Short-circuit not applicable portions of hotplug script on remove, and
make sure we ignore events with incomplete information (no DEVNAME
or no ACTION).
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
mariadb-upgrade has had its own upgrade version file in the datadir,
called mysql_upgrade_info in <= 10.11 and mariadb_upgrade_info there
after.
The mariadb-install-db creates this file, and also the mariadb-upgrade
executable creates this file also.
This removes the need to maintain the .version info though this is used
as a last check of the upgrade.
Signed-off-by: Daniel Black <daniel@mariadb.org>
switch to meson build system
disable sock-diag which is not enabled in openwrt kernel
drop the arm build workaround
disable tests via patch file
Signed-off-by: Jimmy Qin <sunnyqeen@gmail.com>
The handwritten debian/changelog is only used to override the version
reported by support/version, but it is unnecessary and causes a version
mismatch:
- Build/Prepare feeds the raw git hash into debian/changelog, so the
binary reports ddb984f4c17f4a26fd34f3e1b24e3323f9641b75~openwrt1
instead of the package version 2026.08.17~ddb984f4.
- The CI package test then fails because it cannot find the package
version in the output of any installed executable.
- Without .git, debian/changelog or rpm/version, support/version falls
back to the source directory name.
- OpenWrt already names the source directory tvheadend-$(PKG_VERSION),
so the binary correctly reports 2026.08.17~ddb984f4 without any
override.
Alpine uses rpm/version in the same way and does not encode its own
package release into the version either.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
tvheadend has no transliteration of its own. It asks iconv for
"<charset>//TRANSLIT//IGNORE", a GNU extension that musl does not
implement. Converting "ŽluťoučkýKůň" to ASCII on mpc85xx/p2020
(Turris 1.x), musl 1.2.6:
charset musl GNU libiconv
ASCII//TRANSLIT//IGNORE EINVAL "Zlutouck'yKun"
ASCII//TRANSLIT EINVAL "Zlutouck'yKun"
ASCII "*lu*ou*k*K**" EILSEQ
050-iconv-test-continue.patch removed the abort() from the startup
self-test that reports this, so the package could be built against
musl's iconv. That silenced the check without fixing anything:
intlconv_utf8() still returns -EIO, so cleanup_filename() in
src/dvr/dvr_rec.c cannot build a recording file name and
pvr_generate_filename() fails. The charset cannot be avoided either,
because intlconv_filesystem_charset() returns "ASCII" unless $LANG
names a UTF-8 locale, which OpenWrt does not set by default.
Depend on libiconv-full instead of $(ICONV_DEPENDS), which pulls it in
only when BUILD_NLS is set, and point the compiler at its staging prefix
when nls.mk has not already done so. The binary then links against
libiconv.so.2, the self-test passes and the patch can be dropped.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Update to git master ddb984f4, 124 commits on from the previously
packaged 395afb85. Most of that is web UI work and translation updates,
with smaller fixes in the build system, mpegts and dvr code.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
- updatted the README and moved to the package root
- LuCI: fix blank pages on footstrap theme navigation
Signed-off-by: Dirk Brenken <dev@brenken.org>
fixed srv segfault on connection teardown (pthread_join clobbered tid)
C daemon filters device atSign out of the manager atSign list
handle the case where the only manager atSign is the device atSign
sshnpd + srv code review findings (24 fixes: bounds checks, leak
fixes, error-path hardening, log hygiene)
bump atsdk to at_c v0.4.1 for the atauth/onboarding
Signed-off-by: Chris Swan <chris@atsign.com>
Update from 5.06.909 to 5.09.982.
Major improvements and highlights:
- Add frp transport.wireProtocol v2 support (JSON messages + AES-256-GCM AEAD)
- Support modern frp TOML configuration via tomlc17
- Support OIDC authentication with OAuth2 client_credentials flow
- AES-128-CFB wire encryption and Snappy compression support
- QUIC transport maturity with ngtcp2 <-> quic-go interop
- End-to-end security hardening (bounds check, TLS verification, buffer drains)
- Build fix for 32-bit architectures (widen plen to uint64_t before shift)
- Build fix for OpenWrt wolfSSL/OpenSSL dual-backend compatibility
- Remove deprecated IOD and FTP proxy types
Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>
-the trigger calls start refresh, start_service() skips the run
while adblock_status in the runtime file is anything but error
- a missing or unreadable runtime file still starts a run,
which covers the boot case, and a failed run is retried on the next interface event
- manual start, boot, restart and reload are unaffected;
a suspended or stopped adblock is no longer restarted by an interface event
- wan6 in adb_trigger is supported now
- updatted the README and moved to the package root
- LuCI: reworked the feed editor, get rid of custom css
Signed-off-by: Dirk Brenken <dev@brenken.org>
This commit updates the dnsdist package from 2.0.6 to 2.0.9,
fixing several issues including CVE-2026-42005, CVE-2026-40011,
CVE-2026-40211, CVE-2026-40210, CVE-2026-40209, CVE-2026-40208,
CVE-2026-42004 and CVE-2026-52682.
Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
This commit updates the PowerDNS authoritative server to 4.9.17,
the latest release in the 4.9.x LTS branch.
This fixes several security issues, including but not limited to:
CVE-2026-33257, CVE-2026-33260, CVE-2026-33611, CVE-2026-33610,
CVE-2026-33609, CVE-2026-33608, CVE-2026-42002, CVE-2026-42001,
CVE-2026-42000, CVE-2026-41999, CVE-2026-42396, CVE-2026-42005,
CVE-2026-52682.
Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
UCI front-end that installs raw "tc filter ... ingress" expressions on
network devices at boot and re-applies them on ifup, removing them on
stop. The match/action part is entered verbatim as tc syntax; the
package manages the device, the preference number, enable/disable and
persistence. A procd reload trigger re-applies on config changes.
Intended for driving hardware tc-flower offload (e.g. the Realtek DSA
PIE offload) where no higher-level configuration layer exists.
Co-authored-by: OpenWrt AI review account <openwrt-ai@hauke-m.de>
Assisted-by: Claude Code (Anthropic Claude Sonnet 5)
Signed-off-by: Mark Abe <github@mab.wien>
- f_getup() collects the wan state in one pass and diffs the uplink against
the local allowlist
- new f_refresh() patches only the changed allowlist Set elements
in a single atomic nft transaction, without touching the running instance
- the procd trigger calls start refresh, start_service() picks the path, a manual start is unaffected
- wan6 in ban_trigger is supported now
- updatted the README and moved to the package root
- LuCI: reworked the feed editor, get rid of custom css
Signed-off-by: Dirk Brenken dev@brenken.org
Signed-off-by: Dirk Brenken <dev@brenken.org>
Backport two patches from upstream implementing devlink-based firmware
update support for the MaxLinear MxL862xx DSA switch family, found eg.
on the BananaPi R4 Pro (8E/4E).
Users can update the switch firmware using `fwupdmgr update`.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Refresh PKG_HASH from the tag tarball. Upstream moved from
keplerproject to lunarmodules and the 2.7.0 tag has no leading v;
point PKG_SOURCE_URL and the homepage URL at lunarmodules.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
- *Per-policy `action`, `route` (default) or `bypass` - the equivalent of pbr's `ignore`,
an exception carved out of every policy below it.
- `keep_local`, default on - a marked packet to one of your own subnets
stays on `main` instead of taking the policy's default route.
- The ruleset is re-applied when the table is deleted - e.g. with `/etc/init.d/firewall stop`
- README update
Signed-off-by: Dirk Brenken <dev@brenken.org>
Co-authored-by: Claude <noreply@anthropic.com>
Signed-off-by: Dirk Brenken <dev@brenken.org>
- do not set trm_action in the function library; the library is sourced by the init script,
reported by @sch-m
- fixed the uplink ssid comparison for fancy essids with quotes
- added a new optional per uplink revive option; an uplink disabled by the retry limit is set back
to enabled after n run cycles, default off, minimum 10, number of revivals capped by trm_maxretry.
Counters live in a runtime file, no extra config writes
- update the wifibahn login script, support the new CNA portal API
- LuCI: rework the wireless scan dialog; card list instead of the result table, mobile friendly
- LuCI: add the per uplink revive option to the uplink dialog (off / 10 / 30 / 60 run cycles)
- readme update
Signed-off-by: Dirk Brenken <dev@brenken.org>
Enable Kerberos authentication support in curl by including krb5-libs.
This allows curl to handle GSSAPI/Kerberos authentication protocols,
enhancing compatibility with enterprise environments.
The feature is disabled by default to avoid unnecessary dependencies.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Make the timeout for command execution configurable, as not all modems and
mobile networks behave in the same way.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Remove the trailing '...' from the log messages to bring them into line
with the other log messages in this file.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
To handle ip address changing by ifupdate.
When the ipv6 address is updated for an interface
(some ISP only give dynamic ipv6 address).
The ddns script will go into dead loop,
as the new ipv6 address is not used.
The simple change is restarting ddns when ip address is changed.
Signed-off-by: Jimmy Qin <sunnyqeen@gmail.com>
Increment PKG_RELEASE to force a package rebuild following recent changes,
ensuring package indexes and builds reflect the update.
Signed-off-by: Christian Korber <ckorber@tdt.de>
We need `ucode-mod-rtnl` as a dependency, because it is used in ufp.
This was forgotten in previous commits.
Signed-off-by: Christian Korber <ckorber@tdt.de>
Move each package dependency onto its own line.
This makes future dependency additions, removals,
and code reviews much easier to track in diffs.
It also keeps the dependency line under 80 characters.
Signed-off-by: Christian Korber <ckorber@tdt.de>
Highlights of this release:
- eBPF captive DNS fast-answer: LAN DNS queries for captive detection
domains are answered at wire speed from a pinned BPF map (default
1.1.1.1) while the query still reaches dnsmasq, so captive portal
detection works when the router is offline
- Real IPs are learned back into the map from snooped upstream DNS
responses; the dnsmasq aw-captive-domains-hosts mechanism and its
restart dance are removed (one-time migration at startup)
- Always start HTTP/HTTPS service threads (fix dangling gencb arg);
sync trusted MACs into eBPF mac_map; portal DNS consumer
auto-reconnects when aw-bpf reloads
Maintainer: me
Compile tested: aarch64_cortex-a53 (chawrt 25.12 / OpenWrt snapshot)
Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>
Handling uci-defaults scripts in package postinst is not needed in
modern OpenWrt and in fact results in error messages on install since
the common postinst processes and deletes uci-defaults scripts before
package-specific postinsts are executed.
Therefore remove the unneeded postinsts in this package.
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
Update c-ares from 1.34.6 to 1.34.8.
Version 1.34.7 includes the following security fixes:
* CVE-2026-33630 (GHSA-6wfj-rwm7-3542): fix a use-after-free /
double-free issue in query-completion handling.
* CVE-2026-69184 (GHSA-pjmc-gx33-gc76): limit DNS name compression
pointer traversal to prevent CPU-exhaustion denial of service.
* CVE-2026-69186 (GHSA-jv8r-gqr9-68wj): validate DNS record counts
before allocation to prevent memory-amplification denial of service.
It also fixes the UDP socket exhaustion regression introduced in 1.34.6.
Version 1.34.8 reverts an unintended API break introduced in 1.34.7 by
the callback parameter const changes.
Signed-off-by: Karen Khachatryan <karen0734@gmail.com>
Support configuring major version series as host-only (i.e. no target
packages) to reduce strain on buildbots in release branches. The goal is to
have one major target series and multiple host-only ones. E.g. 25.12 uses
1.26 as the default host/target series and 1.27 and beyond as host-only for
packages that require these.
Signed-off-by: George Sapkin <george@sapk.in>
Add a common backend for running librespeed-cli measurements on a router.
The package provides a locked measurement runner, live progress state, and
an rpcd ucode plugin exposing start/stop/status/result/history/config over
ubus. Scheduled measurements are managed through cron and can run within a
configurable time window. Optional daily aggregation keeps longer-term
history compact.
Raw measurements are kept in JSONL for a configurable retention period.
When persistent archive storage is configured, completed days are reduced
to daily min/avg/max values.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Daniel F. Dickinson
Sergei S.
Daniel Black
Romain Isnel
Jimmy Qin
Josef Schlehofer
Martin Johansson
Dirk Brenken
Chris Swan
Dengfeng Liu
Remi Gacogne
Mark AbeandOpenWrt AI review account
Daniel Golle
Alexandru Ardelean
Florian Eckert
Christian Korber
Karen Khachatryan
Andy Chiang
George Sapkin
Tianling Shen