- remove outdated patch file
It was fixed upstream in containers/crun@9acf13d, so the patch file is no longer required.
- replace yajl with json-c
The JSON backend was switched from YAJL to json-c in containers/crun@b62cfdd, so --enable-embedded-yajl should be removed from CONFIGURE_ARGS and libjson-c should be add as a new dependency
Signed-off-by: nantayo <sora1924@outlook.com>
Add a -n guard before the arithmetic comparison of engineidtype in
snmpd_engineid_add(). When the engineid UCI section exists but
engineidtype is not configured, the empty string is passed to
[ -ge ]/[ -le ] which causes 'sh: bad number' on every boot.
Signed-off-by: Michael Pfeifroth <michael.pfeifroth@westermo.com>
Add an opt-in reset_failure_timer option for restart_iface and
run_script modes.
When enabled, watchcat starts a fresh failure window after the
recovery action finishes before allowing another recovery action.
The existing behavior remains the default.
Document the intended default and reset_failure_timer timing
behavior in TIMINGS.md and use a safer string comparison for the
reset_failure_timer check.
Signed-off-by: Dharmik Parmar <dharmikparmar2004@yahoo.com>
Clarify the restart_iface logging so the message reflects that the
configured action happens only after the failure period is reached.
Signed-off-by: Dharmik Parmar <dharmikparmar2004@yahoo.com>
The binary included in this package does not output anything, causing
the generic version check in CI to fail. Override the test.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
- add f_mem() helper to read MemAvailable from /proc/meminfo,
replacing three duplicated inline reads in f_load, f_dns and f_jsnup
- cap the auto-detected CPU core count by available memory in f_load:
adb_cores is limited to MemAvailable / 48 (MiB per job), floored to at least 1 core;
this bounds the number of feeds processed in parallel on constrained devices,
a user-set adb_cores is still honored as a ceiling (the cap only ever lowers it).
- derive the GNU sort buffer size from available memory
- readme update:
- added a "low memory systems" recommendation to use
the zram-swap package (compressed swap) with a swappiness hint,
plus a sizing rule of thumb — this works for all DNS backends OOTB
- significantly expanded the custom-feeds section (all JSON fields, rule parameters, etc.)
Signed-off-by: Dirk Brenken <dev@brenken.org>
default feed updates:
- urlhaus, urlvir, webclient: switched from in to out
and added a tcp udp 80 443 port limit (destination feeds for LAN-initiated traffic)
- feodo, spamhaus, threat, threatview, proxy, tor, vpn, vpndc: switched from in to inout
- threatview: added url_6, as the source ships IPv4 and IPv6 in a single file
- country / asn: intentionally left on in; documented how to switch them to outbound/both
for the recurring "block connections to country X" case
- readme update:
- corrected the feed table to match the above,
- removed the stale drop row (replaced by spamhaus),
- and reworked the chain explanation to clarify the inbound-vs-outbound (source-IP vs destination-IP) model
- significantly expanded the custom-feeds section (all JSON fields, rule parameters, etc.
Signed-off-by: Dirk Brenken <dev@brenken.org>
Swtich to upstream recommended 7.0 LTS branch[1] which includes a fix
for CVE-2026-39402. Full changelog: https://github.com/lxc/lxc/releases/tag/v7.0.0
- Removed patches/021-remove-legacy-cgroup-support.patch due upstream
deprecated CGroupV1 support.
- Modified files/lxc-auto.init to remove the boot() function which mounted
legacy cgroup1 stuff as well. This PR will superceed
https://github.com/openwrt/packages/pull/27757 as a result.
- Added a version check script for the CI.
- Fix another CI failure with -Dmemfd-rexec=false
Note this release adds the ability to introduce landlock-sandboxing the
monitor process but that would depend on CONFIG_SECURITY_LANDLOCK in the
kernel. This can be added in a future PR if there is interest.
1. https://discuss.linuxcontainers.org/t/lxc-7-0-lts-has-been-released/26612#p-90585-support-and-upgrade-8
Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc
Signed-off-by: John Audia <therealgraysky@proton.me>
The exit command was running unconditionally which broke the system
configuration. Fix that and simplify the wan interface check.
Run network.wan deletion quietly in case it doesn't exist.
Signed-off-by: Chester A. Unal <chester.a.unal@arinc9.com>
Two packages (fluent-bit and nnn) don't properly gate musl-fts as
only required when using MUSL.
Signed-off-by: Philip A. Prindeville <philipp@redfish-solutions.com>
- Fix technically undefined behavior when comparing return value from
realloc to the original pointer
- Update mapfile patch 11, removing stray line and improving the
efficiency of the original fix
- Fix read builtin to avoid cases where -1 is used as an index into the
input buffer
Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
Update bsbf-resources to the GIT HEAD of 2026-06-19.
- files/etc/uci-defaults/99-bsbf-bonding:
- Simplify the script and make sure multiple wan interfaces are processed
properly.
- Use routing table 1 instead of 100.
- Make it able to install the bsbf-bonding package without needing
bsbf-client-openwrt-installer.
- files/usr/sbin/bsbf-bonding:
- Move uninstall functionality to makefile.
Signed-off-by: Chester A. Unal <chester.a.unal@arinc9.com>
harden captive portal auto-login script handling:
* enforce the login-script allowlist in the backend instead of the
LuCI frontend only: canonicalize the configured path via 'readlink -f'
(defeats ../ traversal and symlink-to-interpreter tricks) and require a
regular, executable /etc/travelmate/*.login file before running it
* run the script in a noglob subshell ('set -f') so attacker-influenceable
script_args can no longer expand globs into the trusted script; field
splitting (multiple args) is preserved
* writing into /etc/travelmate/ is not covered by the luci-app-travelmate
ACL, so this limits the root-executed script to admin-placed login scripts
and closes a delegated-ACL to root command execution path.
Signed-off-by: Dirk Brenken <dev@brenken.org>
In order to use AES-192 and the like, it is necessary to enable
blumenthal-aes.
Blumenthal AES draft was not formalized in RFC but is
widely implemented by many vendors. It has strong encryption in
connection with SNMPv3.
Signed-off-by: Christian Korber <ckorber@tdt.de>
It seems this software is no longer maintained, because
the latest release is 23 years ago.
No package depends on this.
Signed-off-by: Yanase Yuki <dev@zpc.st>
No longer needed by any package in the feed; jsonpath-ng was the
last consumer and no longer imports it.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
No longer needed by any package in the feed; jsonpath-ng (the last
consumer) vendors ply internally as jsonpath_ng._ply.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
jsonpath-ng 1.8.0 vendors ply as jsonpath_ng._ply and no longer imports
six or decorator, so none are required at runtime.
It builds through the setuptools.build_meta legacy backend but never
declared setuptools as a build dependency; it was only present in the host
build env transitively via those packages' builds. Add python-setuptools/host
explicitly so the build no longer relies on that side effect.
The jsonpath_ng CLI takes a required expression argument and has no version
flag, so the generic version check cannot detect the package version from it.
Add a test-version.sh override and assert __version__ in test.sh instead,
mirroring python-jmespath.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
- fix uplink teardown for bssid-pinned stations
the new implementaion reads the sta object once and parses fields by name via jshn
(isolated namespace, single fork). Bug finder: @adam8833 (#29768)
- add a fork-free f_normbssid() helper and normalize all config-side bssids
to upper case before comparison (in f_getcfg(), covering all callers, and
on the direct scan comparisons in f_main()).
- LuCI: adds a normBssid() helper function as well
Signed-off-by: Dirk Brenken <dev@brenken.org>
snmpd generates its runtime configuration in /var/run/snmpd.conf from
UCI during start_service(). However, since the procd instance command
line never changes, procd does not detect that a restart is needed when
the UCI config is modified.
Add 'procd_set_param file /etc/config/snmpd' so procd tracks the config
file and restarts snmpd when it changes. Without this, 'reload_service'
(triggered by procd_add_reload_trigger) re-creates an identical instance
definition and procd skips the restart, leaving stale configuration
active.
This also fixes a usability issue with SNMPv3: when changing a user's
authentication or privacy algorithm, net-snmp must restart to re-derive
localized keys via createUser. Without the restart, the daemon keeps
using cached key material and authentication fails.
Tested with net-snmp 5.9.4 on OpenWrt (aarch64 and ppc64).
Signed-off-by: Michael Pfeifroth <michael.pfeifroth@westermo.com>
Upstream removed editables from install_requires in hatchling 1.27;
1.30.1 no longer needs it at runtime or build-time.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
No longer needed by any package in the feed; only python-schema
depended on it and it was a Python <3.3 conditional shim.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Upstream only requires contextlib2 on Python <3.3, so it is never
pulled in on a Python 3.14 runtime.
schema builds through the setuptools.build_meta legacy backend but never
declared setuptools as a build dependency; it was only present in the host
build env transitively via contextlib2's build. Add python-setuptools/host
explicitly so the build no longer relies on that side effect.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Add UCI options for the path to the server's SSL certificate and
private key. This enables the use of a certificate provided by an
external certificate authority instead of the default self-signed
certificate.
The self-signed certificate is still produced if it doesn't already
exist, and is used by default. So this change should be transparent to
existing users.
Fixes#23099.
Signed-off-by: Jack Lovell <jacklovell1990@gmail.com>
Maintainer: me
Compile tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Run tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Description:
Update to 1.2.4
- Update PKG_VERSION to 1.2.4 and PKG_RELEASE to 2.
- Update documentation URL from melmac.ca to mossdef.org.
README.md:
- Update documentation URL from melmac.ca to mossdef.org.
files/etc/config/adblock-fast:
- Add default option `download_connect_timeout '10'`.
- Add default option `download_allow_insecure '1'`.
- Set default `parallel_downloads` to `8`.
- Remove commented `download_max_time` line.
files/etc/init.d/adblock-fast:
- Increment `initCompat` to 17.
- Add `download_connect_timeout`, `download_max_time`,
`download_allow_insecure` to config validation schema.
files/etc/uci-defaults/90-adblock-fast:
- Use `initCompat` from init script to stamp `config_compat`.
- Migrate `parallel_downloads` from boolean to numeric cap for compat < 15.
- Seed new `download_connect_timeout` from old `download_timeout`
for compat < 16.
- Add new `config_compat` and `config_version` stamping.
files/lib/adblock-fast/adblock-fast.uc:
- Increment package `compat` to 17.
- Introduce `task_slot_ram` for per-downloader memory budgeting.
- Add `download_connect_timeout`, `download_max_time`,
`download_allow_insecure` to `reload` triggers.
- Store `downloader` kind and track `_last_dl_timeout` status.
- Refine downloader detection: prefer curl, then uclient-fetch, then
GNU wget, finally generic wget.
- Update `curl` command flags for `--insecure`, `--connect-timeout`,
`--speed-limit`/`--speed-time`, `--max-time`.
- Update `uclient-fetch` flags for `--no-check-certificate`.
- Update `wget` flags for `--no-check-certificate`,
`--connect-timeout`, `--read-timeout`.
- Improve SSL support detection for uclient-fetch.
- Capture `curl` exit code 28 as a distinct timeout failure.
- Expand `get_text` cases for `errorDetectingFileType`,
`warningMissingRecommendedPackages` (args), `warningParallelDownloadsThrottled`,
`warningDownloadTimeout`.
- Allow `download_allow_insecure` for `get_url_filesize` calls.
- Set `download_allow_insecure` default to true in `config_schema`.
- Change `parallel_downloads` from boolean to integer `8` default in
`config_schema`.
- Add `download_connect_timeout` and `download_max_time` to `config_schema`.
- Read up to 4KB for `detect_file_type`.
- Improve `warningMissingRecommendedPackages` output: list missing
packages and use `apk` or `opkg` install command.
- Split `process_file_url` into parallelizable `prepare_file_url`
and serial `apply_result`, plus `emit_dl_line`.
- Implement memory-aware throttling for `parallel_downloads`.
- Revert to single `process_file_url` for serial uses and test runner.
- Correct `get_mem_available` to return current free memory only.
- Rename `get_mem_total` to `get_mem_available`.
Signed-off-by: Stan Grishin <stangri@melmac.ca>
Python 3.14 made "forkserver" the default multiprocessing start method on
Linux, which binds an AF_UNIX socket under $TMPDIR during the PGO profile-run.
OpenWrt points TMPDIR at the deeply nested build tree, so the socket path can
exceed the 108-byte AF_UNIX limit and abort the host build with "AF_UNIX path
too long" in test_re (cpython#149527). Pin TMPDIR=/tmp for the host build.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
`pkg/request/ssrftest` is used for tests only and does not contain
real package, exclude it from build list.
Fixes: 7f5a269cf3 ("cloudreve: Update to 4.16.1")
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Updated from 4.04.856 to 5.06.909.
Changes:
- Switch from git clone to tarball download
- Add start_time/end_time scheduling support for tcp/http/https/socks5
- Add service_type validation for tcp (ssh/mstsc/rdp/vnc/telnet)
- Add iod proxy type support
- Add WAN up auto-restart trigger
- Add -s startup parameter
Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>
ifstat fails to build with GCC 15 due to an incorrect detection of the
signal handler return type.
The configure script shipped with ifstat uses an obsolete K&R-style
declaration:
void (*signal())();
With GCC 15 this causes the signal() return type check to incorrectly
assume 'int' instead of 'void'. As a result, the generated code defines
signal handlers returning int, which conflicts with struct sigaction
expecting a void (*)(int) handler and leads to a build failure:
assignment to 'void (*)(int)' from incompatible pointer type
'int (*)(int)'
Enable autoreconf during the build to regenerate the configure
script, which correctly detects the signal handler type and fixes
the compilation error.
Signed-off-by: Til Kaiser <mail@tk154.de>
Add package for memtest86+ and ability to boot directly into it from
existing grub menu. Both legacy and EFI packages are available and each
will provide the needed memtest86+ images plus a postinst and postrm to
handle the grub.cfg menu entries.
The images are tiny, adding at worst 154 kB to the kernel partition.
I do not have x86 box for testing but the memtest86plus-efi package
works as expected on my test machine (ie booting into the image and the
setup and removal of the grub.cfg menu entry).
Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc (Intel N150 based box)
Signed-off-by: John Audia <therealgraysky@proton.me>
nantayo
Hannu Nyman
Michael Pfeifroth
Dharmik Parmar
Stijn Tintel
Hirokazu MORIKAWA
Dirk Brenken
John Audia
Chester A. Unal
Glenn Strauss
dependabot[bot]
Philip A. Prindeville
Wei-Ting Yang
Vladimir Ermakov
Stan Grishin
Christian Korber
Yanase Yuki
Alexandru Ardelean
Jack Lovell
Jan Hák
Jianhui Zhao
Tianling Shen
Carsten Schuette
Dengfeng Liu
Til Kaiser