travelmate: fix loss of configured uplink mac address
- pass the station details to the "rev" call so the uplink section
stays resolved, fixes #30099
- the same empty trm_uplinkcfg also silently skipped disabling the uplink
after trm_maxretry was reached - fixed that too with this oneliner
Daniel Golle [Sat, 25 Jul 2026 17:46:50 +0000 (18:46 +0100)]
uvol: bump version to 1.1
manage volume state over ubus instead of the rootfs
Rework the volume lifecycle around blockd's ubus API, so volume state
lives entirely on the self-describing LVM/UBI backing store and never
leaks into the firmware rootfs.
- register active volumes with blockd over ubus (mount.uc) instead of
spooling mounts into /etc/config/fstab (uci.uc)
- bootstrap .meta from 'uvol boot' and drop the broken 90-uvol-init
uci-default
- run 'uvol boot' straight from the mount.ready trigger, and query
'ubus call block status' at service start to cover storage already
being ready
- defer removal of a volume whose backing device is still held, and
reap it from the mount.umount trigger once it is free
- enforce content-addressed "<algo>-<hexdigest>" volumes in the
dispatcher: reuse an existing volume of the same digest, verify
every write
- verify a content-addressed write in place while the volume is still
incomplete, reporting EBADMSG on mismatch instead of flipping
volume state
- purge incomplete wo/wp leftovers on boot and reclaim an exactly
matching one on create
- serialise mutating commands with a device-wide lock, plus a
per-volume lock ordered after it so a slow write cannot stall other
volumes
- add a grow-only 'resize' verb to both backends: lvextend plus the
matching fs-grow tool for lvm, ubirsvol for ubi
- create ext4 volumes with a journal (was ext2) and request check_fs
when registering a read-write volume
- declare read-only mounts to blockd rather than letting block guess
from the filesystem
- reject non-numeric and non-positive sizes in create and resize
- report its own version
- simplify command line parsing (drop compatibility with ancient ucode)
Requires the matching fstools changes from
openwrt/openwrt@9b11fa4088c6a.
Fixes several security issues:
- CVE-2026-11331 Fix handling of rpz CNAME expansion that returns name too long.
- CVE-2026-11721 Invalid signed wildcard records were being accepted.
- CVE-2026-13321 Fix DNSSEC validation bypass via out-of-zone NSEC Next Field.
- CVE-2026-10723 Correct verification of NSEC3 signer name.
- CVE-2026-12617 Do no assert for some specifics CNAME and DNAME queries.
- CVE-2026-10822 Malformed DNSKEY records could trigger an assertion.
- CVE-2026-11605 Prevent excessive validation work from crafted negative responses.
- CVE-2026-11622 Prevent cache exhaustion under sustained attack.
Full release notes are available upstream at
https://ftp.isc.org/isc/bind9/9.20.26/doc/arm/html/changelog.html
nmap: replace non SPDX license identifiers with SPDX compliant notation
Since this license is not included on the official SPDX License List, it is
referenced in practice as 'NPSL-0.95' or 'NPSL-0.94' but not
'NPSL-0.94-or-NPSL-0.95'.
While we're at it, let's remove the old 'NPSL-0.94', since the source code
uses only 'NPSL-0.95' in the LICENSE file.
openssh: fix BSD license identifier with a valid one
The situation here is complicated. The OpenSSH project combines different
licenses. However, the fact is that the name 'BSD' used here for the
license name is not SPDX-compliant.
It is therefore replaced by the valid SPDX licenses BSD-2-Clause and
BSD-3-Clause.
Florian Eckert [Thu, 19 Feb 2026 12:30:24 +0000 (13:30 +0100)]
xz: use correct SPDX license name
The value 'Public-Domain' is not a correct SPDX identifier so remove
them. In addition, the SPDX license GPL-2.0 is still missing, which is
hereby corrected.
Patches:
- Drop 003-freeradius-fix-error-for-expansion-of-macro.patch (upstream
restructured src/include/threads.h) and add
003-configure-assume-cross-tls.patch instead: the AC_RUN_IFELSE
__thread probe cannot run when cross-compiling, so TLS_STORAGE_CLASS
stays undefined and threads.h hits '#error unsupported' (since 3.2.9).
- Drop 002-disable-session-cache-CVE-2017-9148.patch, 3.2.x is not
affected per https://nvd.nist.gov/vuln/detail/CVE-2017-9148.
- Replace 004-get-hostname-from-proc-in-radtest.patch with
004-radtest-nas-name-from-hostname-env.patch: prefer $HOSTNAME and keep
the upstream `hostname || uname -n` fallback instead of reading
/proc/sys/kernel/hostname unconditionally.
- Re-do 020-fix-freeradius3-krb5.patch, also sent upstream for review.
- Give the touched patches the git format-patch headers 'git am' needs,
with the diff bodies unchanged so they still match 'quilt refresh'.
Depend on libopenssl-legacy when built against OpenSSL: with OpenSSL 3.x
tls_global_init() unconditionally does OSSL_PROVIDER_load(NULL, "legacy")
for MD4/MS-CHAP and errors out when it is missing, so radiusd exits during
startup before it ever serves a request.
Add a test.sh covering the freeradius3, -common, -utils and -democerts
packages: radiusd -XC starts the server for real, the config tree it reads
is checked, the dictionaries the master dictionary still $INCLUDEs must
all be packaged, and the demo certificates must be real PEM.
zabbix: add php8-mod-simplexml dependency to frontend
While the frontend can mostly operate without php8-mod-simplexml, when
trying to import XML templates the user only gets unhelpful error
messages and is unlikely to realize the module is required for that
functionality. Therefore have the frontend depend on php8-mod-simplexml.
The sysctl file increases max files to allow the default full
complement of discovery workers, however this is probably not a
hard requirement and such a conf not shipped elsewhere in tree, so
leave that to the user to configure. (The syslog messages from
zabbix-server and/or zabbix-proxy provided the needed information).
zabbix: reorganize files dir for clarity and to better follow the FHS
Reorganize the extra files under the 'files' dir so that it is more
clear where they go and what they are for, and to avoid having a
disorganized mass of files.
Move the extra C source file out of files and into 'src-extra'.
Avoid treating openwrt-supplied params files as configuration data.
Instead have them in a separate directory under /usr/share which is
included in the zabbix_agentd configuration by default. This also better
follows the FHS.
Hopefully these changes make sense on their own, as well as helping the
CI accept the changes.
SNAPCAST_SOXR passes -DBUILD_WITH_SOXR, which is a build-wide CMake
option: snapserver and snapclient are built from one source tree and
both link libsoxr. The dependency was declared only on snapserver, so
with SNAPCAST_SOXR enabled (the default) the snapclient package failed
at the packaging step:
Package snapclient is missing dependencies for the following libraries:
libsoxr.so.0
Declare +SNAPCAST_SOXR:libsoxr on snapclient too, and relabel the option
"(server + client)" so its build-wide scope is clear.
Fixes: 7673cd9a ("snapcast: make build options explicit and per-package deps precise") Signed-off-by: Mirko Vogt <redacted>
vobject 0.9.9 lists both pytz and six as unconditional runtime requirements
in install_requires, but neither was in DEPENDS. Running the change_tz
console script failed with "ModuleNotFoundError: No module named 'pytz'".
six happened to resolve transitively through python3-dateutil even though
vobject/base.py imports it directly, so list it explicitly rather than rely
on another package's dependency.
Extend test.sh to check that both modules import and that vobject.change_tz
loads.
Fixes: https://github.com/openwrt/packages/issues/29992 Signed-off-by: Alexandru Ardelean <redacted>
snapcast: make build options explicit and per-package deps precise
Pin every CMake BUILD_WITH_* switch and expose the optional features as
config symbols, so builds are reproducible and snapserver/snapclient
each depend only on the libraries their binary actually links (boost is
header-only and becomes a build-only dependency).
Add a patch introducing a BUILD_WITH_SOXR option: upstream looks SOXR up
with an unconditional pkg_search_module(), so resampling gets enabled
purely by whether libsoxr happens to be discoverable in the shared
staging dir - non-deterministic in a package feed. The option makes it
an explicit, REQUIRED choice (enabled-but-missing fails at configure
time instead of silently dropping the feature).
Assisted-By: Claude Opus 4.8 (1M context) <redacted> Signed-off-by: Mirko Vogt <redacted>
NUT (upstream) logging has changed. With the introduction of
NUT_DEBUG_SYSLOG we can set it to "stderr" and have NUT's messages
go to stderr only.
This avoid most duplicate messages when procd sends stderr to syslog.
The reverse (syslog only from NUT) is not a current configuration
option. See the section for NUT_DEBUG_SYSLOG at
https://networkupstools.org/docs/man/nut.conf.html#_directives
This is needed because we use '-FF' so that the daemons remain in the
foreground, which is required for procd to manage them. When using
'-FF' logging behaves differently in NUT than when backgrounded.
Unfortunately, there is still some work to be done upstream to
completely eliminate duplicate messages, so some message continue to
appear twice, though not neccessarily with the same facility.priority.
See also
https://github.com/jimklimov/nut/blob/0c3eed09b89cce1e5c0c65ca03d05b4612371cb8/UPGRADING.adoc#changes-from-282-to-283
and
https://github.com/openwrt/packages/pull/29896#issuecomment-5012737643
Conversely, the log messages the initscripts emit are now configured to
emit only to syslog and not to stderr. This avoids duplicates messages
caused by procd's automatic (not configurable) behaviour of sending
the initscript's stderr to syslog, while preserving the syslogid,
facility and priority we want.
Stan Grishin [Fri, 17 Jul 2026 18:21:04 +0000 (18:21 +0000)]
adblock-fast: update to 1.2.4-4
Maintainer: me
Compile tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Run tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Description:
Update to PKG_RELEASE 4
- Bump PKG_RELEASE from 2 to 4.
- Add PKG_CPE_ID.
files/lib/adblock-fast/adblock-fast.uc:
- Adjust logic for determining the gzip cache path to align with
the new 'compressed_cache' option.
- Remove dependency on 'compressed_cache_dir' for gzip path
construction.
- Update gzip path calculation in 'get_init_status' to use the new
'compressed_cache' option.
Stan Grishin [Fri, 17 Jul 2026 18:24:22 +0000 (18:24 +0000)]
https-dns-proxy: update to 2026.05.06-1
Maintainer: me
Compile tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Run tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Description:
Update to 2026.05.06 and add IP family option
- Update PKG_VERSION to 2026.05.06
- Update PKG_RELEASE to 1
- Add PKG_CPE_ID for CVE tracking
- Update PKG_MIRROR_HASH and PKG_SOURCE_VERSION
files/etc/config/https-dns-proxy:
- Add comments for default options
- Add new 'force_ip_family' option to control IP family for resolvers
- Update default 'bootstrap_dns' to include IPv6 addresses
files/etc/init.d/https-dns-proxy:
- Add DEFAULT_BOOTSTRAP4 and DEFAULT_BOOTSTRAP6 for family fallbacks
- Change 'global_force_ipv6' to 'global_force_ip_family' for new option
- Modify append_boot to filter bootstrap DNS by 'force_ip_family'
- Implement fallback bootstrap DNS for forced IP families with no
compatible configured servers
- Change 'start_instance' to use 'force_ip_family' instead of
'force_ipv6'
- Ensure 'service_started' and 'service_stopped' always return 0 to
prevent incorrect failure reports for `start`/`reload`/`restart`
commands
files/etc/uci-defaults/50-https-dns-proxy-migrate-options.sh:
- Migrate 'force_ipv6_resolvers' option to 'force_ip_family' option
- Remove old 'force_ipv6_resolvers' option after migration
Stan Grishin [Fri, 17 Jul 2026 18:05:10 +0000 (18:05 +0000)]
pbr: update to 1.2.2-20
Maintainer: me
Compile tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Run tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Description:
Update to version 1.2.2-20
- Bump PKG_RELEASE to 20.
- Add Erik Conijn as a co-maintainer.
files/etc/init.d/pbr:
- Update packageCompat to 27.
- Standardize gateway warning messages.
- Add ubus_get_data helper for improved error/warning handling.
- Preserve JSON namespace in json() for better error handling.
- Refine device retrieval logic for OpenVPN interfaces.
- Improve display of IPv4/IPv6 gateways for consistency.
- Adjust service start trigger to only block on errors, not warnings.
- Ensure 'error' field is populated in ubus status when no gateways
are available.
files/etc/uci-defaults/90-pbr:
- Remove sed rule for '/etc/pbr/' to '/usr/share/pbr/' path
update.
OpenSSH reports "10.4p1" but PKG_VERSION is "10.4_p1", so the forced generic
probe never matches and fails. Verify via ssh/sshd where the subpackage ships
one and accept the subpackages that carry no version-reporting binary.
libpam's helper binaries have no version flag, so the forced generic probe
fails with "No executables provided version". Accept the version here; the
library version is already covered by the SONAME checks.
Cover ripe-atlas-common, -probe and -anchor: the busybox measurement
applets resolve and run without crashing, the shell libraries parse, the
capabilities grant CAP_NET_RAW, uci parses the config, and each variant
ships its registration servers and host keys.
test-version.sh overrides the generic per-executable version probe, which
would otherwise run the /usr/sbin/ripe-atlas wrapper -- it has no version
flag and boots the probe instead.
Tiago Gaspar [Mon, 16 Jun 2025 16:02:14 +0000 (17:02 +0100)]
ripe-atlas: add new package
Replace atlas-probe and atlas-sw-probe with ripe-atlas, built from the
upstream ripe-atlas-software-probe release tarball (tag 5110) so future
bumps only touch PKG_VERSION and PKG_HASH. Provide atlas-probe and
atlas-sw-probe so existing installs and sysupgrade keep resolving across
the rename.
Run the probe as the ripe-atlas user instead of root, with ujail granting
the measurement applets CAP_NET_RAW from capabilities.json. Drop the unused
e2fsprogs dependency; keep OPENSSL_WITH_DEPRECATED, which upstream tcputil.c
still needs.
wget: rank wget-nossl below uclient-fetch for the wget alternative
apk uses whatever /usr/bin/wget resolves to for HTTPS index downloads.
wget-nossl's alternative was ranked 300, above the HTTPS-capable
uclient-fetch (200), so pulling it in transitively silently broke
apk update. Lower it to 100 so uclient-fetch keeps the default while
wget-nossl stays selectable. wget-ssl (400) is unchanged.
Fixes: https://github.com/openwrt/openwrt/issues/24270 Signed-off-by: Alexandru Ardelean <redacted>
Drop 001-configure-make-libyaml-default-on-explicit.patch; it was a backport
of upstream commit c5c24486 which is now part of this release, so configure.ac
already makes libyaml default-on and fails fast when yaml-0.1 is missing.
David Connolly [Fri, 17 Jul 2026 11:54:58 +0000 (12:54 +0100)]
udpspeeder: pass the timeout option to the binary
The timeout UCI option is validated and documented but never appended to
the command, so setting it had no effect. Pass it through with the schema
default of 8, which matches the binary's own default.
Fixes: https://github.com/openwrt/packages/issues/18955 Signed-off-by: David Connolly <redacted>
David Connolly [Sun, 5 Jul 2026 20:44:44 +0000 (21:44 +0100)]
udpspeeder: build with the toolchain CXX and flags
Patch the upstream makefile to build the cross target with $(CXX) and the
toolchain $(CXXFLAGS)/$(LDFLAGS), and take the version from an overridable
variable. This replaces the Build/Prepare sed rewrites, and the binary now
picks up the hardening flags.
Honouring CXXFLAGS turns on -mips16 for the mips_24kc targets, where the
C++ atomics compile to a sync instruction MIPS16 cannot encode, so build
them with no-mips16.
strongswan: move strongswan ignore_routing_tables check into subfunction
This makes the generation process clearer and more extensible.
While we're at it, the option 'ignore_routing_tables' is changed to a list of
elements. For the migration, the '/etc/uci-defaults/strongswan' migration
script is be extended with the new function 'migrate_ignore_routing_tables',
which handles the migration from an 'option' element to a 'list' elements.
strongswan: move uci-defaults migration into subfunction
To make the migration script more organized, the migration for the 'ipsec'
unamed section to 'ipsec' named section 'globals' has been moved to a
subfunction.
The change prepares the new migration script to migrate other areas.
strongswan: do not use config_foreach named section globals
In a previous commit, the anonymous 'ipsec' section was changed to a named
section called 'globals'. The reason for this is that this is where the
'strongswan.conf' configuration option are saved. This should only occur
once. Since only one strongswan service can be running on the system.
Therefore, in this commit, the 'config_foreach' loop is removed and
the section is permanently set to 'globals'.
This commit does not change the function and is a preparatory commit.
Assuming there is a global section named 'ipsec'.
strongswan: move strongswan.conf generation to its own function
The cross-file handling of variables that are populated in 'config_ipsec' but
then written to 'strongswan.conf' in the 'do postamble' section is prone
to errors, as variables are often overlooked. The config file
'strongswan.conf' is now generated in a single function without the need to
use global variables.
This commit does not change the function and is a preparatory commit.
strongswan: merging the swanctl and strongswan configurations block by block
In the 'prepare_env' function, the configuration setup for 'swanctl' and
'strongswan' is not grouped into blocks, so it is not clear which functions
depend on each other.
With this change, the 'strongswan' configuration is set up first,
followed by the 'swanctl' configuration.
This commit does not change the function and is a preparatory commit.
Now that post install is running properly, when CI executes the
tests the zabbix-extra-* packages that have a posinst exit the
post install with an error if ubusd is not running.
Drop the error code from killall with no usbd running to fix this.
There are no longer packages that need this.
This offers advanced SSH functions in Python.
But for OpenWrt's context it may work with just using ssh commands
with the subprocess package.
mdns-repeater: pass through CFLAGS/LDFLAGS and package version
Before the change, the feed Makefile would not rely on the predefined
logic of building Makefile-based packages, rather it defined its own
`Build/Compile` step that explicitly called `make`. This didn't play
along well with the upstream Makefile, which doesn't respect the CFLAGS
that come from the environment.
The effect of that was that, for example, `CONFIG_PKG_ASLR_PIE_ALL=y`
was not respected: a non-PIE binary was generated regardless. Other
compiler flags were ignored too in the same manner.
Also it would try to determine the mdns-repeater version by calling to
git, which wouldn't work, since the build system downloaded a pre-made
source tarball without a bundled `.git` directory. The result is an
empty version string when calling `mdns-repeater -h`.
To address all of the above, switch to the built-in logic for
Makefile-type projects. Append to MAKE_FLAGS to completely override
upstream CFLAGS/LDFLAGS and pass through the package version. Set a
dummy HGVERSION variable value to prevent the upstream Makefile from
calling `git` unnecessarily.
modemmanager: make building builtin options optional
This commit enables to choose whether to compile the plugins into the
binary or not. If not included, it moves the plugins to
`/usr/lib/ModemManager/`.
Using add_interface_triggers and check_interface_up is a
better separation of concerns and the code has little in
common (no duplication of code concerns).
While we are at it make both nut-monitor and nut-server failure of
add_interface_triggers non-fatal with a logged error message.
nut: simplify/improve consistency for RUNAS and STATEPATH
We claimed we only supported a single upsd section named 'upsd' and a
single uspmon section named 'upsmon', but when determining RUNAS
and STATEPATH we were using overly-complex functions as we were
attempting to support multiple upsd and upsmon sections.
Simplify the logic by adhering to our stated support.
While were are at it we make RUNAS handling more consistent between
nut-server (upsd) and nut-monitor (upsmon).
We no longer try to limp along if RUNAS is not set by find_runas; to do
this properly would require over-complicated logic when setting file
and directory permissions and ownership.
nut: do not trigger on interface activity by default
The defaults were triggiering on any activity on the network, which
caused excessive restarts. So default to no interface trigger, with
'all' (or specific interfaces) as an option.
See https://github.com/openwrt/packages/pull/29607#discussion_r3463553192
While driverpath is could in theory be configurable, this was not implemented
in the OpenWrt NUT package, and there is not need for it. Therefore remove the
sample configuration for it, and setting that configuration in the upsd.conf file.
See https://github.com/openwrt/packages/pull/29607#discussion_r3463526037
We should fallback to the default if one is not specified. In addition
find_statepath is the wrong place to check for its existence - it should
be created by the initscript if it does not exist.
See https://github.com/openwrt/packages/pull/29607#discussion_r3462976647
Fabrice Fontaine [Wed, 17 Jun 2026 15:23:39 +0000 (17:23 +0200)]
utils/hplip: fix CPE ID
hp:linux_imaging_and_printing is a better CPE ID than
hp:linux_imaging_and_printing_project as this CPE ID has the latest CVE
(whereas hp:linux_imaging_and_printing_project only has CVEs up to
2013):
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:hp:linux_imaging_and_printing
Daniel Golle [Mon, 13 Jul 2026 11:45:18 +0000 (12:45 +0100)]
fwupd: allow enabling the devlink plugin
The devlink plugin allows updating firmware of network devices
implementing the kernel devlink interface. It is gated on libmnl,
which was hard-disabled so far. Wire the libmnl meson option to a
new FWUPD_PLUGIN_DEVLINK config symbol, enabled by default, and add
the corresponding libmnl runtime dependency to fwupd-libs.
git.99rst.org / openwrt-packages.git / log