Ryan Keane [Sun, 16 Jun 2024 00:45:29 +0000 (20:45 -0400)]
unbound: Update to 1.20.0
Updated 010-configure-uname.patch as source changed.
Removed 100-example-conf-in.patch as not needed any more.
Release message:
This release has a fix for the DNSBomb issue CVE-2024-33655. This has a
low severity for Unbound, since it makes Unbound complicit in targeting
others, but does not affect Unbound so much.
To mitigate the issue new configuration options are introduced.
The options discard-timeout: 1900, wait-limit: 1000
and wait-limit-cookie: 10000 are enabled by default. They limit the
number of outstanding queries that a querier can have. This limits
the reply pulse, and make Unbound less favorable for the issue.
With the config wait-limit-netblock and wait-limit-cookie-netblock
the parameters can be fine tuned for specific destinations.
More information on the attack and Unbound's mitigations are
presented further down.
Other fixes in this release are that Unbound no longer follows symlinks
when truncating the pidfile. Unbound also does not chown the pidfile,
this is for safety reasons. There are also a number of fixes for RPZ, in
handling CNAMEs. There is a memory leak fix for the edns client subnet
cache. For DNSSEC validation a case is fixed when the query is of type
DNAME. The unbound-anchor program is fixed to first write to a temporary
file, before replacing the original. This handles disk full situations,
and because of it unbound-anchor needs permission to create that file,
in the same directory as the original file. There is also a fix for
IP_DONTFRAG, to disable fragmentation instead of the opposite.
The option cache-min-negative-ttl can be used to set the minimum TTL
for negative responses in the cache. It complements existing options to
set the maximum ttl for negative responses and to set the minimum and
maximum ttl but not specifically for negative responses.
The option cachedb-check-when-serve-expired option makes Unbound use
cachedb to check for expired responses, when serve-expired is enabled,
and cachedb is used. It is enabled by default.
The -q option for unbound-checkconf can be added to silence it when
there are no errors.
Milinda Brantini [Wed, 12 Jun 2024 06:38:03 +0000 (14:38 +0800)]
powertop: update to 2.15
Release mainly focuses on bug fixes and patching compatibility issues.
Also, adds support to multiple platforms.
Removed obsolete patch as upstream has fixed.
Dirk Brenken [Sun, 16 Jun 2024 19:50:40 +0000 (21:50 +0200)]
banip: update 1.0.0-2
* fixed a possible "Argument list too long" error in the f_log function
* fixed multiple, incomplete digit character classes
* fixed/optimized split file handling
* cosmetics
Supports interface metrics exposed by mwan3. The performance is a
little slow compared to other collectors (~300ms) as the ubus call is
where most of the time is spent. Any future speedups are likely better
put into mwan3's rpcd binary.
Oliver Sedlbauer [Tue, 11 Jun 2024 13:48:51 +0000 (15:48 +0200)]
modemmanager: add option to force connection
This commit improves the automatic reconnect logic. If the modem cannot
establish a connection, for example due to poor reception, the
proto_block_restart prevents the interface from trying to reconnect.
To enforce the connection, this commit adds a new option that allows the
system to attempt to establish a connection indefinitely.
,,_ -*> Snort++ <*-
o" )~ Version 3.1.84.0
'''' By Martin Roesch & The Snort Team
http://snort.org/contact#team
Copyright (C) 2014-2024 Cisco and/or its affiliates. All rights reserved.
Copyright (C) 1998-2013 Sourcefire, Inc., et al.
Using DAQ version 3.0.15
Using LuaJIT version 2.1.0-beta3
Using OpenSSL 3.0.13 30 Jan 2024
Using libpcap version 1.10.4 (with TPACKET_V3)
Using PCRE version 10.42 2022-12-11
Using ZLIB version 1.3.1
Using Hyperscan version 5.4.2 2024-05-26
Using LZMA version 5.4.6
go1.22.4 (released 2024-06-04) includes
security fixes to the archive/zip and net/netip packages,
as well as bug fixes to the compiler,
the go command, the linker,
the runtime, and the os package.
erlang: fix mis-detection of transparent hugepages
Latest Erlang update incorrectly detects THP as always enabled,
which leads to segmentation fault on systems without transparent hugepages.
Here we manually override configure flag by checking actual option of target kernel.
This is an alternative approach to #24209. Instead of switching
to bundled/internal libgd, workaround the capability detection
by giving the information to the build system directly.
PHP's original approach does not work when cross-compiling,
but since it is known which features are enabled in OpenWrt's
build, we can directly enable these features here, too.
This is not that future prove, but should do the job for the
moment until a proper solution was discussed with upstream.
krant [Sun, 2 Jun 2024 10:16:24 +0000 (13:16 +0300)]
curl: update to 8.8.0
- Switch source to .xz according to CONTRIBUTING.md
- Switch project URL to HTTPS
- Drop upstreamed patch
- Refresh remaining patch
- Adopt the package
Georgi Valkov [Mon, 27 May 2024 14:30:54 +0000 (17:30 +0300)]
frr: fix compilation with GCC14
Fixes:
zebra/zebra_netns_notify.c: In function 'zebra_ns_ready_read':
zebra/zebra_netns_notify.c:265:40: error: implicit declaration of function 'basename' [-Wimplicit-function-declaration]
265 | if (strmatch(VRF_DEFAULT_NAME, basename(netnspath))) {
| ^~~~~~~~
Fixed by including libgen.h, then since basename may modify its
parameter, allocate a copy on the stack, using strdupa, and pass the
temporary string to basename.
According to the man page for basename:
With glibc, one gets the POSIX version of basename() when
<libgen.h> is included, and the GNU version otherwise.
The POSIX version of basename may modify the contents of path,
so we should to pass a copy when calling this function.
It was decided that we should require to use real name once again.
There was discussion about it on the mailing list [1], which
was based on the commit in different OpenWrt repo [2]
Rosen Penev [Mon, 27 May 2024 00:49:38 +0000 (17:49 -0700)]
mdnsreponder: update to 2200.100.94.0.2
The IETF fork is unmaintained. In addition, the versioning is incompatible with apk.
010-uclibc.patch is pointless as uclibc is no longer used by OpenWrt.
020-fix-core-dump-while-parsing-interface-list.patch was an upstream
backport. No longer needed.
Added tls=no to avoid mbedtls dependency.
mDNSIdentify is gone.
Added back patches from version 878.200.35. They required manual
refreshing. 120-reproducible-builds.patch is probably needed. Not sure
about 100-linux_fixes.patch.
Add OpenEmbedded patches. Some crash fixes. mdnsd is less noisy with
them.
Log stderr to the log. Otherwise there's no output.
Add to uci-defaults script a migration from old deprecated options to new:
use_staging to staging
keylength to key_type
remove standalone
add missing validation_method
We still support the old options in the acme.init if old config was copied after installing of the newer version of the acme-common.
Rosen Penev [Sun, 2 Jun 2024 00:31:48 +0000 (17:31 -0700)]
wsdd2: fix compilation with GCC14 and 64-bit
struct msghdr under musl uses padding ints for 64-bit, which means we
can't direct initialize like this. Switch to initializing each member
explicitly.
git.99rst.org / openwrt-packages.git / log