aboutsummaryrefslogtreecommitdiff
path: root/net
Commit message (Collapse)AuthorAge
...
* | netavark: add new packageOskari Rauta2023-05-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | podman is moving from cni to netavark. Netavark supports currently only iptables, so I was in touch some time ago with mainstream maintainer and provided a "none" firewall driver - to make it possible to use netavark without firewalling features. Driver cannot be selected at this time without environment variable that selects it, so I made a config file for openwrt and a wrapper script that takes advantage of it. Available options are iptables, nftables and none - but selecting nftables just tells user that nftables isn't yet supported. firewall "none" driver is not yet included in release, so that's why we use git version instead. I chose latest commit instead of commit with none driver. Description: Netavark is a rust based network stack for containers. It is being designed to work with Podman but is also applicable for other OCI container management applications. Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
* | siit: fix compilation warningChristian Marangi2023-05-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix compilation warning for stack limit and variable length array. Fix compilation warning: CC [M] /home/ansuel/openwrt-ansuel/openwrt/build_dir/target-aarch64_cortex-a53_musl/linux-ipq807x_generic/siit-1.2/siit.o ../siit-1.2/siit.c: In function 'ip4_fragment': ../siit-1.2/siit.c:988:9: error: ISO C90 forbids variable length array 'buff' [-Werror=vla] 988 | char buff[FRAG_BUFF_SIZE+hdr_len]; /* buffer to form new fragment packet */ | ^~~~ ../siit-1.2/siit.c: In function 'siit_xmit': ../siit-1.2/siit.c:1359:1: error: the frame size of 2144 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] 1359 | } | ^ cc1: all warnings being treated as errors Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* | lighttpd: select mbedtls for default cryptolibGlenn Strauss2023-05-13
| | | | | | | | | | | | | | | | | | wolfssl has been the base TLS library in openwrt since 21.02 mbedtls will once again be the base TLS library in openwrt 23.?? Default to mbedtls for digest functions in lighttpd Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
* | lighttpd: include mod_h2 in base packageGlenn Strauss2023-05-13
| | | | | | | | | | | | | | | | | | | | | | | | | | The next version of lighttpd will move HTTP/2 support from the lighttpd base executable into a separate module: mod_h2 Include patch to do so now, and update packaging to handle it. HTTP/2 support is enabled by default since lighttpd 1.4.59, but if HTTP/2 support is explicitly disabled in the configuration, then mod_h2 will not be loaded, thereby reducing lighttpd memory use. Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
* | lighttpd: select wolfssl for default cryptolibGlenn Strauss2023-05-13
| | | | | | | | | | | | | | | | wolfssl has been a base TLS library in openwrt since 21.02 Default to wolfssl instead of Nettle for digest functions in lighttpd Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
* | lighttpd: update to lighttpd 1.4.70 release hashGlenn Strauss2023-05-13
| | | | | | | | | | | | remove patches included upstream Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
* | banip: release 0.8.6-1Dirk Brenken2023-05-12
| | | | | | | | | | | | | | | | * made the fetch utility function/autodetection more bullet proof * no longer add suspicious IPs to the local blocklist when the nft set timeout has been set * restructure internal functions & small fixes Signed-off-by: Dirk Brenken <dev@brenken.org>
* | Merge pull request #20970 from nmav/tmp-ocservNikos Mavrogiannopoulos2023-05-12
|\ \ | |/ |/| ocserv: updated to 1.1.7
| * ocserv: updated to 1.1.7Nikos Mavrogiannopoulos2023-05-09
| | | | | | | | Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
* | wsdd2: fix stopping serviceRafał Miłecki2023-05-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Function start_service() is called whenever service may need reloading. If SMB server is not running it could be simply because it has been stopped. Reloading service in such case is not an error so: 1. Don't log error as it isn't one 2. Don't exit with error code as it was confusing procd This change fixes scenario like: /etc/init.d/ksmbd stop /etc/init.d/wsdd2 reload (previously above wasn't stopping wsdd2) Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* | Merge pull request #20801 from jefferyto/python-pyprojectJeffery To2023-05-10
|\ \ | | | | | | python: Add proper support for pyproject.toml-based builds, update Python packages for new build process
| * | onionshare-cli: Force old Python build processJeffery To2023-04-24
| | | | | | | | | | | | | | | | | | | | | This package requires poetry to build using the new Python build process but poetry is not available, so force the old build process for now. Signed-off-by: Jeffery To <jeffery.to@gmail.com>
| * | nmap: Force old Python build processJeffery To2023-04-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This package isn't compatible with the new Python build process yet, so force the old build process for now. This also adds a call to Py3Build/Install, for when the new build process can be used. Signed-off-by: Jeffery To <jeffery.to@gmail.com>
| * | fail2ban: Override Build/Compile instead of Py3Build/CompileJeffery To2023-04-24
| | | | | | | | | | | | | | | | | | | | | This allows changes to the Python build system apply more easily to the package. Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* | | Merge pull request #20944 from stangri/master-https-dns-proxyStan Grishin2023-05-08
|\ \ \ | | | | | | | | https-dns-proxy: fixes/improvements
| * | | https-dns-proxy: fixes/improvementsStan Grishin2023-05-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * use shared memory to store output data * add family option to firewall json objects, due to reports that IPv6 hijacking doesn't work without explicit family declaration Signed-off-by: Stan Grishin <stangri@melmac.ca>
* | | | Merge pull request #20942 from stangri/master-simple-adblockStan Grishin2023-05-08
|\ \ \ \ | | | | | | | | | | simple-adblock: add family to firewall json objects
| * | | | simple-adblock: add family to firewall json objectsStan Grishin2023-05-07
| |/ / / | | | | | | | | | | | | Signed-off-by: Stan Grishin <stangri@melmac.ca>
* | | | Merge pull request #20930 from stangri/master-pbrStan Grishin2023-05-08
|\ \ \ \ | |_|_|/ |/| | | pbr: ipv6 & migration bugfixes
| * | | pbr: ipv6 & migration bugfixesStan Grishin2023-05-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * suppress RTNETLINK errors when inserting ipv6 routes * only display global scope IPv6 gateways in status/WebUI * stop and disable vpn-policy-routing when migrating Signed-off-by: Stan Grishin <stangri@melmac.ca>
* | | | mwan3: bump PKG_VERSION to 2.11.7Anna Tikhomirova2023-05-08
| | | | | | | | | | | | | | | | Signed-off-by: Anna Tikhomirova <vamp@vampik.ru>
* | | | mwan3: reset score to up+down on connectedFlorian Eckert2023-05-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Set the score value to the maximum value when the connected function is called. The same happens with a disconnected event, the score value is there set to zero. Suggested-by: Anna Tikhomirova <vamp@vampik.ru> Suggested-by: Maxim Mikityanskiy <maxtram95@gmail.com> Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* | | | mwan3: refactoring mwan3track action handlingFlorian Eckert2023-05-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Refactoring the score handling, so that only one action could take place during run. The behaviour should be more comprehensible, since several score actions are not processed at the same time. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* | | | banip: release 0.8.5-2Dirk Brenken2023-05-08
| | | | | | | | | | | | | | | | | | | | | | | | * fixed a log parser regression introduced in latest 0.8.4 update Signed-off-by: Dirk Brenken <dev@brenken.org>
* | | | crowdsec-firewall-bouncer: new upstream release version 0.0.26S. Brusch2023-05-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: S. Brusch <ne20002@gmx.ch> Maintainer: Kerma Gérald <gandalf@gk2.net> Run tested: ipq40xx/generic, Fritzbox 4040, Openwrt 22.03.5 Update crowdsec-firewall-bouncer to latest upstream release version 0.0.26
* | | | snort3: update to 3.1.61.0John Audia2023-05-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Upstream bump Removed upstreamed patch: 900-fix_build_for_archs_contain_plus.patch[1] 1. https://github.com/snort3/snort3/commit/4de62ca9b9bfea4049ebe373a07076284b121bfe Build system: x86_64 Build-tested: bcm2711/RPi4B Run-tested: bcm2711/RPi4B Signed-off-by: John Audia <therealgraysky@proton.me>
* | | | haproxy: update to v2.6.13Christian Lachner2023-05-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | - Update haproxy PKG_VERSION and PKG_HASH - See changes: http://git.haproxy.org/?p=haproxy-2.6.git;a=shortlog Signed-off-by: Christian Lachner <gladiac@gmail.com>
* | | | cloudflared: Update to 2023.5.0Tianling Shen2023-05-07
| | | | | | | | | | | | | | | | Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
* | | | smartdns: bump to 1.2023.42Nick Peng2023-05-07
| |/ / |/| | | | | | | | Signed-off-by: Nick Peng <pymumu@gmail.com>
* | | banip: release 0.8.5-1Dirk Brenken2023-05-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * add support for external allowlist URLs to reference additional IPv4/IPv6 feeds, set 'ban_allowurl' accordingly * make download retries in case of an error configurable, set 'ban_fetchretry' accordingly (default 5) * small fixes * readme update * LuCI update (separate commit) Signed-off-by: Dirk Brenken <dev@brenken.org>
* | | nginx: fix compilation error for nginx-fullChristian Marangi2023-05-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix compilation error for stream module not converted to use the PACKAGE config flag and a missing required dependency for the DAV ext module. Drop additional config for STREAM module since they are now included and built by default. Fixes: 65a676ed56fb ("nginx: introduce support for dynamic modules") Fixes: #20906 Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* | | uwsgi: make LuCI workGlen Huang2023-05-05
|/ / | | | | | | | | | | LuCI is no longer powered by lua, but ucode Signed-off-by: Glen Huang <me@glenhuang.com>
* | Merge pull request #20912 from stangri/master-pbrStan Grishin2023-05-04
|\ \ | | | | | | pbr: update to 1.1.1-1
| * | pbr: update to 1.1.1-1Stan Grishin2023-05-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | *** MAKEFILE *** * remove libubus dependency as it was causing issues https://forum.openwrt.org/t/policy-based-routing-pbr-package-discussion/140639/318 * move firewall hotplug directory/file creation out of default section into pbr and pbr-iptables packages sections in preparation for dropping it from pbr * fix no new line after output when uninstalling packages *** UCI-DEFAULTS *** * only add firewall include to firewall config if the include file exists * add shellcheck exception to netifd uci-defaults file *** SCRIPTS *** * more informative logging for firewall and iface hotplug scripts * more informative logging for firewall include script *** SERVICE *** * introduce lock-file to prevent package starting on external events if it hasn't been auto- or manually started before * use the `ip`, not `ip-full` command to prevent errors on OpenWrt 21.02 * parse firewall WAN zone to append list of interfaces * append error and warning "arrays" with new messages * used shared memory to store the service output/logging messages * improve is_ovpn function to filter out false positives when interface names started with `tun` * introduce is_valid_ovpn to find OpenVPN tunnels where the device name in OpenVPN config matches the device name in network config * introduce opkg_get_version to compare versions of principal and luci packages * better code to obtain AdGuardHome version with betas installed * optimize code and add better logging for errors when inserting policies with iptables * optimize code and add better logging for errors when inserting policies with nft * bugfix: insert policies in all specified protocols * bugfix: support using physical devices in policies in nft mode * bugfix: use iptPrefix, not nftPrefix in iptables commands * implement Tor support in nft mode * bugfix: fix spelling for User File Syntax error * restart service fully (instead of quick reload) for OpenVPN interface events, as the order/number of supported interfaces * more verbose output (showing handles) of status in nft mode * improve `icmp_interface`, `ignored_interface`, `supported_interface` validation regexes * improve `interface`, validation regex Signed-off-by: Stan Grishin <stangri@melmac.ca>
* | | banip: update 0.8.4-5Dirk Brenken2023-05-04
| | | | | | | | | | | | | | | | | | | | | | | | * fix remaining small issues * standardize log wording * polished up for branch 23.x Signed-off-by: Dirk Brenken <dev@brenken.org>
* | | banip: update 0.8.4-4Dirk Brenken2023-05-04
| | | | | | | | | | | | | | | | | | | | | | | | * add housekeeping to the autoallow function, only the current uplink will be held * fix small issues * cosmetics Signed-off-by: Dirk Brenken <dev@brenken.org>
* | | mwan3: bump PKG_VERSION to 2.11.6Anna Tikhomirova2023-05-04
| | | | | | | | | | | | Signed-off-by: Anna Tikhomirova <vamp@vampik.ru>
* | | mwan3: fix addition of routes to mwan3_connected ipsetAnna Tikhomirova2023-05-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Addition of routes to mwan3_connected ipset is broken. The ipset name was changed from mwan3_connected_v4/6 to mwan3_connected_ipv4/6, but this change was not reflected in mwan3rtmon. Signed-off-by: Anna Tikhomirova <vamp@vampik.ru> * Update commit message Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* | | mwan3: bump PKG_VERSION to 2.11.5Anna Tikhomirova2023-05-04
| | | | | | | | | | | | Signed-off-by: Anna Tikhomirova <vamp@vampik.ru>
* | | mwan3: fix addition of iptables rules for mwan3 sticky rulesAnna Tikhomirova2023-05-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Addition of iptables rules for mwan3 sticky rules is broken, resulting in non-working sticky rules. The required parameters for the function 'mwan3_set_sticky_iptables' were passed in the wrong order. Signed-off-by: Anna Tikhomirova <vamp@vampik.ru> * Update commit message * Quoting function arguments Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* | | tailscale: update to 1.40.0Zephyr Lykos2023-05-03
| | | | | | | | | | | | Signed-off-by: Zephyr Lykos <git@mochaa.ws>
* | | banip: update 0.8.4-3Dirk Brenken2023-05-02
| | | | | | | | | | | | | | | | | | * add the option 'ban_autoallowuplink' to limit the uplink autoallow function: 'subnet' (default), 'ip' or 'disable' Signed-off-by: Dirk Brenken <dev@brenken.org>
* | | Merge pull request #20768 from stangri/master-simple-adblockStan Grishin2023-05-01
|\ \ \ | | | | | | | | simple-adblock: implement curl_additional_param compressed_cache_dir
| * | | simple-adblock: implement curl_additional_param compressed_cache_dirStan Grishin2023-04-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * curl_additional_param: to pass additional parameters (like proxy) to curl * compressed_cache_dir: where to store compressed cache in non-volitile memory Signed-off-by: Stan Grishin <stangri@melmac.ca>
* | | | sing-box: update to 1.2.6Van Waholtz2023-05-01
| | | | | | | | | | | | | | | | Signed-off-by: Van Waholtz <brvphoenix@gmail.com>
* | | | kea: procd_close_instance doesn't take a parameterPhilip Prindeville2023-05-01
| | | | | | | | | | | | | | | | Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* | | | kea: Update to 2.2.0Philip Prindeville2023-05-01
| | | | | | | | | | | | | | | | Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* | | | openssh: add respawn and reloading via signalErik Karlsson2023-05-01
| | | | | | | | | | | | | | | | | | | | | | | | Configure the openssh server to respawn. Reload by sending SIGHUP Signed-off-by: Erik Karlsson <erik.karlsson@genexis.eu>
* | | | lighttpd: build fixesGlenn Strauss2023-05-01
| |/ / |/| | | | | | | | Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
* | | samba4: decouple quotas from vfs optionJavier Marcet2023-04-29
| | | | | | | | | | | | Signed-off-by: Javier Marcet <javier@marcet.info>
Powered by cgit, Themed by Ted Yin.