Describe the configuration files for bsbf-bonding and bsbf-mptcp so that
they are automatically included when taking a system backup.
Signed-off-by: Chester A. Unal <chester.a.unal@arinc9.com>
Update package description to reflect modern reality (support for
Thunderbird -- Lightning extension has not been a separate entity for
quite some time, and support for iOS clients -- iPhone and iPad, not
only iPhone).
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
Refactor the PR labeler workflow to checkout the base repository ref
instead of the pull request head ref from forks, resolving checkout
errors inside the pull_request_target context.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
- remove outdated patch file
It was fixed upstream in containers/crun@9acf13d, so the patch file is no longer required.
- replace yajl with json-c
The JSON backend was switched from YAJL to json-c in containers/crun@b62cfdd, so --enable-embedded-yajl should be removed from CONFIGURE_ARGS and libjson-c should be add as a new dependency
Signed-off-by: nantayo <sora1924@outlook.com>
Add a -n guard before the arithmetic comparison of engineidtype in
snmpd_engineid_add(). When the engineid UCI section exists but
engineidtype is not configured, the empty string is passed to
[ -ge ]/[ -le ] which causes 'sh: bad number' on every boot.
Signed-off-by: Michael Pfeifroth <michael.pfeifroth@westermo.com>
Add an opt-in reset_failure_timer option for restart_iface and
run_script modes.
When enabled, watchcat starts a fresh failure window after the
recovery action finishes before allowing another recovery action.
The existing behavior remains the default.
Document the intended default and reset_failure_timer timing
behavior in TIMINGS.md and use a safer string comparison for the
reset_failure_timer check.
Signed-off-by: Dharmik Parmar <dharmikparmar2004@yahoo.com>
Clarify the restart_iface logging so the message reflects that the
configured action happens only after the failure period is reached.
Signed-off-by: Dharmik Parmar <dharmikparmar2004@yahoo.com>
The binary included in this package does not output anything, causing
the generic version check in CI to fail. Override the test.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
- add f_mem() helper to read MemAvailable from /proc/meminfo,
replacing three duplicated inline reads in f_load, f_dns and f_jsnup
- cap the auto-detected CPU core count by available memory in f_load:
adb_cores is limited to MemAvailable / 48 (MiB per job), floored to at least 1 core;
this bounds the number of feeds processed in parallel on constrained devices,
a user-set adb_cores is still honored as a ceiling (the cap only ever lowers it).
- derive the GNU sort buffer size from available memory
- readme update:
- added a "low memory systems" recommendation to use
the zram-swap package (compressed swap) with a swappiness hint,
plus a sizing rule of thumb — this works for all DNS backends OOTB
- significantly expanded the custom-feeds section (all JSON fields, rule parameters, etc.)
Signed-off-by: Dirk Brenken <dev@brenken.org>
default feed updates:
- urlhaus, urlvir, webclient: switched from in to out
and added a tcp udp 80 443 port limit (destination feeds for LAN-initiated traffic)
- feodo, spamhaus, threat, threatview, proxy, tor, vpn, vpndc: switched from in to inout
- threatview: added url_6, as the source ships IPv4 and IPv6 in a single file
- country / asn: intentionally left on in; documented how to switch them to outbound/both
for the recurring "block connections to country X" case
- readme update:
- corrected the feed table to match the above,
- removed the stale drop row (replaced by spamhaus),
- and reworked the chain explanation to clarify the inbound-vs-outbound (source-IP vs destination-IP) model
- significantly expanded the custom-feeds section (all JSON fields, rule parameters, etc.
Signed-off-by: Dirk Brenken <dev@brenken.org>
Swtich to upstream recommended 7.0 LTS branch[1] which includes a fix
for CVE-2026-39402. Full changelog: https://github.com/lxc/lxc/releases/tag/v7.0.0
- Removed patches/021-remove-legacy-cgroup-support.patch due upstream
deprecated CGroupV1 support.
- Modified files/lxc-auto.init to remove the boot() function which mounted
legacy cgroup1 stuff as well. This PR will superceed
https://github.com/openwrt/packages/pull/27757 as a result.
- Added a version check script for the CI.
- Fix another CI failure with -Dmemfd-rexec=false
Note this release adds the ability to introduce landlock-sandboxing the
monitor process but that would depend on CONFIG_SECURITY_LANDLOCK in the
kernel. This can be added in a future PR if there is interest.
1. https://discuss.linuxcontainers.org/t/lxc-7-0-lts-has-been-released/26612#p-90585-support-and-upgrade-8
Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc
Signed-off-by: John Audia <therealgraysky@proton.me>
The exit command was running unconditionally which broke the system
configuration. Fix that and simplify the wan interface check.
Run network.wan deletion quietly in case it doesn't exist.
Signed-off-by: Chester A. Unal <chester.a.unal@arinc9.com>
Two packages (fluent-bit and nnn) don't properly gate musl-fts as
only required when using MUSL.
Signed-off-by: Philip A. Prindeville <philipp@redfish-solutions.com>
- Fix technically undefined behavior when comparing return value from
realloc to the original pointer
- Update mapfile patch 11, removing stray line and improving the
efficiency of the original fix
- Fix read builtin to avoid cases where -1 is used as an index into the
input buffer
Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
Update bsbf-resources to the GIT HEAD of 2026-06-19.
- files/etc/uci-defaults/99-bsbf-bonding:
- Simplify the script and make sure multiple wan interfaces are processed
properly.
- Use routing table 1 instead of 100.
- Make it able to install the bsbf-bonding package without needing
bsbf-client-openwrt-installer.
- files/usr/sbin/bsbf-bonding:
- Move uninstall functionality to makefile.
Signed-off-by: Chester A. Unal <chester.a.unal@arinc9.com>
harden captive portal auto-login script handling:
* enforce the login-script allowlist in the backend instead of the
LuCI frontend only: canonicalize the configured path via 'readlink -f'
(defeats ../ traversal and symlink-to-interpreter tricks) and require a
regular, executable /etc/travelmate/*.login file before running it
* run the script in a noglob subshell ('set -f') so attacker-influenceable
script_args can no longer expand globs into the trusted script; field
splitting (multiple args) is preserved
* writing into /etc/travelmate/ is not covered by the luci-app-travelmate
ACL, so this limits the root-executed script to admin-placed login scripts
and closes a delegated-ACL to root command execution path.
Signed-off-by: Dirk Brenken <dev@brenken.org>
In order to use AES-192 and the like, it is necessary to enable
blumenthal-aes.
Blumenthal AES draft was not formalized in RFC but is
widely implemented by many vendors. It has strong encryption in
connection with SNMPv3.
Signed-off-by: Christian Korber <ckorber@tdt.de>
It seems this software is no longer maintained, because
the latest release is 23 years ago.
No package depends on this.
Signed-off-by: Yanase Yuki <dev@zpc.st>
No longer needed by any package in the feed; jsonpath-ng was the
last consumer and no longer imports it.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
No longer needed by any package in the feed; jsonpath-ng (the last
consumer) vendors ply internally as jsonpath_ng._ply.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
jsonpath-ng 1.8.0 vendors ply as jsonpath_ng._ply and no longer imports
six or decorator, so none are required at runtime.
It builds through the setuptools.build_meta legacy backend but never
declared setuptools as a build dependency; it was only present in the host
build env transitively via those packages' builds. Add python-setuptools/host
explicitly so the build no longer relies on that side effect.
The jsonpath_ng CLI takes a required expression argument and has no version
flag, so the generic version check cannot detect the package version from it.
Add a test-version.sh override and assert __version__ in test.sh instead,
mirroring python-jmespath.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
- fix uplink teardown for bssid-pinned stations
the new implementaion reads the sta object once and parses fields by name via jshn
(isolated namespace, single fork). Bug finder: @adam8833 (#29768)
- add a fork-free f_normbssid() helper and normalize all config-side bssids
to upper case before comparison (in f_getcfg(), covering all callers, and
on the direct scan comparisons in f_main()).
- LuCI: adds a normBssid() helper function as well
Signed-off-by: Dirk Brenken <dev@brenken.org>
snmpd generates its runtime configuration in /var/run/snmpd.conf from
UCI during start_service(). However, since the procd instance command
line never changes, procd does not detect that a restart is needed when
the UCI config is modified.
Add 'procd_set_param file /etc/config/snmpd' so procd tracks the config
file and restarts snmpd when it changes. Without this, 'reload_service'
(triggered by procd_add_reload_trigger) re-creates an identical instance
definition and procd skips the restart, leaving stale configuration
active.
This also fixes a usability issue with SNMPv3: when changing a user's
authentication or privacy algorithm, net-snmp must restart to re-derive
localized keys via createUser. Without the restart, the daemon keeps
using cached key material and authentication fails.
Tested with net-snmp 5.9.4 on OpenWrt (aarch64 and ppc64).
Signed-off-by: Michael Pfeifroth <michael.pfeifroth@westermo.com>
Upstream removed editables from install_requires in hatchling 1.27;
1.30.1 no longer needs it at runtime or build-time.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
No longer needed by any package in the feed; only python-schema
depended on it and it was a Python <3.3 conditional shim.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Upstream only requires contextlib2 on Python <3.3, so it is never
pulled in on a Python 3.14 runtime.
schema builds through the setuptools.build_meta legacy backend but never
declared setuptools as a build dependency; it was only present in the host
build env transitively via contextlib2's build. Add python-setuptools/host
explicitly so the build no longer relies on that side effect.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Add UCI options for the path to the server's SSL certificate and
private key. This enables the use of a certificate provided by an
external certificate authority instead of the default self-signed
certificate.
The self-signed certificate is still produced if it doesn't already
exist, and is used by default. So this change should be transparent to
existing users.
Fixes#23099.
Signed-off-by: Jack Lovell <jacklovell1990@gmail.com>
Conor Anderson
Jianhui Zhao
Chester A. Unal
Ivan Pavlov
Daniel F. Dickinson
Moritz Warning
Wei-Ting Yang
Josef Schlehofer
Bruce Chen
Lucian CRISTIAN
nantayo
Hannu Nyman
Michael Pfeifroth
Dharmik Parmar
Stijn Tintel
Hirokazu MORIKAWA
Dirk Brenken
John Audia
Glenn Strauss
dependabot[bot]
Philip A. Prindeville
Vladimir Ermakov
Stan Grishin
Christian Korber
Yanase Yuki
Alexandru Ardelean
Jack Lovell