Stan Grishin [Wed, 12 Feb 2025 03:57:26 +0000 (03:57 +0000)]
pbr: update to 1.1.8-10
* Improve verbose output on start
* Allow to not create ip rule for WG server
* Improve boot up start (take 2)
* Improve verbose output when setting triggers
* Override DNS hijack with DNS policies from pbr
Stan Grishin [Mon, 10 Feb 2025 21:18:24 +0000 (21:18 +0000)]
https-dns-proxy: bugfix: start on boot
* bugfix: working start on boot when interfaces are up
(thanks @tmcqueen-materials and @b1ackbeat)
* improvement: better output when setting triggers on start
Florian Eckert [Tue, 4 Feb 2025 11:36:51 +0000 (12:36 +0100)]
modemmanager: do not disable modem on reconnect
If the modem loses the connection, an attempt is made to re-establish the
connection via the report-down script.
Until now, the modem was disabled when the modem processed the teardown of
the modemmanager protohandler. The immediate up events of netifd renables
the modem right away. This takes time, which is not necessary.
This commit changes the behavior so that the modem is not disabled when
the modemmanager is disconnected via the report-down script.
Daniel Golle [Fri, 11 Oct 2024 03:41:22 +0000 (04:41 +0100)]
gnunet: update to v0.23.1
v0.23.0 (tagged as v0.23.1)
- Add GNUNET_CONFIGURATION_set_value_float
- util: Float configuration values are no longer locale-dependent, but instead must always be in LC_NUMERIC=C format
- GNUNET_DISK_internal_file_handle_ changed to always return int
- Reworkd ProjectData handling; Now required as input for various API calls.
v0.22.2:
- GNUNET_STRINGS_get_utf8_args removed.
- Removed unsafe and unused functions for 2d/3d array allocation.
v0.22.1:
- Update HELLO files for new bootstrap peer
- Fix regression in DHT Bloom filter
- Fix long-standing regression in HELLO URI expirations
v0.22.0:
- New logging API to print/parse hex bytes
- Added RFC9180 HPKE and associated KEMs
- Replace oneshot PKE and KEM APIs with HPKE
- New Elligator KEM
- Namestore API allows multiple records to be inserted in a single transaction (if plugin supports this)
- New ECDH API that uses KDFs instead of hash
- Renamed GNUNET_CRYPTO_hkdf to GNUNET_CRYPTO_hkdf_gnunet
- Added new standard SHA256-based HKDF APIs
- New hostlist bootstrap domain https://bootstrap.gnunet.org
Updated hashmap version.
In the code, almost all the url words have been replaced with domain.
Fixed a bug in the service of getting gateway from VPN name.
Tianling Shen [Wed, 5 Feb 2025 08:05:43 +0000 (16:05 +0800)]
golang: Update to 1.23.6
go1.23.5 (released 2025-01-16) includes security fixes to the
crypto/x509 and net/http packages, as well as bug fixes to the
compiler, the runtime, and the net package.
go1.23.6 (released 2025-02-04) includes security fixes to the
crypto/elliptic package, as well as bug fixes to the compiler
and the go command.
This commit adds support for folder synchronization.
An example is in the 810-files file where it is explained how to
synchronize all hotplug files of keepalived.
Adam Beck [Tue, 4 Feb 2025 14:17:29 +0000 (14:17 +0000)]
ddns-scripts: add type field for digitalocean API
DigitalOcean API requires a "type" JSON field to update a DNS
record. This adds that while checking for IPv6 to change which
record type to use. Without it, the API call fails, making
the script unable to update the DNS records for DigitalOcean.
The hotplug scripts are called with every state change. When called, the
scripts are processed under '/etc/hotplug.d/keepalived'. This change adds
the functionality that the last state change of the keepalived can be
queried via the ubus.
Antonio Pastor [Sun, 26 Jan 2025 20:45:59 +0000 (15:45 -0500)]
netatalk: create small and full variants
Small version includes only AFP file sharing to minimize size.
Base version adds AppleTalk. This matches the contents of the
existing package.
Full version includes everything that OpenWrt can support and
configuration option for build system (menuconfig).
Daniel Golle [Thu, 30 Jan 2025 03:01:27 +0000 (03:01 +0000)]
cryptsetup: update to version 2.7.5
Enable building cryptsetup-reencrypt, integritysetup and veritysetup,
add new binary packages for integritysetup and veritysetup.
Changes since version 2.7.4
~~~~~~~~~~~~~~~~~~~~~~~~~~~
* Fix possible online reencryption data corruption (only in 2.7.x).
In some situations (initializing a suspended device-mapper device),
cryptsetup disabled direct-io device access. This caused unsafe
online reencryption operations that could lead to data corruption.
The code now adds strict checks (and aborts the operation) and
changes direct-io detection code to prevent data corruption.
* Fix a clang compilation error in SSH token plugin.
As clang linker treats missing symbols as errors, the linker phase
for the SSH token failed as the optional cryptsetup_token_buffer_free
was not defined.
* Fix crypto backend initialization in crypt_format_luks2_opal API call.
,,_ -*> Snort++ <*-
o" )~ Version 3.6.2.0
'''' By Martin Roesch & The Snort Team
http://snort.org/contact#team
Copyright (C) 2014-2024 Cisco and/or its affiliates. All rights reserved.
Copyright (C) 1998-2013 Sourcefire, Inc., et al.
Using DAQ version 3.0.18
Using Hyperscan version 5.4.2 2025-01-28
Using libpcap version 1.10.5 (with TPACKET_V3)
Using LuaJIT version 2.1.0-beta3
Using LZMA version 5.6.2
Using OpenSSL 3.0.15 3 Sep 2024
Using PCRE2 version 10.42 2022-12-11
Using ZLIB version 1.3.1
Stan Grishin [Tue, 28 Jan 2025 00:23:59 +0000 (00:23 +0000)]
https-dns-proxy: bugfixes and improvements
* improvement: Makefile: prepend `r` to PKG_RELEASE in binary and init script versions to match package version
* bugfix: init script: more reliable/robust start on boot
* improvement: init script: more compact output()
* improvement: init script: better DNS Hijack login
* improvement: init script: fold some dnsmasq-related functions into dhcp_backup()
Dirk Brenken [Mon, 27 Jan 2025 22:28:04 +0000 (23:28 +0100)]
adblock: update 4.2.4-1
* support smartdns as dns backend
* support top level domains in local white- and blackklist,
e.g. a 'de' in the blacklist blocks all domains with a german tld
and the tld compression removes all subdomains from the final blocklist
Michael Heimpold [Sat, 25 Jan 2025 11:15:16 +0000 (12:15 +0100)]
openssh: fix recursive key file removal
The -r option is not required here but should also not hurt,
since it was already tested, that $key is a file.
However, to express the intent of the command more clearly,
let's drop it.
Coia Prant [Wed, 15 Jan 2025 16:21:53 +0000 (16:21 +0000)]
ddns-scripts: get l3 device for bind network using curl
If pppoe is used for wan access. script set 'eth1' as interface for curl
call. The correct interface is however 'pppoe-wan'.
These scripts use 'network_get_physdev' function to get real device for
bind_network but this is wrong. We need instead the l3_device of the the
logical interface.
In case if we don't use pppoe connection - 'l3_device' is equal to real device.
CVE-2025-23083 - src,loader,permission: throw on InternalWorker use when permission model is enabled (High)
CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)
Dependency update:
CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)
Ryan Keane [Wed, 13 Nov 2024 11:14:03 +0000 (03:14 -0800)]
git: Set PKG_FORTIFY_SOURCE to 0 when lto enabled
If PKG_FORTIFY_SOURCE is not 0 and lto is enabled for package git, it
will fail to compile with the following example error:
/openwrt/staging_dir/toolchain-aarch64_generic_gcc-14.1.0_musl/include/stdio.h: In function 'process_curl_messages': /openwrt/staging_dir/toolchain-aarch64_generic_gcc-14.1.0_musl/include/stdio.h:90:8: error: inlining failed in call to 'always_inline' 'fwrite': function body can be overwritten at link time
90 | size_t fwrite(const void *__restrict, size_t, size_t, FILE *__restrict);
| ^
http.c:355:33: note: called from here
355 | fprintf(stderr, "Received DONE message for unknown request!\n");
| ^
A related issue is #13016 .
This commit set PKG_FORTIFY_SOURCE to 0 if CONFIG_USE_LTO is y.
Yun Wang [Mon, 20 Jan 2025 08:58:32 +0000 (16:58 +0800)]
syncthing: Update to 1.29.2 and Change logfile path
Update to 1.29.2 and Change logfile path from /etc/syncthing/syncthing
log to /var/log/syncthing.log.
This utilizes tmpfs (memory-based storage) to prevent disk usage growth
caused by log file accumulation during extended operation.
Benefits:
- Avoids storage saturation from excessive log growth.
- Aligns with best practices for temporary log management.
- For systems using flash storage (e.g., SSDs or eMMC), storing logs in
tmpfs avoids flash memory wear caused by frequent writes to
/etc/syncthing.
lpac: update to 2.2.1, add support for custom ISD-R AID
Updated lpac to 2.2.1 and added support for custom ISD-R AIDs.
This allows for a broader range of esim cards with non standard AIDs to be supported.
See https://github.com/estkme-group/lpac/pull/181 for additional info.
Dirk Brenken [Fri, 17 Jan 2025 15:51:15 +0000 (16:51 +0100)]
adblock: update 4.2.3-3
Summary of three PRs regarding new adblock sources with minor changes/additions:
- add new source reg_lithuania, PR provided by @Myginas
- add new source certpl, PR provided by @jkostorz
- add new source oisd_nsfw_small, PR provided by @Turjoy9
AntiBlock program proxies DNS requests.
The IP addresses of the specified domains are added to
the routing table for routing through the specified interface.
git.99rst.org / openwrt-packages.git / log