Florian Eckert [Tue, 4 Feb 2025 11:36:51 +0000 (12:36 +0100)]
modemmanager: do not disable modem on reconnect
If the modem loses the connection, an attempt is made to re-establish the
connection via the report-down script.
Until now, the modem was disabled when the modem processed the teardown of
the modemmanager protohandler. The immediate up events of netifd renables
the modem right away. This takes time, which is not necessary.
This commit changes the behavior so that the modem is not disabled when
the modemmanager is disconnected via the report-down script.
Daniel Golle [Fri, 11 Oct 2024 03:41:22 +0000 (04:41 +0100)]
gnunet: update to v0.23.1
v0.23.0 (tagged as v0.23.1)
- Add GNUNET_CONFIGURATION_set_value_float
- util: Float configuration values are no longer locale-dependent, but instead must always be in LC_NUMERIC=C format
- GNUNET_DISK_internal_file_handle_ changed to always return int
- Reworkd ProjectData handling; Now required as input for various API calls.
v0.22.2:
- GNUNET_STRINGS_get_utf8_args removed.
- Removed unsafe and unused functions for 2d/3d array allocation.
v0.22.1:
- Update HELLO files for new bootstrap peer
- Fix regression in DHT Bloom filter
- Fix long-standing regression in HELLO URI expirations
v0.22.0:
- New logging API to print/parse hex bytes
- Added RFC9180 HPKE and associated KEMs
- Replace oneshot PKE and KEM APIs with HPKE
- New Elligator KEM
- Namestore API allows multiple records to be inserted in a single transaction (if plugin supports this)
- New ECDH API that uses KDFs instead of hash
- Renamed GNUNET_CRYPTO_hkdf to GNUNET_CRYPTO_hkdf_gnunet
- Added new standard SHA256-based HKDF APIs
- New hostlist bootstrap domain https://bootstrap.gnunet.org
Updated hashmap version.
In the code, almost all the url words have been replaced with domain.
Fixed a bug in the service of getting gateway from VPN name.
Tianling Shen [Wed, 5 Feb 2025 08:05:43 +0000 (16:05 +0800)]
golang: Update to 1.23.6
go1.23.5 (released 2025-01-16) includes security fixes to the
crypto/x509 and net/http packages, as well as bug fixes to the
compiler, the runtime, and the net package.
go1.23.6 (released 2025-02-04) includes security fixes to the
crypto/elliptic package, as well as bug fixes to the compiler
and the go command.
This commit adds support for folder synchronization.
An example is in the 810-files file where it is explained how to
synchronize all hotplug files of keepalived.
Adam Beck [Tue, 4 Feb 2025 14:17:29 +0000 (14:17 +0000)]
ddns-scripts: add type field for digitalocean API
DigitalOcean API requires a "type" JSON field to update a DNS
record. This adds that while checking for IPv6 to change which
record type to use. Without it, the API call fails, making
the script unable to update the DNS records for DigitalOcean.
The hotplug scripts are called with every state change. When called, the
scripts are processed under '/etc/hotplug.d/keepalived'. This change adds
the functionality that the last state change of the keepalived can be
queried via the ubus.
Antonio Pastor [Sun, 26 Jan 2025 20:45:59 +0000 (15:45 -0500)]
netatalk: create small and full variants
Small version includes only AFP file sharing to minimize size.
Base version adds AppleTalk. This matches the contents of the
existing package.
Full version includes everything that OpenWrt can support and
configuration option for build system (menuconfig).
Daniel Golle [Thu, 30 Jan 2025 03:01:27 +0000 (03:01 +0000)]
cryptsetup: update to version 2.7.5
Enable building cryptsetup-reencrypt, integritysetup and veritysetup,
add new binary packages for integritysetup and veritysetup.
Changes since version 2.7.4
~~~~~~~~~~~~~~~~~~~~~~~~~~~
* Fix possible online reencryption data corruption (only in 2.7.x).
In some situations (initializing a suspended device-mapper device),
cryptsetup disabled direct-io device access. This caused unsafe
online reencryption operations that could lead to data corruption.
The code now adds strict checks (and aborts the operation) and
changes direct-io detection code to prevent data corruption.
* Fix a clang compilation error in SSH token plugin.
As clang linker treats missing symbols as errors, the linker phase
for the SSH token failed as the optional cryptsetup_token_buffer_free
was not defined.
* Fix crypto backend initialization in crypt_format_luks2_opal API call.
,,_ -*> Snort++ <*-
o" )~ Version 3.6.2.0
'''' By Martin Roesch & The Snort Team
http://snort.org/contact#team
Copyright (C) 2014-2024 Cisco and/or its affiliates. All rights reserved.
Copyright (C) 1998-2013 Sourcefire, Inc., et al.
Using DAQ version 3.0.18
Using Hyperscan version 5.4.2 2025-01-28
Using libpcap version 1.10.5 (with TPACKET_V3)
Using LuaJIT version 2.1.0-beta3
Using LZMA version 5.6.2
Using OpenSSL 3.0.15 3 Sep 2024
Using PCRE2 version 10.42 2022-12-11
Using ZLIB version 1.3.1
Stan Grishin [Tue, 28 Jan 2025 00:23:59 +0000 (00:23 +0000)]
https-dns-proxy: bugfixes and improvements
* improvement: Makefile: prepend `r` to PKG_RELEASE in binary and init script versions to match package version
* bugfix: init script: more reliable/robust start on boot
* improvement: init script: more compact output()
* improvement: init script: better DNS Hijack login
* improvement: init script: fold some dnsmasq-related functions into dhcp_backup()
Dirk Brenken [Mon, 27 Jan 2025 22:28:04 +0000 (23:28 +0100)]
adblock: update 4.2.4-1
* support smartdns as dns backend
* support top level domains in local white- and blackklist,
e.g. a 'de' in the blacklist blocks all domains with a german tld
and the tld compression removes all subdomains from the final blocklist
Michael Heimpold [Sat, 25 Jan 2025 11:15:16 +0000 (12:15 +0100)]
openssh: fix recursive key file removal
The -r option is not required here but should also not hurt,
since it was already tested, that $key is a file.
However, to express the intent of the command more clearly,
let's drop it.
Coia Prant [Wed, 15 Jan 2025 16:21:53 +0000 (16:21 +0000)]
ddns-scripts: get l3 device for bind network using curl
If pppoe is used for wan access. script set 'eth1' as interface for curl
call. The correct interface is however 'pppoe-wan'.
These scripts use 'network_get_physdev' function to get real device for
bind_network but this is wrong. We need instead the l3_device of the the
logical interface.
In case if we don't use pppoe connection - 'l3_device' is equal to real device.
CVE-2025-23083 - src,loader,permission: throw on InternalWorker use when permission model is enabled (High)
CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)
Dependency update:
CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)
Ryan Keane [Wed, 13 Nov 2024 11:14:03 +0000 (03:14 -0800)]
git: Set PKG_FORTIFY_SOURCE to 0 when lto enabled
If PKG_FORTIFY_SOURCE is not 0 and lto is enabled for package git, it
will fail to compile with the following example error:
/openwrt/staging_dir/toolchain-aarch64_generic_gcc-14.1.0_musl/include/stdio.h: In function 'process_curl_messages': /openwrt/staging_dir/toolchain-aarch64_generic_gcc-14.1.0_musl/include/stdio.h:90:8: error: inlining failed in call to 'always_inline' 'fwrite': function body can be overwritten at link time
90 | size_t fwrite(const void *__restrict, size_t, size_t, FILE *__restrict);
| ^
http.c:355:33: note: called from here
355 | fprintf(stderr, "Received DONE message for unknown request!\n");
| ^
A related issue is #13016 .
This commit set PKG_FORTIFY_SOURCE to 0 if CONFIG_USE_LTO is y.
Yun Wang [Mon, 20 Jan 2025 08:58:32 +0000 (16:58 +0800)]
syncthing: Update to 1.29.2 and Change logfile path
Update to 1.29.2 and Change logfile path from /etc/syncthing/syncthing
log to /var/log/syncthing.log.
This utilizes tmpfs (memory-based storage) to prevent disk usage growth
caused by log file accumulation during extended operation.
Benefits:
- Avoids storage saturation from excessive log growth.
- Aligns with best practices for temporary log management.
- For systems using flash storage (e.g., SSDs or eMMC), storing logs in
tmpfs avoids flash memory wear caused by frequent writes to
/etc/syncthing.
lpac: update to 2.2.1, add support for custom ISD-R AID
Updated lpac to 2.2.1 and added support for custom ISD-R AIDs.
This allows for a broader range of esim cards with non standard AIDs to be supported.
See https://github.com/estkme-group/lpac/pull/181 for additional info.
Dirk Brenken [Fri, 17 Jan 2025 15:51:15 +0000 (16:51 +0100)]
adblock: update 4.2.3-3
Summary of three PRs regarding new adblock sources with minor changes/additions:
- add new source reg_lithuania, PR provided by @Myginas
- add new source certpl, PR provided by @jkostorz
- add new source oisd_nsfw_small, PR provided by @Turjoy9
AntiBlock program proxies DNS requests.
The IP addresses of the specified domains are added to
the routing table for routing through the specified interface.
Dirk Brenken [Thu, 16 Jan 2025 19:08:36 +0000 (20:08 +0100)]
banIP: release 1.5.0-1
* change the chain structure: only two regular chains contain the generated banIP sets.
“_inbound” covers the base chains WAN-Input and WAN-Forward, ‘_outbound’ covers the base chain LAN-Forward.
* pre-configure the default chains for every feed in the banip.feeds json file, no longer blocks
selected feeds in all chains by default
* it's now possible to split country and asn Sets by country or asn (disabled by default)
* support Set counters to report easily suspicious IPs per Set (disabled by default)
* make it possible, to opt out certain chains from the deduplication process
* the element search now returns all matches (and not only the first one)
* the report engine now includes statistics about the Inbound & Outbound chains and the Set counters (optional)
* save the temp. files of possible nft loading errors in "/tmp/banIP-errors" by default for easier debugging
* various code improvements
* remove ssbl feed (deprecated)
* add two new vpn feeds
* update the readme
Ivan Pavlov [Thu, 16 Jan 2025 06:47:45 +0000 (09:47 +0300)]
openvpn: update to 2.6.13
Feature changes:
- on non-windows clients (MacOS, Linux, Unix) send "release" string from uname() call as IV_PLAT_VER to server
- Windows: protect cached username, password and token in client memory
- Windows: use new API to get dco-win driver version from driver
- Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default timeout of 90 seconds
Security fixes:
- improve server-side handling of clients sending usernames or passwords longer than USER_PASS_LEN
Notable bug fixes:
- FreeBSD DCO: fix memory leaks in nvlist handling
- purge proxy authentication credentials from memory after use
For details refer to https://github.com/OpenVPN/openvpn/blob/v2.6.13/Changes.rst
git.99rst.org / openwrt-packages.git / log