Refresh sha256 from the PyPI sdist.
26.4.0 drops OpenSSL.crypto.X509Req and dump_certificate_request, so
test.sh can no longer import them; remove them and the CSR block. CSR
handling now lives in cryptography.x509, which is not this package.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Building python3-libtorrent with CMake 4 and Python 3.14 fails in
several places, which the distutils error of 2.0.11 used to hide:
- On 32-bit targets FindPython rejects the 64-bit host interpreter.
Pass the host python of OpenWrt as Python3_EXECUTABLE, which skips
that check and keeps CMake on the python that gets setuptools.
- The egg_info step needs setuptools, which the host python no longer
bundles since Python 3.12. Depend on python-setuptools/host when
python3-libtorrent is selected.
- CMake names the module after the SOABI of the host interpreter, for
example libtorrent.cpython-314-x86_64-linux-gnu.so, which the target
python does not load. Rename it to libtorrent.so after installing.
- The wheel from Py3Build/Compile only held the example scripts as
top-level modules and a second dist-info. The module always came
from the CMake install, so drop the wheel steps.
- The module imports datetime when it loads, which python3-base does
not ship. Depend on python3-light.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Check that the python bindings can be imported on the target and that
they report the package version.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Since 2.0.12 the python bindings read the install paths from sysconfig
instead of distutils, which Python 3.12 removed. With 2.0.11 CMake
fails to configure the python bindings, so neither libtorrent-rasterbar
nor python3-libtorrent builds.
Release notes:
https://github.com/arvidn/libtorrent/blob/v2.0.15/ChangeLog
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Solves issues with stats etc. not updating properly and reduces the
amount of leftover temporary files. Access to settings.json is kept
read-only to keep it in sync with UCI.
Signed-off-by: Ludvig Liu Holtze <ldw.liu.holtze@proton.me>
1.30.4:
- Heap buffer overflow with the map directive and regex matching
(CVE-2026-42533).
- Uninitialized memory access with unnamed regex captures and the slice
directive or background cache update (CVE-2026-60005).
- Use-after-free in ngx_http_ssi_filter_module with a crafted proxied
backend response (CVE-2026-56434).
1.30.5:
- Heap buffer overflow with HTTP/3 and OpenSSL 3.5.0 and earlier
(CVE-2026-90439).
All patches apply without changes.
Changelog: https://nginx.org/en/CHANGES-1.30
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Refresh PKG_HASH from the upstream GitHub release tarball.
Drop 010-CVE-2022-40320.patch. Upstream commit d73777c2c356, which the
patch carried, is part of 3.4: cfg_tilde_expand() now terminates the
username before handing it to getpwnam(). Keeping the patch would fail
to apply.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update to latest upstream release.
Removed upstreamed patch.
Security fixes:
- CVE-2026-101283: remote use-after-free in iperf_server_api.c
- CVE-2026-101276: heap buffer overflow in iperf_auth.c
- CVE-2026-102253: denial of service via infinite loop
- CVE-2026-71217: issue with test parameters
Changelog: https://github.com/esnet/iperf/releases/tag/3.22
Signed-off-by: John Audia <therealgraysky@proton.me>
4.5.0 uses three interfaces FFmpeg 7 removed; upstream guards them since
4.6. Drop 010-no-po-man.patch and switch PKG_FIXUP to gettext-version,
which runs autopoint and so supplies the po/Makefile.in.in the patch was
working around. Drop --without-mmal, which 4.7.1 no longer has.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Adds ionos.com as predefined DDNS service. IONOS' dynamic DNS API
only supports domains hosted at IONOS and uses a single fixed
update URL with a generated token as password. Both ipv4 and ipv6
updates use the same endpoint, distinguished by explicitly passing
the detected address via the ipv4= or ipv6= query parameter as
documented by IONOS. Verified working separately for both A and
AAAA record updates against a live domain.
Signed-off-by: Lasse Hanschen <lh@databloat.ch>
Maintainer: Rob White rob@blue-wave.net
Compile tested: All
Run tested: OpenWrt 25.12 and master/snapshot.
Description: mesh11sd (7.3.0)
This version adds pinning of the mesh gateway ARP to the active portal for the peer,
thereby providing reliable ipv4 on multi-portal backhauls.
Additional detected, but non selected portals, cannot retarget the peer or its clients.
The patches of the previous version in this feed are no longer needed so have been removed.
The full changelog can be seen here:
https://github.com/openNDS/mesh11sd/blob/7.3.0/ChangeLog
Signed-off-by: Rob White <rob@blue-wave.net>
- Add interface trigger handling in watchcat.init
- Log when raw interface trigger is activated by any interface coming up
- Move helper functions to separate file
- Update Makefile to install new functions file
Closes: #30463
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
We use shellcheck even though it is pedantic to assist in reducing
errors. Therefore, we add shellcheck directives to silence false
positives. We keep changes minimal as some shellcheck suggestions
result in watchcat failing to function properly.
Also make formatting shmt clean (using -ln=bash due to ash constructs
that shfmt 3.8.0 does not accept for posix shells including busybox).
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
FFmpeg 7 removed AVCodecParameters.channels, causing MiniDLNA 1.3.3
to fail to compile when reading audio channel counts.
Add an OpenWrt package patch to use ch_layout.nb_channels with
libavcodec 61 and later. Retain the existing channels field access
for older versions.
Signed-off-by: Marcin Maj <marcinmajsc@gmail.com>
libwrap is auto-detected from the sysroot and is not in DEPENDS. When
found, the link fails: ocserv assigns to allow_severity and
deny_severity without defining them. Fails on all 35 targets.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Upstream enables wolfSSL whenever it finds it in the sysroot, leaving
libwolfssl.so undeclared and packaging broken on all 35 targets. OpenSSL
is already pulled in via libevent2-openssl and upstream supports it, so
build against that alone.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
- Multiple security fixes for heap buffer overflows, out-of-bounds
writes, and integer overflows. No CVE mentioned.
- Enforces ISO C11 standard.
- Added new Arm Neon (DotProd) and x86 (AVX2/AVX512) paths.
- It is ABI compatible with 1.16.0.
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
Add Alviy DDNS provider (dyndns2 API), IPv4.
Howto:
set [USERNAME] to the Alviy account e-mail
set [PASSWORD] to the host DDNS token
set [DOMAIN] to the hostname
https://www.alviy.com/en/docs/update-api
Signed-off-by: Elly Sai <alviy.dns@gmail.com>
The swanctl.conf child options are called local_ts and remote_ts
(traffic selectors), but the UCI config used local_subnet and
remote_subnet for them. Rename the UCI options in the swanctl init
script to match the swanctl.conf naming, so the config maps 1:1 to
what strongSwan actually expects.
Since this changes the UCI option names, existing configurations
would silently lose their traffic selectors after an upgrade. Add
migrate_child_subnet_to_ts() to the ipsec-to-swanctl migration
script. For each child section it moves the values of local_subnet
and remote_subnet into the local_ts and remote_ts lists and removes
the old options.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The local and remote authentication configuration was stored as flat
options on the connection section. This cannot represent IKEv2 multiple
authentication rounds, where more than one local/remote pair is needed.
Move the options into dedicated 'local' and 'remote' uci sections which
are referenced from the connection via the 'list local' and 'list
remote' options. Multiple sections per connection are now possible and
each pair is emitted as one authentication round.
The generated swanctl.conf names the rounds positionally: the first
local/remote section is emitted as 'local'/'remote', the following ones
as 'local2'/'remote2' and so on.
The 'authentication_method' option moves to the new sections as 'auth'.
The local side of an EAP connection still defaults to pubkey.
The migration script converts an existing connection into one local and
one remote section:
- 'local_identifier' -> local 'id'
- 'local_cert' -> local 'certs'
- 'local_key' -> local 'key'
- 'remote_identifier' -> remote 'id'
- 'remote_ca_certs' -> remote 'cacerts' (list)
- 'eap_id' -> remote 'eap_id'
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Remove the per-connection 'authorities' and 'secrets' blocks generated
inline in config_connection. Pre-shared keys and CA certificates are
now provided via the global 'secret' and 'authority' uci sections, which
prepare_env renders into their own swanctl.conf entries.
The migrate script converts the old per-connection settings into these
new global sections:
- psk connections: 'pre_shared_key' is moved into a 'secret' section
with type='ike', keeping the local/remote identifiers as an 'id' list
- pubkey connections: 'ca_cert' is moved into an 'authority' section
with the matching 'cacert' option
Both options are removed from the connection section afterwards.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Add a generic uci 'secret' section type to swanctl handling, replacing
the dedicated 'mschapv2_secrets' section in prepare_env. The secret kind
is selected via a new 'type' uci option and maps to the matching swanctl
secrets subsection (the section prefix equals the type value):
- eap, xauth, ntlm, ike, ppk: <type>-<name> { id ...; secret }
- private, rsa, ecdsa, pkcs8, pkcs12: <type>-<name> { file ...; secret }
- token: token-<name> { handle, slot, module, pin }
The 'id' option is a uci list element for the eap/xauth/ntlm/ike/ppk
types and emits one 'id' line per entry, matching swanctl's support for
multiple identities per secret.
The legacy path stays unchanged and keeps generating EAP secrets from
the 'mschapv2_secrets' section via legacy_config_mschapv2_secret.
The migrate script now converts 'mschapv2_secrets' sections into
generic 'secret' sections setting type='eap' and turning 'id' into a
list element.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Add support for the new 'authority' uci section type, which generates
global 'authorities/*' entries in the swanctl.conf file.
Each section is translated into one '<name>' authority block using the
following options:
- 'cacert' defines the CA certificate
- 'cert_uri_base' defines the base URI used by the hash and URL
features
- 'list crl_uri' defines one or more CRL distribution points, emitted
as 'crl_uris'
- 'list ocsp_uri' defines one or more OCSP responder URIs, emitted as
'ocsp_uris'
Example uci config:
config authority 'ca'
option cacert 'ca.pem'
list crl_uri 'http://crlca.example/ca.crl'
generates:
authorities {
ca {
cacert = ca.pem
crl_uris = http://crlca.example/ca.crl
}
}
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The 'remote' section type in '/etc/config/ipsec' is a misnomer, since
it defines the whole IPsec connection (IKE peer and children), not just
the remote end. Rename it to 'connection' to align with the swanctl
'connections' terminology.
Rename config_remote() to config_connection() and iterate the
'connection' type in swanctl.init.
Add a migrate_remote_to_connection migration step that renames existing
'remote' sections to 'connection'.
Signed-off-by: Florian Eckert <fe@dev.tdt.de
Let the caller pass an optional session ID as the first argument to
main(). If one is given, the migration is performed inside a LuCI
transaction session: the resulting /tmp/.uci/ipsec delta is moved to
/tmp/run/rpcd/uci-${session} at the end instead of being applied to the
running config directly. This allows LuCI to preview and apply the
ipsec-to-swanctl migration through its normal session workflow, rather
than forcing an immediate, uncoordinated commit of /etc/config/ipsec.
Drop the 'uci commit ipsec' calls scattered through the individual
migration functions, since committing is now the caller's
responsibility. Also add -q to the uci calls that were missing it, so
errors are suppressed consistently.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Until the user runs the migration, the legacy '/etc/config/ipsec'
configuration must keep working. Restore support for the old uci format
in the swanctl init script by adding a parallel legacy rendering path.
The 'legacy_config_*' helpers translate the legacy sections into
swanctl.conf syntax: 'ipsec' and 'remote' sections, including the
existing start/close/dpd action and lifetime translations, plus the
global 'pools' and 'mschapv2_secrets' blocks.
As long as the uci section type 'ipsec.@ipsec[0]' exists, prepare_env() and
service_triggers() use the legacy generation path and keep reloading on
'ipsec' changes.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Now that the ipsec-to-swanctl migration is no longer executed
automatically on boot, expose it through the init script so it can be
invoked on demand via '/etc/init.d/swanctl migrate'.
Also harden the migration script: abort with an error if
'/etc/config/ipsec' does not exist. Keep a copy of the original
configuration in '/etc/config/ipsec_bak' before starting.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The migration of the legacy '/etc/config/ipsec' UCI configuration to
the new '/etc/config/swanctl' format cannot be performed fully
automatically: it rewrites the user's configuration and must be
triggered and acknowledged by the user.
Remove the automatic migration hook that was installed as an
uci-defaults script (executed once on first boot or installation) and
instead ship the migration utility as a regular binary at
'/usr/libexec/strongswan/migrate-ipsec-to-swanctl'. From now on the
migration is only run on demand.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Previously a service reload only reloaded the IPsec connection
definitions from '/var/swanctl/swanctl.conf', leaving changes to
'/var/ipsec/strongswan.conf' to require a full restart.
Extend the reload action to also pick up changes to strongswan.conf
for a running service by executing 'swanctl --reload-settings' on
reload as well.
Note that 'swanctl --reload-settings' reloads '/var/ipsec/strongswan.conf'
at runtime, but not all settings (esp. plugin load directives, kernel/socket
options) are picked up by charon. A full daemon restart is still required
for such changes to apply. A note about this was added as well at this
point.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Strongswan can optionally install routes via XFRM interfaces if the
'charon.plugins.kernel-netlink.install_routes_xfrmi' option is enabled.
This change makes this configurable via uci.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Add a new uci 'shunt' section type for pass/drop policies, independent
of regular connections, since shunts have no peer, authentication or
proposals. Each section renders into its own 'connections{}' entry in
swanctl.conf.
Supports 'mode' (pass/drop), 'local_ts' and 'remote_ts' (lists),
'priority' and 'interface'. Sections with 'enabled' unset are skipped.
Signed-off-by: Florian Eckert <fe@dev.tdt.de
When the 'ipsec' section type was migrated to 'globals', the section
type was overlooked in '/etc/config/ipsec' and in the
config_foreach call in 'swanctl.init'. Both still referred to the old
'type', so the globals section was not picked up.
Fixes: e5c5a23a8 ("strongswan: do not use config_foreach named section globals")
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'dpddelay' to 'dpd_delay' in remote via upgrade script to
match the 'swanctl.conf' '<conn>.dpd_delay' key.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename the uci option 'overtime' to 'over_time' in the 'remote'
sections, via an upgrade script, to match the 'swanctl.conf'
'<conn>.over_time' key.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'rekeytime' to 'rekey_time' in remote via upgrade script to
match the 'swanctl.conf' '<conn>.rekey_time' key.
The new migration function 'migrate_option_remote_values' in 'uci-defaults'
is designed to be generic, since 'rekeytime' is not the only option that
does not conform to the swanctl naming scheme for conn and should also be
migrated.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'lifepackets' to 'life_packets' in child via upgrade script to
match the 'swanctl.conf' '<child>.life_packets' key.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'rekeypackets' to 'rekey_packets' in child via upgrade script to
match the 'swanctl.conf' '<child>.rekey_packets' key.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'lifebytes' to 'life_bytes' in child via upgrade script to
match the 'swanctl.conf' '<child>.life_bytes' key.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'rekeybytes' to 'rekey_bytes' in child via upgrade script to
match the 'swanctl.conf' '<child>.rekey_bytes' key.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'lifetime' to 'life_time' in child via upgrade script to
match the 'swanctl.conf' '<child>.life_time' key.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'rekeytime' to 'rekey_time' in child via upgrade script to
match the 'swanctl.conf' '<child>.rekey_time' key.
The migration function 'migrate_option' in 'uci-defaults' is designed to
be generic, since 'rekeytime' is not the only option that does not conform
to the swanctl naming scheme and should also be migrated.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'startaction' to 'start_action' via upgrade script to
match the 'swanctl.conf' '<child>.start_action' key.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'closeaction' to 'close_action' via upgrade script to
match the 'swanctl.conf' '<child>.close_action' key.
Unlike 'dpd_action', 'close_action' has a direct 'none' equivalent, so
all legacy values are migrated:
* clear -> none
* hold -> trap
* restart -> start
* none -> none
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
swanctl.conf only supports clear (the default), trap and restart, with
no equivalent for the legacy 'none' and 'start' values.
The upgrade script renames the uci option 'dpdaction' to 'dpd_action'
to match the 'swanctl.conf' '<child>.dpd_action' key. The value 'hold'
is remapped to 'trap'; this mapping was previously done in the swanctl
init script.
Not setting 'dpd_action' means 'clear'. Therefore, setting
'dpd_action=clear' (the default) together with 'dpddelay=0' is
equivalent to the old 'dpdaction=none'. This is not upgraded
automatically.
Signed-off-by: Florian Eckert <fe@dev.tdt.de
Introduce the 'use_custom_proposal' flag, allowing users to define
their own IKE/IPsec proposals in 'custom_proposal' instead of relying
on the uci options 'encryption_algorithm', 'hash_algorithm',
'dh_group' and, for IKE, 'prf_algorithm'.
This is particularly useful for:
* Advanced users who need specific algorithm combinations
* Compatibility with non-standard or legacy peers
* Fine-tuning security parameters for specialized use cases
Note that enabling this option requires careful configuration, as
incorrect proposals may break compatibility or cause connection
failures. Upgrades with custom proposals are not officially supported,
since we do not know what the user has configured.
Signed-off-by: Florian Eckert <fe@dev.tdt.de
Previously, the debug option for strongswan logging was configured
directly in the globals section of ipsec, so every subsystem had the
same log level. To improve modularity and maintainability, relocate
the debug configuration to a dedicated named 'ipsec plugin' section
'syslog'.
Rationale:
* Clearer separation of concerns (logging vs. core strongswan settings)
* Better alignment with the strongswan plugin-based architecture
Key improvements:
* Enables separate log level configuration for individual strongswan
subsystems (dmn, mgr, job, ...), allowing finer control over debug
verbosity.
* Splits logging facilities into 'daemon' and 'auth' for more granular
log filtering and debugging. The subsystems ike, chd, enc and esp
are moved to the 'auth' facility; all other subsystems are moved to
the daemon facility.
* The default logging level for the 'auth' and 'daemon' facilities is
set to '-1', which means "absolutely silent".
The existing configuration is also migrated to the new uci layout using
a uci-defaults script.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Alexandru Ardelean
Josef Schlehofer
Ludvig Liu Holtze
John Audia
Lasse Hanschen
Christian Lachner
Rob White
Daniel F. Dickinson
Marcin Maj
Luiz Angelo Daros de Luca
Elly Sai
Florian Eckert