Adds ionos.com as predefined DDNS service. IONOS' dynamic DNS API
only supports domains hosted at IONOS and uses a single fixed
update URL with a generated token as password. Both ipv4 and ipv6
updates use the same endpoint, distinguished by explicitly passing
the detected address via the ipv4= or ipv6= query parameter as
documented by IONOS. Verified working separately for both A and
AAAA record updates against a live domain.
Signed-off-by: Lasse Hanschen <lh@databloat.ch>
Maintainer: Rob White rob@blue-wave.net
Compile tested: All
Run tested: OpenWrt 25.12 and master/snapshot.
Description: mesh11sd (7.3.0)
This version adds pinning of the mesh gateway ARP to the active portal for the peer,
thereby providing reliable ipv4 on multi-portal backhauls.
Additional detected, but non selected portals, cannot retarget the peer or its clients.
The patches of the previous version in this feed are no longer needed so have been removed.
The full changelog can be seen here:
https://github.com/openNDS/mesh11sd/blob/7.3.0/ChangeLog
Signed-off-by: Rob White <rob@blue-wave.net>
- Add interface trigger handling in watchcat.init
- Log when raw interface trigger is activated by any interface coming up
- Move helper functions to separate file
- Update Makefile to install new functions file
Closes: #30463
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
We use shellcheck even though it is pedantic to assist in reducing
errors. Therefore, we add shellcheck directives to silence false
positives. We keep changes minimal as some shellcheck suggestions
result in watchcat failing to function properly.
Also make formatting shmt clean (using -ln=bash due to ash constructs
that shfmt 3.8.0 does not accept for posix shells including busybox).
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
FFmpeg 7 removed AVCodecParameters.channels, causing MiniDLNA 1.3.3
to fail to compile when reading audio channel counts.
Add an OpenWrt package patch to use ch_layout.nb_channels with
libavcodec 61 and later. Retain the existing channels field access
for older versions.
Signed-off-by: Marcin Maj <marcinmajsc@gmail.com>
libwrap is auto-detected from the sysroot and is not in DEPENDS. When
found, the link fails: ocserv assigns to allow_severity and
deny_severity without defining them. Fails on all 35 targets.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Upstream enables wolfSSL whenever it finds it in the sysroot, leaving
libwolfssl.so undeclared and packaging broken on all 35 targets. OpenSSL
is already pulled in via libevent2-openssl and upstream supports it, so
build against that alone.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
- Multiple security fixes for heap buffer overflows, out-of-bounds
writes, and integer overflows. No CVE mentioned.
- Enforces ISO C11 standard.
- Added new Arm Neon (DotProd) and x86 (AVX2/AVX512) paths.
- It is ABI compatible with 1.16.0.
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
Add Alviy DDNS provider (dyndns2 API), IPv4.
Howto:
set [USERNAME] to the Alviy account e-mail
set [PASSWORD] to the host DDNS token
set [DOMAIN] to the hostname
https://www.alviy.com/en/docs/update-api
Signed-off-by: Elly Sai <alviy.dns@gmail.com>
The swanctl.conf child options are called local_ts and remote_ts
(traffic selectors), but the UCI config used local_subnet and
remote_subnet for them. Rename the UCI options in the swanctl init
script to match the swanctl.conf naming, so the config maps 1:1 to
what strongSwan actually expects.
Since this changes the UCI option names, existing configurations
would silently lose their traffic selectors after an upgrade. Add
migrate_child_subnet_to_ts() to the ipsec-to-swanctl migration
script. For each child section it moves the values of local_subnet
and remote_subnet into the local_ts and remote_ts lists and removes
the old options.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The local and remote authentication configuration was stored as flat
options on the connection section. This cannot represent IKEv2 multiple
authentication rounds, where more than one local/remote pair is needed.
Move the options into dedicated 'local' and 'remote' uci sections which
are referenced from the connection via the 'list local' and 'list
remote' options. Multiple sections per connection are now possible and
each pair is emitted as one authentication round.
The generated swanctl.conf names the rounds positionally: the first
local/remote section is emitted as 'local'/'remote', the following ones
as 'local2'/'remote2' and so on.
The 'authentication_method' option moves to the new sections as 'auth'.
The local side of an EAP connection still defaults to pubkey.
The migration script converts an existing connection into one local and
one remote section:
- 'local_identifier' -> local 'id'
- 'local_cert' -> local 'certs'
- 'local_key' -> local 'key'
- 'remote_identifier' -> remote 'id'
- 'remote_ca_certs' -> remote 'cacerts' (list)
- 'eap_id' -> remote 'eap_id'
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Remove the per-connection 'authorities' and 'secrets' blocks generated
inline in config_connection. Pre-shared keys and CA certificates are
now provided via the global 'secret' and 'authority' uci sections, which
prepare_env renders into their own swanctl.conf entries.
The migrate script converts the old per-connection settings into these
new global sections:
- psk connections: 'pre_shared_key' is moved into a 'secret' section
with type='ike', keeping the local/remote identifiers as an 'id' list
- pubkey connections: 'ca_cert' is moved into an 'authority' section
with the matching 'cacert' option
Both options are removed from the connection section afterwards.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Add a generic uci 'secret' section type to swanctl handling, replacing
the dedicated 'mschapv2_secrets' section in prepare_env. The secret kind
is selected via a new 'type' uci option and maps to the matching swanctl
secrets subsection (the section prefix equals the type value):
- eap, xauth, ntlm, ike, ppk: <type>-<name> { id ...; secret }
- private, rsa, ecdsa, pkcs8, pkcs12: <type>-<name> { file ...; secret }
- token: token-<name> { handle, slot, module, pin }
The 'id' option is a uci list element for the eap/xauth/ntlm/ike/ppk
types and emits one 'id' line per entry, matching swanctl's support for
multiple identities per secret.
The legacy path stays unchanged and keeps generating EAP secrets from
the 'mschapv2_secrets' section via legacy_config_mschapv2_secret.
The migrate script now converts 'mschapv2_secrets' sections into
generic 'secret' sections setting type='eap' and turning 'id' into a
list element.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Add support for the new 'authority' uci section type, which generates
global 'authorities/*' entries in the swanctl.conf file.
Each section is translated into one '<name>' authority block using the
following options:
- 'cacert' defines the CA certificate
- 'cert_uri_base' defines the base URI used by the hash and URL
features
- 'list crl_uri' defines one or more CRL distribution points, emitted
as 'crl_uris'
- 'list ocsp_uri' defines one or more OCSP responder URIs, emitted as
'ocsp_uris'
Example uci config:
config authority 'ca'
option cacert 'ca.pem'
list crl_uri 'http://crlca.example/ca.crl'
generates:
authorities {
ca {
cacert = ca.pem
crl_uris = http://crlca.example/ca.crl
}
}
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The 'remote' section type in '/etc/config/ipsec' is a misnomer, since
it defines the whole IPsec connection (IKE peer and children), not just
the remote end. Rename it to 'connection' to align with the swanctl
'connections' terminology.
Rename config_remote() to config_connection() and iterate the
'connection' type in swanctl.init.
Add a migrate_remote_to_connection migration step that renames existing
'remote' sections to 'connection'.
Signed-off-by: Florian Eckert <fe@dev.tdt.de
Let the caller pass an optional session ID as the first argument to
main(). If one is given, the migration is performed inside a LuCI
transaction session: the resulting /tmp/.uci/ipsec delta is moved to
/tmp/run/rpcd/uci-${session} at the end instead of being applied to the
running config directly. This allows LuCI to preview and apply the
ipsec-to-swanctl migration through its normal session workflow, rather
than forcing an immediate, uncoordinated commit of /etc/config/ipsec.
Drop the 'uci commit ipsec' calls scattered through the individual
migration functions, since committing is now the caller's
responsibility. Also add -q to the uci calls that were missing it, so
errors are suppressed consistently.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Until the user runs the migration, the legacy '/etc/config/ipsec'
configuration must keep working. Restore support for the old uci format
in the swanctl init script by adding a parallel legacy rendering path.
The 'legacy_config_*' helpers translate the legacy sections into
swanctl.conf syntax: 'ipsec' and 'remote' sections, including the
existing start/close/dpd action and lifetime translations, plus the
global 'pools' and 'mschapv2_secrets' blocks.
As long as the uci section type 'ipsec.@ipsec[0]' exists, prepare_env() and
service_triggers() use the legacy generation path and keep reloading on
'ipsec' changes.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Now that the ipsec-to-swanctl migration is no longer executed
automatically on boot, expose it through the init script so it can be
invoked on demand via '/etc/init.d/swanctl migrate'.
Also harden the migration script: abort with an error if
'/etc/config/ipsec' does not exist. Keep a copy of the original
configuration in '/etc/config/ipsec_bak' before starting.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The migration of the legacy '/etc/config/ipsec' UCI configuration to
the new '/etc/config/swanctl' format cannot be performed fully
automatically: it rewrites the user's configuration and must be
triggered and acknowledged by the user.
Remove the automatic migration hook that was installed as an
uci-defaults script (executed once on first boot or installation) and
instead ship the migration utility as a regular binary at
'/usr/libexec/strongswan/migrate-ipsec-to-swanctl'. From now on the
migration is only run on demand.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Previously a service reload only reloaded the IPsec connection
definitions from '/var/swanctl/swanctl.conf', leaving changes to
'/var/ipsec/strongswan.conf' to require a full restart.
Extend the reload action to also pick up changes to strongswan.conf
for a running service by executing 'swanctl --reload-settings' on
reload as well.
Note that 'swanctl --reload-settings' reloads '/var/ipsec/strongswan.conf'
at runtime, but not all settings (esp. plugin load directives, kernel/socket
options) are picked up by charon. A full daemon restart is still required
for such changes to apply. A note about this was added as well at this
point.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Strongswan can optionally install routes via XFRM interfaces if the
'charon.plugins.kernel-netlink.install_routes_xfrmi' option is enabled.
This change makes this configurable via uci.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Add a new uci 'shunt' section type for pass/drop policies, independent
of regular connections, since shunts have no peer, authentication or
proposals. Each section renders into its own 'connections{}' entry in
swanctl.conf.
Supports 'mode' (pass/drop), 'local_ts' and 'remote_ts' (lists),
'priority' and 'interface'. Sections with 'enabled' unset are skipped.
Signed-off-by: Florian Eckert <fe@dev.tdt.de
When the 'ipsec' section type was migrated to 'globals', the section
type was overlooked in '/etc/config/ipsec' and in the
config_foreach call in 'swanctl.init'. Both still referred to the old
'type', so the globals section was not picked up.
Fixes: e5c5a23a8 ("strongswan: do not use config_foreach named section globals")
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'dpddelay' to 'dpd_delay' in remote via upgrade script to
match the 'swanctl.conf' '<conn>.dpd_delay' key.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename the uci option 'overtime' to 'over_time' in the 'remote'
sections, via an upgrade script, to match the 'swanctl.conf'
'<conn>.over_time' key.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'rekeytime' to 'rekey_time' in remote via upgrade script to
match the 'swanctl.conf' '<conn>.rekey_time' key.
The new migration function 'migrate_option_remote_values' in 'uci-defaults'
is designed to be generic, since 'rekeytime' is not the only option that
does not conform to the swanctl naming scheme for conn and should also be
migrated.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'lifepackets' to 'life_packets' in child via upgrade script to
match the 'swanctl.conf' '<child>.life_packets' key.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'rekeypackets' to 'rekey_packets' in child via upgrade script to
match the 'swanctl.conf' '<child>.rekey_packets' key.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'lifebytes' to 'life_bytes' in child via upgrade script to
match the 'swanctl.conf' '<child>.life_bytes' key.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'rekeybytes' to 'rekey_bytes' in child via upgrade script to
match the 'swanctl.conf' '<child>.rekey_bytes' key.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'lifetime' to 'life_time' in child via upgrade script to
match the 'swanctl.conf' '<child>.life_time' key.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'rekeytime' to 'rekey_time' in child via upgrade script to
match the 'swanctl.conf' '<child>.rekey_time' key.
The migration function 'migrate_option' in 'uci-defaults' is designed to
be generic, since 'rekeytime' is not the only option that does not conform
to the swanctl naming scheme and should also be migrated.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'startaction' to 'start_action' via upgrade script to
match the 'swanctl.conf' '<child>.start_action' key.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'closeaction' to 'close_action' via upgrade script to
match the 'swanctl.conf' '<child>.close_action' key.
Unlike 'dpd_action', 'close_action' has a direct 'none' equivalent, so
all legacy values are migrated:
* clear -> none
* hold -> trap
* restart -> start
* none -> none
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
swanctl.conf only supports clear (the default), trap and restart, with
no equivalent for the legacy 'none' and 'start' values.
The upgrade script renames the uci option 'dpdaction' to 'dpd_action'
to match the 'swanctl.conf' '<child>.dpd_action' key. The value 'hold'
is remapped to 'trap'; this mapping was previously done in the swanctl
init script.
Not setting 'dpd_action' means 'clear'. Therefore, setting
'dpd_action=clear' (the default) together with 'dpddelay=0' is
equivalent to the old 'dpdaction=none'. This is not upgraded
automatically.
Signed-off-by: Florian Eckert <fe@dev.tdt.de
Introduce the 'use_custom_proposal' flag, allowing users to define
their own IKE/IPsec proposals in 'custom_proposal' instead of relying
on the uci options 'encryption_algorithm', 'hash_algorithm',
'dh_group' and, for IKE, 'prf_algorithm'.
This is particularly useful for:
* Advanced users who need specific algorithm combinations
* Compatibility with non-standard or legacy peers
* Fine-tuning security parameters for specialized use cases
Note that enabling this option requires careful configuration, as
incorrect proposals may break compatibility or cause connection
failures. Upgrades with custom proposals are not officially supported,
since we do not know what the user has configured.
Signed-off-by: Florian Eckert <fe@dev.tdt.de
Previously, the debug option for strongswan logging was configured
directly in the globals section of ipsec, so every subsystem had the
same log level. To improve modularity and maintainability, relocate
the debug configuration to a dedicated named 'ipsec plugin' section
'syslog'.
Rationale:
* Clearer separation of concerns (logging vs. core strongswan settings)
* Better alignment with the strongswan plugin-based architecture
Key improvements:
* Enables separate log level configuration for individual strongswan
subsystems (dmn, mgr, job, ...), allowing finer control over debug
verbosity.
* Splits logging facilities into 'daemon' and 'auth' for more granular
log filtering and debugging. The subsystems ike, chd, enc and esp
are moved to the 'auth' facility; all other subsystems are moved to
the daemon facility.
* The default logging level for the 'auth' and 'daemon' facilities is
set to '-1', which means "absolutely silent".
The existing configuration is also migrated to the new uci layout using
a uci-defaults script.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Migrate the uci section types 'tunnel' and 'transport' in
'/etc/config/ipsec' into a single 'child' section type, distinguished
by a new 'mode' option ('tunnel' or 'transport') for now. Existing 'mode'
values are preserved.
The 'remote' sections keep their type, but their 'list tunnel' and
'list transport' references (which point to the renamed child
sections by name) are merged into a single 'list child'.
Rationale:
* 'tunnel' and 'transport' sections already share the same set of
options (local_subnet, remote_subnet, crypto_proposal, etc.) and
only ever differed by IPsec mode. Modeling that as data (a 'mode'
option) instead of as two separate section types removes
duplicated schema/parsing logic and mirrors how 'swanctl.conf' itself
expresses mode on a single 'children' entry.
* Adding further modes (e.g. 'beet') in the future only requires
extending the allowed values of 'mode', not introducing another
section type and duplicating its option set.
The existing configuration is also migrated to the new uci layout using a
uci-defaults script.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
OpenWrt ships the plugins in multiple packages that are not all
installed by default. When running tools like 'pki' or 'swanctl',
this currently produces error-level log output for plugins that
are simply not installed, which can alarm users unnecessarily.
Enable the new configure option 'plugins-packaged-separately'
(default: no), added in strongSwan 6.0.5, which sets it to 'yes'.
This lowers the log level of the corresponding messages and adds
a note that the missing plugins may be available in other
packages.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
/dev/input/* is 0600 root:root unless input-support is installed to
allocate the input group and ship the hotplug rule, so a program reading
evdev has to run as root without it.
libinput depends on libevdev and inherits this, so both sides of the
evdev stack are covered by saying it once here.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
/dev/dri/card* is 0600 root:root unless video-support is installed to
allocate the video group and ship the hotplug rule that puts the nodes
into it, so anything talking to DRM needs that package present.
libdrm is where that is worth saying once. The dependency is a plain
one, and package-metadata.pl re-emits a selected package's own
conditions onto whatever selects it, so every consumer inherits the
requirement and none of them has to repeat it. That reaches the mesa
providers here and, through them, the video feed.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The package allocates a group named scanner with a dynamic id, while
openwrt.git's scanner-support package allocates it as gid 47. Two
different ids for one group name make the metadata scan fail.
Depend on scanner-support and pin the group to the same id. The hotplug
script stays here: it matches a scanner by vendor and product id against
the usbid lists this package ships, which scanner-support has no way to
do, and it already checks that the group exists before granting access.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The package allocates a group named dvb with a dynamic id, while
openwrt.git's dvb-support package allocates it as gid 49 together with
the hotplug rules that put the DVB adapter nodes into it. Two different
ids for one group name make the metadata scan fail.
Depend on dvb-support and pin the group to the same id.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The AUDIO_SUPPORT target feature is replaced in openwrt.git by an
audio-support package, which allocates the audio, audio-capture and midi
groups and installs the hotplug rules that put the ALSA nodes into them.
A target feature said only that the SoC family might have a sound card;
the package says that this image has one.
Depend on the package where the feature was tested, and read
CONFIG_PACKAGE_audio-support where mpd tested the feature at build time.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
libdvbcsa no longer requires BUILD_PATENTED, so enable dvbcsa
unconditionally and drop the BUILD_PATENTED dependency and config
toggle.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
libdvbcsa no longer requires BUILD_PATENTED, so drop the gate from the
libdvbcsa dependency and the configure args. Software descrambling is
now enabled via TVHEADEND_CSA alone.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Add a test-version.sh override because shineenc does not report its
version. Keep the remaining generic package checks enabled.
Signed-off-by: Marcin Maj <marcinmajsc@gmail.com>
Lasse Hanschen
Christian Lachner
Rob White
Daniel F. Dickinson
Marcin Maj
Alexandru Ardelean
Luiz Angelo Daros de Luca
Elly Sai
Florian Eckert
Daniel Golle
Rosen Penev