Philipp Schmitt [Tue, 18 Feb 2025 16:41:22 +0000 (17:41 +0100)]
mwan3: write `mwan3 use` error/debug messages to stderr instead of stdout
This redirects the debug output to stderr, allowing `mwan3 use` to be used in
scripts without polluting stdout.
Before:
mwan3 use wan curl -fsSL https://ifconfig.co/json | jq -er '.country_iso'
jq: parse error: Invalid numeric literal at line 1, column 8
curl: (23) Failure writing output to destination, passed 389 returned 0
After:
mwan3 use wan curl -fsSL https://ifconfig.co/json | jq -er '.country_iso'
Running 'curl -fsSL https://ifconfig.co/json' with DEVICE=eth2 SRCIP=192.168.0.1 FWMARK=0x3f00 FAMILY=ipv4
DE
John Audia [Wed, 19 Feb 2025 19:29:29 +0000 (14:29 -0500)]
libffi: update to 3.4.7
3.4.7 Feb-8-2024
Add static trampoline support for Linux on s390x.
Fix BTI support for ARM64.
Support pointer authentication for ARM64.
Fix ASAN compatibility.
Fix x86-64 calls with 6 GP registers and some SSE registers.
Miscellaneous fixes for ARC and Darwin ARM64.
Fix OpenRISC or1k and Solaris 10 builds.
Remove nios2 port.
John Audia [Tue, 18 Feb 2025 17:57:33 +0000 (12:57 -0500)]
openssh: bump to 9.9p2
Updated and removed upstreamed patch.
Highlights relating to security:
* Fix CVE-2025-26465 - ssh(1) in OpenSSH versions 6.8p1 to 9.9p1
(inclusive) contained a logic error that allowed an on-path
attacker (a.k.a MITM) to impersonate any server when the
VerifyHostKeyDNS option is enabled. This option is off by default.
* Fix CVE-2025-26466 - sshd(8) in OpenSSH versions 9.5p1 to 9.9p1
(inclusive) is vulnerable to a memory/CPU denial-of-service related
to the handling of SSH2_MSG_PING packets. This condition may be
mitigated using the existing PerSourcePenalties feature.
Both vulnerabilities were discovered and demonstrated to be exploitable
by the Qualys Security Advisory team. We thank them for their detailed
review of OpenSSH.
Full release notes: https://www.openssh.com/txt/release-9.9p2
Stan Grishin [Tue, 18 Feb 2025 00:13:29 +0000 (00:13 +0000)]
https-dns-proxy: bugfixes
* No more `/sbin/uci: Invalid argument output` when set to not update
dnsmasq instances (thanks @tmcqueen-materials for investigation!)
* Do not wait for interface.up on boot, hopefully this resolves the
boot-up start for everyone
Dirk Brenken [Mon, 17 Feb 2025 20:58:24 +0000 (21:58 +0100)]
adblock: release 4.2.5-1
* removed needless subshell calls
* add memory measurements:
- size of the final blocklist in MB
- free memory in MB (MemAvailable from /proc/meminfo)
- script max. used RAM (VmHWM from /proc/$$/status)
* optimized restart logic
* cosmetics
Ryan Keane [Sun, 22 Dec 2024 14:12:04 +0000 (06:12 -0800)]
adguardhome: Update init files
Move working directory from `/var/adguardhome` to
`/var/lib/adguardhome`, according to Linux FHS.
Add option to store PID file, defaulting to `/run/adguardhome.pid`.
Til Kaiser [Sat, 8 Feb 2025 11:01:32 +0000 (12:01 +0100)]
mstflint: update to 4.31.0
This commit updates the mstflint package to the
latest 4.31.0 release.
It also includes patches to fix some build errors
that have been merged into their development branch [1]
but are not inside the current release version.
Dirk Brenken [Fri, 14 Feb 2025 06:26:14 +0000 (07:26 +0100)]
adblock: update 4.2.4-2
* properly handle forced DNS ports <> 53,
no longer make bogus local redirects, reject them instead (fixed #25897)
* support the jail mode for smartdns
* cosmetics
Dirk Brenken [Thu, 13 Feb 2025 20:47:39 +0000 (21:47 +0100)]
banIP: release 1.5.1-1
* optimized the f_nftload function
* reduced the prerouting priority to -175
* optimized the output of the f_survey function
* removed a needless fw4 call/check
* no longer skips regular blocklist feeds in "allowlist only" mode
* optimized init checks
* turris feed: enable IPv6 parsing, too (prvided by @curbengh)
* update the readme
Florian Eckert [Tue, 4 Feb 2025 12:01:53 +0000 (13:01 +0100)]
keepalived: add new uci section config interface_up_down_delays
If an interface that is being used (or tracked) by a VRRP instance goes to
down state, the VRRP instance(s) will, by default, immediately transition to
FAULT state, and when all relevant interfaces are back up again the VRRP
instance(s) will immediately transition to BACKUP state.
This can cause problems if interfaces are bouncing, and so delays can be
specified between the interface state change and the transition to
FAULT/BACKUP state. If the interface returns to its original state before
the delay expires, no associated VRRP instance state transition will occur.
New uci section 'interface_up_down_delay':
config interface_up_down_delays
option device <device>
option down_delay <number in seconds>
option up_delay <number in seconds>
Stan Grishin [Wed, 12 Feb 2025 03:57:26 +0000 (03:57 +0000)]
pbr: update to 1.1.8-10
* Improve verbose output on start
* Allow to not create ip rule for WG server
* Improve boot up start (take 2)
* Improve verbose output when setting triggers
* Override DNS hijack with DNS policies from pbr
Stan Grishin [Mon, 10 Feb 2025 21:18:24 +0000 (21:18 +0000)]
https-dns-proxy: bugfix: start on boot
* bugfix: working start on boot when interfaces are up
(thanks @tmcqueen-materials and @b1ackbeat)
* improvement: better output when setting triggers on start
Florian Eckert [Tue, 4 Feb 2025 11:36:51 +0000 (12:36 +0100)]
modemmanager: do not disable modem on reconnect
If the modem loses the connection, an attempt is made to re-establish the
connection via the report-down script.
Until now, the modem was disabled when the modem processed the teardown of
the modemmanager protohandler. The immediate up events of netifd renables
the modem right away. This takes time, which is not necessary.
This commit changes the behavior so that the modem is not disabled when
the modemmanager is disconnected via the report-down script.
Daniel Golle [Fri, 11 Oct 2024 03:41:22 +0000 (04:41 +0100)]
gnunet: update to v0.23.1
v0.23.0 (tagged as v0.23.1)
- Add GNUNET_CONFIGURATION_set_value_float
- util: Float configuration values are no longer locale-dependent, but instead must always be in LC_NUMERIC=C format
- GNUNET_DISK_internal_file_handle_ changed to always return int
- Reworkd ProjectData handling; Now required as input for various API calls.
v0.22.2:
- GNUNET_STRINGS_get_utf8_args removed.
- Removed unsafe and unused functions for 2d/3d array allocation.
v0.22.1:
- Update HELLO files for new bootstrap peer
- Fix regression in DHT Bloom filter
- Fix long-standing regression in HELLO URI expirations
v0.22.0:
- New logging API to print/parse hex bytes
- Added RFC9180 HPKE and associated KEMs
- Replace oneshot PKE and KEM APIs with HPKE
- New Elligator KEM
- Namestore API allows multiple records to be inserted in a single transaction (if plugin supports this)
- New ECDH API that uses KDFs instead of hash
- Renamed GNUNET_CRYPTO_hkdf to GNUNET_CRYPTO_hkdf_gnunet
- Added new standard SHA256-based HKDF APIs
- New hostlist bootstrap domain https://bootstrap.gnunet.org
Updated hashmap version.
In the code, almost all the url words have been replaced with domain.
Fixed a bug in the service of getting gateway from VPN name.
Tianling Shen [Wed, 5 Feb 2025 08:05:43 +0000 (16:05 +0800)]
golang: Update to 1.23.6
go1.23.5 (released 2025-01-16) includes security fixes to the
crypto/x509 and net/http packages, as well as bug fixes to the
compiler, the runtime, and the net package.
go1.23.6 (released 2025-02-04) includes security fixes to the
crypto/elliptic package, as well as bug fixes to the compiler
and the go command.
This commit adds support for folder synchronization.
An example is in the 810-files file where it is explained how to
synchronize all hotplug files of keepalived.
Adam Beck [Tue, 4 Feb 2025 14:17:29 +0000 (14:17 +0000)]
ddns-scripts: add type field for digitalocean API
DigitalOcean API requires a "type" JSON field to update a DNS
record. This adds that while checking for IPv6 to change which
record type to use. Without it, the API call fails, making
the script unable to update the DNS records for DigitalOcean.
The hotplug scripts are called with every state change. When called, the
scripts are processed under '/etc/hotplug.d/keepalived'. This change adds
the functionality that the last state change of the keepalived can be
queried via the ubus.
Antonio Pastor [Sun, 26 Jan 2025 20:45:59 +0000 (15:45 -0500)]
netatalk: create small and full variants
Small version includes only AFP file sharing to minimize size.
Base version adds AppleTalk. This matches the contents of the
existing package.
Full version includes everything that OpenWrt can support and
configuration option for build system (menuconfig).
Daniel Golle [Thu, 30 Jan 2025 03:01:27 +0000 (03:01 +0000)]
cryptsetup: update to version 2.7.5
Enable building cryptsetup-reencrypt, integritysetup and veritysetup,
add new binary packages for integritysetup and veritysetup.
Changes since version 2.7.4
~~~~~~~~~~~~~~~~~~~~~~~~~~~
* Fix possible online reencryption data corruption (only in 2.7.x).
In some situations (initializing a suspended device-mapper device),
cryptsetup disabled direct-io device access. This caused unsafe
online reencryption operations that could lead to data corruption.
The code now adds strict checks (and aborts the operation) and
changes direct-io detection code to prevent data corruption.
* Fix a clang compilation error in SSH token plugin.
As clang linker treats missing symbols as errors, the linker phase
for the SSH token failed as the optional cryptsetup_token_buffer_free
was not defined.
* Fix crypto backend initialization in crypt_format_luks2_opal API call.
,,_ -*> Snort++ <*-
o" )~ Version 3.6.2.0
'''' By Martin Roesch & The Snort Team
http://snort.org/contact#team
Copyright (C) 2014-2024 Cisco and/or its affiliates. All rights reserved.
Copyright (C) 1998-2013 Sourcefire, Inc., et al.
Using DAQ version 3.0.18
Using Hyperscan version 5.4.2 2025-01-28
Using libpcap version 1.10.5 (with TPACKET_V3)
Using LuaJIT version 2.1.0-beta3
Using LZMA version 5.6.2
Using OpenSSL 3.0.15 3 Sep 2024
Using PCRE2 version 10.42 2022-12-11
Using ZLIB version 1.3.1
Stan Grishin [Tue, 28 Jan 2025 00:23:59 +0000 (00:23 +0000)]
https-dns-proxy: bugfixes and improvements
* improvement: Makefile: prepend `r` to PKG_RELEASE in binary and init script versions to match package version
* bugfix: init script: more reliable/robust start on boot
* improvement: init script: more compact output()
* improvement: init script: better DNS Hijack login
* improvement: init script: fold some dnsmasq-related functions into dhcp_backup()
Dirk Brenken [Mon, 27 Jan 2025 22:28:04 +0000 (23:28 +0100)]
adblock: update 4.2.4-1
* support smartdns as dns backend
* support top level domains in local white- and blackklist,
e.g. a 'de' in the blacklist blocks all domains with a german tld
and the tld compression removes all subdomains from the final blocklist
Michael Heimpold [Sat, 25 Jan 2025 11:15:16 +0000 (12:15 +0100)]
openssh: fix recursive key file removal
The -r option is not required here but should also not hurt,
since it was already tested, that $key is a file.
However, to express the intent of the command more clearly,
let's drop it.
git.99rst.org / openwrt-packages.git / log