- fallback 'block' now rejects instead of dropping, so clients fail
at once rather than on a timeout
- tproxy: a proxied flow whose listener is gone is rejected the same
way, whatever the fallback
- route: the policy table's fallback default is a prohibit route
instead of a blackhole
- update the README
Co-authored-by: Claude <noreply@anthropic.com>
Signed-off-by: Dirk Brenken <dev@brenken.org>
* after reaching the retry limit, the uplink got disabled but the
'continue 2' only skipped to the next scan result, so every further
scan entry with the same essid (e.g. a second bssid) started a new
retry round against the already disabled uplink
Signed-off-by: Dirk Brenken <dev@brenken.org>
del_interface looked for the active interface (if_ifwithname) and
answered "Permission denied" when there was none. That is the normal
case when it is called from a hotplug "remove" event: the device is
gone, olsrd has seen the link go away and has taken the active
interface down by itself. The configured entry stayed in
olsr_cnf->interfaces for good.
olsrd looks at every configured interface that is not up every
NicChgsPollInt seconds (2.5 by default) with ioctl(SIOCGIFFLAGS). For a
name that does not exist, the kernel tries to load a module for it
(dev_load), twice: "netdev-<name>" and "<name>". On OpenWrt each of
these is a run of kmodloader over all modules.
A gateway with wireguard tunnels that come and go collects one such
entry per tunnel. On an EdgeRouter 4 after 24 days there were 12 of
them: 16 to 19 process starts per second, 38 million since boot, about
half of one of its four cores.
Look for the configured entry instead, take it out of the list, and
only take the interface down if it is up. An unknown name is now "Not
found".
Tested on OpenWrt 25.12 (x86_64, in a container): removing an interface
that vanished before, one that is up, an unknown one, two vanished ones
in the other order, and adding one again. The same change has been
running on an EdgeRouter 4 (mips64) gateway.
Signed-off-by: Simon Polack <spolack+git@mailbox.org>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Fix the issues the Copilot review found in the code moved from the
routing feed:
- The init script wrote "option ignore '0'" of an interface section as
"interface <dev> ignore false" into the babeld configuration, which
babeld rejects. Skip the option like ifname.
- The handlers of get_xroutes, get_routes and get_neighbours didn't
check their allocations. Free the collected entries and return an
error instead of crashing.
- add_filter allocated and returned success for an invalid filter type
and leaked the filter. Reject the type before the allocation, and
handle a failure of strdup() and add_filter().
- babeld doesn't use uloop, so the default handler of libubus did
nothing when ubusd restarted. The stale socket stayed readable and
babeld spun in its select loop, and the babeld object was never
added again. Reconnect from the main loop instead, waiting longer
after each failed attempt, up to 32 seconds. ubus_reconnect() adds
the object again.
- The notifications used the helpers for array elements, so their
fields were in an unnamed table. Put them at the root of the message.
- Neighbour notifications were named neigh.*, while ubus.h documents
neighbour.*. Use the documented names.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Nick Hainke <vincent@systemli.org>
The metric is optional in filter_policy: only ifname and type are
rejected when missing, so `ubus call babeld add_filter
'{"ifname":"eth0","type":0}'` reaches
filter->action.add_metric = metric;
with metric never assigned, i.e. whatever was left on the stack. In
babeld an add_metric of INFINITY means "deny", so an uninitialized
read can silently turn an allow filter into a deny filter.
Initialize it to 0, which is the neutral value the filter would have
had if the caller had passed it explicitly.
Reported-by: openwrt-ai[bot]
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Babel is a loop-avoiding distance-vector routing protocol for
IPv6 and IPv4 with fast convergence properties (RFC 8966).
Moved from the openwrt/routing feed, as discussed in
https://github.com/openwrt/routing/issues/184.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
[fix the default conf_dir in babeld.config and the indentation of the
lines 600-add-ubus.patch adds to local.c, as suggested in the review]
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Nick Hainke <vincent@systemli.org>
GCC 15 defaults to gnu23, which breaks the old bundled getopt
K&R-style declarations used by netcat 0.7.1. Force gnu17 for this
package to preserve the previous compiler semantics.
Signed-off-by: Marcin Maj <marcinmajsc@gmail.com>
Implement the FriendlyName accessor required by the 6.2.0 agent using
the runtime hostname, with a model-name fallback.
Signed-off-by: Andrei Ovcharenko <a@krot.name>
Refresh the stock OpenWrt platform patches for the new BPL configuration
backend and removed Wi-Fi credential setter. Keep the production log
levels through the upstream syslog CMake setting and update patch offsets.
Signed-off-by: Andrei Ovcharenko <a@krot.name>
--disable-asm dates back to the import of the package from the old
packages repository (5bf972ecf). libgcrypt detects CPU features at
runtime, and with its assembly it uses the Armv8 crypto extensions and
NEON on ARM and the vector crypto extensions on RISC-V.
bench-slope, median of 3 runs, Cortex-A53: AES-CBC decryption 23.9 ->
1357 MiB/s, AES-GCM 19.1 -> 646 MiB/s, SHA-256 70.8 -> 620 MiB/s.
Cortex-A72 in AArch32, without crypto extensions: SHA-512 45.7 -> 78.0
MiB/s, AES-GCM 33.0 -> 47.7 MiB/s.
libgcrypt.so grows by 34 KiB on aarch64, 35 KiB on riscv64 and 12 KiB on
arm, compressed with xz. mips and loongarch64 gain no assembly and grow
by less than 5 KiB.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
1.12.3 and 1.12.4 fix bugs and security issues, among them RSA PSS and
OAEP input validation and an out-of-bounds read in the GOST28147 MAC.
1.12.3 also adds interfaces; the SONAME stays libgcrypt.so.20.
Release notes:
https://dev.gnupg.org/T8223https://dev.gnupg.org/T8417
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Run collectd in a VRF, using the procd 'vrf' parameter:
config globals 'globals'
option vrf '<dev>'
Assisted-by: Claude:claude-fable-5-1
Signed-off-by: Nick Hainke <vincent@systemli.org>
libudev-zero does not use libevdev. It reads input capabilities from
sysfs and uevents with the constants from <linux/input.h>. The
dependency was carried over from libudev-fbsd.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
* fix false-positive ntp time sync, e.g. at boot with the
sysfixtime clock, no uplink
* ntp hotplug: reject events with an invalid stratum
* remove the synthetic hotplug trigger from f_system
Signed-off-by: Dirk Brenken <dev@brenken.org>
Changes:
- clear old retained topics when a topic translation is added
- configurable sensor offline time (sensor-offline-seconds)
- fix a buffer overflow and a crash on empty MQTT messages
- add --version option
- do not build the tests in the package (BUILD_TESTING=OFF)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FKXWPFfkJSBzsjL6umsjGD
Signed-off-by: Peter Liedholm <peterfromswe884@gmail.com>
10.7.1 accepts libyang v3, so frr keeps building against libyang-legacy.
Refresh 997-reverse_python_test.patch, which otherwise applies with an
offset of one line; the other two patches are unchanged.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
test.sh asserts vtysh, libfrr.so and the per-subpackage daemon binary,
and cross-checks the release in "vtysh --help" against the package
version. test-version.sh overrides the generic scan, which cannot work
for frr-pythontools.
Package/frr-zebra installed libmlag_pb.so* with INSTALL_BIN, which
dereferences symlinks and so tripped the SONAME-symlink check; use
$(CP) instead.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Requires the libyang 5.x / libnetconf2 4.x / sysrepo 5.x stack the
previous commits introduce, so DEPENDS moves back to +libyang and the
legacy staging prefix override is dropped.
Rewrite the three uci-defaults scripts against 2.8.x: modules now come
from both netopeer2 and libnetconf2, sysrepoctl lost -a, and the
keystore and netconf-server models changed. Add test.sh and a
test-version.sh override for the version-flag-less cli.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Jump from the 3.x series; the SONAME moves from libsysrepo.so.7 to
libsysrepo.so.8. The protobuf-c IPC layer is gone in favour of shared
memory, taking its two stub patches and the libprotobuf-c, libev and
libredblack dependencies with it, and DEPENDS moves back to +libyang.
Renamed cmake options are dealt with; PRINTED_CONTEXT_ADDRESS=0 and
NOTIFD_SETUP=OFF skip a try_run() and an install hook that both run
target binaries, which cannot work when cross-compiling.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Jump from the 3.x series to 4.x, which tracks libyang 5.x and moves its
SONAME from libnetconf2.so.3 to libnetconf2.so.5.
Switch DEPENDS back to +libyang and drop the legacy staging prefix
override. ENABLE_PAM=OFF is upstream now, so its patch goes away.
4.x owns the transport YANG modules netopeer2 registers at first boot,
so ship them to /etc/netconf2/modules.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Jump from the 3.x series to 5.x; the SONAME moves from libyang.so.3 to
libyang.so.5, an ABI break for anything linked against the old package.
In-tree consumers were moved to libyang-legacy in the previous commit
and stay there until their own bumps later in this series.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Build a second package from the same libyang 3.13.6 tarball, so
consumers bound to the v3 ABI keep working once libyang moves to 5.x.
It ships only /usr/lib/libyang.so.3* and stages its headers, library
and .pc under /usr/lib/libyang-legacy to avoid colliding with libyang.
All in-tree consumers are switched to it here; the commits that follow
move libnetconf2, sysrepo and netopeer2 back to +libyang as their
upstream releases gain v5 support. frr stays on the legacy ABI.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
liblzma.pc is generated by a make rule that expands $(libdir) and
$(includedir) to absolute paths, which OpenWrt's pkg-config wrapper
cannot redirect at the staging directory. Rewrite the staged copy with
SED instead of patching the template, as ~50 other packages here do.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Add a CI test.sh covering both firewall variants. It verifies the daemon
binary links and prints its usage banner, that the procd init script, UCI
config and iface hotplug files are installed, and that the variant-specific
firewall assets ship: fw3 include for iptables, nft fragments for nftables.
It also drives the config-file parser, which runs before firewall setup,
with an invalid and a valid config to confirm both paths behave.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Fixes a heap overflow in PinholeVerification(), adds snprintf() return
checks, trims over-long nftables rule descriptions, and stops aborting
on SSL errors in the HTTPS path.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Fixes a potential crash on oversized rewrites, Message-Authenticator
verification for CoA/Disconnect-Request, DtlsVersion config handling,
and the MS-MPPE size/alignment check (GHSA-wj29-mxmc-q98c).
Refresh both patches for the new source and give them the git headers
FormalityCheck requires, attributed to their original authors.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Andrey Brusnik
Dirk BrenkenandClaude
Simon PolackandClaude Opus 5.5
Nick Hainke
Josef SchlehoferandClaude Fable 5
Hannu Nyman
Ivan Pavlov
Daniel F. Dickinson
John Audia
Roc Lai
Marcin Maj
Andrei Ovcharenko
Jan Klos
Alan Feng
Julius Bairaktaris
Romain Isnel
Antonio Pastor
Tianling Shen
Noah Meyerhans
Rui Salvaterra
Peter LiedholmandClaude Opus 5.5
Alexandru Ardelean
Packet Please