Release notes can be found here:
https://yaml.dev/doc/ruamel-yaml/
Wheel is compiled as ruamel_yaml (underscore), but on pypi it is ruamel.yaml (dot),
it failed on buildbot, so add slight tweak.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 974e8404c6)
Patches can be dropped.
They don't seem to be needed anymore.
The 'visualize' parts seem to be optional.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 974dc9753c)
It looks like based on opened PRs [1],
there is no official support for Python 3.12+.
Unfortunately, this project is still using setup.py,
which is deprecated and no longer supported.
These days project metadata are stored in pyproject.toml
according to PEP 621.
Also, this project does not follow PEP625 as their
wheel name is in uppercase and it should be in lowercase.
[1] https://github.com/avian2/unidecode/pulls
[2] https://peps.python.org/pep-0621/
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 09951a9cfd)
This looks like it is not maintained anymore.
The last commit in the repository [1] is from 2017,
and the last tarball uploaded on PyPI is from 2015.
That tarball does not follow PEP625, because the
wheel and tarball begins with uppercase, it should be
in lowercase and as well it is still using setup.py.
Python these days is using pyproject.toml.
[1] https://github.com/washort/parsley
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 598dc276f7)
Also remove Peter Wagner (inactive) and Hauke Mehrtens (asked to be removed, in
private conversation).
Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
(cherry picked from commit a863fe3d7a)
It seems this software is no longer maintained.
- The latest upstream commit is 4 years ago.
- Author didn't respond security issue report. (CVE-2023-39141)
No packages depend on this.
Signed-off-by: Yanase Yuki <dev@zpc.st>
(cherry picked from commit 9d6d44487f)
glibc 2.39 has removed libcrypt completely.
solution: link against libxcrypt built with glibc compatibility.
Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
(cherry picked from commit 14aed6a41b)
- rework the iw device detection in the scan function
- remove any limits from the radio selection
- control the reverse radio processing order with a separate option 'trm_revradio'
- tweak a few (debug) log statements
- LuCI updates (separate commit)
- readme update
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 1a1c0d07a9)
changelog: https://github.com/netbirdio/netbird/releases/tag/v0.53.0
Update init file to include `NB_CONFIG="/etc/netbird/config.json"`
variable, ensuring configuration compatibility as before (fixes issue
introduced by profiles feature in 0.52.2). Existing configurations remain
compatible.
Note: license for some components (`management`, `relay`, `signal`) changed
to **AGPLv3**. These components aren't packaged for OpenWrt, so there's no
immediate effect, but record the change for future reference.
Signed-off-by: Wesley Gimenes <wehagy@proton.me>
(cherry picked from commit 7c3e0c1e5b804989b8e4d4310fec240cd43c9776)
changelog: https://github.com/netbirdio/netbird/releases/tag/v0.52.2
`netbird` now supports profiles [1]. The configuration file has been
moved from `/etc/netbird/config.json` to `/var/lib/netbird/`. The
migration is handled by `netbird` itself.
However, in OpenWrt, the `/var` directory is a symbolic link to
`/tmp`, which is a temporary directory. This can result in
configuration loss after rebooting or flashing a new image. This
issue will be fixed in the next release, 0.53.0.
**I reported this behavior upstream [2].**
[1]: https://docs.netbird.io/how-to/profiles
[2]: https://github.com/netbirdio/netbird/issues/4322
Signed-off-by: Wesley Gimenes <wehagy@proton.me>
(cherry picked from commit f06a83c461810296615433a4ad31743d68c162a1)
Set nano as the default EDITOR via /etc/profile.d for those apps
that respect the variable. Only for nano-plus and nano-full variants.
Suggested-by: Anthony Sepa <protectivedad@gmail.com>
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit d4f6c9c322)
- fix a cornercase issue in the scanning function with hidden uplinks
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit f9c132b3c5)
- fix a possible race condition in the scan function
- limit the max. signal strength to 100
- cosmetics
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit b8486bd711)
includes fix for CVE-2025-30192 (from 5.1.6)
includes fixes for CVE-2025-59023 and CVE-2025-59024 (from 5.1.8)
Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>
Before:
checking for python... /myworkingdir/build/staging_dir/host/bin/python
checking for python version... xcode-select: Failed to locate 'python', requesting installation of command line developer tools.
checking for python platform... xcode-select: Failed to locate 'python', requesting installation of command line developer tools.
checking for GNU default python prefix... ${prefix}
checking for GNU default python exec_prefix... ${exec_prefix}
checking for python script directory (pythondir)... xcode-select: Failed to locate 'python', requesting installation of command line developer tools.
checking for python extension module directory (pyexecdir)... xcode-select: Failed to locate 'python', requesting installation of command line developer tools.
After:
checking for python version... 3.11
checking for python platform... darwin
checking for GNU default python prefix... ${prefix}
checking for GNU default python exec_prefix... ${exec_prefix}
checking for python script directory (pythondir)... ${PYTHON_PREFIX}/lib/python3.11/site-packages
checking for python extension module directory (pyexecdir)... ${PYTHON_EXEC_PREFIX}/lib/python3.11/site-packages
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit dcb010bb43)
Fixes:
SetuptoolsDeprecationWarning: License classifiers are deprecated.
!!
********************************************************************************
Please consider removing the following classifiers in favor of a SPDX license expression:
License :: OSI Approved :: Apache Software License
See https://packaging.python.org/en/latest/guides/writing-pyproject-toml/#license for details.
********************************************************************************
!!
self._finalize_license_expression()
Release notes:
https://github.com/di/calver/releases/tag/2025.10.20
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 7f64f6c0cf)
Fixes:
Traceback (most recent call last):
File "<frozen runpy>", line 198, in _run_module_as_main
File "<frozen runpy>", line 88, in _run_code
File "/turris/build/staging_dir/hostpkg/lib/python3.11/site-packages/installer/__main__.py", line 98, in <module>
_main(sys.argv[1:], "python -m installer")
File "/turris/build/staging_dir/hostpkg/lib/python3.11/site-packages/installer/__main__.py", line 86, in _main
with WheelFile.open(args.wheel) as source:
File "/turris/build/staging_dir/hostpkg/lib/python3.11/contextlib.py", line 137, in __enter__
return next(self.gen)
^^^^^^^^^^^^^^
File "/turris/build/staging_dir/hostpkg/lib/python3.11/site-packages/installer/sources.py", line 162, in open
with zipfile.ZipFile(path) as f:
^^^^^^^^^^^^^^^^^^^^^
File "/turris/build/staging_dir/hostpkg/lib/python3.11/zipfile.py", line 1311, in __init__
self.fp = io.open(file, filemode)
^^^^^^^^^^^^^^^^^^^^^^^
FileNotFoundError: [Errno 2] No such file or directory: '/turris/build/build_dir/hostpkg/pypi/Cython-3.0.10//openwrt-build/Cython-3.0.10-*.whl'
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 7f233be4ce)
These patches were required with older setuptools version,
but in Python 3.11.4 is bundled setuptools updated, thus
we can remove these patches.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit f4395c5d31)
In this release, there is updated setuptools, so update
it as well.
Fixes CVEs:
- CVE-2025-47273
- CVE-2024-6345
Release notes:
https://pythoninsider.blogspot.com/2025/10/python-31212-31114-31019-and-3924-are.html
Patch:
- 0001-Adjust-library-header-paths-for-cross-compilation.patch
comes from buildroot [1], but they removed it as they switched to Python 3.12,
however Python 3.11 still supports distutils, but it is marked as deprecated [2]
and it will be gone in 3.12. So, don't rebase it this time as this patch does not apply
anymore due to this commit [3] and sooner switch to more up-to-date Python3 version.
[1] b37e4a5f56
[2] https://peps.python.org/pep-0632/
[3] 88eb8cc66f
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit ef509da52b)
Files such as config file and init script related to OpenWrt
were removed in upstream [1]. Config file was same as umurmur.conf.example,
thus use it and init script, we need to ship our own. Add a simple one.
[1] 209edb5c88
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit b03e655bf0)
This was changed in version 0.3.1 [1]
Fixes initial start of umurmur:
```
root@turris:~# umurmurd
Error in config file /etc/umurmur/umurmur.conf line 0: file I/O error
```
And also while running help of umurmurd, the defailt location is /etc/umurmur/umurmur.conf
```
Usage: umurmurd [-d] [-r] [-h] [-p <pidfile>] [-t] [-c <conf file>] [-a <addr>] [-b <port>]
-c <conf file> - Specify configuration file (default /etc/umurmur/umurmur.conf)
```
[1] 4f3ed41357
Fixes: c4a23ca996 ("umurmur: update to version 0.3.1")
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 3d6be64ea3)
Replace embedded ivykis with a separate package to improve
dependency management and enable library reuse.
The ivykis library now properly supports io_uring when
CONFIG_KERNEL_IO_URING is enabled.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 8fcf45d05a)
Libivykis, an asynchronous I/O readiness notification library.
This library is required by syslog-ng and potentially other packages
that need event-driven I/O handling.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit c92d120690)
2025-10-14: Version 7.5.3
* Fix: Exit with non-zero code if the conversion is aborted
due to a binary file.
* Fix: Exit with zero code when an unicode conversion error
occurs in quiet mode.
* Updated Brazilian Portuguese, Catalan, Chinese (traditional), Dutch,
Friulian, Georgian, and Serbian translations.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 49dbbf0dc9)
Fixes the following security issues:
- CVE-2025-8677: DNSSEC validation fails if matching but invalid
DNSKEY is found.
- CVE-2025-40778 Address various spoofing attacks.
- CVE-2025-40780 Cache-poisoning due to weak pseudo-random number
generator.
The complete list of changes from version 9.20.11 is available in the
upstream changelog at
https://ftp.isc.org/isc/bind9/9.20.15/doc/arm/html/changelog.html
Signed-off-by: Noah Meyerhans <frodo@morgul.net>
(cherry picked from commit 59465b95b8)
After reinstalling the packages with the preserved configuration files
after a sysupgrade, the reinstalled package config files overwrite what
is on disk rather than being placed as conf-opkg. Defining these config
files will preserve them appropriately.
Signed-off-by: Joel Low <joel@joelsplace.sg>
(cherry picked from commit 03088536db)
UCI plugin in strongswan has been broken for years, and now its causing
strongswan to fail compilation.
So, instead of the whole strongswan package to be failing and missing from
feeds simply make UCI plug depend on @BROKEN.
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit a8c89a0c77)
Most of the time, when people contribute to the repository for the first time
(or after a longer break), the multi-arch-test-build passes, but the
formality check fails and requires the contributor to make some changes.
This creates unnecessary load on the CI/CD, since the multi-arch-test-build
runs again even though it already passed, while other PRs are waiting for a runner.
Hopefully, this change will help decrease the waiting time.
Proposed changes:
- Run the formality check first, and only trigger the package tests afterwards.
This can be done using needs: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idneeds
- Merge formal.yml into multi-arch-test-build.yml so that needs can be used.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 4474f539bb)
For some reason, pip builds a broken Cython, which segfaults on attempting
to install wheel. Work around this by allowing to use precompiled wheels.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit d798ccce9a)
Update mhz to latest version to include new calibration features.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
(cherry picked from commit 7ef10e0364)
It was reported that in some build environments the install step fails
with following:
find /home/.../buildsystem/build_dir/target-aarch64-unknown-linux-gnu_musl/lvm2-normal/LVM2.2.03.22/ipkg-install/usr/sbin/ -type l -exec cp -fpR -a {} /home/.../buildsystem/build_dir/target-aarch64-unknown-linux-gnu_musl/lvm2-normal/LVM2.2.03.22/.pkgdir/lvm2/sbin/ \;
make[6]: /bin/sh: Argument list too long
This is likely happening once the number of symlinks exceeds the shell's
maximum argument limit.
So lets fix it by switching to more reliable xargs based solution:
print0/xargs -0 to handle filenames with special characters
xargs -r to skip execution if no files are found
cp -t to specify the target directory once instead of for each file
Fixes: #26552
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 073b460cb1)
Major change is:
- set server signing to auto by default.
In recent versions of Windows 11, server signing is required.
However, server signing is disabled by default in ksmbd server.
So It is recommended to set server signing = auto as default,
so that it is used whenever it is required.
Signed-off-by: Andrea Pesaresi <andreapesaresi82@gmail.com>
(cherry picked from commit a7d51c511c)
The major changes are:
- Add max ip connections parameter. (ready for future upstream fix) at the moment is reverted by: 18bdeda011
- unlock follow symlinks parameter to support symlink.
- send bind_interfaces_only parameter to ksmbd.
Signed-off-by: Andrea Pesaresi <andreapesaresi82@gmail.com>
(cherry picked from commit 47f1bfa717)
Now for all devices with every size of RAM it is set to:
`smb2 max read = 64K`
`smb2 max write = 64K`
`smb2 max trans = 64K`
Instead of fixed value to 64K is better to check RAM size and adjust to:
32 ~ 64MB RAM, set the value to 64K
64 ~ 128MB, set it to 128KB
128 ~ 256MB, set it to 1MB
More than 256MB leave default size to 4MB
With 64MB and 128MB is better also to disable the read/write cache
`cache read buffers = no`
`cache write buffers = no`
Signed-off-by: Andrea Pesaresi <andreapesaresi82@gmail.com>
(cherry picked from commit 0ca4794564)
- fix a logical glitch in opensta-handling
- add a list option 'trm_ssidfilter' to maintain a list of SSID patterns
for filtering/skipping specific open uplinks, e.g. 'Chromecast*' (fix#26406)
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 65b935cb58)
ZNC can modify its own config file (znc.conf) during runtime, for
example using controlpanel or webadmin modules. Manually editing the
znc.conf file while znc is running is strongly discouraged.
Thus prodc should not watch this file, it would just lead to znc being
restarted unnecessarily.
As it happens, no restarts were done, because the watched path was
specified incorrectly. It used ZNC_CONFIG instead of ZNC_CONFIG_DIR,
and so it watched /tmp/etc/znc/configs/znc.conf/configs/znc.conf which
does not exist.
Remove the watch of znc.conf as it is not needed.
Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org>
(cherry picked from commit 00feb12444)
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
- add a new lan/wan subnet check, to to show conflicts with router LAN network
- clean up bogus debug log outputs
- minor code clean ups
- readme update
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit a38196f151)
- drop iwinfo, use iw/ip instead
- support passive wlan scanning (active scanning is still the default)
- drop qrencode, use the LuCI internal qrcode js library instead
- more vpn fixes
- various LuCI changes/enhancements
- fix#27599
- disable proactive scanning in the default config
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit a46dd4cf3c)
* bugfix: remove IPKG_INSTROOT check
* bugfix: do not attempt to download config update if package is disabled
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit a7f831b846)
Signed-off-by: Stan Grishin <stangri@melmac.ca>
Makefile:
* stop shipping/dealing with the firewall hotplug (obsolete)
* install a third user-script (dnsprefetch) by @betonmischer
Config:
* remove obsolete options
* include the new user script
Init-script:
* start much earlier so that on boot, the procd_add_raw_trigger works on all systems
* create a ubus() helper function so that service delete does not produce "Command not found"
* rename options to better reflect their function:
* procd_lan_device to lan_device
* procd_wan_interface to uplink_interface
* procd_wan6_interface to uplink_interface6
* procd_wan6_metric to uplink_interface6_metric
* wan_ip_rules_priority to uplink_ip_rules_priority
* wan_mark to uplink_mark
* visually separate run-time variables from variables loaded from config options
* use ${IPKG_INSTROOT} when sourcing files
* fix typo in str_to_dnsmasq_nftset()
* use pidof to kill dnsmasq in dnsmasq_kill()
* add helper function uci_add_list_if_new()
* add helper function uci_changes()
* add helper function ubus() so that service delete does not produce "Command not found"
* implement the dnsmasq features check similar to dnsmasq init script
* add get_url() function similar to luci package
* add/modify error and warning messages
* change how mktemp is used for more reliable file creation
* unset non-true boolean package config options on load for easier checks later
* improve handling of nft/nft set options
* fewer calls to resolver() and resolver() optimization to speed up the service
* use softlinks instead of duplicating dnsmasq nftset files into each instance
* prevent duplication of dnsmasq nftset elements
* option to target a specific dest dns port in DNS policies
* bugfix: more reliable interface reloads
* display README links to errors/warnings sections if any errors/warnings discovered
Uci-defaults:
* transition from old options to new ones
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit f0f8dc0fce)
Signed-off-by: Stan Grishin <stangri@melmac.ca>
Config/uci files were not being included in -full variant.
Config files were also being lost in firmware upgrades for all variants.
Both issues fixed, including correct file permissions for config files.
Signed-off-by: Antonio Pastor <antonio.pastor@gmail.com>
(cherry picked from commit 0d939af403)
The libtirpc package is only needed when building with musl, as glibc
includes the required RPC functionality. This change makes libtirpc a
conditional dependency and adjusts the build flags accordingly.
Building with x86_64-glibc:
...
Feature options:
DAQ Modules: Dynamic
libatomic: User-specified
Hyperscan: ON
ICONV: ON
Libunwind: OFF
LZMA: ON
RPC DB: Built-in
SafeC: OFF
TCMalloc: ON
JEMalloc: OFF
UUID: ON
NUMA: OFF
LibML: OFF
...
Building with aarch64_cortex-a76_musl:
...
Feature options:
DAQ Modules: Dynamic
libatomic: User-specified
Hyperscan: ON
ICONV: ON
Libunwind: OFF
LZMA: ON
RPC DB: TIRPC
SafeC: OFF
TCMalloc: ON
JEMalloc: OFF
UUID: ON
NUMA: OFF
LibML: OFF
...
Build system: x86/64
Build-tested: x86/64-glibc, bcm27flogic/xiaomi_redmi-router-ax6000-ubootmod (for musl)
Run-tested: x86/64-glibc
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit e4bdefe1c2)
This fixes version detection issues when other packages (like snort3)
try to find the tcmalloc library using CMake's find_package(). Without
the headers in the staging directory, CMake cannot read the version
information from tcmalloc.h, resulting in empty version strings.
Fixes:
Found TCMalloc: /builder/staging_dir/target-x86_64_musl/usr/lib/libtcmalloc.so (found version "")
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit e52a809371)
This simplifies checks enabling/disabling features, if packages are present
instead of having checks for specific architectures.
TCMALLOC_LIBRARIES is removed as it's auto-detected, unlike vectorscan
which requires explicit HS_INCLUDE_DIRS.
Fixes: 126364e105 ("snort3: refactor architecture-specific dependencies and CMake options")
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 02f78bc30a)
Makefile:
* update to latest upstream: 7b27ecd559
* update version, release
* drop CONFIGURE_ARGS as the build is curl-independent
* update the link to the documentation
README:
* add small README with the link to documentation
Config:
* rename procd_fw_src_interfaces to force_dns_src_interface to better reflect meaning
* add heartbeat_domain, heartbeat_sleep_timeout, heartbeat_wait_timeout options
* add default user, group and listen_addr options to the main config
* drop the user, group and listen_addr options from the instance configs
Init-script:
* start much earlier so that on boot, the procd_add_raw_trigger works on all systems
* create a ubus() helper function so that service delete does not produce "Command not found"
* new options handling where the global config options can be used for instance options
* some renaming of global/instance variables due to abovementioned redesign
* new open port detection, no longer relying on netstat
* new uci_changes() logic where it returns 0 or 1 instead of text
* new append_parm logic for not adding default value options to CLI
* new boolean options handling logic
* move config loading to load_package_config() function
* new logic for calling procd_set_config_changed firewall based solely on "$force_dns"
* source network.sh based on "${IPKG_INSTROOT}" path
* rename procd_fw_src_interfaces to force_dns_src_interface to better reflect meaning
* rename use_http1 to force_http1
* rename use_ipv6_resolvers_only to force_ipv6_resolvers
Uci-defaults:
* migrate to new option names
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit e1cf4ac52e)
Signed-off-by: Stan Grishin <stangri@melmac.ca>
1. Enabled hyperscan/vectorscan together with adding dependency only for x86_64 and aarch64.
2. Disabled tmalloc (from gperftools package) for powerpc and mips.
By doing this refactor, snort3 is going to be available for more OpenWrt devices
(as it was in the past) as currently it was compiled only for x86_x64 and aarch64 by mistake.
Fixes: 257e2fc38a ("snort3: fix logic in gpertools-runtime depends")
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 126364e105)
[For OpenWrt 24.10: There is hyperscan instead of vectorscan]
Config file:
* add debug_init_script and debug_performance options
* remove led (default should be empty) option
* remove procd_boot_delay (obsolete) option
Init Script:
* reinstate IPKG_INSTROOT check
* change capitalization in status messages
* unset default value for led option on load_package_config
* bugfix: unset bool options which are later checked for non-empty
* bugfix: create compressed cache only if block-file exists
* adjust errors output/storing errors for later display in multuple cases
* produce information about cache/compressed cache files in service
status output when service is stopped
* attempt to create compressed cache in service_started only if block-
file exists
* bugfix: run service_started from the dl command (to create compressed
cache file)
* rename StripToDomains variables for readability
* improve open port detection
Uci-Defaults:
* improve readability of debug options migration
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit ff2a55441d)
MariaDB now depends on libaio even when uring is enabled.
Signed-off-by: Michal Hrusecky <michal.hrusecky@turris.com>
(cherry picked from commit d50b5e583c)
Simplification of Makefile: remove line splits to increase readability.
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 87d0da8aa2)
Use upstream tarballs for source rather than using git. If we ever need
to build from git we can cherry pick and make a patch. This gives a
cleaner Makefile and faster build.
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 8914929466)
Run the daemon as unprivileged user for better security.
Trim whitespaces while at it.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 182db0ac04)
Although recent updates were made, the `PKG_RELEASE` bump was missed.
Signed-off-by: Wesley Gimenes <wehagy@proton.me>
(cherry picked from commit 7c88f998e5)
Signed-off-by: Sander van Deijck <sander@vandeijck.com>
OpenVPN does work without the kernel module, it just won't be able to use DCO.
To make life easier for OpenVPN users on very space-constrained devices make it
an optional dependency.
Signed-off-by: Dennis Camera <dennis.camera+openwrt@riiengineering.ch>
(cherry picked from commit 01fafd69ef)
Signed-off-by: Sander van Deijck <sander@vandeijck.com>
Enable the DCO option by default in the openvpn package to allow for
better performance and have a use case for kmod-ovpn-dco-v2 :-)
Signed-off-by: Dennis Camera <dennis.camera+openwrt@riiengineering.ch>
(cherry picked from commit 11e17a3ed6)
Signed-off-by: Sander van Deijck <sander@vandeijck.com>
Using the broker_selection param makes it possible to decide by use (default),
always use the first available broker to connect or select a random broker
See also: 51a5e46ad1/client/l2tp_client.c (L1331-L1333)
Signed-off-by: Florian Maurer <f.maurer@outlook.de>
(cherry picked from commit 296c15c1f2)
Makefile changes
----------------
1. The location of uMurmur binary was changed to /sbin
in release 0.3.1. See release notes [1]
2. I need to specify location of the library file instead of
the directory.
Fixes:
CMake Warning at src/CMakeLists.txt:44 (target_link_libraries):
Target "umurmurd" requests linking to directory
"/build/staging_dir/target-powerpc_8548_musl/usr/lib".
Targets may link only to libraries. CMake is dropping the item.
CMake Warning at src/CMakeLists.txt:44 (target_link_libraries):
Target "umurmurd" requests linking to directory
"/build/staging_dir/target-powerpc_8548_musl/usr/lib".
Targets may link only to libraries. CMake is dropping the item.
Because of these two warnings, the build fails with
undefined references to
protobuf-c symbols (e.g. protobuf_c_message_get_packed_size).
Patches
-------
Removed all of them, because they are included in
the upstream source code.
[1] https://github.com/umurmur/umurmur/releases/tag/v0.3.1
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit c4a23ca996)
Make libunwind support optional depending on package availability.
Previously, gperftools unconditionally enabled libunwind as
mandatory dependency, which led to build failures on architectures where
libunwind is not provided.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 69bf2443d9)
It should be working for mips*,
so enable it and let's see. :-)
In the past, there were some issues related to mips,
when the package was added, but these days, it appears
that these issues are gone. More details
about those issues could be found in the GitHub pull request
when gperftools was added. Reference is in the Fixes tag.
Fixes: c1b4e80825 ("gperftools: add new package")
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 4dc36ae9fd)
fail2ban changes:
- nftables support (iptables dependency removed)
- python3 support (old package patches removed)
- Upstream patches backports:
- filter.d/dropbear.conf: failregex extended to match different format of "Exit before auth" message
- cherry-pick from debian: debian default banactions are nftables, systemd backend for sshd
- Removed unresponsive/unreachable maintainer.
Fixes: https://github.com/openwrt/packages/issues/23015 ("fail2ban: very old version")
Signed-off-by: Andrey Zotikov <andrey.zotikov@gmail.com>
(cherry picked from commit 2a202b2091)
The /etc/tor/torrc may contain the line:
%include /etc/torrc.d/*.conf
So users may put their own config files there.
We should preserve the files during an upgrade.
Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
[Added PKG_RELEASE bump]
(cherry picked from commit 83737ed9ea)
Makefile:
* update version/release
Init Script:
* boot up reliability improvements:
- change START from 50 to 20 to ensure procd_add_raw_trigger works on boot
- better logic of checking/using the cache/compressed cache on boot
* new dnsmasq handling/integration logic:
- new logic for checking dnsmasq functionality (similar to dnsmasq init script)
- instead of copying/duplicating adblock-fast files per specified dnsmasq instance, create one file
and add softlinks to it for specified dnsmasq instances and make sure it's in the instance's addnmounts
- update dnsmasqConfFile, dnsmasqIpsetFile and dnsmasqNftsetFile to point to the same filename as the
logic for integrating with dnsmasq is the same for those options
- get the confdir for specified dnsmasq instances via ubus info/config file since the config_get is broken
between releases by https://github.com/openwrt/openwrt/pull/14975
- update clean-up procedures for other dns backend settings to properly clean up when switching away from
dnsmasq.conf, dnsmasq.ipset, dnsmasq.nftset where the new logic is used
- remove obsolete outputDnsmasqFileList variable and logic of building and using it
- only create compressed cache in service_started after successful resolver restart with the block-file
* new package config / environment loading logic
- switch away from using `load_validate_config` to start functions to loading package config "manually"
- unset boolean variables which are non-true on package config load
- switch checking values of such variables from `-eq 0` to empty/non-empty
* debugging improvements:
- rename debug option to debug_init_script and proc_debug to debug_performance
- output performance debug info to log only when debug_performance is set
* miscellaneous changes:
- move best dl tool detection into its own function for reuse in adb_config_update
- change uci_changes function to return 0/1 instead of the text of changes
- improve mktemp calls reliability by creating the file and not using `-u` anymore
- add remove_cache/remove_gzip calls to adb_file function
- better readability of the start_serice logic determining the action
- change flock value from 207 to 209 to avoid collisions with pbr
- temporarily switch namespaces when using jshn functions to avoid collisions with PROCD
- move from using spaces to tabs in indentation in code
- prevent Command Not Found message on uninstall
- remove unneeded IPKG_INSTROOT check in the init script
- update all sourcing instructions to include IPKG_INSTROOT in the path
Uci-defaults script:
* transition old debug and proc_debug options to debug_init_script/debug_performance
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 3c3d9d2b86)
Netatalk 4.3.x adds the option to use sqlite as a CNID DB. This
is now a config option for the full package.
(mysql is also an option but this has not been included here yet).
As CNID DB backends are now managed by the netatalk meta-daemon
the init script has been updated to use it instead of starting
afpd & dbd manually.
Cleaned up tab/space issues here and there.
Signed-off-by: Antonio Pastor <antonio.pastor@gmail.com>
(cherry picked from commit 2a8fdf37dc)
In addition to shipping the latest upstream version, package shared objects.
It is worth noting that this release is required when building with GCC 15.1.
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 0f281ad57b)
I modified the makefile, so that it will build two packages: jq and
jq-full. The former will remain unchanged and the latter will have a
dependency to the oniguruma library, so jq-full will have regex functions
enabled.
Signed-off-by: Maximilian Trüpschuch <milanx@gmx.net>
(cherry picked from commit 711a19c4b2)
It was discovered that even while using ``--enable-redis=no``
and ``--disable-redis`` that it was still linking with libhiredis.
This avoids to picking up libhiredis as dependency:
```
Package knot is missing dependencies for the following libraries:
libhiredis.so.1.1.0
```
Fixes: cbbd2b5b3b ("knot: disable redis as it was enabled since 3.5.0 by default")
Signed-off-by: Jan Hák <jan.hak@nic.cz>
(cherry picked from commit 598504d895)
By disabling redis, it is not possible to use redis database as zone storage
Signed-off-by: Jan Hák <jan.hak@nic.cz>
(cherry picked from commit cbbd2b5b3b)
Release notes:
https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.10.0
Makefile changes
----------------
1. Disable experimental feature: stackdump
due to issues, which were reported to upstream
2. Disabled example modules to avoid adding libstdc++.so.6 dependency
Fixes:
Package syslog-ng is missing dependencies for the following libraries:
libstdc++.so.6
Other changes
-------------
In syslog-ng 4.8.0, there was added possibility to use value "current"
as version in the config file, so use it, which confirm to use
the latest version instead of bumping the version in the file
manually.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit b1cfb71f7b)
It adds a runtime test to verify that the compiled binary in
CI/CD runs without segfault and prints the version.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 971a2164f5)
* trivial fix for #25963 to workaround the current "10 line parsing limit"
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 732a8405ef)
fix autoconf test for broken strtold
fix for parsing compound assignment while expanding alias
fix compilation on systems that provide select or pselect but not both
fix for reading partial invalid multibyte characters
fix issue where comparing quoted and unquoted words to be completed results in readline not displaying possible matches
Signed-off-by: Ariel Xiong <ArielHeleneto@outlook.com>
(cherry picked from commit ca2b5ea51f)
Bump to latest release and removed upstreamed patch.
Resulting libs give a fully functional snort3 which was built against
this new version.
Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc (Intel N150 based box)
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 465eddb46d)
- switch source archive to tar.xz to save space and bandwidth
- refresh a patch
Signed-off-by: Aleksey Vasilenko <aleksey.vasilenko@gmail.com>
(cherry picked from commit 10862df850)
Fixes: 47644ba46 ("syncthing: fix discovery and relay extra args")
Signed-off-by: George Sapkin <george@sapk.in>
(cherry picked from commit d75075ce8e)
Fixes: 47644ba46 ("syncthing: fix discovery and relay extra args")
Signed-off-by: George Sapkin <george@sapk.in>
(cherry picked from commit 6ccb3b6174)
The version specified in Cargo.lock is too old to build.
Trim whitespaces while at it.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 6f6ad3fe1c)
The logic in e57cc9898a was flawed causing
gperftools-runtime to fail to get detected when building resulting in:
...
ninja: Entering directory `/scratch/union/build_dir/target-x86_64_glibc/snort3-3.9.1.0'
ninja: error: '/scratch/union/staging_dir/target-x86_64_glibc/usr/lib/libtcmalloc.so', needed by 'src/snort', missing and no known rule to make it
make[2]: *** [Makefile:161: /scratch/union/build_dir/target-x86_64_glibc/snort3-3.9.1.0/.built] Error 1
It was missed due testing in build root that already had gperftools-runtime
built only discovered when building from a clean build root.
This commit fixes this flaw.
Test:
cat <<EOF > .config
CONFIG_TARGET_x86=y
CONFIG_TARGET_x86_64=y
CONFIG_TARGET_x86_64_DEVICE_generic=y
CONFIG_PACKAGE_snort3=y
EOF
make defconfig
grep gperftools-run .config
CONFIG_PACKAGE_gperftools-runtime=y
cat <<EOF > .config
CONFIG_TARGET_qoriq=y
CONFIG_TARGET_qoriq_generic=y
CONFIG_TARGET_qoriq_generic_DEVICE_watchguard_firebox-m300=y
CONFIG_PACKAGE_snort3=y
EOF
make defconfig
grep gperftools-run .config
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 257e2fc38a)
Added test.sh
Predetermine count used by for loops in Makefile postrm
Implemented extra_command in initscript
Resolved shellcheck issues
Bump release
Signed-off-by: Dan Srebnick <k2ie@k2ie.net>
(cherry picked from commit 551ef4a7c1)
This project can be used with the OpenWrt SDK to generate a package
for ampr-ripd. It is intended for use only by licensed amateur radio
operators. ampr-ripd is a modified RIPv2 listener that provides
route information for ARDC IPIP Mesh tunnels.
Signed-off-by: Dan Srebnick <k2ie@k2ie.net>
(cherry picked from commit 19249742cd)
When compiling glib2 with NLS, it automatically sets linker flags to `-lglib-2.0 -lintl` in pkg-config (.pc) files.
Signed-off-by: Lukas Voegl <lvoegl@tdt.de>
(cherry picked from commit 7ee547b440)
2.80.1 - January 8, 2025
========================
- OpenSSL: fix crash in complete_handshake (!251, Dario Saccavino)
- OpenSSL: fix invalid free in openssl_get_binding_tls_server_end_point() (!255)
- TLS test should handle G_IO_ERROR_WOULD_BLOCK (!253, Richard Purdie and Alexander Kanavin)
- Updated translations
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit b49f4cc0a3)
Add GIO modules for TLS support as well as defining proxies via well-known
environment variables.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 223d7e2995)
Move post-install script to /etc/uci-defaults so it always runs on the
target and doesn't require the host to provide 'update-mime-database'.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 0b2bd76ed1)
Also removed i686 as OpenWrt replaces it with i386 in $(ARCH).
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit a5c3fd1fee)
Looking at the official CPE dictionary [1], `cpe:/a:nginx:nginx` was
only used until 1.21.4 inclusively. Later it was renamed to
`cpe:/a:f5:nginx`, and it showed up in a few more non-contiguous
versions numbers after 1.21.4.
In all nginx security advisories [2] starting from year 2024, the CPE
ID used is `cpe:/a:f5:nginx_open_source`. This includes versions 1.25.0
and newer.
Update the CPE ID to the newest known value of `cpe:/a:f5:nginx_open_source`
used in nginx's own security advirosies/CVEs.
[1]: https://nvd.nist.gov/products/cpe
[2]: https://nginx.org/en/security_advisories.html
Signed-off-by: Roman Azarenko <roman.azarenko+gh@genexis.eu>
(cherry picked from commit 973a26fc63)
Currently, we are using Download recipes to download the various modules,
however we are using then with PROTO:=git but SOURCE_VERSION is not set,
only VERSION variable so thus the dl_github_archive.py scripts gets called
with --version="" instead of being actually passed the desired commit hash
and thus actually the git head is fetched.
This explains why currently buildbots are failling with
nginx-mod-njs/104-endianness_fix.patch failling to apply since buildbots
are using prepackaged tarballs which are different than what we get when
manually building.
So, lets set SOURCE_VERSION to make sure we actually fetch the desired
git commit hash.
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit ea29db6daa)
Signed-off-by: Roman Azarenko <roman.azarenko+gh@genexis.eu>
Knot Resolver 5.7.6 (2025-07-17)
================================
Security
--------
- DoS: fix a rare segfault in `resolve` function (!1720)
Someone controlling the DNS traffic might be able
to trigger this crash intentionally and too often.
- DoS: drop a wrong assertion/crash (!1721)
Someone controlling the DNS traffic will most likely be able
to trigger this crash intentionally and too often.
Knot Resolver 5.7.5 (2025-04-24)
================================
Security
--------
- DoS: fix unconfirmed crashes with the line below (!1683)
[system] requirement "h && h->end > h->begin" failed in queue_pop_impl
Improvements
------------
- tests: disable problematic config.http test (#925, !1678)
- validator: accept a confusing NODATA proof with insecure delegation (!1678)
Bugfixes
--------
- daemon/http: DoH stream got stuck after returning an error code (!1652)
- stats: request latency was very incorrect in some cases (!1678)
Signed-off-by: Vladimír Čunát <vladimir.cunat@nic.cz>
(cherry picked from commit 4f22b4dceb)
This is long overdue. Honestly I dislike that packaging
is hardcoding it this way. It's error-prone, as we can see.
Knot Resolver source does contain the up to date anchors,
and it also (optionally) installs them. Still, I'm not up to
larger changes in OpenWrt packaging right now.
Signed-off-by: Vladimír Čunát <vladimir.cunat@nic.cz>
(cherry picked from commit 47f8b88f43)
Added upstream patch to fix starting containers with complex hooks.
No existing patches needed to be rebased/simple version bump to 6.0.4.
Build system: x86/64
Build-tested: x86/64
Run-tested: x86/64
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 343f1151f9)
Users running unprivileged containers will need to create
/etc/subgid and /etc/subuid and want to have them preserved
across updates. This commit adds them to the default backup set.
Signed-off-by: John Audia <therealgraysky@proton.me>
Co-authored-by: Tianling Shen <cnsztl@gmail.com>
(cherry picked from commit 6fe80f5586)
Modified 025-remove-unsupported-option.patch to both remove
the bsdtar command as it ends in errors, see below, and to
circumvent an error when extracting to overlayfs[1].
Error when extracting rootfs tarball with bsdtar:
tar --absolute-names --numeric-owner '--xattrs-include=*' -xpJf /var/cache/lxc//download/archlinux/current/amd64//default/rootfs.tar.xz -C /mnt/data/lxc/test/rootfs
./usr/bin/newgidmap: Cannot restore extended attributes on this system: Illegal byte sequence
lxc-create: test: ../src/lxc/lxccontainer.c: create_run_template: 1589 Failed to create container from template
lxc-create: test: ../src/lxc/tools/lxc_create.c: lxc_create_main: 318 Failed to create container test
1. https://github.com/openwrt/openwrt/issues/15888
Signed-off-by: John Audia <therealgraysky@proton.me>
Build system: x86/64
Build-tested: x86/64/AMD Cezanne
Run-tested: x86/64/AMD Cezanne
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 96c96fe041)
Add gnu-tar as a dependency for lxc-create which is needed to
properly extract the root file system tarball. Without it,
symlink target of /bin/tar is busybox and it lacks proper
support to extract with xattrs. The default gnu-tar is actually
built without this support as well, but it is able to extract
the rootfs tarballs with a warning not an error which is not the
case with busybox which ends in an error.
Signed-off-by: John Audia <therealgraysky@proton.me>
Build system: x86/64
Build-tested: x86/64/AMD Cezanne
Run-tested: x86/64/AMD Cezanne
(cherry picked from commit b74dc8a119)
Several deps are missing based the output of lxc-checkconfig shown below
before this commit is applied.
CONFIG_IP_NF_TARGET_MASQUERADE and CONFIG_IP6_NF_TARGET_MASQUERADE are
only needed for lxc-net which we do not package.
% lxc-checkconfig | grep missing
Cgroup device: missing
CONFIG_IP_NF_TARGET_MASQUERADE: missing
CONFIG_IP6_NF_TARGET_MASQUERADE: missing
CONFIG_NETFILTER_XT_TARGET_CHECKSUM: missing
FUSE (for use with lxcfs): missing
checkpoint restore: missing
CONFIG_UNIX_DIAG: missing
CONFIG_INET_DIAG: missing
CONFIG_PACKET_DIAG: missing
CONFIG_NETLINK_DIAG: missing
Additionally, two new patches have been added which remove checks for
options that OpenWrt currently does not package and can serve are
false positives for missing items from our kernel config, namely:
lxc-net and lxc-checkpoint
After applying this commit, below is the output showing that the kernel
config[1] should pass all tests for functionality:
% CONFIG=config ./lxc-checkconfig
LXC version 6.0.3
--- Namespaces ---
Namespaces: enabled
Utsname namespace: enabled
Ipc namespace: enabled
Pid namespace: enabled
User namespace: enabled
Network namespace: enabled
Namespace limits:
cgroup: 383849
ipc: 383849
mnt: 383849
net: 383849
pid: 383849
time: 383849
user: 383849
uts: 383849
--- Control groups ---
Cgroups: enabled
Cgroup namespace: enabled
Cgroup v1 mount points:
Cgroup v2 mount points:
- /sys/fs/cgroup
Cgroup device: enabled
Cgroup sched: enabled
Cgroup cpu account: enabled
Cgroup memory controller: enabled
Cgroup cpuset: enabled
--- Misc ---
Veth pair device: enabled, loaded
Macvlan: enabled, not loaded
Vlan: enabled, not loaded
Bridges: enabled, loaded
Advanced netfilter: enabled, loaded
CONFIG_NETFILTER_XT_TARGET_CHECKSUM: enabled, not loaded
CONFIG_NETFILTER_XT_MATCH_COMMENT: enabled, loaded
--- Checkpoint/Restore ---
checkpoint restore: missing
CONFIG_FHANDLE: enabled
CONFIG_EVENTFD: enabled
CONFIG_EPOLL: enabled
CONFIG_UNIX_DIAG: enabled
CONFIG_INET_DIAG: enabled
CONFIG_PACKET_DIAG: enabled
CONFIG_NETLINK_DIAG: enabled
File capabilities: enabled
1. Generated on 23-Feb-2025 running bcm27xx/bcm2712 on r28869+1
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit ba7e4dccec)
We do not package lxc-net or lxcfs so remove the lines within
lxc-checkconfig that looks forCONFIG_IP_NF_TARGET_MASQUERADE and
CONFIG_IP6_NF_TARGET_MASQUERADE which, as far as I know, is the only
part of lxc that needs them. Also remove the check for FUSE since we do
not pakcage lxcfs.
Without this commit, users will see these two as missing.
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 57434a290d)
No patches needed to be rebased/simple version bump.
Build system: x86/64
Build-tested: x86/64
Run-tested: x86/64
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit f8587b9ec4)
Some platforms lack builtin atomics and use libatomic. Add it.
Backport various patches to fix some warnings.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit e64ca4a0dc)
3.3.9 release includes the following security fix of default gems:
- CVE-2025-24294: Possible Denial of Service in resolv gem
And the following fixes for build issues:
- GCC 15.1
- Visual Studio 2022 Version 17.14
3.3.7 and 3.3.8 are routine update that includes minor bug fixes.
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
(cherry picked from commit 59880e81a6)
Ruby 3.3.6 is a routine update that includes minor bug fixes. It also
stops warning missing default gem dependencies that will be bundled gems
in Ruby 3.5.
Link: https://github.com/ruby/ruby/releases/tag/v3_3_6
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
(cherry picked from commit 2b999558db)
Ruby JSON modules are used to build WebKitGTK.
Include them in the host build.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit c667ae2efb)
changes the relative URL in the PR template to an absolute URL
to resolve a "Not Found" error.
Signed-off-by: Wesley Gimenes <wehagy@proton.me>
(cherry picked from commit ae6fd69de5)
Adjust the variant definition so that DEFAULT_VARIANT is only applied
to the full variant.
Set the title of the full variant to 'full' for menuconfig.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 2e2cc335a6)
The tiny version disables tailscale by default for small package size.
OpenWrt also has the tailscale package as an alternative. We prefer
to keep the base version has the same build tags with the upstream
releases for compatibility.
Signed-off-by: Van Waholtz <brvphoenix@gmail.com>
(cherry picked from commit 16ada8307b)
libtorrent only links to boost headers since boost 1.69.
Remove boost-system from the dependencies and add boost as build
dependency.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 7be94fac37)
README:
* update header
Init-script:
* set an earlier start to get triggers to work
* better str_contains
* improve readability of json() by getting rid of cascading case statements
* add new errors/status messages to get_text()
* prepare get_text() for localization by switching to inline printf
* adjust shellcheck disable comments where needed
* parse unbound config for DNS hijack ports
* test if the archived cache exists on boot and proceed to use it if it does
* add trigger waiting status so that luci app can display correct status
* do not run adb_config_update on boot, speeding up trigger setup
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit ea6111a4a0)
The provided Config.in was never sourced from the Makefile, making it
impossible to toggle TLS support.
This commit adds the necessary Makefile glue to fix this.
Also default to TLS disabled, as was the de-facto case since Config.in
was never sourced (and thus the default 'y' never enabled).
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
(cherry picked from commit 5ffca82f54)
This reverts commit 6356527dd5.
sing-box 1.12.3 is apparently buggy and crashes.
Reference to #27346 and #27339
Let's revert the upgrade.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Provide four new options:
--valid-lifetime
--preferred-lifetime
--max-router-adv-interval
--min-router-adv-interval
Signed-off-by: Jan-Niklas Burfeind <git@aiyionpri.me>
(cherry picked from commit b2f14a5e8d)
Introduce `RUST_{HOST,PKG}_LOCKED` flag (enabled by default) to respect
upstream lockfile. This can be disabled by setting it to 0 if you want
to have up-to-date dependencies.
This change also adds new `CARGO_{HOST,PKG}_ARGS` variable to pass extra
build arguments to cargo.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 1000e99185)
- drop load_environment_flag and always load environment on start, making
restart command great again
- store/restore existing jshn namespace when using json()
- remove unneeded sleepCount in is_wan_up()
- move updated README inside files/
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 51686912e0)
Use upstream solutions to local patches.
Remove test.sh as it's broken.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit cf6ef1ac5a)
CMake is way too opertunistic. Avoid the dependency by manually handling
it.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 9d12a9618a)
Shell expects a matching library version to be installed. Specify a
matching version using EXTRA_DEPENDS.
Signed-off-by: George Sapkin <george@sapk.in>
(cherry picked from commit 5b8e0fd464)
The Alibaba Cloud CLI is a tool to manage and
use Alibaba Cloud resources through a command line interface
Signed-off-by: Bruce Chen <a805899926@gmail.com>
(cherry picked from commit f6e404e96d)
When building kmod-32 package for the first time (clean build_dir), it
builds and installs fine. When building for 2nd time, sometimes
(probably some race condition?) it fails to build in install step with
following error:
for tool in insmod lsmod rmmod depmod modprobe modinfo; do \
ln -s kmod /tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/$tool; \
done
ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/insmod': File exists
ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/lsmod': File exists
ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/rmmod': File exists
ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/depmod': File exists
ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/modprobe': File exists
ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/modinfo': File exists
Lets fix it by backporting upstream fix.
Fixes: #27171
Link: https://lore.kernel.org/r/20240306145804.135709-1-lucas.de.marchi@gmail.com
Upstream-Status: Backport [c5054b2150]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 79f78c0e77)
Added config field to allow insecure TLS ciphers that were disabled
in Go 1.22.
Fixes: #27039
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 80e343dd43)
e5500 is the only powerpc64 target we have in tree, but it's not
supported by golang[1]. Since it's hard to opt e5500 out from the
supported arch list, simply remove powerpc64 from it for now.
1. https://github.com/golang/go/issues/19074
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit c8ad05854d)
Makefile:
- bugfix: change references to melmac.net to melmac.ca
README:
- add basic README with the link to full documentation
Config:
- add heartbeat_domain
- add heartbeat_sleep_timeout
- add sanity_check
- add update_config_sizes
Init Script:
- a lot of visual output improvements, especially with verbosity=2
- better output separation for different verbosity levels
- removed unneeded runningErrorFile
- bugfix: updated runningConfigFile
- updated runningStatusFile and added runningStatusFileLock
- moved append_url() higher up for better visibility
- refactor force-redownload/restart on some config changes functionality
- improve count_blocked_domains
- add internal debug_log() for debugging functions where output is captured
- unified all json add/get calls in the same formatting
- major rework on json() to allow storing of error/warning messages as json objects
- added some error/warning messages
- renamed `cache()` function to `adb_file()` to better reflect functionality
- added functionality to test the dnsmasq config before restarting dnsmasq with ad-blocking
- added functionality to throw warnings if TLDs or leading-dot domains are discovered
in the final block-list file (can be disabled by `sanity_check` option)
- added functionality to test DNS resolution after resolver restart with `heartbeat_domain`
for `heartbeat_sleep_timeout` seconds
- added functionality to revert the resolver's config/ad-blocking if heartbeat domain cannot
be resolved after resolver restart
- added `ALLOWED_TMP` variable/file for better processing of external allow-lists
- added debug output to log with the elapsed time for each step of processing
- drastically improved final block-list optimization with the new awk script
- minor other performance improvements
- added check_tld/check_leading_dot CLI commands to show domains breaking sanity checks
- added validate functions to triggers
Bugfixes:
- fixes: https://github.com/openwrt/packages/issues/27146
- supercedes: https://github.com/openwrt/packages/pull/27159
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit af75ccbb4f)
Makefile:
- add SPDX-Identifier-License
- update Copyright
README:
- add basic README with the link to full documentation
Config:
- add debug_dnsmasq
- add procd_boot_trigger_delay
Init Script:
- move extra_command calls high up for visibility
- bump packageCompat to sync with luci app
- implement support for debug_dnsmasq to dump dnsmasq debug into $packageDebugFile
- create $runningStatusFile json-file allowing more verbose errors/warnings messages
- replaced `state add` calls with json add calls to store errors/warnings messages
- remove no longer needed errorSummary, warningSummary
- ensure environment is only loaded once per run via $load_environment_flag
- bugfix: update is_{host,hostname,domain,ipv4,mac_address} functions to properly sort policy entries
- bugfix: change references to melmac.net to melmac.ca
- add some new error/warning messages
- add delay before service is started on boot via procd_boot_trigger_delay
- bugfix: add logic to identify unknown policy entries instead of silently failing on them
- store error/warning messages as json objects in ubus data for luci app
- update load_validate_config with debug_dnsmasq and procd_boot_trigger_delay entries
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 4b831c6dbf)
* skip rdap requests/replies with placeholders for all IPv4/IPv6 addresses
* sanitize possible bogus config values, e.g. '/dev/null' as a directory
* change URL for beycyber feed
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit ac1076ef95)
2.11.0 will not compile with GCC15, so update to 2.12.0.
It also fixes CVE-2025-31160.
Fixes: #27085
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 90dfd41b51)
Change SECTION variable value from `Utilities` to `utils`,
probably a confusion with the variable CATEGORY.
Signed-off-by: Wesley Gimenes <wehagy@proton.me>
(cherry picked from commit 93d3840f1a)
Change SECTION variable value from `Utilities` to `utils`,
probably a confusion with the variable CATEGORY.
Signed-off-by: Wesley Gimenes <wehagy@proton.me>
(cherry picked from commit 59628aaceb)
Simplify the build invocation and reorder the target list to avoid
failures due the build process changes.
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 95eef0fd58)
The new version of tokio is not compatible with musl:
error[E0432]: unresolved import `tokio::net::TcpListener`
--> src/main.rs:34:13
|
34 | use tokio::{net::TcpListener, task::JoinHandle};
| ^^^^^^^^^^^^^^^^ no `TcpListener` in `net`
error[E0433]: failed to resolve: could not find `UnixListener` in `net`
--> src/main.rs:156:44
|
156 | let listener = tokio::net::UnixListener::bind(socket_path)
| ^^^^^^^^^^^^ could not find `UnixListener` in `net`
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 1716415018)
This is no longer required after commit openwrt/procd@2e206dbe77
("service: add support for triggers on service/instance data changes").
Also remove unused 'name' field.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 12b50193b1)
Dufs is a distinctive utility file server that supports static serving,
uploading, searching, accessing control, webdav...
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 2c8a641e0a)
While backporting the latest version of snort3 into the OpenWrt 24.10,
it looks like that the patches folder was not pushed. Lets fix that.
Fixes: 46d6c499fe ("snort3: update to 3.9.1.0")
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Fix a possible assertion failure when stale-answer-client-timeout
is set to 0. (CVE-2025-40777)
Signed-off-by: Liu Yu <f78fk@live.com>
(cherry picked from commit 283702c29f)
"This dot release replaces 5.8.0 that was missing a couple CMake files
in the tarball and the multicore detection did not compile on MacOS
and other BSDs. Because the Windows executables were not affected I
will not be updating them."
--------------------------------
Release 5.8.0 - January 27, 2025
--------------------------------
added: if present, use multiple cores by default (cli programs only)
added: option --no-threads to force single-threading (cli programs)
fixed: noise issue in hybrid mode (low bitrate / high sample rate)
improved: all new DNS algorithm for better hybrid mode quality
improved: "extra" option with multithreading and hybrid modes
added: TSOC (Composer Sort) added to handled ID3v2 tags
added: --no-overwrite command-line option to wvunpack
fixed: handling of 24+ channels (CoolEdit / Audition)
fixed: encoding raw audio from pipes (Windows only)
fixed: handling of unpacked samples in WAV files
fixed: rare command-line option parsing issue
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit ab6dcf82d6)
ratelimit is a stateful ubus interface to the HTB traffic shaper,
enabling per-client bandwidth limits assignment.
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
(cherry picked from commit 3211b6295b)
New notify-defer configuration option
Removed dependency on libsystemd
Fixed zone deletion issue (GL #5291)
Fixed zone refresh bug (GL #5307)
reset PKG_RELEASE to 1
Signed-off-by: Liu Yu <f78fk@live.com>
Co-authored-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 43681b5420)
Add conditional to disable gperftools-runtime depends for powerpc and mips due to inability
to compile introduced with 7345b73c30
Co-authored-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Signed-off-by: John Audia <therealgraysky@proton.me>
hangelog: https://github.com/snort3/snort3/releases/tag/3.9.1.0
% # snort --version
,,_ -*> Snort++ <*-
o" )~ Version 3.9.1.0
'''' By Martin Roesch & The Snort Team
http://snort.org/contact#team
Copyright (C) 2014-2025 Cisco and/or its affiliates. All rights reserved.
Copyright (C) 1998-2013 Sourcefire, Inc., et al.
Using DAQ version 3.0.20
Using Hyperscan version 5.4.2 2025-06-30
Using libpcap version 1.10.5 (with TPACKET_V3)
Using LuaJIT version 2.1.0-beta3
Using LZMA version 5.6.2
Using OpenSSL 3.5.0 8 Apr 2025
Using PCRE2 version 10.42 2022-12-11
Using ZLIB version 1.3.1
Build system: x86/64
Build-tested: x86/64
Run-tested: x86/64
Signed-off-by: John Audia <therealgraysky@proton.me>
Also bumps setuptools to version 24.0
Run tested: aarch64, Dynalink DL-WRX36, Master Branch
Maintainer: Jeffery To <jeffery.to@gmail.com>
Signed-off-by: Sean Khan <datapronix@protonmail.com>
(cherry picked from commit 49e3c330d4)
Noteworthy changes in version 2.4.8 (2025-05-14)
------------------------------------------------
* gpg: Fix a verification DoS due to a malicious subkey in the
keyring. [T7527]
* gpg: Fix a regression in 2.4.7 for generating a key from card.
[T7457]
* gpg: Fix --quick-add-key for Weierstrass ECC with usage given.
[T7506]
* gpg: Fully implement the group key flag. [rGedd01d8fc4]
* gpg: Make combination of show-only-fpr-mbox and show-unusable-uid
work. [rGeb2a90d343]
* gpgsm: Do not return an error code when importing a certificate
with an empty subject. [T7171]
* scd: Accept P15 cards with a zero-length label. [rG18b4ebb28a]
* keyboxd: Use case-insensitive search for mail addresses. [T7576]
* gpgconf: Fix reload and kill of keyboxd. [T7569]
* w32: Fix posssible lockup due to lost select results.
[rG9448d01d61]
Release-info: https://dev.gnupg.org/T7428
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 3017332949)
As a replacement for this project despite it was resurrected,
it is not maintained.
We added stress-ng [1], which is regularly updated and
gets new features and there is no reason to have two packages
in this repository.
[1] fba6bb9489 ("stress-ng: add")
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 74aaf9c131)
Building sox_ng under certain environments inadvertantly tries to include Speex code.
This patch forces sox_ng to build without Speex codec references.
Signed-off-by: Ted Hess <thess@kitschensync.net>
(cherry picked from commit 2521e8cf86)
Upstream continued developement for SoX (abandoned project v14.4.x)
Added support for opus audio format and wavpack in new builds
Signed-off-by: Ted Hess <thess@kitschensync.net>
(cherry picked from commit 88b086fe45)
knot-resolver will attempt to use jemalloc if it's available.
Jemalloc was added to openwrt packages in PR: Add jemalloc and integrate into bind #26721 [1].
At this time, we would rather continue linking with the libc malloc,
so this PR disables jemalloc support explicitly in the knot-resolver build configuration.
[1] https://github.com/openwrt/packages/pull/26721#issuecomment-2973865778
Signed-off-by: Noah Meyerhans <frodo@morgul.net>
(cherry picked from commit 3413d5bd9c)
Enable building cryptsetup-reencrypt, integritysetup and veritysetup,
add new binary packages for integritysetup and veritysetup.
Changes since version 2.7.4
~~~~~~~~~~~~~~~~~~~~~~~~~~~
* Fix possible online reencryption data corruption (only in 2.7.x).
In some situations (initializing a suspended device-mapper device),
cryptsetup disabled direct-io device access. This caused unsafe
online reencryption operations that could lead to data corruption.
The code now adds strict checks (and aborts the operation) and
changes direct-io detection code to prevent data corruption.
* Fix a clang compilation error in SSH token plugin.
As clang linker treats missing symbols as errors, the linker phase
for the SSH token failed as the optional cryptsetup_token_buffer_free
was not defined.
* Fix crypto backend initialization in crypt_format_luks2_opal API call.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit befdf8a5b2)
A recent change (00d420e80) removed the `output` function, which textfile.lua was
using to output metrics. So use the underlying output handle instead
Signed-off-by: Rob Hoelz <rob@hoelz.ro>
(cherry picked from commit 86e20d37a8)
If PKG_FORTIFY_SOURCE is not 0 and lto is enabled for package git, it
will fail to compile with the following example error:
/openwrt/staging_dir/toolchain-aarch64_generic_gcc-14.1.0_musl/include/stdio.h: In function 'process_curl_messages': /openwrt/staging_dir/toolchain-aarch64_generic_gcc-14.1.0_musl/include/stdio.h:90:8: error: inlining failed in call to 'always_inline' 'fwrite': function body can be overwritten at link time
90 | size_t fwrite(const void *__restrict, size_t, size_t, FILE *__restrict);
| ^
http.c:355:33: note: called from here
355 | fprintf(stderr, "Received DONE message for unknown request!\n");
| ^
A related issue is #13016 .
This commit set PKG_FORTIFY_SOURCE to 0 if CONFIG_USE_LTO is y.
Close#24366
Link: https://lore.kernel.org/git/CAHfWF5mjquES-nocQaK+CAEsqWgdy-_OYdGtN82heYs0eJP3eQ@mail.gmail.com/T/#t
Link: https://github.com/openwrt/openwrt/issues/13016
Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110834
Signed-off-by: Ryan Keane <the.ra2.ifv@gmail.com>
(cherry picked from commit b7bbd42594)
The following error occurs when CONFIG_USE_APK is set.
```
ln /mnt/gl-mt6000-main/openwrt/build_dir/target-aarch64_cortex-a53_musl/git-2.46.2/.pkgdir/git/usr/lib/git-core/git /mnt/gl-mt6000-main/openwrt/build_dir/target-aarch64_cortex-a53_musl/git-2.46.2/.pkgdir/git/usr/bin/git
ln /mnt/gl-mt6000-main/openwrt/build_dir/target-aarch64_cortex-a53_musl/git-2.46.2/.pkgdir/git/usr/lib/git-core/git-shell /mnt/gl-mt6000-main/openwrt/build_dir/target-aarch64_cortex-a53_musl/git-2.46.2/.pkgdir/git/usr/bin/git-shell
touch /mnt/gl-mt6000-main/openwrt/build_dir/target-aarch64_cortex-a53_musl/git-2.46.2/.pkgdir/git.installed
mkdir -p /mnt/gl-mt6000-main/openwrt/staging_dir/target-aarch64_cortex-a53_musl/root-mediatek/stamp
SHELL= flock /mnt/gl-mt6000-main/openwrt/tmp/.root-copy.flock -c 'cp -fpR /mnt/gl-mt6000-main/openwrt/build_dir/target-aarch64_cortex-a53_musl/git-2.46.2/.pkgdir/git/. /mnt/gl-mt6000-main/openwrt/staging_dir/target-aarch64_cortex-a53_musl/root-mediatek/'
cp: '/mnt/gl-mt6000-main/openwrt/build_dir/target-aarch64_cortex-a53_musl/git-2.46.2/.pkgdir/git/./usr/bin/git' and '/mnt/gl-mt6000-main/openwrt/staging_dir/target-aarch64_cortex-a53_musl/root-mediatek/./usr/bin/git' are the same file
cp: '/mnt/gl-mt6000-main/openwrt/build_dir/target-aarch64_cortex-a53_musl/git-2.46.2/.pkgdir/git/./usr/bin/git-shell' and '/mnt/gl-mt6000-main/openwrt/staging_dir/target-aarch64_cortex-a53_musl/root-mediatek/./usr/bin/git-shell' are the same file
make[2]: *** [Makefile:167: /mnt/gl-mt6000-main/openwrt/staging_dir/target-aarch64_cortex-a53_musl/root-mediatek/stamp/.git_installed] Error 1
```
Use $(LN) instead of ln and use relative paths.
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry picked from commit ba445acd7c)
Trying to compile libffi now that automake has been updated to 1.17 will
fail, however there is no reason for us to be calling autoreconf as libffi
release tarballs already contain the generated configure script.
So, drop the unnecessary autoreconf that seems to be leftover from the
previous 3.4.2 bump as we dont have any patches targeting configure.ac nor
libffi in general.
Fixes: openwrt/openwrt#18041
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit c8949c84a2)
3.4.7 Feb-8-2024
Add static trampoline support for Linux on s390x.
Fix BTI support for ARM64.
Support pointer authentication for ARM64.
Fix ASAN compatibility.
Fix x86-64 calls with 6 GP registers and some SSE registers.
Miscellaneous fixes for ARC and Darwin ARM64.
Fix OpenRISC or1k and Solaris 10 builds.
Remove nios2 port.
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 00f28b8281)
Commit 9fc79e2e2622 ("download: don't overwrite VERSION variable")
changed the variable for direct download call from VERSION to
SOURCE_VERSION.
This cause the dl_github_archive script to pass empty value for
--version arg making it always clone HEAD.
Correctly update the variable to SOURCE_VERSION to actually clone the
expected commit HASH.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 7dee8c47f1)
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
The alist was sold to a Chinese commercial company by the project owner
without any clarification. Though the company bought it nearly a half
year ago, they still cannot show a clear roadmap and privacy policy now.
They also tried to collect runtime information from the user, but the
code was not merged into the main tree "luckily".
Anyway, various behaviors from the company indicate they are untrustable,
so the other developers from the alist project have forked and made a new
project named OpenList, which will continue to be maintained by the community.
===== security note =====
The alist code up to 3.45.0 has been reviewed "clean", however the main
problem is from the author's private API that used to connect to cloud drives.
For security reasons, please reset your password and/or token if possible.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit b13bdcbac6)
Fixes: 6746398cb ("yt-dlp: run CI test for the main package only")
Signed-off-by: George Sapkin <george@sapk.in>
(cherry picked from commit fa8425028a)
netclass collector scrape time goes from 230ms to 170ms
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit 00d420e801)
* limit nft logging to a rate 10/second to prevent possible log-flooding
* skip external feed processing if "allowlist-only" mode is fully enabled (in in- and outbound)
* remove needless default icmpv6 rule in wan-input
* refine the housekeeping script (uci-defaults)
* readme update
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit d2599fb6b6)
Request only 'interfaces' status, as we don't use 'connected' and
'policies' status. On my router with 5 wans / 2 tracking IPs per wan,
scrape time goes from 1.90s to 1.30s (still pretty slow but better)
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit caeb4c1834)
With valid 'cert'/'key' config, prometheus-node-exporter-lua
will respond to https instead of http on 'listen_port'.
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit 73f9b9ab79)
hostapd exposes the `hostapd-auth` ubus object. In both
hostapd_ubus_stations.lua and hostapd_stations.lua this object is
incorrectly matched as if it were a wifi phy such as `hostapd.phy0-ap0`.
Using the literal period to find interfaces (^hostapd%.) instead of the
pattern-matching period (hostapd.) fixes this.
fix formatting consistency
Signed-off-by: Michael Payne <10254938+mikepayne02@users.noreply.github.com>
[fix version conflict]
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit 28c085f7c3)
Description:
1. Avoid error on nil value by skipping over it
2. Adds a newline to error messages
Signed-off-by: Amos Shapira <amos.shapira@gmail.com>
[bump version]
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit bb43d5f28e)
This package intercepts/blocks traffic from 'interface' and
redirects http requests to a splash page that you can personalize,
stored in '/etc/simple-captive-portal/'.
After clicking on 'connect' the MAC of the client is allowed,
for 'timeout' seconds (24h), allowing both IPv4 and IPv6.
If your guest interface defaults to input drop or reject (recommended),
make sure to allow tcp 8888-8889 on input (and also dns and dhcp).
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit e0d761e79b)
Update nano editor to version 8.5.
Upstream has fixed the gnulib related cross-compilation problem,
so remove the config hack that was added at the 8.4 update.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit cfdf5fffec)
Files in `/etc/profile.d/` are marked as user configs and won't be
replaced to new version when update the package, so add a migration
script for this.
Fixes: #26709
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit ae33358c4f)
When the syslog-ng installed it records all messages to /var/log/messages.
This makes the default OpenWrt's ubox /sbin/logread useless and return nothing.
The logread script was added to the syslog-ng as a shim.
It's based on `tail /var/log/messages` and repeats basic options that the ubox logread have.
The script is installed instead of the /sbin/logread and this is causes an error.
Instead install it to /usr/libexec/logread.sh and specify as an alternative /sbin/logread.
The ubox logread also needs to be made as alternative in /usr/libexec/logread-ubox.
So we need to give it a separate name.
The most simple and clear would be logread-shell or just logread.sh.
Suggested-by: Andreas Gnau <andreas.gnau@iopsys.eu>
Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
(cherry picked from commit 641ec2b644)
This patch was introduced by me in commit
62513dc576 ("mc: fix mouse handling")
and that commit backported patch from master branch and it that time,
there was not any release, which included it.
Since 4.8.2.5 update, we are still rebasing it, no need to do that.
Fixes: eb0c3b534a ("mc: update to 4.8.25")
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit fa01e8adfc)
If nls.mk is not included and BUILD_NLS is set compilation
will fail with various undefined references to the libiconv
library. So this commit includes the missing nls.mk.
Signed-off-by: Til Kaiser <mail@tk154.de>
(cherry picked from commit d8f2960e14)
Not everyone filling out the bug report is an expert.
These fields, with additional explanations, can hopefully
help users provide more accurate information.
Add fields to guide users in completing the bug report.
Signed-off-by: Wesley Gimenes <wehagy@proton.me>
(cherry picked from commit 38b89da400)
Previously, users could leave fields blank,
resulting in missing information in the bug report.
Now, it is mandatory for all fields to be filled out,
ensuring that no essential information is overlooked.
Signed-off-by: Wesley Gimenes <wehagy@proton.me>
(cherry picked from commit c323222c63)
This is heavily inspired by OpenWrt main repository [1]
as in the packages feed we would like to follow
and be in sync with the main repository.
Having external, well, contact links, where users
can ask or propose feature request and even find links
for documentation or contacting us is a good idea.
Might help to improve the current state of this repository.
[1] 57c104ef7f/.github/ISSUE_TEMPLATE/config.yml
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 1f189894dc)
This replaces the old issue templates with the new one.
It is going to reflect changes and require more details.
Issue Forms as also used in the main repository and in LuCI,
it helps users to create structured issue.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 67dc75f941)
The previous pull request was kinda not exactly tested.
This one should be better and more visible.
Fixes: 9a273c3e79 ("github: Improve Pull Request template")
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit c623dbf30d)
By updating pull request template, this ensures that all newly patches
will be hopefully submitted to upstream, which help us that we dont need to
maintain these patches for ages. Also, all patches should be applied by git am.
This is important, because this follows OpenWrt main repo contribution policy
and we will know, who is the author of the patch and what it does (=
commit subject, commit description).
Also, we don't need to know on which host env, we compiled package.
If there is something host related, we can request details.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 9a273c3e79)
This change follows the structure of GitHub workflow
folders from the main OpenWrt repository, where scripts
are in separate folder.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 91a366e870)
Lets switch to shared workflow in actions-shared-workflows instead of having
this separate file here. It will track and use the latest changes to avoid
being outdated.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 3621fded1e)
* fixed the restore rc handling
* skip allowlist entries during map creation
* disable the map button by default (only enabled if map & NFT counter are selected)
* disable the content filter checkbox for elements with hits by default (only enabled if NFT counter are selected)
* readme update
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 645b0ab137)
The custom Build/Compile definition was overriding the default OpenWrt build logic,
causing issues when compiling with fPIC.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 57d860a6aa)
`-isystem ext` makes `#include <miniupnpc/miniupnpc.h>` actually include `ext/miniupnpc/miniupnpc.h`.
we should use `$(STAGING_DIR)/usr/include` as a higher priority system include path.
Fix https://github.com/openwrt/openwrt/issues/18019
Signed-off-by: Liangbin Lian <jjm2473@gmail.com>
(cherry picked from commit d1b5a6d68f)
* update to SPDX license identified in Makefile
* bugfix: correct HELP line description for sizes command (thanks @justops1337)
* performance fix: updated domains filter (thanks @justops1337)
* bugfix/improvement: more reliable get_url_filesize code with fall-back to
uclient-fetch (thanks @justops1337)
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 73744c3ac5)
This commit updates the mstflint package to the latest
4.30.0 release. It also drops the zlib dependency because
libsqlite3 and libxml2 already depend on it.
Signed-off-by: Til Kaiser <mail@tk154.de>
(cherry picked from commit e337b588a4)
Unannounced modifications (OpenWrt PR 13780) in uci network.lan.ipaddr broke tvheadend init script.
This commit updates the init script to cut the subnet from the ip address reported by uci.
Bug report: #26681
Reported-by: @DonKult
Tested-by: @DonKult
Signed-off-by: Marius Dinu <m95d+git@psihoexpert.ro>
(cherry picked from commit ea07162ee5)
Adjust .json names to match the plugin names: use '-' instead of '_'
Fix commits 033c19a and e36b727 that used a filename differing
from the plugin name used in OpenWrt. That prevented package compilation
to find and include the .json files that were left out of the package.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit beb0de663c)
Package has a consistent Config.in file, but it isn't added to all parts of the file.
libopenldap is unable to be built with --enable-debug because the Config.in is never
attached to the libopenldap.
Signed-off-by: Donald Hoskins <grommish@gmail.com>
* show the IP plus the packet counter in the modal Set content view (or on the CLI)
* add a filter to show only elements with hits in the modal Set content view (or on the CLI)
* limit the element output with hits to max. 50 per Set on the Set Reporting overview page
* fixed set names suffix in the report output
* fixed the Set content view for MAC based Sets
* display the map even if the HomeIP cannot be determined
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 7222ac88f0)
Based on ethtool-lua library, add interface statistics to the
prometheus-node-exporter.
As closely as possible, the behaviour of the implementation at
400c397993/collector/ethtool_linux.go (L208)
is replicated.
Signed-off-by: Kevin Jilissen <info@kevinjilissen.nl>
[squash commits, bump version, fix permission, use untyped, rename to ethtool]
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit 9f94448b71)
The ethtool-lua library is a partial re-implementation of the ethtool.
The goal is to provide the CLI queries and configuration options as a
Lua API.
The reason for staring this library, was the desire for a nice and
efficient way to query DSA switch statistics in the
prometheus-node-exporter-lua on OpenWRT devices. Existing suggestions
around the internet focussed mainly on calling the ethtool CLI program
and parsing the output. This is neither elegant nor efficient, as the
collection time for this implementation was 300% higher on my rtl838x
based switch running OpenWRT.
This package can be easily compiled and packaged for OpenWRT, as it was
initially created as an OpenWRT package.
Signed-off-by: Kevin Jilissen <info@kevinjilissen.nl>
[improve PKG_SOURCE/PKG_SOURCE_URL]
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit 054ba0ce9c)
Fix compilation with gcc 14 by applying the -std=c17 flag, as suggested
by lededev in 2d3f68cc8c (commitcomment-153860241)
(also -c23 seems to work ok with gcc14, but that seems to break gcc13)
Remove the previous autoreconf fix attempt.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 02c134e2ba)
PKG_FIXUP:=autoreconf introduced in this commit[1] to fix builds with GCC 14
does not play well with GCC 13. Apply it conditionally.
I build some coreutils packages under GCC 13 and again under GCC 14 and both
completed successfully.
Build system: x86/64
Build-tested: x86/64
Fixes https://github.com/openwrt/packages/issues/26175
1. b1a648e1ff
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 716cb3deac)
This fixes the build on GCC 14 and solves issue https://github.com/openwrt/packages/issues/26175
Maintainer: hnyman
Compile tested: x86/64, QEMU Standard PC (Q35 + ICH9, 2009), r29064-696ad7b1aa09
Compile tested: ath79/generic, TP-Link Archer C7 v4, r29064-696ad7b1aa09
Compile tested: realtek/rtl838x, Netgear GS108T v3, r29064-696ad7b1aa09
Run tested: x86/64, QEMU Standard PC (Q35 + ICH9, 2009), r29064-696ad7b1aa09, booted and used for 7h without issues
Run tested: ath79/generic, TP-Link Archer C7 v4, r29064-696ad7b1aa09, booted and used for 7h without issues
Run tested: realtek/rtl838x, Netgear GS108T v3, r29064-696ad7b1aa09, booted and used for 7h without issues
Signed-off-by: Pascal Ernster <git@hardfalcon.net>
(cherry picked from commit b1a648e1ff)
Adjust the dependency to the virtual coreutils main package in
each app to be selective. Otherwise you need to first select the
main coreutils before the actuall apps can be selected. That has
prevented other applications from depending on just one individual
coreutils app, as they have needed to depend also on the empty main
coreutils package.
Reference to discussion in:
https://github.com/openwrt/luci/issues/7605
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 82852a9f15)
Have no idea why such dependency was added.
No documentation from transmission that they need
such dependency on build time. On the other hand
saves vast of time during build
Signed-off-by: Serhii Ivanov <icegood1980@gmail.com>
(cherry picked from commit a06829b0a2)
* A new module `uci` added since this version.
* Fix an installation issue: Existing soft links should be preserved when installing libeco.
Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
(cherry picked from commit d1f9862893)
* added a new "divested" feed, see https://divested.dev/pages/dnsbl
* added a new nsfw category of the hagezi feed
* added the missing custom feed file handling in the backend
* added a geoIP map with all blocked domains (plus the homeIP) in a
modal popup window on the Reporting tab in LuCI
* fixed the fetchcmd autodetection
* small code fixes and improvements
* update the readme, added a new "Best practise" section
* update different LuCI components (separate commit)
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 58d0992886)
It needs to be group writable or session.key can't be written once
named drops privileges.
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
(cherry picked from commit b82574b31c)
CVE-2025-40775: Prevent assertion when processing TSIG algorithm. DNS messages
that included a Transaction Signature (TSIG) containing an invalid value in the
algorithm field caused named to crash with an assertion failure. This has been
fixed.
Signed-off-by: Noah Meyerhans <frodo@morgul.net>
(cherry picked from commit bafabd520e)
Until now it was not possible to stop the acme service, because the handling
was done via cron. With this change, the acme handler can now be stopped by
calling '/etc/init.d/acme' stop. This call removes the entry from the crontab.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Since procd is now used, the call of '/etc/init.d/acme' does not have to be
locked separately. This code block can therefore be removed.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
In the current implementation, the config change trigger is no longer set
at boot time. This is because during boot, only the '$CHALLENGE_DIR' is
created with the boot function. The 'start_service' is first called by first
cron call at midnight. This call is installing the service_triggers reload
handling.
To fix this, add a new extra_command 'renew' that is responsible to renew
the acme. This function is called from cron and the start_service
function does the rest.
* Create directories
* Install service reload trigger form acme config change
Fixes: 76f17ab15b (acme-common: Create challenge directory on boot)
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The challenge directory (for webroot challenges) is on a tmpfs, which
means it doesn't exist on boot. Some web servers (uhttpd in particular)
don't like being configured to serve files from a non-existent
directory. So add a boot() section to the ACME init script that just
creates the challenge directory, and make sure it runs relatively early.
That should take care of the non-existent directory issue, while still
keeping the actual certificate renewal controlled by cron.
Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
Verbatim copy from upstream's release notes:
Notes for BIND 9.20.7
- New Features
- Implement the min-transfer-rate-in configuration option.
- A new option min-transfer-rate-in has been added to the view and zone configurations. It can abort incoming zone transfers that run very slowly due to network-related issues, for example. The default value is 10240 bytes in five minutes. [GL #3914]
- Add HTTPS record query to host command line tool.
- The host command was extended to also query for the HTTPS RR type by default.
- Implement sig0key-checks-limit and sig0message-checks-limit.
- Previously, a hard-coded limitation of a maximum of two key or message verification checks was introduced when checking a message’s SIG(0) signature, to protect against possible DoS attacks. Two as a maximum was chosen so that more than a single key should only be required during key rotations, and in that case two keys are enough. It later became apparent that there are other use cases where even more keys are required; see the related GitLab issue for examples.
- This change introduces two new configuration options for the views: sig0key-checks-limit and sig0message-checks-limit. They define how many keys can be checked to find a matching key, and how many message verifications are allowed to take place once a matching key has been found. The former provides slightly less “expensive” key parsing operations and defaults to 16. The latter protects against expensive cryptographic operations when there are keys with colliding tags and algorithm numbers; the default is 2. [GL #5050]
- Bug Fixes
- Fix dual-stack-servers configuration option.
- The dual-stack-servers configuration option was not working as expected; the specified servers were not being used when they should have been, leading to resolution failures. This has been fixed. [GL #5019]
- Fix a data race causing a permanent active client increase.
- Previously, a data race could cause a newly created fetch context for a new client to be used before it had been fully initialized, which would cause the query to become stuck; queries for the same data would be either paused indefinitely or dropped because of the clients-per-query limit. This has been fixed. [GL #5053]
- Fix deferred validation of unsigned DS and DNSKEY records.
- When processing a query with the “checking disabled” bit set (CD=1), named stores the invalidated result in the cache, marked “pending”. When the same query is sent with CD=0, the cached data is validated and either accepted as an answer, or ejected from the cache as invalid. This deferred validation was not attempted for DS and DNSKEY records if they had no cached signatures, causing spurious validation failures. The deferred validation is now completed in this scenario.
- Also, if deferred validation fails, the data is now re-queried to find out whether the zone has been corrected since the invalid data was cached. [GL #5066]
- Fix RPZ race condition during a reconfiguration.
- With RPZ in use, named could terminate unexpectedly because of a race condition when a reconfiguration command was received using rndc. This has been fixed. [GL #5146]
- “CNAME and other data check” not applied to all types.
- An incorrect optimization caused “CNAME and other data” errors not to be detected if certain types were at the same node as a CNAME. This has been fixed. [GL #5150]
- Relax private DNSKEY and RRSIG constraints.
- DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to allow empty key and signature material after the algorithm identifier for PRIVATEOID and PRIVATEDNS. It is arguable whether this falls within the expected use of these types, as no key material is shared and the signatures are ineffective, but these are private algorithms and they can be totally insecure. [GL #5167]
- Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
- Previously, when parsing responses, named incorrectly rejected responses without matching RRSIG records for NSEC/DS/NSEC3 records in the authority section. This rejection, if appropriate, should have been left for the validator to determine and has been fixed. [GL #5185]
- Fix TTL issue with ANY queries processed through RPZ “passthru”.
- Answers to an “ANY” query which were processed by the RPZ “passthru” policy had the response-policy’s max-policy-ttl value unexpectedly applied. This has been fixed. [GL #5187]
- dnssec-signzone needs to check for a NULL key when setting offline.
- dnssec-signzone could dereference a NULL key pointer when resigning a zone. This has been fixed. [GL #5192]
- Fix a bug in the statistics channel when querying zone transfer information.
- When querying zone transfer information from the statistics channel, there was a rare possibility that named could terminate unexpectedly if a zone transfer was in a state when transferring from all the available primary servers had failed earlier. This has been fixed. [GL #5198]
- Fix assertion failure when dumping recursing clients.
- Previously, if a new counter was added to the hash table while dumping recursing clients via the rndc recursing command, and fetches-per-zone was enabled, an assertion failure could occur. This has been fixed. [GL #5200]
- Dump the active resolver fetches from dns_resolver_dumpfetches()
- Previously, active resolver fetches were only dumped when the fetches-per-zone configuration option was enabled. Now, active resolver fetches are dumped along with the number of clients-per-query counters per resolver fetch.
Notes for BIND 9.20.6
- New Features
- Adds support for EDE code 1 and 2.
- Support was added for EDE codes 1 and 2, which might occur during DNSSEC validation in the case of an unsupported RRSIG algorithm or DNSKEY digest. [GL #2715]
- Add an rndc command to toggle jemalloc profiling.
- The new command is rndc memprof; the memory profiling status is also reported inside rndc status. The status shows whether named can toggle memory profiling, and whether the server is built with jemalloc. [GL #4759]
- Add support for multiple extended DNS errors.
- The Extended DNS Error (EDE) mechanism may raise errors during a DNS resolution. named is now able to add up to three EDE codes in a DNS response. If there are duplicate error codes, only the first one is part of the DNS response. [GL #5085]
- Print the expiration time of stale records.
- BIND now prints the expiration time of any stale RRsets in the cache dump.
- Bug Fixes
- Recently expired records could be returned with a timestamp in future.
- Under rare circumstances, an RRSet that expired at the time of the query could be returned with a TTL in the future. This has been fixed.
- As a side effect, the expiration time of expired RRSets is no longer returned in a cache dump. [GL #5094]
- YAML string not terminated in negative response in delv.
- [GL #5098]
- Fix a bug in dnssec-signzone related to keys being offline.
- When dnssec-signzone was called on an already-signed zone and the private key file was unavailable, a signature that needed to be refreshed was dropped without being able to generate a replacement. This has been fixed. [GL #5126]
- Apply the memory limit only to ADB database items.
- Under heavy load, a resolver could exhaust the memory available for storing the information in the Address Database (ADB), effectively discarding previously stored information in the ADB. The memory used to retrieve and provide information from the ADB is no longer subject to the same memory limits that are applied to the Address Database. [GL #5127]
- Avoid unnecessary locking in the zone/cache database.
- Lock contention among many worker threads referring to the same database node at the same time is now prevented. This improves zone and cache database performance for any heavily contended database nodes. [GL #5130]
- Fix reporting of Extended DNS Error 22 (No Reachable Authority).
- This error code was previously not reported in some applicable situations. This has been fixed. [GL #5137]
Compile tested: x86/64, QEMU Standard PC (Q35 + ICH9, 2009), r29064-696ad7b1aa09
Compile tested: ath79/generic, TP-Link Archer C7 v4, r29064-696ad7b1aa09
Compile tested: realtek/rtl838x, Netgear GS108T v3, r29064-696ad7b1aa09
Run tested: x86/64, QEMU Standard PC (Q35 + ICH9, 2009), r29064-696ad7b1aa09, booted and used for 7h without issues
Run tested: ath79/generic, TP-Link Archer C7 v4, r29064-696ad7b1aa09, booted and used for 7h without issues
Run tested: realtek/rtl838x, Netgear GS108T v3, r29064-696ad7b1aa09, booted and used for 7h without issues
Signed-off-by: Pascal Ernster <git@hardfalcon.net>
(cherry picked from commit 2d66b6c8f2)
* update to 2025.05.11 from upstream: a34e20d6e2
* update default config with default value for procd_fw_src_interfaces
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit ece4291596)
- chore(lib): expose model methods to obtain progress
- feat(gui): explanation to options enabled or disabled per folder type
- fix(gui): validate device ID in canonical form
- fix(config): remove discontinued primary STUN server
- fix(stun): better error handling
- chore(config): remove discontinued secondary STUN servers
- chore(fs): speed up case normalization
- build(deps): update dependencies
- feat(fs, config): add support for custom filesystem type construction
- build: replace underscore in Debian version
- chore(model): add metric for total number of conflicts
- fix(config): properly apply defaults when reading folder configuration
- fix(config): zero filesystemtype is "basic"
- build: push artifacts to Azure
- chore(config): resolve primary STUN servers via SRV record
- chore(fs): changes to allow Filesystem to be implemented externally
- fix(strings): differentiate setup(n) and set(v) up
- fix(gui): mark unseen disconnected devices as inactive
- fix(syncthing): use separate lock file instead of locking the
certificate
- feat(api, gui): allow authentication bypass for metrics
- chore: add missing copyright in new files from infra branch
- fix(osutil): give threads same I/O priority on Linux
- chore(syncthing): remove support for TLS 1.2 sync connections
- chore(gui): update dependency copyrights, add script for periodic
maintenance
- chore(api): log X-Forwarded-For
- feat(config): add option for audit file
- chore(gui): use go list --deps for dependency list
- fix(strelaysrv): make the session limiter session-dependent
Changelog: https://github.com/syncthing/syncthing/compare/v1.29.5...v1.29.6
Signed-off-by: George Sapkin <george@sapk.in>
(cherry picked from commit 9f78bed3f8)
* do not display errors on negated values
* improved output in verbose mode
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit a443f2e200)
As of netatalk-4.2.0 the iniparser library is a prerequisite.
Signed-off-by: Antonio Pastor <antonio.pastor@gmail.com>
(cherry picked from commit 7cd8b345e4)
Package is present in multiple linux distributions.
Upstream is actively maintained.
Signed-off-by: Antonio Pastor <antonio.pastor@gmail.com>
(cherry picked from commit 456d8ff5d5)
Small issues with sample configureation caused services not to start
or flood log with errors.
Signed-off-by: Antonio Pastor <antonio.pastor@gmail.com>
(cherry picked from commit fa2eb8bf78)
ack would always set a return code of 1 if -c was used. Now it properly
returns 1 if no files match, and 0 if any files match.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit b6b9cd38fa)
The python package now works with Python 3.11.
Also simplify Build/InstallDev with CMAKE_INSTALL.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 800924c435)
Description: fix in full compile a firmware
pkg_hash_check_unresolved: cannot find dependency aria2-openssl for aria2
pkg_hash_fetch_best_installation_candidate: Packages for aria2 found, but incompatible with the architectures configured
satisfy_dependencies_for: Cannot satisfy the following dependencies for luci-app-aria2:
aria2-openssl
opkg_install_cmd: Cannot install package luci-app-aria2.
Signed-off-by: Lunatic Kochiya <125438787@qq.com>
(cherry picked from commit 2a1b4a2035)
* add an uci-defaults script for housekeeping and option migration from former versions
* small fixes and improvements
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 5402f8eea1)
1ab3208a1fceb12fca8f24ba57d6e13c5bff15e3 'lua.h' back to redundancy in version definitions
21ff8de33a5aca9c3c907592b894e4b9ab036d3e Bug: Tricky _PROMPT may trigger undefined behavior
7eb1ed21b7057ab5f1b921f8271eddcf13659737 More permissive use of 'errno'
2db966fcbf757775c842bc66449d7e697826aa1d Bug: luaL_traceback may need more than 5 stack slots
ae9a0cbbb446499e759acae47664d1d136d7ba90 Bug: overlapping assignments
d5212c13b081ed62d8e1ae436779e79c79edf564 More disciplined use of 'errno'
e0efebdbe4e4053c6fb78588c546f1dc23aa964a Detail in the manual
e84f7bf19852c35ad0a1e9a1654a7b99a211e17c Details
dfbde4c7d540f81f2cc539741a2c1f4c00f91c10 Bug: Active-lines for stripped vararg functions
de794a6527058e75b674118b35f39dcbb13e88b1 Towards release 5.4.7
8b83417de982d068bd92e0428a42ca0cdd909789 Avoids a warning when lua_Number is 'float'
e288c5a91883793d14ed9e9d93464f6ee0b08915 Bug: Yielding in a hook stops in the wrong instruction
5853c37a83ec66ccb45094f9aeac23dfdbcde671 Bug: Buffer overflow in string concatenation
842a83f09caa2ebd4bc03e0076420148ac07c808 Panic functions should not raise errors
7923dbbf72da303ca1cca17efd24725668992f15 Bug: Recursion in 'getobjname' can stack overflow
81e4fce5303fdb274bc5572fb168dd766fb8208e Simpler test in 'luaH_getint'
6baee9ef9d5657ab582c8a4b9f885ec58ed502d0 Removed test for "corrupted binary dump"
edd8589f478e784bb8d1a8e9a3bb2bb3ca51738c Avoid casts from unsigned long to floating-point
07a9eab23ac073362f231ddc7215688cf221ff45 Cannot use 'getshrstr' before setting 'shrlen'
9363a8b9901a5643c9da061ea8dda8a86cdc7ef1 Documentation for "LUA_NOENV"
5ab6a5756b3c50c99f1388885e9a48a7da8cbe2d Bug: Wrong line number for function calls
9b4f39ab14fb2e55345c3d23537d129dac23b091 More disciplined use of 'getstr' and 'tsslen'
f4211a5ea4e235ccfa8b8dfa46031c23e9e839e2 More control over encoding of test files
1b3f507f620d996ffb69da7476a19251acfb89ca Bug: Call hook may be called twice when count hook yields
6b51133a988587f34ee9581d799ea9913581afd3 Thread stacks resized in the atomic phase
cbae01620278f9b568805db16a96d0631ced473d Details
ea39042e13645f63713425c05cc9ee4cfdcf0a40 Removed redundancy in definitions of version/release
05ec55f16b389a4377adab84efe374437da8dbd2 Avoid inclusion loop in 'ltm.h'
f623b969325be736297bc1dff48e763c08778243 Bug: read overflow in 'l_strcmp'
9be74ccc214eb6f4d9d0b9496fd973542c7377d9 Several functions turned 'static'
09f3c2372f5dbeaec9f50614a26c1b5761726a88 Option '-l' discards version sufix from file name
c197885cb00b85251c35cffdc4057efaee2d7a88 Small improvements in tests
934e77a286aeb97ca02badf56956ccc78217e9d0 Details
Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
(cherry picked from commit 769e8f9d2d)
* realtek-poe was only being built for realtek/rtl838x with mips-4kec
* needed by targets in realtek/rtl839x with mips-24kc
Signed-off-by: Stephen Howell <howels@allthatwemight.be>
(cherry picked from commit 6ade11fc3a)
Update to 1.29.2 and Change logfile path from /etc/syncthing/syncthing
log to /var/log/syncthing.log.
This utilizes tmpfs (memory-based storage) to prevent disk usage growth
caused by log file accumulation during extended operation.
Benefits:
- Avoids storage saturation from excessive log growth.
- Aligns with best practices for temporary log management.
- For systems using flash storage (e.g., SSDs or eMMC), storing logs in
tmpfs avoids flash memory wear caused by frequent writes to
/etc/syncthing.
Signed-off-by: Yun Wang <maoerpet@foxmail.com>
(cherry picked from commit 85fa8cfe0b)
Signed-off-by: George Sapkin <george@sapk.in>
Add missing syscalls found with `/etc/init.d/transmission trace`.
fix crash on boot on x86_64 platform
Signed-off-by: Liangbin Lian <jjm2473@gmail.com>
(cherry picked from commit d827297546)
* add an uci-defaults script for housekeeping and option migration from former versions
* update the readme
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 519c7fcf96)
* checked and fixed the kresd and smartdns support
* fixed another ETAG issue
* changed the enabled feeds in default config to certpl, aguard and adguard_tracking
* various other small fixes
* update the readme
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 3e99991067)
* minor ETAG fixes and improvements
* permanently set the addnmount option for dnsmasq
* cosmetics
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit d10813d62f)
* added a 'DNS Shift' option, where the generated final DNS blocklist is moved to the backup directory and
only a soft link to this file is set in memory. As long as your backup directory is located on an external drive,
you should activate this option to save disk space
* added ETAG-Header support to make sure to download only feeds that has been changed,
use backups otherwise (not supported by uclient-fetch)
* removed aria2 support
* added brave as a new safesearch provider
* removed the racist terminology from the local lists and renamed it to "allowlist" and "blocklist"
* removed the 'list' and 'timer' function from init, use the LuCI feed editor and the standard cron frontend instead
* various code changes and improvements
* major LuCI frontend changes, incl. a custom feed editor (separate commit)
* partial readme update
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 4857db8e28)
Security fixes:
CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
Security scope: OpenVPN servers between 2.6.1 and 2.6.13 using --tls-crypt-v2 can be made
to abort with an ASSERT() message by sending a particular combination of authenticated and
malformed packets. No crypto integrity is violated, no data is leaked, and no remote code
execution is possible. This bug does not affect OpenVPN clients.
For details refer to https://github.com/OpenVPN/openvpn/blob/v2.6.14/Changes.rst
Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>
musl libc does not support this feature, and for glibc, additional
library libasan is required. Disable it explicitly to avoid build issue
when CONFIG_DEBUG is selected.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 1fc56e79d5)
Libarchive 3.7.9 is a bugfix release, fixing a regression in libarchive
3.7.8 regarding GNU sparse entries was fixed.
Libarchive 3.7.8 is a bugfix and security release:
Security fixes:
* tar reader: Handle truncation in the middle of a GNU long linkname (CVE-2024-57970)
* unzip: fix null pointer dereference (CVE-2025-1632)
* tar reader: fix unchecked return value in list_item_verbose() (CVE-2025-25724)
Important bugfixes:
* 7zip reader: add SPARC and POWERPC filter support for non-LZMA compressors
* tar reader: Ignore ustar size when pax size is present
* tar writer: Fix bug when -s/a/b/ used more than once with b flag
* cpio: Fix a Y2038 bug on Windows
* libarchive: Handle ARCHIVE_FILTER_LZOP in archive_read_append_filter
* libarchive: Adding missing seeker function to archive_read_open_FILE()
Full Changelog: https://github.com/libarchive/libarchive/compare/v3.7.7...v3.7.8
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 4803944c5a)
libarchive fixed a lot of security issues in the last few releases, listing only
notable changes,
libarchive 3.7.5:
* rar4: protect copy_from_lzss_window_to_unp() CVE-2024-20696
* rar4: fix CVE-2024-26256
libarchive 3.7.6:
* this release fixes a tar regression introduced in libarchive 3.7.5
libarchive 3.7.7:
* gzip: prevent a hang when processing a malformed gzip inside a gzip (OSS-Fuzz)
* tar: don't crash on truncated tar archives (OSS-Fuzz)
* tar: fix two leaks in tar header parsing
Link: https://github.com/libarchive/libarchive/releases
Signed-off-by: Matthias Franck <matthias.franck@softathome.com>
(cherry picked from commit 39b1179bd6)
* the ETAG function now supports country and asn feeds as well
* fixed becyber URL and other small fixes
* LuCI fixes and improvements (separate commit)
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 7383b4817b)
Update nano edit to version 8.4.
Add configure flags to overcome upstream bug 66978, where the newly added
gnulib module for strcasecmp always fails in the configure step when
cross-compiling.
https://savannah.gnu.org/bugs/?66978b2927d1b1f
The added flags disable the strcasecmp function from gnulib.
If upstream (gnulib?) fixes things later, the flags should be removed.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 3d055f8dfb)
Fixes CVE-2025-26794 (SQL injection when using SQLite for ETRN hints)
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 05f82abaa7)
1) Added the ability to route different domains through different gateways, up to 32 routes.
2) The program has been switched from proxying mode to sniffer mode.
3) Blacklist has been added so that the specified subnets are not added to the routing table.
4) Log updated.
5) The "output" option has been removed from the service, it is now /tmp/antiblock
Signed-off-by: Khachatryan Karen <karen0734@gmail.com>
Docker's backend storage driver can be configurable for certain
filesystems. The default is the overlay storage driver, but if you run
openwrt on a system with btrfs, this will allow you to override the
default configuration by settings the storage_driver in uci in dockerd's
global section. This value will be used in the created dockerd.json
file.
Signed-off-by: Keith T. Garner <kgarner@kgarner.com>
(cherry picked from commit f2aa53cdef)
* fixed a JSON reporting issue (when the map and NFT counters are disabled)
* optimized the getfetch function call within the reporting function
* removed the stale IPv6 links in the becyber feed
* cosmetics
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 251f58d513)
* added a geoIP Map to show home IPs and potential attacker IPs on a leafletjs based map
* significantly improved the reporting performance on multicore hardware
* removed aria2 support (it doesn't support post data requests)
* removed the following outbound feeds due to too many false positives:
adaway, adguard, adguardtrackers, antipopads, oisdbig, oisdnsfw, oisdsmall, stevenblack and yoyo
* renamed the banIP command "survey" to "content"
* various other small tweaks
* update the readme
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 716e73da56)
go1.23.7 (released 2025-03-04) includes security fixes to the net/http
package, as well as bug fixes to cgo, the compiler, and the reflect,
runtime, and syscall packages.
Signed-off-by: George Sapkin <george@sapk.in>
Feature changes:
- on non-windows clients (MacOS, Linux, Unix) send "release" string from uname() call as IV_PLAT_VER to server
- Windows: protect cached username, password and token in client memory
- Windows: use new API to get dco-win driver version from driver
- Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default timeout of 90 seconds
Security fixes:
- improve server-side handling of clients sending usernames or passwords longer than USER_PASS_LEN
Notable bug fixes:
- FreeBSD DCO: fix memory leaks in nvlist handling
- purge proxy authentication credentials from memory after use
For details refer to https://github.com/OpenVPN/openvpn/blob/v2.6.13/Changes.rst
Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>
Updated and removed upstreamed patch.
Highlights relating to security:
* Fix CVE-2025-26465 - ssh(1) in OpenSSH versions 6.8p1 to 9.9p1
(inclusive) contained a logic error that allowed an on-path
attacker (a.k.a MITM) to impersonate any server when the
VerifyHostKeyDNS option is enabled. This option is off by default.
* Fix CVE-2025-26466 - sshd(8) in OpenSSH versions 9.5p1 to 9.9p1
(inclusive) is vulnerable to a memory/CPU denial-of-service related
to the handling of SSH2_MSG_PING packets. This condition may be
mitigated using the existing PerSourcePenalties feature.
Both vulnerabilities were discovered and demonstrated to be exploitable
by the Qualys Security Advisory team. We thank them for their detailed
review of OpenSSH.
Full release notes: https://www.openssh.com/txt/release-9.9p2
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 67784bf4d0)
The -r option is not required here but should also not hurt,
since it was already tested, that $key is a file.
However, to express the intent of the command more clearly,
let's drop it.
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 9ef2d15c29)
Imitate dropbear init.d-script and make sure we
don't end up with corrupt keys.
This can happen if we use a caching filesystem,
like 'ubifs', and the DUT is powered off during
boot-up.
Signed-off-by: Markus Gothe <markus.gothe@genexis.eu>
(cherry picked from commit 69c29a5b26)
Starting with OpenSSH 9.8 sessions are handled by a separate binary
called sshd-session
Signed-off-by: Erik Karlsson <erik.karlsson@iopsys.eu>
(cherry picked from commit 3ac8092a39)
Dropped:
003-without-vendored-meson.patch
004-workaround-for-multiple-top-level-packages-discovered.patch
This time, we really need to use meson to build numpy.
And to make things more complicated, the 'vendored' meson package (that
comes with numpy) must be used. This is because they have some special
logic in there that's specific to numpy.
With this change, we also need to keep a special/internal
'openwrt-cross.txt.in' file, because cross-compiling numpy also requires
that a 'longdouble_format' property be added.
More details about this:
https://github.com/numpy/numpy/issues/23972https://github.com/numpy/numpy/blob/maintenance/2.2.x/doc/source/building/cross_compilation.rst
Removing quirk fix for x86_64 with detecting 'avx512f'.
This should work with the new meson stuff.
And finally, added a test.sh script.
This should make sure that this package works fine during upgrades.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 7b4ee2dabf)
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Fixes podman build breakage which was caused by podman depending on
netavark, which in turn depends on rust-iptables.
rust-iptables requires rust 1.85.0 since commit 75825cd
75825cd9c1
Signed-off-by: Jonathan McCrohan <jmccrohan@gmail.com>
(cherry picked from commit c675028528)
* fix a race condition in the process scheduler
* sync the banIP country file with ipdeny feed
* refine etag handling with country/asn feeds
* refine logging with country/asn feeds
* refine the banIP status output (incl. LuCI changes)
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 764a77acfd)
* fix an out of bound error reported in the forum
* set always a default for "adb_dnsdir" to prevent cornercase issues
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit dd4e3e336d)
* optimized uci config processing (list options)
* optimized icmp rules in pre-routing (thanks @brada)
* set inbound marker in pre-routing only if inbound logging is enabled (fixes#26044)
* fix cornercase in Set removal function
* print chain-, set- and rules-counter in the banIP status
* clean up logging und download queue handling
* update the readme
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit d5cd6f3cf2)
Prevents IPv6 updates to also update IPv4 (undesirable when behind a CGNAT)
Signed-off-by: Dimitri Souza <dimitri.souza@gmail.com>
(cherry picked from commit 65cbccfded)
DigitalOcean API requires a "type" JSON field to update a DNS
record. This adds that while checking for IPv6 to change which
record type to use. Without it, the API call fails, making
the script unable to update the DNS records for DigitalOcean.
Signed-off-by: Adam Beck <subcursion@gmail.com>
(cherry picked from commit 1302e503a3)
If pppoe is used for wan access. script set 'eth1' as interface for curl
call. The correct interface is however 'pppoe-wan'.
These scripts use 'network_get_physdev' function to get real device for
bind_network but this is wrong. We need instead the l3_device of the the
logical interface.
In case if we don't use pppoe connection - 'l3_device' is equal to real device.
Follow P/R:
#14431
Signed-off-by: Coia Prant <coiaprant@gmail.com>
(cherry picked from commit 9cd00fb191)
Migrate retry_count to retry_max_count in the script to fix infinite retry loop.
Signed-off-by: FriesI23 Qin <FriesI23@outlook.com>
(cherry picked from commit 0dceb9d0f1)
Using the PUT method recreates the DNS record with and only with
the newly provided data. This seems unnecessary. In particular,
we don't need to hardcode a TTL of 120. Any existing comment
would be lost too.
The only detail we need to change is the IP address. Leave everything
else as it was.
Signed-off-by: Gedalya Nie <gedalya@gedalya.net>
(cherry picked from commit 0a98b6d0ed)
* add memory measurements:
- free memory in MB (MemAvailable from /proc/meminfo)
- script run max. used RAM in MB (VmHWM from /proc/$$/status)
* removed the obsolete (domain) lookup command in init script
* update the readme
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 884876c7e1)
Move working directory from `/var/adguardhome` to
`/var/lib/adguardhome`, according to Linux FHS.
Add option to store PID file, defaulting to `/run/adguardhome.pid`.
Signed-off-by: Ryan Keane <the.ra2.ifv@gmail.com>
(cherry picked from commit c3a33e10a5)
go1.23.5 (released 2025-01-16) includes security fixes to the
crypto/x509 and net/http packages, as well as bug fixes to the
compiler, the runtime, and the net package.
go1.23.6 (released 2025-02-04) includes security fixes to the
crypto/elliptic package, as well as bug fixes to the compiler
and the go command.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 86b0144211)
* properly handle forced DNS ports <> 53,
no longer make bogus local redirects, reject them instead (fixed#25897)
* support the jail mode for smartdns
* cosmetics
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 7699651f6c)
* optimized the f_nftload function
* reduced the prerouting priority to -175
* optimized the output of the f_survey function
* removed a needless fw4 call/check
* no longer skips regular blocklist feeds in "allowlist only" mode
* optimized init checks
* turris feed: enable IPv6 parsing, too (prvided by @curbengh)
* update the readme
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 4e3d7845fd)
* Improve verbose output on start
* Allow to not create ip rule for WG server
* Improve boot up start (take 2)
* Improve verbose output when setting triggers
* Override DNS hijack with DNS policies from pbr
Signed-off-by: Stan Grishin <stangri@melmac.ca>
* bugfix: working start on boot when interfaces are up
(thanks @tmcqueen-materials and @b1ackbeat)
* improvement: better output when setting triggers on start
Signed-off-by: Stan Grishin <stangri@melmac.ca>
Updated hashmap version.
In the code, almost all the url words have been replaced with domain.
Fixed a bug in the service of getting gateway from VPN name.
Signed-off-by: Khachatryan Karen <karen0734@gmail.com>
(cherry picked from commit f53f96d37c)
Support for EAP-MSCHAPv2 authentication scheme is added.
Different from the previously supported schemes, this one is
usually asymmetric in the way that server auth method (pubkey) is
different from the client auth method (eap-mschapv2).
The code handles this asymmetry automatically.
A new UCI config section mschapv2_secrets is added where the user
can specify the EAP identities and their passwords that are
accepted by the server. AFAIK, there is no way to select which
EAP IDs should be accepted by which remote, except setting
`eap_id` to something different than `%any`. But `eap_id`
does not support template matching, so either only a single
identity or all can be configured for one remote. This is why
the EAP identities are not subsections of remotes, but are
a standalone section.
Signed-off-by: Martin Pecka <peci1@seznam.cz>
Signed-off-by: Martin Pecka <peckama2@fel.cvut.cz>
(cherry picked from commit 88d1876f38)
Before this commit, if a user configures multiple remotes in UCI,
each remote generates one output section of pools.
This doesn't hurt because swanctl just merges all of them,
but it is apparently not needed to have N copies of the same.
This commit changes the behavior to only create one pools
section at the end of the generated swanctl config.
Signed-off-by: Martin Pecka <peci1@seznam.cz>
Signed-off-by: Martin Pecka <peckama2@fel.cvut.cz>
(cherry picked from commit 6b824ee7d7)
The following error occurs when creating storage configuration in WEBUI:
```
Failed to save config after 10 tries: failed to create temp file for new config: open /etc/rclone/rclone.conf4258227003: permission denied
```
we should set the owner of the parent directory of the configuration
file to rclone.
Signed-off-by: Liangbin Lian <jjm2473@gmail.com>
[split chown command, wrap commit message]
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit bcd87dd8b6)
Small version includes only AFP file sharing to minimize size.
Base version adds AppleTalk. This matches the contents of the
existing package.
Full version includes everything that OpenWrt can support and
configuration option for build system (menuconfig).
Signed-off-by: Antonio Pastor <antonio.pastor@gmail.com>
(cherry picked from commit 0bd99d1cbb)
* fixed the incomplete rule maintainance during banIP reloads
* fixed the Set query function (if the Set counters are disabled)
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit bf2fb994fa)
* improvement: Makefile: prepend `r` to PKG_RELEASE in binary and init script versions to match package version
* bugfix: init script: more reliable/robust start on boot
* improvement: init script: more compact output()
* improvement: init script: better DNS Hijack login
* improvement: init script: fold some dnsmasq-related functions into dhcp_backup()
Signed-off-by: Stan Grishin <stangri@melmac.ca>
* support smartdns as dns backend
* support top level domains in local white- and blackklist,
e.g. a 'de' in the blacklist blocks all domains with a german tld
and the tld compression removes all subdomains from the final blocklist
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit f9effa495e)
Block HTTP/3 by including UDP in the feeds that have the 80 443 ports in
their flag.
Signed-off-by: Juan Orti Alcaine <jorti@pm.me>
(cherry picked from commit f80fbec40f)
This is a security release.
Notable Changes
CVE-2025-23083 - throw on InternalWorker use when permission model is enabled (High)
CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)
Dependency update:
CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* change the chain structure: only two regular chains contain the generated banIP sets.
“_inbound” covers the base chains WAN-Input and WAN-Forward, ‘_outbound’ covers the base chain LAN-Forward.
* pre-configure the default chains for every feed in the banip.feeds json file, no longer blocks
selected feeds in all chains by default
* it's now possible to split country and asn Sets by country or asn (disabled by default)
* support Set counters to report easily suspicious IPs per Set (disabled by default)
* make it possible, to opt out certain chains from the deduplication process
* the element search now returns all matches (and not only the first one)
* the report engine now includes statistics about the Inbound & Outbound chains and the Set counters (optional)
* save the temp. files of possible nft loading errors in "/tmp/banIP-errors" by default for easier debugging
* various code improvements
* remove ssbl feed (deprecated)
* add two new vpn feeds
* update the readme
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 80768dfdae)
AntiBlock program proxies DNS requests.
The IP addresses of the specified domains are added to
the routing table for routing through the specified interface.
Signed-off-by: Khachatryan Karen <karen0734@gmail.com>
(cherry picked from commit 64f1a2835d)
Summary of three PRs regarding new adblock sources with minor changes/additions:
- add new source reg_lithuania, PR provided by @Myginas
- add new source certpl, PR provided by @jkostorz
- add new source oisd_nsfw_small, PR provided by @Turjoy9
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit cd89956c13)
* remove indentation in postinst/prerm/postrm scripts to fix issues with APK
* rework hijack logic to redirect port 53 to the port of active/selected dnsmasq instances
Signed-off-by: Stan Grishin <stangri@melmac.ca>
go1.23.4 (released 2024-12-03) includes fixes to the compiler, the
runtime, the trace command, and the syscall package.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit edab60b0f8)
Currently we're seeing random build failures, caused by autofoo being
called on very ancient bundled autofoo:
cd . && aclocal
aclocal.real: warning: autoconf input should be named 'configure.ac', not 'configure.in'
acinclude.m4:2: warning: underquoted definition of AC_REPLACE_GNU_GETOPT
acinclude.m4:2: run info Automake 'Extending aclocal'
acinclude.m4:2: or see https://www.gnu.org/software/automake/manual/automake.html#Extending-aclocal
configure.in:106: error: automatic de-ANSI-fication support has been removed
For some reason that `touch` based neutralization introduced in commit
6d6c4b21b5 ("lrzsz: update to v0.12.21rc and fix a CVE") doesn't
always work.
So lets fix it by removing the autofoo bits from the bundled Makefile.in
and while at it remove processing of man and testsuite subdirs to save
some computing cycles.
Fixes: #25543
Fixes: 6d6c4b21b5 ("lrzsz: update to v0.12.21rc and fix a CVE")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 3e61258604)
* add support for mbedtls 3.0.0
* fix newline in init script
Signed-off-by: Moritz Warning <moritzwarning@web.de>
(cherry picked from commit e0d8a72da0)
qemu need a recent version of python build , this is visible when you build with the docker image of the sdk see https://github.com/openwrt/docker/
error generated during the build : found no usable tomli, please install it
Signed-off-by: Erwan MAS <erwan@mas.nom.fr>
(cherry picked from commit edad451a84)
WFB-ng is long-range packet radio link based on raw WiFi radio.
Adding it to openwrt base packages will help a lot of it users
to use cheap wifi routers (supporting minitoring mode) instead
of build custom hardware yourself.
Signed-off-by: Vasily Evseenko <svpcom@gmail.com>
(cherry picked from commit 2c171be2b4)
APK is now the default, the SDK action will try to compile things and
fails if the version doesn't fit.
Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit 57394d53af)
- manually refresh patch 030-glib.patch
Major changes are:
fix adduser / addshare prompting on musl libc
fix use of veto files as global share parameter
lookup primary group and don't recurse in ksmbd.conf @group handling
fix a leak and an intermittent auth failure in Kerberos 5
add global parameter kerberos support
detailed changelog here: https://github.com/cifsd-team/ksmbd-tools/releases/tag/3.5.3
Signed-off-by: Andrea Pesaresi <andreapesaresi82@gmail.com>
(cherry picked from commit 5b058c9949)
Maintainer: me
Compile tested: x86_64, Dell EMC Edge620, OpenWrt 24.10.0-rc2
Run tested: x86_64, Dell EMC Edge620, OpenWrt 24.10.0-rc2
Description:
* stop building netifd flavour until netifd isuees are resolved
* improve output()
* improve inline_set()
* improve is_config_enabled()
* bugfix is_domain()
* improve is_supported_protocol()
* improve is_supported_interface()
* bugfix is_tor_running()
* improve ipv4_leases_to_nftset()
* improve ipv6_leases_to_nftset()
* add check for ip-full binary on start
* bugfix: load environment on boot
* bugfix: hack around dnsmasq confdir instances
* bugfix: IPv6-related fixes for internet_routing() and status_service()
* improve netifd setup by bringing code into the init script from uci-defaults
* bugfix: do not attempt to use IPv6 prefixes in pbr.user.aws if IPv6 support is disabled in pbr config
Signed-off-by: Stan Grishin <stangri@melmac.ca>
Maintainer: Antonio Pastor / @APCCV
Compile tested: ipq806x (24.10-rc2, snapshot)
Run tested: ipq806x - C2600 (snapshot): install apk, start/stop sfpd service & review logs
Description:
Bump to version 4.0.7
Signed-off-by: Antonio Pastor <antonio.pastor@gmail.com>
(cherry picked from commit c487146f17)
Sunwait calculates sunrise or sunset times with civil, nautical, astronomical and custom twilights.
It is intended for use in home automation with Windows Task Scheduler or cron. Use it to turn lights on before it gets dark! The program can wait from invocation until the event specified on the command line occurs or it can return immediately indicating if it is day or night. It's best to schedule Sunwait to run a little before the earliest opportunity for the event to occur each year - ie dusk range is 3:30pm to 10:30pm here, so it reasonable to schedule a dusk task at 3pm and allow Sunwait to pause the task for between 30mins and 7 and a half hours. If you scheduled the task for 6pm, then your lights will come on no earlier than 6pm.
The sun's position is calculated using time, and position - latitude and longitude should be specified on the command line.
Features:
Calculates sunrise and sunset for given coordinates
Can wait for sunrise/sunset, or return DAY or NIGHT codes
Works with Windows Task Scheduler (or cron)
Supports custom twilight angles
Used to automate domestic lighting with Arduino transmitter and radio controlled sockets
Signed-off-by: Stan Grishin <stangri@melmac.ca>
* correctly parse json objects with hyphens in the autodetection functions
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 823633c0e6)
Changes since v0.12:
7fb6416 tests: fix segfault with no /etc/protocols (#286)
0dddc42 README: Update branch references in badge URLs
5eea3f4 github: Update branch names for actions
b102523 scripts: get debug info for bug reports
334bb9c Make listening socket creation optional. (#297)
a4e7b65 {etc,man}: improve check_route address notification flag documentation (#301)
ffa276f Support ELL 0.68 l_netlink_message API. (#303)
269f10a gh: daily validation of the ELL compatibility (#308)
824ff8c Support listener events (#304)
5d9f33a Some clean-ups (#305)
05a08bf lib: switch to v4.0.1: only added items (#306)
3702487 scripts: debug: also print system info (#307)
5d8db15 ell: only include 'ell/ell.h' header (#309)
772afe9 AUTHORS: Update e-mail addresses.
0c36dba mptcpd 0.13
Drop backported patches which are part of the release.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 46e1b60f5d)
* correctly parse json objects with hyphens in the autodetection function
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 3140259fc6)
* optimized procd settings for better performance
* made the log monitor working again (even on master with apk migration issues)
* reworked the fetch autodetection function (still broken in master due to apk migration)
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 8609a5bbe5)
* optimized procd settings for better performance
* reworked autodetection functions (still broken in master due to apk migration)
* made the tld function optional, set 'adb_tld' accordingly (enabled by default)
* reworked count function
* various code improvements
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 8afc26fafb)
go1.23.3 (released 2024-11-06) includes fixes to the linker,
the runtime, and the net/http, os, and syscall packages.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit b9dc86034b)
Adjust version to be compatible with apk's semanting versioning.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 252efdc342)
Make PKG_VERSION compatible with apk by dropping the C char,
simplifying Makefile also otherwise. Also remove unnecessary
variables.
Refresh patches (just cosmetics for CI).
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 69f5605e5a)
Make version compatible with the apk package manager.
Add short explanation about rtklib purpose to the menu item.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 454e232e5b)
APK versions use dots instead of dashes, so update EXTRA_DEPENDS to make it
APK compatible.
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 49ef6ff303)
Commit 5e69da4ccb upgraded openwisp-monitoring
to version 0.2.0 but missed necessary Makefile adjustments, causing the
package to break in OpenWrt feeds.
This patch updates the Makefile to ensure proper functionality of
openwisp-monitoring with the 0.2.0 release.
Signed-off-by: Gagan Deep <pandafy.dev@gmail.com>
(cherry picked from commit 886b3fa36d)
After the SIM has been successfully unlocked, it is initialized. This can
take longer on some modems, so we must wait until the modem is ready to
execute the next commands.
Otherwise the modem cannot be enabled and aborts with the following
error message:
error: couldn't enable the modem: 'GDBus.Error:org.freedesktop.ModemManager1.Error.Core.WrongState: modem in initializing state'
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 24d2ba0ba8)
If a configured 'plmn' is deleted from the configuration between a connection
setup, it will continue to be used because the modem remembers it.
Therefore, the 'plmn' stored in the modem must be deleted when a new
connection is established if it is no longer in the configuration.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit fa6198e36b)
In the current implementation of the modemmanager 'proto', if a 'plmn' and a
'technology' is configured, the 'plmn' is set first and then second the
'technology' on a 'proto' setup.
However, this is problematic if a 'technology' has already been set in an
earlier run. It is possible, that this previously set 'technology' is not
available at the current location, as the modem remembers the setting.
To fix this, first set the technology and then the plmn.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 3a5aa8a387)
To improve the code, the setting of the 'plmn' is moved to separate function.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 8682084e34)
This settings are needed before any other mmcli command is executed.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 9f35173639)
If the ModemManager is started with debug, all outputs are written to the
system log. To simplify debugging, a logging file is now created under
'/var/log/mm.log' in this case. This simplifies error analysis.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit b6664ae938)
Modify EXTRA_DEPENDS in package section to meet APK packaging
requirements.
Signed-off-by: Ryan Keane <the.ra2.ifv@gmail.com>
[ fix dependency also for nginx-full ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit ea5536c14c)
Update configuration in Makefile to fix#25168.
Add "/etc/openwisp/" to conf files.
Signed-off-by: Gagan Deep <pandafy.dev@gmail.com>
(cherry picked from commit 67d4fa3b05)
Adjust versioning to be compatible with apk.
As we fetch source via git commit hash, simply change - to .
in version string.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit bc14a5428b)
Having both double quotes and parentheses in package
description may lead into troublewith apk, if parentheses
are located so that they get passed "outside" the quoted
parameter, and get interpreted as a token for shell.
Example:
ash: -c: line 1: syntax error near unexpected token `('
bash: -c: line 1: `/OpenWrt/e8450/staging_dir/host/bin/fakeroot
/OpenWrt/e8450/staging_dir/host/bin/apk mkpkg --info "name:ddns
-scripts-pdns" --info "version:2.8.2-r51" --info "description:D
ynamic DNS Client scripts extension for "PowerDNS" via API. It
requires: "option param_opt(Optional Parameter)" to be a valid
Avoid that by using single quotes in the detailed descriptions.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit b74ca8feb2)
Bump fwupd to 2.0.1 and make libdrm support configurable.
Set libdrm support disabled by default.
This is needed to fix a problem with buildbot where libdrm dependency is
silently included as buildbot compile every package and library is found
in the system.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit fe5649f379)
Move uci-defaults file to run level 51, so it is executed immediately
after the attendedsysupgrade-common package's uci-defaults script.
Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>
(cherry picked from commit 712e403703)
If nls.mk is not included and BUILD_NLS is set compilation will fail with:
aarch64-openwrt-linux-musl-gcc atop.o version.o various.o deviate.o procdbase.o acctproc.o photoproc.o photosyst.o cgroups.o rawlog.o ifprop.o parseable.o showgeneric.o drawbar.o showlinux.o showsys.o showprocs.o atopsar.o netatopif.o netatopbpfif.o gpucom.o json.o utsnames.o -o atop -lncursesw -lz -lm -lrt -Lstaging_dir/toolchain-aarch64_cortex-a53_gcc-13.3.0_musl/usr/lib -Lstaging_dir/toolchain-aarch64_cortex-a53_gcc-13.3.0_musl/lib -fuse-ld=bfd -znow -zrelro -Lstaging_dir/target-aarch64_cortex-a53_musl/usr/lib -lglib-2.0 -lintl
staging_dir/toolchain-aarch64_cortex-a53_gcc-13.3.0_musl/lib/gcc/aarch64-openwrt-linux-musl/13.3.0/../../../../aarch64-openwrt-linux-musl/bin/ld.bfd: cannot find -lintl: No such file or directory
collect2: error: ld returned 1 exit status
So make sure to include nls.mk.
Fixes: #25231
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 1f3fa379d3)
In dropping the dummy-package, also the extra dependency for
nginx-ssl-util needed to be dropped.
Fixes: #25250
Fixes: b75050d59e ("nginx-util: drop nginx-util dummy packages")
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit f2e7f81307)
Nginx hardcode the libxml2 include path to /usr/include/libxml2. This
works in a local build as pretty much everyone have the libxml2 library
installed but doesn't on buildbot container as the library doesn't
exist.
This effectively makes the host library leak intro library detection but
doesn't actually link to it as linking is still done with the correct
library in staging dir.
To fix this add a patch to define custom libxml2 include directory
instead of hardcoding it to host library.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit c919fddfc1)
Enough transition period has passed for nginx-util dummy package. Finally
drop it for good and drop the extra dependency.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit b75050d59e)
Drop extra dependency <2 for nginx-util. The reason is not clear and
cause problems with APK package creation.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 9c563d536c)
Enough transition period has passed for nginx dummy package. Finally
drop it for good and add Provides for nginx default.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit ad14af942c)
Mute warning on procd init.d script enable as nginx_util is tried to be
called from /usr/bin host system. Limit it to be called only if
nginx-util is present.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 329d7e4f78)
Starting v4.0.0, netatalk brings back AppleTalk features lost in v3.
Updated description.
Signed-off-by: Antonio Pastor <antonio.pastor@gmail.com>
(cherry picked from commit 09a2427c2a)
Updated title.
Updated description.
Reordered to match most common layout
Signed-off-by: Antonio Pastor <antonio.pastor@gmail.com>
(cherry picked from commit 049a055b76)
Maintainer: Antonio Pastor / @APCCV
Compile tested: ipq806x (23.05.3, snapshot)
Run tested: ipq806x - C2600: start server, connect from MacOS, read/write files to home share, create/update TimeMachine backups
Description:
No changes to package other than using latest available upstream code base. Starting Netatalk 4.x build uses meson instead of autotools.
Signed-off-by: Antonio Pastor <antonio.pastor@gmail.com>
(cherry picked from commit d0abe3d52d)
2024-11-04 06:35:24 +01:00
640 changed files with 13998 additions and 11958 deletions
description:Report an issue with a package in this repository
title:"<package-name>: <short description>"
labels:[bug]
body:
- type:markdown
attributes:
value:|
# 📦 Package Details
- type:input
id:package-name
attributes:
label:Package Name
placeholder:e.g. iptables, curl, netdata
validations:
required:true
- type:input
id:maintainer
attributes:
label:Maintainer
description:|
Check the latest package commits and/or search the repo with the example below.\
```<package-name>/makefile maintainer```
placeholder:(@username)
validations:
required:true
- type:input
id:openwrt-version
attributes:
label:OpenWrt Version
description:|
If you are unsure, use the command below.\
```ubus call system board | jsonfilter -e '@.release.version'```
placeholder:e.g. 23.05.2 or SNAPSHOT
validations:
required:true
- type:input
id:target-subtarget
attributes:
label:OpenWrt Target/Subtarget
description:|
If you are unsure, use the command below.\
```ubus call system board | jsonfilter -e '@.release.target'```
placeholder:e.g. ramips/mt76x8, ath79/generic
validations:
required:true
- type:textarea
id:steps-to-reproduce
attributes:
label:Steps to Reproduce
description:Please list the steps that lead to the issue.
placeholder:|
1. Do this
2. Then this
3. Observe the issue
Try to avoid uploading screenshots, logs are preferred.
validations:
required:true
- type:textarea
id:actual-behavior
attributes:
label:Actual Behaviour
description:What actually happened? Be as detailed as possible.
placeholder:A clear and concise description of what happened.
validations:
required:true
- type:markdown
attributes:
value:|
# ✅ Formalities
Before submitting this issue, please confirm the following:
- type:checkboxes
id:confirmations
attributes:
label:Confirmation Checklist
options:
- label:The package is maintained in this repository.
required:true
- label:I understand that issues related to [the base OpenWrt repository](https://github.com/openwrt/openwrt/issues) or [LuCI repository](https://github.com/openwrt/luci/issues) will be closed.
required:true
- label:I am reporting an issue for OpenWrt, not an unsupported fork.
about:The OpenWrt project relies on volunteers. While we appreciate feature requests, we might lack the manpower to handle them. Ideally, you get familiar with the codebase and attempt to contribute the feature yourself. We recommend to post in the forum, as this is the most likely place to receive feedback on feature requests.
- name:OpenWrt community
url:https://openwrt.org/contact
about:Consider reaching out to our community to get help. OpenWrt is a complex software project with many pitfalls; there is a good chance someone can help you solve your issue in no time.
- name:OpenWrt documentation
url:https://openwrt.org/docs/start
about:The OpenWrt documentation contains a lot of valuable information.
Please make sure that the issue subject starts with `<package-name>: `
Also make sure that the package is maintained in this repository and not in base which should be submitted at https://bugs.openwrt.org or in the LuCI repository which should be submitted at https://github.com/openwrt/luci/issues.
Issues related to releases below 18.06 and forks are not supported or maintained and will be closed.
# Issue template (remove lines from top till here)
Maintainer: @\<github-user> (find it by checking history of the package Makefile)
Environment: (put here arch, model, OpenWrt version)
Description:
```
Format code blocks by wrapping them with pairs of ```
<sub>(You can find this by checking the history of the package `Makefile`.)</sub>
**Description:**
<!-- Briefly describe what this package does or what changes are introduced -->
---
## 🧪 Run Testing Details
- **OpenWrt Version:**
- **OpenWrt Target/Subtarget:**
- **OpenWrt Device:**
---
## ✅ Formalities
- [ ] I have reviewed the [CONTRIBUTING.md](https://github.com/openwrt/packages/blob/master/CONTRIBUTING.md) file for detailed contributing guidelines.
### If your PR contains a patch:
- [ ] It can be applied using `git am`
- [ ] It has been refreshed to avoid offsets, fuzzes, etc., using
```bash
make package/<your-package>/refresh V=s
```
- [ ] It is structured in a way that it is potentially upstreamable
From 7d669a90212e105b0f669aa2ab38c987b187baab Mon Sep 17 00:00:00 2001
From: Hongxu Jia <hongxu.jia@windriver.com>
Date: Wed, 21 May 2025 13:09:25 +0800
Subject: [PATCH] fix lttng-tools fails to compile with libxml2 2.14.0+
Description:
| In file included from /srv/pokybuild/yocto-worker/qemux86-alt/build/build/tmp/work/core2-32-poky-linux/lttng-tools/2.13.15/recipe-sysroot/usr/include/libxml2/libxml/parser.h:25,
| from ../../../../lttng-tools-2.13.15/src/common/config/session-config.c:29:
| /srv/pokybuild/yocto-worker/qemux86-alt/build/build/tmp/work/core2-32-poky-linux/lttng-tools/2.13.15/recipe-sysroot/usr/include/libxml2/libxml/encoding.h:173:7: note: declared here
| 173 | } input XML_DEPRECATED_MEMBER;
| | ^~~~~
| ../../../../lttng-tools-2.13.15/src/common/config/session-config.c:432:15: error: called object is not a function or function pointer
PKG_MAINTAINER:=Jan Pavlinec <jan.pavlinec1@gmail.com>, Jeffery To <jeffery.to@gmail.com>
PKG_LICENSE:=Apache-2.0 BSD-2-Clause
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.