This is a security release.
Notable Changes
* CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
Reverts [1] to resolve the following build error on macOS:
/Volumes/wrt3200/openwrt/staging_dir/hostpkg/usr/bin/perl installperl --destdir=/Volumes/wrt3200/openwrt/build_dir/target-arm_cortex-a9+vfpv3-d16_musl_eabi/perl/perl-5.38.2/ipkg-install
WARNING: You've never run 'make test' or some tests failed! (Installing anyway.)
/usr/bin/perl5.38.2
error: /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/install_name_tool: input file: /Volumes/wrt3200/openwrt/build_dir/target-arm_cortex-a9+vfpv3-d16_musl_eabi/perl/perl-5.38.2/ipkg-install/usr/bin/perl5.38.2 is not a Mach-O file
[1] 88efce3814
Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
Changes since v0.5:
Bugfixes:
- bugfix: 'geoip-shell on' command errors out on iptables-based systems
- bugfix: when changing the update cron schedule, old cron job does not get removed
- bugfix: in some edge cases, the update cron job may not be created
- bugfix: incorrect mask bits used when creating a rule allowing ipv6 link-local connections (/8 instead of /10)
- bugfix: geoip-shell-fetch.sh: fix running without root permissions
Improvements:
- nftables variant: attach the base chain to the prerouting netfilter hook with priority -141 (rather than -150) to make rules processing deterministic when other rules exist which have priority 'mangle' (-150), making it easier to create custom rules which will be processed before geoip-shell rules
- include information on currently used firewall backend utility (nftables or iptables) in the status report
- avoid unnecessary re-fetching of ip lists when running 'geoip-shell configure'
- randomize the default update schedule's minute between 10 and 20 (previously was always 15)
- randomize the automatic update second between 0 and 59
- improve console messages and the status report
- update and improve the general documentation
- improve OpenWrt-specific documentation
Signed-off-by: Anton Khazan <antonk.d3v@gmail.com>
Fix broken compile with external Toolchain.
Commit 32aaaaa7d3 ("xtables-addons: pass correct flags to
compile and install") simplified and dropped the custom Compile/Install
in favor of the default one. Problem is that it dropped DESTDIR
resulting in the package having problem on finishing install.
The commit then was reworked with c83b8787a5 ("xtables-addons: adapt
build to EXTERNAL_TOOLCHAIN" that reintroduced DESTDIR and also
introduced a useless custom flag to fix wrong ARCH.
ARCH is fixed by kernel.mk and doesn't depend on external Toolchain or
not. For ARCH that require fixing, kernel.mk should be fixed instead of
adding custom function to packages Makefile.
Drop the custom ARCH handling and use Compile/Install everytime.
Fixes: 32aaaaa7d3 ("xtables-addons: pass correct flags to compile and install")
Fixes: c83b8787a5 ("xtables-addons: adapt build to EXTERNAL_TOOLCHAIN")
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
- Add before/after active state event callbacks in UCI config.
- Add volume change event callbacks in UCI config.
- Add unfixable error event callbacks in UCI config.
As of the current shairport-sync release, all event callbacks have been
mapped to UCI config.
Signed-off-by: David Andreoletti <david@andreoletti.net>
If the iPhone restarts while the USB cable is still connected,
tethering does not work. This can be fixed by reconnecting.
Fix: if the hotplug.d script detects that carrier is disabled
(no communication), the USB link is reset, and then the
usbmuxd service is restarted. Tethering starts even before
the iPhone is unlocked. As a side effect, if tethering is not
enabled, the iPhone will ding a second time after 5 seconds.
Add dependency on usbutils for usbreset, remove dependency on librt.
[1] https://github.com/libimobiledevice/usbmuxd/issues/218
[2] https://github.com/openwrt/openwrt/issues/12566#issuecomment-2066305622
Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
Remove local patch as upstream has a different solution applied.
Use PKG_SOURCE_DATE to get rid of weird apk version.
Remove various variables that are default anyway.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
* fixed possible Set search race condition (initiated from LuCI frontend)
* fixed the "no result" Set search problem in LuCI
* removed abandoned feeds: spamhaus edrop (was merged with spamhaus drop)
Signed-off-by: Dirk Brenken <dev@brenken.org>
Bump to latest 2.0.25.1 release
Drop upstream PCRE2 patch and alarm memory leak fix.
Rework and refresh patch due to release bump.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* include `server:` directive at the top of unbound file
* update unbound-related outputGzip variable to include full path
* return always_nxdomain for blocked domains
* also update copyright stamp/license
Signed-off-by: Stan Grishin <stangri@melmac.ca>
* added a DDoS protection rules in a new pre-routing chain to prevent common ICMP, UDP and SYN flood attacks and drop spoofed tcp flags & invalid conntrack packets, flood tresholds are configured via 'ban_icmplimit' (default 10/s), 'ban_synlimit' (default 10/s) and 'ban_udplimit' (default 100/s)
* the new pre-routing rules are tracked via named nft counters and are part of the standard reporting, set 'ban_logprerouting' accordingly
* block countries dynamically by Regional Internet Registry (RIR)/regions, e.g. all countries related to ARIN. Supported service regions are: AFRINIC, ARIN, APNIC, LACNIC and RIPE, set 'ban_region' accordingly
* it's now possible to always allow certain protocols/destination ports in wan-input and wan-forward chains, set 'ban_allowflag' accordingly - e.g. ' tcp 80 443-445'
* filter/convert possible windows line endings of external feeds during processing
* the cpu core autodetection is now limited to max. 16 cores in parallel, set 'ban_cores' manually to overrule this limitation
* set the default nft priority to -100 for banIP input/forward chains (pre-routing is set to -150)
* update readme
* a couple of bugfixes & performance improvements
* removed abandoned feeds: darklist, ipblackhole
* added new feeds: becyber, ipsum, pallebone, debl (changed URL)
* requires a LuCI frontend update as well (separate PR/commit)
Signed-off-by: Dirk Brenken <dev@brenken.org>
Remove the unnecessary 'r' from PKG_RELEASE as it is
added automatically by the build system to the final versioning.
(Current version leads into 'geoip-shell_0.5-rr2_all.ipk')
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
* make PKG_RELEASE numeric again
* made a release bump due to a newly added patch (see de4ef9d169 for details)
* remove maintainer (as requested in #23890
Signed-off-by: Dirk Brenken <dev@brenken.org>
Stan Grishin