aboutsummaryrefslogtreecommitdiff
path: root/net
Commit message (Collapse)AuthorAge
...
* | banip: update 0.8.0-2Dirk Brenken2023-02-20
| | | | | | | | | | | | | | * fix a potential race condition during initial startup (after flash) which leads to a "disabled" service Signed-off-by: Dirk Brenken <dev@brenken.org Signed-off-by: Dirk Brenken <dev@brenken.org>
* | Merge pull request #20475 from cotequeiroz/openssl3Eneas U de Queiroz2023-02-20
|\ \ | | | | | | treewide: prepare packages for OpenSSL 3.0 update
| * | apfree-wifidog: add support for OpenSSL 3.0Eneas U de Queiroz2023-02-16
| | | | | | | | | | | | | | | | | | This adds an upstream commit to allow building with OpenSSL 3.0. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
| * | boinc: Add compatibility with OpenSSL 3.0Eneas U de Queiroz2023-02-16
| | | | | | | | | | | | | | | | | | This adds a patch from upstream allowing to build with OpenSSL 3.0. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
| * | umurmur: fix compilation with OpenSSL 3.0Eneas U de Queiroz2023-02-16
| | | | | | | | | | | | | | | | | | Remove a call to CRYPTO_mem_ctrl(), which is used only for debugging, Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
| * | squid: bump to release 5.7Eneas U de Queiroz2023-02-16
| | | | | | | | | | | | | | | | | | This is the latest version and brings compatibility with OpenSSL 3.0. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
| * | nsd: bump to 4.6.1Eneas U de Queiroz2023-02-16
| | | | | | | | | | | | | | | | | | | | | | | | This version adds compatibility with OpenSSL 3.0. There's a patch, submitted upstream, to fix building without SSL. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
| * | nginx-util: allow building with OpenSSL 3.0Eneas U de Queiroz2023-02-16
| | | | | | | | | | | | | | | | | | | | | Add -Wno-error=deprecated-declarations to CFLAGS to allow usage of deprecated API. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
* | | knot: update to version 3.2.5Jan Hák2023-02-20
| | | | | | | | | | | | Signed-off-by: Jan Hák <jan.hak@nic.cz>
* | | Merge pull request #20484 from salim-b/patch-1Eneas U de Queiroz2023-02-20
|\ \ \ | |_|/ |/| | transmission: retrieve boolean config opts using `config_get_bool`
| * | transmission: retrieve boolean config opts using `config_get_bool`Salim B2023-02-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The tranmission UCI config options - `config_overwrite` - `incomplete_dir_enabled` - `watch_dir_enabled` are all booleans, so we have to retrieve them using `config_get_bool` in order to make sure they are properly interpreted in case the user sets them to a keyword (`true`/`false`, `on`/`off` etc.) and not an integer (`0`/`1`). Signed-off-by: Salim B <git@salim.space>
* | | simple-adblock: bugfix: ensure directory for jsonFile is createdStan Grishin2023-02-19
| | | | | | | | | | | | Signed-off-by: Stan Grishin <stangri@melmac.ca>
* | | simple-adblock: implement procd_boot_wan_timeout supportStan Grishin2023-02-19
| | | | | | | | | | | | | | | | | | | | | * implement procd_boot_wan_timeout support * update config with oisd ABPlus and domains lists Signed-off-by: Stan Grishin <stangri@melmac.ca>
* | | Merge pull request #20511 from stangri/master-simple-adblockStan Grishin2023-02-18
|\ \ \ | | | | | | | | simple-adblock: update to 1.9.4-1
| * | | simple-adblock: update to 1.9.4-1Stan Grishin2023-02-16
| | |/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * update default config for new oisd.nl lists * conf.update file to migrate oisd.nl lists to the new format * introduce AdBlockPlus lists support (new oisd.nl format) * longer wait for WAN up/gateway detection * make load_environemnt only execute once to suppress duplicate warnings/errors PS. While I was testing this, oisd.nl has brought back the old domains lists as well, so this version supports both as I'm unclear as to why the "big" ABPlus list is only 6.2Mb where as the "big" domains list is whopping 19.9Mb. Signed-off-by: Stan Grishin <stangri@melmac.ca>
* | | Merge pull request #20491 from dibdot/banIPDirk Brenken2023-02-18
|\ \ \ | | | | | | | | banip: release 0.8.0 (nft rewrite)
| * | | banip: release 0.8.0 (nft rewrite)Dirk Brenken2023-02-18
| | |/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - complete rewrite of banIP to support nftables - all sets are handled in a separate nft table/namespace 'banIP' - for incoming blocking it uses the inet input hook, for outgoing blocking it uses the inet forward hook - full IPv4 and IPv6 support - supports nft atomic set loading - supports blocking by ASN numbers and by iso country codes - 42 preconfigured external feeds are available, plus local allow- and blocklist - supports local allow- and blocklist (IPv4, IPv6, CIDR notation or domain names) - auto-add the uplink subnet to the local allowlist - provides a small background log monitor to ban unsuccessful login attempts in real-time - the logterms for the log monitor service can be freely defined via regex - auto-add unsuccessful LuCI, nginx, Asterisk or ssh login attempts to the local blocklist - fast feed processing as they are handled in parallel as background jobs - per feed it can be defined whether the input chain or the forward chain should be blocked (default: both chains) - automatic blocklist backup & restore, the backups will be used in case of download errors or during startup - automatically selects one of the following download utilities with ssl support: aria2c, curl, uclient-fetch or wget - supports a 'allowlist only' mode, this option restricts internet access from/to a small number of secure websites/IPs - provides comprehensive runtime information - provides a detailed set report - provides a set search engine for certain IPs - feed parsing by fast & flexible regex rulesets - minimal status & error logging to syslog, enable debug logging to receive more output - procd based init system support (start/stop/restart/reload/status/report/search) - procd network interface trigger support - ability to add new banIP feeds on your own - add a readme with all available options/feeds to customize your installation to your needs - a new LuCI frontend will be available in due course Signed-off-by: Dirk Brenken <dev@brenken.org>
* | | adblock: update 4.1.5-6Dirk Brenken2023-02-18
| | | | | | | | | | | | | | | | | | * adapted changed oisd downloads (again), fixed #20516 Signed-off-by: Dirk Brenken <dev@brenken.org>
* | | kcptun: update to version 20230207Dengfeng Liu2023-02-17
| | | | | | | | | | | | | | | | | | add support for port-range dailer, port-range listener Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>
* | | cloudreve: Update to 3.7.1Tianling Shen2023-02-16
| |/ |/| | | | | | | | | Dropped architectures that are no longer supported by upstream. Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
* | gg: Update to 0.2.18Tianling Shen2023-02-16
| | | | | | | | Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
* | dnsproxy: Update to 0.47.0Tianling Shen2023-02-16
| | | | | | | | Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
* | adblock: update 4.1.5-5Dirk Brenken2023-02-15
|/ | | | | | | | | | * adapted changed oisd namings / download locations oisd_big (old: oisd_full), oisd_small (old: oisdb_basic) * added antipopads as new sources * removed broken energized source * fixed readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* gsocket: upstream update to 1.4.39Ralf Kaiser2023-02-11
| | | | Signed-off-by: Ralf Kaiser <skyper@thc.org>
* Merge pull request #20349 from turris-cz/unbound-1171Josef Schlehofer2023-02-10
|\ | | | | unbound: update to version 1.17.1
| * unbound: update to version 1.17.1Josef Schlehofer2023-02-10
| | | | | | | | | | | | | | - Refreshed one patch - Removed deprecated AUTORELEASE Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* | sing-box: add new packageVan Waholtz2023-02-10
| | | | | | | | Signed-off-by: Van Waholtz <brvphoenix@gmail.com>
* | v2ray-geodata: Update to latest versionTianling Shen2023-02-10
| | | | | | | | Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
* | v2ray-core: Update to 5.3.0Tianling Shen2023-02-10
| | | | | | | | Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
* | xray-core: Update to 1.7.5Tianling Shen2023-02-10
| | | | | | | | Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
* | cloudflared: Update to 2023.2.1Tianling Shen2023-02-09
| | | | | | | | Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
* | dnscrypt-proxy2: update to version 2.1.4Fabian Lipken2023-02-08
| | | | | | | | Signed-off-by: Fabian Lipken <dynasticorpheus@gmail.com>
* | xl2tpd: bump to version 1.3.18Yousong Zhou2023-02-06
| | | | | | | | Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* | bind: bump PKG_RELEASENoah Meyerhans2023-02-05
| |
* | bind: add option to enable GSSAPI supportStijn Tintel2023-02-05
| | | | | | | | | | | | | | Samba4 running as Active Directory Domain Controller with the internal DNS backend requires the nsupdate binary with GSSAPI support. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* | bind: bump release numberRucke Teg2023-02-05
| | | | | | | | Signed-off-by: Rucke Teg <rucketeg@protonmail.com>
* | bind: Fix ipv6 detection logicRucke Teg2023-02-05
| | | | | | | | | | | | | | Bug was introduced in a7b770eec4370087a5ccd27887386dac9266214e and results in bind always stating with the `-4` flag. Signed-off-by: Rucke Teg <rucketeg@protonmail.com>
* | simple-adblock: update to 1.9.3-7Stan Grishin2023-02-04
| | | | | | | | | | | | | | | | * add boot() function which waits for network.interface to come up * switch oisd.nl hosts entry to domains * remove erroneous oisd substitution from config-update file Signed-off-by: Stan Grishin <stangri@melmac.ca>
* | tailscale: update to 1.36.0Oskari Rauta2023-02-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Update tailscale to version 1.36.0 - Patch iptables support Tailscale does not (yet) support nftables. Tailscale allows running with --netfilter=off allowing end-user to create his own firewall rules, but this affects only tailscale cli, not tailscaled daemon, so connection cannot be made without error telling that tailscaled was unable to determine execute iptables for determining it's version. There is a work-around for those who do not want nft-iptables compatibility package; they can create a script to /usr/bin/iptables which responds to --version argument and echos fake version string and on any other arguments or no arguments, just exits. After this procedure and starting tailscale cli with netfilter off- it works. Openwrt has moved on to nftables, so iptables manipulation seems unnecessary. Especially for other reasons, on Openwrt, firewall should be configured on it's own, because firewall rules made by other software, such as tailscale, loose their firewalling rules when firewall restarts. So I patched it to allow "fake" iptables pointing to executable /bin/false and ignoring version request. And I also set cli to default to netfilter off setting. If still end-user wants to use iptables, this patch does not make it impossible; just install iptables, or nft-iptables, and run tailscale with argument --netfilter=on and it works out as it did before, tailscaled daemon still matches with iptables if it is found in $PATH. Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
* | pdns-recursor: update to 4.8.2Peter van Dijk2023-02-03
| | | | | | | | Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>
* | openssh: actually build openssh-server-pam with pam supportSibren Vasse2023-02-03
| | | | | | | | Signed-off-by: Sibren Vasse <github@sibrenvasse.nl>
* | openssh: update to 9.2p1Sibren Vasse2023-02-03
| | | | | | | | Signed-off-by: Sibren Vasse <github@sibrenvasse.nl>
* | crowdsec-firewall-bouncer: update to 0.0.25S. Brusch2023-02-03
| | | | | | | | | | | | | | | | | | | | | | | | | | Update crowdsec-firewall-bouncer to latest upstream release version 0.0.25 Signed-off-by: S. Brusch <ne20002@gmx.ch> Maintainer: Kerma Gérald <gandalf@gk2.net> Run tested: ipq40xx/generic, Fritzbox 4040, Openwrt 22.03.3 Rework: - now based on uci config file - create nftables tables and chains in initd script
* | stunnel: update version to 5.67Florian Eckert2023-02-01
| | | | | | | | Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* | shadowsocks-libev: ss-rules: Add 'auto-merge' flag to avoid conflictsLi Xin2023-01-28
| | | | | | | | | | | | | | Link: https://github.com/openwrt/packages/pull/19872 Signed-off-by: Li Xin <i@crzidea.com> (squash commits) Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* | haproxy: update to v2.6.8Christian Lachner2023-01-28
| | | | | | | | | | | | - Update haproxy download URL and hash Signed-off-by: Christian Lachner <gladiac@gmail.com>
* | bind: update to 9.18.11Noah Meyerhans2023-01-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes CVEs: - CVE-2022-3924: Fix serve-stale crash when recursive clients soft quota is reached. - CVE-2022-3736: Handle RRSIG lookups when serve-stale is active. - CVE-2022-3094: An UPDATE message flood could cause named to exhaust all available memory. This flaw was addressed by adding a new "update-quota" statement that controls the number of simultaneous UPDATE messages that can be processed or forwarded. The default is 100. A stats counter has been added to record events when the update quota is exceeded, and the XML and JSON statistics version numbers have been updated. Signed-off-by: Noah Meyerhans <frodo@morgul.net>
* | snort3: update to 3.1.53.0John Audia2023-01-28
| | | | | | | | | | | | | | | | | | | | Upstream bump Build system: x86_64 Build-tested: bcm2711/RPi4B Run-tested: bcm2711/RPi4B Signed-off-by: John Audia <therealgraysky@proton.me>
* | nextdns: Update to version 1.39.4Olivier Poitrey2023-01-28
| | | | | | | | Signed-off-by: Olivier Poitrey <rs@nextdns.io>
* | nextdns: Update to version 1.39.0Olivier Poitrey2023-01-26
| | | | | | | | Signed-off-by: Olivier Poitrey <rs@nextdns.io>
Powered by cgit, Themed by Ted Yin.