- use the GNU regex matchers with gawk >= 5.4;
gawk 5.4 switched its default regex engine to MinRX, this
slows down the domain check a lot (~35x slower)
- speed up the tld compression
- readme update
Signed-off-by: Dirk Brenken <dev@brenken.org>
uvol creates /tmp/run/uvol/.meta/apk as the database directory of apk's
uvol layer, but leaves it empty. apk only activates a layer other than
the root one when its world file can be read, so every package built
for that layer is refused as "masked in: layer" until something writes
the file. The container runtime keeps its global state in
/tmp/run/uvol/.meta/uxc, which only container packages ship, so on a
device without any of them that state cannot be stored.
Create an empty world file and the uxc directory when they are missing,
whenever .meta is created or adopted at boot.
uvol up on an LVM volume that is already active and registered with
blockd registers it again. blockd answers each registration with a
mount.add notification, so a consumer that brings volumes up from a
mount.add trigger, such as the container runtime, triggers itself again
without end. Return success for such a volume without registering it,
as the UBI backend already does for an active volume.
Fixes: 6772c0fe44 ("uvol: clean up paths and fix delayed startup")
Fixes: cb60600aec ("uvol: bump version to 1.1")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Add a service definition for the netcup CloudDNS DynDNS API
(https://customercontrolpanel.de/wsDynDns.php). Domains migrated to
CloudDNS cannot be updated through the legacy CCP API used by the
netcup.com service anymore.
option username not used, can be anything
option password API key (CCP "API-Keys", not a Legacy API key)
option domain FQDN
Bump PKG_RELEASE.
Signed-off-by: Dieter Softwaresonnenschein <dieter.softwaresonnenschein@proton.me>
- remove raw feed download files after preparation
- pack multiple domains per dnsmasq 'local=' line
- log which (custom) feed file will be used
- readme update
Signed-off-by: Dirk Brenken <dev@brenken.org>
- faster IPv4 validation in f_chkip (~2-3 × faster)
- avoid full nft element fetches in the following functions:
f_actual, f_down (reload & count) and f_search
Signed-off-by: Dirk Brenken <dev@brenken.org>
- f_chkdom validates domains with a single anchored regex instead
of a per-label loop (~2.5× faster)
- f_tld merges compression and allowlist removal into one pass (~2× faster)
Signed-off-by: Dirk Brenken <dev@brenken.org>
This PR updates DNSdist to the latest release on the 2.1.x
branch, 2.1.3, including various bug fixes but no security
issues.
Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
A client asks again when the TTL of an answer runs out, and the write
for the new answer reaches the kernel up to one write interval later.
With the element timed out to the second it is missing for exactly
that gap, and a connection opened in it starts on the normal uplink
and keeps that path for its lifetime.
Co-authored-by: Claude <noreply@anthropic.com>
Signed-off-by: Dirk Brenken <dev@brenken.org>
The auth syslog block only logs ike, cfg, asn and tls. chd, enc and esp
are not logged there any more; they are only part of the daemon block.
Also change how the levels are written to the charon syslog config:
- config_get now defaults every level to "0" instead of an empty string.
- All levels are always written out. The '[ "$x" = "" ] ||' guards are
removed, so an unset option results in an explicit level 0 instead of
no line at all.
Tidy up the code in config_charon_plugin_syslog():
- Move the cfg, asn and tls declarations and config_get calls from the
daemon section to the auth section.
- Sort the local variables, config_get calls and swan_xappend3 calls
alphabetically in both sections.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Add option 'aggressive' to the globals section of /etc/config/ipsec.
When enabled, the charon setting
'i_dont_care_about_security_and_use_aggressive_mode_psk = yes' is
written to the generated strongswan.conf. The setting is only
emitted when the option is active.
IKEv1 aggressive mode with PSK is sometimes required to interoperate
with old peers that do not support main mode with PSK.
If enabled, IKE Responders are allowed to use IKEv1 Aggressive Mode with
Pre-Shared Keys (PSKs). This is strongly discouraged due to security
concerns (offline attacks on the openly transmitted hash of the PSK).
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename the per-option charon config helpers in swanctl.init to carry
a "common" infix (scripts, interfaces_use, ignore_routing_tables,
install_routes) and call them from a new config_charon_common()
wrapper. config_strongswan_generate() now calls only the wrapper.
This is purely a refactoring to add additional configuration parameters
for general charon options that are not loaded by a plugin.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The syslog daemon and auth facilities both use default = 0, so a group
configured for one facility was also logged by the other, producing
duplicate messages.
Set groups that are configured for daemon (dmn, mgr, job, cfg, knl,
net, asn, lib, tls, tnc, imc, imv, pts, app, wch) to -1 in auth, and
groups configured for auth (ike, chd, enc, esp) to -1 in daemon.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The proposals (IKE_SA) and esp_proposals (CHILD_SA) settings in
swanctl.conf do not have to be configured explicitly. If omitted,
charon falls back to its default proposals:
- IKE: the default proposals include all algorithms supported by the
loaded plugins that are not considered insecure.
- ESP: the default proposals are hard-coded, as the kernel can't be
queried for its supported algorithms. They include the supported
key exchange methods as well as "none", which makes PFS optional.
The default ESP proposal is only used if neither ah_proposals nor
esp_proposals are configured for a CHILD_SA.
Update the config to reflect that both options are optional.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
With peers that support multiple IKEv2 key exchanges (RFC 9370), up
to seven additional key exchanges may be negotiated. strongSwan
configures them by prefixing the algorithm keyword with keX_ (X being
1..7), e.g. 'x25519-ke1_mlkem768'.
The 'dh_group' option only allows a single key exchange method. Add a
'ke' list option to the crypto_proposal sections, which holds the
additional key exchange methods. Both config_ike_proposal() and
config_esp_proposal() append them to the generated proposal after
dh_group, so 'x25519' plus 'list ke mlkem768' results in
'x25519-ke1_mlkem768'.
The keN_ prefix is generated by the init script from the position of
the entry in the list. Entries which already carry a keN_ prefix are
used verbatim with a warning, which keeps keX_none (used to make a
key exchange round optional) working. Entries beyond the seventh are
dropped with a warning. A warning is also emitted if key exchange
methods are configured without a dh_group, since the first key
exchange method is mandatory.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
- new client selector src_dev: everything arriving on an ingress
device, in both address families - a whole guest network or VLAN,
independent of a changing IPv6 prefix; prerouting only, like src_mac
- new destination selector dst_file: address and prefix lists from a
file, read like domain_file and refilled atomically by
`shunt refresh`; domain_file.uc becomes list_file.uc for both kinds
- dport/proto alone now select traffic as documented, instead of
rejecting the policy as "selects nothing"
- a policy whose dst entries are all unusable is skipped instead of
being widened to every destination of its clients
- client and static destination sets use auto-merge, so overlapping
prefixes no longer fail the whole ruleset with "conflicting
intervals"
- update the README
Co-authored-by: Claude <noreply@anthropic.com>
Signed-off-by: Dirk Brenken <dev@brenken.org>
Some of these are obsolete. Others like CTS make no sense for IPSec.
Others are already selected by others. Simplify the list.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
e500 cores trap on dcbzl, maclhw and mullhw, but configure enables
dcbzl for --cpu=8548, and ppc4xx too with CONFIG_USE_LTO, so ffmpeg
dies with SIGILL (seen on a Turris 1.1). Pass --disable-dcbzl and
--disable-ppc4xx for 8540 and 8548 and make configure honour them.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Maintainer: Rob White rob@blue-wave.net
Compile tested: All
Run tested: OpenWrt master/snapshot.
Description: mesh11sd (7.3.1)
This is a bugfix release.
Numerous bugs were fixed, including correct handling of legacy swconfig
devices, introduction of the loop_interval_delta config option to reduce
overload hang-ups on legacy devices with slow clock rates, and improved
watchdog functionality allowing better autonomous critical error recovery.
The full changelog can be seen here:
https://github.com/openNDS/mesh11sd/blob/7.3.1/ChangeLog
Signed-off-by: Rob White <rob@blue-wave.net>
1.32 declares a tomlkit dependency, which the host build rejects as
unmet. It is only reached by the "hatchling version" CLI, not by the
PEP 517 backend the feed uses, so patch it out rather than package
tomlkit for an unreachable code path.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Security release: CVE-2025-55154 (integer overflow in MNG MAGN chunk
handling), CVE-2026-56379 (command injection via crafted SVG drawing
commands) and CVE-2026-103118 (stack exhaustion in the WPG reader),
plus heap buffer over-reads in GenerateIPTCAttribute() and missing
overflow detection in the PICT decoder.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Upstream lists a single change for this release, support for Python
3.15, so this only keeps the package current; the free-threading fixes
to the C lookup caches are queued for 8.7 and are not in it.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
0.5.7 renames the sdist's top directory from python-gnupg-0.5.7 to
python_gnupg-0.5.7, so set PYPI_SOURCE_NAME to make PKG_BUILD_DIR match
what the tarball extracts to. pypi.mk then derives the same PKG_SOURCE
that the explicit line held, so drop it.
Add 001-relax-setuptools-constraint.patch: 0.5.7 tightens its build
requirement to "setuptools >= 68,<75", which the feed's setuptools
84.0.0 does not satisfy, so the build fails with an unmet
"setuptools<75,>=68" dependency. The cap is precautionary and the
package builds unchanged without it.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
1.2.1 fixes a SQL injection via wrongly escaped bytes parameters on the
big5, gbk, sjis, cp932 and gb18030 charsets (GHSA-x4f8-9hx9-hpp9).
Drop the pymysql.converters assertions from test.sh: escape_dict is now
a non-callable placeholder kept only for aiomysql, and upstream states
the module is internal with no compatibility guarantee.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Picks up the 3.18.2 security fixes: GHSA-33wh-fxxf-88vv hardens content
negotiation against large Accept headers, GHSA-3547-9m27-7rxg refuses
non-text encoding charsets, and GHSA-xw6w-gcfp-cf8m makes deleting a
TokenProxy actually delete the token. 3.18.3 then reverts the
order_by_precedence() return value, which 3.18.2 had changed by
mistake.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Security release: CVE-2026-77050 (denial of service in
get_supported_language_variant()), CVE-2026-84429 (denial of service in
parse_header_parameters(), reachable through the Accept and
Content-Type headers), CVE-2026-87890 (request forgery via spatial
lookup byte values) and CVE-2026-87975 (privilege abuse in model
formsets with editable primary keys). It also completes an
insufficient mitigation of CVE-2026-15307 shipped in 6.1.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Single fix: the precision defaults for the e/E format types, added in
2.3.0, were processed wrongly and the formatter emitted its own format
string instead of a number -- format(sin(1), ".10De") returned
"%.10.6RDe" rather than "8.4147098480e-01".
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Hardens the reader against crafted databases: decoding now caps a
record at 65536 values, 512 levels of nesting and 2 MiB of string and
bytes payload, rejects unsigned integers over 16 bytes and signed ones
over 4 bytes before reading their payload, and rejects an invalid
search tree size when opening a database. Those, and the truncated
reads that used to surface as IndexError or struct.error, all raise
InvalidDatabaseError now.
Upstream vendors libmaxminddb 1.14.0 for the same limits in the C
extension; this package links the feed's libmaxminddb instead, so that
half arrives with a libmaxminddb bump.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
4.15.1 raises the typing_extensions requirement marker from
python_version < "3.13" to < "3.15", so it is now a real runtime
dependency on python 3.14 and importing anyio fails without it.
Add python3-typing-extensions to DEPENDS.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
The single change is a new "towncrier-fragments-zerover" version
scheme: like towncrier-fragments, but while the last tag is still 0.x a
breaking or removal fragment bumps the minor version and only a major
fragment proposes 1.0.0. Nothing else moves; this keeps the package in
step with setuptools-scm, which shares its repository.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Dirk Brenken
Daniel Golle
Ray Wang
Dieter Softwaresonnenschein
Tianling Shen
Javier Marcet
George Sapkin
Remi Gacogne
Niklas Thorild
Andy Chiang
Jean Thomas
Florian Eckert
Rosen Penev
Josef Schlehofer
Rob White
Sandro Jäckel
Alexandru Ardelean