uneighbord synchronizes hostapd 802.11k Neighbor Reports between local
`hostapd.*` BSSes and other OpenWrt access points on the same LAN, over
IPv6 link-local UDP multicast. Reports are only shared between BSSes with
the same SSID, and installed through hostapd's ubus API.
Signed-off-by: Nick Hainke <vincent@systemli.org>
Update bsbf-resources to the GIT HEAD of 2026-08-29.
- files/usr/sbin/bsbf-bonding:
- Adjust to new xray configuration.
Signed-off-by: Chester A. Unal <chester.a.unal@arinc9.com>
The generic package version check invokes ksmbd.tools directly, but the
multicall binary rejects that basename and fails the test.
Check the version through ksmbd.mountd and skip subpackages without
versioned executables.
Signed-off-by: Andrea Pesaresi <andreapesaresi82@gmail.com>
Upstream history:
https://github.com/dangowrt/comrade/compare/v0.1.1...v0.1.16
Also adds comrade-tests, a separate package carrying comrade's compiled
test suite (its unit tests, comrade-e2e, and its end-to-end scenario
scripts) so none of it reaches an end-user comrade install. CI's own
test.sh wires up the unit tests through comrade-tests' own
run-unit-tests.sh; both discover what to run from what was actually
installed rather than a hardcoded list, so neither goes stale as
upstream's own suite grows. stream_cc_test and natstream_test are
skipped there instead of run: the first asserts a throughput floor
QEMU user-mode emulation can't reliably clear, the second does real
ICE/NAT gathering, so run-unit-tests.sh skips both by default;
COMRADE_SKIP= run-unit-tests.sh runs them too, e.g. on real hardware,
and comrade-tests' own description now says so. The variable is
namespaced rather than a plain SKIP, matching COMRADE_E2E_NET below,
so it can't collide with whatever else a CI harness's environment
happens to define. run-unit-tests.sh also warns if a listed test ever
matches no installed binary, so a rename or removal upstream surfaces
as a message instead of silent drift. Each test runs under busybox
timeout with a 600 second bound, 5x upstream's largest CTest TIMEOUT
of 120 seconds with margin left for the slowest emulated targets, so
a test that wedges under QEMU fails in minutes and by name rather
than holding the job to its six-hour limit. The end-to-end scenarios
need real network or multicast conditions, and some a live DHT, that
CI's QEMU emulation cannot promise, so they ship for manual use on
real hardware instead.
PKG_SOURCE_URL now points at the release's own tarball instead of
GitHub's codeload archive: codeload's compression is not guaranteed
byte-stable release to release, which broke a hash pinned against
v0.1.12 within hours of that release going out, while a release asset
is frozen the moment the tag's release is published. The tarball is
still produced with `git archive`, so it still carries no submodule
content and deps/always-online-stun still arrives empty for
Build/Prepare to fill.
The STUN list pin matches this release's own deps/always-online-stun
commit. comrade tries every server in the pool in rotation now, not
just the first entry, but a pool with many dead entries still degrades
public-IPv4 discovery, so this still wants refreshing on every bump.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
CARTO now requires an API key for the raster basemaps at basemaps.cartocdn.com and watermarks every unauthenticated tile request, so the GeoIP map currently renders "API KEY REQUIRED" across the whole viewport.
Therefore in luci-app-banip the basemap is now drawn from country outlines that ship with the package: Natural Earth 1:110m, public domain, all attributes stripped, simplified to 36 kB (~10 kB in the apk).
readme changes in the base package only
Signed-off-by: Dirk Brenken <dev@brenken.org>
CARTO now requires an API key for the raster basemaps at basemaps.cartocdn.com and watermarks every unauthenticated tile request, so the GeoIP map currently renders "API KEY REQUIRED" across the whole viewport.
Therefore in luci-app-banip the basemap is now drawn from country outlines that ship with the package: Natural Earth 1:110m, public domain, all attributes stripped, simplified to 36 kB (~10 kB in the apk).
readme changes in the base package only
Signed-off-by: Dirk Brenken <dev@brenken.org>
- fixed crash loops as the shipped example policy is disabled
- fixed restart/reload glitches with already stopped services
- bumped version to 0.1.5-r2
Signed-off-by: Dirk Brenken <dev@brenken.org>
Co-authored-by: Claude <noreply@anthropic.com>
Signed-off-by: Dirk Brenken <dev@brenken.org>
It seems these softwares are no longer maintained,
because the latest upstream commit is 7 years ago.
I think Wi-Fi 7 MLO provides similar feature.
This commit drops macremapper, libdcwproto, libdcwsocket,
dcstad, mrmctl and dcwapd.
Signed-off-by: Yanase Yuki <dev@zpc.st>
Update sqm-scripts to the 1.8.0 release.
This release replaces the iptables-based marking rules with native
nftables rules. Replace the iptables dependencies with nftables to match.
Signed-off-by: Dharmik Parmar <dharmikparmar2004@yahoo.com>
shunt is a policy-based routing daemon for OpenWrt. Policies select
traffic by client address or MAC, destination address, domain, port and
protocol, and route it into any netifd interface or device via fwmark
and per-policy routing tables in nftables/fw4.
Domains are covered by a passive DNS observer (AF_PACKET + BPF) that
works with any resolver - dnsmasq, unbound, AGH, a remote DoH client -
because it reads answers on the LAN bridges instead of integrating with
a specific DNS backend. An optional poller pre-warms configured names.
Learned addresses are written in adaptive batches to stay usable beside
packages that keep very large nft sets (e.g. banIP).
Written in ucode, no dependencies beyond ucode modules, nft and ip.
Companion LuCI app is submitted separately to openwrt/luci.
Signed-off-by: Dirk Brenken <dev@brenken.org>
Co-authored-by: Claude <noreply@anthropic.com>
Signed-off-by: Dirk Brenken <dev@brenken.org>
The generic per-executable version probe and the old test.sh both invoke
tcpreplay --version. Under the QEMU test runtime tcpreplay and
tcpreplay-edit abort at startup on the interface link probe
("eth0: SIOCETHTOOL(ETHTOOL_GLINK) ioctl failed: Not a tty") before
autoopts can print the version, which fails the tcpreplay-all test and
warns on the standalone tcpreplay/tcpreplay-edit packages.
Add a test-version.sh that disables the flaky generic probe and asserts
each tool's version without needing an interface, and rewrite test.sh to
exercise the file-processing core (tcpcapinfo dissect, tcprewrite edit,
tcpprep cache) on a small synthesized capture instead of shelling out to
--version, which the CI infrastructure already covers.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Refresh PKG_HASH from the release tarball.
Define __UAPI_DEF_ETHHDR=0: 4.6.0 added XDP support, so txring.h now
pulls <linux/if_ether.h> while sendpacket.h pulls <netinet/if_ether.h>,
and on musl both define struct ethhdr. The macro makes the kernel header
defer the struct to libc, fixing the redefinition.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
v0.28.0:
- util: added GNUNET_CRYPTO_aead_* APIs; removed deprecated
GNUNET_CRYPTO_symmetric_*, GNUNET_CRYPTO_QUALITY_*,
GNUNET_CRYPTO_hash_create_random, GNUNET_CRYPTO_hash_to_aes_key; switched
various crypto primitives from gcrypt to libsodium; deprecated
xsalsa20poly1305/AES-CTR and ECDSA (services moved to EdDSA where
applicable)
- gnsrecord: new Seal/Open API
- pq: added GNUNET_JSON_pack_conditional, array_int16 query/result specs
v0.29.0:
- curl: added GNUNET_CURL_job_add_stream (streams a response body instead
of buffering it) and GNUNET_CURL_job_set_paused
- peerstore: GNUNET_PEERSTORE_Processor now has a single documented
termination signal (NULL record ends iteration; handle released before
the call returns)
- core: fixed a bug in nonce selection in the handshake, among other bugs
- util: added GNUNET_TIME_round_up_utc/round_down_utc; fixed
GNUNET_static_assert to actually assert at compile time; added
GNUNET_MQ_try_handle_message
- namecache: added API to drop cache entries
Refreshed 0005-meson-detect-libcurl-gnutls.patch (hunk offsets only, no
content change).
Not build-verified: a pre-existing host python3/ncurses build failure
affecting every package in this feed blocks the build before it
reaches gnunet's own compile step.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* new option ban_monitorallowed: in allowlist-only mode
the log monitor only honours the local allowlist, so attackers
from an explicitly allowed segment can be banned (fixesopenwrt/luci#8950)
* adds the allowlist.local.v4/.v6 Sets, built from /etc/banip/banip.allowlist only,
referenced by no rule
* allowlist-only mode: skip only those external feeds whose direction is
fully covered by the allowlist, instead of skipping all or none — split Sets included
* f_lookup keeps the monitor Set in sync with resolved domains
* f_restore: no more bogus per-proto restore attempts for the allowlist
* f_report: batched and deduplicated geo lookups, correct Set names in the report
* readme update
Signed-off-by: Dirk Brenken <dev@brenken.org>
prosodyctl refuses start, stop, restart and reload once it detects an
init system, and /etc/init.d/prosody makes that detection always true.
The refusal is fatal, so the service could neither be started nor
stopped:
ERROR: Use of 'prosodyctl stop' is disabled in this installation
because we detected that this system uses rc.d for managing
services.
Let procd supervise the daemon directly with -F instead, and reload the
configuration with SIGHUP, which is what prosody expects.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
The uci-defaults scripts are already sourced and removed
by default_postinst so nut-server and nut-upsmon postinsts in this
Makefile are not needed.
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
Create a group to allow sharing directories files between upsd and
upsmon, and create a shared NSS certificate/key database on postinst
of nut-common (providing the database dir does not already exist).
Also enables preserving the shared database across sysupgrades.
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
Enable CERTVERIFY, CERTREQUEST, and related options for requiring
verified certificates from peers.
While we are at it, alphabetize the list of PKG_CONFIG_DEPENDS in the
Makefile
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
To satisfy the CI (because of project style) use spaces instead of tab
in the Makefile, except for Make 'recipes' (which require tabs).
To be consistent do this through the file, no only where CI complained.
There is unusual spacing on the nested define recipes as Make's rules for
those is very particular.
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
Migrate frpc and frps configuration generation to the TOML format used by
current frp releases.
- generate TOML configuration from UCI options
- add UCI defaults migration for existing installations
- install additional fragments under /etc/frp/frpc.d and /etc/frp/frps.d
- preserve manual raw TOML fragment support without exposing it in LuCI
- keep client and server TCP mux settings aligned
- update the package metadata for the current frp release artifacts
Signed-off-by: Roc Lai <laipeng668@qq.com>
* distinguish an active run cycle from an idle daemon in the
runtime status: 'processing' is now only reported while f_main
is actually running, an idle daemon without uplink reports
'not connected' instead
* settle the status file at the end of f_main, so a leftover
'processing' does not survive into the sleep phase
* README: document the travelmate_status values and the LuCI
button behaviour
Signed-off-by: Dirk Brenken <dev@brenken.org>
A few minor cleanup changes:
- redirect warning message that causes abort to stderr
- replace bashism: &> redirect and shell substitution
- remove unused variables IPT and WD_DIR
Signed-off-by: Moritz Warning <moritzwarning@web.de>
Serverless peer-to-peer terminal sharing: a host shares a tmux session
that a client joins with a token, over a hole-punched link discovered on
the mainline DHT or link-local multicast, wrapped in an end-to-end SSH
session with the host key pinned in the token.
comrade adds no crypto of its own and follows whatever backend libssh
already links; OpenWrt's libssh uses mbedTLS, so this resolves to
monocypher.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
openNDS (open Network Demarcation Service) is a high
performance, small footprint captive portal supporting both CPD and
CPI (RFC 8910 and RFC 8908) methods.
Moved from the openwrt/routing feed, as discussed in
https://github.com/openwrt/routing/issues/184.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The compat definitions of kzalloc_obj(), kmalloc_obj() and
kmalloc_objs() were guarded by a version range which carves out only
specific stable backports. These helpers are backported on demand to
stable kernel branches, so on a newer stable kernel they collide
with the definitions in include/linux/slab.h and the module fails to
build:
compat-hacks.h:52:9: error: "kzalloc_obj" redefined [-Werror]
./include/linux/slab.h:963:9: note: this is the location of the
previous definition
CI showed this on exactly the four targets sitting on
KERNEL_PATCHVER 6.12 - mips_24kc, powerpc_8548, arm_cortex-a15 and
arm_cortex-a9 - while the six 6.18 targets passed.
Guard each definition on the macro name instead, so the compat code
steps aside whenever the kernel provides the helper, without having
to track which point release of which stable series picked up the
backport.
This mirrors what batman-adv carries in compat-include/linux/slab.h.
That file is not used by this package, which force-includes its own
compat-hacks.h instead, so the same fix has to be applied here as
well. slab.h is included explicitly, because unlike the upstream
file this header does not otherwise pull it in.
Upstream-Status: Backport [96a26bababe5e9c9b9f9226e7cdbe60f49f57b71]
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
proto_batadv_to_batadv_hardif() uses continue to skip a section, but
there is no loop in the function itself. POSIX leaves continue
without an enclosing loop in the current function unspecified; ash
walks the dynamic call stack and lands on the loop inside
config_foreach, which happens to produce the intended behaviour.
Use return, which expresses the intent directly and does not depend
on how config_foreach is implemented.
Reported-by: openwrt-ai[bot]
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
/etc/config/batman-adv is registered as a conffile although the
package never installs it: files/ only ships the uci-defaults
migration script and the netifd proto handlers. The migration script
itself removes /etc/config/batman-adv as its last step once the
settings have been moved into /etc/config/network, so the entry is
left over from the layout that predates batadv_hardif.
Reported-by: openwrt-ai[bot]
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
B.A.T.M.A.N. Advanced is a routing protocol for multi-hop
ad-hoc mesh networks implemented as a kernel module. It builds
against the mac80211 backport like in the routing feed.
Moved from the openwrt/routing feed, as discussed in
https://github.com/openwrt/routing/issues/184.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Mesh11sd autonomously manages all aspects of an 802.11s mesh
network, with dynamic mesh parameters across all nodes and point to
multi-point vxlan tunneling.
Moved from the openwrt/routing feed, as discussed in
https://github.com/openwrt/routing/issues/184.
Carries three backports on top of the routing feed's copy, all from
the 7.2.0 development cycle and all pointed out by upstream:
- 443cdb4c handles the informational options before get_current_setup()
runs. The setup pass waits for br-lan through wait_for_interface(),
so on a host without that bridge "mesh11sd -v" took the full
interface_timeout, ten seconds by default. That is invisible on a
running router and fatal in the package CI, which kills each version
probe after ten seconds.
- 9d18091f makes the script header agree with the LICENSE file the
project ships. It claimed GPL version 3 or later while the file is
GPL version 2, so PKG_LICENSE follows it to GPL-2.0-or-later.
- d0db5353 fixes a typo in get_current_setup(): the length came from
$apmon_cgi_dir, which is never set, so strlen was always 0 and the
trailing slash check read the wrong character.
The submenu is Mesh rather than the Network top level the feed copy
used; the other mesh packages follow once the move from the routing
feed is complete.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
get_interface_address() calls io.open() and dereferences the result
without checking it. /sys/class/net does not contain interfaces
only: with the bonding module loaded it also holds the plain file
bonding_masters, which the `ls -1` in get_interfaces_names() returns
and which has no address below it. io.open() then returns nil and
the script dies with "attempt to index a nil value", so no bat-hosts
data is published at all on such a node.
Return nil when the file cannot be opened and skip those entries in
the caller, which would otherwise index the interface table with
nil. get_hostname() gets the same guard.
Reported-by: openwrt-ai[bot]
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
alfred is a user space daemon for distributing arbitrary local
information (e.g. hostnames or vis data) over a batman-adv mesh
network in a decentralized fashion via IPv6 link-local multicast.
Moved from the openwrt/routing feed, as discussed in
https://github.com/openwrt/routing/issues/184.
The one deviation from the feed copy is SUBMENU:=Wireless, which the
feed copy does not set at all: without it the package sits ungrouped at
the top of the Network menu. Wireless keeps it next to mesh11sd and
batctl, which move across with the same value. A dedicated Mesh submenu
is the better home for all three and is worth adding once enough of the
mesh packages have landed to justify it.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
"managment" is user visible in the description of all three variants.
The MAKE_VARS and MAKE_FLAGS continuation lines were indented with
spaces while every other multi-line list in the file uses a tab.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The CONFIG_* switches were assembled into a newline separated string
and smuggled to the build through a shell variable via shexport, so
the Makefile read:
MAKE_FLAGS += $$$$$(call shvar,batctl_config)
They can simply be listed on the make command line instead. The
result is identical, since later assignments on the command line
override earlier ones, exactly as the "n first, then y" order of the
old string relied on. The longest variant expands to 96 assignments,
about 2 KB, so there is no length concern that would justify the
indirection.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
PKG_BUILD_DIR was set to exactly the value package.mk derives by
default for a package with build variants, so the override had no
effect.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
batctl is the user space configuration and debugging tool for
the B.A.T.M.A.N. Advanced kernel module. It is packaged in three
variants (tiny, default, full) with different sets of subcommands.
Moved from the openwrt/routing feed, as discussed in
https://github.com/openwrt/routing/issues/184.
The one deviation from the feed copy is SUBMENU:=Wireless, which the
feed copy does not set at all: without it the three variants sit
ungrouped at the top of the Network menu. Wireless keeps them next to
mesh11sd and alfred, which move across with the same value. A dedicated
Mesh submenu is the better home for all three and is worth adding once
enough of the mesh packages have landed to justify it.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
libdht now installs libdht.so.0 with a soname and an ABI_VERSION, so the
package it depends on is libdht0 rather than libdht. Bump PKG_RELEASE to
force the rebuild that picks that up.
No other change is needed: DHT_LIBRARY still points at the libdht.so
development symlink, and the resulting binary records the soname, so
transmission-daemon links libdht.so.0 and depends on libdht0.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Three problems in the generated configuration:
- The error message for a missing configuration file prints $file,
which is never set, instead of $val, which holds the path.
- The warning for the unsupported FAS options prints the value of
the option instead of its name, so the message does not say which
option is unsupported.
- gatewayinterface is emitted twice: once resolved to a device via
network_get_device() as "GatewayInterface", and once more by the
generic option loop with the raw UCI value. When the value names a
network section rather than a device, the second line overrides
the resolved device with a name nodogsplash cannot use.
Reported-by: openwrt-ai[bot]
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Nick Hainke
John Audia
Chester A. Unal
Andrea Pesaresi
Ivan Pavlov
Daniel Golle
Dirk Brenken
Yanase Yuki
Dharmik Parmar
Chris Swan
Alexandru Ardelean
Jonas Jelonek
Vladimir Ermakov
Astrozen Zhou
Josef Schlehofer
Daniel F. Dickinson
Roc Lai
Jan Hák
Moritz Warning
George Sapkin