harden captive portal auto-login script handling:
* enforce the login-script allowlist in the backend instead of the
LuCI frontend only: canonicalize the configured path via 'readlink -f'
(defeats ../ traversal and symlink-to-interpreter tricks) and require a
regular, executable /etc/travelmate/*.login file before running it
* run the script in a noglob subshell ('set -f') so attacker-influenceable
script_args can no longer expand globs into the trusted script; field
splitting (multiple args) is preserved
* writing into /etc/travelmate/ is not covered by the luci-app-travelmate
ACL, so this limits the root-executed script to admin-placed login scripts
and closes a delegated-ACL to root command execution path.
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 0627b412ee)
- fix uplink teardown for bssid-pinned stations
the new implementaion reads the sta object once and parses fields by name via jshn
(isolated namespace, single fork). Bug finder: @adam8833 (#29768)
- add a fork-free f_normbssid() helper and normalize all config-side bssids
to upper case before comparison (in f_getcfg(), covering all callers, and
on the direct scan comparisons in f_main()).
- LuCI: adds a normBssid() helper function as well
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 71d92bcc9e)
Maintainer: me
Compile tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Run tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Description:
Update to 1.2.4
- Update PKG_VERSION to 1.2.4 and PKG_RELEASE to 2.
- Update documentation URL from melmac.ca to mossdef.org.
README.md:
- Update documentation URL from melmac.ca to mossdef.org.
files/etc/config/adblock-fast:
- Add default option `download_connect_timeout '10'`.
- Add default option `download_allow_insecure '1'`.
- Set default `parallel_downloads` to `8`.
- Remove commented `download_max_time` line.
files/etc/init.d/adblock-fast:
- Increment `initCompat` to 17.
- Add `download_connect_timeout`, `download_max_time`,
`download_allow_insecure` to config validation schema.
files/etc/uci-defaults/90-adblock-fast:
- Use `initCompat` from init script to stamp `config_compat`.
- Migrate `parallel_downloads` from boolean to numeric cap for compat < 15.
- Seed new `download_connect_timeout` from old `download_timeout`
for compat < 16.
- Add new `config_compat` and `config_version` stamping.
files/lib/adblock-fast/adblock-fast.uc:
- Increment package `compat` to 17.
- Introduce `task_slot_ram` for per-downloader memory budgeting.
- Add `download_connect_timeout`, `download_max_time`,
`download_allow_insecure` to `reload` triggers.
- Store `downloader` kind and track `_last_dl_timeout` status.
- Refine downloader detection: prefer curl, then uclient-fetch, then
GNU wget, finally generic wget.
- Update `curl` command flags for `--insecure`, `--connect-timeout`,
`--speed-limit`/`--speed-time`, `--max-time`.
- Update `uclient-fetch` flags for `--no-check-certificate`.
- Update `wget` flags for `--no-check-certificate`,
`--connect-timeout`, `--read-timeout`.
- Improve SSL support detection for uclient-fetch.
- Capture `curl` exit code 28 as a distinct timeout failure.
- Expand `get_text` cases for `errorDetectingFileType`,
`warningMissingRecommendedPackages` (args), `warningParallelDownloadsThrottled`,
`warningDownloadTimeout`.
- Allow `download_allow_insecure` for `get_url_filesize` calls.
- Set `download_allow_insecure` default to true in `config_schema`.
- Change `parallel_downloads` from boolean to integer `8` default in
`config_schema`.
- Add `download_connect_timeout` and `download_max_time` to `config_schema`.
- Read up to 4KB for `detect_file_type`.
- Improve `warningMissingRecommendedPackages` output: list missing
packages and use `apk` or `opkg` install command.
- Split `process_file_url` into parallelizable `prepare_file_url`
and serial `apply_result`, plus `emit_dl_line`.
- Implement memory-aware throttling for `parallel_downloads`.
- Revert to single `process_file_url` for serial uses and test runner.
- Correct `get_mem_available` to return current free memory only.
- Rename `get_mem_total` to `get_mem_available`.
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 57bc3f85ae)
Signed-off-by: Stan Grishin <stangri@melmac.ca>
Dependencies for plugin authn_gssapi, authn_ldap, authn_pam, authn_dbi
and authn_sasl are not correctly written.
This cause lighttpd package to always compile krb5-libs, libopenldap and
libpam, even if not selected
Before the fix:
grep -e libpam -e krb5-libs -e libopenldap .config
\# CONFIG_PACKAGE_libpam is not set
\# CONFIG_PACKAGE_libopenldap is not set
\# CONFIG_PACKAGE_krb5-libs is not set
make | grep -e libpam -e krb5 -e ldap
make[3] -C feeds/packages/net/krb5 compile
make[3] -C feeds/packages/libs/libpam compile
make[3] -C feeds/packages/libs/openldap compile
With the fix:
make | grep -e libpam -e krb5 -e ldap
"nothing compiled"
Check that fix works when mod-authn tokens are
selected (select lighttpd-mod-authn_xxx):
grep lighttpd-mod-authn .config
CONFIG_PACKAGE_lighttpd-mod-authn_file=y
CONFIG_PACKAGE_lighttpd-mod-authn_gssapi=m
CONFIG_PACKAGE_lighttpd-mod-authn_ldap=m
CONFIG_PACKAGE_lighttpd-mod-authn_pam=y
make | grep -e libpam -e krb5 -e ldap
make[3] -C feeds/packages/net/krb5 compile
make[3] -C feeds/packages/libs/libpam compile
make[3] -C feeds/packages/libs/openldap compile
x-ref:
"lighttpd: Malformed dependencies cause unselected packages to be compiled"
https://github.com/openwrt/packages/pull/28157
github: closes#28157
Signed-off-by: Alarcon Laurent <laurent.alarcon@sagemcom.com>
Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
(cherry picked from commit ee21a8b227)
Add a patch fixing a possible crash, when a non-responding host is
tried to be pinged and retry attempts are limited by MaxMissed option.
> daemon.err: collectd[14133]: ping plugin: host 192.168.1.99 has not answered 3 PING requests, triggering resolve
> daemon.info: procd: Instance collectd::instance1 s in a crash loop 7 crashes, 3 seconds since last crash
Fixes: #29649
* upstream bug created: https://github.com/collectd/collectd/issues/4406
* older upstream bug: https://github.com/collectd/collectd/issues/3079
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit eb21982576)
The link flag makes the main program depend on liblua in official
package feeds, even if collectd-mod-lua is not installed.
The plugin is already linked against liblua.so, so this can be removed.
Signed-off-by: Qingfang Deng <dqfext@gmail.com>
[added PKG_RELEASE bump]
(cherry picked from commit aa0a14e2dd)
The lxc-unprivileged package depends on both newgidmap and newuidmap
if users are installing and setting it up for the first time. dc52894
dropped both of the applets.
This change builds libusbid as a shared lib which builds a versioned
symbol which OpenWrt does not stage so build with --disable-shared
and --enable-static to avoid a failure.
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 5883c07493)
Enable trailing whitespace trimming, insert final newline, and force LF.
Configure git input validation to warn if subject exceeds 60 characters
or if body lines exceed 75 characters.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit d1acb1cc44)
On macOS (Darwin) hosts, building host Python C extensions (such as Cython) using the '-shared' flag and linking against '-lpython3.x' causes the host Python interpreter to load a duplicate copy of the Python runtime. This leads to type checking mismatches and segmentation faults (SIGSEGV) when importing the compiled extension.
For example, running:
./staging_dir/hostpkg/bin/python3 -c "import Cython.Utils"
crashes with:
Segmentation fault: 11
To build shared modules correctly on macOS, they must be compiled as bundles using the '-bundle -undefined dynamic_lookup' flags instead of '-shared', and they should not link against the Python library (no '-lpython3.x' in LDFLAGS).
Fix this by dynamically adjusting LDSHARED and LDFLAGS in python3-host.mk when the host OS is Darwin.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit ea541f48b5)
- Fix loop in subshells calling wait builtin with inherited job list
- Fix mapfile problem when callback unsets the variable it is modifying
- Fix subshells inappropriately running the EXIT trap if they receive a
fatal signal before resetting traps
Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
(cherry picked from commit 3085718815)
rust/host fails to compile on macOS running on Intel x64
because the host target triple is autogenerated to be
'arm64-unknown-linux-'. Rust doesn't have such a target triple, thus the
build fails because there are no pre-built artefacts for bootstrapping.
Fix this by setting RUSTC_HOST_ARCH to 'x86_64-apple-darwin' in case
our host is HOST_ARCH=x86_64 and HOST_OS=Darwin.
This fix is based on the existing fix for Apple silicon [1].
Fixes:
File "/Volumes/pepe/py/openwrt/build_dir/target-x86_64_musl/host/rustc-1.96.0-src/x.py", line 53, in <module>
bootstrap.main()
~~~~~~~~~~~~~~^^
File "/Volumes/pepe/py/openwrt/build_dir/target-x86_64_musl/host/rustc-1.96.0-src/src/bootstrap/bootstrap.py", line 1418, in main
bootstrap(args)
~~~~~~~~~^^^^^^
File "/Volumes/pepe/py/openwrt/build_dir/target-x86_64_musl/host/rustc-1.96.0-src/src/bootstrap/bootstrap.py", line 1366, in bootstrap
build.download_toolchain()
~~~~~~~~~~~~~~~~~~~~~~~~^^
File "/Volumes/pepe/py/openwrt/build_dir/target-x86_64_musl/host/rustc-1.96.0-src/src/bootstrap/bootstrap.py", line 697, in download_toolchain
download_component(download_info)
~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^
File "/Volumes/pepe/py/openwrt/build_dir/target-x86_64_musl/host/rustc-1.96.0-src/src/bootstrap/bootstrap.py", line 529, in download_component
get(
~~~^
download_info.base_download_url,
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
...<3 lines>...
verbose=download_info.verbose,
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
)
^
File "/Volumes/pepe/py/openwrt/build_dir/target-x86_64_musl/host/rustc-1.96.0-src/src/bootstrap/bootstrap.py", line 58, in get
raise RuntimeError(
...<6 lines>...
)
RuntimeError: src/stage0 doesn't contain a checksum for dist/2026-04-16/rust-std-1.95.0-x86_64-unknown-linux-darwin24.6.0.tar.xz. Pre-built artifacts might not be available for this target at this time, see https://doc.rust-lang.org/nightly/rustc/platform-support.html for more information.
[1] https://github.com/openwrt/packages/commit/105fa3920e12f557bdf1fcbc566fc286fb53e319
Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
(cherry picked from commit aa32dd256e)
Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
Large version jump from 4.8.1 to 4.19.4 (latest upstream LTS).
Build changes:
- Refresh patches/004-fix-su-controoling-term.patch: su.c moved the
ioctl() call from line 1122 to 1169 and changed (char *) 0 to
(char *) NULL; update patch context and re-canonicalise through
quilt (blank context line spacing).
- New CONFIGURE_ARGS:
* --disable-logind: 4.19.4 added an optional libsystemd-based
logind integration which OpenWrt doesn't ship.
* --without-libbsd: shadow's configure now hard-fails on missing
readpassphrase() unless libbsd is found; the in-tree
lib/readpassphrase.c fallback is enabled by --without-libbsd.
* --without-sssd: avoid dragging in an sssd build dep.
* --disable-subordinate-ids: 4.19.4 builds libsubid (subuid/subgid
runtime API) unconditionally when subids are enabled, and its
libtool -export-symbols-regex generates a version script that
binutils 2.40+ rejects against libxcrypt's versioned
crypt_checksalt@@XCRYPT_4.3 symbol. Disabling subordinate-ids
skips libsubid entirely; OpenWrt doesn't ship libsubid.
- Drop newgidmap, newuidmap, lastlog and groups from SHADOW_APPLETS:
newgidmap/newuidmap are only built when subordinate-ids are
enabled, lastlog defaults to disabled in 4.19.4, and the groups
binary was removed from shadow upstream (use coreutils).
Test coverage:
- Replace the per-applet --version check in test.sh with per-applet
functional tests:
pwck -> 'pwck -r' read-only consistency check; accept
non-zero exit since the CI container's /etc/passwd
trips minor warnings.
grpck -> 'grpck -r' read-only consistency check.
chage -> 'chage -l root' lists password aging info.
useradd -> 'useradd -D' dumps defaults without modifying state.
passwd -> 'passwd -S root' prints the password status line.
faillog -> create empty /var/log/faillog then 'faillog -a'
must emit a header line.
login/su -> PAM-interactive; presence covered by generic tests.
Other applets -> verify binary presence (CI's generic tests
already check stripped, no build paths, linked-libs).
- Add test-version.sh as a generic-version-check override: shadow
tools don't honour --version (only --help), so the framework's
probe finds no PKG_VERSION match in any binary and would otherwise
fail Generic tests for every sub-package.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit dc52894904)
- Python3-pysocks was removed as it was not maintained in commit 95fe4bf332 ("python-pysocks: remove outdated and not maintained package")
- Python3-unidecode was removed in commit 09951a9cfd ("python-unidecode: drop unmaintained package"), because there is no official support for Python 3.12 and it is still using setup.py, which is deprecated.
Fixes:
```
WARNING: Makefile 'package/feeds/packages/onionshare-cli/Makefile' has a dependency on 'python3-pysocks', which does not exist
WARNING: Makefile 'package/feeds/packages/onionshare-cli/Makefile' has a dependency on 'python3-unidecode', which does not exist
```
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit c62a85e847)
Install libperl.so with executable permissions (0755) instead of copying
it as-is.
This allows the OpenWrt build system to recognize the library as a binary and
automatically run the "strip" utility on it. Stripping removes unnecessary
debugging metadata and helper symbols that are only needed for development but
not for running Perl on the router.
This change reduces the installed size of libperl.so on the device:
- Before (not stripped): 3.7 MB (3,929,652 bytes)
```
root@turris:~# file /usr/lib/perl5/5.40/CORE/libperl.so
/usr/lib/perl5/5.40/CORE/libperl.so: ELF 32-bit MSB shared object, PowerPC or cisco 4500, version 1 (SYSV), dynamically linked, with debug_info, not stripped
```
- After (stripped): 3.5 MB (3,674,081 bytes)
```
root@turris:~# file /usr/lib/perl5/5.40/CORE/libperl.so
/usr/lib/perl5/5.40/CORE/libperl.so: ELF 32-bit MSB shared object, PowerPC or cisco 4500, version 1 (SYSV), dynamically linked, no section header
```
Saving ~255 KB of flash storage space on target devices.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit b6d2070fc8)
zipmerge and zipcmp prints version on -V,
but ziptool does not offer version number in any output.
Co-authored-by: George Sapkin <george@sapk.in>
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit fa6c9463ad)
Tracing Transmission 4.11 showed the Transmission is started to use
the pwritev2 syscall for better write performance.
Add pwritev2 and preadv2 (which may be used as well, and anyway
doesn't hurt) to the list of allowed syscalls.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 9e84e22a78)
arm926ej-s (ARMv5) does not have native lock-free atomics and the
toolchain inserts calls to libatomic.so.1 for atomic operations.
The libgstreamer1 DEPENDS only listed armeb, powerpc, mips and mipsel
as needing libatomic, missing plain arm (little-endian 32-bit ARM).
Extend the condition to include arm so the package is properly
declared on all 32-bit ARM targets that require libatomic.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 2ac8367f3a)
The build fails on xscale because the dependency to libatomic.so.1 is
missing.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 086dcb2a59)
libtheora's configure probes the host assembler for NEON support
rather than the target CPU, so on pre-ARMv7 (arm926ej-s, etc.) it
falsely succeeds and the build emits NEON the CPU can't execute.
Force --disable-asm only when the ARM target's TARGET_CFLAGS does
not advertise armv7 or armv8, so cortex-a* keeps the NEON path.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 214b265f4a)
The RRL module's kru.inc.c has a `static_assert(ATOMIC_CHAR16_T_LOCK_FREE
== 2, ...)` that breaks the build on any target whose toolchain does
not advertise lock-free 16-bit atomics (e.g. ARMv5 arm926ej-s).
Upstream considers the assertion non-essential and plans to drop it;
they recommended a patch over a Makefile-level RRL disable. Bump
PKG_RELEASE for the patch swap.
Suggested-by: Daniel Salzman <daniel.salzman@nic.cz>
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 106acb9774)
Removing the ncursesw path from include avoids seeing the wide-char
version of ncurses, so the host build picks up the narrow static lib
that the OpenWrt SDK stages. To keep that pin from leaking back in
through other curses headers the build host may have under
/usr/include, also force every header check in Python's configure.ac
AC_CHECK_HEADERS(curses.h ncurses.h ncursesw/ncurses.h
ncursesw/curses.h ncursesw/panel.h panel.h) line to "no" via cached
ac_cv_header_* variables.
The narrow ncursesw_* trio was enough on the original reporter's
host; Jan Kardell's review of the first cut hit a build where
`/usr/include/curses.h` and `/usr/include/ncurses.h` from the
distro's libncurses-dev were still being picked up. Adding the
non-wide entries (and panel.h for symmetry, in case a host also
ships /usr/include/panel.h alone) makes the override insensitive to
whichever curses dev packages the host distro happens to provide.
Reported-by: Jan Kardell <jan.kardell@telliq.com>
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit d883c02a41)
Resolves several security issues:
- CVE-2026-3592: Limit resolver server list size.
- CVE-2026-3039: Fix GSS-API resource leak.
- CVE-2026-5950: Avoid unbounded recursion loop.
- CVE-2026-5947: Fix crash in resolver when SIG(0)-signed responses are
received under load.
- CVE-2026-3593: Add system test for HTTP/2 SETTINGS frame flood.
- CVE-2026-5946: Disable recursion, UPDATE, and NOTIFY for non-IN views.
Complete list of changes is available upstream at
https://ftp.isc.org/isc/bind9/9.20.23/doc/arm/html/changelog.html
Signed-off-by: Noah Meyerhans <frodo@morgul.net>
(cherry picked from commit ea421564d333b53b847434aaed2cd4d8a74954f0)
* bugfix: only load the configuration once per run: a new `ban_confload`
guard short-circuits `f_conf()` on subsequent calls, avoiding
repeated `config_load` invocations
* new: the per-set report now sorts elements by their packet counter in
descending order before truncating to the top 50, so the report
shows the most active elements instead of just the first 50 found
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit faeecaeb14)
Refresh the hardware database with the latest USB, PCI and PnP IDs.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 3695f1dae5)
Stan Grishin
Dirk Brenken
Glenn Strauss
Alarcon Laurent
Antonio Pastor
Hannu Nyman
Qingfang Deng
John Audia
Jan Havelka
Josef Schlehofer
Tianling Shen
Niklas Thorild
Wei-Ting Yang
Georgi Valkov
Alexandru Ardelean
Michael Heimpold
Olivier Poitrey
Daniel Golle
Tyrel M. McQueen
Hauke Mehrtens
Jan Hák
Ray Wang
Noah Meyerhans