- fallback 'block' now rejects instead of dropping, so clients fail
at once rather than on a timeout
- tproxy: a proxied flow whose listener is gone is rejected the same
way, whatever the fallback
- route: the policy table's fallback default is a prohibit route
instead of a blackhole
- update the README
Co-authored-by: Claude <noreply@anthropic.com>
Signed-off-by: Dirk Brenken <dev@brenken.org>
* after reaching the retry limit, the uplink got disabled but the
'continue 2' only skipped to the next scan result, so every further
scan entry with the same essid (e.g. a second bssid) started a new
retry round against the already disabled uplink
Signed-off-by: Dirk Brenken <dev@brenken.org>
del_interface looked for the active interface (if_ifwithname) and
answered "Permission denied" when there was none. That is the normal
case when it is called from a hotplug "remove" event: the device is
gone, olsrd has seen the link go away and has taken the active
interface down by itself. The configured entry stayed in
olsr_cnf->interfaces for good.
olsrd looks at every configured interface that is not up every
NicChgsPollInt seconds (2.5 by default) with ioctl(SIOCGIFFLAGS). For a
name that does not exist, the kernel tries to load a module for it
(dev_load), twice: "netdev-<name>" and "<name>". On OpenWrt each of
these is a run of kmodloader over all modules.
A gateway with wireguard tunnels that come and go collects one such
entry per tunnel. On an EdgeRouter 4 after 24 days there were 12 of
them: 16 to 19 process starts per second, 38 million since boot, about
half of one of its four cores.
Look for the configured entry instead, take it out of the list, and
only take the interface down if it is up. An unknown name is now "Not
found".
Tested on OpenWrt 25.12 (x86_64, in a container): removing an interface
that vanished before, one that is up, an unknown one, two vanished ones
in the other order, and adding one again. The same change has been
running on an EdgeRouter 4 (mips64) gateway.
Signed-off-by: Simon Polack <spolack+git@mailbox.org>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Fix the issues the Copilot review found in the code moved from the
routing feed:
- The init script wrote "option ignore '0'" of an interface section as
"interface <dev> ignore false" into the babeld configuration, which
babeld rejects. Skip the option like ifname.
- The handlers of get_xroutes, get_routes and get_neighbours didn't
check their allocations. Free the collected entries and return an
error instead of crashing.
- add_filter allocated and returned success for an invalid filter type
and leaked the filter. Reject the type before the allocation, and
handle a failure of strdup() and add_filter().
- babeld doesn't use uloop, so the default handler of libubus did
nothing when ubusd restarted. The stale socket stayed readable and
babeld spun in its select loop, and the babeld object was never
added again. Reconnect from the main loop instead, waiting longer
after each failed attempt, up to 32 seconds. ubus_reconnect() adds
the object again.
- The notifications used the helpers for array elements, so their
fields were in an unnamed table. Put them at the root of the message.
- Neighbour notifications were named neigh.*, while ubus.h documents
neighbour.*. Use the documented names.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Nick Hainke <vincent@systemli.org>
The metric is optional in filter_policy: only ifname and type are
rejected when missing, so `ubus call babeld add_filter
'{"ifname":"eth0","type":0}'` reaches
filter->action.add_metric = metric;
with metric never assigned, i.e. whatever was left on the stack. In
babeld an add_metric of INFINITY means "deny", so an uninitialized
read can silently turn an allow filter into a deny filter.
Initialize it to 0, which is the neutral value the filter would have
had if the caller had passed it explicitly.
Reported-by: openwrt-ai[bot]
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Babel is a loop-avoiding distance-vector routing protocol for
IPv6 and IPv4 with fast convergence properties (RFC 8966).
Moved from the openwrt/routing feed, as discussed in
https://github.com/openwrt/routing/issues/184.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
[fix the default conf_dir in babeld.config and the indentation of the
lines 600-add-ubus.patch adds to local.c, as suggested in the review]
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Nick Hainke <vincent@systemli.org>
GCC 15 defaults to gnu23, which breaks the old bundled getopt
K&R-style declarations used by netcat 0.7.1. Force gnu17 for this
package to preserve the previous compiler semantics.
Signed-off-by: Marcin Maj <marcinmajsc@gmail.com>
Implement the FriendlyName accessor required by the 6.2.0 agent using
the runtime hostname, with a model-name fallback.
Signed-off-by: Andrei Ovcharenko <a@krot.name>
Refresh the stock OpenWrt platform patches for the new BPL configuration
backend and removed Wi-Fi credential setter. Keep the production log
levels through the upstream syslog CMake setting and update patch offsets.
Signed-off-by: Andrei Ovcharenko <a@krot.name>
* fix false-positive ntp time sync, e.g. at boot with the
sysfixtime clock, no uplink
* ntp hotplug: reject events with an invalid stratum
* remove the synthetic hotplug trigger from f_system
Signed-off-by: Dirk Brenken <dev@brenken.org>
10.7.1 accepts libyang v3, so frr keeps building against libyang-legacy.
Refresh 997-reverse_python_test.patch, which otherwise applies with an
offset of one line; the other two patches are unchanged.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
test.sh asserts vtysh, libfrr.so and the per-subpackage daemon binary,
and cross-checks the release in "vtysh --help" against the package
version. test-version.sh overrides the generic scan, which cannot work
for frr-pythontools.
Package/frr-zebra installed libmlag_pb.so* with INSTALL_BIN, which
dereferences symlinks and so tripped the SONAME-symlink check; use
$(CP) instead.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Requires the libyang 5.x / libnetconf2 4.x / sysrepo 5.x stack the
previous commits introduce, so DEPENDS moves back to +libyang and the
legacy staging prefix override is dropped.
Rewrite the three uci-defaults scripts against 2.8.x: modules now come
from both netopeer2 and libnetconf2, sysrepoctl lost -a, and the
keystore and netconf-server models changed. Add test.sh and a
test-version.sh override for the version-flag-less cli.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Jump from the 3.x series; the SONAME moves from libsysrepo.so.7 to
libsysrepo.so.8. The protobuf-c IPC layer is gone in favour of shared
memory, taking its two stub patches and the libprotobuf-c, libev and
libredblack dependencies with it, and DEPENDS moves back to +libyang.
Renamed cmake options are dealt with; PRINTED_CONTEXT_ADDRESS=0 and
NOTIFD_SETUP=OFF skip a try_run() and an install hook that both run
target binaries, which cannot work when cross-compiling.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Build a second package from the same libyang 3.13.6 tarball, so
consumers bound to the v3 ABI keep working once libyang moves to 5.x.
It ships only /usr/lib/libyang.so.3* and stages its headers, library
and .pc under /usr/lib/libyang-legacy to avoid colliding with libyang.
All in-tree consumers are switched to it here; the commits that follow
move libnetconf2, sysrepo and netopeer2 back to +libyang as their
upstream releases gain v5 support. frr stays on the legacy ABI.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Add a CI test.sh covering both firewall variants. It verifies the daemon
binary links and prints its usage banner, that the procd init script, UCI
config and iface hotplug files are installed, and that the variant-specific
firewall assets ship: fw3 include for iptables, nft fragments for nftables.
It also drives the config-file parser, which runs before firewall setup,
with an invalid and a valid config to confirm both paths behave.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Fixes a heap overflow in PinholeVerification(), adds snprintf() return
checks, trims over-long nftables rule descriptions, and stops aborting
on SSL errors in the HTTPS path.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Fixes a potential crash on oversized rewrites, Message-Authenticator
verification for CoA/Disconnect-Request, DtlsVersion config handling,
and the MS-MPPE size/alignment check (GHSA-wj29-mxmc-q98c).
Refresh both patches for the new source and give them the git headers
FormalityCheck requires, attributed to their original authors.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
netifd always emits a nexthop for its routes, the unspecified address
for a gateway-less one, e.g. wg0 with route_allowed_ips. Taken as
gateway, IPv4 treats 0.0.0.0 as none, but the kernel rejects "via ::"
with EINVAL, so the IPv6 policy route was never installed and marked
traffic fell through to main, where the interface metrics decided
(IPv6 leak via WAN).
Co-authored-by: Claude <noreply@anthropic.com>
Signed-off-by: Dirk Brenken <dev@brenken.org>
- handle captive portals failing after the redirect,
fixes#30709
- Strip the port from the effective url host and, for a consistent
foreign host comparison, from the probe host as well
Signed-off-by: Dirk Brenken <dev@brenken.org>
With only ripe-atlas-common installed, get_key told users to start the
probe to create the key, but the init creates it only once
ripe-atlas-probe or ripe-atlas-anchor is installed. For an anchor, it
pointed to the registration form of software probes. Say which package
is missing, and point an anchor to the anchor application.
Fixes: 21b1fefb41 ("ripe-atlas: add get_key and probeid to init script")
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
ripe-atlas-common provides atlas-probe at version 5130, newer than the
atlas-probe 2.6.3 it is meant to replace, so apk replaces atlas-probe
with ripe-atlas-common whenever only that package is installed, for
example when LuCI installs ripe-atlas-common or ripe-atlas-anchor.
atlas-sw-probe then keeps running without its measurement programs,
and its key is not taken over.
Provide atlas-probe from ripe-atlas-probe instead, which also replaces
atlas-sw-probe and takes over its key.
Fixes: b77264c922 ("ripe-atlas: add new package")
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
When LuCI passes a session id, migrate-ipsec-to-swanctl moves its uci
delta into /tmp/run/rpcd/uci-<session id>, rpcd's private save directory
of that session. rpcd stops naming this directory after the session id,
as the id is a bearer credential that leaked through directory listings,
so the migrated configuration would no longer show up as pending changes
in LuCI.
Stage the migration through rpcd's uci ubus API instead: revert the
session's ipsec changes, delete all sections and add the sections of the
migrated configuration. Then revert the changes of the uci command line
tool, which the old code moved away. This works with old and new rpcd
versions. If staging fails, both are reverted and the script exits with
an error.
Fixes: d5f33e6410 ("strongswan: support optional UCI session staging in migrate-ipsec-to-swanctl")
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Previous package (atlas-sw-probe) printed the public key to register a
new probe with "/etc/init.d/atlas get_key" and the probe ID with
"/etc/init.d/atlas probeid", and the documentation [1] [2] tells users
to run get_key. Add both back as "/etc/init.d/ripe-atlas get_key" and
"/etc/init.d/ripe-atlas probeid". For a probe that has registered since
boot, get_key prints the probe ID instead of asking to register it.
[1] https://docs.turris.cz/basics/apps/atlas/
[2] https://github.com/openwrt/packages/blob/d2aeaf041bc0/net/atlas-sw-probe/files/atlas.readme
Fixes: b77264c922 ("ripe-atlas: add new package")
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* define tproxy_available() before render(): ucode resolves the name
when render() is compiled, so the later definition left it null and
every status call failed - LuCI showed "no answer from the backend"
Signed-off-by: Dirk Brenken <dev@brenken.org>
* add the per-policy action 'tproxy': hands the selected tcp/udp traffic
to a transparent proxy on the router (option tproxy_port), delivered to
127.0.0.1/::1 via a 'local default dev lo' policy table
* restore rules for tproxy flows carry the tproxy statement on every
packet - a mark alone loses udp flows to the proxy's reply socket
* a proxied flow whose listener is gone is always dropped: its conntrack
entry was never NATed and would leave with the client's own address;
fallback 'main'/'block' decides about new flows only
* no tproxy rules in output (the kernel rejects the statement there), no
keep_local rule for tproxy (main would forward socket-assigned packets)
* tproxy policies are skipped as an issue without kmod-nft-tproxy instead
of failing the whole nft batch
* shunt check and the rpcd status report tproxy policies
* readme update
Co-authored-by: Claude <noreply@anthropic.com>
Signed-off-by: Dirk Brenken <dev@brenken.org>
WeeChat (Wee Enhanced Environment for Chat) is a fast, light and
extensible chat client with a modular architecture and relay support.
This package provides:
- weechat-minimal (default variant): headless daemon without ncurses,
suited for routers and for use through relay web or mobile clients.
- weechat-full: the ncurses terminal client as well as the headless
daemon.
- Config.in: menuconfig options for zstd, cJSON and the scripting
plugins (Python, Lua, Ruby, Perl, Tcl).
- procd init script and UCI configuration. irc.conf, relay.conf and
logger.conf are generated from UCI, and the values written to them
are checked first. The relay refuses to start without a password and
disk logging is off by default to protect flash storage. Passwords
are stored as hex encoded WeeChat expressions, so characters like ';'
or '${' can neither run commands nor get evaluated.
- The daemon runs as the weechat user. /etc/weechat, /etc/weechat/tls
and /var/run/weechat belong to root. The init script only changes
paths whose parent the daemon cannot modify, except for the generated
files in the sticky config directory, which it renames into place
without following symlinks. Of the log directories it only creates
the default /var/log/weechat.
- test.sh: checks the binaries and plugins, the init script
validation, the directory layout, the values WeeChat reads back from
the generated files and that the relay listens.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Tiago Gaspar has not been active in this repository since May 2026 and
did not respond when Alexandru Ardelean offered to pick the package up
in https://github.com/openwrt/packages/pull/30030. Michel Stam, who
wrote RIPE's own OpenWrt packaging, has not taken part here, and since
5120 that packaging lists the RIPE Atlas Team instead of him. I run a
probe and test the package on Turris OS, so take it over.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
ripe-atlas-probe provides atlas-sw-probe, but carries nothing over, so
an upgraded probe would come up with a new key, which RIPE rejects
until its host enters it on atlas.ripe.net.
Take over the key and the settings of atlas-sw-probe in a uci-defaults
script of ripe-atlas-probe, and stop and disable atlas once the key is
in place. A failed run is retried on the next boot. Until it succeeds,
the init does not start the probe, so the key is never used twice and
no new key is created. Until the key is in place, the init logs that it
waits.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
- Build the tree once, the variants only install different files. Both
provide ripe-atlas, with the probe as the default variant, so that
apk, whose packages carry no CONFLICTS, cannot install both.
- Select busybox tee, cmp and find with the options that the
registration and the init use, and drop jsonfilter and the busybox ps,
killall, tar, ntpd and bunzip2 selects, which nothing installed uses.
- Do not keep /etc/ripe-atlas/mode, the init rewrites it on every start.
- List all licenses: the measurement busybox is BusyBox (GPL-2.0-only)
with libevent (BSD-3-Clause and ISC) linked in, and five of the shell
libraries are LGPL-2.1-or-later.
- Link the measurement applets in one loop.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Restart the probe when /etc/config/ripe-atlas changes. procd does not
restart an instance when any of these options changes, and up to OpenWrt
25.12, when it stops one, it signals only the main script, so the
measurement daemons, the ssh tunnel and telnetd would keep running. Stop
and start the whole service instead.
On stop, take the processes from the instance's cgroup, which holds
exactly those of the probe, and fall back to the ripe-atlas group only
when it holds none.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
procd hands capabilities to a service only through ujail, which is
optional. Without it the probe ran as ripe-atlas without CAP_NET_RAW,
and its ping and traceroute measurements failed.
Use ujail when it and the ripe-atlas user exist, and run the probe as
root otherwise, as atlas-sw-probe did, with a warning in the log. Keep
only CAP_NET_RAW, the probe never changes its user.
Fixes: b77264c922 ("ripe-atlas: add new package")
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Andrey Brusnik
Dirk BrenkenandClaude
Simon PolackandClaude Opus 5.5
Nick Hainke
Josef SchlehoferandClaude Fable 5
Ivan Pavlov
Daniel F. Dickinson
John Audia
Roc Lai
Marcin Maj
Andrei Ovcharenko
Jan Klos
Alan Feng
Tianling Shen
Noah Meyerhans
Rui Salvaterra
Alexandru Ardelean
Packet Please
Hauke Mehrtens