When LuCI passes a session id, migrate-ipsec-to-swanctl moves its uci
delta into /tmp/run/rpcd/uci-<session id>, rpcd's private save directory
of that session. rpcd stops naming this directory after the session id,
as the id is a bearer credential that leaked through directory listings,
so the migrated configuration would no longer show up as pending changes
in LuCI.
Stage the migration through rpcd's uci ubus API instead: revert the
session's ipsec changes, delete all sections and add the sections of the
migrated configuration. Then revert the changes of the uci command line
tool, which the old code moved away. This works with old and new rpcd
versions. If staging fails, both are reverted and the script exits with
an error.
Fixes: d5f33e6410 ("strongswan: support optional UCI session staging in migrate-ipsec-to-swanctl")
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
tio embeds Lua for its scripting support, which is not optional. It
looks Lua up through pkg-config as lua-5.4, lua-5.3, lua-5.2, lua-5.1
and lua, in this order, with no option to select the version. The
package depends on lua (5.1), which tio has found as lua.pc so far.
Since lua5.4 stages lua-5.4.pc, tio finds Lua 5.4 first and links
liblua5.4 without depending on it.
Depend on liblua5.4, the version tio looks up first, instead of lua,
which is the documented preferred version anyway.
Only the library is needed; tio does not run the lua interpreter.
Signed-off-by: Mirko Vogt <mirko-openwrt@nanl.de>
Lua stopped shipping a pkg-config file after 5.1; the 5.2, 5.3 and 5.4
release tarballs contain none. Distributions add one to their Lua
packages instead: Debian's liblua5.4-dev ships lua5.4.pc, lua-5.4.pc
and lua54.pc, Alpine's lua5.4-dev ships lua5.4.pc and lua-5.4.pc. Build
systems of Lua consumers look Lua 5.4 up under these names. The package
stages no pkg-config file so far, so such builds cannot find
liblua5.4; the only Lua pkg-config file in the staging directory is
lua.pc of the lua package (5.1.5).
Stage lua5.4.pc, generated from a template with the package version,
and lua-5.4.pc and lua54.pc as links to it. It points to the headers in
/usr/include/lua5.4 and to liblua5.4, and lists libm and libdl as
private libraries for static linking, as the upstream Makefile links
them on Linux.
Of the packages that look up one of these names through pkg-config,
libinput disables its Lua plugin support explicitly in the previous
commit. tio looks up lua-5.4 before lua but depends on lua (5.1), so it
links liblua5.4 without depending on it until the next commit moves it
to Lua 5.4. The others select their Lua version explicitly, look up lua
(5.1) first, build without the feature using Lua, or depend on lua5.4
already.
Assisted-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Mirko Vogt <mirko-openwrt@nanl.de>
The lua-plugins option is left at its default, auto, so libinput builds
its Lua plugin support whenever pkg-config finds Lua 5.4 (lua-5.4,
lua5.4 or lua >= 5.4) in the staging directory. lua5.4 installs no
pkg-config file so far, so the package has been built without it. Once
lua5.4 stages lua5.4.pc, libinput links liblua5.4 without depending on
it, and packaging fails with "missing dependencies for the following
libraries: liblua5.4.so.*".
Set -Dlua-plugins=disabled, so the package is built as before.
Signed-off-by: Mirko Vogt <mirko-openwrt@nanl.de>
luaconf.h builds the module search paths out of LUA_ROOT, which upstream
hardcodes to /usr/local, where nothing installs on OpenWrt. LUA_ROOT is
defined unconditionally, but the two macros it feeds, LUA_PATH_DEFAULT
and LUA_CPATH_DEFAULT, are both guarded with #if !defined and are the
only users of it, so set them in TARGET_CFLAGS and drop the patch.
The resulting paths are the ones the patch produced, so the interpreter
behaves exactly as before.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
The three Lua variants of each package install the same files, differing
only in the destination directory, so define LUA_INSTALL_DIR next to the
other per-variant settings and share a single install recipe. Same idiom
as luafilesystem, luasec and luaexpat. No packaged path changes.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Previous package (atlas-sw-probe) printed the public key to register a
new probe with "/etc/init.d/atlas get_key" and the probe ID with
"/etc/init.d/atlas probeid", and the documentation [1] [2] tells users
to run get_key. Add both back as "/etc/init.d/ripe-atlas get_key" and
"/etc/init.d/ripe-atlas probeid". For a probe that has registered since
boot, get_key prints the probe ID instead of asking to register it.
[1] https://docs.turris.cz/basics/apps/atlas/
[2] https://github.com/openwrt/packages/blob/d2aeaf041bc0/net/atlas-sw-probe/files/atlas.readme
Fixes: b77264c922 ("ripe-atlas: add new package")
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* define tproxy_available() before render(): ucode resolves the name
when render() is compiled, so the later definition left it null and
every status call failed - LuCI showed "no answer from the backend"
Signed-off-by: Dirk Brenken <dev@brenken.org>
* add the per-policy action 'tproxy': hands the selected tcp/udp traffic
to a transparent proxy on the router (option tproxy_port), delivered to
127.0.0.1/::1 via a 'local default dev lo' policy table
* restore rules for tproxy flows carry the tproxy statement on every
packet - a mark alone loses udp flows to the proxy's reply socket
* a proxied flow whose listener is gone is always dropped: its conntrack
entry was never NATed and would leave with the client's own address;
fallback 'main'/'block' decides about new flows only
* no tproxy rules in output (the kernel rejects the statement there), no
keep_local rule for tproxy (main would forward socket-assigned packets)
* tproxy policies are skipped as an issue without kmod-nft-tproxy instead
of failing the whole nft batch
* shunt check and the rpcd status report tproxy policies
* readme update
Co-authored-by: Claude <noreply@anthropic.com>
Signed-off-by: Dirk Brenken <dev@brenken.org>
duperemove is a simple tool for finding duplicated
extents and submitting them for deduplication. It
will de-dupe results on btrfs.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Signed-off-by: Keith T. Garner <kgarner@kgarner.com>
WeeChat (Wee Enhanced Environment for Chat) is a fast, light and
extensible chat client with a modular architecture and relay support.
This package provides:
- weechat-minimal (default variant): headless daemon without ncurses,
suited for routers and for use through relay web or mobile clients.
- weechat-full: the ncurses terminal client as well as the headless
daemon.
- Config.in: menuconfig options for zstd, cJSON and the scripting
plugins (Python, Lua, Ruby, Perl, Tcl).
- procd init script and UCI configuration. irc.conf, relay.conf and
logger.conf are generated from UCI, and the values written to them
are checked first. The relay refuses to start without a password and
disk logging is off by default to protect flash storage. Passwords
are stored as hex encoded WeeChat expressions, so characters like ';'
or '${' can neither run commands nor get evaluated.
- The daemon runs as the weechat user. /etc/weechat, /etc/weechat/tls
and /var/run/weechat belong to root. The init script only changes
paths whose parent the daemon cannot modify, except for the generated
files in the sticky config directory, which it renames into place
without following symlinks. Of the log directories it only creates
the default /var/log/weechat.
- test.sh: checks the binaries and plugins, the init script
validation, the directory layout, the values WeeChat reads back from
the generated files and that the relay listens.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Tiago Gaspar has not been active in this repository since May 2026 and
did not respond when Alexandru Ardelean offered to pick the package up
in https://github.com/openwrt/packages/pull/30030. Michel Stam, who
wrote RIPE's own OpenWrt packaging, has not taken part here, and since
5120 that packaging lists the RIPE Atlas Team instead of him. I run a
probe and test the package on Turris OS, so take it over.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
ripe-atlas-probe provides atlas-sw-probe, but carries nothing over, so
an upgraded probe would come up with a new key, which RIPE rejects
until its host enters it on atlas.ripe.net.
Take over the key and the settings of atlas-sw-probe in a uci-defaults
script of ripe-atlas-probe, and stop and disable atlas once the key is
in place. A failed run is retried on the next boot. Until it succeeds,
the init does not start the probe, so the key is never used twice and
no new key is created. Until the key is in place, the init logs that it
waits.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
- Build the tree once, the variants only install different files. Both
provide ripe-atlas, with the probe as the default variant, so that
apk, whose packages carry no CONFLICTS, cannot install both.
- Select busybox tee, cmp and find with the options that the
registration and the init use, and drop jsonfilter and the busybox ps,
killall, tar, ntpd and bunzip2 selects, which nothing installed uses.
- Do not keep /etc/ripe-atlas/mode, the init rewrites it on every start.
- List all licenses: the measurement busybox is BusyBox (GPL-2.0-only)
with libevent (BSD-3-Clause and ISC) linked in, and five of the shell
libraries are LGPL-2.1-or-later.
- Link the measurement applets in one loop.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Restart the probe when /etc/config/ripe-atlas changes. procd does not
restart an instance when any of these options changes, and up to OpenWrt
25.12, when it stops one, it signals only the main script, so the
measurement daemons, the ssh tunnel and telnetd would keep running. Stop
and start the whole service instead.
On stop, take the processes from the instance's cgroup, which holds
exactly those of the probe, and fall back to the ripe-atlas group only
when it holds none.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
procd hands capabilities to a service only through ujail, which is
optional. Without it the probe ran as ripe-atlas without CAP_NET_RAW,
and its ping and traceroute measurements failed.
Use ujail when it and the ripe-atlas user exist, and run the probe as
root otherwise, as atlas-sw-probe did, with a warning in the log. Keep
only CAP_NET_RAW, the probe never changes its user.
Fixes: b77264c922 ("ripe-atlas: add new package")
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
The probe runs as ripe-atlas, but /etc/ripe-atlas is root's, so the
probe could neither create its key nor copy the registration servers
there, and it never registered. Let the init, which runs as root,
prepare both, as generic-ATLAS.sh would, and keep the directory root's,
so that the probe cannot swap in links for what root writes or chowns
there.
While at it:
- validate the booleans as bool, yes/on/true made the probe refuse to
start;
- create the key also over an empty file, which ssh-keygen would not
overwrite without asking;
- set up the spool directories, which the probe user owns, only until
that worked once since boot, remove links put in their place, and
refuse a /var/spool/ripe-atlas that root does not own, so that root's
chown and chmod cannot be redirected;
- create its files and directories with umask 022, so that a caller's
umask can neither hide them from the probe nor open them to others;
- wait for ripe-atlas-probe or -anchor, which apk installs only after
ripe-atlas-common started the service, and restart the service from
their post-install;
- install measurement.conf readable for the probe.
Fixes: b77264c922 ("ripe-atlas: add new package")
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
The kernel marks routes using no-carrier devices as dead linkdown. mwan3
strips linkdown but passes dead to ip route, which rejects the copied route
and leaves policy tables incomplete.
Strip both flags, including at end of line, and add a runtime test.
Signed-off-by: Gleb Pesin <dormancygrace@gmail.com>
Commit 246506690f ("modemmanager: always reset the init_eps if not
configured") changed the behaviour for an unset 'init_epsbearer' from
leaving the modem untouched to clearing the initial EPS bearer on every
setup. This is a regression for users upgrading from 24.10:
- Modems without support for setting the LTE attach configuration (e.g.
Sierra Wireless EM7430) fail the setup with
MM_INIT_EPS_BEARER_SET_FAILED and never come up.
- Attach settings preloaded by the carrier firmware are wiped.
The same commit also removed the explicit 'none' case, so 'none' now
silently skips the initial EPS bearer setup, while it cleared it in
24.10. Neither matches the documentation.
Make all modes explicit, each naming where the initial EPS bearer
settings come from:
- modem: leave the settings stored on the modem unchanged (default)
- network: set an empty initial EPS bearer, the network assigns the
APN; replaces the implicit clear, e.g. after a SIM swap
- connection: use the connection options (apn, iptype, ...)
- custom: use the init_* options
'none' and 'default' are kept as deprecated aliases for 'modem' and
'connection'. 'none' maps to 'modem' as documented in the README and as
it behaves since 246506690f, although an explicit 'none' cleared the
initial EPS bearer in 24.10; use 'network' for that. Unknown values fall
back to 'modem'. The README now documents the modes and how to clear
stale settings manually.
Fixes: https://github.com/openwrt/packages/issues/30299
Signed-off-by: Michael Pfeifroth <micpf@westermo.com>
Commit 3fe92e63f5 moved the default Lua 5.4 module search paths
from /usr/local to /usr. luaossl still staged and packaged its Lua 5.4
modules under /usr/local/lib/lua/5.4, outside the default search paths.
Set lua54path and lua54cpath to /usr/lib/lua/5.4 and update the package
install rules to match. Bump PKG_RELEASE to 3 so the corrected package
is offered as an upgrade. Keep Lua 5.1 and Lua 5.3 paths unchanged.
Fixes: 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of /usr/local")
Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
Commit 3fe92e63f5 moved the default Lua 5.4 module search paths
from /usr/local to /usr. cqueues still staged and packaged its Lua 5.4
modules under /usr/local/lib/lua/5.4, outside the default search paths.
Set lua54path and lua54cpath to /usr/lib/lua/5.4 and update the package
install rules to match. Bump PKG_RELEASE to 3 so the corrected package
is offered as an upgrade. Keep Lua 5.1 and Lua 5.3 paths unchanged.
Fixes: 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of /usr/local")
Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
Commit 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of
/usr/local") changed LUA_ROOT to /usr/, moving the default Lua 5.4
module search paths out of /usr/local. The Lua 5.4 variant of lua-ffi
still installed ffi.so under /usr/local/lib/lua/5.4, so require("ffi")
could no longer find it with the default search paths.
Install ffi.so under /usr/lib/lua/5.4 to match the new default search
path. Bump PKG_RELEASE to 2 so the corrected package is offered as an
upgrade. Keep the Lua 5.1 and Lua 5.3 installation paths unchanged.
Fixes: 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of /usr/local")
Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
Commit 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of
/usr/local") changed LUA_ROOT to /usr/, moving the default Lua 5.4
module search paths out of /usr/local. The Lua 5.4 variant of lua-cjson
still installed cjson.so under /usr/local/lib/lua/5.4, so require("cjson")
could no longer find it with the default search paths.
Install cjson.so under /usr/lib/lua/5.4 to match the new default search
path. Bump PKG_RELEASE to 6 so the corrected package is offered as an
upgrade. Keep the Lua 5.1 and Lua 5.3 installation paths unchanged.
Fixes: 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of /usr/local")
Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
Commit 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of
/usr/local") changed LUA_ROOT to /usr/, moving the default Lua 5.4
module search paths out of /usr/local. lua-eco still installed its Lua
and native modules under /usr/local/lib/lua/5.4, so require() could no
longer find them with the default search paths.
Install modules from the main package and all subpackages under
/usr/lib/lua/5.4, which is searched for both .lua and .so files.
Define LUA_INSTALL_DIR once and use it throughout the install rules so
future directory changes only need one update. Bump PKG_RELEASE to 2
so the corrected packages are offered as upgrades.
Fixes: 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of /usr/local")
Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
--enable-small builds only the resumable mode of the LZMA decoder and a
single-table CRC32/CRC64 without the architecture-specific CRC code.
Keep it for SMALL_FLASH targets and build the fast variants elsewhere.
xz -dc -T1 of a 32 MiB file (3.3 MiB .xz), median of 5: 966 -> 880 ms
on Cortex-A53, 813 -> 634 ms on Cortex-A72 in AArch32. liblzma grows by
11.5 KiB (aarch64) to 19.6 KiB (mips_24kc), compressed with xz.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Refresh sha256 from the PyPI sdist.
26.4.0 drops OpenSSL.crypto.X509Req and dump_certificate_request, so
test.sh can no longer import them; remove them and the CSR block. CSR
handling now lives in cryptography.x509, which is not this package.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Building python3-libtorrent with CMake 4 and Python 3.14 fails in
several places, which the distutils error of 2.0.11 used to hide:
- On 32-bit targets FindPython rejects the 64-bit host interpreter.
Pass the host python of OpenWrt as Python3_EXECUTABLE, which skips
that check and keeps CMake on the python that gets setuptools.
- The egg_info step needs setuptools, which the host python no longer
bundles since Python 3.12. Depend on python-setuptools/host when
python3-libtorrent is selected.
- CMake names the module after the SOABI of the host interpreter, for
example libtorrent.cpython-314-x86_64-linux-gnu.so, which the target
python does not load. Rename it to libtorrent.so after installing.
- The wheel from Py3Build/Compile only held the example scripts as
top-level modules and a second dist-info. The module always came
from the CMake install, so drop the wheel steps.
- The module imports datetime when it loads, which python3-base does
not ship. Depend on python3-light.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Check that the python bindings can be imported on the target and that
they report the package version.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Since 2.0.12 the python bindings read the install paths from sysconfig
instead of distutils, which Python 3.12 removed. With 2.0.11 CMake
fails to configure the python bindings, so neither libtorrent-rasterbar
nor python3-libtorrent builds.
Release notes:
https://github.com/arvidn/libtorrent/blob/v2.0.15/ChangeLog
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Solves issues with stats etc. not updating properly and reduces the
amount of leftover temporary files. Access to settings.json is kept
read-only to keep it in sync with UCI.
Signed-off-by: Ludvig Liu Holtze <ldw.liu.holtze@proton.me>
1.30.4:
- Heap buffer overflow with the map directive and regex matching
(CVE-2026-42533).
- Uninitialized memory access with unnamed regex captures and the slice
directive or background cache update (CVE-2026-60005).
- Use-after-free in ngx_http_ssi_filter_module with a crafted proxied
backend response (CVE-2026-56434).
1.30.5:
- Heap buffer overflow with HTTP/3 and OpenSSL 3.5.0 and earlier
(CVE-2026-90439).
All patches apply without changes.
Changelog: https://nginx.org/en/CHANGES-1.30
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Refresh PKG_HASH from the upstream GitHub release tarball.
Drop 010-CVE-2022-40320.patch. Upstream commit d73777c2c356, which the
patch carried, is part of 3.4: cfg_tilde_expand() now terminates the
username before handing it to getpwnam(). Keeping the patch would fail
to apply.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update to latest upstream release.
Removed upstreamed patch.
Security fixes:
- CVE-2026-101283: remote use-after-free in iperf_server_api.c
- CVE-2026-101276: heap buffer overflow in iperf_auth.c
- CVE-2026-102253: denial of service via infinite loop
- CVE-2026-71217: issue with test parameters
Changelog: https://github.com/esnet/iperf/releases/tag/3.22
Signed-off-by: John Audia <therealgraysky@proton.me>
4.5.0 uses three interfaces FFmpeg 7 removed; upstream guards them since
4.6. Drop 010-no-po-man.patch and switch PKG_FIXUP to gettext-version,
which runs autopoint and so supplies the po/Makefile.in.in the patch was
working around. Drop --without-mmal, which 4.7.1 no longer has.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Adds ionos.com as predefined DDNS service. IONOS' dynamic DNS API
only supports domains hosted at IONOS and uses a single fixed
update URL with a generated token as password. Both ipv4 and ipv6
updates use the same endpoint, distinguished by explicitly passing
the detected address via the ipv4= or ipv6= query parameter as
documented by IONOS. Verified working separately for both A and
AAAA record updates against a live domain.
Signed-off-by: Lasse Hanschen <lh@databloat.ch>
Maintainer: Rob White rob@blue-wave.net
Compile tested: All
Run tested: OpenWrt 25.12 and master/snapshot.
Description: mesh11sd (7.3.0)
This version adds pinning of the mesh gateway ARP to the active portal for the peer,
thereby providing reliable ipv4 on multi-portal backhauls.
Additional detected, but non selected portals, cannot retarget the peer or its clients.
The patches of the previous version in this feed are no longer needed so have been removed.
The full changelog can be seen here:
https://github.com/openNDS/mesh11sd/blob/7.3.0/ChangeLog
Signed-off-by: Rob White <rob@blue-wave.net>
- Add interface trigger handling in watchcat.init
- Log when raw interface trigger is activated by any interface coming up
- Move helper functions to separate file
- Update Makefile to install new functions file
Closes: #30463
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
We use shellcheck even though it is pedantic to assist in reducing
errors. Therefore, we add shellcheck directives to silence false
positives. We keep changes minimal as some shellcheck suggestions
result in watchcat failing to function properly.
Also make formatting shmt clean (using -ln=bash due to ash constructs
that shfmt 3.8.0 does not accept for posix shells including busybox).
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
FFmpeg 7 removed AVCodecParameters.channels, causing MiniDLNA 1.3.3
to fail to compile when reading audio channel counts.
Add an OpenWrt package patch to use ch_layout.nb_channels with
libavcodec 61 and later. Retain the existing channels field access
for older versions.
Signed-off-by: Marcin Maj <marcinmajsc@gmail.com>
libwrap is auto-detected from the sysroot and is not in DEPENDS. When
found, the link fails: ocserv assigns to allow_severity and
deny_severity without defining them. Fails on all 35 targets.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Upstream enables wolfSSL whenever it finds it in the sysroot, leaving
libwolfssl.so undeclared and packaging broken on all 35 targets. OpenSSL
is already pulled in via libevent2-openssl and upstream supports it, so
build against that alone.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
- Multiple security fixes for heap buffer overflows, out-of-bounds
writes, and integer overflows. No CVE mentioned.
- Enforces ISO C11 standard.
- Added new Arm Neon (DotProd) and x86 (AVX2/AVX512) paths.
- It is ABI compatible with 1.16.0.
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
Add Alviy DDNS provider (dyndns2 API), IPv4.
Howto:
set [USERNAME] to the Alviy account e-mail
set [PASSWORD] to the host DDNS token
set [DOMAIN] to the hostname
https://www.alviy.com/en/docs/update-api
Signed-off-by: Elly Sai <alviy.dns@gmail.com>