aboutsummaryrefslogtreecommitdiff
path: root/net
Commit message (Collapse)AuthorAge
* rclone: Update to 1.61.1Tianling Shen2022-12-25
| | | | Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
* cloudreve: Update to 3.6.2Tianling Shen2022-12-25
| | | | Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
* xray-core: Update to 1.6.6-2Tianling Shen2022-12-25
| | | | Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
* dnsproxy: Update to 0.46.5Tianling Shen2022-12-25
| | | | Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
* dnslookup: Update to 1.8.1Tianling Shen2022-12-25
| | | | Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
* cloudflared: Update to 2022.12.1Tianling Shen2022-12-25
| | | | Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
* krb5: update to 1.20.1W. Michael Petullo2022-12-23
| | | | | | | Besides updating the package to 1.20.1, this commit removed two patches that the new release made unnecessary. Signed-off-by: W. Michael Petullo <mike@flyn.org>
* snort3: update to 3.1.50.0John Audia2022-12-22
| | | | | | | | | | Upstream bump Build system: x86_64 Build-tested: bcm2711/RPi4B Run-tested: bcm2711/RPi4B Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: update to 3.1.49.0John Audia2022-12-22
| | | | | | | | | | Upstream bump Build system: x86_64 Build-tested: bcm2711/RPi4B Run-tested: bcm2711/RPi4B Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: minor tweaks to local.luaJohn Audia2022-12-22
| | | | | | | | | * Use Boolean true for enable inline mode which is more intuitive that older '' * Add skeleton section for openappid since it has been merged[1] 1. https://github.com/openwrt/packages/commit/2d4e7d5fd343652d0852337184d56522ef5af83d Signed-off-by: John Audia <therealgraysky@proton.me>
* nfdump: update to 1.6.25W. Michael Petullo2022-12-22
| | | | Signed-off-by: W. Michael Petullo <mike@flyn.org>
* pbr: bugfix: Makefile, rt_tables fixStan Grishin2022-12-22
| | | | Signed-off-by: Stan Grishin <stangri@melmac.ca>
* uacme: Remove deprecated $(AUTORELEASE)Antti Seppälä2022-12-22
| | | | Signed-off-by: Antti Seppälä <a.seppala@gmail.com>
* uacme: Use UCI to configure firewall instead of iptablesAntti Seppälä2022-12-22
| | | | | | | | | Use UCI to add temporary incoming firewall rule to accept http traffic for challenge verification. This should make uacme compatible with OpenWrt's fw3/4 implementation. Signed-off-by: Antti Seppälä <a.seppala@gmail.com>
* natmap: add forward_port optionRichard Yu2022-12-21
| | | | | | | The bind port (-b) can be used with forward port (-p), so expose this option in config file. Signed-off-by: Richard Yu <yurichard3839@gmail.com>
* unbound: fix local_subnet for IPv6 addresses that contain a portMark Mentovai2022-12-20
| | | | | | | | | | | This prevents a forwarding server named like ::1@5453 from being added to unbound.conf as a forward-host instead of the correct forward-addr. forward-host requires the name to be resolved, which is impossible in the absence of another nameserver. Thus, forwarding-only configurations referencing only the IPv6 loopback address with a port number were broken. Signed-off-by: Mark Mentovai <mark@mentovai.com>
* Merge pull request #20108 from stangri/master-pbrStan Grishin2022-12-19
|\ | | | | pbr: update to 1.0.1-1
| * pbr: update to 1.0.1-1Stan Grishin2022-12-19
| | | | | | | | | | | | | | | | | | | | * add more error/warning messages * better return statements from ips/nftset functions * better error/warning handling when inserting policies * comment out unnecessary nft set/ipst clean ups * shellchecked status functions Signed-off-by: Stan Grishin <stangri@melmac.ca>
* | Merge pull request #20099 from tohojo/fix-flent-pkgToke Høiland-Jørgensen2022-12-19
|\ \ | | | | | | flent: fixup flent package
| * | flent: Integrate flent-tools into the flent packageToke Høiland-Jørgensen2022-12-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now that we're packaging flent itself, there's no reason to have a completely separate flent-tools package. So integrate the flent-tools package specification into the main flent package so it's always kept in sync. Also add a dependency from flent itself on flent-tools, as the shell versions of those utilities that Flent uses when running tests doesn't work on the busybox shell included with openwrt. Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
| * | flent: Rename and update packageToke Høiland-Jørgensen2022-12-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Update the Flent package and move it to net/, renaming it to just 'flent' instead of python3-flent (it's not a library, having the python3- prefix makes no sense). Also add python3-defusedxml as a dependency to protect against XML bombs if using the one of the backends that use XML-RPC, and trim the dependencies to those used directly by Flent. Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* | | mwan3: make mwan3.user executableFlorian Eckert2022-12-19
| |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | This is a fix for the the following change: https://github.com/openwrt/packages/commit/3d824ea288d907a31729c3629e884ea122c30da0 Before the change, it was only possible to execute a shell script. To remove this restriction, a binary or other script language can now also be used for 'mwan3.user'. Unfortunately, the old shell script was not executable for older mwan3 version. During a sysupgrade with config transfer, this 'mwan3.user' script could not be executed for newer mwan3 versions. To fix this, the calling script checks whether the 'mwan3.user' is executable, and if not, this executable bit is now set. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* | tor: bump to 0.4.7.12 stableRui Salvaterra2022-12-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Quoting the changelog: Changes in version 0.4.7.12 - 2022-12-06 This version contains a major change that is a new key for moria1. Also, new metrics are exported on the MetricsPort for the congestion control subsystem. o Directory authority changes (moria1): - Rotate the relay identity key and v3 identity key for moria1. They have been online for more than a decade and refreshing keys periodically is good practice. Advertise new ports too, to avoid confusion. Closes ticket 40722. o Minor feature (Congestion control metrics): - Add additional metricsport relay metrics for congestion control. Closes ticket 40724. o Minor features (fallbackdir): - Regenerate fallback directories generated on December 06, 2022. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as retrieved on 2022/12/06. o Minor bugfixes (cpuworker, relay): - Fix an off by one overload calculation on the number of CPUs being used by our thread pool. Fixes bug 40719; bugfix on 0.3.5.1-alpha. Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
* | tor: bump to 0.4.7.11 stableRui Salvaterra2022-12-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Quoting the changelog: Changes in version 0.4.7.11 - 2022-11-10 This version contains several major fixes aimed at helping defend against network denial of service. It is also extending drastically the MetricsPort for relays to help us gather more internal data to investigate performance and attacks. We strongly recommend to upgrade to this version especially for Exit relays in order to help the network defend against this ongoing DDoS. o Directory authority changes (dizum, Faravahar): - Change dizum IP address. Closes ticket 40687. - Remove Faravahar until its operator, Sina, set it back up online outside of Team Cymru network. Closes ticket 40688. o Major bugfixes (geoip data): - IPFire informed us on August 12th that databases generated after (including) August 10th did not have proper ARIN network allocations. We are updating the database to use the one generated on August 9th, 2022. Fixes bug 40658; bugfix on 0.4.5.13. o Major bugfixes (onion service): - Set a much higher circuit build timeout for opened client rendezvous circuit. Before this, tor would time them out very quickly leading to unnecessary retries meaning more load on the network. Fixes bug 40694; bugfix on 0.3.5.1-alpha. o Major bugfixes (OSX): - Fix coarse-time computation on Apple platforms (like Mac M1) where the Mach absolute time ticks do not correspond directly to nanoseconds. Previously, we computed our shift value wrong, which led us to give incorrect timing results. Fixes bug 40684; bugfix on 0.3.3.1-alpha. o Major bugfixes (relay): - Improve security of our DNS cache by randomly clipping the TTL value. TROVE-2021-009. Fixes bug 40674; bugfix on 0.3.5.1-alpha. o Minor feature (Mac and iOS build): - Change how combine_libs works on Darwin like platforms to make sure we don't include any `__.SYMDEF` and `__.SYMDEF SORTED` symbols on the archive before we repack and run ${RANLIB} on the archive. This fixes a build issue with recent Xcode versions on Mac Silicon and iOS. Closes ticket 40683. o Minor feature (metrics): - Add various congestion control counters to the MetricsPort. Closes ticket 40708. o Minor feature (performance): - Bump the maximum amount of CPU that can be used from 16 to 128. Note that NumCPUs torrc option overrides this hardcoded maximum. Fixes bug 40703; bugfix on 0.3.5.1-alpha. o Minor feature (relay): - Make an hardcoded value for the maximum of per CPU tasks into a consensus parameter. - Two new consensus parameters are added to control the wait time in queue of the onionskins. One of them is the torrc MaxOnionQueueDelay options which supersedes the consensus parameter. Closes ticket 40704. o Minor feature (relay, DoS): - Apply circuit creation anti-DoS defenses if the outbound circuit max cell queue size is reached too many times. This introduces two new consensus parameters to control the queue size limit and number of times allowed to go over that limit. Closes ticket 40680. o Minor feature (relay, metrics): - Add DoS defenses counter to MetricsPort. - Add congestion control RTT reset counter to MetricsPort. - Add counters to the MetricsPort how many connections, per type, are currently opened and how many were created. - Add relay flags from the consensus to the MetricsPort. - Add total number of opened circuits to MetricsPort. - Add total number of streams seen by an Exit to the MetricsPort. - Add traffic stats as in number of read/written bytes in total. - Related to ticket 40194. o Minor features (fallbackdir): - Regenerate fallback directories generated on November 10, 2022. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as retrieved on 2022/11/10. o Minor bugfixes (authorities, sandbox): - Allow to write file my-consensus-<flavor-name> to disk when sandbox is activated. Fixes bug 40663; bugfix on 0.3.5.1-alpha. o Minor bugfixes (dirauth): - Directory authorities stop voting a consensus "Measured" weight for relays with the Authority flag. Now these relays will be considered unmeasured, which should reserve their bandwidth for their dir auth role and minimize distractions from other roles. In place of the "Measured" weight, they now include a "MeasuredButAuthority" weight (not used by anything) so the bandwidth authority's opinion on this relay can be recorded for posterity. Lastly, remove the AuthDirDontVoteOnDirAuthBandwidth torrc option which never worked right. Fixes bugs 40698 and 40700; bugfix on 0.4.7.2-alpha. o Minor bugfixes (onion service client): - A collapsing onion service circuit should be seen as an "unreachable" error so it can be retried. Fixes bug 40692; bugfix on 0.3.5.1-alpha. o Minor bugfixes (onion service): - Make the service retry a rendezvous if the circuit is being repurposed for measurements. Fixes bug 40696; bugfix on 0.3.5.1-alpha. o Minor bugfixes (relay overload statistics): - Count total create cells vs dropped create cells properly, when assessing if our fraction of dropped cells is too high. We only count non-client circuits in the denominator, but we would include client circuits in the numerator, leading to surprising log lines claiming that we had dropped more than 100% of incoming create cells. Fixes bug 40673; bugfix on 0.4.7.1-alpha. o Code simplification and refactoring (bridges): - Remove unused code related to ExtPort connection ID. Fixes bug 40648; bugfix on 0.3.5.1-alpha. Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
* | smcroute: update to 2.5.6Alexey Smirnov2022-12-19
|/ | | | Signed-off-by: Alexey Smirnov <s.alexey@gmail.com>
* igmpproxy: update to version 0.4.0Oli Ze2022-12-16
| | | | Signed-off-by: Oli Ze <olze@trustserv.de>
* AdGuardHome: update to v0.107.21YiZhen Choo2022-12-16
| | | | Signed-off-by: YiZhen Choo <yizhen.c02@gmail.com>
* OpenAppID: add new packageJohn Audia2022-12-16
| | | | | | | | | | | | | | | | | | | | | | Traditionally, Snort rules are based upon packet analysis. OpenAppID enables detection of applications/cloud applications on the network. This package provides OpenAppID and signature files used by OpenAppID to detect network traffic from certain applications can be used to identify rogue application use, detect malicious applications and implement various application policies, such as application blacklisting, limiting application usage, and enforcing conditional controls. To use, for example, edit /etc/snort/local.lua and add the following section at a minimum: appid = { app_detector_dir = '/usr/lib/openappid', log_stats = true, app_stats_period = 60, } Signed-off-by: John Audia <therealgraysky@proton.me>
* pdns-recursor: update to 4.8.0Peter van Dijk2022-12-15
| | | | Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>
* acme-acmesh: Provide a 'combined' certificate bundle as wellToke Høiland-Jørgensen2022-12-14
| | | | | | | | | | | | | | | The haproxy hotplug script creates a 'combined' certificate bundle that contains both the certificate chain and the private key. However, having a daemon hotplug script write into CERT_DIR is not great; so let's provide the bundle as part of the main acme framework, keeping it in $domain_dir and just linking it into CERT_DIR. That way we can keep CERT_DIR as just a collection of links for everything, that no consumers should need to write into. Also make sure to set the umask correctly so the combined file is not world-readable (since it contains the private key). Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* acme-acmesh: Don't hard-code certificate directoryToke Høiland-Jørgensen2022-12-14
| | | | | | | | | The acme-acmesh package hardcoded the certificate path in its hook script. Now that we export it as a variable we can avoid hard-coding and use the variable version instead. Also factor out the linking of certificates into a function so it's not repeated. Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* acme-common: Export canonical paths for storing certificates and challengesToke Høiland-Jørgensen2022-12-14
| | | | | | | | | | | | The contract between the acme-common framework and consumers and hook scripts is that certificates can be consumed from /etc/ssl/acme and that web challenges are stored in /var/run/acme/challenge. Make this explicit by exporting $CERT_DIR and $CHALLENGE_DIR as environment variables as well, instead of having knowledge of those paths depend on out-of-band information. We already exported $challenge_dir, but let's change it to upper-case to make it clear that it's not a user configuration variable. Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* Merge pull request #20059 from hgl/acmeToke Høiland-Jørgensen2022-12-14
|\ | | | | acme: deprecate state_dir
| * acme-acmesh: use $challenge_dirGlen Huang2022-12-14
| | | | | | | | Signed-off-by: Glen Huang <i@glenhuang.com>
| * acme: deprecate state_dirGlen Huang2022-12-14
| | | | | | | | | | | | | | | | | | | | | | | | | | state_dir is actually a hardcoded value in conffiles. Allowing users to customize it could result in losing certificates after upgrading if they don't also specify the dir as being preserved. We shouldn't default to this dangerous behavior. With the new ACME package, certificates live in the standard location /etc/ssl/acme, users who need to do certificate customizations should look for them in that dir instead. Signed-off-by: Glen Huang <i@glenhuang.com>
* | Merge pull request #20062 from stangri/master-pbrStan Grishin2022-12-12
|\ \ | | | | | | pbr: detect missing iptables
| * | pbr: detect missing iptablesStan Grishin2022-12-12
| | | | | | | | | | | | Signed-off-by: Stan Grishin <stangri@melmac.ca>
* | | openssh: update to 9.1p1Sibren Vasse2022-12-13
| | | | | | | | | | | | Signed-off-by: Sibren Vasse <github@sibrenvasse.nl>
* | | simple-adblock: bugfix: add dnsmasq.nftset to uci_load_validateStan Grishin2022-12-12
| | | | | | | | | | | | | | | | | | | | | | | | * fixes https://github.com/openwrt/openwrt/issues/11481 thanks to: * https://github.com/mistepien for reporting * https://github.com/dave14305 for diagnosing Signed-off-by: Stan Grishin <stangri@melmac.ca>
* | | Merge pull request #19982 from golddranks/masterTianling Shen2022-12-13
|\ \ \ | | | | | | | | ddns-scripts: update_gandi_net: improve logging & add timeout
| * | | ddns-scripts: update_gandi_net: improve logging & add timeoutPyry Kontio2022-12-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Improved logging - Log the executed curl command to be able to rerun and test it manually - Log the curl exit status - Added 30 second timeout timeout for clear-cut detection of flaky connections. Signed-off-by: Pyry Kontio <pyry.kontio@drasa.eu>
* | | | knot: update to version 3.2.4Jan Hák2022-12-13
| |/ / |/| | | | | | | | Signed-off-by: Jan Hák <jan.hak@nic.cz>
* | | pdns: update to 4.7.3Peter van Dijk2022-12-12
| | | | | | | | | | | | Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>
* | | wget: apply upstream fix to avoid nettle linking in nosslHannu Nyman2022-12-11
| |/ |/| | | | | | | | | | | | | | | | | | | Replace my own patch with the upstream solution, which they issued in response to my bug report. (Two patches as they overlooked something on the first try. Reference to https://savannah.gnu.org/bugs/index.php?63431 ) The nettle lib evaluation is now conditional to not having "--disable-ntlm". Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
* | https-dns-proxy: fix restartStan Grishin2022-12-10
| | | | | | | | Signed-off-by: Stan Grishin <stangri@melmac.ca>
* | Merge pull request #20040 from stangri/master-https-dns-proxyStan Grishin2022-12-09
|\ \ | | | | | | https-dns-proxy: add mdns service records
| * | https-dns-proxy: add mdns service recordsStan Grishin2022-12-07
| | | | | | | | | | | | | | | | | | | | | | | | * add mdns records for started instances * Makefile: use $(PKG_VERSION) as a value for PKG_SOURCE_DATE instead of hard-coding it Signed-off-by: Stan Grishin <stangri@melmac.ca>
* | | simple-adblock: support new OISD dnsmasq configStan Grishin2022-12-10
| | | | | | | | | | | | | | | | | | * OISD dnsmasq config files switched from using address= to server= Signed-off-by: Stan Grishin <stangri@melmac.ca>
* | | ddns-scripts: add support for Google Cloud DNSChris Barrick2022-12-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The implementation uses a GCP service account. The user is expected to create and secure a service account and generate a private key. The "password" field can contain the key inline or be a file path pointing to the key file on the router. The GCP project name and Cloud DNS ManagedZone must also be provided. These are taken as form-urlencoded key-value pairs in param_enc. The TTL can optionally be supplied in param_opt. Signed-off-by: Chris Barrick <chrisbarrick@google.com>
* | | tailscale: preserve tailscaled state fileCarlo Alberto Ferraris2022-12-09
| | | | | | | | | | | | | | | Fixes #19774 Signed-off-by: Carlo Alberto Ferraris <cafxx@strayorange.com>
Powered by cgit, Themed by Ted Yin.