🐶 Sync 2026-10-07 11:59:35

luci-app-adguardhome/.official_channel

@@ -1 +1 @@
-snapshot
+both

luci-app-adguardhome/.official_version_release

@@ -1 +1 @@
-26.278.51687~be446e3
+26.278.68466~6e4d979

luci-app-fwlive/Makefile

@@ -11,8 +11,8 @@ LUCI_DESCRIPTION:=Live firewall log table (firewall4/nft; iptables-tagged lines
 LUCI_DEPENDS:=+luci-base +logd +jsonfilter
 LUCI_PKGARCH:=all
 
-PKG_VERSION:=0.1.51
-PKG_RELEASE:=62
+PKG_VERSION:=0.1.52
+PKG_RELEASE:=63
 
 # Reproducible build: honor SOURCE_DATE_EPOCH from the build environment (set by docker-sdk.sh / CI).
 ifdef SOURCE_DATE_EPOCH

luci-app-fwlive/README.md

@@ -29,7 +29,7 @@ LuCI **Firewall Live View** — client-side JS view polling `ubus fwlive poll` (
 | `root/usr/libexec/fwlive-adaptive-cap.sh` | Layer 1 adaptive poll cap (sourced by `rpcd/fwlive`) |
 | `root/usr/libexec/fwlive-logging.sh` | WAN zone logging helpers |
 | `root/lib/upgrade/keep.d/luci-app-fwlive` | Keep `/etc/fwlive/` across sysupgrade |
-| `/etc/fwlive/wan-log-baseline` | Written on first **Enable logging** (and best-effort on already-on enable with no baseline file, recording the current mask with fwlive's filter-log bit cleared); `prerm` restores it on uninstall. A successful disable/reload, including an already-disabled retry, drops the marker when no later fwlive toggle has taken ownership; this preserves operator changes to other log-mask bits, including staged edits. A disable commit race (`firewall_commit_raced`) is still reported as a failure, but a successful reload also retires the marker because it only tracks fwlive's own toggle. If logging is already off but the marker remains, Disable retries `/etc/init.d/firewall reload`; pending UCI changes return `firewall_changes_pending` without reloading, and reload failure returns `firewall_reload_failed` while retaining the marker. Lock, read, or generation mismatch also keeps it for uninstall recovery. Restore is skipped (file kept; `fwlive` syslog only) when there is no WAN zone, the lock is unavailable, firewall changes are pending, the commit does not verify, reload fails, or the value after reload does not match the baseline. Disable of a pre-existing/foreign log bit is not snapshotted, so uninstall will not restore that bit. |
+| `/etc/fwlive/wan-log-baseline` | Written on first **Enable logging** (and best-effort on already-on enable with no baseline file, recording the current mask with fwlive's filter-log bit cleared); `prerm` restores it on uninstall. A raced Enable commit retains the marker for uninstall recovery because the committed value may have changed. A successful disable/reload, including an already-disabled retry, drops the marker when no later fwlive toggle has taken ownership; this preserves operator changes to other log-mask bits, including staged edits. A disable commit race (`firewall_commit_raced`) is still reported as a failure, but a successful reload also retires the marker because it only tracks fwlive's own toggle. If logging is already off but the marker remains, Disable retries `/etc/init.d/firewall reload`; pending UCI changes return `firewall_changes_pending` without reloading, and reload failure returns `firewall_reload_failed` while retaining the marker. Lock, read, or generation mismatch also keeps it for uninstall recovery. Restore is skipped (file kept; `fwlive` syslog only) when there is no WAN zone, the lock is unavailable, firewall changes are pending, the commit does not verify, reload fails, or the value after reload does not match the baseline. Disable of a pre-existing/foreign log bit is not snapshotted, so uninstall will not restore that bit. |
 | `root/usr/libexec/fwlive-log-filter.sh` | Server-side firewall-only filter (`isFirewallEvent` parity) |
 | `root/usr/libexec/fwlive-is-firewall-event.sh` | Shared filter logic (sourced by filter + tests) |
 | `root/usr/libexec/fwlive-is-firewall-event.awk` | **Generated** standalone classifier from `CLASSIFY_SPEC`; loaded by `fwlive-is-firewall-event.sh` |

luci-app-fwlive/htdocs/luci-static/resources/fwlive/constants.js

@@ -9,7 +9,7 @@
  */
 return baseclass.extend({
 	/* Keep in sync with openwrt-feed/luci-app-fwlive/Makefile PKG_VERSION. */
-	APP_VERSION: '0.1.51',
+	APP_VERSION: '0.1.52',
 	ROW_LIMIT_OPTIONS: [25, 50, 100, 250, 500, 1000, 2000],
 	DEFAULT_ROW_LIMIT: 100,
 	FETCH_MODE_OPTIONS: ['auto', 'manual'],

luci-app-open-box/Makefile

@@ -1,8 +1,8 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-open-box
-PKG_VERSION:=0.1.290
-PKG_RELEASE:=13
+PKG_VERSION:=0.1.291
+PKG_RELEASE:=14
 
 PKG_MAINTAINER:=liandu2024
 PKG_LICENSE:=GPL-3.0-or-later

luci-app-sqm-autorate/root/usr/share/rpcd/acl.d/luci-app-sqm.json

@@ -4,19 +4,24 @@
 		"read": {
 			"file": {
 				"/var/run/sqm/available_qdiscs": [ "list" ],
-				"/usr/lib/sqm/*.qos.help": [ "read" ],
+				"/usr/lib/sqm/*.qos.help": [ "read" ]
+			},
+			"uci": [ "sqm" ],
+			"ubus": {
+				"file": [ "read", "list" ]
+			}
+		},
+		"write": {
+			"file": {
 				"/etc/init.d/sqm enable" : [ "exec" ],
 				"/etc/init.d/sqm start" : [ "exec" ],
 				"/etc/init.d/sqm-autorate enable" : [ "exec" ],
 				"/etc/init.d/sqm-autorate start" : [ "exec" ]
 			},
-			"uci": [ "sqm" ],
 			"ubus": {
-				"file": [ "read", "list" ],
+				"file": [ "exec" ],
 				"luci": [ "setInitAction" ]
-			}
 			},
-		"write": {
 			"uci": [ "sqm" ]
 		}
 	}

luci-mod-network/htdocs/luci-static/resources/view/network/wireless.js

@@ -483,6 +483,8 @@ function formatConfigEncryption(enc) {
 
 	if (enc == '' || enc == 'none')
 		return _('None');
+	if (enc == 'owe')
+		return 'OWE';
 	if (enc == 'psk2' || enc.indexOf('psk2+') == 0)
 		return 'WPA2-PSK';
 	if (enc == 'psk' || enc.indexOf('psk+') == 0)
@@ -509,12 +511,43 @@ function formatConfigEncryption(enc) {
 	return enc;
 }
 
+// Keep an incompatible saved value visible as invalid, never silently replace it.
+function restrictQca6GHzChoices(option, getBand, allowed, message) {
+	let widget, section;
+	const update = function() {
+		if (!widget)
+			return;
+		widget.querySelectorAll('option').forEach(choice => {
+			const incompatible = getBand() == '6g' && !allowed.includes(choice.value);
+			choice.disabled = incompatible;
+			choice.hidden = incompatible && !choice.selected;
+		});
+	};
+	option.renderWidget = function(section_id, option_index, cfgvalue) {
+		section = section_id;
+		widget = form.ListValue.prototype.renderWidget.call(this, section_id, option_index, cfgvalue);
+		widget.addEventListener('change', update);
+		update();
+		return widget;
+	};
+	option.validate = function(section_id, value) {
+		return getBand() != '6g' || allowed.includes(value) || message;
+	};
+	return function() {
+		update();
+		if (widget)
+			option.triggerValidation(section);
+	};
+}
+
 function getConfigEncryptionValue(section_id, hwtype) {
 	const enc = String(uci.get('wireless', section_id, 'encryption') || '');
 	const sae = uci.get('wireless', section_id, 'sae');
 
 	if (enc == 'wep')
 		return 'wep-open';
+	if (isQcaWifiHwtype(hwtype) && uci.get('wireless', section_id, 'owe') == '1')
+		return 'owe';
 
 	if (isQcaWifiHwtype(hwtype) && sae == '1') {
 		if (enc == 'psk2' || enc.indexOf('psk2+') == 0)
@@ -548,12 +581,18 @@ function getConfigCipherValue(section_id, hwtype) {
 }
 
 function getDisplayEncryption(radioNet) {
+	const hwtype = uci.get('wireless', radioNet.getWifiDeviceName(), 'type');
+	const configured = getConfigEncryptionValue(radioNet.getName(), hwtype);
+	// The QCA iwinfo backend reports OWE as WPA2-PSK.
+	if (isQcaWifiHwtype(hwtype) && configured == 'owe')
+		return formatConfigEncryption(configured);
+
 	const encryption = radioNet.getActiveEncryption();
 
 	if (encryption && encryption != '-')
 		return encryption;
 
-	return formatConfigEncryption(getConfigEncryptionValue(radioNet.getName(), uci.get('wireless', radioNet.getWifiDeviceName(), 'type')));
+	return formatConfigEncryption(configured);
 }
 
 function getDisplayBSSID(radioNet) {
@@ -2240,6 +2279,11 @@ var CBIWifiFrequencyValue = form.Value.extend({
 			E('br', { 'style': 'clear:left' })
 		]);
 
+		elem.addEventListener('change', () => {
+			if (this.onBandChange)
+				this.onBandChange();
+		});
+
 		return this.setInitialValues(section_id, elem, cfgvalue);
 	},
 
@@ -2782,6 +2826,15 @@ return view.extend({
 				 * Mode/Band/Channel/Width controls in the modal.
 				 */
 				o.ucisection = radioNet.getWifiDeviceName();
+				const frequencyOption = o;
+				const getSecurityBand = function() {
+					const device = radioNet.getWifiDeviceName();
+					const field = frequencyOption.map.findElement('data-field', frequencyOption.cbid(device));
+					const band = field && field.querySelector('select.band');
+					return band ? band.value : getConfiguredBand(hwtype,
+						uci.get('wireless', device, 'hwmode'), uci.get('wireless', device, 'channel'),
+						uci.get('wireless', device, 'band'), uci.get('wireless', device, 'htmode'));
+				};
 
 				if (hwtype == 'mac80211' || isQcaWifiHwtype(hwtype)) {
 					o = ss.taboption('general', CBIWifiTxPowerValue, 'txpower', _('Maximum transmit power'), _('Specifies the maximum transmit power the wireless radio may use. Depending on regulatory requirements and wireless usage, the actual transmit power may be reduced by the driver.'));
@@ -3227,6 +3280,15 @@ return view.extend({
 						c = 'ccmp';
 
 					if (isQcaWifiHwtype(hwtype)) {
+						if (e == 'owe') {
+							stored_e = 'ccmp';
+							uci.set('wireless', section_id, 'owe', '1');
+							uci.set('wireless', section_id, 'ieee80211w', '2');
+							uci.unset('wireless', section_id, 'key');
+						}
+						else {
+							uci.unset('wireless', section_id, 'owe');
+						}
 						if (e == 'sae-mixed') {
 							stored_e = 'psk2';
 							uci.set('wireless', section_id, 'sae', '1');
@@ -3246,6 +3308,7 @@ return view.extend({
 				};
 
 				o = ss.taboption('encryption', form.ListValue, 'cipher', _('Cipher'));
+				const cipherOption = o;
 				o.depends('encryption', 'wpa');
 				o.depends('encryption', 'wpa2');
 				o.depends('encryption', 'wpa3');
@@ -3448,6 +3511,17 @@ return view.extend({
 					encr.value(crypto_mode[0], '%s (%s)'.format(crypto_mode[1], security_level));
 				});
 
+				if (isQcaWifiHwtype(hwtype)) {
+					const updateEncryption = restrictQca6GHzChoices(encr, getSecurityBand,
+						['sae', 'owe'], _('6 GHz requires WPA3-SAE or OWE.'));
+					const updateCipher = restrictQca6GHzChoices(cipherOption, getSecurityBand,
+						['auto', 'ccmp', 'ccmp256', 'gcmp', 'gcmp256'], _('TKIP is not supported on 6 GHz.'));
+					frequencyOption.onBandChange = function() {
+						updateEncryption();
+						updateCipher();
+					};
+				}
+
 				// QR Code
 				o = ss.taboption('encryption', form.DummyValue, '_qrops', _('QR Code'),
 					_('SSID and passwords with URIencoded sequences (e.g. %20) may not work.'));

shunt/Makefile

@@ -6,7 +6,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=shunt
 PKG_VERSION:=0.1.11
-PKG_RELEASE:=6
+PKG_RELEASE:=7
 PKG_LICENSE:=GPL-3.0-or-later
 PKG_LICENSE_FILES:=
 PKG_MAINTAINER:=Dirk Brenken <dev@brenken.org>

shunt/src/netifd.uc

@@ -9,9 +9,10 @@
 function nexthop(entry, fam) {
 	let dflt = (fam == 4) ? '0.0.0.0' : '::';
 
-	for (let r in (entry?.route ?? []))
-		if (r?.target == dflt && r?.mask == 0 && length(r?.nexthop ?? ''))
+	for (let r in (entry?.route ?? [])) {
+		if (r?.target == dflt && r?.mask == 0 && length(r?.nexthop ?? '') && r.nexthop != dflt)
 			return r.nexthop;
+	}
 
 	return null;
 }