The local variables were completely jumbled. To keep track of them, they
have been sorted in the order in which the following 'config_get' calls
are made.
No functional change.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The local variables were completely jumbled. To keep track of them, they
have been sorted to the order in which the following 'config_get' calls
are made.
No functional change.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* add new 'adb_repfilter' option to pass an additional, user
defined tcpdump filter expression which is logically ANDed
to the internal port filter. This allows to exclude redundant
traffic upfront, e.g. DNS requests originating from the router
itself which are routed via a VPN client interface and which
are picked up again when 'adb_repiface' is set to 'any';
see the readme for details/examples.
Signed-off-by: Dirk Brenken <dev@brenken.org>
Update to the latest upstream stable release.
Also expand test.sh beyond the single loose configtest grep: assert the
daemon binary, init script and default config are installed, that
--configtest exits cleanly on the shipped config, and that it rejects an
explicitly-passed missing config file (so the positive check is real).
The daemon is never started, which would hang under QEMU emulation.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update to the latest upstream stable release.
Replace the version-only test.sh with checks that exercise the installed
binaries. smbinfo ships as a /usr/bin/python3 script, so add +python3-light
or it cannot exec; it also has no version flag, so add test-version.sh to
override the generic per-executable version probe (skipping smbinfo).
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update dnscrypt-proxy2 to version 2.1.18.
Fix the blocked_names_file substitution. The previous expression did not
match the upstream example configuration, leaving the bundled blocklist
disabled. This enables blocked-names.txt on fresh installations.
Declare blocked-names.txt as a configuration file so that
local changes are preserved during package upgrades.
Signed-off-by: Paul Lipps <paul.lipps@tb.pro>
The previous test only grepped prosody.version and ran `prosodyctl
about`, which still passes when the parts that actually differ per
target architecture are broken.
Drive the rest of the package instead:
- Assert `prosodyctl about` reports Lua 5.4. The wrapper silently falls
back to /usr/bin/lua (5.1 on OpenWrt) if --runwith is lost, and
prosody 13 refuses to run on it.
- Require loader.lua to be installed, since prosody(ctl) cannot resolve
any of its 'prosody.*' requires without it.
- Register and unregister an account on the sample VirtualHost. That is
the only path exercising util.datamanager storage together with the
internal_hashed SCRAM derivation, and it must not leave the cleartext
password on disk.
- Load each of the 13 compiled util/*.so extensions through their
luaopen_prosody_util_* entry points.
- Check known-answer vectors through util.hashes and an Ed25519
sign/verify round trip through util.crypto (both linked against
libopenssl), IDNA plus stringprep through util.encodings (libidn),
and XML parsing through util.xml (luaexpat).
- Require lfs, socket and ssl, so a missing luafilesystem5.4 /
luasocket5.4 / luasec5.4 runtime dependency fails here rather than on
a user's router.
The XMPP daemon is still never started: it would block forever under
QEMU emulation.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
0.12.x is EOL upstream and accumulating CVEs. Bump to the current
stable 13.0.6, which carries the fix from security advisory
2026-04-29 / prosody.im/security/advisory_735dd9d3 that first shipped
in 13.0.5.
Prosody 13 requires Lua >= 5.2 (configure rejects 5.1). Switch the
build and runtime to Lua 5.4 and depend on the new
luafilesystem5.4 / luaexpat5.4 / luasec5.4 / luasocket5.4 variants.
Drop the now-unused luabitop dependency: bit operations are built in
since Lua 5.3.
Other notes:
- configure now needs an explicit --lua-version=5.4 and --runwith=lua5.4
because the wrapper script defaults to '/usr/bin/lua' (5.1 on OpenWrt).
- Install the new mod_debug_stanzas plugin directory. The commented-out
fallbacks/*.lua install is dropped rather than revived: upstream's
'make install' never copies that directory, and fallbacks/lxp.lua is
Lua 5.1 code using module(), which does not even load on 5.4.
- util-src/hashes.c now calls EVP_blake2{s256,b512}(), which libopenssl
does not provide unless OPENSSL_WITH_BLAKE2 is set, so compile those
two hashes out when libcrypto lacks them. Selecting the symbol instead
is not enough: the resulting util/hashes.so still fails to relocate
against a stock libcrypto, and prosody aborts at startup. Only the
COMPAT util.hmac table references them, and it tolerates nil entries.
- Install loader.lua. 13.x moved every internal require() to the
'prosody.*' namespace, and loader.lua is what maps those names back
onto the installed layout. It is the first file prosodyctl looks for,
so both prosody and prosodyctl abort at startup without it.
Refs: https://github.com/openwrt/packages/issues/29252
Release notes: https://blog.prosody.im/prosody-13.0.6-released/
Security: https://prosody.im/security/advisory_735dd9d3/
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
From upstream: 1.25.2 consolidates security fixes for issues reported over
a period of time. There are fixes for CVE-2026-14586, CVE-2026-32665,
CVE-2026-40691, CVE-2026-41637, CVE-2026-42955, CVE-2026-44621,
CVE-2026-44687, CVE-2026-44690, CVE-2026-46582, CVE-2026-50045,
CVE-2026-50046, CVE-2026-50243, CVE-2026-50248, CVE-2026-50251,
CVE-2026-50252, CVE-2026-52863, CVE-2026-54478, CVE-2026-55708,
CVE-2026-55717, CVE-2026-55973, CVE-2026-55990, CVE-2026-55991,
CVE-2026-56416 and CVE-2026-56444.
Full details at
https://github.com/NLnetLabs/unbound/releases/tag/release-1.25.2
Signed-off-by: Tyrel M. McQueen <tmcqueen.materials@gmail.com>
The date format read from the UCI option ddns.global.ddns_dateformat was
embedded into a command string that is later executed through "eval", both
for the recurring log timestamps
DATE_PROG="date +'$ddns_dateformat'"
...
write_log 5 "PID '$$' started at $(eval $DATE_PROG)"
and for the "last update" timestamp in the updater
EPOCH_TIME="date -d @$EPOCH_TIME +'$ddns_dateformat'"
write_log 7 "last update: $(eval $EPOCH_TIME)"
The value is only wrapped in single quotes, so a single quote inside it
closes that quote and starts a new shell word. A user who can write the ddns
configuration - a delegated DDNS operator who was never granted shell access
- can set
ddns_dateformat="%F'; touch /tmp/pwned; '"
and have arbitrary commands run as root, because the updater runs as root.
The injection triggers on the next start of the updater, so in practice on
the next reconfiguration or reboot.
Stop building shell code from the option. Provide date_prog() as an ordinary
shell function and pass the format as a single quoted argument in both
places, which leaves no way for its content to be interpreted by the shell.
The remaining use of ddns_dateformat in dynamic_dns_updater.sh, for
NEXT_CHECK_TIME, already substituted it as a quoted argument without eval
and was not affected.
luci-app-ddns consumes the same option and is fixed separately in the LuCI
repository.
Reported-by: Matthew Hickey (Hacker Fantastic, https://hacker.house)
Fixes: 1c20dcb71a ("ddns-scripts: update to 2.7.6-1")
Assisted-by: Claude:claude-opus-5
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The 3.2.10 update made freeradius3-common select libopenssl-legacy, which
hard-depends on libopenssl; the generator propagates that onto common's
selectors (freeradius3, freeradius3-utils) as a FREERADIUS3_OPENSSL depends,
looping with the SSL choice. Declare the OpenSSL deps there too to break it.
Fixes: https://github.com/openwrt/packages/pull/30081#issuecomment-5100951400
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
This adds more config options for use in UCI, esp. new configuration
options that were introduced in newer radsecproxy versions and it fixes
an escaping issue in the init script where a string containing single
quotes would still be escaped using single quotes, causing radsecproxy
to reject the config.
This also bumps the PKG_RELEASE in the Makefile
Signed-off-by: Jan-Frederik Rieckers <rieckers@dfn.de>
The map array anchor and the f_fetch call were placed inside the uplink branch, so a WAN
interface without a resolvable address left adb_map.jsn empty. That skipped the blocked domain
lookup as well and dropped the entire map, not just the local marker.
Signed-off-by: Dirk Brenken <dev@brenken.org>
- better extract Uplink addresses
- the map array anchor was written inside the runtime file branch,
so a missing runtime file dropped the entire map instead of just the local marker
Signed-off-by: Dirk Brenken <dev@brenken.org>
- pass the station details to the "rev" call so the uplink section
stays resolved, fixes#30099
- the same empty trm_uplinkcfg also silently skipped disabling the uplink
after trm_maxretry was reached - fixed that too with this oneliner
Signed-off-by: Dirk Brenken <dev@brenken.org>
Fixes several security issues:
- CVE-2026-11331 Fix handling of rpz CNAME expansion that returns name too long.
- CVE-2026-11721 Invalid signed wildcard records were being accepted.
- CVE-2026-13321 Fix DNSSEC validation bypass via out-of-zone NSEC Next Field.
- CVE-2026-10723 Correct verification of NSEC3 signer name.
- CVE-2026-12617 Do no assert for some specifics CNAME and DNAME queries.
- CVE-2026-10822 Malformed DNSKEY records could trigger an assertion.
- CVE-2026-11605 Prevent excessive validation work from crafted negative responses.
- CVE-2026-11622 Prevent cache exhaustion under sustained attack.
Full release notes are available upstream at
https://ftp.isc.org/isc/bind9/9.20.26/doc/arm/html/changelog.html
Signed-off-by: Noah Meyerhans <frodo@morgul.net>
Since this license is not included on the official SPDX License List, it is
referenced in practice as 'NPSL-0.95' or 'NPSL-0.94' but not
'NPSL-0.94-or-NPSL-0.95'.
While we're at it, let's remove the old 'NPSL-0.94', since the source code
uses only 'NPSL-0.95' in the LICENSE file.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The situation here is complicated. The OpenSSH project combines different
licenses. However, the fact is that the name 'BSD' used here for the
license name is not SPDX-compliant.
It is therefore replaced by the valid SPDX licenses BSD-2-Clause and
BSD-3-Clause.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Patches:
- Drop 003-freeradius-fix-error-for-expansion-of-macro.patch (upstream
restructured src/include/threads.h) and add
003-configure-assume-cross-tls.patch instead: the AC_RUN_IFELSE
__thread probe cannot run when cross-compiling, so TLS_STORAGE_CLASS
stays undefined and threads.h hits '#error unsupported' (since 3.2.9).
- Drop 002-disable-session-cache-CVE-2017-9148.patch, 3.2.x is not
affected per https://nvd.nist.gov/vuln/detail/CVE-2017-9148.
- Replace 004-get-hostname-from-proc-in-radtest.patch with
004-radtest-nas-name-from-hostname-env.patch: prefer $HOSTNAME and keep
the upstream `hostname || uname -n` fallback instead of reading
/proc/sys/kernel/hostname unconditionally.
- Re-do 020-fix-freeradius3-krb5.patch, also sent upstream for review.
- Give the touched patches the git format-patch headers 'git am' needs,
with the diff bodies unchanged so they still match 'quilt refresh'.
Depend on libopenssl-legacy when built against OpenSSL: with OpenSSL 3.x
tls_global_init() unconditionally does OSSL_PROVIDER_load(NULL, "legacy")
for MD4/MS-CHAP and errors out when it is missing, so radiusd exits during
startup before it ever serves a request.
Add a test.sh covering the freeradius3, -common, -utils and -democerts
packages: radiusd -XC starts the server for real, the config tree it reads
is checked, the dictionaries the master dictionary still $INCLUDEs must
all be packaged, and the demo certificates must be real PEM.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Add an nftables firewall backend while keeping the existing iptables backend available.
Use nftables on fw4 systems and fall back to iptables otherwise.
Signed-off-by: Dharmik Parmar <dharmikparmar2004@yahoo.com>
NUT (upstream) logging has changed. With the introduction of
NUT_DEBUG_SYSLOG we can set it to "stderr" and have NUT's messages
go to stderr only.
This avoid most duplicate messages when procd sends stderr to syslog.
The reverse (syslog only from NUT) is not a current configuration
option. See the section for NUT_DEBUG_SYSLOG at
https://networkupstools.org/docs/man/nut.conf.html#_directives
This is needed because we use '-FF' so that the daemons remain in the
foreground, which is required for procd to manage them. When using
'-FF' logging behaves differently in NUT than when backgrounded.
Unfortunately, there is still some work to be done upstream to
completely eliminate duplicate messages, so some message continue to
appear twice, though not neccessarily with the same facility.priority.
See also
https://github.com/jimklimov/nut/blob/0c3eed09b89cce1e5c0c65ca03d05b4612371cb8/UPGRADING.adoc#changes-from-282-to-283
and
https://github.com/openwrt/packages/pull/29896#issuecomment-5012737643
Conversely, the log messages the initscripts emit are now configured to
emit only to syslog and not to stderr. This avoids duplicates messages
caused by procd's automatic (not configurable) behaviour of sending
the initscript's stderr to syslog, while preserving the syslogid,
facility and priority we want.
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
Maintainer: me
Compile tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Run tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Description:
Update to PKG_RELEASE 4
- Bump PKG_RELEASE from 2 to 4.
- Add PKG_CPE_ID.
files/lib/adblock-fast/adblock-fast.uc:
- Adjust logic for determining the gzip cache path to align with
the new 'compressed_cache' option.
- Remove dependency on 'compressed_cache_dir' for gzip path
construction.
- Update gzip path calculation in 'get_init_status' to use the new
'compressed_cache' option.
Signed-off-by: Stan Grishin <stangri@melmac.ca>
Maintainer: me
Compile tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Run tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Description:
Update to 2026.05.06 and add IP family option
- Update PKG_VERSION to 2026.05.06
- Update PKG_RELEASE to 1
- Add PKG_CPE_ID for CVE tracking
- Update PKG_MIRROR_HASH and PKG_SOURCE_VERSION
files/etc/config/https-dns-proxy:
- Add comments for default options
- Add new 'force_ip_family' option to control IP family for resolvers
- Update default 'bootstrap_dns' to include IPv6 addresses
files/etc/init.d/https-dns-proxy:
- Add DEFAULT_BOOTSTRAP4 and DEFAULT_BOOTSTRAP6 for family fallbacks
- Change 'global_force_ipv6' to 'global_force_ip_family' for new option
- Modify append_boot to filter bootstrap DNS by 'force_ip_family'
- Implement fallback bootstrap DNS for forced IP families with no
compatible configured servers
- Change 'start_instance' to use 'force_ip_family' instead of
'force_ipv6'
- Ensure 'service_started' and 'service_stopped' always return 0 to
prevent incorrect failure reports for `start`/`reload`/`restart`
commands
files/etc/uci-defaults/50-https-dns-proxy-migrate-options.sh:
- Migrate 'force_ipv6_resolvers' option to 'force_ip_family' option
- Remove old 'force_ipv6_resolvers' option after migration
Signed-off-by: Stan Grishin <stangri@melmac.ca>
Maintainer: me
Compile tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Run tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Description:
Update to version 1.2.2-20
- Bump PKG_RELEASE to 20.
- Add Erik Conijn as a co-maintainer.
files/etc/init.d/pbr:
- Update packageCompat to 27.
- Standardize gateway warning messages.
- Add ubus_get_data helper for improved error/warning handling.
- Preserve JSON namespace in json() for better error handling.
- Refine device retrieval logic for OpenVPN interfaces.
- Improve display of IPv4/IPv6 gateways for consistency.
- Adjust service start trigger to only block on errors, not warnings.
- Ensure 'error' field is populated in ubus status when no gateways
are available.
files/etc/uci-defaults/90-pbr:
- Remove sed rule for '/etc/pbr/' to '/usr/share/pbr/' path
update.
Signed-off-by: Stan Grishin <stangri@melmac.ca>
OpenSSH reports "10.4p1" but PKG_VERSION is "10.4_p1", so the forced generic
probe never matches and fails. Verify via ssh/sshd where the subpackage ships
one and accept the subpackages that carry no version-reporting binary.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Cover ripe-atlas-common, -probe and -anchor: the busybox measurement
applets resolve and run without crashing, the shell libraries parse, the
capabilities grant CAP_NET_RAW, uci parses the config, and each variant
ships its registration servers and host keys.
test-version.sh overrides the generic per-executable version probe, which
would otherwise run the /usr/sbin/ripe-atlas wrapper -- it has no version
flag and boots the probe instead.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Replace atlas-probe and atlas-sw-probe with ripe-atlas, built from the
upstream ripe-atlas-software-probe release tarball (tag 5110) so future
bumps only touch PKG_VERSION and PKG_HASH. Provide atlas-probe and
atlas-sw-probe so existing installs and sysupgrade keep resolving across
the rename.
Run the probe as the ripe-atlas user instead of root, with ujail granting
the measurement applets CAP_NET_RAW from capabilities.json. Drop the unused
e2fsprogs dependency; keep OPENSSL_WITH_DEPRECATED, which upstream tcputil.c
still needs.
Signed-off-by: Tiago Gaspar <tiagogaspar8@gmail.com>
Delete the atlas-sw-probe package in favor of the new ripe-atlas package
that will be added in a following commit.
Signed-off-by: Tiago Gaspar <tiagogaspar8@gmail.com>
Delete the atlas-probe package in favor of the new ripe-atlas package
that will be added in a following commit.
Signed-off-by: Tiago Gaspar <tiagogaspar8@gmail.com>
apk uses whatever /usr/bin/wget resolves to for HTTPS index downloads.
wget-nossl's alternative was ranked 300, above the HTTPS-capable
uclient-fetch (200), so pulling it in transitively silently broke
apk update. Lower it to 100 so uclient-fetch keeps the default while
wget-nossl stays selectable. wget-ssl (400) is unchanged.
Fixes: https://github.com/openwrt/openwrt/issues/24270
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
The timeout UCI option is validated and documented but never appended to
the command, so setting it had no effect. Pass it through with the schema
default of 8, which matches the binary's own default.
Fixes: https://github.com/openwrt/packages/issues/18955
Signed-off-by: David Connolly <david@connol.ly>
Florian Eckert
Dirk Brenken
Alexandru Ardelean
Paul Lipps
Richard Muzik
Tyrel M. McQueen
Eric Luehrsen
Hauke Mehrtens
Ray Wang
Jan-Frederik Rieckers
Tianling Shen
Florian Klink
Noah Meyerhans
Jan Hák
Dengfeng Liu
Daniel F. Dickinson
Dharmik Parmar
Stan Grishin
Tiago Gaspar
Richard Schneidt
David Connolly