This includes the fix for CVE-2018-5738: When recursion is enabled but the
allow-recursion and allow-query-cache ACLs are not specified, they should be
limited to local networks, but they were inadvertently set to match the default
allow-query, thus allowing remote queries.
Signed-off-by: Noah Meyerhans <frodo@morgul.net>
- fix AXFR zones to delay a potentially large download with ntp-hotplug
- fix odhcpd link script to properly delete expired lease data from DNS
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
If we set the option "local_source" in the globals mwan3 section to "none",
traffic generated by the router it self will always use the default route from
the wan interface with the lowest metric. If this interface is down
the router traffic still uses the connection with the lowest metric but
this is disconnected. Load balancing and failover from the lan site is
still possible. Only router generated traffic is not load balanced and
could not use failover.
To solve this issue with router initiated traffic add the additional
option "online_metric" to the mwan3 interface section.
If the interface is connected then this lower "online metric" is set in the
default routing table.
With this change we have at least a failover with router initiated
traffic.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
During runntime of mwan3 we could add dynamicly networks to this ipset
which would then treated as connected networks by mwan3.
This is also usefull for ipsec.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
With the list param "rt_table_lookup" in the mwan3 section globals,
it is now possible to add a additional routing table numbers which would get
also parsed and will be added to the connected network.
So mwan3 will treat them as they are directly connected to this device.
This could be usefull if we use ipsec.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The generation for reporting the policies uses the same code add a
common function to reduce duplication.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
This adds a couple of patches when setting some openssl options:
* ECDSA code in openssh-compat.h and libressl-api-compat.c needs to be
be guarded by OPENSSL_HAS_ECC; otherwise, it will not build with
openssl compiled without ECC support.
* Fix openssl version number in openbsd-compat/openssl-compat.c which
failed to compile --with-ssl-engine; this option is used when
CONFIG_OPENSSL_ENGINE_CRYPTO=y
Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
Signed-off-by: Peter Wagner <tripolar@gmx.at>
This package forces the use of Google and Bing safe search by default.
It does this by adding hosts files for dnsmasq to use. These hosts replace the
normal IP addresses for Google and Bing with addresses that force safe
search to be turned on all the time.
Google and Bing Safe Search are suitable for most businesses, schools, and
families who wish to block adult content. This package also offers
YouTube's restricted and 'restricted moderate' via a configuration
option. The reason that this is not enabled is that it is probably more
suitable for children rather than a wide audience.
This package is designed so that other services that offer safe search can be
added easily in the future.
For more information about safe search please visit these URLs:
- https://support.google.com/websearch/answer/186669
- https://help.bing.microsoft.com/#apex/18/en-US/10003/0
- https://support.google.com/a/answer/6212415
Signed-off-by: Gregory L. Dietsche <gregory.dietsche@cuw.edu>
Disable PCRE process searching to avoid linking against libprce, which
would cause the build to fail due to a missing dependency. With the
--without-pcre switch, build fails due to an undefined reference, so do
it via CONFIGURE_VARS instead.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
[disable PCRE process searching]
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
darkstat includes its own strlcat and strlcpy, making the dependency
somewhat pointless.
Fixes compilation ever since glibc dependency on libbsd was removed.
Also removed std=gnu99 as it's not needed with GCC7.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Switch to codeload for simplicity. Rearranged Makefile a bit for consistency between Makefiles.
Removed version dependency for seafile-server to avoid breaking builds.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
This commit brings UCI support to the stubby package.
o All options are documented in the README.md file.
o The README.md file has been re-written to include a short usage
manual.
o The default configuration now includes more Cloudflare addresses.
o The stubby service is (re)started using procd triggers from a
specified interface with a configurable time delay.
o Round robin use of upstream resolvers is now activated by
default.
o Client privacy is now activated by default.
o Options are added for specifying the log level of the daemon and
command line options passed to the stubby command.
Signed-off-by: Jonathan G. Underwood <jonathan.underwood@gmail.com>
Get downtime information for the tracked mwan3 wan interfaces.
The information shows how long this interface is in disconnected state.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Get uptime information for the tracked mwan3 wan interfaces.
The information shows how long this interface is in connected state.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
If a interface is down, call ubus will return an null message which is
used to json_load, it causes json_get_vars gets value from last load and
l3_device various is nonzero.
Signed-off-by: Kyson Lok <kysonlok@gmail.com>
Added PKG_USE_MIPS16 as it seems not to build under mipsel.
Error: opcode not supported on this processor: mips32r2 (mips32r2) `sync'
Signed-off-by: Rosen Penev <rosenp@gmail.com>
The first is needed for 4.14 (maybe the relevant parts got packported and
the second is for when OpenWrt migrates to 4.19.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
PR includes switch to codeload tarballs and rename from netopeer2 to
Netopeer2 for better codeload integration.
Signed-off-by: Mislav Novakovic <mislav.novakovic@sartura.hr>
Currently luci-app-sqm provided by sqm-scripts depends on luci-base instead
of selecting it, this leads to an indirect circular dependency in kconfig:
tmp/.config-package.in:34646:error: recursive dependency detected!
For a resolution refer to Documentation/kbuild/kconfig-language.txt
subsection "Kconfig recursive dependency limitations"
tmp/.config-package.in:34646: symbol PACKAGE_iptables is selected by PACKAGE_sqm-scripts
For a resolution refer to Documentation/kbuild/kconfig-language.txt
subsection "Kconfig recursive dependency limitations"
tmp/.config-package.in:961: symbol PACKAGE_sqm-scripts is selected by PACKAGE_luci-app-sqm
For a resolution refer to Documentation/kbuild/kconfig-language.txt
subsection "Kconfig recursive dependency limitations"
tmp/.config-package.in:22421: symbol PACKAGE_luci-app-sqm depends on PACKAGE_luci-base
For a resolution refer to Documentation/kbuild/kconfig-language.txt
subsection "Kconfig recursive dependency limitations"
tmp/.config-package.in:21387: symbol PACKAGE_luci-base is selected by PACKAGE_luci-lib-iptparser
For a resolution refer to Documentation/kbuild/kconfig-language.txt
subsection "Kconfig recursive dependency limitations"
tmp/.config-package.in:22899: symbol PACKAGE_luci-lib-iptparser is selected by PACKAGE_luci-app-splash
For a resolution refer to Documentation/kbuild/kconfig-language.txt
subsection "Kconfig recursive dependency limitations"
tmp/.config-package.in:22402: symbol PACKAGE_luci-app-splash is selected by PACKAGE_luci-mod-freifunk-community
For a resolution refer to Documentation/kbuild/kconfig-language.txt
subsection "Kconfig recursive dependency limitations"
tmp/.config-package.in:21552: symbol PACKAGE_luci-mod-freifunk-community depends on PACKAGE_iptables
Solve the issue by turning the dependencies into selecting ones which also
matches the behaviour of other LuCI applications.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
This should fix compilation as wolfSSL currently does not define
wolfTLSv1_client_method. And as the comment suggests, this is only TLS 1,
not 1.0 and above.
SSLv23 is TLS 1.1 and above as currently configured in the wolfssl package
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Add the ipvsadm command line tool to set up, maintain or inspect the virtual
server table in the Linux kernel.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Added some help to the choice of TLS library in menuconfig, taken from
the squid release notes.
Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
When libnl is enabled and libnl-genl is disabled, libnl-genl-3.so.200 is
installed by InstallDev, and keepalived picks it up anyway.
This causes build to fail with the following error:
Package keepalived is missing dependencies for the following libraries:
libnl-genl-3.so.200
Instead of having a conditional dependency it is better to have a
consistent build. Disable libnl to enforce this.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* with the config option 'trm_radio' you can now restrict travelmate
to a single radio (e.g. 'radio1') or change the overall
scanning order (e.g. 'radio1 radio2 radio0')
* LuCI: show QR codes now inline on the overview page
(collapsed by default)
Signed-off-by: Dirk Brenken <dev@brenken.org>
Building against libftdi1 can't be avoided in the presence of libftdi1
headers apparently. As it might be useful for some DMX adapters and
such, depend on libftdi1 from now on.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Five commits from upstream were applied to v. 7.8-p1:
482d23bc upstream: hold our collective noses and use the openssl-1.1.x
API in
48f54b9d adapt -portable to OpenSSL 1.1x API
86e0a9f3 upstream: use only openssl-1.1.x API here too
a3fd8074 upstream: missed a bit of openssl-1.0.x API in this unittest
d64e7852 add compat header
Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
* replace shell based urlencoder with an awk variant
* fix write_log function/syslog output in case of an error
* protect answer string with double quotes in update_route53
* remove bogus set/IFS options in update_route53
* clean-up update_route53 a little bit
This patchset finally fix#6977
Many thanks to @mark0n & @a-bali for testing & debugging
Signed-off-by: Dirk Brenken <dev@brenken.org>
This is a long overdue followup commit to openwrt/openwrt@5d9eeab
("build: remove obsolete references to cris and avr32")
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
Full changelog at https://github.com/eclipse/mosquitto/blob/v1.5.3/ChangeLog.txt
Primary change:
CVE fix for CVE-2018-12543 - prevent crash on topics that begin with $
but are not $SYS
Selected other fixes relevant to OpenWrt since 1.5.1:
- Fix retained messages not sent by bridges on outgoing topics at the first
connection. Closes#701.
- Fix duplicate clients being added to by_id hash before the old client was
removed. Closes#645.
- Fix excessive CPU usage when the number of sockets exceeds the system limit.
Closes#948.
- Fix for bridge connections when using WITH_ADNS=yes.
- Fix round_robin false behaviour. Closes#481.
- Fix segfault on HUP when bridges and security options are configured.
Closes#965.
Signed-off-by: Karl Palsson <karlp@etactica.com>
Move setting global enabled flag from /etc/init.d/mwan3 to mwan3
command. So we could start mwan3 from the cmd mwan3 as well.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Remove the limit setting core="unlimited", since this shouldn't be needed
in production use (i.e. non-debug) and on an embedded platform, which is
why it's rarely used by any existing packages.
Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
Add an SPKI pin for Cloudflare to help prevent MITM and downgrade attacks,
as described in RFC7858 (DNS over TLS). The setup of SPKI and the specific
SHA256 certificate hash are taken from Cloudflare's DoT configuration guide
published at https://developers.cloudflare.com/1.1.1.1/dns-over-tls/.
Note that the certificate is valid to March 25th 2020, 13:00 CET, which
provides ample time for issuance of a backup pin to support future key
rollover.
Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
Retain the upstream value since privacy is usually the key user motivation
for using DNS-over-TLS, and simply note that those encountering sub-optimal
routing may consider disabling the setting.
Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
The config file /etc/stubby/stubby.yml is not registered properly and any
local changes are being overwritten on upgrade or reinstall.
Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
- The original copy process is to delete all routing tables first,
then add new routing table. This process is too slow and very dirty.
- We use grep to identify the changes and apply them.
- ignore ipv6 unreachable routes
- update version number
Signed-off-by: Chen Minqiang <ptpt52@gmail.com>
This adds a metapakcge for acme luci ap without uhttpd dependency and adds entities and check to stop handle nginx server and modify the certificate set automatically.
Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
Should be faster.
Rearranged Makefile slightly for consistency with other packages.
Version 3.5.6 and above are relicensed to GPL-2.0.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Fix the init script to allow access from IPv6 subnets of the interface
specified in allow section in /etc/config/chrony.
Fixes issue #7039.
Signed-off-by: Miroslav Lichvar <mlichvar0@gmail.com>
- adjust a few UCI translations to coordinate with upstream defaults
- remove OpenSSL < 1.1.0 API log error patch which is included upstream
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* if <keyutils.h> is found krb5 pulls in the lib, which than fails to link because of a missing -fPic in libkeyutils.so
* keyutils 1.5.11 will depend on krb5, so we disable it in krb5 to avoid circular dependency
Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
* update to 4.9.0
* move vfs_xattr_tdb to defaults
* add vfs_audit, vfs_extd_audit, vfs_full_audit to AD-DC variant
* disable jansson, libarchive by default, enabled for AD-DC variant
* update waf answers
Noteable smb.conf changes:
* store dos attributes Default changed yes
* ea support Default changed yes
Fixes: Timemachine "The identity of the Backup disk ... has changed since the previous backup."
Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
Commit 6cd8fcabe added ipsec hotplug script support by calling "exec
/sbin/hotplug-call ipsec".
Using the exec call breaks the insertion of iptables rules by the _updown.in
script as hotplug-call just replaces the current shell meaning the commands
following exec do not run since the shell is replaced and as a result lead to
connectivity issues.
Fix this by removing the exec command in front of /sbin/hotplug-call.
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
libbsd may compile before nfs-kernel-server, it will make
nfs-kernel-server depends libbsd.so.0, that is not we want to see. so
gave option to 'configure' to disable libbsd detect and tell it we have
no libbsd
Signed-off-by: Guo Li <uxgood.org@gmail.com>
* enable avahi by default, so Linux/Mac Clients can see samba shares
* enable timemachine config support
* fix invalid --builtin-libraries
* default to 'mdns name = mdns' in template
Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
Open vSwitch 2.10 introduces meters support to the kernel datapath. In
upstream Linux, the feature is only available since 4.15
This is mainly for make the newly introduced meter features in linux
kernel datapath more easily available
root@OpenWrt:/# ovs-ofctl -OOpenFlow13 meter-features br0
OFPST_METER_FEATURES reply (OF1.3) (xid=0x2):
max_meter:4294967295 max_bands:1 max_color:0
band_types: drop
capabilities: kbps pktps burst stats
root@OpenWrt:/#
Size comparison between in-tree and upstreamed modules are attached
2800 Sep 5 08:47 ipkg-mips_24kc/kmod-openvswitch-geneve-intree/lib/modules/4.14.67/vport-geneve.ko
2736 Sep 5 08:47 ipkg-mips_24kc/kmod-openvswitch-geneve/lib/modules/4.14.67/vport-geneve.ko
2596 Sep 5 08:47 ipkg-mips_24kc/kmod-openvswitch-gre-intree/lib/modules/4.14.67/vport-gre.ko
2536 Sep 5 08:47 ipkg-mips_24kc/kmod-openvswitch-gre/lib/modules/4.14.67/vport-gre.ko
288320 Sep 5 08:47 ipkg-mips_24kc/kmod-openvswitch-intree/lib/modules/4.14.67/openvswitch.ko
118984 Sep 5 08:47 ipkg-mips_24kc/kmod-openvswitch/lib/modules/4.14.67/openvswitch.ko
2792 Sep 5 08:47 ipkg-mips_24kc/kmod-openvswitch-lisp-intree/lib/modules/4.14.67/vport-lisp.ko
2788 Sep 5 08:47 ipkg-mips_24kc/kmod-openvswitch-stt-intree/lib/modules/4.14.67/vport-stt.ko
3668 Sep 5 08:47 ipkg-mips_24kc/kmod-openvswitch-vxlan-intree/lib/modules/4.14.67/vport-vxlan.ko
3400 Sep 5 08:47 ipkg-mips_24kc/kmod-openvswitch-vxlan/lib/modules/4.14.67/vport-vxlan.ko
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
- initscript: skip when ctl scripts are absent. When only ovs is
installed, this will quash error messages of ovn-ctl not found when
invoking stop
- openvswitch-common: include ovs-kmod-ctl
- patches: ovs-save: compatible with busybox ip command
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* remove needless third status "not connected", use only "running / not
connected" and "connected"
* change indentation from spaces to tabs (saves 4kb)
* small fixes
* update readme
Signed-off-by: Dirk Brenken <dev@brenken.org>
The registered URLs only point to the latest version. After adding the archive
URL we could now download older version again.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The official tarball does not contain configure, we should set
PKG_FIXUP=autoreconf to generate one
make[4]: *** No targets specified and no makefile found. Stop.
Signed-off-by: Guo Li <uxgood.org@gmail.com>
This was introduced in Open vSwitch 2.10 in commit 771680d ("DNS: Add
basic support for asynchronous DNS resolving")
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
Install the .pc files to staging directory to help other packages
to find the libraries.
Since the build does not use CMake, we need to manually install the
files and replace two variables using sed.
Filed upstream as https://github.com/eclipse/mosquitto/pull/950
Signed-off-by: Michael Heimpold <michael.heimpold@i2se.com>
Tested-by: Karl Palsson <karlp@etactica.com>
Currently the uci-defaults script doesn't check if the rule is already present. This prevent any problem related by this.
Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
add extra command "export_storage" to export data for use with Radicale 2.x.x
remove myself as PKG_MAINTAINER, give back to the community
Signed-off-by: Christian Schoenebeck <christian.schoenebeck@gmail.com>
