Stan Grishin [Sun, 21 Apr 2024 14:06:52 +0000 (14:06 +0000)]
adblock-fast: bugfix: unbound-related fixes
* include `server:` directive at the top of unbound file
* update unbound-related outputGzip variable to include full path
* return always_nxdomain for blocked domains
* also update copyright stamp/license
* added a DDoS protection rules in a new pre-routing chain to prevent common ICMP, UDP and SYN flood attacks and drop spoofed tcp flags & invalid conntrack packets, flood tresholds are configured via 'ban_icmplimit' (default 10/s), 'ban_synlimit' (default 10/s) and 'ban_udplimit' (default 100/s)
* the new pre-routing rules are tracked via named nft counters and are part of the standard reporting, set 'ban_logprerouting' accordingly
* block countries dynamically by Regional Internet Registry (RIR)/regions, e.g. all countries related to ARIN. Supported service regions are: AFRINIC, ARIN, APNIC, LACNIC and RIPE, set 'ban_region' accordingly
* it's now possible to always allow certain protocols/destination ports in wan-input and wan-forward chains, set 'ban_allowflag' accordingly - e.g. ' tcp 80 443-445'
* filter/convert possible windows line endings of external feeds during processing
* the cpu core autodetection is now limited to max. 16 cores in parallel, set 'ban_cores' manually to overrule this limitation
* set the default nft priority to -100 for banIP input/forward chains (pre-routing is set to -150)
* update readme
* a couple of bugfixes & performance improvements
* removed abandoned feeds: darklist, ipblackhole
* added new feeds: becyber, ipsum, pallebone, debl (changed URL)
* requires a LuCI frontend update as well (separate PR/commit)
* make PKG_RELEASE numeric again
* made a release bump due to a newly added patch (see https://github.com/openwrt/packages/commit/de4ef9d169a182350796afca778742bf68052af4 for details)
* remove maintainer (as requested in #23890
Sean Khan [Fri, 12 Apr 2024 22:05:30 +0000 (18:05 -0400)]
nginx: autoload dynamic modules
In current setup, dynamic modules are not autoloaded, requiring users
to create and load additional config files.
We should assume that if a user installs additional modules, they want
them 'on' by default.
This commit does the following:
1.) generates a module load config in '/etc/nginx/modules.d' with the
format '${module_name}'.module
(i.e. /etc/nginx/modules.d/ngx_http_geoip2.module)
2.) deletes previous module conf for 'luci'
/etc/nginx/modules.d/luci.module if it exists, this will prevent
'module already loaded' errors.
The following is a portion of the final output when using the
default uci template `/etc/nginx/uci.conf.template` (via nginx-util):
Sean Khan [Fri, 12 Apr 2024 22:40:13 +0000 (18:40 -0400)]
nginx: fix geoip2 dependency on mod ngx_stream
Since the geoip2 package contains both `http` and `stream` versions. It
requires the module `ngx_stream` be installed and loaded and produces
the error:
```
2024/04/12 18:38:18 [emerg] 4402#0: dlopen()
"/usr/lib/nginx/modules/ngx_stream_geoip2_module.so" failed (Error
relocating /usr/lib/nginx/modules/ngx_stream_geoip2_module.so:
ngx_stream_complex_value: symbol not found) in
/etc/nginx/module.d/ngx_stream_geoip2.module:1 nginx: configuration file
/etc/nginx/uci.conf test failed
```
Add dependency so it's built at build time and installed automatically
by `opkg`
Version 6.3.4 has some important fixes for the OpenWrt community.
This version properly supports Big-Endian systems (which are many); the previous OpenWrt packaged version crashed on such systems.
Paul Spooren [Thu, 11 Apr 2024 20:29:55 +0000 (22:29 +0200)]
mtd-rw: drop PKG_VERSION definition in Makefile
By default Kernel modules follow the version schema from openwrt.git,
which happens to be APK compatible. Instead of defining a entirely
custom format, use what's already out there.
This patch drops the individual PKG_VERSION definition.
Right now, the version becomes 6.1.82.0~7e856206-r2.
,,_ -*> Snort++ <*-
o" )~ Version 3.1.84.0
'''' By Martin Roesch & The Snort Team
http://snort.org/contact#team
Copyright (C) 2014-2024 Cisco and/or its affiliates. All rights reserved.
Copyright (C) 1998-2013 Sourcefire, Inc., et al.
Using DAQ version 3.0.14
Using LuaJIT version 2.1.0-beta3
Using OpenSSL 3.0.13 30 Jan 2024
Using libpcap version 1.10.4 (with TPACKET_V3)
Using PCRE version 8.45 2021-06-15
Using ZLIB version 1.3.1
Using Hyperscan version 5.4.2 2024-04-10
Using LZMA version 5.4.6
$ rsync --version
rsync version 3.3.0 protocol version 31
Copyright (C) 1996-2024 by Andrew Tridgell, Wayne Davison, and others.
Web site: https://rsync.samba.org/
Capabilities:
64-bit files, 64-bit inums, 64-bit timestamps, 64-bit long ints,
no socketpairs, symlinks, symtimes, hardlinks, no hardlink-specials,
no hardlink-symlinks, IPv6, atimes, batchfiles, inplace, append, no ACLs,
no xattrs, optional secluded-args, no iconv, prealloc, stop-at,
no crtimes
Optimizations:
no SIMD-roll, no asm-roll, no openssl-crypto, asm-MD5
Checksum list:
md5 md4 none
Compress list:
zlibx zlib none
Daemon auth list:
md5 md4
Paul Spooren [Thu, 11 Apr 2024 13:03:43 +0000 (15:03 +0200)]
macremapper: drop VERSION definition in Makefile
By default Kernel modules follow the version schema from openwrt.git,
which happens to be APK compatible. Instead of defining a entirely
custom format, use what's already out there.
This patch drops the individual VERSION definition.
Eric Fahlgren [Fri, 12 Apr 2024 21:21:15 +0000 (14:21 -0700)]
snort3: fix issue caused by ucode semantics change
A recent change in the ucode interpeter caused a failure when using
the 'in' operator.
https://github.com/jow-/ucode/commit/be767ae197babd656d4f5d9c2d5013e39ddbe656
Reported in a forum post by @graysky2.
https://forum.openwrt.org/t/194218/28
Stan Grishin [Thu, 11 Apr 2024 16:21:28 +0000 (16:21 +0000)]
pbr: update to 1.1.4-r15
* delete obsolete files/etc/init.d/pbr.init
* add files/etc/uci-defaults/91-pbr-iptables to help update from older OpenWrt
* add files/etc/uci-defaults/91-pbr-nft to help update from older OpenWrt
* update files/etc/uci-defaults/91-pbr-netifd to only add tables to supported ifaces
* re-organize variants in the Makefile so that they hopefull work this time
* update prerm for all variants for better user experience
* update the -netifd prerm to remove leftofver entries from network and rt_tables file
In the init script:
* add decorations for netifd-interfaces related operations (blue ticks)
* add rtTablesFile variables instead of hard-coding the rt_tables file
* add function to check if the table is netifd-derived
* add error messages/hints for failed interface setup and failed WAN discovery
* make cleanup_rt_tables the netifd-compatible
* streamline interface_process function with a clearer case statement
* rename the interface_process `pre-init` option to `pre_init` to conform to the other
functions options naming style
git.99rst.org / openwrt-packages.git / log