Ulrich Stark [Sun, 10 Aug 2025 20:21:53 +0000 (23:21 +0300)]
ccrypt: fix compilation with gcc15
gcc15 is using iso9899:2024 by default.
ccrypt fails to compile with it.
--> use previous standard "-std=c17" instead.
Ref.: https://github.com/openwrt/packages/issues/27112
Michael Heimpold [Mon, 21 Jul 2025 21:37:56 +0000 (23:37 +0200)]
php8: link PCRE2 JIT usage to actual library configuration
libpcre2's JIT support is controlled with a compile-time flag.
When PHP is compiled against it (external libpcre2 - not PHP's bundled
version) as in our use-case, then it tries to auto-detect whether
JIT support is enalbed or not - but this is done based on a guess
when cross-compiling.
So instead of guessing, we need to tell the actual OpenWrt configuration
of libpcre2 to PHP.
George Sapkin [Wed, 26 Mar 2025 00:04:22 +0000 (02:04 +0200)]
adguardhome: run as an unprivileged user
Run AdGuard Home without superuser privileges, by granting the binary
capabilities through ujail.
AdGuard Home writes new config files, so it must have r/w access to the
directory where these files live. Which means existing configs must be
migrated to a new directory, /etc/adguardhome, by default.
CAP_NET_BIND_SERVICE and CAP_NET_RAW capabilities are based on the
official documentation linked below.
Petr Štetiar [Wed, 6 Aug 2025 09:30:40 +0000 (09:30 +0000)]
kmod: fix build failure in install step over dirty build dir
When building kmod-32 package for the first time (clean build_dir), it
builds and installs fine. When building for 2nd time, sometimes
(probably some race condition?) it fails to build in install step with
following error:
for tool in insmod lsmod rmmod depmod modprobe modinfo; do \
ln -s kmod /tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/$tool; \
done
ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/insmod': File exists
ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/lsmod': File exists
ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/rmmod': File exists
ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/depmod': File exists
ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/modprobe': File exists
ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/modinfo': File exists
Wesley Gimenes [Tue, 5 Aug 2025 17:14:55 +0000 (14:14 -0300)]
CONTRIBUTING.md: accept only real names in the SoB
Follow the rule from the Submission Guidelines:
https://openwrt.org/submitting-patches#submission_guidelines
And the shared formal check:
https://github.com/openwrt/actions-shared-workflows/blob/ba03db3b5ae747ed9f38df6c96eb4a37a9f7f7c5/.github/workflows/formal.yml#L37-L43
Dirk Brenken [Mon, 4 Aug 2025 18:53:01 +0000 (20:53 +0200)]
banIP: update 1.5.6-7
* skip rdap requests/replies with placeholders for all IPv4/IPv6 addresses
* sanitize possible bogus config values, e.g. '/dev/null' as a directory
* change URL for beycyber feed
Vladimír Čunát [Thu, 31 Jul 2025 06:55:46 +0000 (08:55 +0200)]
knot-resolver: update DNSSEC root trust anchors
This is long overdue. Honestly I dislike that packaging
is hardcoding it this way. It's error-prone, as we can see.
Knot Resolver source does contain the up to date anchors,
and it also (optionally) installs them. Still, I'm not up to
larger changes in OpenWrt packaging right now.
Security
--------
- DoS: fix a rare segfault in `resolve` function (!1720)
Someone controlling the DNS traffic might be able
to trigger this crash intentionally and too often.
- DoS: drop a wrong assertion/crash (!1721)
Someone controlling the DNS traffic will most likely be able
to trigger this crash intentionally and too often.
Security
--------
- DoS: fix unconfirmed crashes with the line below (!1683)
[system] requirement "h && h->end > h->begin" failed in queue_pop_impl
Improvements
------------
- tests: disable problematic config.http test (#925, !1678)
- validator: accept a confusing NODATA proof with insecure delegation (!1678)
Bugfixes
--------
- daemon/http: DoH stream got stuck after returning an error code (!1652)
- stats: request latency was very incorrect in some cases (!1678)
e5500 is the only powerpc64 target we have in tree, but it's not
supported by golang[1]. Since it's hard to opt e5500 out from the
supported arch list, simply remove powerpc64 from it for now.
`ubus.call(sprintf('network.interface.%s', ifname), 'status', {})`
returns null if the interface `ifname` doesn't exists (yet).
For pppoe interfaces using `option ipv6 auto`, a virtual interface suffixed `_6`
is automatically created once the connection is established,
but until then it doesn't exists.
John Audia [Fri, 1 Aug 2025 20:05:50 +0000 (16:05 -0400)]
modemmanager: change permissions on dbus file
/etc/dbus-1/system.d/org.freedesktop.ModemManager1.conf needs to be 644
so that it can be read to prevent the following since dbus runs as an
unprivileged user:
dbus-daemon[12465]: Encountered error 'Failed to open "/etc/dbus-1/system.d/org.freedesktop.ModemManager1.conf": Permission denied' while parsing '/etc/dbus-1/system.d/org.freedesktop.ModemManager1.conf
John Audia [Fri, 1 Aug 2025 14:12:05 +0000 (10:12 -0400)]
dbus: use pid file owned by dbus
Switching to the dbus user in edc5a534 also needed to redefine the
location of dbus.pid into the directory under its ownership. This
commit fixes that omission.
Init Script:
- a lot of visual output improvements, especially with verbosity=2
- better output separation for different verbosity levels
- removed unneeded runningErrorFile
- bugfix: updated runningConfigFile
- updated runningStatusFile and added runningStatusFileLock
- moved append_url() higher up for better visibility
- refactor force-redownload/restart on some config changes functionality
- improve count_blocked_domains
- add internal debug_log() for debugging functions where output is captured
- unified all json add/get calls in the same formatting
- major rework on json() to allow storing of error/warning messages as json objects
- added some error/warning messages
- renamed `cache()` function to `adb_file()` to better reflect functionality
- added functionality to test the dnsmasq config before restarting dnsmasq with ad-blocking
- added functionality to throw warnings if TLDs or leading-dot domains are discovered
in the final block-list file (can be disabled by `sanity_check` option)
- added functionality to test DNS resolution after resolver restart with `heartbeat_domain`
for `heartbeat_sleep_timeout` seconds
- added functionality to revert the resolver's config/ad-blocking if heartbeat domain cannot
be resolved after resolver restart
- added `ALLOWED_TMP` variable/file for better processing of external allow-lists
- added debug output to log with the elapsed time for each step of processing
- drastically improved final block-list optimization with the new awk script
- minor other performance improvements
- added check_tld/check_leading_dot CLI commands to show domains breaking sanity checks
- added validate functions to triggers
Init Script:
- move extra_command calls high up for visibility
- bump packageCompat to sync with luci app
- implement support for debug_dnsmasq to dump dnsmasq debug into $packageDebugFile
- create $runningStatusFile json-file allowing more verbose errors/warnings messages
- replaced `state add` calls with json add calls to store errors/warnings messages
- remove no longer needed errorSummary, warningSummary
- ensure environment is only loaded once per run via $load_environment_flag
- bugfix: update is_{host,hostname,domain,ipv4,mac_address} functions to properly sort policy entries
- bugfix: change references to melmac.net to melmac.ca
- add some new error/warning messages
- add delay before service is started on boot via procd_boot_trigger_delay
- bugfix: add logic to identify unknown policy entries instead of silently failing on them
- store error/warning messages as json objects in ubus data for luci app
- update load_validate_config with debug_dnsmasq and procd_boot_trigger_delay entries
On my "test" router (5 wans, 2 tracking ips per wan), before any rework,
prometheus-node-exporter-lua mwan3 average scraping time was 1230ms
(scraping only the interfaces), after optimizing the shell version,
average time was down to 485ms, with ucode we are now at 41ms.
pgrep is pretty slow as it needs to read all /proc/*/cmdline
or /proc/*/status, and it's called twice per wan.
Add STARTED and PID files to speedup mwan3_get_mwan3track_status().
mwan3: add new readfile function to speedup variable read from file
This is a preparation for adding an utility function readfile() to read
directly to a variable. Using '$(cat ...)' causes a fork/execve which is
extremely slow just to read '~2' chars.
(commit message from Florian Eckert) Signed-off-by: Etienne Champetier <redacted>
John Audia [Tue, 15 Jul 2025 14:05:43 +0000 (10:05 -0400)]
nfs-kernel-server: fix build
Add nls.mk and patch to avoid the build ending in an error:
In function 'write_table',
inlined from 'write_tables' at rpc_tblout.c:73:4,
inlined from 't_output.constprop' at rpc_main.c:841:3:
rpc_tblout.c:91:26: error: '%s' directive writing likely 1 or more bytes into a region of size between 0 and 99 [-Werror=format-overflow=]
91 | s_print (progvers, "%s_%s",
| ^
rpc_tblout.c:91:26: note: assuming directive output of 1 byte
In function 'sprintf',
inlined from 'write_table' at rpc_tblout.c:91:7,
inlined from 'write_tables' at rpc_tblout.c:73:4,
inlined from 't_output.constprop' at rpc_main.c:841:3:
/scratch/union/staging_dir/toolchain-x86_64_gcc-15.1.0_glibc/include/bits/stdio2.h:30:10: note: '__builtin___sprintf_chk' output 2 or more bytes (assuming 102) into a destination of size 100
30 | return __builtin___sprintf_chk (__s, __USE_FORTIFY_LEVEL - 1,
| ^
lto1: some warnings being treated as errors
make[6]: *** [/scratch/union/tmp/ccHfYNRX.mk:2: /scratch/union/tmp/ccudJcWZ.ltrans0.ltrans.o] Error 1
lto-wrapper: fatal error: make returned 2 exit status
compilation terminated.
mold: fatal: lto-wrapper failed
Josef Schlehofer [Wed, 30 Jul 2025 09:52:03 +0000 (11:52 +0200)]
mqttled: remove package
Development of this package is stalled [1],
it uses python3-netifaces [2], but that repository
was archived in 20211 [3], because there does not
seems to be replacement according to this issue:
https://github.com/trevortrevor/mqttled/issues/3
git.99rst.org / openwrt-packages.git / log