Tiago Gaspar has not been active in this repository since May 2026 and
did not respond when Alexandru Ardelean offered to pick the package up
in https://github.com/openwrt/packages/pull/30030. Michel Stam, who
wrote RIPE's own OpenWrt packaging, has not taken part here, and since
5120 that packaging lists the RIPE Atlas Team instead of him. I run a
probe and test the package on Turris OS, so take it over.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
ripe-atlas-probe provides atlas-sw-probe, but carries nothing over, so
an upgraded probe would come up with a new key, which RIPE rejects
until its host enters it on atlas.ripe.net.
Take over the key and the settings of atlas-sw-probe in a uci-defaults
script of ripe-atlas-probe, and stop and disable atlas once the key is
in place. A failed run is retried on the next boot. Until it succeeds,
the init does not start the probe, so the key is never used twice and
no new key is created. Until the key is in place, the init logs that it
waits.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
- Build the tree once, the variants only install different files. Both
provide ripe-atlas, with the probe as the default variant, so that
apk, whose packages carry no CONFLICTS, cannot install both.
- Select busybox tee, cmp and find with the options that the
registration and the init use, and drop jsonfilter and the busybox ps,
killall, tar, ntpd and bunzip2 selects, which nothing installed uses.
- Do not keep /etc/ripe-atlas/mode, the init rewrites it on every start.
- List all licenses: the measurement busybox is BusyBox (GPL-2.0-only)
with libevent (BSD-3-Clause and ISC) linked in, and five of the shell
libraries are LGPL-2.1-or-later.
- Link the measurement applets in one loop.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Restart the probe when /etc/config/ripe-atlas changes. procd does not
restart an instance when any of these options changes, and up to OpenWrt
25.12, when it stops one, it signals only the main script, so the
measurement daemons, the ssh tunnel and telnetd would keep running. Stop
and start the whole service instead.
On stop, take the processes from the instance's cgroup, which holds
exactly those of the probe, and fall back to the ripe-atlas group only
when it holds none.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
procd hands capabilities to a service only through ujail, which is
optional. Without it the probe ran as ripe-atlas without CAP_NET_RAW,
and its ping and traceroute measurements failed.
Use ujail when it and the ripe-atlas user exist, and run the probe as
root otherwise, as atlas-sw-probe did, with a warning in the log. Keep
only CAP_NET_RAW, the probe never changes its user.
Fixes: b77264c922 ("ripe-atlas: add new package")
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
The probe runs as ripe-atlas, but /etc/ripe-atlas is root's, so the
probe could neither create its key nor copy the registration servers
there, and it never registered. Let the init, which runs as root,
prepare both, as generic-ATLAS.sh would, and keep the directory root's,
so that the probe cannot swap in links for what root writes or chowns
there.
While at it:
- validate the booleans as bool, yes/on/true made the probe refuse to
start;
- create the key also over an empty file, which ssh-keygen would not
overwrite without asking;
- set up the spool directories, which the probe user owns, only until
that worked once since boot, remove links put in their place, and
refuse a /var/spool/ripe-atlas that root does not own, so that root's
chown and chmod cannot be redirected;
- create its files and directories with umask 022, so that a caller's
umask can neither hide them from the probe nor open them to others;
- wait for ripe-atlas-probe or -anchor, which apk installs only after
ripe-atlas-common started the service, and restart the service from
their post-install;
- install measurement.conf readable for the probe.
Fixes: b77264c922 ("ripe-atlas: add new package")
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
The kernel marks routes using no-carrier devices as dead linkdown. mwan3
strips linkdown but passes dead to ip route, which rejects the copied route
and leaves policy tables incomplete.
Strip both flags, including at end of line, and add a runtime test.
Signed-off-by: Gleb Pesin <dormancygrace@gmail.com>
Commit 246506690f ("modemmanager: always reset the init_eps if not
configured") changed the behaviour for an unset 'init_epsbearer' from
leaving the modem untouched to clearing the initial EPS bearer on every
setup. This is a regression for users upgrading from 24.10:
- Modems without support for setting the LTE attach configuration (e.g.
Sierra Wireless EM7430) fail the setup with
MM_INIT_EPS_BEARER_SET_FAILED and never come up.
- Attach settings preloaded by the carrier firmware are wiped.
The same commit also removed the explicit 'none' case, so 'none' now
silently skips the initial EPS bearer setup, while it cleared it in
24.10. Neither matches the documentation.
Make all modes explicit, each naming where the initial EPS bearer
settings come from:
- modem: leave the settings stored on the modem unchanged (default)
- network: set an empty initial EPS bearer, the network assigns the
APN; replaces the implicit clear, e.g. after a SIM swap
- connection: use the connection options (apn, iptype, ...)
- custom: use the init_* options
'none' and 'default' are kept as deprecated aliases for 'modem' and
'connection'. 'none' maps to 'modem' as documented in the README and as
it behaves since 246506690f, although an explicit 'none' cleared the
initial EPS bearer in 24.10; use 'network' for that. Unknown values fall
back to 'modem'. The README now documents the modes and how to clear
stale settings manually.
Fixes: https://github.com/openwrt/packages/issues/30299
Signed-off-by: Michael Pfeifroth <micpf@westermo.com>
Commit 3fe92e63f5 moved the default Lua 5.4 module search paths
from /usr/local to /usr. luaossl still staged and packaged its Lua 5.4
modules under /usr/local/lib/lua/5.4, outside the default search paths.
Set lua54path and lua54cpath to /usr/lib/lua/5.4 and update the package
install rules to match. Bump PKG_RELEASE to 3 so the corrected package
is offered as an upgrade. Keep Lua 5.1 and Lua 5.3 paths unchanged.
Fixes: 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of /usr/local")
Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
Commit 3fe92e63f5 moved the default Lua 5.4 module search paths
from /usr/local to /usr. cqueues still staged and packaged its Lua 5.4
modules under /usr/local/lib/lua/5.4, outside the default search paths.
Set lua54path and lua54cpath to /usr/lib/lua/5.4 and update the package
install rules to match. Bump PKG_RELEASE to 3 so the corrected package
is offered as an upgrade. Keep Lua 5.1 and Lua 5.3 paths unchanged.
Fixes: 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of /usr/local")
Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
Commit 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of
/usr/local") changed LUA_ROOT to /usr/, moving the default Lua 5.4
module search paths out of /usr/local. The Lua 5.4 variant of lua-ffi
still installed ffi.so under /usr/local/lib/lua/5.4, so require("ffi")
could no longer find it with the default search paths.
Install ffi.so under /usr/lib/lua/5.4 to match the new default search
path. Bump PKG_RELEASE to 2 so the corrected package is offered as an
upgrade. Keep the Lua 5.1 and Lua 5.3 installation paths unchanged.
Fixes: 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of /usr/local")
Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
Commit 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of
/usr/local") changed LUA_ROOT to /usr/, moving the default Lua 5.4
module search paths out of /usr/local. The Lua 5.4 variant of lua-cjson
still installed cjson.so under /usr/local/lib/lua/5.4, so require("cjson")
could no longer find it with the default search paths.
Install cjson.so under /usr/lib/lua/5.4 to match the new default search
path. Bump PKG_RELEASE to 6 so the corrected package is offered as an
upgrade. Keep the Lua 5.1 and Lua 5.3 installation paths unchanged.
Fixes: 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of /usr/local")
Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
Commit 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of
/usr/local") changed LUA_ROOT to /usr/, moving the default Lua 5.4
module search paths out of /usr/local. lua-eco still installed its Lua
and native modules under /usr/local/lib/lua/5.4, so require() could no
longer find them with the default search paths.
Install modules from the main package and all subpackages under
/usr/lib/lua/5.4, which is searched for both .lua and .so files.
Define LUA_INSTALL_DIR once and use it throughout the install rules so
future directory changes only need one update. Bump PKG_RELEASE to 2
so the corrected packages are offered as upgrades.
Fixes: 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of /usr/local")
Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
--enable-small builds only the resumable mode of the LZMA decoder and a
single-table CRC32/CRC64 without the architecture-specific CRC code.
Keep it for SMALL_FLASH targets and build the fast variants elsewhere.
xz -dc -T1 of a 32 MiB file (3.3 MiB .xz), median of 5: 966 -> 880 ms
on Cortex-A53, 813 -> 634 ms on Cortex-A72 in AArch32. liblzma grows by
11.5 KiB (aarch64) to 19.6 KiB (mips_24kc), compressed with xz.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Refresh sha256 from the PyPI sdist.
26.4.0 drops OpenSSL.crypto.X509Req and dump_certificate_request, so
test.sh can no longer import them; remove them and the CSR block. CSR
handling now lives in cryptography.x509, which is not this package.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Building python3-libtorrent with CMake 4 and Python 3.14 fails in
several places, which the distutils error of 2.0.11 used to hide:
- On 32-bit targets FindPython rejects the 64-bit host interpreter.
Pass the host python of OpenWrt as Python3_EXECUTABLE, which skips
that check and keeps CMake on the python that gets setuptools.
- The egg_info step needs setuptools, which the host python no longer
bundles since Python 3.12. Depend on python-setuptools/host when
python3-libtorrent is selected.
- CMake names the module after the SOABI of the host interpreter, for
example libtorrent.cpython-314-x86_64-linux-gnu.so, which the target
python does not load. Rename it to libtorrent.so after installing.
- The wheel from Py3Build/Compile only held the example scripts as
top-level modules and a second dist-info. The module always came
from the CMake install, so drop the wheel steps.
- The module imports datetime when it loads, which python3-base does
not ship. Depend on python3-light.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Check that the python bindings can be imported on the target and that
they report the package version.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Since 2.0.12 the python bindings read the install paths from sysconfig
instead of distutils, which Python 3.12 removed. With 2.0.11 CMake
fails to configure the python bindings, so neither libtorrent-rasterbar
nor python3-libtorrent builds.
Release notes:
https://github.com/arvidn/libtorrent/blob/v2.0.15/ChangeLog
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Solves issues with stats etc. not updating properly and reduces the
amount of leftover temporary files. Access to settings.json is kept
read-only to keep it in sync with UCI.
Signed-off-by: Ludvig Liu Holtze <ldw.liu.holtze@proton.me>
1.30.4:
- Heap buffer overflow with the map directive and regex matching
(CVE-2026-42533).
- Uninitialized memory access with unnamed regex captures and the slice
directive or background cache update (CVE-2026-60005).
- Use-after-free in ngx_http_ssi_filter_module with a crafted proxied
backend response (CVE-2026-56434).
1.30.5:
- Heap buffer overflow with HTTP/3 and OpenSSL 3.5.0 and earlier
(CVE-2026-90439).
All patches apply without changes.
Changelog: https://nginx.org/en/CHANGES-1.30
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Refresh PKG_HASH from the upstream GitHub release tarball.
Drop 010-CVE-2022-40320.patch. Upstream commit d73777c2c356, which the
patch carried, is part of 3.4: cfg_tilde_expand() now terminates the
username before handing it to getpwnam(). Keeping the patch would fail
to apply.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update to latest upstream release.
Removed upstreamed patch.
Security fixes:
- CVE-2026-101283: remote use-after-free in iperf_server_api.c
- CVE-2026-101276: heap buffer overflow in iperf_auth.c
- CVE-2026-102253: denial of service via infinite loop
- CVE-2026-71217: issue with test parameters
Changelog: https://github.com/esnet/iperf/releases/tag/3.22
Signed-off-by: John Audia <therealgraysky@proton.me>
4.5.0 uses three interfaces FFmpeg 7 removed; upstream guards them since
4.6. Drop 010-no-po-man.patch and switch PKG_FIXUP to gettext-version,
which runs autopoint and so supplies the po/Makefile.in.in the patch was
working around. Drop --without-mmal, which 4.7.1 no longer has.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Adds ionos.com as predefined DDNS service. IONOS' dynamic DNS API
only supports domains hosted at IONOS and uses a single fixed
update URL with a generated token as password. Both ipv4 and ipv6
updates use the same endpoint, distinguished by explicitly passing
the detected address via the ipv4= or ipv6= query parameter as
documented by IONOS. Verified working separately for both A and
AAAA record updates against a live domain.
Signed-off-by: Lasse Hanschen <lh@databloat.ch>
Maintainer: Rob White rob@blue-wave.net
Compile tested: All
Run tested: OpenWrt 25.12 and master/snapshot.
Description: mesh11sd (7.3.0)
This version adds pinning of the mesh gateway ARP to the active portal for the peer,
thereby providing reliable ipv4 on multi-portal backhauls.
Additional detected, but non selected portals, cannot retarget the peer or its clients.
The patches of the previous version in this feed are no longer needed so have been removed.
The full changelog can be seen here:
https://github.com/openNDS/mesh11sd/blob/7.3.0/ChangeLog
Signed-off-by: Rob White <rob@blue-wave.net>
- Add interface trigger handling in watchcat.init
- Log when raw interface trigger is activated by any interface coming up
- Move helper functions to separate file
- Update Makefile to install new functions file
Closes: #30463
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
We use shellcheck even though it is pedantic to assist in reducing
errors. Therefore, we add shellcheck directives to silence false
positives. We keep changes minimal as some shellcheck suggestions
result in watchcat failing to function properly.
Also make formatting shmt clean (using -ln=bash due to ash constructs
that shfmt 3.8.0 does not accept for posix shells including busybox).
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
FFmpeg 7 removed AVCodecParameters.channels, causing MiniDLNA 1.3.3
to fail to compile when reading audio channel counts.
Add an OpenWrt package patch to use ch_layout.nb_channels with
libavcodec 61 and later. Retain the existing channels field access
for older versions.
Signed-off-by: Marcin Maj <marcinmajsc@gmail.com>
libwrap is auto-detected from the sysroot and is not in DEPENDS. When
found, the link fails: ocserv assigns to allow_severity and
deny_severity without defining them. Fails on all 35 targets.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Upstream enables wolfSSL whenever it finds it in the sysroot, leaving
libwolfssl.so undeclared and packaging broken on all 35 targets. OpenSSL
is already pulled in via libevent2-openssl and upstream supports it, so
build against that alone.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
- Multiple security fixes for heap buffer overflows, out-of-bounds
writes, and integer overflows. No CVE mentioned.
- Enforces ISO C11 standard.
- Added new Arm Neon (DotProd) and x86 (AVX2/AVX512) paths.
- It is ABI compatible with 1.16.0.
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
Add Alviy DDNS provider (dyndns2 API), IPv4.
Howto:
set [USERNAME] to the Alviy account e-mail
set [PASSWORD] to the host DDNS token
set [DOMAIN] to the hostname
https://www.alviy.com/en/docs/update-api
Signed-off-by: Elly Sai <alviy.dns@gmail.com>
The swanctl.conf child options are called local_ts and remote_ts
(traffic selectors), but the UCI config used local_subnet and
remote_subnet for them. Rename the UCI options in the swanctl init
script to match the swanctl.conf naming, so the config maps 1:1 to
what strongSwan actually expects.
Since this changes the UCI option names, existing configurations
would silently lose their traffic selectors after an upgrade. Add
migrate_child_subnet_to_ts() to the ipsec-to-swanctl migration
script. For each child section it moves the values of local_subnet
and remote_subnet into the local_ts and remote_ts lists and removes
the old options.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The local and remote authentication configuration was stored as flat
options on the connection section. This cannot represent IKEv2 multiple
authentication rounds, where more than one local/remote pair is needed.
Move the options into dedicated 'local' and 'remote' uci sections which
are referenced from the connection via the 'list local' and 'list
remote' options. Multiple sections per connection are now possible and
each pair is emitted as one authentication round.
The generated swanctl.conf names the rounds positionally: the first
local/remote section is emitted as 'local'/'remote', the following ones
as 'local2'/'remote2' and so on.
The 'authentication_method' option moves to the new sections as 'auth'.
The local side of an EAP connection still defaults to pubkey.
The migration script converts an existing connection into one local and
one remote section:
- 'local_identifier' -> local 'id'
- 'local_cert' -> local 'certs'
- 'local_key' -> local 'key'
- 'remote_identifier' -> remote 'id'
- 'remote_ca_certs' -> remote 'cacerts' (list)
- 'eap_id' -> remote 'eap_id'
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Remove the per-connection 'authorities' and 'secrets' blocks generated
inline in config_connection. Pre-shared keys and CA certificates are
now provided via the global 'secret' and 'authority' uci sections, which
prepare_env renders into their own swanctl.conf entries.
The migrate script converts the old per-connection settings into these
new global sections:
- psk connections: 'pre_shared_key' is moved into a 'secret' section
with type='ike', keeping the local/remote identifiers as an 'id' list
- pubkey connections: 'ca_cert' is moved into an 'authority' section
with the matching 'cacert' option
Both options are removed from the connection section afterwards.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Add a generic uci 'secret' section type to swanctl handling, replacing
the dedicated 'mschapv2_secrets' section in prepare_env. The secret kind
is selected via a new 'type' uci option and maps to the matching swanctl
secrets subsection (the section prefix equals the type value):
- eap, xauth, ntlm, ike, ppk: <type>-<name> { id ...; secret }
- private, rsa, ecdsa, pkcs8, pkcs12: <type>-<name> { file ...; secret }
- token: token-<name> { handle, slot, module, pin }
The 'id' option is a uci list element for the eap/xauth/ntlm/ike/ppk
types and emits one 'id' line per entry, matching swanctl's support for
multiple identities per secret.
The legacy path stays unchanged and keeps generating EAP secrets from
the 'mschapv2_secrets' section via legacy_config_mschapv2_secret.
The migrate script now converts 'mschapv2_secrets' sections into
generic 'secret' sections setting type='eap' and turning 'id' into a
list element.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Add support for the new 'authority' uci section type, which generates
global 'authorities/*' entries in the swanctl.conf file.
Each section is translated into one '<name>' authority block using the
following options:
- 'cacert' defines the CA certificate
- 'cert_uri_base' defines the base URI used by the hash and URL
features
- 'list crl_uri' defines one or more CRL distribution points, emitted
as 'crl_uris'
- 'list ocsp_uri' defines one or more OCSP responder URIs, emitted as
'ocsp_uris'
Example uci config:
config authority 'ca'
option cacert 'ca.pem'
list crl_uri 'http://crlca.example/ca.crl'
generates:
authorities {
ca {
cacert = ca.pem
crl_uris = http://crlca.example/ca.crl
}
}
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The 'remote' section type in '/etc/config/ipsec' is a misnomer, since
it defines the whole IPsec connection (IKE peer and children), not just
the remote end. Rename it to 'connection' to align with the swanctl
'connections' terminology.
Rename config_remote() to config_connection() and iterate the
'connection' type in swanctl.init.
Add a migrate_remote_to_connection migration step that renames existing
'remote' sections to 'connection'.
Signed-off-by: Florian Eckert <fe@dev.tdt.de
Let the caller pass an optional session ID as the first argument to
main(). If one is given, the migration is performed inside a LuCI
transaction session: the resulting /tmp/.uci/ipsec delta is moved to
/tmp/run/rpcd/uci-${session} at the end instead of being applied to the
running config directly. This allows LuCI to preview and apply the
ipsec-to-swanctl migration through its normal session workflow, rather
than forcing an immediate, uncoordinated commit of /etc/config/ipsec.
Drop the 'uci commit ipsec' calls scattered through the individual
migration functions, since committing is now the caller's
responsibility. Also add -q to the uci calls that were missing it, so
errors are suppressed consistently.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Until the user runs the migration, the legacy '/etc/config/ipsec'
configuration must keep working. Restore support for the old uci format
in the swanctl init script by adding a parallel legacy rendering path.
The 'legacy_config_*' helpers translate the legacy sections into
swanctl.conf syntax: 'ipsec' and 'remote' sections, including the
existing start/close/dpd action and lifetime translations, plus the
global 'pools' and 'mschapv2_secrets' blocks.
As long as the uci section type 'ipsec.@ipsec[0]' exists, prepare_env() and
service_triggers() use the legacy generation path and keep reloading on
'ipsec' changes.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Now that the ipsec-to-swanctl migration is no longer executed
automatically on boot, expose it through the init script so it can be
invoked on demand via '/etc/init.d/swanctl migrate'.
Also harden the migration script: abort with an error if
'/etc/config/ipsec' does not exist. Keep a copy of the original
configuration in '/etc/config/ipsec_bak' before starting.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The migration of the legacy '/etc/config/ipsec' UCI configuration to
the new '/etc/config/swanctl' format cannot be performed fully
automatically: it rewrites the user's configuration and must be
triggered and acknowledged by the user.
Remove the automatic migration hook that was installed as an
uci-defaults script (executed once on first boot or installation) and
instead ship the migration utility as a regular binary at
'/usr/libexec/strongswan/migrate-ipsec-to-swanctl'. From now on the
migration is only run on demand.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Previously a service reload only reloaded the IPsec connection
definitions from '/var/swanctl/swanctl.conf', leaving changes to
'/var/ipsec/strongswan.conf' to require a full restart.
Extend the reload action to also pick up changes to strongswan.conf
for a running service by executing 'swanctl --reload-settings' on
reload as well.
Note that 'swanctl --reload-settings' reloads '/var/ipsec/strongswan.conf'
at runtime, but not all settings (esp. plugin load directives, kernel/socket
options) are picked up by charon. A full daemon restart is still required
for such changes to apply. A note about this was added as well at this
point.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Strongswan can optionally install routes via XFRM interfaces if the
'charon.plugins.kernel-netlink.install_routes_xfrmi' option is enabled.
This change makes this configurable via uci.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Add a new uci 'shunt' section type for pass/drop policies, independent
of regular connections, since shunts have no peer, authentication or
proposals. Each section renders into its own 'connections{}' entry in
swanctl.conf.
Supports 'mode' (pass/drop), 'local_ts' and 'remote_ts' (lists),
'priority' and 'interface'. Sections with 'enabled' unset are skipped.
Signed-off-by: Florian Eckert <fe@dev.tdt.de
Josef Schlehofer
Gleb Pesin
Michael Pfeifroth
Jianhui Zhao
Julius Bairaktaris
Alexandru Ardelean
Ludvig Liu Holtze
John Audia
Lasse Hanschen
Christian Lachner
Rob White
Daniel F. Dickinson
Marcin Maj
Luiz Angelo Daros de Luca
Elly Sai
Florian Eckert