Updated from 4.04.856 to 5.06.909.
Changes:
- Switch from git clone to tarball download
- Add start_time/end_time scheduling support for tcp/http/https/socks5
- Add service_type validation for tcp (ssh/mstsc/rdp/vnc/telnet)
- Add iod proxy type support
- Add WAN up auto-restart trigger
- Add -s startup parameter
Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>
(cherry picked from commit a1103ac37e)
Update to version 1.9.24. (Mostly security fixes)
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 28e1008974)
[backport also license info change and https change]
- add f_mem() helper to read MemAvailable from /proc/meminfo,
replacing three duplicated inline reads in f_load, f_dns and f_jsnup
- cap the auto-detected CPU core count by available memory in f_load:
adb_cores is limited to MemAvailable / 48 (MiB per job), floored to at least 1 core;
this bounds the number of feeds processed in parallel on constrained devices,
a user-set adb_cores is still honored as a ceiling (the cap only ever lowers it).
- derive the GNU sort buffer size from available memory
- readme update:
- added a "low memory systems" recommendation to use
the zram-swap package (compressed swap) with a swappiness hint,
plus a sizing rule of thumb — this works for all DNS backends OOTB
- significantly expanded the custom-feeds section (all JSON fields, rule parameters, etc.)
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit c2a00f2db0)
Don't override the upstream build ID logic to hopefully improve
reproducibility.
Signed-off-by: George Sapkin <george@sapk.in>
(cherry picked from commit 6149f90711)
default feed updates:
- urlhaus, urlvir, webclient: switched from in to out
and added a tcp udp 80 443 port limit (destination feeds for LAN-initiated traffic)
- feodo, spamhaus, threat, threatview, proxy, tor, vpn, vpndc: switched from in to inout
- threatview: added url_6, as the source ships IPv4 and IPv6 in a single file
- country / asn: intentionally left on in; documented how to switch them to outbound/both
for the recurring "block connections to country X" case
- readme update:
- corrected the feed table to match the above,
- removed the stale drop row (replaced by spamhaus),
- and reworked the chain explanation to clarify the inbound-vs-outbound (source-IP vs destination-IP) model
- significantly expanded the custom-feeds section (all JSON fields, rule parameters, etc.
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit f5160c8aa1)
The exit command was running unconditionally which broke the system
configuration. Fix that and simplify the wan interface check.
Run network.wan deletion quietly in case it doesn't exist.
Signed-off-by: Chester A. Unal <chester.a.unal@arinc9.com>
(cherry picked from commit 8262543989)
Firewall will be reloaded when there's ifup so don't reload it.
Signed-off-by: Chester A. Unal <chester.a.unal@arinc9.com>
(cherry picked from commit 8522406a1c)
Update bsbf-resources to the GIT HEAD of 2026-06-19.
- files/etc/uci-defaults/99-bsbf-bonding:
- Simplify the script and make sure multiple wan interfaces are processed
properly.
- Use routing table 1 instead of 100.
- Make it able to install the bsbf-bonding package without needing
bsbf-client-openwrt-installer.
- files/usr/sbin/bsbf-bonding:
- Move uninstall functionality to makefile.
Signed-off-by: Chester A. Unal <chester.a.unal@arinc9.com>
(cherry picked from commit 70e1b46a22)
harden captive portal auto-login script handling:
* enforce the login-script allowlist in the backend instead of the
LuCI frontend only: canonicalize the configured path via 'readlink -f'
(defeats ../ traversal and symlink-to-interpreter tricks) and require a
regular, executable /etc/travelmate/*.login file before running it
* run the script in a noglob subshell ('set -f') so attacker-influenceable
script_args can no longer expand globs into the trusted script; field
splitting (multiple args) is preserved
* writing into /etc/travelmate/ is not covered by the luci-app-travelmate
ACL, so this limits the root-executed script to admin-placed login scripts
and closes a delegated-ACL to root command execution path.
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 0627b412ee)
- fix uplink teardown for bssid-pinned stations
the new implementaion reads the sta object once and parses fields by name via jshn
(isolated namespace, single fork). Bug finder: @adam8833 (#29768)
- add a fork-free f_normbssid() helper and normalize all config-side bssids
to upper case before comparison (in f_getcfg(), covering all callers, and
on the direct scan comparisons in f_main()).
- LuCI: adds a normBssid() helper function as well
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 71d92bcc9e)
Maintainer: me
Compile tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Run tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Description:
Update to 1.2.4
- Update PKG_VERSION to 1.2.4 and PKG_RELEASE to 2.
- Update documentation URL from melmac.ca to mossdef.org.
README.md:
- Update documentation URL from melmac.ca to mossdef.org.
files/etc/config/adblock-fast:
- Add default option `download_connect_timeout '10'`.
- Add default option `download_allow_insecure '1'`.
- Set default `parallel_downloads` to `8`.
- Remove commented `download_max_time` line.
files/etc/init.d/adblock-fast:
- Increment `initCompat` to 17.
- Add `download_connect_timeout`, `download_max_time`,
`download_allow_insecure` to config validation schema.
files/etc/uci-defaults/90-adblock-fast:
- Use `initCompat` from init script to stamp `config_compat`.
- Migrate `parallel_downloads` from boolean to numeric cap for compat < 15.
- Seed new `download_connect_timeout` from old `download_timeout`
for compat < 16.
- Add new `config_compat` and `config_version` stamping.
files/lib/adblock-fast/adblock-fast.uc:
- Increment package `compat` to 17.
- Introduce `task_slot_ram` for per-downloader memory budgeting.
- Add `download_connect_timeout`, `download_max_time`,
`download_allow_insecure` to `reload` triggers.
- Store `downloader` kind and track `_last_dl_timeout` status.
- Refine downloader detection: prefer curl, then uclient-fetch, then
GNU wget, finally generic wget.
- Update `curl` command flags for `--insecure`, `--connect-timeout`,
`--speed-limit`/`--speed-time`, `--max-time`.
- Update `uclient-fetch` flags for `--no-check-certificate`.
- Update `wget` flags for `--no-check-certificate`,
`--connect-timeout`, `--read-timeout`.
- Improve SSL support detection for uclient-fetch.
- Capture `curl` exit code 28 as a distinct timeout failure.
- Expand `get_text` cases for `errorDetectingFileType`,
`warningMissingRecommendedPackages` (args), `warningParallelDownloadsThrottled`,
`warningDownloadTimeout`.
- Allow `download_allow_insecure` for `get_url_filesize` calls.
- Set `download_allow_insecure` default to true in `config_schema`.
- Change `parallel_downloads` from boolean to integer `8` default in
`config_schema`.
- Add `download_connect_timeout` and `download_max_time` to `config_schema`.
- Read up to 4KB for `detect_file_type`.
- Improve `warningMissingRecommendedPackages` output: list missing
packages and use `apk` or `opkg` install command.
- Split `process_file_url` into parallelizable `prepare_file_url`
and serial `apply_result`, plus `emit_dl_line`.
- Implement memory-aware throttling for `parallel_downloads`.
- Revert to single `process_file_url` for serial uses and test runner.
- Correct `get_mem_available` to return current free memory only.
- Rename `get_mem_total` to `get_mem_available`.
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 57bc3f85ae)
Signed-off-by: Stan Grishin <stangri@melmac.ca>
Dependencies for plugin authn_gssapi, authn_ldap, authn_pam, authn_dbi
and authn_sasl are not correctly written.
This cause lighttpd package to always compile krb5-libs, libopenldap and
libpam, even if not selected
Before the fix:
grep -e libpam -e krb5-libs -e libopenldap .config
\# CONFIG_PACKAGE_libpam is not set
\# CONFIG_PACKAGE_libopenldap is not set
\# CONFIG_PACKAGE_krb5-libs is not set
make | grep -e libpam -e krb5 -e ldap
make[3] -C feeds/packages/net/krb5 compile
make[3] -C feeds/packages/libs/libpam compile
make[3] -C feeds/packages/libs/openldap compile
With the fix:
make | grep -e libpam -e krb5 -e ldap
"nothing compiled"
Check that fix works when mod-authn tokens are
selected (select lighttpd-mod-authn_xxx):
grep lighttpd-mod-authn .config
CONFIG_PACKAGE_lighttpd-mod-authn_file=y
CONFIG_PACKAGE_lighttpd-mod-authn_gssapi=m
CONFIG_PACKAGE_lighttpd-mod-authn_ldap=m
CONFIG_PACKAGE_lighttpd-mod-authn_pam=y
make | grep -e libpam -e krb5 -e ldap
make[3] -C feeds/packages/net/krb5 compile
make[3] -C feeds/packages/libs/libpam compile
make[3] -C feeds/packages/libs/openldap compile
x-ref:
"lighttpd: Malformed dependencies cause unselected packages to be compiled"
https://github.com/openwrt/packages/pull/28157
github: closes#28157
Signed-off-by: Alarcon Laurent <laurent.alarcon@sagemcom.com>
Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
(cherry picked from commit ee21a8b227)
Add a patch fixing a possible crash, when a non-responding host is
tried to be pinged and retry attempts are limited by MaxMissed option.
> daemon.err: collectd[14133]: ping plugin: host 192.168.1.99 has not answered 3 PING requests, triggering resolve
> daemon.info: procd: Instance collectd::instance1 s in a crash loop 7 crashes, 3 seconds since last crash
Fixes: #29649
* upstream bug created: https://github.com/collectd/collectd/issues/4406
* older upstream bug: https://github.com/collectd/collectd/issues/3079
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit eb21982576)
The link flag makes the main program depend on liblua in official
package feeds, even if collectd-mod-lua is not installed.
The plugin is already linked against liblua.so, so this can be removed.
Signed-off-by: Qingfang Deng <dqfext@gmail.com>
[added PKG_RELEASE bump]
(cherry picked from commit aa0a14e2dd)
The lxc-unprivileged package depends on both newgidmap and newuidmap
if users are installing and setting it up for the first time. dc52894
dropped both of the applets.
This change builds libusbid as a shared lib which builds a versioned
symbol which OpenWrt does not stage so build with --disable-shared
and --enable-static to avoid a failure.
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 5883c07493)
Enable trailing whitespace trimming, insert final newline, and force LF.
Configure git input validation to warn if subject exceeds 60 characters
or if body lines exceed 75 characters.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit d1acb1cc44)
On macOS (Darwin) hosts, building host Python C extensions (such as Cython) using the '-shared' flag and linking against '-lpython3.x' causes the host Python interpreter to load a duplicate copy of the Python runtime. This leads to type checking mismatches and segmentation faults (SIGSEGV) when importing the compiled extension.
For example, running:
./staging_dir/hostpkg/bin/python3 -c "import Cython.Utils"
crashes with:
Segmentation fault: 11
To build shared modules correctly on macOS, they must be compiled as bundles using the '-bundle -undefined dynamic_lookup' flags instead of '-shared', and they should not link against the Python library (no '-lpython3.x' in LDFLAGS).
Fix this by dynamically adjusting LDSHARED and LDFLAGS in python3-host.mk when the host OS is Darwin.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit ea541f48b5)
- Fix loop in subshells calling wait builtin with inherited job list
- Fix mapfile problem when callback unsets the variable it is modifying
- Fix subshells inappropriately running the EXIT trap if they receive a
fatal signal before resetting traps
Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
(cherry picked from commit 3085718815)
rust/host fails to compile on macOS running on Intel x64
because the host target triple is autogenerated to be
'arm64-unknown-linux-'. Rust doesn't have such a target triple, thus the
build fails because there are no pre-built artefacts for bootstrapping.
Fix this by setting RUSTC_HOST_ARCH to 'x86_64-apple-darwin' in case
our host is HOST_ARCH=x86_64 and HOST_OS=Darwin.
This fix is based on the existing fix for Apple silicon [1].
Fixes:
File "/Volumes/pepe/py/openwrt/build_dir/target-x86_64_musl/host/rustc-1.96.0-src/x.py", line 53, in <module>
bootstrap.main()
~~~~~~~~~~~~~~^^
File "/Volumes/pepe/py/openwrt/build_dir/target-x86_64_musl/host/rustc-1.96.0-src/src/bootstrap/bootstrap.py", line 1418, in main
bootstrap(args)
~~~~~~~~~^^^^^^
File "/Volumes/pepe/py/openwrt/build_dir/target-x86_64_musl/host/rustc-1.96.0-src/src/bootstrap/bootstrap.py", line 1366, in bootstrap
build.download_toolchain()
~~~~~~~~~~~~~~~~~~~~~~~~^^
File "/Volumes/pepe/py/openwrt/build_dir/target-x86_64_musl/host/rustc-1.96.0-src/src/bootstrap/bootstrap.py", line 697, in download_toolchain
download_component(download_info)
~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^
File "/Volumes/pepe/py/openwrt/build_dir/target-x86_64_musl/host/rustc-1.96.0-src/src/bootstrap/bootstrap.py", line 529, in download_component
get(
~~~^
download_info.base_download_url,
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
...<3 lines>...
verbose=download_info.verbose,
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
)
^
File "/Volumes/pepe/py/openwrt/build_dir/target-x86_64_musl/host/rustc-1.96.0-src/src/bootstrap/bootstrap.py", line 58, in get
raise RuntimeError(
...<6 lines>...
)
RuntimeError: src/stage0 doesn't contain a checksum for dist/2026-04-16/rust-std-1.95.0-x86_64-unknown-linux-darwin24.6.0.tar.xz. Pre-built artifacts might not be available for this target at this time, see https://doc.rust-lang.org/nightly/rustc/platform-support.html for more information.
[1] https://github.com/openwrt/packages/commit/105fa3920e12f557bdf1fcbc566fc286fb53e319
Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
(cherry picked from commit aa32dd256e)
Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
Large version jump from 4.8.1 to 4.19.4 (latest upstream LTS).
Build changes:
- Refresh patches/004-fix-su-controoling-term.patch: su.c moved the
ioctl() call from line 1122 to 1169 and changed (char *) 0 to
(char *) NULL; update patch context and re-canonicalise through
quilt (blank context line spacing).
- New CONFIGURE_ARGS:
* --disable-logind: 4.19.4 added an optional libsystemd-based
logind integration which OpenWrt doesn't ship.
* --without-libbsd: shadow's configure now hard-fails on missing
readpassphrase() unless libbsd is found; the in-tree
lib/readpassphrase.c fallback is enabled by --without-libbsd.
* --without-sssd: avoid dragging in an sssd build dep.
* --disable-subordinate-ids: 4.19.4 builds libsubid (subuid/subgid
runtime API) unconditionally when subids are enabled, and its
libtool -export-symbols-regex generates a version script that
binutils 2.40+ rejects against libxcrypt's versioned
crypt_checksalt@@XCRYPT_4.3 symbol. Disabling subordinate-ids
skips libsubid entirely; OpenWrt doesn't ship libsubid.
- Drop newgidmap, newuidmap, lastlog and groups from SHADOW_APPLETS:
newgidmap/newuidmap are only built when subordinate-ids are
enabled, lastlog defaults to disabled in 4.19.4, and the groups
binary was removed from shadow upstream (use coreutils).
Test coverage:
- Replace the per-applet --version check in test.sh with per-applet
functional tests:
pwck -> 'pwck -r' read-only consistency check; accept
non-zero exit since the CI container's /etc/passwd
trips minor warnings.
grpck -> 'grpck -r' read-only consistency check.
chage -> 'chage -l root' lists password aging info.
useradd -> 'useradd -D' dumps defaults without modifying state.
passwd -> 'passwd -S root' prints the password status line.
faillog -> create empty /var/log/faillog then 'faillog -a'
must emit a header line.
login/su -> PAM-interactive; presence covered by generic tests.
Other applets -> verify binary presence (CI's generic tests
already check stripped, no build paths, linked-libs).
- Add test-version.sh as a generic-version-check override: shadow
tools don't honour --version (only --help), so the framework's
probe finds no PKG_VERSION match in any binary and would otherwise
fail Generic tests for every sub-package.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit dc52894904)
- Python3-pysocks was removed as it was not maintained in commit 95fe4bf332 ("python-pysocks: remove outdated and not maintained package")
- Python3-unidecode was removed in commit 09951a9cfd ("python-unidecode: drop unmaintained package"), because there is no official support for Python 3.12 and it is still using setup.py, which is deprecated.
Fixes:
```
WARNING: Makefile 'package/feeds/packages/onionshare-cli/Makefile' has a dependency on 'python3-pysocks', which does not exist
WARNING: Makefile 'package/feeds/packages/onionshare-cli/Makefile' has a dependency on 'python3-unidecode', which does not exist
```
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit c62a85e847)
Install libperl.so with executable permissions (0755) instead of copying
it as-is.
This allows the OpenWrt build system to recognize the library as a binary and
automatically run the "strip" utility on it. Stripping removes unnecessary
debugging metadata and helper symbols that are only needed for development but
not for running Perl on the router.
This change reduces the installed size of libperl.so on the device:
- Before (not stripped): 3.7 MB (3,929,652 bytes)
```
root@turris:~# file /usr/lib/perl5/5.40/CORE/libperl.so
/usr/lib/perl5/5.40/CORE/libperl.so: ELF 32-bit MSB shared object, PowerPC or cisco 4500, version 1 (SYSV), dynamically linked, with debug_info, not stripped
```
- After (stripped): 3.5 MB (3,674,081 bytes)
```
root@turris:~# file /usr/lib/perl5/5.40/CORE/libperl.so
/usr/lib/perl5/5.40/CORE/libperl.so: ELF 32-bit MSB shared object, PowerPC or cisco 4500, version 1 (SYSV), dynamically linked, no section header
```
Saving ~255 KB of flash storage space on target devices.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit b6d2070fc8)
zipmerge and zipcmp prints version on -V,
but ziptool does not offer version number in any output.
Co-authored-by: George Sapkin <george@sapk.in>
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit fa6c9463ad)
Tracing Transmission 4.11 showed the Transmission is started to use
the pwritev2 syscall for better write performance.
Add pwritev2 and preadv2 (which may be used as well, and anyway
doesn't hurt) to the list of allowed syscalls.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 9e84e22a78)
arm926ej-s (ARMv5) does not have native lock-free atomics and the
toolchain inserts calls to libatomic.so.1 for atomic operations.
The libgstreamer1 DEPENDS only listed armeb, powerpc, mips and mipsel
as needing libatomic, missing plain arm (little-endian 32-bit ARM).
Extend the condition to include arm so the package is properly
declared on all 32-bit ARM targets that require libatomic.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 2ac8367f3a)
Hirokazu MORIKAWA
Rui Salvaterra
Wei-Ting Yang
Glenn Strauss
Dengfeng Liu
Hannu Nyman
Dirk Brenken
Daniel Golle
George Sapkin
Chester A. Unal
Stan Grishin
Alarcon Laurent
Antonio Pastor
Qingfang Deng
John Audia
Jan Havelka
Josef Schlehofer
Tianling Shen
Niklas Thorild
Georgi Valkov
Alexandru Ardelean
Michael Heimpold
Olivier Poitrey
Tyrel M. McQueen