The local variables were completely jumbled. To keep track of them, they
have been sorted in the order in which the following 'config_get' calls
are made.
No functional change.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The local variables were completely jumbled. To keep track of them, they
have been sorted to the order in which the following 'config_get' calls
are made.
No functional change.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* add new 'adb_repfilter' option to pass an additional, user
defined tcpdump filter expression which is logically ANDed
to the internal port filter. This allows to exclude redundant
traffic upfront, e.g. DNS requests originating from the router
itself which are routed via a VPN client interface and which
are picked up again when 'adb_repiface' is set to 'any';
see the readme for details/examples.
Signed-off-by: Dirk Brenken <dev@brenken.org>
Each output flush runs in a coroutine whose stack was forced to 4096 (one
page). The HTTP output plugin overflows it and crashes with SIGSEGV after
the flush (issue #30113). Pin FLB_CORO_STACK_SIZE to upstream's own 64K
floor (FLB_CORO_STACK_SIZE_MIN_BYTE), which the musl-shrunk default undercuts.
Also add a regression test: drive the dummy input into the http output and
assert fluent-bit survives a few flush cycles instead of dying from a signal
(no listener needed -- the overflow happens while composing the request).
Fixes: https://github.com/openwrt/packages/issues/30113
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update to the latest upstream stable release.
Also expand test.sh beyond the single loose configtest grep: assert the
daemon binary, init script and default config are installed, that
--configtest exits cleanly on the shipped config, and that it rejects an
explicitly-passed missing config file (so the positive check is real).
The daemon is never started, which would hang under QEMU emulation.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update to the latest upstream stable release.
Replace the version-only test.sh with checks that exercise the installed
binaries. smbinfo ships as a /usr/bin/python3 script, so add +python3-light
or it cannot exec; it also has no version flag, so add test-version.sh to
override the generic per-executable version probe (skipping smbinfo).
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update dnscrypt-proxy2 to version 2.1.18.
Fix the blocked_names_file substitution. The previous expression did not
match the upstream example configuration, leaving the bundled blocklist
disabled. This enables blocked-names.txt on fresh installations.
Declare blocked-names.txt as a configuration file so that
local changes are preserved during package upgrades.
Signed-off-by: Paul Lipps <paul.lipps@tb.pro>
* Add config file patch for proxy
* Add initscript for proxy
* Update Makefile and support files to bring proxy to parity with
agentd and server.
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
* Genericize zabbix_server initscript.
* Add shellcheck overrides where needed.
* Add a 'never_root' config option (default true) that determines
whether server starts as an unprivileged user or starts as root and
drops to an unprivileged user (unless config is changed so it always
runs as root).
* Bring zabbix_agentd initscript to parity with zabbix_server for the
initscript and configuration.
* Tweak Makefile to reduce repetition
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
Tweak the agentd and server patch configurations and bring agentd and
server confgurations to parity.
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
This is the upstream recommendation, and fits with our separation
of agent and server.
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
The previous test only grepped prosody.version and ran `prosodyctl
about`, which still passes when the parts that actually differ per
target architecture are broken.
Drive the rest of the package instead:
- Assert `prosodyctl about` reports Lua 5.4. The wrapper silently falls
back to /usr/bin/lua (5.1 on OpenWrt) if --runwith is lost, and
prosody 13 refuses to run on it.
- Require loader.lua to be installed, since prosody(ctl) cannot resolve
any of its 'prosody.*' requires without it.
- Register and unregister an account on the sample VirtualHost. That is
the only path exercising util.datamanager storage together with the
internal_hashed SCRAM derivation, and it must not leave the cleartext
password on disk.
- Load each of the 13 compiled util/*.so extensions through their
luaopen_prosody_util_* entry points.
- Check known-answer vectors through util.hashes and an Ed25519
sign/verify round trip through util.crypto (both linked against
libopenssl), IDNA plus stringprep through util.encodings (libidn),
and XML parsing through util.xml (luaexpat).
- Require lfs, socket and ssl, so a missing luafilesystem5.4 /
luasocket5.4 / luasec5.4 runtime dependency fails here rather than on
a user's router.
The XMPP daemon is still never started: it would block forever under
QEMU emulation.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
0.12.x is EOL upstream and accumulating CVEs. Bump to the current
stable 13.0.6, which carries the fix from security advisory
2026-04-29 / prosody.im/security/advisory_735dd9d3 that first shipped
in 13.0.5.
Prosody 13 requires Lua >= 5.2 (configure rejects 5.1). Switch the
build and runtime to Lua 5.4 and depend on the new
luafilesystem5.4 / luaexpat5.4 / luasec5.4 / luasocket5.4 variants.
Drop the now-unused luabitop dependency: bit operations are built in
since Lua 5.3.
Other notes:
- configure now needs an explicit --lua-version=5.4 and --runwith=lua5.4
because the wrapper script defaults to '/usr/bin/lua' (5.1 on OpenWrt).
- Install the new mod_debug_stanzas plugin directory. The commented-out
fallbacks/*.lua install is dropped rather than revived: upstream's
'make install' never copies that directory, and fallbacks/lxp.lua is
Lua 5.1 code using module(), which does not even load on 5.4.
- util-src/hashes.c now calls EVP_blake2{s256,b512}(), which libopenssl
does not provide unless OPENSSL_WITH_BLAKE2 is set, so compile those
two hashes out when libcrypto lacks them. Selecting the symbol instead
is not enough: the resulting util/hashes.so still fails to relocate
against a stock libcrypto, and prosody aborts at startup. Only the
COMPAT util.hmac table references them, and it tolerates nil entries.
- Install loader.lua. 13.x moved every internal require() to the
'prosody.*' namespace, and loader.lua is what maps those names back
onto the installed layout. It is the first file prosodyctl looks for,
so both prosody and prosodyctl abort at startup without it.
Refs: https://github.com/openwrt/packages/issues/29252
Release notes: https://blog.prosody.im/prosody-13.0.6-released/
Security: https://prosody.im/security/advisory_735dd9d3/
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Add luasocket5.4 next to the existing luasocket (Lua 5.1) and
luasocket5.3 variants, installed via the upstream makefile's
'make install LUAV=5.4'.
That makefile defaults to prefix=/usr/local on linux, which is where
the luasocket5.3 variant still installs, so pass prefix=/usr explicitly
to land in /usr/share/lua/5.4 and /usr/lib/lua/5.4 like the other Lua
5.4 module packages.
Needed for the prosody 13.x upgrade.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Add luaexpat5.4, parallel to existing luaexpat (Lua 5.1, default).
Builds against the Lua 5.4 headers under /usr/include/lua5.4 and
installs to /usr/lib/lua/5.4/. Same pattern as the luasocket 5.3
variant already shipped.
Needed for the prosody 13.x upgrade.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Lua 5.1 is EOL and many downstream packages need 5.2+. Mirror the
luasocket multi-variant pattern: keep luafilesystem (Lua 5.1, default)
and add luafilesystem5.4 which builds the same source against
liblua5.4 and installs to /usr/lib/lua/5.4/.
Needed for the prosody 13.x upgrade (Lua 5.1 unsupported upstream).
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
luaconf.h hardcodes LUA_ROOT to "/usr/local/", and nothing in this
package overrides it for the target build, so the interpreter only ever
searches /usr/local/{share,lib}/lua/5.4. Nothing installs there on
OpenWrt, which leaves every Lua 5.4 module package unreachable:
# lua5.4 -e 'require "lfs"'
lua5.4: module 'lfs' not found:
no file '/usr/local/share/lua/5.4/lfs.lua'
no file '/usr/local/lib/lua/5.4/lfs.so'
[...]
# find / -name lfs.so
/usr/lib/lua/5.4/lfs.so
Point LUA_ROOT at /usr. LUA_LDIR and LUA_CDIR are derived from it and
keep the version suffix, so the search paths become /usr/share/lua/5.4
and /usr/lib/lua/5.4 - exactly where the Lua 5.4 module packages
install. The core lua (5.1) package carries an equivalent patch.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
From upstream: 1.25.2 consolidates security fixes for issues reported over
a period of time. There are fixes for CVE-2026-14586, CVE-2026-32665,
CVE-2026-40691, CVE-2026-41637, CVE-2026-42955, CVE-2026-44621,
CVE-2026-44687, CVE-2026-44690, CVE-2026-46582, CVE-2026-50045,
CVE-2026-50046, CVE-2026-50243, CVE-2026-50248, CVE-2026-50251,
CVE-2026-50252, CVE-2026-52863, CVE-2026-54478, CVE-2026-55708,
CVE-2026-55717, CVE-2026-55973, CVE-2026-55990, CVE-2026-55991,
CVE-2026-56416 and CVE-2026-56444.
Full details at
https://github.com/NLnetLabs/unbound/releases/tag/release-1.25.2
Signed-off-by: Tyrel M. McQueen <tmcqueen.materials@gmail.com>
LUA_ECO_CRASH_BACKTRACE declared "depends on PACKAGE_lua-eco" while
lua-eco's DEPENDS carries "+LUA_ECO_CRASH_BACKTRACE:libunwind", which the
generator turns into "select libunwind if LUA_ECO_CRASH_BACKTRACE". kconfig
then sees lua-eco and the symbol depending on each other:
error: recursive dependency detected!
symbol LUA_ECO_CRASH_BACKTRACE depends on PACKAGE_lua-eco
symbol PACKAGE_lua-eco depends on LUA_ECO_CRASH_BACKTRACE
Drop the redundant guard; the option only affects lua-eco's own build, so
nothing is pulled in when lua-eco itself is not selected.
Fixes: https://github.com/openwrt/packages/pull/30098#issuecomment-5113528752
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update to the latest upstream stable release and add a functional
test.sh that pipes a small text stream and a 256 KiB binary stream
through pv, checking both arrive unchanged.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
The date format read from the UCI option ddns.global.ddns_dateformat was
embedded into a command string that is later executed through "eval", both
for the recurring log timestamps
DATE_PROG="date +'$ddns_dateformat'"
...
write_log 5 "PID '$$' started at $(eval $DATE_PROG)"
and for the "last update" timestamp in the updater
EPOCH_TIME="date -d @$EPOCH_TIME +'$ddns_dateformat'"
write_log 7 "last update: $(eval $EPOCH_TIME)"
The value is only wrapped in single quotes, so a single quote inside it
closes that quote and starts a new shell word. A user who can write the ddns
configuration - a delegated DDNS operator who was never granted shell access
- can set
ddns_dateformat="%F'; touch /tmp/pwned; '"
and have arbitrary commands run as root, because the updater runs as root.
The injection triggers on the next start of the updater, so in practice on
the next reconfiguration or reboot.
Stop building shell code from the option. Provide date_prog() as an ordinary
shell function and pass the format as a single quoted argument in both
places, which leaves no way for its content to be interpreted by the shell.
The remaining use of ddns_dateformat in dynamic_dns_updater.sh, for
NEXT_CHECK_TIME, already substituted it as a quoted argument without eval
and was not affected.
luci-app-ddns consumes the same option and is fixed separately in the LuCI
repository.
Reported-by: Matthew Hickey (Hacker Fantastic, https://hacker.house)
Fixes: 1c20dcb71a ("ddns-scripts: update to 2.7.6-1")
Assisted-by: Claude:claude-opus-5
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Refresh "cmake-add-build-with-soxr-option"-patch.
The CI/CD pipeline checks whether patches are byte-identical to what
make package/$(PKG_NAME)/refresh produces.
While the patch applied cleanly, it contained the index-line and a
git-footer, which caused the CI/CD-pipeline's patch-check to bail out
Signed-off-by: Mirko Vogt <mirko-openwrt@nanl.de>
When libapparmor installs headers and libraries for build, libextractor
picks it up and fails with "missing dependencies libapparmor.so.1").
Disable it explicitly via configure.
Fixes: https://github.com/openwrt/packages/pull/30068#issuecomment-5107754731
Fixes: 3253c6c9b ("apparmor: stage libapparmor headers via InstallDev")
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update to the latest upstream stable release.
Also, add backslash for CMake options, so that they get activated.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Florian Eckert
Dirk Brenken
Hirokazu MORIKAWA
Alexandru Ardelean
Lukas Voegl
Paul Lipps
Richard Muzik
Daniel F. Dickinson
Tyrel M. McQueen
Eric Luehrsen
Hauke Mehrtens
Mirko Vogt
Michel Promonet
Wei-Ting Yang
Facundo Acevedo
Ray Wang