- update_cloudflare_com_v4.sh: enclose urls in single quotes
- dynamic_dns_functions.sh: force to return only one ip, if using nslookup to get registered ip
Signed-off-by: Christian Schoenebeck <christian.schoenebeck@gmail.com>
Update to new snapshot version. We also make IPV6 optional, and
conditionally selecting the udptunnel6 module, using the same trick that
the strongswan package also uses for this kind of dependency expression.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
When only kmod-openvswitch is enabled, which commonly happens during LEDE
release builds, there is no need to build the entire userland of openvswitch
as this is done at a later stage on systems dedicated to build only userspace
packages.
This change conditionalizes the dependency on python, which means that python
prerequisites are only compiled if the openvswitch-python package is enabled,
which allows us to eliminate the entire python dependency chain.
Furthermore, this change sets MAKE_PATH to the kernel module sub directory
if only kmod-openvswitch is enabled which causes the openvswitch build system
to only process sources related to the .ko files.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
This patch prepares for another future package (ecdsautils),
which builds multiple binaries all linked to libuecc.
The changes are a direct copy of [1]. The original commit
message was:
> commit cb2ecbfdf0c478568a28aacb99d30fd6ee5c0dd1
> From: Matthias Schiffer <mschiffer@universe-factory.net>
> Date: Tue, 3 May 2016 21:33:34 +0200
> Subject: libuecc: use shared instead of static library
>
> Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
[1]: cb2ecbfdf0/patches/packages/openwrt/0007-libuecc-use-shared-instead-of-static-library.patch
Signed-off-by: Dominik Menke <dom@digineo.de>
modified Makefile to:
- stop service before install when updating reported at http://forum.lede-project.org/t/ddns-scripts-upgrade-issue/456/1
- run uci-defaults for all packages
- modify services files only on new installation
still some commands already covered by default_postinst() etc. but they are in there for backward compatibilty.
Signed-off-by: Christian Schoenebeck <christian.schoenebeck@gmail.com>
This version of ocserv needs us to explicitly specify the prefix
for libev. Add a --with-libev-prefix parameter to make the
configure stage to get the right library.
Signed-off-by: Angelo G. Del Regno <kholk11@gmail.com>
- History: prior to package 1.5.10-3 /var/lib/unbound was not used
- History: prior to package 1.5.10-4 no UCI scripts were provided
- Problem: UCI 'option manual_conf 1' only copied unbound.conf and root.key
- Problem: power users that had complex file nests cannot use this
- Fix: README.md includes instructions for /var/lib/unbound jail
- Fix: unbound.sh copies ALL of /etc/unbound for 'option manual_conf 1'
Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
- tld_names.dat.gz
- rename to public_suffix_list.dat.gz
- (re)created during build
- new location /usr/share
- move services files to /etc/ddns
- new services
- CloudFlare.com-v4 using API-Version 4 without using public_suffix_list.dat
- GoDaddy.com
- both depending on cURL package
- both with modified syntax for option domain ( NEW: [host[.subdom]@]domain.tld )
- new service
- Now-DNS.com formerly Now-IP.com
- service afraid.org now supports key-auth and basic-auth
- new command line options for dynamic_dns_updater.sh and dynamic_dns_updater.sh
- adapted ddns.init and ddns.hotplug to new command line options
- renaming config options inside section global
Signed-off-by: Christian Schoenebeck <christian.schoenebeck@gmail.com>
Now that we don't ship any modules by default, znc might be started
without any modules. Unfortunately znc refuses to start without any
modules, so patch out the appropriate check.
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
-unbound.sh implements the majority of requirements in README.md
-rootzone.sh reloads a small subset for alternate trigger maintenance
-unbound.init sets procd triggers on Unbound and dnsmasq (dhcp) UCI
-two part commit squashed with Makefile included
Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
-dnsmasq really provides nice local DHCP-DNS records
-Unbound host records would be clumsy to update
-Unbound can be configured to forward to dnsmasq
-iptools provided to facilitate PTR records
-flexible ipv6 colon notation is a bit complex
Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
-DNSSEC needs time, time needs ntp, or power off RTC
-Many consumer routers are cost thrifted without RTC
-Conf "val-override-date: -1" disables time inside DNSSEC
-Need restart as option is not dynamically switchable
-hotplug/ntp is used to set file /var/lib/unbound/unbound.time
-UCI will add or remove option depending on flag-like-file
Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
If libjson-c is detected during bind-libs configure phase, bind-libs
will be built with libjson support. This results in a missing dependency
error during install phase. Solve this by disabling libjson support.
This updates to the latest git version of acme.sh and drops the patch to
disable timestamps from the output (since that is now supported
upstream).
Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
This version handles transitioning from a previous certificate that was
issues using the staging server, adds more debug logging, and handles
state directories better if issuing fails.
Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
quassel-irssi is an irssi plugin that allows irssi to connect to
Quassel cores. Quassel is a distributed IRC client in which the
core can run independently and be connected to by quassel clients
over the network.
Signed-off-by: Ben Rosser <rosser.bjr@gmail.com>
Create & run znc as a specific user rather than nobody. Converted to
use procd, removing dependencies on znc's 'droproot' module & 'su'
Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
- haproxy 1.6 needs OPENSSL_WITH_DEPRECATED, OPENSSL_WITH_EC NPM ...
- fix buildflags for lua, so its not build with the host compiler
- fix duplication of defines
Signed-off-by: heil <heil@terminal-consulting.de>
The advanced playback module makes it possible for IRC clients to avoid
undesired repetitive buffer playback. IRC clients may request the module
to send a partial buffer playback starting from and ending to a certain
point of time.
Particularly useful with (supporting) mobile clients such as Mutter,
Colloquy & others.
Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
---
Unfortunately playback.cpp is not included as part of the standard ZNC
modules and so has been added as a patch.
- based on the work done by el1n with his authorization (https://github.com/el1n/OpenWRT-package-softether)
- updated softethervpn to latest version
- introduced necessary patches for lede compatibility (nossl3)
Signed-Off-by: Federico Di Marco <fededim@gmail.com>
Patch 101-musl-fixes defines __kernel_nlink_t as void; but using
a pre-3.6.11 kernel on an arm cortex defines __kernel_nlink_t as
unsigned short using uclibc
Fix the compile issue by not redefining __kernel_nlink_t
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
Fixes issue openwrt#3403 "radiusd requires a temporary directory to be existent for certain operations, like verification of certificates."
Signed-off-by: Alberto Bursi <alberto.bursi@outlook.it>
This version will use the standalone (netcat) mode of acme.sh during
verification instead of exposing uhttpd to the internet for the duration
of the verification. It will also add an ip6tables rule to also support
verification over IPv6.
Also contains an updated version of acme.sh.
Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
musl.h was included before _GNU_SOURCE in 101-musl-fixes patch
leading to compilation issue on gcc (RTLD_DEFAULT not being
defined in dlfcn.h due to __USE_GNU not being set).
As described in the feature test macro man page feature macro
can be defined in the source code but need to be defined before
including any headers.
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
'cifsmount' alone is not able to mount a SMB share, after
having installed kmod-fs-cifs this was possible.
So I guess adding kmod-fs-cifs as a dependency to cifsmount is ok.
Signed-off-by: Paul Wassi <p.wassi@gmx.at>
Package doesn't build with uClibc without them, but no change for other libc
variants so no need to bump revision.
Signed-off-by: Michal Hrušecký Michal.Hrusecky@nic.cz
-Patch for /etc/unbound/unbound.conf
--All work done in /var/lib/unbound/
--chroot or jail to /var/lib/unbound/
-Init script points to /usr/lib/unbound.sh
-Makefile to install new scripts in the package
Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
-Unbound RFC 5011 is busy and writes frequently
-RFC 5011 creates working files in same directory
-DNSSEC root.key managed in /var/lib/unbound
-Protect against flash ROM wear out in /etc/unbound
-Scripts will copy back every 7 days instead
Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
-Rebind to new interfaces cleanly
-Detach from old interfaces cleanly
-Some conf options do not reload dynamically
-Unbound grows some and this will shrink it
Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* change option 'trm_iw' to boolean,
1 => use iw (default)
0 => use iwinfo
* option 'trm_maxretry' now accepts '0' to disable this check at all
* documentation update
Signed-off-by: Dirk Brenken <dev@brenken.org>
The configure script (for libdnet) seems to find <net/bpf.h>
and detect some BSD stuff.
The lidnet's Makefile wants to include eth-bsd.c, arp-bsd.c
and other BSD friends.
This seems to put a cork on it, and no BSD stuff appears anymore.
[at least on my system].
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
Adds gitolite package which is a handy administrative tool for
managing shared git repositories.
Signed-off-by: Daniel Dickinson <lede@cshore.thecshore.com>
- privoxy.init fix handling of config section "system"
- change start/stop to start=95 and stop=10
Signed-off-by: Christian Schoenebeck <christian.schoenebeck@gmail.com>
Lcdringer is a tool which runs on a Raspberry Pi with an LCD
display. Lcdringer connects to an XMPP server, listens for messages
sent to a particular Jabber ID, and displays these incoming messages
while playing an audible alarm. Lcdringer also responds to the messages
it receives with an indication of whether or not the audible alarm was
acknowledged with a button press.
Signed-off-by: W. Michael Petullo <mike@flyn.org>
-Remove interlaced configuration changes
--Less sensitive to upstream example.conf changes
--Easier to read patch-of-patch work for maintenance
-Use MEMORY CONTROL EXAMPLE from http://unbound.net/
--Review and rework with respect to previous pacakge
--Effectively the same configuration as previous package
-Disable DNSSEC by default due to real-time chicken-n-egg
--Many OpenWrt target devices have no power-off clock (reboot)
--User choice of work around should be conscious
--Initial install should not fail reboot with DNSSEC default
-Add some defaults explicitly to prevent surprises
Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
received. Otherwise an unauthenticated peer can repeat the KEXINIT and cause
allocation of up to 128MB -- until the connection is closed. Reported by
shilei-c at 360.cn
ec165c392c
Signed-off-by: Peter Wagner <tripolar@gmx.at>
Wrap around dhtcache vs. datacache confusion which prevented
the datacache service from starting.
While at it, sanetize default package selection.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Explicitely disable liblz4 and external libtalloc support in order to avoid
implicit dependencies leading to the following error on build environments
that happen to provide liblz4 and libtalloc:
Package ocserv is missing dependencies for the following libraries:
liblz4.so.1
libtalloc.so.2
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* add new 'envchk'function to check adblock environment only,
i.e. check volatile firewall rules or uhttpd instances
without list updates
* add new optional parm 'adb_loglevel',
set it to "0" to mute output (print only errors)
* set hotplug priority to '90' as well (missed in the last commit)
* documentation update
* cosmetics
Signed-off-by: Dirk Brenken <dev@brenken.org>
I think re-ordering the assignments is important here,
_and_ using := for PKG_SOURCE_SUBDIR instead of simple =.
I also grouped the assignments to make it more readable,
IMHO at least :-)
While at, we should also specify the license file
and remove the unneeded Compile definition - the default
just works fine.
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
- moved from net to mail category
- removed no-ssl package and added ssl support as configuration option (default enabled)
- added configuration option to support extended logging (default disabled)
- disabled build of test tools
- added LEDE compatibility (support for openssl without SSL3)
Signed-off-by: Federico Di Marco <fededim@gmail.com>
This should massively improve performance for (at least) MIPS targets:
* poly1305: optimize unaligned access
This is a very appreciated fix from René van Dorst, adjusting the
arithmetic in Poly1305 to work fast on platforms with slow unaligned
access, such as MIPS. According to his calculation, this gives a 50%
improvement on small MIPS boxes.
Signed-off-by: Baptiste Jonglez <git@bitsofnetworks.org>
remove postinst (of main package) from Makefile because all is done inside uci-defaults scripts
Signed-off-by: Christian Schoenebeck <christian.schoenebeck@gmail.com>
commands to apply changes introduced during release changes, moved from Makefile postinst to /etc/uci-defaults
Signed-off-by: Christian Schoenebeck <christian.schoenebeck@gmail.com>
Local variable declarations outside of functions are illegal since the Busybox
update to v1.25.0, therfore remove them from the appropriate places.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* now a single config file in /etc/afp.conf
* convert services to procd while at it
* take over maintainership as the original maintainer is
unresponsive (see #1550)
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
because otherwise the build of this package in LEDE trunk fails, complaining about lack of libz.so.1
signed off by Alberto Bursi <alberto.bursi@outlook.it>
- if local ip cannot be detected or is invalid then do not exit ddns-scripts #2950,
using multiple url's to detect local ip not jet implemented
- change spdns.de update url and add sydyn.de inside services file #2991
- move transfer- and lookup-program detection to dynamic_dns_functions.sh
so run once at startup in stead of at every transfer/lookup
- add khost, drill and hostip to verify_host_port() function
- updated tld_names.dat
Signed-off-by: Christian Schoenebeck <christian.schoenebeck@gmail.com>
The package creates a "mosquitto" user, but the support added for
persistence creates the data directory as root running the init script.
Properly chown the newly created directory to ensure it's writable.
Signed-off-by: Karl Palsson <karlp@etactica.com>
* enhance the new query function:
change the regex to find only the relevant blocklist entries
add a recursive tld search to quickly identify domains for
whitelisting (see documentation)
better result preparation
* add securemecca as new blocklist source
* documentation update
Signed-off-by: Dirk Brenken <dev@brenken.org>
* add a query function to search the active blocklists for a specific
domain (/etc/init.d/adblock query <DOMAIN>)
* fix bug in ap mode/uhttpd port detection
* check general firewall and dnsmasq package dependencies and remove
redundant checks in ap mode
Signed-off-by: Dirk Brenken <dev@brenken.org>
* added a 'window.close()' to adblock landing page to automatically
close any pop-ups that might get loaded with a blocked ad
* simplified dnsmasq check in ap mode
Signed-off-by: Dirk Brenken <dev@brenken.org>
* change the default hphosts list source to ad and tracking servers
only, the overall list includes to many false positives
* new optional config parm 'adb_hotplugif' to restrict hotplug support
to a certain wan interface or to disable it at all
* documentation update
* cosmetics
Signed-off-by: Dirk Brenken <dev@brenken.org>
Update Csocket to a newer version with compile fixes for OpenSSL with
disabled compression support. Since we don't get zlib as an transitive
dependency anymore, also add zlib as an explicit dependency.
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Set teardown_on_l3_link_down notifying netifd xl2tpd wants to be
teared down when layer3 link loss is detected
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
while at it, also fix post-install script and no longer ship
gnunet-download-manager.scm, we ain't got guile anyway and it wasn't
touched for 12 years.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
This fixes two issues with the freeradius package init scripts:
- The package installs libraries in /usr/lib/freeradius{2,3}, but the
musl dynamic linker won't find them there unless LD_LIBRARY_PATH is
set to include this directory. This adds an appropriate env statement
to the procd init setup.
- procd expects services to stay in the foreground, or it will be unable
to properly shut them down again. This adds the -f flag to radiusd to
achieve that.
Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
This adds a package wrapping the acme.sh script from
https://github.com/Neilpang/acme.sh in Uci config and hooks to interact
correctly with uhttpd.
Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
Before starting chilli instance, it first removes generated
files (/var/run/chilli*) for the instance. While deleting
generated files, it doesn't match full instance name.
Thus if coova-chilli config file (/etc/config/chilli) has
instances wlan11 and wlan1 in order,
when creating coova-chilli instance for wlan1, it is removing
files generated for wlan11 instances also (as it uses wlan1*
in remove command).
Fix issue by matching full instance name while removing old files.
Signed-off-by: Rajan Vaja <rajan.vaja@gmail.com>
Signed-off-by: Bhargav Patel <br13patel@gmail.com>
From the Tor project page:
obfsproxy is a tool that attempts to circumvent censorship, by
transforming the Tor traffic between the client and the bridge. This
way, censors, who usually monitor traffic between the client and the
bridge, will see innocent-looking transformed traffic instead of the
actual Tor traffic.
This depends on:
- pyptlib (#2053)
- twisted (#2052)
Also, txsocksx (#2058) is necessary to use an outgoing SOCKS proxy,
and having either gmpy2 (#2067) or gmpy (#2051) installed will help
speed up calculations.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
Tcpreplay is a suite of free Open Source utilities for editing and
replaying previously captured network traffic. Originally designed
to replay malicious traffic patterns to Intrusion Detection/Prevention
Systems, it has seen many evolutions including
capabilities to replay to web servers.
Pretty useful for testing stuff too.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
for working out the interface name
Working:
ubus -S call network.interface dump|jsonfilter -e "@.interface[@.interface=\"wan\"].l3_device"
Broken:
ubus -S call network.interface dump|jsonfilter -e "@.interface[@.interface=\"wan\"].device"
Fix run tested:
root@wifi:/overlay/upper# ps |grep mini_snmpd
1404 root 980 S /usr/bin/mini_snmpd -n -c public -L Undisclosed -C VGB <admin@victimsofgaybullying.com> -t 1 -a -d /overlay,/tmp -i br-lan,pppoe-w
Before it wasn't using the pppoe interface it was using the parent
interface eth0 twice. Small 1 line fix. Merge at your convenience.
Signed-off-by: Luke McKee <hojuruku@gmail.com>
Also fix a new compilation error, due to upstream changes in the build
system. SUBDIRS= is deprecated when building external kernel modules, use
M= instead to fix compilation.
Signed-off-by: Baptiste Jonglez <git@bitsofnetworks.org>
Maintainer: Ondrej Caletka / @Oskar456
Compile tested: TurrisOS 3.1 (fork of OpenWRT Chaos Calmer), Trunk (both uClibC and musl)
Run tested: mpc85xx - Turris 1.0 - TurrisOS - no problems observed
Upstream: https://github.com/fln/addrwatch / @fln
Description:
This is a tool similar to arpwatch. It's main purpose is to monitor network
and log discovered ethernet/ip pairings.
The package has been UCIfied, care has been taken to reload the deamon
every time an interface goes up or down.
Signed-off-by: Ondřej Caletka <ondrej@caletka.cz>
freeradius-server version 2.x has been marked End-Of-Life.
This commit adds freeradius-server version 3.0.11 in a new package.
This commit also introduces the option "freeradius3-default"
which activate all modules needed to run radiusd with its default
configuration.
- rlm_digest (HTTP Digest Authentication) has been added
- rlm_unix (System Authentication) has been added
- rlm_attr_rewrite has been deleted
Note that SQL and LDAP support has been disabled.
Signed-off-by: Lucile Quirion <lucile.quirion@savoirfairelinux.com>
The default /etc/config/racoon shipped by ipsec-tools lacks an option keyword
on the p2_proposal line, leading to a syntax error when processing the file.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Makes use of all available runtime options that can be passed to
mini_snmpd such as -I listen_on interface
Run-tested on trunk on ar71xx. Please review the init script regarding procd
monitoring interfaces, though everything else due to the conversion to
procd should be and done properly, if not overkill compared to most
other script bundled with openwrt.
The main benefit of all this is now larger routers can run multiple
instances of mini_snmpd on different ports, to get around the MIB hard
coded 4 interface/mountpoint limits.
Due to somewhat lacking dev / package maintainer docs except for
http://wiki.prplfoundation.org/wiki/Procd_reference writing this script
took longer than it should. You can see it's evolution here:
https://github.com/hojuruku/openwrt-packages/blob/mini_snmpd/net/mini_snmpd/files/mini_snmpd.init
If everything in it is found to be sane, please include it to the
openwrt wiki on procd as an example.
Due to procd / uci /sbin/validate_data cbi element datatype (uciname) being used
to check uci config, the configuration file now only takes openwrt uci network names not
physical network names as it did before.
http://git.openwrt.org/?p=packages.git;a=commit;h=783e5578ad104d1ca3c31582add08fc8eb4ad083
Like busybox the package Makefile has depends for all runtime
dependencies needed by the init script. mini_snmpd only depends on libc
squashed commits:
mini_snmpd: fix typo to fix procd triggers calling daemon binary directly instead of init script - misuse of $PROG var
mini_snmpd: enable SSP & mini_snmpd to start by default and listen on lan
mini_snmpd: disable RELRO blocker in Makefile after consulation
mini_snmpd: add smarts to init script to detect if ubusd hasn't started yet
mini_snmpd: fix init script - ubus -S doesn't print meaningful errors to give the user
mini_snmpd: Makefile roll back Makefile PKG_RELEASE to 1 for feng shui
Signed-off-by: Jean-Michel Lacroix <lacroix@lepine-lacroix.info>
From the oldpackages.
Updated to version 3.0.719, new config file to add more options
Rewritten init file to take in account the new config file and
removing a bug when stopping the daemon.
Corrected license information in Makefile
Signed-off-by: Jean-Michel Lacroix <lacroix@lepine-lacroix.info>
UCI commands report errors in parsing coova-chilli
sample configuration file. Fix this issue by using
proper format in configuration.
Signed-off-by: Rajan Vaja <rajan.vaja@gmail.com>
In file included from print.h:25:0,
from linreg.c:24:
util.h:364:32: error: unknown type name 'time_t'
int rate_limited(int interval, time_t *last);
^
Signed-off-by: Stephen Walker <stephendwalker+github@gmail.com>
Standard assignment is immediate expansion without any extraneous spacing, RFC822 compliant email addresses without any quotation marks and long git hashes
Signed-off-by: Stephen Walker <stephendwalker+github@gmail.com>
The default busybox config used by OpenWrt does not enable floating
point number support for the sleep applet. This can cause an error when
stopping or restarting strongswan:
sleep: invalid number '0.1'
Replace the float with an integer to fix this.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
postrm/postinst symlink mangling is frowned upon
by trunk devs, in addition to packages modifying
the files as other packages during
installation/removal (without a agreed upon mechanism
for coordinating such changes) is prohibited in
most distros.
Further in this case results in wget-ssl failing to conflict
with wget-nossl. As mentioned in the github issue
regarding this (https://github.com/openwrt/packages/issues/2728)
it is also unnessary in current openwrt/lede.
This patch there makes the symlink from the specific
flavour of wget (e.g. wget-ssl) from /usr/bin/wget part
of /install so that they conflict with each other the
way they should, and do not modify the same files
without a delibarate --force-overwrite.
Signed-off-by: Daniel Dickinson <lede@daniel.thecshore.com>
add PKG_BUILD_DEPENDS and PKG_CONFIG_DEPENDS and also make the sub
packages select the main package.
Signed-off-by: Hauke Mehrtens <hauke.mehrtens@intel.com>
This brings IoTivoity to version 1.1.0
The old @lantiq.com address does not work any more, update to the
@intel.com address.
The removed patches were merged upstream, but there are still some new ones needed.
Signed-off-by: Hauke Mehrtens <hauke.mehrtens@intel.com>
davfs2 had hardcoded value for stack protector. If stack protector is disabled
in toolchain, it would break the build. Disabling the hardcoded value, counting
on settings in cross-build system.
Signed-off-by: Michal Hrusecky <michal.hrusecky@nic.cz>
[bump PKG_RELEASE]
Signed-off-by: Etienne CHAMPETIER <champetier.etienne@gmail.com>
lispmob accesses the gnu members of struct udphdr like source and dest
and does not use the posix member names. Instead of using the correct
names just define this as _GNU_SOURCE.
[bump PKG_RELEASE]
Signed-off-by: Etienne CHAMPETIER <champetier.etienne@gmail.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: Etienne CHAMPETIER <champetier.etienne@gmail.com>
* fw rule changes:
force_dns now supports multiple lan devices
disable needless force_dns- & forward/output-rules in 'ap mode'
check return codes during adblock chain creation
* simplified the test for a running firewall
* documentation update
Signed-off-by: Dirk Brenken <dev@brenken.org>
- fix handling of parameter "is_glue" and "dns_server" to work with luci-app-ddns
- update TLD_names.dat
Signed-off-by: Christian Schoenebeck <christian.schoenebeck@gmail.com>
* restructured sources
* fix logical glitches in config handling
* many corner case fixes & cosmetics
* show runtime errors in LuCI (in lastrun section)
Signed-off-by: Dirk Brenken <dev@brenken.org>
Until now unbound was always running as root by default. A DNS resolver can
easily run under a non-privileged user.
Signed-off-by: Michael Hanselmann <public@hansmi.ch>
The commands aliased by $(INSTALL_BIN) and $(INSTALL_DATA) set good
permissions, unlike a raw file copy.
Signed-off-by: Michael Hanselmann <public@hansmi.ch>
The custom list of DNS root servers provided with the package is not necessary.
Unbound ships with a built-in list.
Signed-off-by: Michael Hanselmann <public@hansmi.ch>
* rework download/backup/restore handling
* rework firewall handling
* refine whitelist parsing
* changed default null-ip to 198.18.0.1 to prevent conflicts with bcp38
* spread traffic from ad servers (port 80/443) on two uhttpd instances,
this fixes timeouts on sites with many ssl ad server connections, i.e.
youtube.com
* provide statistics & last runtime for LuCI interface
* documentation update
Signed-off-by: Dirk Brenken <dev@brenken.org>
Enabling BCP38 causes an iptables rule to be inserted before this rule:
ACCEPT all -- anywhere anywhere ID:66773300 ctstate RELATED,ESTABLISHED
This makes all forwarded packets go through the BCP38 ipset match, which slows
down download speed from 440 Mbit/s to 340 Mbit/s.
Only apply BCP38 match rules if state is NEW.
Bump package version.
Signed-off-by: Török Edwin <edwin@skylable.com>
Bring back Subversion from oldpackages and update to the latest version.
Create prerm script to stop subversion server and remove init script
on uninstall.
Signed-off-by: Donald Rumata <donald.rumata@gmail.com>
Install more development files as those might be used by other software
depending on knot libraries. They are used for example by knot-resolver.
Signed-off-by: Michal Hrusecky <Michal.Hrusecky@nic.cz>
Introduce package for additional experimental scripts for sqm-scripts.
The target is to provide an opportunity to test QoS scripts and qdiscs
still under development. E.g. cake related scripts can be placed here
for testing.
sqm-scripts and luci-app-sqm will pick up the new scripts automatically.
Initially the package contains five cake-related scripts.
The package depends on the main sqm-scripts package.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
* new config option 'adb_restricted' to disable updates of the adblock
config during runtime (no flash writes, disabled by default)
* new update function, to apply latest configuration changes if needed
(/etc/init.d/adblock cfgup)
* fix dns redirect rule
* various optimizations
Signed-off-by: Dirk Brenken <dev@brenken.org>
If libuv is present within the build environment, aria2 will fail to build
with the following error:
LibuvEventPoll.cc: In member function 'virtual void aria2::LibuvEventPoll::poll(const timeval&)':
LibuvEventPoll.cc:144:59: error: invalid conversion from 'void (*)(uv_timer_t*, int) {aka void (*)(uv_timer_s*, int)}' to 'uv_timer_cb {aka void (*)(uv_timer_s*)}' [-fpermissive]
uv_timer_start(timer, timer_callback, timeout, timeout);
^
In file included from LibuvEventPoll.h:43:0,
from LibuvEventPoll.cc:44:
.../staging_dir/target-arm_xscale_musl-1.1.14_eabi/usr/include/uv.h:770:44: note: initializing argument 2 of 'int uv_timer_start(uv_timer_t*, uv_timer_cb, uint64_t, uint64_t)'
UV_EXTERN int uv_timer_start(uv_timer_t* handle,
^
Makefile:2271: recipe for target 'LibuvEventPoll.lo' failed
make[6]: *** [LibuvEventPoll.lo] Error 1
Explicitely disable the libuv support in `configure` to avoid picking up this
unwanted dependency.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Patch modified to resolve conflict caused by #2804
This closes#2776
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Assuming the following dns zone configuration for kresin.me:
. 1800 IN NS ns.inwx.de.
home.kresin.me. 1800 IN NS gw.home.kresin.me.
gw.home.kresin.me. 60 IN A 198.51.100.1
Using the example, gw.home.kresin.me is a glue record and used as DDNS
record as well. gw.home.kresin.me points to the OpenWrt installation
where the ddns-scripts are running.
Since ns.inwx.de isn't the authoritative server for home.kresin.me,
a query for the the A record of gw.home.kresin.me will be "forwarded"
to and replied by the authoritative server 198.51.100.1. If the
authoritative server can't be reached, the query times out without any
address returned.
The only way to get the A record of the glue record is to use bind
host in verbose output mode, query ns.inwx.de for gw.home.kresin.me and
evaluate the additional section of the response.
To my knowledge, only bind host in verbose output mode shows the
additional section of the response. Therefore, this features depends on
bind host.
It is not possible to use the bind host verbose mode for all queries.
In verbose mode the "has address" line isn't returned. Grepping for the
hostname might fail if the hostname is CNAME. Grepping for the first
occurrence of an ip-address is way to error prone, since it could
return the ip address of a different record type.
Signed-off-by: Mathias Kresin <dev@kresin.me>
ktutil_funcs.c: In function 'ktutil_delete':
ktutil_funcs.c:75:28: error: 'prev' may be used uninitialized in this function [-Werror=maybe-uninitialized]
Signed-off-by: John Crispin <john@phrozen.org>
Add back from oldpackages with fixes for build errors and UCIfication
(for LuCI app submitted in a related PR (against LuCI repo)).
NOTE: Untested packages have been marked with @BROKEN. This can
be undone of others report success with the sniffer
Signed-off-by: Daniel Dickinson <lede@daniel.thecshore.com>
If the liblz4 library exists within the build environment, the openconnect
configure will pick it up and start depending on it, leading to the following
build error:
Package openconnect is missing dependencies for the following libraries:
liblz4.so.1
Disable LZ4 support in configure in order to avoid this implicit,
nondeterministic dependency.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Mark the usbip package nonshared so that is built along with the target
specific binaries and not within the SDK environment.
This is needed since the usbip package draws its source files directly
from the kernel tree which is unavailable within the SDK.
Fixes the following build error encountered by the LEDE buildbots:
http://downloads.lede-project.org/snapshots/faillogs/mipsel_1004kc_dsp/packages/usbip/compile.txt
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
The most recent developer of netdiscover had self-hosted downloads
but also put the project on SourceForge. The self-hosted site went
down but SourceForge is much more reliable so I have moved the
download URI to SourceForge (md5sum is the same).
Signed-off-by: Daniel Dickinson <openwrt@daniel.thecshore.com>
- add DNS lookup support for "drill" and "khost" (Knot DNS) #2637
- new service nsupdate.info (IPv4 and IPv6) #2433
- new services dyndnss.net, dyns.net (IPv4 only)
- new services dnshome.de, goip.de, myonlineportal.net (IPv4 and IPv6)
Signed-off-by: Christian Schoenebeck <christian.schoenebeck@gmail.com>
* push gnurl, gnutls and libmicrohttpd dependencies down to modules
* use standard UID/GID for gnunet (958/958)
* use GID adjecent (452) to dnsmasq (453) for gnunetdns to allow
using the owner match with a range of GIDs (452-452)
* package new gnunet-social pub/sub CLI tool
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Fixes the following CVEs:
Bug 3020 / CVE-2016-1551: Refclock impersonation vulnerability, AKA: refclock-peering
Reported by Matt Street and others of Cisco ASIG
Bug 3012 / CVE-2016-1549: Sybil vulnerability: ephemeral association attack, AKA: ntp-sybil - MITIGATION ONLY
Reported by Matthew Van Gundy of Cisco ASIG
Bug 3011 / CVE-2016-2516: Duplicate IPs on unconfig directives will cause an assertion botch
Reported by Yihan Lian of the Cloud Security Team, Qihoo 360
Bug 3010 / CVE-2016-2517: Remote configuration trustedkey/requestkey values are not properly validated
Reported by Yihan Lian of the Cloud Security Team, Qihoo 360
Bug 3009 / CVE-2016-2518: Crafted addpeer with hmode > 7 causes array wraparound with MATCH_ASSOC
Reported by Yihan Lian of the Cloud Security Team, Qihoo 360
Bug 3008 / CVE-2016-2519: ctl_getitem() return value not always checked
Reported by Yihan Lian of the Cloud Security Team, Qihoo 360
Bug 3007 / CVE-2016-1547: Validate crypto-NAKs, AKA: nak-dos
Reported by Stephen Gray and Matthew Van Gundy of Cisco ASIG
Bug 2978 / CVE-2016-1548: Interleave-pivot - MITIGATION ONLY
Reported by Miroslav Lichvar of RedHat and separately by Jonathan Gardner of Cisco ASIG
Bug 2952 / CVE-2015-7704: KoD fix: peer associations were broken by the fix for NtpBug2901, AKA: Symmetric active/passive mode is broken
Reported by Michael Tatarinov, NTP Project Developer Volunteer
Bug 2945 / Bug 2901 / CVE-2015-8138: Zero Origin Timestamp Bypass, AKA: Additional KoD Checks
Reported by Jonathan Gardner of Cisco ASIG
Bug 2879 / CVE-2016-1550: Improve NTP security against buffer comparison timing attacks, authdecrypt-timing, AKA: authdecrypt-timing
Reported independently by Loganaden Velvindron, and Matthew Van Gundy and Stephen Gray of Cisco ASIG.
Signed-off-by: Peter Wagner <tripolar@gmx.at>
OpenWrt offers a special 'prelocal' routing table at priority 0.
Use it, so local-to-local DNS traffic also gets redirected properly.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
fwknop Makefile had two conffiles sections. Combine them.
Remove also the whitespace from conffiles section (see #2652)
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
The conffiles definition in Makefile should not contain leading whitespace.
Remove whitespace from Makefile of motion, dnscrypt-proxy and sstp-client.
Reference to discussion at #2652
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
* support more router modes, as long as the firewall and the DNS server
are enabled
* new source sites can be added & changed via awk ruleset in uci config
* source domain count, last update time & overall count will be stored
in uci config
* added 3 new source sites:
ransomware tracker
rolist/easylist
winspy
* switch to minimal inline base64 encoded 1×1 GIF for pixel server
(separate png image no longer needed)
* simplified uci parser
* source download & domain sort optimization
* add whitelist parser with wildcard support
* reduced code size & various cleanups
* updated documentation
Signed-off-by: Dirk Brenken <openwrt@brenken.org>
Create directory which was accidentally left-out during the previous
commit adding the proto handler.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
fixes bug in resolver logic which was exposed by recent fixes in
various C Standard libraries including musl.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
TARGET_CFLAGS was pointing to /usr/include/libnl3 instead
of $(STAGING_DIR)/usr/include/libnl3
Signed-off-by: Daniel Dickinson <openwrt@daniel.thecshore.com>
Signed-off-by: Jonathan McCrohan <jmccrohan@gmail.com>
[RELEASE] Released version 1.5.16
Released version 1.5.16 with the following main changes :
- BUG/BUILD: replace haproxy-systemd-wrapper with $(EXTRA) in install-bin.
- BUG/MINOR: acl: don't use record layer in req_ssl_ver
- BUG: http: do not abort keep-alive connections on server timeout
- BUG/MEDIUM: http: switch the request channel to no-delay once done.
- MINOR: config: extend the default max hostname length to 64 and beyond
- BUG/MEDIUM: http: don't enable auto-close on the response side
- BUG/MEDIUM: stream: fix half-closed timeout handling
- BUG/MEDIUM: cli: changing compression rate-limiting must require admin level
- BUILD: freebsd: double declaration
- BUG/MEDIUM: sample: urlp can't match an empty value
- BUG/MEDIUM: peers: table entries learned from a remote are pushed to others after a random delay.
- BUG/MEDIUM: peers: old stick table updates could be repushed.
- CLEANUP: haproxy: using _GNU_SOURCE instead of __USE_GNU macro.
- BUG/MINOR: chunk: make chunk_dup() always check and set dst->size
- MINOR: chunks: ensure that chunk_strcpy() adds a trailing zero
- MINOR: chunks: add chunk_strcat() and chunk_newstr()
- MINOR: chunk: make chunk_initstr() take a const string
- BUG/MEDIUM: config: Adding validation to stick-table expire value.
- BUG/MEDIUM: sample: http_date() doesn't provide the right day of the week
- BUG/MEDIUM: channel: fix miscalculation of available buffer space.
- BUG/MINOR: stream: don't force retries if the server is DOWN
- MINOR: unix: don't mention free ports on EAGAIN
- BUG/CLEANUP: CLI: report the proper field states in "show sess"
- MINOR: stats: send content-length with the redirect to allow keep-alive
- BUG: stream_interface: Reuse connection even if the output channel is empty
- DOC: remove old tunnel mode assumptions
- DOC: add server name at rate-limit sessions example
- BUG/MEDIUM: ssl: fix off-by-one in ALPN list allocation
- BUG/MEDIUM: ssl: fix off-by-one in NPN list allocation
- BUG/MEDIUM: stats: stats bind-process doesn't propagate the process mask correctly
- BUG/MINOR: http: Be sure to process all the data received from a server
- BUG/MEDIUM: chunks: always reject negative-length chunks
- BUG/MINOR: systemd: ensure we don't miss signals
- BUG/MINOR: systemd: report the correct signal in debug message output
- BUG/MINOR: systemd: propagate the correct signal to haproxy
- MINOR: systemd: ensure a reload doesn't mask a stop
- CLEANUP: stats: Avoid computation with uninitialized bits.
- CLEANUP: pattern: Ignore unknown samples in pat_match_ip().
- CLEANUP: map: Avoid memory leak in out-of-memory condition.
- BUG/MINOR: tcpcheck: conf parsing error when no port configured on server and last rule is a CONNECT with no port
- BUG/MINOR: tcpcheck: fix incorrect list usage resulting in failure to load certain configs
- MINOR: cfgparse: warn when uid parameter is not a number
- MINOR: cfgparse: warn when gid parameter is not a number
- BUG/MINOR: standard: Avoid free of non-allocated pointer
- BUG/MINOR: pattern: Avoid memory leak on out-of-memory condition
- CLEANUP: http: fix a build warning introduced by a recent fix
- BUG/MINOR: log: GMT offset not updated when entering/leaving DST
Signed-off-by: heil <heil@terminal-consulting.de>
On some systems too many retries with authentication failure results
in IP or username being locked out, so add option to prevent retries
in the event of authentication failure
Signed-off-by: Daniel Dickinson <openwrt@daniel.thecshore.com>
The contents of the file "db.root" is very old (12 years).
Here's a new version downloaded from ftp://ftp.internic.net/domain/
Signed-off-by: DonkZZ <donk@evhr.net>
This adds one patch from the upcoming 0.10.2 release to exclude Avahi/DNS-SD from build time
detection and properly adds liblo as a dependency.
Signed-off-by: Christian Beier <dontmind@freeshell.org>
The "internal pure-C" tor-fw-helper was removed in 0.2.7.5. This removes
the tor-fw-helper package and references to its dependencies.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
$(CP) was defined as `cp -fpR' since the very begining of OpenWrt build
system (2006-06-22). The -R option should be enough and base packages
use only $(CP) for the same purposes just fine and BSD manual of cp also
discourages the use of `-r' option. So let's just tidy up the usage now.
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* add sysctl.org as new adblock source
* add main debug switch (by default all stderr outputs are going to
/dev/null)
* small cleanups
* first 'stable' release! ;-)
Signed-off-by: Dirk Brenken <openwrt@brenken.org>
This should always have been available in the mosquitto package itself.
This file needs to exist in basic form to allow the init scripts to even check whether it exists.
Signed-off-by: Karl Palsson <karlp@etactica.com>
Instead of manually copying files and renaming on install, use the nice
clean "files/<mirror>" structure and just $(CP) them into place.
Signed-off-by: Karl Palsson <karlp@etactica.com>
Change the git repository url to use https. Because it's found that in
some network environments http doesn't work.
Signed-off-by: Zhao, Gang <gang.zhao.42@gmail.com>
- roll back to "old" update_url of freedns.afraid.org fix for #2445 and openwrt/luci#661
- add provider nubem.com (IPv4 only)
- add provider nettica.com (IPv4 only)
- add provider zerigo.com (IPv4 and IPv6)
- add provider regfish.de (IPv4 and IPv6)
Signed-off-by: Christian Schoenebeck <christian.schoenebeck@gmail.com>
* all relevant adblock events will be properly written to syslog/stdout
* removed needless 'debug log' option
* add optional parm 'adb_forcedns' to redirect all queries to local
resolver (default: '1', enabled)
* revised space check
* various code cosmetics & cleanups
Signed-off-by: Dirk Brenken <openwrt@brenken.org>
new packages: gnunet-rest, gnunet-rps, gnunet-social
also improve package descriptions and maintain order
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* fix ip6tables reject types
* simplified firewall ruleset for IPv4/IPv6
* fix memory detection (swap was always 0)
* fix dnsmasq restart after partial restore
* ad hotplug support, adblock will be started when wan interface comes
up
* change adblock init script accordingly, do nothing on 'boot'
* optimize wget parameters for faster download results (in case of an
error)
* added CC installation notes to readme
* removed needless external online check
* removed needless optional parms 'adb_maxtime', 'adb_maxloop',
'adb_probeipv4' and 'adb_probeipv6'
Signed-off-by: Dirk Brenken <openwrt@brenken.org>
When applying wireless configuration changes, the ifindex of the
wireless interface(s) change. While snmpd picks up the new interfaces
with the correct index, it does not remove the old ones:
IF-MIB::ifName.23 = STRING: wlan0
IF-MIB::ifName.24 = STRING: wlan1
IF-MIB::ifName.25 = STRING: wlan0
IF-MIB::ifName.26 = STRING: wlan1
This causes problems for monitoring tools that use ifName (or ifDesc) as
interface reference. Add a trigger that reloads snmpd on interface
up/down events so that it will no longer have the old interfaces.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Update to 0.9.10 due to https://prosody.im/issues/issue/585
The init script seems to block, as "prosodyctl start" started to block
at least on my configuration. I switched to a procd init script, which
deals with blocking processes.
Signed-off-by: Stefan Hellermann <stefan@the2masters.de>
Add uci option mppe which makes the mppe parameter configurable;
the default value is required,no40,no56,stateless as before.
Add uci option logwtmp; when enabled updates wtmp when users
connect and disconnect
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* fix root cause for https timeout issues
* fix startup issues via luci
* detach init start process to fix luci timeout issues
* fix html header in adblock pages
* fix adblock.conf options to single quotes
Signed-off-by: Dirk Brenken <openwrt@brenken.org>
* openwrt init system support, see /etc/init.d/adblock
* support for two new adblock sources: openphish and ruadlist/easylist
* partial block list restore, i.e. if a single list download failed
* fix performance regression on sites with links to https ad servers
* removed no longer used samples dir
* updated documentation
Signed-off-by: Dirk Brenken <openwrt@brenken.org>
- renamed (lower case) filenames and servicenames for no-ip.com, cloudflare.com and bind_nsupdate including modifing existing configurations #2375
- updated tld_names.dat
Signed-off-by: Christian Schoenebeck <christian.schoenebeck@gmail.com>
- fix build error reported by buildbot by disabling krb5
- libcom_err from krb5 is used - configure output:
configure: WARNING: library 'com_err' is required for Heimdal Kerberos
- krb5 has its own libcom_err (see krb5 package) with its own symbols
- linking with wrong libcom_err from libext2fs produces errors during
libgssapi_krb5.so: undefined reference to `error_message@com_err_3_MIT'
libgssapi_krb5.so: undefined reference to `remove_error_table@com_err_3_MIT'
libgssapi_krb5.so: undefined reference to `add_error_table@com_err_3_MIT'
-> remove libext2fs dependency (wasnt working anyway - no PKG_BUILD_DEP)
Signed-off-by: Dirk Neukirchen <dirkneukirchen@web.de>
* upstream to Privoxy 3.0.24
* add facility to set compile options
* add file list to be saved on sysupgrade
* fixed PKG_MAINTAINER string
* add port 8118 used by privoxy to /etc/services
* new "boot_delay" option (default 10 seconds) to wait for interfaces to come up before hotplug restarts are enabled
Signed-off-by: Christian Schoenebeck <christian.schoenebeck@gmail.com>
- new function expand_ipv6()
- expand IPv6 before compare https://dev.openwrt.org/ticket/21725
- Fix split_FQDN() to return host.subdomain correctly #2334
- modified check for musl library used by nslookup #2341#2346 thanks to Arjen de Korte
Signed-off-by: Christian Schoenebeck <christian.schoenebeck@gmail.com>
- fix possible race condition during startup
- fix duplicate logging during startup
- fix wget parms to prevent partitial downloads
- fix iptables rules to meet openwrt user chains
- added a rule in output chain to reject local ad related requests as
well
- changed default IPv4/IPv6 blackhole ip address to fix routing issues
with windows clients
Signed-off-by: Dirk Brenken <openwrt@brenken.org>
Use libevent2 instead of libevent
Update copyright to 2016
Bump PKG_RELEASE due to package changes
Signed-off-by: Daniel Engberg <daniel.engberg.lists@pyret.net>
As said in a related github discussion thread [1], OpenWrt is so small a
system that
- "airmon-ng check kill" does not have much to check
- airmon-ng takes up too much space for not that much benefit (bringing
up monitor interface with just iw should be enough for at least b43
and ath9k drivers)
Airmon-ng depends on a lot of utility binaries to run and these
dependencies increase the installation size. With this commit we can
provide a working airmon-ng and a smaller aircrack-ng package.
Dependency spec of airmon-ng is also reworked to
- select usbutils only if USB feature is available
- select pciutils only if PCI feature is available
While doing the split, this commit also contains a few other minor
changes
- Use SPDX identifier for license name.
- Add PKG_LICENSE_FILES definition.
- Set PKG_MAINTAINER (MAINTAINER variable will take value from it).
[1] https://github.com/openwrt/packages/pull/1693
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* "zero-conf" installation & setup, usually no manual config changes
required (i.e. ip address, network devices etc.)
* full IPv4 and IPv6 support
* new adblock list source (malwaredomainlist.com)
* adblock related statistics will be done by iptables
* removed curl dependency
* for IPv6 support you need 'kmod-ipt-nat6'
* fix Chaos Calmer compability
* various small changes & fixes
* updated documentation
* updated maintainer email address
Signed-off-by: Dirk Brenken <dirk@brenken.org>
- [PATCH 11/13] BUG/MEDIUM: peers: table entries learned from a remote
- [PATCH 12/13] BUG/MEDIUM: peers: old stick table updates could be
- [PATCH 13/13] CLEANUP: haproxy: using _GNU_SOURCE instead of
Signed-off-by: heil <heil@terminal-consulting.de>
fixes:
* path traversal vulnerability in mod_http_files (CVE-2016-1231)
* use of weak PRNG in generation of dialback secrets (CVE-2016-1232)
Signed-off-by: heil <heil@terminal-consulting.de>
- add support for "hostip" to get_registered_ip() as alternative to "Bind host" package https://dev.openwrt.org/ticket/20893#comment:5
- allow to send updates using compiled-in certificate file/path of curl/wget #2242#2243#2245
- add support for uclient-fetch / libustream-ssl.so
- remove /128 prefix-filter in get_local_ip() via interface #2268
- add dyndns.org to services_ipv6 https://forum.openwrt.org/viewtopic.php?id=62103
- readd duckdns.org to services #2251 (lost somewhere in data heaven)
- add zzzz.io service #2302
- updated tld_names.dat
Signed-off-by: Christian Schoenebeck <christian.schoenebeck@gmail.com>
Import cifs-utils from old packages:
* update to 6.4
* add upstream patch to fix builds with musl
* add license information
* add myself as maintainer
Signed-off-by: Florian Fainelli <florian@openwrt.org>
Building both variants improperly tried to include the passwd utility
for the non-ssl variant, as the variable was set for the ssl variant.
Use properly separated install tasks to install additional files, rather
than hacking around inside the single target.
Signed-off-by: Karl Palsson <karlp@remake.is>
Linuxptp is a user space software implementation of IEEE 1588
Precision Time Protocol standard.
Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik@neratec.com>
Reviewed-by: John Crispin<blogic@openwrt.org>
Many users of the SSL build of mosquitto need the passwd utility for
managing keys.
Fixes github issue #1909
Signed-off-by: Karl Palsson <karlp@remake.is>
This is necessary when there are multiple records for the same domain,
otherwise the script will overwrite the first one returned by the API.
It has the secondary benefit of allowing faster updates by performing
only one API call instead of two.
In case 'rec_id' is not set the script behaves exactly as before.
Signed-off-by: Leonardo Brondani Schenkel <leonardo@schenkel.net>
Signed-off-by: Patrick Grimm <patrick@lunatiki.de>
Acked-by: Othmar Truniger <github@truniger.ch>
[Squashed patches from PR into single one, bump PKG_RELEASE]
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
I guess these were left since some initial OVS package versions.
They were fine up until recently.
Some of the build artifacts got a little messy and thus the
OpenWRT OVS package got a little messy.
This cleans it up a bit.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* upstream to Radicale 1.1
* new "boot_delay" option (default 10 seconds) to wait for interfaces to come up before hotplug restarts are enabled.
Signed-off-by: Christian Schoenebeck <christian.schoenebeck@gmail.com>
Most patches for 4.1 are no longer needed, only a minor patch to fix a
missing WAIT_ANY constant. 2.5.0 depends on nf_conntrack (ipv4 and ipv6)
Signed-off-by: Jeroen van Bemmel <jvb127@gmail.com>
Added dy.fi dynamic dns provider into ddns-scripts (ipv4) services file.
Tested-by: Vaasa Hacklab ry <info@vaasa.hacklab.fi>
Signed-off-by: Sami Olmari <sami@olmari.fi>
Whenever we ship fixed libopenssl binaries in DD, the Freeradius daemon fails
at startup because it detects a mismatch of the build time and runtime OpenSSL
version.
Since our OpenSSL updates for DD are ABI compatible we do not need or even want
this superflous check. Removing it saves us the effort to rebuild Freeradius
after every OpenSSL version bump.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
Added dy.fi dynamic dns provider into ddns-scripts (ipv4) services file.
Tested-by: Vaasa Hacklab ry <info@vaasa.hacklab.fi>
Signed-off-by: Sami Olmari <sami@olmari.fi>
https://rsync.samba.org/security.html#s3_1_2:
If you're using a version of rsync older than 3.1.2 as a client and
receiving files from an rsync server that you might not fully trust,
this version adds extra checking to the file list to prevent the sender
from tweaking the paths and/or the transfer requests in a way that could
cause a file to be received outside the transfer destination.
Signed-off-by: Maxim Storchak <m.storchak@gmail.com>
Fix iptables issue where a needed ipset was not created if first wan that came online was not a member of policy.
Signed-off-by: Jeroen Louwes <jeroen.louwes@gmail.com>
Fix for #2116 - $INTERNAL_IP{4,6}_DNS variables are not word-split correctly when containing more than one DNS server.
Signed-off-by: Aleksandar Radovanovic <biblbroks@sezampro.rs>
Probably related to -fstack-protector being used.
Got the idea from:
http://ubuntuforums.org/showthread.php?t=352642&p=10100263#post10100263
Regarding the missing __stack_check_fail_local, using gcc as the linker instead of ld fixes the issue without disabling stack protection as with -fno-stack-protector.
Fixes linker errs on some targets:
objects/prod/dnssd_clientstub.c.so.o: In function `handle_resolve_response':
dnssd_clientstub.c:(.text+0x395): undefined reference to `__stack_chk_fail_local'
objects/prod/dnssd_clientstub.c.so.o: In function `handle_query_response':
dnssd_clientstub.c:(.text+0x4bd): undefined reference to `__stack_chk_fail_local'
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
Fix issue with sticky sessions not working correctly
Fix issue where user created ipsets were not applied
Signed-off-by: Jeroen Louwes <jeroen.louwes@gmail.com>
* add two new blocklist sources: adaway.org and disconnect.me
* each blocklist source will be processed separately (no longer use one
big monolithic adblocklist), duplicates makes no harm to dnsmasq
* url timestamp check to download and process only updated blocklists
* overall duplicate removal in separate blocklists (will be
automatically disabled on low memory systems)
* additional checks & various small changes
Signed-off-by: Dirk Brenken <dirk@brenken.org>
Update wget to version 1.17.1.
Remove patches as they are included upstream.
Changes in Wget 1.17.1
* Fix compile error when IPv6 is disabled or SSL is not present.
* Fix HSTS memory leak.
* Fix progress output in non-C locales.
* Fix SIGSEGV when -N and --content-disposition are used together.
* Add --check-certificate=quiet to tell wget to not print any warning
about invalid certificates.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Version 1.13.3 has a tar.gz so the OpenWRT default Build/Prepare
rule can be used with MD5 checksum.
Add patch to fix build:
ktutil_funcs.c: In function 'ktutil_delete':
ktutil_funcs.c:75:28: error: 'prev' may be used uninitialized in this function [-Werror=maybe-uninitialized]
prev->next = lp->next;
There does not seem to be a way for 'prev' being uninitialized
(logically), however the compiler does not see that, because
'prev' is dependent on i >= 1.
So, we just need to initialize it to NULL.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
Reported buildbot issue is:
/store/buildbot/slave/ar71xx/build/build_dir/target-mips_34kc_musl-1.1.11/ola-0.9.7/plugins/openpixelcontrol/.libs/libolaopenpixelcontrol.so: undefined reference to `ola::network::TCPSocket::ReadDescriptor() const'
collect2: error: ld returned 1 exit status
There's also a discussion (attempt) to fix this on the buildroot project:
https://patchwork.ozlabs.org/patch/503884/
This bug has been reported (from the buildroot project), here:
https://github.com/OpenLightingProject/ola/issues/880
This commit introduced the issue:
bfc1d99055
specifically the `-fvisibility-inlines-hidden` switch.
So, until, the upstream project (ola) fixes this, this fix
looks like the quickest/simplest workaround to have this package build.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
This changeset removes the shell wrapper the package used previously,
and uses the instance-management abilities of procd to track ssh
processes. Many fixes and improvements were integrated from the
package maintainer's branch at
https://github.com/nunojpg/packages/tree/sshtunnel
Signed-off-by: Kiril Zyapkov <kiril.zyapkov@gmail.com>
Seems ntpdate also requires this lib:
```
Package ntpdate is missing dependencies for the following libraries:
libcap.so.2
make[2]: *** [/store/buildbot/slave/ar71xx/build/bin/ar71xx/packages/packages/ntpdate_4.2.8p4-1_ar71xx.ipk] Error 1
make[2]: Leaving directory `/store/buildbot/slave/ar71xx/build/feeds/packages/net/ntpd'
```
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
gnunet's config section may contain dashes '-' which isn't an
allowed character for sections in UCI.
Thus replace the first underscore with a dash which in gnunet-config
sections, as that happends to be work for all currently used sections.
e.g. this now allows accessing sections like transport-http_server via
an UCI sections called transport_http_server as well as namestore-flat
using an UCI section called namestore_flat.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
some general packaging fixes for cadet and conversation.
allow building experimental components multicast, psyc, social.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Main changes are as the following
- Allow specifying port in server option, e.g. example.com:1702 (fixes
github issue #1960 "xl2tpd port change bug").
- Fixes NULL dereference on connection timeout
- Update 100-makefile_opt_flags.patch
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
See https://wiki.strongswan.org/issues/1213
Removed the changes to charon-xpc.c because they didn't apply and are
only used on OS X anyway.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
OpenWrt trunk's lowest supported GCC version is 4.8, so we don't need
to depend on specific versions anymore. Fixes visibility with GCC 5,
the current default.
Signed-off-by: Jonas Gorski <jogo@openwrt.org>
* rework shallalist processing: significantly reduce memory consumption
during archive extraction and merging.
* considerable reduce memory consumption during adblock source
processing.
* considerable reduce memory consumption of sort (sorts only the domain
list and not the bigger dnsmasq file)
other changes:
* auto detection/defaults for adb_if, adb_dev, adb_ntpsrv, adb_maxloop,
adb_maxtime and adb_minspace - these options can be safely removed from
previous adblock configuration file
* check total memory and main uhttpd configuration on startup
* documentation update
Signed-off-by: Dirk Brenken <dirk@brenken.org>
- centralized logging via separate function to stdout, syslog and file
- remove dependencies between helper functions
- add two new options "adb_maxtime" and "adb_maxloop"
- add description to every adblock config option (see
adblock.conf.sample)
- update README.md
Signed-off-by: Dirk Brenken <dirk@brenken.org>
Pingcheck is a daemon for OpenWRT which checks the online status of individual
network interfaces and makes this information available via UBUS and by
triggering "online" and "offline" scripts.
It is maintained at: https://github.com/br101/pingcheck
Signed-off-by: Bruno Randolf <br1@einfach.org>
gmpdh plugin implements DH Groups (same as normal GMP plugin), but links to GMP statically and is stripped of all RSA based stuff. Binary size for plugin is ~20kbytes with no dependency on libgmp (200+ kbytes after squash), easilly fitting into flash space restricted devices.
strongswan-isakmp metapackage defines a minimal set of strongswan plugins (including gmpdh) for ISAKMP / IKEv1 PSK tunnels. Will fit even 4mb routers (like tplink wr841n) with disabled IPv6 support and packages (so its a trade - IPv6 or ipsec tunnels).
Signed-of-by: Mikalai Miadzvedz <brainsucker.na@gmail.com>
- fix the init script to read the right config
- rework the init script to allow reusing its code in the hotplug script
- find wan interfaces in the hotplug script instead of using hardcoded
name and set the online/offline status separately for IPv4/IPv6
- allow NTP access on interfaces that are configured after chronyd start
- add NTP servers obtained from DHCP, options are specified in a new
dhcp_ntp_server config section
- start chronyd before the network service, include a patch to always
have IP_FREEBIND defined, which seems to be missing with uclibc
Signed-off-by: Miroslav Lichvar <mlichvar0@gmail.com>
Update rtorrent to 0.9.6.
Update patches.
Disable ipv6 in rtorrent, as ipv6 is disabled also in libtorrent.
Libtorrent compilation has been broken since #1181 got merged
and ipv6 got enabled. Users have seen issues like #1316 and #1804
IPv6 support in libtorrent & rtorrent master is not complete.
Instead there is a separate ipv6 branch, which still needs some
cleanup before mainstream use. See discussion at
https://github.com/rakshasa/rtorrent/issues/59#issuecomment-56651538
So, it makes no sense to use ipv6 with the master branch.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
bugfix: busybox "tr" does not support character classes by default and
generates (partly) odd domain names.
Signed-off-by: Dirk Brenken <dirk@brenken.org>
* add uci support
* add dynamic uhttpd instance support
(no longer rely on uhttpd config changes)
* package reordering
* plus various fixes
Signed-off-by: Dirk Brenken <dirk@brenken.org>
- add -V / --version parameter to show version information
- new option lookup_host as host to use by nslookup/host to validate IP address changes, to be separate from [DOMAIN] parameter which produces a lot of questions in the forum and on multi-host updates
- new option param_enc for optional usage inside update_url [PARAMENC] (will be send urlencoded)
- new option param_opt for optional usage inside update_url [PARAMOPT]
- new service strato.de (IPv4 only) requested by ludwig.jaffe@
- new service variomedia.de (IPv4 & IPv6) requested by Wolfgang Oertl #1884
- rewritten function get_service_data to read services/service_ipv6 file
- allow 3rd parameter inside services/service_ipv6 file - here should be the answer of the ddns provider on success. If parameter is set, it's checked by ddns-scripts and report errors to logfile/syslog if failed and retry
- updated tld_names.dat
Signed-off-by: Christian Schoenebeck <christian.schoenebeck@gmail.com>
make defconfig (or feeds update) raised following error for fossil
package on Ubuntu 14.04 LTS with GNU Make 3.81:
Makefile:47: *** missing separator. Stop.
To fix this, empty blocks are now defined instead of using undefine
directive which was added in GNU Make 3.82.
Signed-off-by: Jan Čermák <jan.cermak@nic.cz>
While at it, also do the following fixes
- Drop the URL pointing to the old github repo
- Fix detection of default set of private keys
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
In this bump as agreed with Thomas we are dropping out all the nginx 3rd party
addons. In case you would like to see your 3rd party addon included please send
a pull request and make sure it works with newest version.
Signed-off-by: Luka Perkov <luka@openwrt.org>
caught on build-bot:
make -C /store/buildbot/slave/ramips/build/build_dir/target-mipsel_24kec+dsp_musl-1.1.11/linux-ramips_rt305x/linux-3.18.21 M=/store/buildbot/slave/ramips/build/build_dir/target-mipsel_24kec+dsp_musl-1.1.11/openvswitch-2.4.0/datapath/linux modules
make[7]: Entering directory `/store/buildbot/slave/ramips/build/build_dir/target-mipsel_24kec+dsp_musl-1.1.11/linux-ramips_rt305x/linux-3.18.21'
Makefile:610: arch/mipsel/Makefile: No such file or directory
Declare LINUX_KARCH to package's build-system to resolv this.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
This brings IoTivity to version 1.0.0. The patches removed by this
commit are merged upstream now. There are some new patches needed for
new problems with Big Endian CPUs and also for musl. The plugin manager
was removed in upstream IoTivity 1.0.0.
Signed-off-by: Hauke Mehrtens <hauke.mehrtens@lantiq.com>
* Updates wifidog to latest upstream release.
* Removes patches/100-musl-compat.patch as that's included in 1.3.0
Signed-off-by: Michael Haas <haas@computerlinguist.org>
Hard-coded location of ip (/usr/bin/ip) in controller file
Added space after "for" in .htm files to clean it up
signed-off-by: Aedan "ARFETT" Renner <chipdankly@gmail.com>
The initscript originally imported from oldpackages no longer does
the job, sed'ery around ifconfig is just not the way.
Remove stuff which can also be done via /etc/freeradius2/* or
/etc/default/radiusd instead.
Fixes#1769 and #1193
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Support for authentication with command key was replaced with
communication over Unix domain socket.
Signed-off-by: Miroslav Lichvar <mlichvar0@gmail.com>
Remove files that were accidentally included in the previous merge
(pull request #1802). The obsolete patches are breaking the build now.
Signed-off-by: Miroslav Lichvar <mlichvar0@gmail.com>
A typo in the init file was causing a certain setting to be overwritten on every daemon start.
Signed-off-by: Jonathan Bennett <JBennett@incomsystems.biz>
Headers are required by collectd as mentioned in #1801. This is the nut portion based on dwmw2@d636841cd1d1dfab04cb509520c082738ddfb2ea
Happy to merge with 15.05 as per #1803.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
[martin.p.rowe@gmail.com: condensed InstallDev lines]
Added package nut-web-cgi based on demorfi@7e340f47944ff4a9c49d3b1dc6c1d9d965cd344c. Closes#1614.
Pending signoff by @demorfi
[martin.p.rowe@gmail.com: simplified implementation, no changes to Config.in]
Added package nut-avahi-service similar to other implementations in #618
Bugfix to remove redundant NUT_DRIVER_SERIAL config
Bugfix to make UPSLOG config actually install (requires PKG_RELEASE bump)
Some code tidy-ups
Signed-off-by: Martin Rowe <martin.p.rowe@gmail.com>
The update is mainly for addressing some memory corruption and segementation
faults issues observed when running xl2tpd in OpenWrt. The relevant upstream
pull request was at link [1]
[1] Devel fix valgrind #77, https://github.com/xelerance/xl2tpd/pull/77
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
u²pnpd announces a device as UPnP basic device on the
network so that an user could easily find it. It tries
to detect various system information automatically, however
everything can be overridden by UCI settings.
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
Use gettext-version PKG_FIXUP to install up-to-date gettext
infrastructure. autoreconf is still run implicitely as well.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Source homepage has changed, and sources are updated to version 1.1.1
released 25 August 2015.
Patch adjtimex still applies.
Changes in version 1.1.1:
- Fixed out of bound issue and a missing null-terminated string (thanks
to Tobias Stöckmann)
Signed-off-by: Tijs Van Buggenhout <tvbuggen@netzerk.be>
- [PATCH 05/13] BUG/MINOR: http/sample: gmtime/localtime can fail
- [PATCH 06/13] DOC: typo in 'redirect', 302 code meaning
- [PATCH 07/13] DOC: mention that %ms is left-padded with zeroes.
- [PATCH 08/13] CLEANUP: .gitignore: ignore more test files
- [PATCH 09/13] CLEANUP: .gitignore: finally ignore everything but what
- [PATCH 10/13] MEDIUM: config: emit a warning on a frontend without
- [PATCH 11/13] BUG/MEDIUM: counters: ensure that src_{inc,clr}_gpc0
- [PATCH 12/13] DOC: ssl: missing LF
- [PATCH 13/13] DOC: fix example of http-request using
Signed-off-by: heil <heil@terminal-consulting.de>
Adds init.d and config files for nbd-client. Each section holds
parameters of one block device, where section name (eg. nbd0) is NBD
device name.
Signed-off-by: Marcin Jurkowski <marcin1j@gmail.com>
Network block device server allows to export a block device from router
to remote host. This is particularly useful if no network filesystem
server is feasible or direct access to a block device is needed.
It's been tested for nearly a month on ar71xx (TL-WR842ND) and proved to
be very stable and efficient solution.
The package comes with init.d script and conf.d file allowing to
configure most nbd-server options using standard uci interface.
Signed-off-by: Marcin Jurkowski <marcin1j@gmail.com>
Makes kmod-ipsec6 requirement dependent on IPv6 support for packages.
This allows to disable unnecessary IPv6 kernel modules, saving
considerable amount of space.
Signed-off-by: Marcin Jurkowski <marcin1j@gmail.com>
This brings IoTivity to version 0.9.2 in addition it does the following:
* split C and C++ Stack into two packages
* backport some patches which are adding missing dependencies to the shared libs
* remove patches merged upstream
* add some other patches fixing some problems, most of them are already merged upstream
* activate security and logging support
Signed-off-by: Hauke Mehrtens <hauke.mehrtens@lantiq.com>
Enables bind to do ECDSA DNSSEC validation. Depends on OpenSSL support
for ECDSA. Increases size of bind-libs package by about 2kB.
Signed-off-by: Janusz Dziemidowicz <rraptorr@nails.eu.org>
Without this, produces an error :
<code>/etc/rc.common: line 1: contentscannertimeout:uinteger: not found
validation failed
/etc/rc.common: line 1: contentscannertimeout:uinteger: not found</code>
Signed-off-by: Julien Paquit julien@databeille.com
- Update copyright year.
- Add PKG_LICENSE:=GPL-2.0 from the Google Code project page.
- Add autoreconf as the PKG_FIXUP method.
- Add myself as the package maintainer.
- Add a patch to fix building with musl-libc.
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
When only strongswan-minimal is selected, libtls.so will not be built
yet package strongswan will still try to copy the file causing build
failure.
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
Update vsftpd to 3.0.3 released in July 2015.
Changelog: https://security.appspot.com/vsftpd/Changelog.txt
Release blog: http://scarybeastsecurity.blogspot.fi/2015/07/vsftpd-303-released-and-horrors-of-ftp.html
- Increase VSFTP_AS_LIMIT to 200MB; various reports.
- Make the PWD response more RFC compliant; report from Barry Kelly
<barry@modeltwozero.com>.
- Remove the trailing period from EPSV response to work around BT Internet
issues; report from Tim Bishop <tdb@mirrorservice.org>.
- Fix syslog_enable issues vs. seccomp filtering. Report from Michal Vyskocil
<mvyskocil@suse.cz>. At least, syslogging seems to work on my Fedora now.
- Allow gettimeofday() in the seccomp sandbox. I can't repro failures, but I
probably have a different distro / libc / etc. and there are multiple reports.
- Some kernels support PR_SET_NO_NEW_PRIVS but not PR_SET_SECCOMP, so handle
this case gracefully. Report from Vasily Averin <vvs@odin.com>.
- List the TLS1.2 cipher AES128-GCM-SHA256 as first preference by default.
- Make some compile-time SSL defaults (such as correct client shutdown
handling) stricter.
- Disable Nagle algorithm during SSL data connection shutdown, to avoid 200ms
delays. From Tim Kosse <tim.kosse@filezilla-project.org>.
- Kill the FTP session if we see HTTP protocol commands, to avoid
cross-protocol attacks. A report from Jann Horn <jann@thejh.net>.
- Kill the FTP session if we see session re-use failure. A report from
Tim Kosse <tim.kosse@filezilla-project.org>.
(vsftpd-3.0.3pre1)
- Enable ECDHE, Tim Kosse <tim.kosse@filezilla-project.org>.
- Default cipher list is now just ECDHE-RSA-AES256-GCM-SHA384.
- Minor SSL logging improvements.
- Un-default tunable_strict_ssl_write_shutdown again. We still have
tunable_strict_ssl_read_eof defaulted now, which is the important one to prove
upload integrity.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Several patches here and pull requests at the upstream github project
page were merged into the devel branch. Switch to that until the next
stable release.
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
This change aims to address the following 2 issues
- The control file was there yet xl2tpd process was not
- The control file's existence prevented xl2tpd from start
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
L2TP with xl2tpd has no proto_task in the context of netifd and because
of this there is no valid $ERROR to check for when doing tearing down.
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
sqm-scripts and luci-app-sqm now live in the same Makefile and are built
from the upstream git repository, rather than having the files included
here.
Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* 010_fix_getnameinfo.patch is no longer needed
* 011-cron-without-pthread-fix.patch added, fixes incorrect
ifdef when building without pthreads
Signed-off-by: Michael Haas <haas@computerlinguist.org>
Fixes regression already fixed in oldpackages commit
012eec3f60a24db1a568d64868a48ea95aedcc87
but re-introduced in commit 6636e13f2ab8992d4eb03a48919ae9ae8da98cee.
This patch also enables IPv6 support.
Signed-off-by: Ondřej Caletka <ondrej@caletka.cz>
being based on curl 0.70.0 gnurl is affected by
CVE-2015-3144
CVE-2015-3145
CVE-2015-3153
CVE-2015-3236
Import patches from curl package to fix that.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* always re-create config-file when service is started
* use /lib/upgrade/keep.d instead of /etc/sysupgrade.conf sed'ery
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* add gnunet-vpn binary, it was missing
* clean-up -datastore, it contained files already packaged in -mysql
* remove gnunet-import-gns.sh from -utils, it can live in -gns
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
ntripcaster developer agency (http://igs.bkg.bund.de/) no longer provides sources for download.
Created a github repository to provide sources and allow contributions.
Fixed install location for configuration files.
Signed-off-by: Nuno Goncalves <nunojpg@gmail.com>
ntripserver developer agency http://igs.bkg.bund.de/ does not reliably provide a source mirror with version naming.
Created a github repository to provide sources and allow contributions.
Signed-off-by: Nuno Goncalves <nunojpg@gmail.com>
ntripclient developer agency http://igs.bkg.bund.de/ does not reliably provide a source mirror with version naming.
Created a github repository to provide sources and allow contributions.
Signed-off-by: Nuno Goncalves <nunojpg@gmail.com>
simple.qos had accidentally set up the egress shaper twice, once
with the true egress parameters and a second time using the ingress
parameters, effectively misconfiguring both directions. This bub
only affected situations where 3-tier ingress classification was
used.
Signed-off-by: Sebastian Moeller <moeller0@gmx.de>
sqm_logger tried tro wait indefinitely if passed an empty string.
This in turn makes sqm-scripts hang. Quoting the input argument in sqm_logger
seems to fix the problem.
Signed-off-by: Sebastian Moeller <moeller0@gmx.de>
The last batch of changes tried to teach the GUI to pass link layer
options to cake but forgot to actually call the function that parses
the GUI variables and used it as a string insteead. So this fixes that
it also tries to allow the use of the tc_stab link layer adjustment
method with cake so the implementations can be validated against each other
easily. Needs testing...
Signed-off-by: Sebastian Moeller <moeller0@gmx.de>
The cake traffic-shaper qdisc omne stop solution knows how to handle
link layer adjustments for ATM and can account for per packet overhead.
This commit adds cake as link layer adjustment mechanism in the GUI and
passes numerically specified overhead as well as the ATM linklayer
keywords on to cake. This change also passes the "advanced option strings"
from the Queue Discipline tab to cake. But as before no error checking.
This needs testing, as I have no working cake qdisc available so
caveat emptor...
Signed-off-by: Sebastian Moeller <moeller0@gmx.de>
Make clear that configuration options guarded by checkboxes are only
effective as long as those boxes are checked.
The sqm gui has giarded some advanced configuration options behind exposing
checkboxes, meaning these optiopn's values were only used as long
as those boxes were checked. This commit just improves the description of
the checkboxes to included this useage instruction...
Signed-off-by: Sebastian Moeller <moeller0@gmx.de>
The SQM gui has confused its users with an enable button, that only served to
selecively activate/de-activate sqm instances instead of controlling sqm's
initscript (which needs to be enabled so the sqm properly starts up after a reboot
and also for hotplug to work properly). luci-app-sqm will now enable sqm's
initscript when a single sqm instance get enabled. It also informs the user about
this fact in the top margin of the sqm page. Note sqm will not disable the
initscript behind the user's back if sqm instances get disabled.
While I would have prefered this notice to be more prominent an attentive user
should notice, and most users should not care anyway. This also increases the
package release number.
Signed-off-by: Sebastian Moeller <moeller0@gmx.de>
Backport upstream commit 3aefaf3 which allows sslh to be built without
libpcre support. This was brought about by the move to musl which
doesn't support the non-POSIX REG_STARTEND regexec eflag.
Fixes: #1506
Signed-off-by: Jonathan McCrohan <jmccrohan@gmail.com>
* fix two typos in Makefile
* package transports seperately
* enable all installed transports by default
* use logfile so we don't stdio-choke gnunet-service-arm
-> should use syslog instead...
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Fixed two issues in Chaos Calmer and trunk:
-troubleshooting page not displaying
-UCI arguments out of order because of switch to musl c library from uclibc
Signed-off-by: Aedan "arfett" Renner <chipdankly@gmail.com>
- BUILD/MINOR: tools: rename popcount to my_popcountl
- BUG/MAJOR: buffers: make the buffer_slow_realign() function respect output data
Signed-off-by: heil <heil@terminal-consulting.de>
IoTivity is a Internet of Things framework implementing the Open
Interconnect Consortium Specification.
The current version of IoTivity is still in heavy development and does
not support all its intended features, but I still want to add it to
the packages feed to make it easier for others to extend the OpenWrt
support.
Signed-off-by: Hauke Mehrtens <hauke.mehrtens@lantiq.com>
ZNC 1.6.0 now verifies SSL certificates on connect, and some Servers
do not use a valid one (e.g. freenode).
Signed-off-by: Jonas Gorski <jogo@openwrt.org>
The current mtr does not build if IPv6 is disabled globally, add a patch to
fix the build in this case.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
- Add header tests for `error.h`, `sys/types.h` and `sys/select.h`
- Add function tests for `canonicalize_file_name()` and `fopencookie()`
- Add `compat.h` header to provide replacements for `error()`,
`error_at_line()` and `canonicalize_file_name()` as well as the
`_PATH_MOUNTED` and `_PATH_MNTTAB` defines
- Add missing includes for `sys/select.h` and `sys/types.h`
- Disable libneon debugging if no `fopencookie()` implementation is
available
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
Add missing `sys/types.h` include to `strnstr()` replacement code in
`compat.c` in order to declare `ssize_t` type under musl.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
Add missing `sys/types.h` include to `strnstr()` replacement code in
`compat.c` in order to declare `ssize_t` type under musl.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
If no explicit CA file is given, gnurl fails to setup HTTPS connections
as it doesn't looks for certificates in /etc/ssl/certs/ in any way.
Fix that by utilizing GnuTLS' gnutls_certificate_set_x509_system_trust
as a fall-back if neither CA file, CA path nor SRP is declared.
Reported upstream: https://github.com/bagder/curl/issues/330
Fix suggested upstream: https://github.com/bagder/curl/pull/331
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
This patch enables support for validating ECDSA signatures, which
are being deployed more and more in DNSSEC.
Proper validating can be tested by observing the AD flag in following
query (courtesy of Olafur Gudmundsson, CloudFlare):
$ dig ds-4.alg-14-nsec.dnssec-test.org
Signed-off-by: Ondřej Caletka <ondrej@caletka.cz>
Released version 1.5.13 with the following main changes :
- BUG/MINOR: check: fix tcpcheck error message
- CLEANUP: deinit: remove codes for cleaning p->block_rules
- DOC: Update doc about weight, act and bck fields in the statistics
- MINOR: ssl: add a destructor to free allocated SSL ressources
- BUG/MEDIUM: ssl: fix tune.ssl.default-dh-param value being overwritten
- MEDIUM: ssl: replace standards DH groups with custom ones
- BUG/MINOR: debug: display (null) in place of "meth"
- BUG/MINOR: cfgparse: fix typo in 'option httplog' error message
- BUG/MEDIUM: cfgparse: segfault when userlist is misused
- BUG/MEDIUM: stats: properly initialize the scope before dumping stats
- BUG/MEDIUM: http: don't forward client shutdown without NOLINGER except for tunnels
- CLEANUP: checks: fix double usage of cur / current_step in tcp-checks
- BUG/MEDIUM: checks: do not dereference head of a tcp-check at the end
- CLEANUP: checks: simplify the loop processing of tcp-checks
- BUG/MAJOR: checks: always check for end of list before proceeding
- BUG/MEDIUM: checks: do not dereference a list as a tcpcheck struct
- BUG/MEDIUM: peers: apply a random reconnection timeout
- BUG/MINOR: ssl: fix smp_fetch_ssl_fc_session_id
- MEDIUM: init: don't stop proxies in parent process when exiting
- MINOR: peers: store the pointer to the signal handler
- MEDIUM: peers: unregister peers that were never started
- MEDIUM: config: propagate the table's process list to the peers sections
- MEDIUM: init: stop any peers section not bound to the correct process
- MEDIUM: config: validate that peers sections are bound to exactly one process
- MAJOR: peers: allow peers section to be used with nbproc > 1
- DOC: relax the peers restriction to single-process
- CLEANUP: config: fix misleading information in error message.
- MINOR: config: report the number of processes using a peers section in the error case
- BUG/MEDIUM: config: properly compute the default number of processes for a proxy
Signed-off-by: heil <heil@terminal-consulting.de>
The ntpd package ships autoconf macros which attempt to test for the C99
compliance of `snprintf()` and `vsnprintf()`.
Those macros unconditionally consider the functions not compliant in a cross
compile setting and therfore break all subsequent configure tests because
the `snprintf` and `vsnprintf` symbols are shadowed with `#define` directives
redirecting them to their respectiv gnulib replacements.
The fortify source headers in turn will `#undef` those defines when wrapping
the associated functions and therfore cause all `conftest` programs to emit
a failure.
Pass the required magic autoconf cache variables via `CONFIGURE_VARS` to let
`./configure` assume C99 compliance of the affected functions, thus fixing
the build.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
Add missing `sys/select.h` include to `ntripclient.c` to provide
declarations for `struct timeval` and `fd_set` under musl.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
- Add `fcntl.h` to `nrhp/opennhrp.c` for `open()`, `O_WRONLY` etc.
- Add missing `sys/types.h` include to `nrhp/nrhp_common.h` to provide
required `u_int*_t` types under musl
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
The shadowsocks source uses the name `encrypt` which is already reserved by
the `unistd.h` header. Rename the local `encrypt` and `decrypt` functions to
`crypto_encrypt` and `crypto_decrypt` in order to prevent clashes with the
standard headers.
Fixes the following build error oberserved on the buildbot:
In file included from client.c:19:0:
crypto.h:18:5: error: conflicting types for 'encrypt'
int encrypt(int sockfd, struct link *ln);
^
In file included from .../staging_dir/toolchain-mipsel_mips32_gcc-4.8-linaro_musl-1.1.10/include/fortify/unistd.h:20:0,
from client.c:12:
.../staging_dir/toolchain-mipsel_mips32_gcc-4.8-linaro_musl-1.1.10/include/unistd.h:145:6: note: previous declaration of 'encrypt' was here
void encrypt(char *, int);
^
make[3]: *** [sslocal] Error 1
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
The configure script incorrectly mangles `CFLAGS` by attempting to remove
`-Werror` from it, thus turning `-Werror=format-security` into just
`=format-security` which will cause subsequent autoconf tests to fail.
Patch out the custom `CFLAGS` mangling to fix the build.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
Change `sys/signal.h` include to just `signal.h`. The build otherwise fails
due to `-Werror` with the following message:
In file included from rfcnb-io.c:43:0:
.../staging_dir/toolchain-mipsel_mips32_gcc-4.8-linaro_musl-1.1.10/include/sys/signal.h:1:2: error: #warning redirecting incorrect #include <sys/signal.h> to <signal.h> [-Werror=cpp]
#warning redirecting incorrect #include <sys/signal.h> to <signal.h>
^
cc1: all warnings being treated as errors
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
- Ship a `net/ppp_defs.h` replacement header since musl does not provide one
but `pppd/pppd.h` provided by pppd is needing it.
- Add missing `sys/types.h` includes
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
Replace the nonstandard `SIGCLD` signal name with the proper `SIGCHLD` spelling
as the `SIGCLD` alias is not provided by musl.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
fixed sed when filtering IP address from nslookup output
because "Server:" block might have multiple address lines.
Thanks to Arjen de Korte
Signed-off-by: Christian Schoenebeck <christian.schoenebeck@gmail.com>
Prefer linux/if_ether.h over netinet/if_ether.h if available since the
musl libc if_ether.h header does not allow mixing with kernel headers,
it will result in a struct ethhdr redefinition error.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
- Include `sys/user.h` if `__WORDSIZE` is undefined
- Add `fcntl.h` to `libscc.c` in order to declare `loff_t`
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
Let configure include `sys/if_tun.h` when testing for `netinet/if_ether.h`
to detect the Kernel/libc header conflict on musl.
After this patch, configure will correctly detect `netinet/if_ether.h` as
unusable and the subsequent compilation will not attempt to use it.
Fixes the following compatibility error:
In file included from .../staging_dir/toolchain-mips_mips32_gcc-4.8-linaro_musl-1.1.9/include/linux/if_tun.h:20:0,
from linux/device.c:24:
.../staging_dir/toolchain-mips_mips32_gcc-4.8-linaro_musl-1.1.9/include/linux/if_ether.h:137:8: error: redefinition of 'struct ethhdr'
struct ethhdr {
^
In file included from .../staging_dir/toolchain-mips_mips32_gcc-4.8-linaro_musl-1.1.9/include/net/ethernet.h:10:0,
from linux/../have.h:180,
from linux/../system.h:26,
from linux/device.c:21:
.../staging_dir/toolchain-mips_mips32_gcc-4.8-linaro_musl-1.1.9/include/netinet/if_ether.h:96:8: note: originally defined here
struct ethhdr {
^
make[5]: *** [linux/device.o] Error 1
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
Switch the mtr package to the upstream `newdns` git branch.
This will fix compilation on Glibc, uClibc and musl without requiring
further patches.
Note that the base version of this branch is 0.85, not 0.86 so the
lower version number is intentional.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
- Avoid non-pointer use of `FILE` type since its just a forward declaration
- Build with -D_GNU_SOURCE to expose required `struct tcphdr` members
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
- Add missing `sys/ttydefaults.h` include to `config.c`
- Restrict usage of `error.h` to glibc and uclibc only
- Avoid including `linux/if_tun.h` on non-glibc/uclibc to prevent
musl kernel/libc header conflicts
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
Pass HAVE_RLIM_T via TARGET_CPPFLAGS since configure uses that define
but never actually declares it.
Without doing that, `config.h` tries to declare `rlim_t` itself which
leads to `config.h:126:16: error: 'long long long' is too long for GCC`
with musl on at least x86_64.
Also refresh patches while we're at it.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
sqm-scripts for a long time interprets a "Down- or Upload speed" of zero as
an indication that the shaper should be disabled. Note that really shaping
an individual direction down o zero will make the link effectively dead
for tcp (think reverse ACK traffic). Son instead of allowing the user to
configure something broken, 0 was "over-loaded" to denote no shaping
since several years, but that information has not been documented visibly
to the users. This commit aims at fixing that oversight.
Signed-off-by: Sebastian Moeller <moeller0@gmx.de>
- Ship a net/ppp_defs.h replacement header since musl does not provide one
but pppd/pppd.h provided by pppd is needing it.
- Replace deprecated MSG_TRYHARD flag with the proper MSG_DONTROUTE one
- Unconditionally include string.h in bcrelay to avoid undeclared memset()
and strcpy() warnings.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
Make vsftpd to compile with musl, while preserving uclibc compatibility.
When using musl:
* disable UTMPX functionality
* disable -lnsl option in upstream Makefile
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Add missing includes to libbridge.h to define struct timeval and the
required u_int*_t types under musl.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
Do not include netinet/if_ether.h for musl to prevent struct ethhdr
redeclarations.
Also define NETDB_INTERNAL if needed to fix compilation of the network
backends.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
This fixes multiple issues like upload/download problems on seahub
and also makes it possible to use the new HTTP syncing feature
which doesn't work with libevhtp 1.2.10 at all.
That allows to restart transmission when it crashes, to limit
the memory used by it, as well as be jailed in the directories
it is supposed to access.
Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
- [PATCH 1/2] BUG/MEDIUM: stats: properly initialize the scope before
- [PATCH 2/2] BUG/MEDIUM: http: don't forward client shutdown without
- [PATCH 3/8] BUG/MINOR: check: fix tcpcheck error message
- [PATCH 4/8] CLEANUP: checks: fix double usage of cur / current_step
- [PATCH 5/8] BUG/MEDIUM: checks: do not dereference head of a
- [PATCH 6/8] CLEANUP: checks: simplify the loop processing of
- [PATCH 7/8] BUG/MAJOR: checks: always check for end of list before
- [PATCH 8/8] BUG/MEDIUM: checks: do not dereference a list as a
- [PATCH 09/10] BUG/MEDIUM: peers: apply a random reconnection timeout
- [PATCH 10/10] DOC: Update doc about weight, act and bck fields in the
- [PATCH 11/14] MINOR: ssl: add a destructor to free allocated SSL
- [PATCH 12/14] BUG/MEDIUM: ssl: fix tune.ssl.default-dh-param value
- [PATCH 13/14] BUG/MINOR: cfgparse: fix typo in 'option httplog' error
- [PATCH 14/14] BUG/MEDIUM: cfgparse: segfault when userlist is misused
Signed-off-by: heil <heil@terminal-consulting.de>
The previous commit left an unwanted string in the options passed
to xl2tpd-control. Remove that as well.
Also set procd respawn parameter now that I'm at it.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Overriding DEFAULT to 'n' prevents packages being build unless
explicitely selected even if ALL is set.
Instead, set 'DEFAULT:=y if PACKAGE_gnunet' for the default
packages and otherweise don't touch DEFAULT.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
