Alois Klink [Wed, 23 Nov 2022 18:37:01 +0000 (18:37 +0000)]
github-ci: error on any shell errors
Enable `errexit` and `nounset` [POSIX shell options][1]
in `.github/workflows/entrypoint.sh` so that the script fails
if any command within the script fails.
John Audia [Tue, 29 Nov 2022 10:50:45 +0000 (05:50 -0500)]
snort3: unified configs: local.lua and homenet.lua
This commit adds /etc/snort/local.lua and /etc/snort/homenet.lua for user
defined config options which is more simplistic than modifying upstream
files directly. That can be tedious and decisive to maintain in sync with
upstream changes. The init script has been adjusted accordingly.
Acknowledgment to amish who maintains the Arch Linux snort-nfqueue package[1]
for these ideas and initial code.
Another modification is dropping the following args in the call to
/usr/bin/snort by the init system as these options are provided in
/etc/snort/local.lua:
* --daq-dir /usr/lib/daq/
* -A "$alert_module"
Instructions to configure snort3:
1. Edit /etc/snort/homenet.lua and redefine HOME_NET and EXTERNAL_NET, for example:
2. Edit /etc/snort/local.lua to setup options unique to your use case of snort.
The default ones I included should be sane for the role of IDS (alert only),
but users may easily uncomment some options therein to use IPS (drop) mode.
3. Install or symlink rules to /etc/snort/rules/snort.rules and optionally
edit /etc/snort/local.lua to define extra rules files if not using a unified
'snort.rules'
The original idea of the extra namespace variable was to set up
bpfcountd from other daemons etc. independent of what a user configured
in /etc/config/bpfcountd for instance. Like:
will not stop the according namespaced instance, as the stop() in
/etc/rc.common will call procd_kill() without the namespace prefix.
And we can't overwrite that behaviour. And asking a user to use
"... start <in> <ns>" and "... stop <ns>.<in>" is confusing.
(and currently "... stop <ns>.<in>" would not remove the correct
unix socket).
2) A stop call without an instance/config name would always stop all
instances. So the namespace variable would be ignored.
While start without an instance "works", but:
3) It would stop any process that is not in the currently selected
UCI_CONFIG_DIR.
As all this is not easily fixable without changing OpenWrt internals,
just remove the whole namespace idea for now.
Daniel Golle [Mon, 5 Dec 2022 01:18:43 +0000 (01:18 +0000)]
snowflake: update to version 2.4.1
Changes in version v2.4.1 - 2022-12-01
- Issue 40224: Bug fix in utls roundtripper
Changes in version v2.4.0 - 2022-11-29
- Fix proxy command line help output
- Issue 40123: Reduce multicast DNS candidates
- Add ICE ephemeral ports range setting
- Reformat using Go 1.19
- Update CI tests to include latest and minimum Go versions
- Issue 40184: Use fixed unit for bandwidth logging
- Update gorilla/websocket to v1.5.0
- Issue 40175: Server performance improvements
- Issue 40183: Change snowflake proxy log verbosity
- Issue 40117: Display proxy NAT type in logs
- Issue 40198: Add a `orport-srcaddr` server transport option
- Add gofmt output to CI test
- Issue 40185: Change bandwidth type from int to int64 to prevent overflow
- Add version output support to snowflake
- Issue 40229: Change regexes for ipv6 addresses to catch url-encoded addresses
- Issue 40220: Close stale connections in standalone proxy
Marius Dinu [Wed, 30 Nov 2022 09:21:39 +0000 (11:21 +0200)]
tvheadend: add conditions for -O3 and LTO optimizations
Building for arc, mips and powerpc platforms fails if -O3 and LTO optimizations are enabled. This patch removes that option for everything other than arm and x86_64. These are known to work.
Fixes issue #19923.
Also fixes a typo in the description.
Stan Grishin [Mon, 31 Oct 2022 23:08:01 +0000 (23:08 +0000)]
pbr: initial commit
* The makefile produces the nft and iptables capable `pbr` package
and the `pbr-iptables` package for legacy setups
* This replaces `vpnbypass` and `vpn-policy-routing` packages
* I'm soliciting feedback on this package and my intention is to
update the version to 1.0.0 before this is merged, but I need the
feedback on this and luci-app-pbr before then.
Linus Lüssing [Sun, 27 Nov 2022 09:55:37 +0000 (10:55 +0100)]
bpfcountd: add initial package
bpfcountd was created to obtain packet statistics in larger networks
without stressing the cpu resources. bpfcountd will count the amount
of packages and bytes over time (for each defined rule). The rules
are defined using the tcpdump filter syntax (bpf). The collected
data is provided on a unix socket in plaintext.
Hannu Nyman [Tue, 29 Nov 2022 18:03:26 +0000 (20:03 +0200)]
wget: update to 1.21.3
Update wget to 1.21.3
* Remove patch 100-fix-hsts-time.patch as upstream has issued
its own version on the fixes
* Add a hack (and fixup autoreconf) to fix an upstream bug that
forces the nettle library into nossl even if NTLM is disabled.
Upstream bug filed: https://savannah.gnu.org/bugs/?63431
Tjeu Kayim [Thu, 24 Nov 2022 11:08:30 +0000 (12:08 +0100)]
gnupg: compile with -fcommon
This fixes a segfault because gnupg/g10/options.h struct opt
is otherwise not shared between the different compilation units,
resulting in opt.homedir being NULL when passed to make_filename.
$ gpg1 -i
gpg: signal 11 caught ... exiting
Segmentation fault
(gdb) bt
#0 0x00007f17bb2185e2 in strlen (s=s@entry=0x0) at src/string/strlen.c:17
#1 0x0000000000460ea0 in make_filename (first_part=first_part@entry=0x0) at gnupg-1.4.23/util/fileutil.c:174
#2 0x000000000040ee42 in keydb_add_resource (url=url@entry=0x46bfe3 "secring.gpg", flags=flags@entry=4, secret=secret@entry=1)
at gnupg-1.4.23/g10/keydb.c:238
#3 0x00000000004062ee in main (argc=<optimized out>, argv=<optimized out>) at gnupg-1.4.23/g10/gpg.c:3323
Marius Dinu [Mon, 21 Nov 2022 10:42:59 +0000 (12:42 +0200)]
tvheadend: update to git master 2022-11-20
- EPG database switched from v2 to v3. This commit updates OpenWrt init script to use the new database file.
- EPG database symlink created by OpenWrt config option is overwritten with a real file by tvheadend.
The latest tvheadend commit included here fixes that.
Adam Williams [Mon, 21 Nov 2022 04:00:56 +0000 (21:00 -0700)]
wifi-presence: Update to version v0.3.0
This version handles the new hostapd connect message format,
as introduced in: https://github.com/openwrt/openwrt/commit/8cb995445a26ee124e40b8ef97cc0ddd9d10f82a
Tilman Vogel [Mon, 21 Nov 2022 14:09:43 +0000 (15:09 +0100)]
ices: Update to 2.0.3
This fixes a timing issue causing a playlist to be streamed as-fast-as-
possible until memory exhaustion, finally crashing ices and making it
basically useless.
This problem occurred in the timing code in src/common/timing/ and is
probably related to libc header changes because ices 2.0.2 worked up until
OpenWrt 21.02.3 (at least) but failed in OpenWrt 22.03.2.
libgpg-error: copy gpg-error.pc to staging directory
Packages like libassuan and libksba would not compile after updating
libgpg-error to 1.46. This was because gpg-error.m4 (and thus the affected
packages' configure scripts) relies on gpgrt-config, which in turn needs
access to gpg-error.pc. This modifies the libgpg-error build process to
copy gpg-error.pc to OpenWrt's staging directory, so that it is available
for subsequent dependent package builds.
Fixes: https://github.com/openwrt/packages/issues/19880 Signed-off-by: W. Michael Petullo <redacted>
git.99rst.org / openwrt-packages.git / log