* major rewrite
* add support for multiple chains
* add mac whitelisting
* add support for multiple ssh daemons in parallel
* add an ipset report engine
* add mail notifications
* add suspend/resume functions
* add a cron wrapper to set an ipset related auto-timer for
automatic blocklist updates
* add a list wrapper to add/remove blocklist sources
* add 19.x and Turris OS 5.x compatibility code
* sources stored in an external compressed json file
(/etc/banip/banip.sources.gz)
* change Country/ASN download sources (faster/more reliable)
* fix DHCPv6/icmpv6 issues
Signed-off-by: Dirk Brenken <dev@brenken.org>
Fix starting problem:
Starting function should be named 'start_service' instead of 'start_instance'.
Fix reloading problem:
Register reload tigger for uci config itself.
And, xray does not support reload currently, so use legacy restart as reload.
Fixes: 6c9b96352f ("xray-core: add init script")
Signed-off-by: Tianling Shen <cnsztl@project-openwrt.eu.org>
Major changes are:
add "vfs objects = acl_xattr" parameter in configuration.
fix wrong group domain name in lsarpc response.
set to SID_TYPE_UNKNOWN if there is no domain sid in server.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
The iputils build system embeds git tags into the generated binaries
for use by commands like ping -V. Since openwrt packaging is done in
a different repository from the upstream repo, the tags it finds
aren't particularly meaningful, and we get confusing results like
those described at https://github.com/openwrt/packages/issues/13920
This change removes the git tag inspection in favor of the static
version string that's already known to the upstream build system.
Signed-off-by: Noah Meyerhans <frodo@morgul.net>
Drop obsolete patches
- 001-no-tests.patch
- 002-fix-cross-compilation.patch
Move several user-executable binaries from /usr/sbin to /usr/bin per
upstream.
Signed-off-by: Noah Meyerhans <frodo@morgul.net>
Current implementation of socat's init service doesn't allow to run more
complex configurations. As an example there's no possibility to execute
following command:
socat TCP-LISTEN:8080,fork,reuseaddr,bind=192.168.1.1 \
EXEC:"/sbin/ip netns exec somenetns socat STDIO TCP:10.0.0.1:80"
In such command the first line is argv[1] and the second line is
argv[2]. SocatOptions config option is a string. As as a consequence of
this each word will be passed as a separate argv element. Socat won't be
able to parse arguments correctly.
In order to mitigate this issue, we can also accept SocatOptions as a
list of strings. Following config file will work correctly:
config socat 'tunnel_8080_into_somenetns'
option enable '1'
list SocatOptions 'TCP-LISTEN:8080,fork,reuseaddr,bind=192.168.1.1'
list SocatOptions 'EXEC:"/sbin/ip netns exec somenetns socat STDIO TCP:10.0.0.1:80"'
While we're at it, pass stdout and stderr into logread.
Signed-off-by: Dobroslaw Kijowski <dobo90@gmail.com>
* The default local-adress makes Netopeer2-server listen on ipv4 only.
We change it to :: in order to listen on ipv6 as well as ipv4.
Signed-off-by: Jakov Smolic <jakov.smolic@sartura.hr>
* fix for possible exploit #13758
* sanetize all external template/config inputs
* fix some shellcheck warnings
Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
I checked the hostname for existing DNS A and AAAA entries and these
ones didn't have an entry.
Signed-off-by: Gerald Hansen <gerald.hansen@cloud.ionos.com>
As the default uclient-fetch doesn't support authentication header
and the ddns provider myonlineportal.net support also username and
passwort as url parameter this can be changed.
Signed-off-by: Gerald Hansen <gerald.hansen@cloud.ionos.com>
add eoip package,this can create ethernet
tunnels compatible with Mikrotik EoIP tunnel.
At current moment it is easiest way
to create stateless tunnel with Mikrotik.
Signed-off-by: Bogdan Shatik <bogdikxxx@mail.ru>
In IPv4 the default route can be written as
0.0.0.0/0
In IPv6 the default route can be written as
::/0
If u try
owipcalc 0.0.0.0/0 contains 1.1.1.1
or
owipcalc ::/0 contains ::1
owipcalc will respond with 0 meaning that the "default prefixes" do not
contain the routes.
That is why we check now for 0 prefix.
Furthermore, if the prefix is 0, i will be 16. We will access a negative
array entry in the line:
uint8_t net1 = x->s6_addr[15-i] & m;
Divide by % 16 to prevent i becoming 16:
uint8_t i = ((128 - a->prefix) / 8) % 16;
Signed-off-by: Nick Hainke <vincent@systemli.org>
This is a helpful utility, but it does not have any dependencies
in base repository. Move it to packages feed.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This is a helpful utility, but it does not have any dependencies
in base repository. Move it to packages feed.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Some users have reported that reloading dnsmasq does not always work. It
sometimes stop responding to DNS lookup requests after being reloaded.
This patch changes "safe-search-maintenance" so that it restarts dnsmasq
instead of reloading it.
Signed-off-by: Gregory L. Dietsche <gregory.dietsche@cuw.edu>
Ensure that the best available IP is always used for all supported
safe-search providers. This is accomplished by periodically checking
DNS for the most recent list of IP addresses associated with each
provider.
Signed-off-by: Gregory L. Dietsche <gregory.dietsche@cuw.edu>
Dirk Brenken
Lucian Cristian
Tianling Shen
Rosen Penev
Noah Meyerhans
Glenn Strauss
Stan Grishin
Jakov Smolic
W. Michael Petullo
Marcel Telka
Philip Prindeville
Dobroslaw Kijowski
Florian Eckert
Edi Turn
Nick Hainke
Andy Walsh
Gerald Hansen
Gerald Hansen
Olivier Poitrey
Jan Pavlinec
Martin Johansson
Bogdan Shatik
Adrian Schmutzler
Karl Palsson
Jan Hak
Gregory L. Dietsche
Nishant Sharma
Nicholas Smith