- update dependencies from perl to python
- support dropbear
Signed-off-by: Maxim Storchak <m.storchak@gmail.com>
(cherry picked from commit b0a6a9147b)
Rsyncd only needs a subset of all capabilities so create
a dedicated user with these capabilities. This is better from both a
security and an isolation perspective than running as root.
Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 2a7364534e)
Maintainer: me
Compile tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.1
Run tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.1
Description:
update to 2026.03.18, improve nftables rules
- Update PKG_VERSION to 2026.03.18.
- Set PKG_RELEASE to 1.
- Update PKG_SOURCE_VERSION to 801881210ba8215dc9cd577222d8c10372423360.
- Update PKG_MIRROR_HASH to 4c356c19b62fc7bdef3a67fd678e48f3659d709da10517c2eadef76e3409f5ce.
files/etc/init.d/https-dns-proxy:
- Wrap the notrack chain in its own `inet https_dns_proxy_notrack`
table. A top-level `chain` outside any table is invalid nftables
syntax and is rejected on kernel 6.18+, breaking firewall load.
Fixesmossdef-org/https-dns-proxy#7.
- Syntax-check the generated snippet with `nft -c -f` after write
and report OK/FAIL on the start path.
- On remove, explicitly `nft delete table` in addition to removing
the snippet file, so the live ruleset is cleaned up immediately
rather than waiting for the next fw4 reload.
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 0d5f7a16c1)
Signed-off-by: Stan Grishin <stangri@melmac.ca>
This object class implements an asynchronous HTTP user agent
for the IO::Async framework in Perl, similar to LWP::UserAgent.
Signed-off-by: Jens Wagner <jens@wagner2013.de>
(cherry picked from commit 70f8dd8aa3)
This module extends existing IO::Async classes with
methods to allow the use of SSL or TLS-based connections
Required be e.g. Net::Async::HTTP to support https://
Signed-off-by: Jens Wagner <jens@wagner2013.de>
(cherry picked from commit c30cec8144)
Provides a central location for modules to report monitoring metrics.
Required e.g. by Net::Async::HTTP
Signed-off-by: Jens Wagner <jens@wagner2013.de>
(cherry picked from commit f9aada2b27)
Povides a deferred subroutine syntax for futures in Perl
Signed-off-by: Jens Wagner <jens@wagner2013.de>
(cherry picked from commit 62e5e1f82f)
(cherry picked from commit 3a2ce3480c)
Perl bindings for OpenSSL and LibreSSL
Signed-off-by: Jens Wagner <jens@wagner2013.de>
(cherry picked from commit e35fe955d8)
(cherry picked from commit e168d9fdfb)
Get information about a Perl class and its structure
Signed-off-by: Jens Wagner <jens@wagner2013.de>
(cherry picked from commit 1bc3bf261b)
(cherry picked from commit bf5002488f)
This commit adds a valid git patch header for each patch, so that
additional information can be stored. This is in this case and 'CVE:' tag.
This can be used by CVE scanner to find out if the patch fixes a CVE.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit f9e7e2db94)
I could not reproduce the bug reported, but the update should fix it
anyway. Tested on Turris Omnia, OpenWrt r31111.
Signed-off-by: Marius Dinu <m95d+git at psihoexpert.ro>
[imported from mailing list]
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 164d5a0cf7)
Bump to version 0.1.3 and drop patch, which is in upstream.
Signed-off-by: Erik Larsson <who+github@cnackers.org>
(cherry picked from commit fee669b6d4)
Build is failing for a while now with error:
```
14.3.0_musl/usr/include -I/builder/shared-workdir/build/sdk/staging_dir/toolchain-mipsel_24kc_gcc-14.3.0_musl/include -I/builder/shared-workdir/build/sdk/staging_dir/toolchain-mipsel_24kc_gcc-14.3.0_musl/include/fortify -I/builder/shared-workdir/build/sdk/staging_dir/target-mipsel_24kc_musl/usr/include/python3.14 -fPIC -I/builder/shared-workdir/build/sdk/staging_dir/target-mipsel_24kc_musl/usr/include/python3.14 -c ./ubus_python.c -o build/temp.linux-mipsel-cpython-314/ubus_python.o
./ubus_python.c: In function 'ubus_python_add':
./ubus_python.c:1081:17: error: implicit declaration of function 'PyEval_CallMethod'; did you mean 'PyObject_CallMethod'? [-Wimplicit-function-declaration]
1081 | PyEval_CallMethod(python_alloc_list, "pop", "");
| ^~~~~~~~~~~~~~~~~
| PyObject_CallMethod
error: command '/builder/shared-workdir/build/sdk/staging_dir/toolc
```
This has been fixed on version 0.1.3, but that hasn't been
published to pypi yet.
Also add test.sh
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 29e685e1f8)
Maintainer: me
Compile tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.1
Run tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.1
Description:Add nftables notrack for localhost traffic
- Removed. License is now included in the main project.
net/https-dns-proxy/Makefile:
- Bumped PKG_RELEASE to 5.
net/https-dns-proxy/files/etc/config/https-dns-proxy:
- Added 'option notrack_dns '1'' to the default configuration.
net/https-dns-proxy/files/etc/init.d/https-dns-proxy:
- Defined NOTRACK_NFT_FILE constant.
- Added 'notrack_dns' and 'notrack_ports' variables.
- Implemented 'notrack_nft' function to manage nftables rules for notracking local DNS traffic.
- Enabled loading of 'notrack_dns' boolean from configuration.
- Modified start_instance to collect listen_port into notrack_ports if notrack_dns is enabled.
- Modified start_service to call notrack_nft update/remove based on notrack_dns and collected ports.
- Modified stop_service to call notrack_nft remove.
- Updated service_started and service_stopped to trigger firewall config changes when notrack_dns is enabled.
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit fa4b35ad53)
Signed-off-by: Stan Grishin <stangri@melmac.ca>
With fortify sources libutp fails to compile because the fortify sources
for musl use the GNU extension include_next. Do not fail when the
compiler issues a warning.
Fixes the following compile error:
```
In file included from libutp-2023.02.14~c95738b1/utp_utils.cpp:23:
/include/fortify/stdlib.h:22:2: error: #include_next is a GCC extension [-Werror]
22 | #include_next <stdlib.h>
| ^~~~~~~~~~~~
```
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 0814aba3b0)
Version 1.24
------------
* The CMake-based build system now supports Apple Framework builds.
* libdeflate now builds for Windows ARM64EC.
* Made another small optimization to the x86 and ARM CRC32 code.
* Fixed a compiler warning on certain platforms (issue #416).
Version 1.23
------------
* Fixed bug introduced in 1.20 where incorrect checksums could be calculated if
libdeflate was compiled with clang at -O0 and run on a CPU supporting AVX512.
* Fixed bug introduced in 1.20 where incorrect checksums could be calculated in
rare cases on macOS computers that support AVX512 and are running an older
version of macOS that contains a bug that corrupts AVX512 registers. This
could occur only if code outside libdeflate enabled AVX512 in the thread.
* Fixed build error when using -mno-evex512 with clang 18+ or gcc 14+.
* Increased the minimum CMake version to 3.10.
* Further optimized the x86 CRC code.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit fba37516d7)
While backporting commits from master, it was overlooked that OpenWrt 24.10
does not have python-setuptools/host, but only python-setuptools, so we can
depend on that instead.
Fixes:
```
WARNING: Makefile 'package/feeds/packages/python-zope-event/Makefile' has a build dependency on 'python-setuptools/host', which does not exist
WARNING: Makefile 'package/feeds/packages/python-zope-interface/Makefile' has a build dependency on 'python-setuptools/host', which does not exist
```
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Update package to 4.8.1.
Security fix:
- Empty or missing tokens are no longer accepted; previously this could
allow bypassing token authentication
Documentation improvements: new installation section, revised docs, fixed
broken links.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit bf34f9abb4)
The LMDB shared library (liblmdb.so) does not currently have a SONAME
set, which can cause issues when linking against it. Specifically, when
an object is linked against the library using its absolute path (for
example, in Meson builds), that path (as seen in the build environment)
is stored in the resulting object's DT_NEEDED entry. This can prevent
the library from being found during runtime linking. Set the SONAME to
liblmdb.so to ensure proper runtime linking.
Signed-off-by: Michał Kępień <michal@isc.org>
(cherry picked from commit 8aa78ebebf)
- Use GitHub for sources URL
- Remove autoreconf fixup (it works out-of-the-box)
- Remove squid-mod-cachemgr package since cachemgr.cgi was removed upstream
- Rename ac_cv_epoll_works to squid_cv_epoll_works to follow upstream
- Don't customize target CFLAGS and LDFLAGS (they work as is)
- Remove nettle configure patch - upstream handles it correctly now
- Remove dummy comment in config menu
Signed-off-by: Aleksey Vasilenko <aleksey.vasilenko@gmail.com>
(cherry picked from commit 55404adb91)
* Switch Hagezi URL to a more compact higher-level only domains list as we
prefer it anyways and there's less processing (thanks @dave14305)
* When update_config_sizes is unset, save collected sizes to RAM to improve
luci app performance (thanks @sshaikh)
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 5e0b94f2a4)
Signed-off-by: Stan Grishin <stangri@melmac.ca>
fix: avoid unnecessary dnsmasq restarts (thanks @egc112)
fix: insert, not add dns policies to ensure higher priority than the DNS
hijack rules (thanks @egc112)
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 727ca8a3a5)
Signed-off-by: Stan Grishin <stangri@melmac.ca>
The RFC-1918 zones are automatically synthesized locally by bind
to avoid forwarding queries about them to root nameservers. As
a result, we can't easily replace them with rndc addzone on the
fly. We need this for DHCP integration.
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
(cherry picked from commit 505ca0a0d4)
Maxim Storchak
John Audia
Stan Grishin
Vladimir Ulrich
Sander van Deijck
Jens Wagner
Rosen Penev
Florian Eckert
Tan Zien
Hannu Nyman
Rui Salvaterra
Josef Schlehofer
Erik Larsson
Alexandru Ardelean
Daniel Golle
Hauke Mehrtens
Federico Capoano
Michał Kępień
Aleksey Vasilenko
George Sapkin
Noah Meyerhans
Philip Prindeville