* supports allowing / blocking of certain VLAN forwards in segregated network environments,
set 'ban_vlanallow', ''ban_vlanblock' accordingly
* simplified the code/JSON to generate/parse the banIP status
* enclose nft related devices in quotation marks , e.g. to handle devices which starts with a number '10g-1'
* made the new vlan options available to LuCI (separate commit)
* Update package nlohmannjson to version 3.11.2.
* Version 3.11.2 is source compatible with 3.10.2 so no package should fail to compile
* From version 3.11.2 on forward template declarations are collected in the file
json_fwd.hpp. The json.hpp still contains all template definitions.
Because in most compilation units of a software package only the file json_fwd.hpp
needs to be included, the compilation process is accelerated a lot.
Executables depending on binary package libmagic segfault in case
package file is not installed. Libmagic needs file
/usr/share/misc/magic to not segfault. Thus, install
/usr/share/misc/magic along with libmagic and not with file.
* prevent superflous etag function calls during start action (on start backups will be used anyway)
* changed the ipthreat feed download URL (load a compressed file variant to save bandwidth)
* added HTTP ETag or entity tag support to download only ressources that have been updated on the server side,
to save bandwith and speed up banIP reloads
* added 4 new feeds: binarydefense, bruteforceblock, etcompromised, ipblackhole (see readme)
* updated the readme
We currently have a more or less circular dependency with nginx ssl and
full variant.
FULL variant depends on every nginx module. Every nginx module depends
on nginx-ssl.
Since nginx-full depends on an nginx module, nginx-ssl is installed as
module depends on it and then the installation fails as nginx-full
conflicts with nginx-ssl.
nginx-full in it's meaning is nginx built with every config selected and
it should not have module as dependency. In fact an user should always
install them separetly as while other things, local modification to the
nginx config file are required to include the just installed module.
To fix this circular dependency problem, drop the dependency of every
nginx module for FULL variant.
Fixes: #21300 Signed-off-by: Christian Marangi <redacted>
This commit adds support for http/3. This is an experimental version
and isn't fully supported because nginx is being built with the regular
OpenSSL and the regular one doesn't support quic.
Javier Marcet [Sat, 1 Jul 2023 18:51:17 +0000 (20:51 +0200)]
python-dotenv: update to v1.0.0
- 1.0.0:
- What's Changed:
- Handle situations where the cwd does not exist.
- Add python-decouple as a related project
- Drop support for python 3.7, add python 3.12-dev
- 0.21.1:
- Added:
- Use Python 3.11 non-beta in CI
- Modernize variables code
- Modernize main.py and parser.py code
- Improve conciseness of cli.py and init.py
- Improve error message for get and list commands when env file
can't be opened
- Updated Licence to align with BSD OSI template
Javier Marcet [Sat, 1 Jul 2023 18:43:28 +0000 (20:43 +0200)]
python-websocket-client: update to 1.6.1
- 1.6.1
- Fix Dispatcher keyboard interrupt. Should solve reconnect loop
with rel
- 1.6.0
- Fix teardown issue when ping thread is not properly ended
- Fix double ping wait time on first ping
- Minor typehints improvements
- 1.5.3
- Add logic to avoid error in the case where content-length header
does not exist, bug introduced in 1.5.2
- Fix wsdump.py script typing, bug introduced in 1.5.2
- 1.5.2
- Add typehints
- Fix pytype errors
- Fix args passed to logging function
- Standardize PEP 3101 formatting
- Add more verbose exception for unsuccessful handshake
Oskari Rauta [Sun, 28 May 2023 06:33:08 +0000 (09:33 +0300)]
libwebsockets: Fix -Werror=enum-int-mismatch in lws_tls_server_abort_connection()
with gcc 13 libwebsockets fails with -Werror=enum-int-mismatch with both
SSL variants. These 2 patches work out that issue. Problem is mentioned
as a issue in openwrt/packages#20949 and instead of overriding issue
with appropriate CFLAGS, this approach was suggested for me as it's
been made as a PR (for openssl) at warmcat/libwebsockets#2824
Second patch for mbedtls, was made by me using same approach
as was used of openssl.
Eventually these propably will be merged into libwebsockets mainstream.
There is an apparent bug in pkgconf 1.9 that broke building the OpenWrt
Vala package. This adds a patch to circumvent the bug. For the related
discussion, see:
https://github.com/openwrt/packages/issues/21359
The pkgconf bug appears similar to the one discussed here:
Robert Högberg [Sun, 11 Jun 2023 21:55:23 +0000 (23:55 +0200)]
minidlna: update to 1.3.3
Fixes CVE-2023-33476:
ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable
to Buffer Overflow. The vulnerability is caused by incorrect
validation logic when handling HTTP requests using chunked transport
encoding. This results in other code later using attacker-controlled
chunk values that exceed the length of the allocated buffer,
resulting in out-of-bounds read/write.
netsniff-ng: backport patch fixing wrong args handling with musl
Backport a patch from upstream fixing wrong args handling with musl.
Before this patch non args must be passed at the end of the command due
to a musl limitation.
Noah Meyerhans [Mon, 26 Jun 2023 03:02:35 +0000 (20:02 -0700)]
bind: bump to 9.18.16
Fixes CVEs:
- CVE-2023-2828: The overmem cleaning process has been improved, to
prevent the cache from significantly exceeding the configured
max-cache-size limit.
- CVE-2023-2911: A query that prioritizes stale data over lookup
triggers a fetch to refresh the stale data in cache. If the fetch is
aborted for exceeding the recursion quota, it was possible for named
to enter an infinite callback loop and crash due to stack overflow.
The complete list of changes is available in the upstream release
notes at
https://ftp.isc.org/isc/bind9/cur/9.18/doc/arm/html/notes.html#notes-for-bind-9-18-16
Dirk Brenken [Sat, 24 Jun 2023 11:09:40 +0000 (13:09 +0200)]
banip: update 0.8.8-2
* process local lists in strict sequential order to prevent possible race conditions
* support ranges in the IP search, too
* fix some minor search issues
Remi Gacogne [Tue, 13 Jun 2023 15:48:27 +0000 (17:48 +0200)]
dnsdist: Split in two packages `dnsdist` and `dnsdist-full`
`dnsdist-full` has all optional features enabled, but is a big package
in term of both flash and memory footprint.
`dnsdist` only keeps the features that make the most sense
on embeded devices, but can also be customised to match the
user's needs, up to the point where it matches `dnsdist-full`.
git.99rst.org / openwrt-packages.git / log