Maintainer: @neheb / @BKPepe / @zhanhb
Compile tested: ipq806x, generic, netgear_r7800, master
Run tested: ipq806x, generic, netgear_r7800, openwrt-19.07
Description:
Squid now only support HTTPS proxy in TCP tunnel mode (e.g. `ssl_bump splice all`):
https_port 3128 ssl-bump tls-cert=/etc/squid/squid.pem generate-host-certificates=on
ssl_bump splice all
In order to operate in SSL Bump mode, we need to compile with `--enable-ssl-crtd` for following configuration:
https_port 3128 ssl-bump tls-cert=/etc/squid/squid.pem generate-host-certificates=on
sslcrtd_program /usr/lib/squid/security_file_certgen -s /car/cache/squid/ssl_db -M 4MB
ssl_bump stare all
ssl_bump bump all
This PR switch the `SQUID_enable-ssl-crtd` into `default y`, therefore default enable SSL Bump mode.
Signed-off-by: Wong Hoi Sing Edison <hswong3i@pantarei-design.com>
(cherry picked from commit dbda77686d)
Library for node.js will be disabled temporarily due to difficulty in supporting the latest node.js.
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
Using `$(INSTALL_CONF)` will cause the program has no access to
configurations file when someone enabled the selinux support.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(backported from bbc6c62c2a)
Xray now is no longer planning to keep compatibility with original
v2ray. Remove PROVIDES before it is totally broken.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(backported from 92efcc2956)
From mosquitto 2.x, port became optional and deprecated in the config,
and it was recommended that listeners be used instead. Drop the hard
requirement in our config conversion script.
Reported in: https://github.com/openwrt/packages/issues/15506
Signed-off-by: <karlp@etactica.com>
- ignore Content-Length from backend if 101 Switching Protocols
- close HTTP/2 connection after bad password
- skip cert chain build for self-issued certs
- meson zstd fix
- ls-hpack upstream update
- discard some HTTP/2 DATA frames received after response
Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
(cherry picked from commit 52f85a0e1f)
* fix whitelist housekeeping if you switch between normal- and
'whitelist only' mode
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 7cfb0f4657)
Fixes two related security vulnerabilities (CVE-2020-15078) which
under very specific circumstances allow tricking a server using delayed
authentication (plugin or management) into returning a PUSH_REPLY before
the AUTH_FAILED message, which can possibly be used to gather
information about a VPN setup. In combination with "--auth-gen-token" or
a user-specific token auth solution it can be possible to get access to
a VPN with an otherwise-invalid account.
OpenVPN 2.5.2 also includes other bug fixes and improvements.
Add CI build test script.
Signed-off-by: Magnus Kroken <mkroken@gmail.com>
(cherry-picked from 6186fe732b)
* add a "whitelist only" mode, this option allows to restrict Internet
access from/to a small number of secure websites/IPs, and block access
from/to the rest of the Internet.
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 515397b009)
Psycopg is the most popular PostgreSQL adapter for the Python programming language
It's used by the python-sqlalchemy for postgresql
This package was removed by this commit for lacking python3 support:
c37b15e1c4
Version 2.8.6 used in this package now supports pyhton3
Signed-off-by: Daniel Danzberger <daniel@dd-wrt.com>
(cherry picked from commit 7cfb9a04af)
This patche change prepares the ubi plugin to add the bad block evaluation in
percent.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 4927b53333)
Enables the compiler option that collectd is compiled with
debugging support. This is used at development stages to get
more messages from the collectd during development.
This option is default disabled.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit a4f74eb11c)
On my system the attribute DEVTYPE was not set. The plugin could not
read any data and the function call blocked forever on this function and did
not returned. By removing it, all block devices under `/sys/class/block`
were checked.
Block devices that do not support SMART were not evaluated. The
collected displays the following message.
smart plugin: checking SMART status of /dev/loop4.
smart plugin: unable to open /dev/loop4.
If you do not like this message, you could only enable device in the uci that
does support SMART.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 543a2a970c)
* support the RPZ trigger 'RPZ-CLIENT-IP' to always allow/block certain
clients based on their IP (currently only supported by bind!)
* avoid promiscuous mode in tcpdump setup for adblock reporting
* speed up dns report preparation
* support dns report mailing (/etc/init.d/adblock report mail)
* fix bind autodetection
* update LuCI-frontend (separate PR)
* update readme
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit c531b6daea)
Currently, this package can not be installed while using standard path
of busybox, because binary killall wants to be installed on the same
location as busybox.
Collision:
• /usr/bin/killall: busybox (new-file), psmisc (existing-file)
Many of these binaries, which provides alternatives were moved to
folder /usr/libexec like wget, sed, findutils, less.
So I moved killall to /usr/libexec and others leave in touch and added
ALTERNATIVES for it, because preinstall script is no longer necessary.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit d8969e0fd1)
