Fix ICE: substitute types before checking inlining compatibility
- Fix ICE: don't use `can_eq` in `derive(..)` suggestion for missing method
- Fix building Rust 1.71.0 from the source tarball
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit a896412813)
This loads the module, which should return the path of the CA bundle
and verifies that the file exists.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 219edcfa31)
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
This renames the source package to python-maxminddb to match other
Python packages.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit ca7fdf61dc)
This renames the source package to python-pyroute2 to match other Python
packages.
This also updates/simplifies the package dependencies.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit c5c02c060b)
The package changed to the hatchling build backend and removed the
dependency on apipkg.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 0218c9067a)
This renames the source package to python-sqlparse to match other Python
packages.
This also updates the build dependencies; package now uses the flit-core
build backend.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit aa44ed23ce)
From the README:
A project to manage callbacks in asyncio projects.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 0eabbb8ef7)
From the README:
frozenlist.FrozenList is a list-like structure which implements
collections.abc.MutableSequence. The list is mutable until
FrozenList.freeze is called, after which list modifications raise
RuntimeError.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 9c8e4c4aef)
From the README:
A library that helps you read text from an unknown charset encoding.
Motivated by chardet, I'm trying to resolve the issue by taking a new
approach. All IANA character set names for which the Python core library
provides codecs are supported.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 5ef294f64f)
Notable Changes:
*Ada 2.0
Node.js v18.17.0 comes with the latest version of the URL parser, Ada. This update brings significant performance improvements to URL parsing, including enhancements to the url.domainToASCII and url.domainToUnicode functions in node:url.
*Web Crypto API
Web Crypto API functions' arguments are now coerced and validated as per their WebIDL definitions like in other Web Crypto API implementations. This further improves interoperability with other implementations of Web Crypto API.
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry picked from commit 2282d2e664)
The line to generate the argument list for 'simple connect' is quite
long and is not maintainable. To improve the handling a function
'append_param' was added for appending the 'simple connect' options.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 89391d4213)
Signed-off-by: Francisco Jose Alvarez <francisco.alvarez@galgus.net>
* Update commit head
* Rebase patch to the latest changes
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 7ba2c969b2)
Inform netifd with missing 'proto_update', that the interface is not
up anymore.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 2f00e4b8d7)
If on teardown the 'proto_notify_error' is set to 'MM_TEARDOWN_IN_PROGRESS',
then an error which is set on 'setup' is not visible in the ubus
network.interface.<iface> status output.
{
"up": false,
"pending": false,
"available": true,
"autostart": false,
"dynamic": false,
"proto": "modemmanager",
"data": {
},
"errors": [
{
"subsystem": "dualsim",
"code": "MM_TEARDOWN_IN_PROGRESS"
}
]
}
It alway shows the code 'MM_TEARDWON_IN_PROGRESS'!
By removing the line 'proto_notify_error "${interface}" MM_TEARDOWN_IN_PROGRESS'
in teardown, the last error is show in the proto stack from setup.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 30911865b2)
This renames the source package to python-unidecode to match other
Python packages.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 35d6cdf8bb)
This renames the source package to python-netifaces to match other
Python packages.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 935f791e76)
* fix permission to dnsmasq files for ad-blocking
* add pause function to pause the ad-blocking temporarily
* introduce pause_timeout option to control default pause time
* update default config and config-update file
* use $param instead of $1 in adb_start()
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit dea274cc33)
When user runs `make clean` command, everything in `$(STAGING_DIR)`
(where we installed rust) will be removed, but `$(BUILD_DIR_HOST)`
(where we compiled rust and stored build stage) is untouched.
So when user starts a new build after that, OpenWrt buildroot will
still consider `rust` is installed already, resulting the build error
"cargo: command not found".
Fix this by moving to target build dir as well.
Fixes: f489e019ac ("rust: compile host package per target")
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit efdbac38dc)
Tor projects tries to migrate away from git.torproject.org [0,1]. We
need to adjust PKG_SOURCE and GO_PKG name. Further, we need to backport
patches to fix compiling on riscv64, so add:
- 0001-Bump-minimum-required-version-of-go.patch
- 0002-Update-dependencies.patch
Changelog:
2fa8fd9188
[0] - https://gitlab.torproject.org/tpo/anti-censorship/team/-/issues/86
[1] - 82cc0f38f7
Signed-off-by: Nick Hainke <vincent@systemli.org>
(cherry picked from commit 0281f7594b)
While the compiled binaries are intended to run on the host system, the
rust/host package does include the target matching the configured
OpenWrt target.
If using (for example) ./scripts/env to switch between different
OpenWrt configurations, this will cause issues if the different
configuration is for a different target. In such case there will be a
mismatch between the available Rust target and OpenWrt target and the
following error will be printed:
> error[E0463]: can't find crate for `core`
> note: the `XXX` target may not be installed
This fix will add the RUSTC_TARGET_ARCH as HOST_BUILD_DIR and CARGO_HOME
suffix, such that rust/host will be compiled in case an OpenWrt
configuration change causes the RUSTC_TARGET_ARCH to change.
Fixes: #21530
Signed-off-by: Orne Brocaar <info@brocaar.com>
[Applied Jeffery To's suggestion for build and install path]
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit f489e019ac)
Includes fix for CVE-2023-29406 (net/http: insufficient sanitization of
Host header).
This also updates the copyright information for various Go packaging
files.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 8000a7f769)
Mako was removed in 60ce07b9a1d5c7a53297f177f10af68f3304be9e; at the
time we were using host pip to install host Python packages and so
having this package was not necessary.
With the move away from host pip and toward proper host packages, it
would be better to have a Mako host-only package here to support the
mesa package in the video feed.
This re-imports the package from the abandoned packages feed, updates
the makefile with current Python package conventions, and updates the
package to the latest version.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 666ea93977)
* supports allowing / blocking of certain VLAN forwards in segregated network environments,
set 'ban_vlanallow', ''ban_vlanblock' accordingly
* simplified the code/JSON to generate/parse the banIP status
* enclose nft related devices in quotation marks , e.g. to handle devices which starts with a number '10g-1'
* made the new vlan options available to LuCI (separate commit)
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 1c14eb6d8c)
This renames the source package to python-click to match other Python
packages.
This also updates the package dependencies, licence file, package title
and description.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 5710f272db)
* made the etag id parsing more bulletproof (to catch unverified etags as well)
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 5e2a9f082a)
* prevent superflous etag function calls during start action (on start backups will be used anyway)
* changed the ipthreat feed download URL (load a compressed file variant to save bandwidth)
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 88e64a2ae4)
* added HTTP ETag or entity tag support to download only ressources that have been updated on the server side,
to save bandwith and speed up banIP reloads
* added 4 new feeds: binarydefense, bruteforceblock, etcompromised, ipblackhole (see readme)
* updated the readme
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 68cdc3952d)
We currently have a more or less circular dependency with nginx ssl and
full variant.
FULL variant depends on every nginx module. Every nginx module depends
on nginx-ssl.
Since nginx-full depends on an nginx module, nginx-ssl is installed as
module depends on it and then the installation fails as nginx-full
conflicts with nginx-ssl.
nginx-full in it's meaning is nginx built with every config selected and
it should not have module as dependency. In fact an user should always
install them separetly as while other things, local modification to the
nginx config file are required to include the just installed module.
To fix this circular dependency problem, drop the dependency of every
nginx module for FULL variant.
Fixes: #21300
(cherry picked from commit 3d0183e9c5)
[ fix conflict error and bump pkg release ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
There is an apparent bug in pkgconf 1.9 that broke building the OpenWrt
Vala package. This adds a patch to circumvent the bug. For the related
discussion, see:
https://github.com/openwrt/packages/issues/21359
The pkgconf bug appears similar to the one discussed here:
https://github.com/pkgconf/pkgconf/issues/268
Signed-off-by: W. Michael Petullo <mike@flyn.org>
(cherry picked from commit a7e1ba32fdf4b736a44d467b0f79b7f4665ce32d)
This also removes the dependency on gnupg as there are two packages for
gpg, gnupg and gnupg2; this library should work with either one.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 67af34188d)
This adds new build dependencies as the package switched to
pyproject.toml-based builds.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit e1ef13a30c)
* Add separate packages for each tool (semodule-*)
* Update the semodule-utils package as a meta-package that installs all
tools, keeping it functionally the same as the current semodule-utils
package
* Remove host build (not used by any other package)
* Update package titles, descriptions, and license files
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit aa4085a13f)
* Added packages:
* python3-seobject
Contains the seobject.py library file which was previously included
in selinux-semanage
* selinux-sepolicy
Contains the sepolicy and sepolgen tools which were previously
included in python3-sepolicy
* selinux-sepolgen-ifgen
Contains the sepolgen-ifgen tool which was previously included in
selinux-audit2allow
* selinux-python
A meta-package to install all tools
* Change the python3-sepolgen data_dir from /usr/share/sepolgen to
/etc/sepolgen (updated 0001-sepolgen-adjust-data_dir.patch), and add
the directory to conffiles
By default, the sepolgen-ifgen tool writes to a file named
"interface_info" in the data directory, to be read by the audit2allow
tool. The header comment in the perm_map file also suggests that the
file is customizable.
The best place for these files would be in /var/lib, but /etc is more
appropriate than /usr.
* Remove gui files from python3-sepolicy (0003-sepolicy-no-gui.patch)
* Fix ModuleNotFoundError raised by sepolicy
(0004-sepolicy-fix-get_os_version-except.patch)
Patch has been submitted upstream:
https://lore.kernel.org/selinux/20230619063217.3165462-1-jeffery.to@gmail.com/
* Update package titles, descriptions, and dependencies
* Use Py3Package to build Python bytecode and source packages
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 6bd71dac0c)
This also moves the python3-selinux dependency from the default section
into each util package.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 61e79aad69)
* Rename:
* Source package from python3-libsemanage to python-semanage
* Target package from python3-libsemanage to python3-semanage
* Update dependents with new target package name
* Update package title, license files, and dependencies
* Remove Build/InstallDev (files not used by any other package)
* Use Py3Package to build Python bytecode and source packages
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 23ff8177f0)
* Rename:
* Source package from python3-libselinux to python-selinux
* Target package from python3-libselinux to python3-selinux
* Update dependents with new target package name
* Remove patches:
* 010-setup-py-custom-cc.patch: LDSHARED is already set as part of
$(PYTHON3_VARS)
* 020-Make-use-of-variables-when-defining-libdir-and-inclu.patch: This
package doesn't install the libselinux.pc file
* Update package title and dependencies
* Remove Build/InstallDev (files not used by any other package)
* Use Py3Package to build Python bytecode and source packages
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit a205483547)
* Add separate packages for each tool (setools-*) and a package for the
Python bindings (python3-setools)
* Update the setools package as a meta-package that installs all tools,
keeping it functionally the same as the current setools package
* Remove gui tool (apol) and Python binding (setoolsgui)
* Simplify 030-remove-host-paths.patch (libraries installed by
Build/InstallDev are placed in $(STAGING_DIR)/usr/lib only)
* Update package titles, descriptions, license, and dependencies
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 6938f58a45)
* update binaries to 1.7.2
* move sharedMemoryOutput variable declaration into output function as it doesn't
need to be global
* rename parse_yaml function to yaml_parse
* add TODOs for future development
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 204e6076d352d5c7232e18de0fcf58503ef6ae9b)
* process local lists in strict sequential order to prevent possible race conditions
* support ranges in the IP search, too
* fix some minor search issues
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit c3084be415)
* Support MAC-/IPv4/IPv6 ranges in CIDR notation
* Support concatenation of local MAC addresses with IPv4/IPv6 addresses, e.g. to enforce dhcp assignments (see readme)
* small fixes & cosmetics
* update readme
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit b9bd6cdb0d)
* Optionally auto-add entire subnets to the blocklist Sets based on an additional RDAP request with the
monitored suspicious IP, set 'ban_autoblocksubnet' accordingly (disabled by default).
For more information regarding RDAP see
https://www.ripe.net/manage-ips-and-asns/db/registration-data-access-protocol-rdap for reference.
* small fixes & cosmetics
* update readme
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 767d1ec663)
musl 1.2.4 deprecated legacy "LFS64" ("large file support") interfaces so
just having _GNU_SOURCE defined is not enough anymore.
Manually pass -D_LARGEFILE64_SOURCE to allow to keep using LFS64 definitions.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit a9cda91502)
* Added test.sh script
* Fixed build with riscv64
* Passed package version via go ldflags
* Refreshed patches
* Removed useless test binaries from package
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 27b4291bd4)
This is a security and bugfix release.
Security
o CVE-2023-32067. High. 0-byte UDP payload causes Denial of Service
o CVE-2023-31147. Moderate. Insufficient randomness in generation of DNS query IDs
o CVE-2023-31130. Moderate. Buffer Underwrite in ares_inet_net_pton()
o CVE-2023-31124. Low. AutoTools does not set CARES_RANDOM_FILE during cross compilation
Fixing libcares.pc
The pkg-config file libcares.pc in version 1.19.1 has been changed to be unsuitable for OpenWrt
and causes build errors with Openwrt packages that use libcares.
For this reason, libcares.pc was replaced.
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry picked from commit 4c4d3b9001)
Update to v18.16.1
The following CVEs are fixed in this release:
* CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High)
* CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium)
* CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium)
* CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium)
* CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium)
* OpenSSL Security Releases (Depends on shared library provided by OpenWrt)
* OpenSSL security advisory 28th March.
* OpenSSL security advisory 20th April.
* OpenSSL security advisory 30th May
* c-ares vulnerabilities: (Depends on shared library provided by OpenWrt)
* GHSA-9g78-jv2r-p7vc
* GHSA-8r8p-23f3-64c2
* GHSA-54xr-f67r-4pc4
* GHSA-x6mf-cxr9-8q6v
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry picked from commit 286d1d11ae)
If an alias name is used for the modem, then a check if the device exists
in sysfs does not work. To fix this remove the check if the sysfs device
exists. The protocoll handler already checks if the modem is responsible
for this device on the next line.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit fd63e400ba)
On small systems with many virtual devices, the modem manager sometimes
could not start because it took too long until all devices for the modem
were recognised. This is because all system events that are stored in
the file events.cache have to be processed. To speed up the processing,
all devices under /sys/devices/virtual are now filtered out so that they
do not have to be processed.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit e66fead6d4)
Tests are breaking compilation for mipsel targets because of the removal
of the sysmips call. Let's just not build them.
While at it, remove patches from 1.1 version and move the current ones
to the default 'patches' directory.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 085dc8d965)
1.45.0
* linux: introduce io_uring support
* src: add new metrics APIs
* unix,win: give thread pool threads an 8 MB stack
* win,unix: change execution order of timers
1.44.2
* loop: better align order-of-events behavior between platforms
* zos: fix fs event not fired if the watched file is moved/removed/recreated
* win: Fix pipe resource leak if closed during connect (and other bugs)
* zos: don't error when killing a zombie process
* macos: avoid posix_spawnp() cwd bug
* kqueue: skip EVFILT_PROC events when invalidating events for an fd.
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry picked from commit cf7e9a77c9)
- armvirt target has been renamed to armsr (Arm SystemReady) [1].
- armsr-armv8 has been switched to aarch64_generic architecture [2].
1. 40b02a2301
2. e0f06ddc23
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit bf88b371c5)
armvirt target has been renamed to armsr (Arm SystemReady) [1],
so the dependency need to be changed as well.
40b02a2301
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit e007556915)
armvirt target has been renamed to armsr (Arm SystemReady) [1],
so the dependency need to be changed as well.
1. 40b02a2301
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 21538459c2)
mhz is a tool for mathematically calculating the current CPU frequency, it
has proven to be a really good help while developing CPU frequency scaling
solutions as it allows to independently prove that scaling actually works.
Now that the author has added a license we can package it for the all to
use.
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 89123b308f)
ICU 73.2 updates to CLDR 43.1 locale data. These are maintenance releases for ICU 73 and CLDR 43, with limited sets of bug fixes and no API or structural changes.
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry picked from commit a5e21caa82)
In Go 1.18+ embedded files is natively supported, so this package
is useless now. It has been archived on Jun 2022 and failed to build
on the riscv64 target.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 92059f19b0)
Add concurrency rules to skip redundant build to skip extra build test
on force push on pull request.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit d26e21ef40)
netavark v1.6.0 was released, so instead of using
git version, use release. Does not contain very
much of changes, but list is available from netavark's
commit log.
Software now comes with additional tool named
netavark-dhcp-proxy-client which is now included
in package.
Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit da8c4ee3b8)
aardvark-dns v1.6.0 was released,
so instead of using git version, use release -
similarly like netavark.
Very much hasn't changed but list of changes
is in git commit log of aardvark-dns.
Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit b6c2ed0b8d)
Lot's of changes, but no online release notes
available, check ChangeLog file once extracted
if necessary
Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit 6117fb98cc)
Automatically compute and substitute current values for all
$(COMMITCOUNT) instances as this feature is deprecated and shouldn't be
used.
Based on commit 0c10c224be:
Change COMMITCOUNT in rules.mk to:
```
COMMITCOUNT = $(if $(DUMP),0,$(shell sed -i "s/\$$(COMMITCOUNT)/$(call commitcount)/" $(CURDIR)/Makefile))
```
then update all affected packages by:
```
for i in $(git -C feeds/packages grep -l COMMITCOUNT | sed 's^.*/\([^/]*\)/Makefile^\1^';);
do
make package/$i/clean
done
```
Signed-off-by: Kuan-Yi Li <kyli@abysm.org>
(cherry picked from commit ba75322534)
Fix a bug on installation of nginx-mod-luci where module.d directory
is not found and luci.module creation fails.
Correctly create empty directory for module.d include for dynamic module
loading by placing file in this directory.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 9365622f27)
Bump nginx to new 1.25.0 release.
Changes:
*) Feature: experimental HTTP/3 support.
Every patch automatically refreshed.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 3f080e484e)
In mesh communities, tunneldigger is widely used to create L2TPv3 tunnels
and mesh via them. Since the broker is typically installed on other
distributions, the openwrt broker package has not received any
maintenance in recent years [0]. I take now care of the further maintaince
of this package. Furthermore, I consulted with the maintainers to ensure
that they were comfortable with the change [1].
This PR is just a refactoring of the already existing opkg package from
wlanslovenija. It fixes config parsing and in general the config, adapts
to the new python syntax and fixes dependency handling.
- [0] https://github.com/wlanslovenija/firmware-packages-opkg/tree/master/net/tunneldigger-broker
- [1] https://github.com/wlanslovenija/firmware-packages-opkg/issues/24
Signed-off-by: Nick Hainke <vincent@systemli.org>
(cherry picked from commit 8298ce8234)
A compiler bug (suspiciously) blocks gnulib compilation for
mipsel_24kc_24kf. While we had this patch to disable gnulib, it was
accidentally removed by 5d27631d9f. Add it
back to fix the long broken build for mipsel_24kc_24kf.
Fixes: #19511
Signed-off-by: Jitao Lu <dianlujitao@gmail.com>
Fix some problem with migration of uci conf template and include of
module.d directive.
Fix 2 case:
- uci.conf.template not versioned but with the include module.d
resulting in double include module.d
- uci.conf.template version 1.1 with the include module.d at the end
of the config. This is problematic for nginx as modules must be
included before any http directive.
Handle this 2 case to restore a working uci.conf.template configuration
on migrated config.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit add3cbfcd3)
Bump uci conf template version to 1.2 to sync with nginx version
handling some migration problem.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 15271cb467)
Imported patches included in debian and other package.
* 200-Fix-NULL-pointer-crashes-from-175.patch
CVE-2021-3502
A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this vulnerability is to the service availability.
* 201-Avoid-infinite-loop-in-avahi-daemon-by-handling-HUP-event.patch
CVE-2021-3468
A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the client connection on the avahi Unix socket is not correctly handled in the client_work function, allowing a local attacker to trigger an infinite loop. The highest threat from this vulnerability is to the availability of the avahi service, which becomes unresponsive after this flaw is triggered.
* 202-avahi_dns_packet_consume_uint32-fix-potential-undefined-b.patch
avahi_dns_packet_consume_uint32 left shifts uint8_t values by 8, 16 and 24 bits to combine them into a 32-bit value. This produces an undefined behavior warning with gcc -fsanitize when fed input values of 128 or 255 however in testing no actual unexpected behavior occurs in practice and the 32-bit uint32_t is always correctly produced as the final value is immediately stored into a uint32_t and the compiler appears to handle this "correctly".
Cast the intermediate values to uint32_t to prevent this warning and ensure the intended result is explicit.
* 203-Do-not-disable-timeout-cleanup-on-watch-cleanup.patch
This was causing timeouts to never be removed from the linked list that tracks them, resulting in both memory and CPU usage to grow larger over time.
* 204-Emit-error-if-requested-service-is-not-found.patch
It currently just crashes instead of replying with error. Check return
value and emit error instead of passing NULL pointer to reply.
* 205-conf-file-line-lengths.patch
Allow avahi-daemon.conf file to have lines longer than 256 characters (new limit 1024).
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry picked from commit 779af4d40c)
Update crowdsec to latest upstream release version 1.5.2
Signed-off-by: S. Brusch <ne20002@gmx.ch>
Maintainer: Kerma Gérald <gandalf@gk2.net>
Run tested: ipq40xx/generic, Fritzbox 4040, Openwrt 22.03.5
Description: update to latest version of upstream
(cherry picked from commit 1813bf2c6e)
This renames the source package to python-asgiref to match other Python
packages.
This also updates the package title and URL.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit b098f2ac40)
speedtestcpp is a fork of Taganaka's speedtest, rewritten.
It has some improvements such as
- interactive result show
- use server recommended profiles, which makes it faster (can be disabled)
- and more..
It also provides it's functions in shared and static libraries
and offers development headers for integrating speedtest to
features to another projects.
This commit replaces speedtestpp since this fork has
all the same features + more.
Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit c5bf970241)
This renames the source package from passlib to python-passlib to match
other Python packages.
This also updates the package URL and list of dependencies.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 5b965e4d79)
Disable mpfr detection to fix a build error due to (unncessary)
missing dependency:
```
Package gawk is missing dependencies for the following libraries:
libgmp.so.10
libmpfr.so.6
```
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 3d9b6df7d8)
Zabbix moved the 6.2 directory from "stable" into "oldstable". This adds
the "oldstable" URL to PKG_SOURCE_URL.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit c196aac4b1)
From the README:
This CLI tool provides an integrated set of utilities to remotely
interact with and automate a MicroPython device over a serial
connection.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit a83dcf0d5c)
From the README:
Hatchling plugin to read project dependencies from requirements.txt
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 9071deb1c7)
The package has been reworked to install the same files that are
available to be downloaded/installed by mip, the package manager new to
MicroPython 1.20.0.
This also splits the original target package into four:
* micropython-lib
* Includes packages common to all MicroPython ports (python-stdlib,
python-ecosys, micropython)
* Contains mpy bytecode files
* micropython-lib-src
* Includes packages common to all MicroPython ports (python-stdlib,
python-ecosys, micropython)
* Contains py source files
* micropython-lib-unix
* Includes packages specific to the MicroPython Unix port (unix-ffi)
* Contains mpy bytecode files
* Installs a specific launcher (micropython-unix) that adds the Unix
package directory into MicroPython's library path
* micropython-lib-unix-src
* Includes packages specific to the MicroPython Unix port (unix-ffi)
* Contains py source files
This also updates the package license, title, and description.
Patches:
* 001-build-unix-ffi.patch
This enables the repo build script to also build the Unix-specific
packages. Not sure if upstream is open to accepting this since the
Unix-specific packages don't fit well into the existing package
distribution mechanism.
* 002-add-unix-ffi-os-path.patch and 003-add-unix-ffi-uu.patch
These fix instances where the unix-ffi version of the os package is
overridden by the python-stdlib version. These have been submitted to
upstream: https://github.com/micropython/micropython-lib/pull/672
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 9390bd0262)
Patches 000-Makefile-no-errors.patch and 020-mpy-cross-fix-flags.patch
are no longer necessary.
This also adds a Build/InstallDev recipe to install files necessary for
micropython-lib.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit a4ae38494f)
It is no longer required since gnulib is now local to host build environment (tools/gnulib).
Signed-off-by: Ted Hess <thess@kitschensync.net>
(cherry picked from commit b7afecad9d)
* Added new dependencies introduced in this version
* Disabled mips16 due to build issues
* Fixed the usage of the `CONFIG_USE_MUSL` variable (missing $)
* Refreshed patches
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 284093d85a)
This renames the source package from Werkzeug to python-werkzeug to
match other Python packages.
This also updates the package title, description, and list of
dependencies.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 574d43fca6)
This renames the source package from MarkupSafe to python-markupsafe to
match other Python packages.
This also updates the package title and description.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 5602cc85d3)
This renames the source package from Jinja2 to python-jinja2 to match
other Python packages.
This also updates the package license files, title, and list of
dependencies.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 572387f0cb)
This renames the source package from click-log to python-click-log to
match other Python packages.
This also updates the package to download from PyPI, and updates the
package title, URL, and dependencies.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 67a854aee2)
This is the last released version before bcrypt's Rust rewrite; this
package can be further updated after the OpenWrt Rust toolchain has
stablized.
This also renames the source package from bcrypt to python-bcrypt to
match other Python packages, and updates the list of dependencies.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 3def783d3c)
This also updates the SPDX license identifier, title, description and
URL for the package.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit f45f067f3f)
From the documentation:
GNU MPC is a portable library written in C for arbitrary precision
arithmetic on complex numbers providing correct rounding. It implements
a multiprecision equivalent of the C99 standard. It builds upon the GNU
MP and the GNU MPFR libraries.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 4d64d5f80a)
From the documentation:
MPFR is a portable library written in C for arbitrary precision
arithmetic on floating-point numbers. It is based on the GNU MP library.
It aims to provide a class of floating-point numbers with precise
semantics.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 925bd16945)
Packaging setuptools from a separate source package allows it to stay
updated with upstream.
Host setuptools will remain installed as part of python3. Host
setuptools is used in a much more controlled way and so is less critical
for it to track upstream.
setuptools was in a separate source package that was removed in
a53d0c5a403d1669e2cf6c59c2be6a9d3ed633a0; this work is not based on that
earlier package.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit b4975f8bbb)
Packaging pip from a separate source package allows it to stay updated
with upstream.
Host pip will remain installed as part of python3. Host pip is used in a
much more controlled way and so is less critical for it to track
upstream.
This also removes the python-pip-conf package and installs the pip.conf
file as part of python3-pip.
The patch 003-disable-pip-version-check.patch is originally from Debian:
bb079efb8c/debian/patches/disable-pip-version-check.patch
pip was in a separate source package that was removed in
a53d0c5a403d1669e2cf6c59c2be6a9d3ed633a0; this work is not based on that
earlier package.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit eee273507b)
This adds a new subpackage for the venv module. This also moves the
ensurepip module from python3-pip into python3-venv, as ensurepip is not
necessary for pip but often used for venv.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit d53475ac21)
Python added tomli to its standard library in 3.11. Now that Python in
the packages feed has been updated to 3.11, the separate tomli package
is no longer necessary.
This removes python-tomli and updates all dependant packages, removing
python-tomli from their lists of dependencies.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 0509d460c8)
Setting __PYVENV_LAUNCHER__ for Python package builds was added in
a91a992abb, but neither the commit message
nor the pull request[1] explain its purpose in detail.
My guess is this was done to set the shebang for installed Python
scripts. We now have a Makefile recipe to set the shebang, so it would
be unnecessary to set this variable for this purpose.
It appears that Python 3.11 has changed the handling of this (internal)
environment variable, and setting it appears to be causing build errors
for all Python packages.
This removes setting __PYVENV_LAUNCHER__ for Python package builds.
[1]: https://github.com/openwrt/packages/pull/525
Fixes: https://github.com/openwrt/packages/issues/21162
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 9e95dff9ac)
This version includes support for Python 3.11.
This also:
* Updates Build/Compile to only build selected subpackages.
* Removes the submenu in menuconfig; there are too few subpackages to
justify the extra complexity.
Fixes: https://github.com/openwrt/packages/issues/21163
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 4d8cc440a4)
* update to a new upstream commit, fixes#19366
* update patches/010-cmakelists-remove-cflags.patch as upstream file was update
* remove patches/020-cmakelists-add-version.patch as version is now set elsewhere
* add patches/020-src-options.c-add-version.patch to set the version information
* adjust PROCD START time to 95
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit eb40aa1b5d)
This package lacks proper maintenance in both upstream and here.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 72c8977b3b)
lang/python is meant for Python libraries and other packages closely
related to the Python language. It makes more sense for borgbackup to be
in utils instead.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 5059cfccae)
* Removed patches:
* 001-enable-zlib.patch: zlib module should be enabled automatically
* 007-distutils-do-not-adjust-path.patch: Not necessary since we
process shebang lines for all scripts (in python3-package.mk)
* 030-bpo-43112-detect-musl-as-a-separate-SOABI-GH-24502.patch:
Already merged
* Move configure vars from config.site back into Makefile
Centralizing all build information into one file makes it easier to
maintain
* No longer set ac_cv_header_uuid_h=yes as configure should detect
libuuid
* Order configure args by enable-/disable-/with-/without-, then
alphabetically
* Set ac_cv_working_openssl_hashlib=yes for host configure to bypass the
OpenSSL API tests with LibreSSL
* Use the default Host/Compile recipe instead of picking out specific
targets to make
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 2445fe9fb2)
026-openssl-feature-flags.patch and
028-host-python-support-ssl-with-libressl.patch were removed in
4ecd9d67e9 to fix the ssl module after
libressl was upgraded to 3.7.0[1].
However, the cause of the ssl module build failure was only
028-host-python-support-ssl-with-libressl.patch.
Removing 026-openssl-feature-flags.patch caused a build failure for the
hashlib module.
This restores 026-openssl-feature-flags.patch with an updated version of
the patch from OpenBSD[2].
[1]: https://github.com/openwrt/packages/issues/20107
[2]: 26a04435bf/lang/python/3.10/patches/patch-Modules__hashopenssl_c
Fixes: 4ecd9d67e9 ("python3: fix ssl support by removing libressl patches")
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 02eb5c100c)
This adds $(STAGING_DIR_HOST)/include/e2fsprogs to HOST_CFLAGS and
HOST_CPPFLAGS so that configure can find uuid/uuid.h.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 44fb4927f1)
By default, the Python build process will add /usr/local/{lib,include},
and multiarch paths (e.g. /usr/{lib,include}/x86_64-linux-gnu) if
building on Debian/Ubuntu, to its library and includes paths.
006-remove-multi-arch-and-local-paths.patch was added in
84202f17e1 to stop the Python build
process from adding these paths.
006-remove-multi-arch-and-local-paths.patch was removed in
48277ec915.
006-do-not-add-multiarch-paths-when-cross-compiling.patch was added in
0c8b0b0bf7 to stop the Python build
process from adding these paths for target Python.
These paths are still added by the Python build process when building
host Python.
This replaces the cross-compiling-only patch with the original patch,
renamed slightly and adapted for Python 3.10.
Fixes: 48277ec915 ("python3: bump to version 3.8")
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit f006d0ea23)
When doing parallel builds, host Python can install the python3 symlink
before the Python standard library is installed completely.
When this occurs, it is possible for other packages to detect the
python3 symlink and try to use host Python before it is fully installed.
This adds a patch to make commoninstall (where the standard library is
installed) a prerequisite of bininstall (where the python3 symlink is
installed), so that commoninstall is fully completed before bininstall
begins.
Patch has been submitted upstream:
https://github.com/python/cpython/pull/104693
Fixes: https://github.com/openwrt/packages/issues/19241
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 67e47f1196)
The Makefile lines to add READELF to TARGET_CONFIGURE_OPTS was removed
in 4e05541782.
Without setting READELF, configure finds the symlink to
$(TARGET_CROSS)readelf (e.g. arm-openwrt-linux-readelf) instead of
$(TARGET_CROSS)readelf (e.g. arm-openwrt-linux-muslgnueabi-readelf).
This leads to the symlink name being saved to _sysconfigdata.py, and so
the readelf name is not replaced correctly (in
Py3Package/python3-base/install).
This restores the removed Makefile lines.
Fixes: 4e05541782 ("python3: bump to version 3.10.0")
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit e1a9578635)
003-do-not-run-distutils-tests.patch was removed in
4e05541782. This patch stopped "make
install" from, among other things, running compileall.
When this patch was removed, "make install" ran compileall as normal and
created bytecode files in __pycache__ directories. These files were then
packaged in python3-light.
This adds a patch to stop compileall from being run during "make
install".
Fixes: 4e05541782 ("python3: bump to version 3.10.0")
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 8a4da01790)
From 7d669a90212e105b0f669aa2ab38c987b187baab Mon Sep 17 00:00:00 2001
From: Hongxu Jia <hongxu.jia@windriver.com>
Date: Wed, 21 May 2025 13:09:25 +0800
Subject: [PATCH] fix lttng-tools fails to compile with libxml2 2.14.0+
Description:
| In file included from /srv/pokybuild/yocto-worker/qemux86-alt/build/build/tmp/work/core2-32-poky-linux/lttng-tools/2.13.15/recipe-sysroot/usr/include/libxml2/libxml/parser.h:25,
| from ../../../../lttng-tools-2.13.15/src/common/config/session-config.c:29:
| /srv/pokybuild/yocto-worker/qemux86-alt/build/build/tmp/work/core2-32-poky-linux/lttng-tools/2.13.15/recipe-sysroot/usr/include/libxml2/libxml/encoding.h:173:7: note: declared here
| 173 | } input XML_DEPRECATED_MEMBER;
| | ^~~~~
| ../../../../lttng-tools-2.13.15/src/common/config/session-config.c:432:15: error: called object is not a function or function pointer
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.