Tianling Shen [Sun, 7 Feb 2021 17:48:21 +0000 (01:48 +0800)]
ttyd: force enable authentication for login
Currently, we called `/usr/libexec/login.sh` as login command, but unfortunately the auth
is disabled by default in it[1], and this is really serious as it could be a free "backdoor"
for any spoiler who has conntectd to the router via LAN or wireless.
In my option, it shouldn't be exposed to anyone without auth, so I set the default login
command to `/bin/login`. And for those who really want that, they can do it themselves.
1. `login.sh` adjusts whether use authentication or not from system config named ttylogin,
which is set to disabled by default. See package/base-files/files/bin/config_generate#L243.
Hans Dedecker [Sun, 7 Feb 2021 17:52:36 +0000 (18:52 +0100)]
nghttp2: update to 1.43
3dc6c0af Bump version number to 1.43.0 e8762781 Update AUTHORS 2bf841e2 workflow: Build with UBSAN enabled 7ebab98e Merge pull request #1548 from nghttp2/py3-bindings 23fc6cc9 Bump Linux runner OS to ubuntu 20.04 2e35cdea Update doc 22af8e78 Require python3 for python bindings c88e9100 Update ax_python_devel.m4 43ba3125 Merge pull request #1547 from nghttp2/sphinx-v3.3 3c17299a Update enum references a7ecff65 Make doc generation work with sphinx v3.3 79a4f789 Merge pull request #1546 from nghttp2/py3-scripts 28ba0b37 Update document reference 6b7ade9f Require python3 for python scripts 46536729 Bump clang-format to 10 563c1173 Merge pull request #1544 from nghttp2/nghttpx-clear-mcpool 1c04ca80 Merge pull request #1540 from tavrez/patch-1 d32e20bc nghttpx: Make sure that Pool gets cleared when all buffers are returned 8b8ba6b0 Merge pull request #1542 from nghttp2/nghttpx-check-sigalg 81fb0153 nghttpx: Choose ECDSA cert if compatible signature algorithm available d8c71d5f Added new nghttp2_ksl.c to Windows makefile fb5b5aef Merge pull request #1537 from nghttp2/nghttpx-allow-colon-in-pattern 6787423e nghttpx: Add workaround to include ':' in backend pattern ffcdf5df Merge pull request #1533 from LorenzNickel/patch-1 0cdb1738 Fix typo in security.rst c9d5472f Bump version number to 1.43.0-DEV 15bd71ed Update manual pages
Nick Hainke [Thu, 4 Feb 2021 15:34:02 +0000 (16:34 +0100)]
wg-installer: add wg-installer
This tool can be used to automatically create wireguard tunnels. Using
rpcd a new wireguard interface is created on the server where the client
can connect to.
Wiregurad server automatically installs a user and associated ACL to use
the wireguard-installer-server features. The user is called wginstaller
and so is the password.
Get Usage:
wg-client-installer get_usage --ip 127.0.0.1 --user wginstaller
--password wginstaller
The build process uses a minilua helper for code generation
which must not be compiled with target cross-compiler but
the host compiler.
This error was spotted by buildbots:
ext/opcache/minilua /builder/shared-workdir/build/sdk/build_dir/
target-x86_64_musl/php-8.0.1/ext/opcache/jit/dynasm/dynasm.lua
-D X64=1 -o ext/opcache/jit/zend_jit_x86.c /builder/shared-workdir
/build/sdk/build_dir/target-x86_64_musl/php-8.0.1/ext/opcache/jit/zend_jit_x86.dasc
/bin/bash: ext/opcache/minilua: No such file or directory
Makefile:406: recipe for target 'ext/opcache/jit/zend_jit_x86.c' failed
make[4]: *** [ext/opcache/jit/zend_jit_x86.c] Error 127
isc-dhcp: treat 'config host' like superset of 'config domain'
Not including an A record mapping will cause nsupdate to balk at
CNAME and MX records (and probably SRV as well) because the target
will be unknown at the time of parsing, until the lease gets
activated.
We need these RR's to be in place well before the servers even
come up.
Stijn Tintel [Thu, 4 Feb 2021 17:16:44 +0000 (19:16 +0200)]
miniupnpd: introduce IGDv1 variant
Microsoft Windows, Xbox and possibly other operating systems do not
support IGDv2. With IGDv2 enabled, they send a HTTP GET request for
rootDesc.xml and WANIPCn.xml, and then nothing happens. The Microsoft
implementation probably doesn't like the WANIPCn.xml response and
decides UPnP is not available. When miniupnpd is built without IGDv2
support, after the 2 HTTP GET requests, there is a HTTP POST request to
/ctl/IPConn, and miniupnpd configures the port forward as expected.
The runtime option force_igd_desc_v1=yes (UCI: igvd1) does not solve
this problem. It's possible this was enough in earlier miniupnpd
versions, but it does not fix the problem the current version.
Since we are a modern distro, we want to support the latest and
greatest, so we should default to IGDv2 enabled. Introducing a
menuconfig option to disable IGDv2 would only help people who build
their own images, so offer a separate package variant for IGDv1.
Dirk Brenken [Thu, 4 Feb 2021 14:35:21 +0000 (15:35 +0100)]
banip: release 0.7.0
* major rewrite
* add support for multiple chains
* add mac whitelisting
* add support for multiple ssh daemons in parallel
* add an ipset report engine
* add mail notifications
* add suspend/resume functions
* add a cron wrapper to set an ipset related auto-timer for
automatic blocklist updates
* add a list wrapper to add/remove blocklist sources
* add 19.x and Turris OS 5.x compatibility code
* sources stored in an external compressed json file
(/etc/banip/banip.sources.gz)
* change Country/ASN download sources (faster/more reliable)
* fix DHCPv6/icmpv6 issues
Rosen Penev [Wed, 3 Feb 2021 22:45:06 +0000 (14:45 -0800)]
ksmbd-tools: update to 3.3.4
Major changes are:
add "vfs objects = acl_xattr" parameter in configuration.
fix wrong group domain name in lsarpc response.
set to SID_TYPE_UNKNOWN if there is no domain sid in server.
Noah Meyerhans [Wed, 3 Feb 2021 16:21:49 +0000 (08:21 -0800)]
iputils: Fix version reporting
The iputils build system embeds git tags into the generated binaries
for use by commands like ping -V. Since openwrt packaging is done in
a different repository from the upstream repo, the tags it finds
aren't particularly meaningful, and we get confusing results like
those described at https://github.com/openwrt/packages/issues/13920
This change removes the git tag inspection in favor of the static
version string that's already known to the upstream build system.
Georgi Valkov [Sat, 30 Jan 2021 12:23:48 +0000 (14:23 +0200)]
hwdata: fix build error on macOS
The install command on macOS does not support the -T flag.
As suggested by Rosen Penev, this package does not compile anything,
so the contents can be installed directly.
git.99rst.org / openwrt-packages.git / log