From 8f12eb3394d8d349310d1b821fb7eca5513f4aed Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Fri, 22 Mar 2019 02:34:48 +0800
Subject: [PATCH 01/56] pptpctrl: rename pppd client ifname

---
 .../patches/105-ppp-ifname-for-natcap.patch   | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 net/pptpd/patches/105-ppp-ifname-for-natcap.patch

diff --git a/net/pptpd/patches/105-ppp-ifname-for-natcap.patch b/net/pptpd/patches/105-ppp-ifname-for-natcap.patch
new file mode 100644
index 0000000000..4dd085f5e0
--- /dev/null
+++ b/net/pptpd/patches/105-ppp-ifname-for-natcap.patch
@@ -0,0 +1,22 @@
+--- a/pptpctrl.c
++++ b/pptpctrl.c
+@@ -681,6 +681,7 @@ static int startCall(char **pppaddrs, st
+  */
+ static void launch_pppd(char **pppaddrs, struct in_addr *inetaddrs)
+ {
++        static __thread char pppname[16];
+         char *pppd_argv[16];
+         int an = 0;
+         sigset_t sigs;
+@@ -801,6 +802,11 @@ static void launch_pppd(char **pppaddrs,
+                  pppd_argv[an++] = inet_ntoa(inetaddrs[1]);
+         }
+ 
++        snprintf(pppname, 16, "pcap%u", getpid());
++        pppname[15] = 0;
++        pppd_argv[an++] = "ifname";
++        pppd_argv[an++] = pppname;
++
+         pppd_argv[an++] = "remotenumber";
+         pppd_argv[an++] = inet_ntoa(inetaddrs[1]);
+ #endif

From 385143f5622f6f00cc70427288ce4e441dd0b847 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Thu, 24 Oct 2019 05:18:57 +0800
Subject: [PATCH 02/56] net/sqm-scripts: depends on
 BUSYBOX_CONFIG_FEATURE_STAT_FORMAT

Signed-off-by: Chen Minqiang <ptpt52@gmail.com>
---
 net/sqm-scripts/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sqm-scripts/Makefile b/net/sqm-scripts/Makefile
index 65591c60a7..908873d051 100644
--- a/net/sqm-scripts/Makefile
+++ b/net/sqm-scripts/Makefile
@@ -24,7 +24,7 @@ include $(INCLUDE_DIR)/package.mk
 define Package/sqm-scripts
   SECTION:=net
   CATEGORY:=Base system
-  DEPENDS:=+tc +ip +kmod-sched-cake +kmod-ifb +iptables +iptables-mod-ipopt
+  DEPENDS:=+tc +ip +kmod-sched-cake +kmod-ifb +iptables +iptables-mod-ipopt +@BUSYBOX_CONFIG_FEATURE_STAT_FORMAT
   TITLE:=SQM Scripts (QoS)
   PKGARCH:=all
 endef

From 31a6ade23d06cb58fd0733b395d08ed0711cb97b Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Mon, 20 Apr 2020 20:42:11 +0800
Subject: [PATCH 03/56] net/ddns-scripts: also start on ifupdate event

---
 net/ddns-scripts/files/etc/hotplug.d/iface/ddns | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ddns-scripts/files/etc/hotplug.d/iface/ddns b/net/ddns-scripts/files/etc/hotplug.d/iface/ddns
index b0f6c98f84..ed58714964 100644
--- a/net/ddns-scripts/files/etc/hotplug.d/iface/ddns
+++ b/net/ddns-scripts/files/etc/hotplug.d/iface/ddns
@@ -32,7 +32,7 @@ ddns_service() {
 }
 
 case "$ACTION" in
-	ifup)
+	ifup|ifupdate)
 		/etc/init.d/ddns enabled && ddns_service "ifup" "$INTERFACE"
 		;;
 	ifdown)

From f8b69051731c87830e5c3e51cacab5ed2b3053cb Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Sat, 16 Nov 2019 00:52:17 +0800
Subject: [PATCH 04/56] net/ddns-scripts: add aliyun_ddns support

This import aliyun_ddns code from:
https://github.com/sensec/ddns-scripts_aliyun.git
and change by ptpt52

Signed-off-by: Chen Minqiang <ptpt52@gmail.com>
---
 net/ddns-scripts/Makefile                     |  28 +++
 net/ddns-scripts/files/update_aliyun_com.sh   | 237 ++++++++++++++++++
 .../usr/share/ddns/services/aliyun.com.json   |   9 +
 3 files changed, 274 insertions(+)
 create mode 100644 net/ddns-scripts/files/update_aliyun_com.sh
 create mode 100644 net/ddns-scripts/files/usr/share/ddns/services/aliyun.com.json

diff --git a/net/ddns-scripts/Makefile b/net/ddns-scripts/Makefile
index f81bcc1bcf..fc929c00e6 100644
--- a/net/ddns-scripts/Makefile
+++ b/net/ddns-scripts/Makefile
@@ -78,6 +78,17 @@ define Package/ddns-scripts-luadns/description
   Dynamic DNS Client scripts extension for LuaDNS API v1 (require curl)
 endef
 
+
+define Package/ddns-scripts_aliyun
+    $(call Package/ddns-scripts/Default)
+    TITLE:=DDNS extension for AliYun.com
+    DEPENDS:=ddns-scripts +hmac-sha1-util +wget-any
+endef
+define Package/ddns-scripts_aliyun/description
+	Dynamic DNS Client scripts extension for AliYun.com
+endef
+
+
 define Package/ddns-scripts-cloudflare
   $(call Package/ddns-scripts/Default)
   TITLE:=Extension for cloudflare.com API v4
@@ -528,6 +539,22 @@ fi
 exit 0
 endef
 
+define Package/ddns-scripts_aliyun/install
+	$(INSTALL_DIR) $(1)/usr/lib/ddns
+	$(INSTALL_BIN) ./files/update_aliyun_com.sh $(1)/usr/lib/ddns
+
+	$(INSTALL_DIR) $(1)/usr/share/ddns/default
+	$(INSTALL_DATA) ./files/usr/share/ddns/services/aliyun.com.json \
+		$(1)/usr/share/ddns/default
+endef
+
+define Package/ddns-scripts_aliyun/prerm
+#!/bin/sh
+if [ -z "$${IPKG_INSTROOT}" ]; then
+	/etc/init.d/ddns stop
+fi
+exit 0
+endef
 
 define Package/ddns-scripts-cloudflare/install
 	$(INSTALL_DIR) $(1)/usr/lib/ddns
@@ -1017,6 +1044,7 @@ $(eval $(call BuildPackage,ddns-scripts))
 $(eval $(call BuildPackage,ddns-scripts-services))
 $(eval $(call BuildPackage,ddns-scripts-utils))
 $(eval $(call BuildPackage,ddns-scripts-luadns))
+$(eval $(call BuildPackage,ddns-scripts_aliyun))
 $(eval $(call BuildPackage,ddns-scripts-cloudflare))
 $(eval $(call BuildPackage,ddns-scripts-gcp))
 $(eval $(call BuildPackage,ddns-scripts-freedns))
diff --git a/net/ddns-scripts/files/update_aliyun_com.sh b/net/ddns-scripts/files/update_aliyun_com.sh
new file mode 100644
index 0000000000..3ec06be631
--- /dev/null
+++ b/net/ddns-scripts/files/update_aliyun_com.sh
@@ -0,0 +1,237 @@
+#!/bin/sh
+#
+# 用于阿里云解析的DNS更新脚本
+# 2017-2018 Sense <sensec at gmail dot com>
+# 阿里云解析API文档 https://help.aliyun.com/document_detail/29739.html
+#
+# 本脚本由 dynamic_dns_functions.sh 内的函数 send_update() 调用
+#
+# 需要在 /etc/config/ddns 中设置的选项
+# option username - 阿里云API访问账号 Access Key ID。可通过 aliyun.com 帐号管理的 accesskeys 获取, 或者访问 https://ak-console.aliyun.com
+# option password - 阿里云API访问密钥 Access Key Secret
+# option domain   - 完整的域名。建议主机与域名之间使用 @符号 分隔，否则将以第一个 .符号 之前的内容作为主机名
+#
+
+# 检查传入参数
+[ -z "$username" ] && write_log 14 "配置错误！保存阿里云API访问账号的'用户名'不能为空"
+[ -z "$password" ] && write_log 14 "配置错误！保存阿里云API访问密钥的'密码'不能为空"
+
+# 检查外部调用工具
+[ -n "$WGET_SSL" ] || write_log 4 "使用阿里云API建议安装 GNU Wget 支持，否则部分功能失效"
+command -v sed >/dev/null 2>&1 || write_log 13 "使用阿里云API需要 sed 支持，请先安装"
+command -v hmac-sha1-util >/dev/null 2>&1 || write_log 13 "使用阿里云API需要 hmac-sha1-util 支持，请先安装"
+
+# 包含用于解析 JSON 格式返回值的函数
+. /usr/share/libubox/jshn.sh
+
+# 变量声明
+local __HOST __DOMAIN __TYPE __URLBASE __CMDBASE __URLARGS __SEPARATOR __RECID
+[ $use_https -eq 0 ] && __URLBASE="http://alidns.aliyuncs.com/" || __URLBASE="https://alidns.aliyuncs.com/"
+__SEPARATOR="&"
+
+# 从 $domain 分离主机和域名
+[ "${domain:0:2}" == "@." ] && domain="${domain/./}" # 主域名处理
+[ "$domain" == "${domain/@/}" ] && domain="${domain/./@}" # 未找到分隔符，兼容常用域名格式
+__HOST="${domain%%@*}"
+__DOMAIN="${domain#*@}"
+[ -z "$__HOST" -o "$__HOST" == "$__DOMAIN" ] && __HOST="@"
+
+# 设置记录类型
+[ $use_ipv6 -eq 0 ] && __TYPE="A" || __TYPE="AAAA"
+
+# 构造基本通信命令
+build_command() {
+	__CMDBASE="$WGET_SSL -nv -t 1 -O $DATFILE -o $ERRFILE"
+	if ! [ -n "$WGET_SSL" ]; then
+		__CMDBASE="$WGET --timeout=60 -qO $DATFILE"
+	fi
+	# 绑定用于通信的主机/IP
+	if [ -n "$bind_network" ] && [ -n "$WGET_SSL" ]; then
+		local bind_ip run_prog
+		[ $use_ipv6 -eq 0 ] && run_prog="network_get_ipaddr" || run_prog="network_get_ipaddr6"
+		eval "$run_prog bind_ip $bind_network" || \
+			write_log 13 "Can not detect local IP using '$run_prog $bind_network' - Error: '$?'"
+		write_log 7 "Force communication via IP '$bind_ip'"
+		__CMDBASE="$__CMDBASE --bind-address=$bind_ip"
+	fi
+	# 强制设定IP版本
+	if [ $force_ipversion -eq 1 ]; then
+		[ $use_ipv6 -eq 0 ] && __CMDBASE="$__CMDBASE -4" || __CMDBASE="$__CMDBASE -6"
+	fi
+	# 设置CA证书参数
+	if [ $use_https -eq 1 ]; then
+		if [ "$cacert" = "IGNORE" ]; then
+			__CMDBASE="$__CMDBASE --no-check-certificate"
+		elif [ -f "$cacert" ]; then
+			__CMDBASE="$__CMDBASE --ca-certificate=${cacert}"
+		elif [ -d "$cacert" ]; then
+			__CMDBASE="$__CMDBASE --ca-directory=${cacert}"
+		elif [ -n "$cacert" ]; then
+			write_log 14 "No valid certificate(s) found at '$cacert' for HTTPS communication"
+		fi
+	fi
+	# 如果没有设置，禁用代理 (这可能是 .wgetrc 或环境设置错误)
+	[ -z "$proxy" ] && [ -n "$WGET_SSL" ] && __CMDBASE="$__CMDBASE --no-proxy"
+	[ -z "$proxy" ] && ! [ -n "$WGET_SSL" ] && __CMDBASE="$__CMDBASE --proxy=off"
+}
+
+# 用于阿里云API的通信函数
+aliyun_transfer() {
+	local __PARAM="$@"
+	local __CNT=0
+	local __RUNPROG __ERR PID_SLEEP
+
+	[ $# -eq 0 ] && write_log 12 "Error in 'aliyun_transfer()' - wrong number of parameters"
+
+	while : ; do
+		build_Request $__PARAM
+		__RUNPROG="$__CMDBASE '${__URLBASE}?${__URLARGS}'"
+
+		write_log 7 "#> $__RUNPROG"
+		eval $__RUNPROG
+		__ERR=$?
+		[ $__ERR -eq 0 ] && return 0
+
+		write_log 3 "GNU Wget Error: '$__ERR'"
+		write_log 7 "$(cat $ERRFILE)"
+
+		if [ $VERBOSE -gt 1 ]; then
+			write_log 4 "Transfer failed - Verbose Mode: $VERBOSE - NO retry on error"
+			return 1
+		fi
+
+		__CNT=$(( $__CNT + 1 ))
+		[ $retry_count -gt 0 -a $__CNT -gt $retry_count ] && \
+			write_log 14 "Transfer failed after $retry_count retries"
+
+		write_log 4 "Transfer failed - retry $__CNT/$retry_count in $RETRY_SECONDS seconds"
+		sleep $RETRY_SECONDS &
+		PID_SLEEP=$!
+		wait $PID_SLEEP
+		PID_SLEEP=0
+	done
+}
+
+# 百分号编码
+percentEncode() {
+	if [ -z "${1//[A-Za-z0-9_.~-]/}" ]; then
+		echo -n "$1"
+	else
+		local string=$1; local i=0; local ret chr
+		while [ $i -lt ${#string} ]; do
+			chr=${string:$i:1}
+			[ -z "${chr#[^A-Za-z0-9_.~-]}" ] && chr=$(printf '%%%02X' "'$chr")
+			ret="$ret$chr"
+			i=$(( $i + 1 ))
+		done
+		echo -n "$ret"
+	fi
+}
+
+# 构造阿里云解析请求参数
+build_Request() {
+	local args="$@"; local string
+	local HTTP_METHOD="GET"
+
+	# 添加请求参数
+	__URLARGS=
+	for string in $args; do
+		case "${string%%=*}" in
+			Format|Version|AccessKeyId|SignatureMethod|Timestamp|SignatureVersion|SignatureNonce|Signature) ;; # 过滤公共参数
+			*) __URLARGS="$__URLARGS${__SEPARATOR}"$(percentEncode "${string%%=*}")"="$(percentEncode "${string#*=}");;
+		esac
+	done
+	__URLARGS="${__URLARGS:1}"
+
+	# 附加公共参数
+	string="Format=JSON"; __URLARGS="$__URLARGS${__SEPARATOR}"$(percentEncode "${string%%=*}")"="$(percentEncode "${string#*=}")
+	string="Version=2015-01-09"; __URLARGS="$__URLARGS${__SEPARATOR}"$(percentEncode "${string%%=*}")"="$(percentEncode "${string#*=}")
+	string="AccessKeyId=$username"; __URLARGS="$__URLARGS${__SEPARATOR}"$(percentEncode "${string%%=*}")"="$(percentEncode "${string#*=}")
+	string="SignatureMethod=HMAC-SHA1"; __URLARGS="$__URLARGS${__SEPARATOR}"$(percentEncode "${string%%=*}")"="$(percentEncode "${string#*=}")
+	string="Timestamp="$(date -u '+%Y-%m-%dT%H:%M:%SZ'); __URLARGS="$__URLARGS${__SEPARATOR}"$(percentEncode "${string%%=*}")"="$(percentEncode "${string#*=}")
+	string="SignatureVersion=1.0"; __URLARGS="$__URLARGS${__SEPARATOR}"$(percentEncode "${string%%=*}")"="$(percentEncode "${string#*=}")
+	string="SignatureNonce="$(cat '/proc/sys/kernel/random/uuid'); __URLARGS="$__URLARGS${__SEPARATOR}"$(percentEncode "${string%%=*}")"="$(percentEncode "${string#*=}")
+
+	# 对请求参数进行排序，用于生成签名
+	string=$(echo -n "$__URLARGS" | sed 's/\'"${__SEPARATOR}"'/\n/g' | sort | sed ':label; N; s/\n/\'"${__SEPARATOR}"'/g; b label')
+	# 构造用于计算签名的字符串
+	string="${HTTP_METHOD}${__SEPARATOR}"$(percentEncode "/")"${__SEPARATOR}"$(percentEncode "$string")
+	# 字符串计算签名HMAC值
+	local signature=$(echo -n "$string" | hmac-sha1-util "${password}&")
+	# HMAC值编码成字符串，得到签名值
+	signature=$(echo -n "$signature" | base64)
+
+	# 附加签名参数
+	string="Signature=$signature"; __URLARGS="$__URLARGS${__SEPARATOR}"$(percentEncode "${string%%=*}")"="$(percentEncode "${string#*=}")
+}
+
+# 添加解析记录
+add_domain() {
+	local value
+	aliyun_transfer "Action=AddDomainRecord" "DomainName=${__DOMAIN}" "RR=${__HOST}" "Type=${__TYPE}" "Value=${__IP}" || write_log 14 "服务器通信失败"
+	json_cleanup; json_load "$(cat "$DATFILE" 2> /dev/null)" >/dev/null 2>&1
+	json_get_var value "RecordId"
+	[ -z "$value" ] && write_log 14 "添加新解析记录失败"
+	write_log 7 "添加新解析记录成功"
+	return 0
+}
+
+# 修改解析记录
+update_domain() {
+	local value
+	aliyun_transfer "Action=UpdateDomainRecord" "RecordId=${__RECID}" "RR=${__HOST}" "Type=${__TYPE}" "Value=${__IP}" || write_log 14 "服务器通信失败"
+	json_cleanup; json_load "$(cat "$DATFILE" 2> /dev/null)" >/dev/null 2>&1
+	json_get_var value "RecordId"
+	[ -z "$value" ] && write_log 14 "修改解析记录失败"
+	write_log 7 "修改解析记录成功"
+	return 0
+}
+
+# 启用解析记录
+enable_domain() {
+	local value
+	aliyun_transfer "Action=SetDomainRecordStatus" "RecordId=${__RECID}" "Status=Enable" || write_log 14 "服务器通信失败"
+	json_cleanup; json_load "$(cat "$DATFILE" 2> /dev/null)" >/dev/null 2>&1
+	json_get_var value "Status"
+	[ "$value" != "Enable" ] && write_log 14 "启用解析记录失败"
+	write_log 7 "启用解析记录成功"
+	return 0
+}
+
+# 获取子域名解析记录列表
+describe_domain() {
+	local value type; local ret=0
+	aliyun_transfer "Action=DescribeSubDomainRecords" "SubDomain=${__HOST}.${__DOMAIN}" "Type=${__TYPE}" || write_log 14 "服务器通信失败"
+	json_cleanup; json_load "$(cat "$DATFILE" 2> /dev/null)" >/dev/null 2>&1
+	json_get_var value "TotalCount"
+	if [ $value -eq 0 ]; then
+		write_log 7 "解析记录不存在"
+		ret=1
+	else
+		json_select "DomainRecords" >/dev/null 2>&1
+		json_select "Record" >/dev/null 2>&1
+		json_select 1 >/dev/null 2>&1
+		json_get_var value "Locked"
+		[ $value -ne 0 ] && write_log 14 "解析记录被锁定"
+		json_get_var __RECID "RecordId"
+		write_log 7 "获得解析记录ID: ${__RECID}"
+		json_get_var value "Status"
+		[ "$value" != "ENABLE" ] && ret=$(( $ret | 2 )) && write_log 7 "解析记录被禁用"
+		json_get_var type "Type"
+		json_get_var value "Value"
+		[ "$type" != "${__TYPE}" -o "$value" != "${__IP}" ] && ret=$(( $ret | 4 )) && write_log 7 "地址或类型需要修改"
+	fi
+	return $ret
+}
+
+build_command
+describe_domain
+ret=$?
+if [ $ret -eq 1 ]; then
+	sleep 3 && add_domain
+else
+	[ $(( $ret & 2 )) -ne 0 ] && sleep 3 && enable_domain
+	[ $(( $ret & 4 )) -ne 0 ] && sleep 3 && update_domain
+fi
+
+return 0
diff --git a/net/ddns-scripts/files/usr/share/ddns/services/aliyun.com.json b/net/ddns-scripts/files/usr/share/ddns/services/aliyun.com.json
new file mode 100644
index 0000000000..c1ad8a5545
--- /dev/null
+++ b/net/ddns-scripts/files/usr/share/ddns/services/aliyun.com.json
@@ -0,0 +1,9 @@
+{
+	"name": "aliyun.com",
+	"ipv4": {
+		"url": "update_aliyun_com.sh"
+	},
+	"ipv6": {
+		"url": "update_aliyun_com.sh"
+	}
+}

From 9b9a086cd7bbe213d470a40d5915a38c70d1c4ee Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Tue, 11 Feb 2020 13:13:37 +0800
Subject: [PATCH 05/56] net/nginx-util: simple listen lan

---
 net/nginx-util/src/nginx-util.cpp | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/nginx-util/src/nginx-util.cpp b/net/nginx-util/src/nginx-util.cpp
index 3b4ad8c60e..5ffe5209fc 100644
--- a/net/nginx-util/src/nginx-util.cpp
+++ b/net/nginx-util/src/nginx-util.cpp
@@ -20,7 +20,7 @@ void create_lan_listen()  // create empty files for compatibility:
     // TODO(pst): replace by dummies after transitioning nginx config to UCI:
     std::vector<std::string> ips;
 
-#ifndef NO_UBUS
+#if 0
     try {
         auto loopback_status = ubus::call("network.interface.loopback", "status");
 
@@ -54,7 +54,8 @@ void create_lan_listen()  // create empty files for compatibility:
     catch (const std::runtime_error&) { /* do nothing about it */
     }
 #else
-    ips.emplace_back("127.0.0.1");
+    ips.emplace_back("0.0.0.0");
+    ips.emplace_back("[::]");
 #endif
 
     std::string listen = std::string{file_comment_auto_created};

From 8b0dbae1e203e26f8b597b2c660dc0cec7f14dd3 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Mon, 1 Jun 2020 13:08:23 +0800
Subject: [PATCH 06/56] net/nginx/files-luci-support: aria2 support

---
 net/nginx/files-luci-support/luci.locations | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/net/nginx/files-luci-support/luci.locations b/net/nginx/files-luci-support/luci.locations
index 374ee5d9fc..bdce530b01 100644
--- a/net/nginx/files-luci-support/luci.locations
+++ b/net/nginx/files-luci-support/luci.locations
@@ -15,3 +15,11 @@ location ~ /cgi-bin/cgi-(backup|download|upload|exec) {
 location /luci-static {
 		error_log stderr crit;
 }
+
+location /jsonrpc {
+		proxy_set_header Host $http_host;
+		proxy_set_header X-NginX-Proxy true;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_pass http://127.0.0.1:6800;
+}

From cc9dc3250c6e495788e1ea748bff82b271fd5104 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Tue, 17 Nov 2020 23:08:22 +0800
Subject: [PATCH 07/56] net/aria2: comment out empty options

---
 net/aria2/files/aria2.conf | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/aria2/files/aria2.conf b/net/aria2/files/aria2.conf
index 108a30e012..5ca60ec0d1 100644
--- a/net/aria2/files/aria2.conf
+++ b/net/aria2/files/aria2.conf
@@ -20,12 +20,12 @@ config aria2 'main'
 
 	# Add addition Headers here.
 	# eg. list header 'Content-Encoding: gzip'
-	list header ''
+	#list header ''
 
 	# Add BT trackers here.
 	# eg. list bt_tracker 'http://tracker.example.com/announce'
-	list bt_tracker ''
+	#list bt_tracker ''
 
 	# Add extra settings here.
 	# eg. list extra_settings 'option=value'
-	list extra_settings ''
+	#list extra_settings ''

From 8dd8f1d4969e4cd10654053195edd5ebb78109c7 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Thu, 10 Dec 2020 15:57:52 +0800
Subject: [PATCH 08/56] p910nd: add conn timeout

---
 net/p910nd/patches/10-p910nd-timeout.patch | 35 ++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 net/p910nd/patches/10-p910nd-timeout.patch

diff --git a/net/p910nd/patches/10-p910nd-timeout.patch b/net/p910nd/patches/10-p910nd-timeout.patch
new file mode 100644
index 0000000000..6f41469fdc
--- /dev/null
+++ b/net/p910nd/patches/10-p910nd-timeout.patch
@@ -0,0 +1,35 @@
+diff --git a/p910nd.c b/p910nd.c
+index 2fa4454..e89aa4d 100644
+--- a/p910nd.c
++++ b/p910nd.c
+@@ -401,11 +401,13 @@ int copy_stream(int fd, int lp)
+ 		struct timeval now;
+ 		struct timeval then;
+ 		struct timeval timeout;
++		struct timeval last_read_time;
+ 		int timer = 0;
+ 		Buffer_t printerToNetworkBuffer;
+ 		initBuffer(&printerToNetworkBuffer, lp, fd, 0);
+ 		fd_set readfds;
+ 		fd_set writefds;
++		gettimeofday(&last_read_time, 0);
+ 		/* Finish when network sent EOF. */
+ 		/* Although the printer to network stream may not be finished (does this matter?) */
+ 		while (!networkToPrinterBuffer.eof_sent && !networkToPrinterBuffer.err) {
+@@ -433,8 +435,15 @@ int copy_stream(int fd, int lp)
+ 			if (FD_ISSET(fd, &readfds)) {
+ 				/* Read network data. */
+ 				result = readBuffer(&networkToPrinterBuffer);
+-				if (result > 0)
++				if (result > 0) {
+ 					dolog(LOG_DEBUG,"read %d bytes from network\n",result);
++					gettimeofday(&last_read_time, 0);
++				}
++			}
++			gettimeofday(&now, 0);
++			if (now.tv_sec - last_read_time.tv_sec >= 30) {
++				dolog(LOG_NOTICE,"read no data from network for 30s, stop copy stream\n");
++				break;
+ 			}
+ 			if (FD_ISSET(lp, &readfds)) {
+ 				/* Read printer data, but pace it more slowly. */

From 13de31618b1d2dfb5035d6482f49fa84bea1a217 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Tue, 12 Jan 2021 11:26:46 +0800
Subject: [PATCH 09/56] net/nginx-util: no _redirect2ssl

---
 net/nginx-util/files/nginx.config | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/nginx-util/files/nginx.config b/net/nginx-util/files/nginx.config
index 4f07ae1d4d..7c9d342bcc 100644
--- a/net/nginx-util/files/nginx.config
+++ b/net/nginx-util/files/nginx.config
@@ -6,7 +6,7 @@ config server '_lan'
 	list listen '443 ssl default_server'
 	list listen '[::]:443 ssl default_server'
 	option server_name '_lan'
-	list include 'restrict_locally'
+	#list include 'restrict_locally'
 	list include 'conf.d/*.locations'
 	option uci_manage_ssl 'self-signed'
 	option ssl_certificate '/etc/nginx/conf.d/_lan.crt'
@@ -19,4 +19,6 @@ config server '_redirect2ssl'
 	list listen '80'
 	list listen '[::]:80'
 	option server_name '_redirect2ssl'
-	option return '302 https://$host$request_uri'
+	#option return '302 https://$host$request_uri'
+	list include 'conf.d/*.locations'
+	option access_log 'off; # logd openwrt'

From 6ff75d6e61a1227c6bbddb38972ce3f21e82cbaf Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Fri, 29 Jan 2021 11:34:55 +0800
Subject: [PATCH 10/56] p910nd: relay stdout/stderr to logd

---
 net/p910nd/files/p910nd.init | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/p910nd/files/p910nd.init b/net/p910nd/files/p910nd.init
index cfb3bbd956..ebd2a464d1 100644
--- a/net/p910nd/files/p910nd.init
+++ b/net/p910nd/files/p910nd.init
@@ -87,6 +87,8 @@ start_p910nd() {
 			# Call procd_add_mdns with the positional parameters
 			MDNS_INSTANCE_NAME="$mdns_ty" procd_add_mdns "$@"
 		fi
+		procd_set_param stdout 1 # relay stdout to logd
+		procd_set_param stderr 1 # relay stderr to logd
 		procd_close_instance
 	fi
 }

From 24d9e062283fc521fa4e9e7cd06ce217f3f6d913 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Mon, 1 Feb 2021 16:52:09 +0800
Subject: [PATCH 11/56] p910nd: refine

---
 net/p910nd/patches/20-refine.patch | 177 +++++++++++++++++++++++++++++
 1 file changed, 177 insertions(+)
 create mode 100644 net/p910nd/patches/20-refine.patch

diff --git a/net/p910nd/patches/20-refine.patch b/net/p910nd/patches/20-refine.patch
new file mode 100644
index 0000000000..4997f77a73
--- /dev/null
+++ b/net/p910nd/patches/20-refine.patch
@@ -0,0 +1,177 @@
+diff --git a/p910nd.c b/p910nd.c
+index e89aa4d..51210ca 100644
+--- a/p910nd.c
++++ b/p910nd.c
+@@ -159,6 +159,8 @@ typedef struct {
+ 	int eof_read;		/* Nonzero indicates the input file has reached EOF. */
+ 	int eof_sent;		/* Nonzero indicates the output file has fully received all data. */
+ 	int err;		/* Nonzero indicates an error detected on the output file. */
++#define READ_ERR  0x01
++#define WRITE_ERR 0x02
+ 	char buffer[BUFFER_SIZE];	/* Buffered data goes here. */
+ } Buffer_t;
+ 
+@@ -293,7 +295,7 @@ void initBuffer(Buffer_t * b, int infd, int outfd, int detectEof)
+ /* Sets the readfds and writefds (used by select) based on current buffer state. */
+ void prepBuffer(Buffer_t * b, fd_set * readfds, fd_set * writefds)
+ {
+-	if (b->outfd>=0 && !b->err && (b->bytes != 0 || b->eof_read)) {
++	if (b->outfd>=0 && (!(b->err & WRITE_ERR)) && (b->bytes != 0 || b->eof_read)) {
+ 		FD_SET(b->outfd, writefds);
+ 	}
+ 	if (b->infd>=0 && !b->eof_read && b->bytes < sizeof(b->buffer)) {
+@@ -334,7 +336,7 @@ ssize_t readBuffer(Buffer_t * b)
+ 			}
+ 		} else if (result < 0) {
+ 			dolog(LOGOPTS, "read: %m\n");
+-			b->err = 1;
++			b->err |= READ_ERR;
+ 		}
+ 		else if (b->detectEof) {
+ 			dolog(LOG_DEBUG, "read: eof\n");
+@@ -351,15 +353,11 @@ ssize_t writeBuffer(Buffer_t * b)
+ {
+ 	int avail;
+ 	ssize_t result = 0;
+-	if (b->bytes == 0 || b->err) {
++	if (b->bytes == 0 || (b->err & WRITE_ERR)) {
+ 		/* Buffer is empty. */
+ 		avail = 0;
+-	} else if (b->endidx > b->startidx) {
+-		/* Buffer is not wrapped. Can write all the data. */
+-		avail = b->endidx - b->startidx;
+ 	} else {
+-		/* Buffer is wrapped. Can only write the top (first) part. */
+-		avail = sizeof(b->buffer) - b->startidx;
++		avail = b->bytes;
+ 	}
+ 	if (avail) {
+ 		if (b->outfd>=0)
+@@ -369,7 +367,7 @@ ssize_t writeBuffer(Buffer_t * b)
+ 		if (result < 0) {
+ 			/* Mark the output file in an error condition. */
+ 			dolog(LOGOPTS, "write: %m\n");
+-			b->err = 1;
++			b->err |= WRITE_ERR;
+ 		} else {
+ 			/* Zero or more bytes were written. */
+ 			b->startidx += result;
+@@ -382,8 +380,10 @@ ssize_t writeBuffer(Buffer_t * b)
+ 			}
+ 		}
+ 	}
+-	else if (b->eof_read)
++	else if (b->eof_read) {
+ 		b->eof_sent = 1;
++		dolog(LOG_DEBUG, "write: eof\n");
++	}
+ 	
+ 	/* Return the write() result, -1 (error) or #bytes written. */
+ 	return result;
+@@ -393,6 +393,7 @@ ssize_t writeBuffer(Buffer_t * b)
+ /* If bidir, also copy data from printer (lp) to network (fd). */
+ int copy_stream(int fd, int lp)
+ {
++	int need_clear_lp = 0;
+ 	int result;
+ 	Buffer_t networkToPrinterBuffer;
+ 	initBuffer(&networkToPrinterBuffer, fd, lp, 1);
+@@ -410,7 +411,7 @@ int copy_stream(int fd, int lp)
+ 		gettimeofday(&last_read_time, 0);
+ 		/* Finish when network sent EOF. */
+ 		/* Although the printer to network stream may not be finished (does this matter?) */
+-		while (!networkToPrinterBuffer.eof_sent && !networkToPrinterBuffer.err) {
++		while (!networkToPrinterBuffer.eof_sent && !(networkToPrinterBuffer.err & WRITE_ERR) && !(printerToNetworkBuffer.err & WRITE_ERR)) {
+ 			FD_ZERO(&readfds);
+ 			FD_ZERO(&writefds);
+ 			prepBuffer(&networkToPrinterBuffer, &readfds, &writefds);
+@@ -427,6 +428,7 @@ int copy_stream(int fd, int lp)
+ 				else
+ 					FD_CLR(lp, &readfds);
+ 			}
++			gettimeofday(&now, 0);
+ 			timeout.tv_sec = 0;
+ 			timeout.tv_usec = 100000;
+ 			result = select(maxfd + 1, &readfds, &writefds, 0, &timeout);
+@@ -436,11 +438,10 @@ int copy_stream(int fd, int lp)
+ 				/* Read network data. */
+ 				result = readBuffer(&networkToPrinterBuffer);
+ 				if (result > 0) {
+-					dolog(LOG_DEBUG,"read %d bytes from network\n",result);
++					dolog(LOG_DEBUG,"%d.%d: read %d bytes from network\n", (int)now.tv_sec, (int)now.tv_usec, result);
+ 					gettimeofday(&last_read_time, 0);
+ 				}
+ 			}
+-			gettimeofday(&now, 0);
+ 			if (now.tv_sec - last_read_time.tv_sec >= 30) {
+ 				dolog(LOG_NOTICE,"read no data from network for 30s, stop copy stream\n");
+ 				break;
+@@ -449,7 +450,7 @@ int copy_stream(int fd, int lp)
+ 				/* Read printer data, but pace it more slowly. */
+ 				result = readBuffer(&printerToNetworkBuffer);
+ 				if (result > 0) {
+-					dolog(LOG_DEBUG,"read %d bytes from printer\n",result);
++					dolog(LOG_DEBUG,"%d.%d: read %d bytes from printer\n", (int)now.tv_sec, (int)now.tv_usec, result);
+ 					gettimeofday(&then, 0);
+ 					// wait 100 msec before reading again.
+ 					then.tv_usec += 100000;
+@@ -457,16 +458,35 @@ int copy_stream(int fd, int lp)
+ 						then.tv_usec -= 1000000;
+ 						then.tv_sec++;
+ 					}
+-					timer = 1;
++					if (!need_clear_lp) {
++						timer = 1;
++					}
+ 				}
+ 			}
+ 			if (FD_ISSET(lp, &writefds)) {
+ 				/* Write data to printer. */
+ 				result = writeBuffer(&networkToPrinterBuffer);
+-				if (result > 0)
+-					dolog(LOG_DEBUG,"wrote %d bytes to printer\n",result);
++				if (result > 0) {
++					if (need_clear_lp) {
++						need_clear_lp = 0;
++						printerToNetworkBuffer.startidx = 0;
++						printerToNetworkBuffer.endidx = 0;
++						printerToNetworkBuffer.bytes = 0;
++						printerToNetworkBuffer.totalin = 0;
++						printerToNetworkBuffer.totalout = 0;
++					}
++					dolog(LOG_DEBUG,"%d.%d: wrote %d bytes to printer\n", (int)now.tv_sec, (int)now.tv_usec, result);
++				}
+ 			}
+ 			if (FD_ISSET(fd, &writefds) || printerToNetworkBuffer.outfd == -1) {
++				if (need_clear_lp) {
++					printerToNetworkBuffer.startidx = 0;
++					printerToNetworkBuffer.endidx = 0;
++					printerToNetworkBuffer.bytes = 0;
++					printerToNetworkBuffer.totalin = 0;
++					printerToNetworkBuffer.totalout = 0;
++					continue;
++				}
+ 				/* Write data to network. */
+ 				result = writeBuffer(&printerToNetworkBuffer);
+ 				/* If socket write error, discard further data from printer */
+@@ -475,14 +495,19 @@ int copy_stream(int fd, int lp)
+ 					printerToNetworkBuffer.err = 0;
+ 					result = 0;
+ 					dolog(LOG_DEBUG,"network write error, discarding further printer data\n",result);
++					break;
+ 				}
+ 				else if (result > 0) {
+ 					if (printerToNetworkBuffer.outfd == -1)
+ 						dolog(LOG_DEBUG,"discarded %d bytes from printer\n",result);				
+ 					else
+-						dolog(LOG_DEBUG,"wrote %d bytes to network\n",result);
++						dolog(LOG_DEBUG,"%d.%d: wrote %d bytes to network\n", (int)now.tv_sec, (int)now.tv_usec, result);
+ 				}
+ 			}
++			if ((networkToPrinterBuffer.err & READ_ERR) && now.tv_sec - last_read_time.tv_sec >= 10) {
++				dolog(LOG_NOTICE,"read no data from network err, stop copy stream in 10s\n");
++				break;
++			}
+ 		}
+ 		dolog(LOG_NOTICE,
+ 		       "Finished job: %d/%d bytes sent to printer, %d/%d bytes sent to network\n",

From 18d03710daf31635f26feaa8ca4b238ac4f90949 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Sun, 7 Mar 2021 18:43:44 +0800
Subject: [PATCH 12/56] nginx: init_lan may timeout at firstboot

---
 net/nginx/files/nginx.init | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/nginx/files/nginx.init b/net/nginx/files/nginx.init
index a6b6ebea3d..be5cf5d280 100644
--- a/net/nginx/files/nginx.init
+++ b/net/nginx/files/nginx.init
@@ -52,7 +52,10 @@ nginx_init() {
 	[ -d /var/lib/nginx ] || mkdir -p /var/lib/nginx
 
 	rm -f "$(readlink "${UCI_CONF}")"
-	${NGINX_UTIL} init_lan
+	for i in 1 2 3; do
+		busybox timeout 30 ${NGINX_UTIL} init_lan && break
+		logger -t "nginx_init" -p "daemon.info" "${NGINX_UTIL} init_lan timeout"
+	done
 
 	if [ -f $UCI_CONF_TEMPLATE ]; then
 		nginx_check_luci_template

From 761186f3720481cbf92add657a7db2d9ebb2b9eb Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Wed, 19 May 2021 20:20:38 +0800
Subject: [PATCH 13/56] nginx-util: fix fallthrough usage

Signed-off-by: Chen Minqiang <ptpt52@gmail.com>
---
 net/nginx-util/src/nginx-ssl-util.hpp | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/net/nginx-util/src/nginx-ssl-util.hpp b/net/nginx-util/src/nginx-ssl-util.hpp
index 5a64b000a8..4484b3550f 100644
--- a/net/nginx-util/src/nginx-ssl-util.hpp
+++ b/net/nginx-util/src/nginx-ssl-util.hpp
@@ -166,14 +166,9 @@ static constexpr auto _escape = _Line{
         std::string ret{};
         for (char c : strptr) {
             switch (c) {
-                case '^':
-                    ret += '\\';
-                    ret += c;
-                    break;
-                case '_':
-                case '-':
-                    ret += c;
-                    break;
+                case '^': ret += '\\'; /* fallthrough */
+                case '_': /* fallthrough */
+                case '-': ret += c; break;
                 default:
                     if ((isalpha(c) != 0) || (isdigit(c) != 0)) {
                         ret += c;

From 764990bb906e8567c588ad7ef954b58ff8fb89e9 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Thu, 20 May 2021 12:36:29 +0800
Subject: [PATCH 14/56] multimedia/gst1-plugins-ugly: enable x264

---
 multimedia/gst1-plugins-ugly/Makefile | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/multimedia/gst1-plugins-ugly/Makefile b/multimedia/gst1-plugins-ugly/Makefile
index 47595835e4..55236a276c 100644
--- a/multimedia/gst1-plugins-ugly/Makefile
+++ b/multimedia/gst1-plugins-ugly/Makefile
@@ -28,6 +28,7 @@ include $(INCLUDE_DIR)/meson.mk
 PKG_CONFIG_DEPENDS:= \
 	CONFIG_PACKAGE_gst1-mod-asf \
 	CONFIG_PACKAGE_gst1-mod-mpeg2dec \
+	CONFIG_PACKAGE_gst1-mod-x264 \
 
 GST_UGLY_MODULES:=
 
@@ -101,7 +102,7 @@ MESON_ARGS += \
 	-Ddvdread=disabled \
 	$(call GST_COND_SELECT,mpeg2dec) \
 	-Dsidplay=disabled \
-	-Dx264=disabled \
+	$(call GST_COND_SELECT,x264) \
 	\
 	-Dgpl=enabled \
 	-Dnls=enabled \
@@ -154,6 +155,7 @@ endef
 
 $(eval $(call GstBuildPlugin,asf,ASF demuxer,audio video riff rtp rtsp sdp tag,,))
 $(eval $(call GstBuildPlugin,mpeg2dec,MPEG decoder,video,,+libmpeg2))
+$(eval $(call GstBuildPlugin,x264,H264/AVC codec support,pbutils,,+libx264))
 
 $(eval $(call BuildPackage,gstreamer1-plugins-ugly))
 $(eval $(call BuildPackage,gst1-plugins-ugly))

From 1f361a00b2de8cd7761144632c94206eb982351d Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Thu, 20 May 2021 15:03:42 +0800
Subject: [PATCH 15/56] multimedia/gst1-libav: fixup

---
 multimedia/gst1-libav/patches/020-fixup.patch | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 multimedia/gst1-libav/patches/020-fixup.patch

diff --git a/multimedia/gst1-libav/patches/020-fixup.patch b/multimedia/gst1-libav/patches/020-fixup.patch
new file mode 100644
index 0000000000..76eb22104a
--- /dev/null
+++ b/multimedia/gst1-libav/patches/020-fixup.patch
@@ -0,0 +1,24 @@
+diff --git a/ext/libav/gstavmux.c b/ext/libav/gstavmux.c
+index 325a79d..68e3d50 100644
+--- a/ext/libav/gstavmux.c
++++ b/ext/libav/gstavmux.c
+@@ -883,7 +883,8 @@ gst_ffmpegmux_register (GstPlugin * plugin)
+     gchar *type_name;
+     GstRank rank = GST_RANK_MARGINAL;
+ 
+-    if ((!strncmp (in_plugin->name, "u16", 3)) ||
++    if ((!in_plugin->name) ||
++        (!strncmp (in_plugin->name, "u16", 3)) ||
+         (!strncmp (in_plugin->name, "s16", 3)) ||
+         (!strncmp (in_plugin->name, "u24", 3)) ||
+         (!strncmp (in_plugin->name, "s24", 3)) ||
+@@ -921,7 +922,8 @@ gst_ffmpegmux_register (GstPlugin * plugin)
+       continue;
+     }
+ 
+-    if ((!strncmp (in_plugin->long_name, "raw ", 4))) {
++    if ((!in_plugin->long_name) ||
++        (!strncmp (in_plugin->long_name, "raw ", 4))) {
+       GST_LOG ("Ignoring raw muxer %s", in_plugin->name);
+       continue;
+     }

From 112d589f7a483e82a4919d4edd794791245cf8e2 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Thu, 20 May 2021 22:37:01 +0800
Subject: [PATCH 16/56] schroot: depends on coreutils...

---
 admin/schroot/Makefile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/admin/schroot/Makefile b/admin/schroot/Makefile
index 99e2e160e5..e5d5ad2f24 100644
--- a/admin/schroot/Makefile
+++ b/admin/schroot/Makefile
@@ -27,6 +27,7 @@ define Package/schroot
   TITLE:=Securely enter a chroot and run a command or login shell.
   DEPENDS:=$(ICONV_DEPENDS) \
 	+boost +boost-filesystem +boost-iostreams +boost-program_options +boost-regex \
+	+coreutils +coreutils-cp +coreutils-stat \
 	+SCHROOT_BTRFS:btrfs-progs \
 	+SCHROOT_LOOPBACK:losetup \
 	+SCHROOT_LVM:lvm2 \

From 3dcecfa41bffc17d20e42b810d5a1f5120950683 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Sun, 1 Aug 2021 10:56:37 +0800
Subject: [PATCH 17/56] nginx: fix ipk install

---
 net/nginx/files/nginx.init | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/nginx/files/nginx.init b/net/nginx/files/nginx.init
index be5cf5d280..c6c03c0d59 100644
--- a/net/nginx/files/nginx.init
+++ b/net/nginx/files/nginx.init
@@ -46,6 +46,7 @@ nginx_check_luci_template() {
 }
 
 nginx_init() {
+	eval $("${NGINX_UTIL}" get_env)
 	[ -z "${CONF}" ] || return # already called.
 
 	[ -d /var/log/nginx ] || mkdir -p /var/log/nginx
@@ -127,6 +128,7 @@ configure_mdns() {
 }
 
 start_service() {
+	eval $("${NGINX_UTIL}" get_env)
 	nginx_init
 
 	procd_open_instance
@@ -144,6 +146,7 @@ start_service() {
 
 
 reload_service() {
+	eval $("${NGINX_UTIL}" get_env)
 	nginx_init
 
 	if [ "$(cat "/proc/$(cat "/var/run/nginx.pid")/cmdline")" = \

From b4213d4ea5aec9eac8550b2eb51dff6856eab579 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Tue, 7 Sep 2021 07:46:11 +0800
Subject: [PATCH 18/56] ieee8021xclient: depends on wpad

Signed-off-by: Chen Minqiang <ptpt52@gmail.com>
---
 net/ieee8021xclient/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ieee8021xclient/Makefile b/net/ieee8021xclient/Makefile
index 62a4f27387..5357c1b9cd 100644
--- a/net/ieee8021xclient/Makefile
+++ b/net/ieee8021xclient/Makefile
@@ -20,7 +20,7 @@ define Package/ieee8021xclient
   CATEGORY:=Network
   MAINTAINER:=David Yang <mmyangfl@gmail.com>
   TITLE:=Wired 802.1x client config support
-  DEPENDS:=@(PACKAGE_wpa-supplicant||PACKAGE_wpad)
+  DEPENDS:=+wpad
   PKGARCH:=all
 endef
 

From 218a7d001c90b0358006e68c09bbe05be2d7ac66 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Thu, 18 Nov 2021 19:57:41 +0800
Subject: [PATCH 19/56] p910nd: update changes

---
 ...en-at-max-30-connections-wait-queues.patch | 25 +++++++++++
 .../31-abort-printer-open-failed.patch        | 41 +++++++++++++++++++
 2 files changed, 66 insertions(+)
 create mode 100644 net/p910nd/patches/30-listen-at-max-30-connections-wait-queues.patch
 create mode 100644 net/p910nd/patches/31-abort-printer-open-failed.patch

diff --git a/net/p910nd/patches/30-listen-at-max-30-connections-wait-queues.patch b/net/p910nd/patches/30-listen-at-max-30-connections-wait-queues.patch
new file mode 100644
index 0000000000..c3232ced7c
--- /dev/null
+++ b/net/p910nd/patches/30-listen-at-max-30-connections-wait-queues.patch
@@ -0,0 +1,25 @@
+From 0b794f93675deb881c8a4adae88818c54c2d351d Mon Sep 17 00:00:00 2001
+From: Chen Minqiang <ptpt52@gmail.com>
+Date: Thu, 18 Nov 2021 11:27:46 +0800
+Subject: [PATCH] listen at max 30 connections wait queues
+
+---
+ p910nd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/p910nd.c b/p910nd.c
+index 51210ca..0792584 100644
+--- a/p910nd.c
++++ b/p910nd.c
+@@ -651,7 +651,7 @@ void server(int lpnumber)
+ 			res = res->ai_next;
+ 			continue;
+ 		}
+-		if (listen(netfd, 5) < 0) {
++		if (listen(netfd, 30) < 0) {
+ 			dolog(LOGOPTS, "listen: %m\n");
+ 			close(netfd);
+ 			res = res->ai_next;
+-- 
+2.17.1
+
diff --git a/net/p910nd/patches/31-abort-printer-open-failed.patch b/net/p910nd/patches/31-abort-printer-open-failed.patch
new file mode 100644
index 0000000000..298ce1369e
--- /dev/null
+++ b/net/p910nd/patches/31-abort-printer-open-failed.patch
@@ -0,0 +1,41 @@
+From 9bb911014ee1130cabe15fb04d533fceb6c0239f Mon Sep 17 00:00:00 2001
+From: Chen Minqiang <ptpt52@gmail.com>
+Date: Thu, 18 Nov 2021 16:36:16 +0800
+Subject: [PATCH] abort printer open failed
+
+---
+ p910nd.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/p910nd.c b/p910nd.c
+index 0792584..edad256 100644
+--- a/p910nd.c
++++ b/p910nd.c
+@@ -663,6 +663,7 @@ void server(int lpnumber)
+ 	clientlen = sizeof(client);
+ 	memset(&client, 0, sizeof(client));
+ 	while ((fd = accept(netfd, (struct sockaddr *)&client, &clientlen)) >= 0) {
++		int open_printer_fail = 0;
+ 		char host[INET6_ADDRSTRLEN];
+ #ifdef	USE_LIBWRAP
+ 		if (hosts_ctl("p910nd", STRING_UNKNOWN, get_ip_str((struct sockaddr *)&client, host, sizeof(host)), STRING_UNKNOWN) == 0) {
+@@ -676,8 +677,15 @@ void server(int lpnumber)
+ 		/*write(fd, "Printing", 8); */
+ 
+ 		/* Make sure lp device is open... */
+-		while ((lp = open_printer(lpnumber)) == -1)
++		while ((lp = open_printer(lpnumber)) == -1 && open_printer_fail < 3) {
++			open_printer_fail++;
+ 			sleep(10);
++		}
++		if (lp == -1) {
++			dolog(LOG_NOTICE, "Abort. printer open failed for %s:%hu\n", get_ip_str((struct sockaddr *)&client, host, sizeof(host)), get_port((struct sockaddr *)&client));
++			(void)close(fd);
++			continue;
++		}
+ 
+ 		if (copy_stream(fd, lp) < 0)
+ 			dolog(LOGOPTS, "copy_stream: %m\n");
+-- 
+2.17.1
+

From 7c61e26426e8b12b7e0e55efffe2aeb0421254b2 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Mon, 30 May 2022 11:31:16 +0800
Subject: [PATCH 20/56] nginx-util: ssl CN x-wrt.lan

---
 net/nginx-util/src/nginx-ssl-util.hpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/nginx-util/src/nginx-ssl-util.hpp b/net/nginx-util/src/nginx-ssl-util.hpp
index 4484b3550f..3432bfe741 100644
--- a/net/nginx-util/src/nginx-ssl-util.hpp
+++ b/net/nginx-util/src/nginx-ssl-util.hpp
@@ -451,7 +451,7 @@ inline void create_ssl_certificate(const std::string& crtpath,
 
         write_key(pkey, tmpkeypath);
 
-        std::string subject{"/C=ZZ/ST=Somewhere/L=None/CN=OpenWrt/O=OpenWrt"};
+        std::string subject{"/C=ZZ/ST=Somewhere/L=None/CN=x-wrt.lan/O=x-wrt.lan"};
         subject += noncestr.data();
 
         selfsigned(pkey, days, subject, tmpcrtpath);

From 18fbbeb622a8f758d8aab465f11a51b1c8296c51 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Mon, 18 Jul 2022 15:25:18 +0800
Subject: [PATCH 21/56] dawn: update to lastest version

---
 net/dawn/Makefile | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/net/dawn/Makefile b/net/dawn/Makefile
index 0ca519b180..b86522dcb6 100644
--- a/net/dawn/Makefile
+++ b/net/dawn/Makefile
@@ -5,13 +5,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dawn
-PKG_SOURCE_DATE:=2026-06-10
-PKG_RELEASE:=1
+PKG_SOURCE_DATE:=2026-06-27
+PKG_VERSION:=20260627
 
-PKG_SOURCE_PROTO:=git
-PKG_SOURCE_URL:=https://github.com/berlin-open-wireless-lab/DAWN.git
-PKG_SOURCE_VERSION:=806166bce0badb383f72e4942744dab9e26a591f
-PKG_MIRROR_HASH:=8b5eaa42a2c579c45662fa84ccd9d639a27ec0a43d88a5c812b2e99c11514d02
+PKG_SOURCE_URL:=https://codeload.github.com/fakemesh/dawn/tar.gz/$(PKG_VERSION)?
+PKG_HASH:=bf6cc1e7c322e9f6242bcbecee6bcd89ebc85528171c18141b313d9636a6fb23
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 
 PKG_MAINTAINER:=Nick Hainke <vincent@systemli.org>
 PKG_LICENSE:=GPL-2.0-only

From da5c151690a491e092ffb1949a5ca24f75baf46e Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Thu, 11 Aug 2022 17:38:08 +0800
Subject: [PATCH 22/56] cgi-io: allow underscore character in filename/mimetype

Signed-off-by: Chen Minqiang <ptpt52@gmail.com>
---
 ...low-underscore-character-in-filename.patch | 30 +++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 net/cgi-io/patches/10-allow-underscore-character-in-filename.patch

diff --git a/net/cgi-io/patches/10-allow-underscore-character-in-filename.patch b/net/cgi-io/patches/10-allow-underscore-character-in-filename.patch
new file mode 100644
index 0000000000..10db5e0200
--- /dev/null
+++ b/net/cgi-io/patches/10-allow-underscore-character-in-filename.patch
@@ -0,0 +1,30 @@
+--- a/main.c
++++ b/main.c
+@@ -547,11 +547,11 @@ main_download(int argc, char **argv)
+ 		return failure(403, 0, "Requested path is not a regular file or block device");
+ 
+ 	for (p = fields[5]; p && *p; p++)
+-		if (!isalnum(*p) && !strchr(" ()<>@,;:[]?.=%-", *p))
++		if (!isalnum(*p) && !strchr(" ()<>@,;:[]?.=%-_", *p))
+ 			return failure(400, 0, "Invalid characters in filename");
+ 
+ 	for (p = fields[7]; p && *p; p++)
+-		if (!isalnum(*p) && !strchr(" .;=/-", *p))
++		if (!isalnum(*p) && !strchr(" .;=/-_", *p))
+ 			return failure(400, 0, "Invalid characters in mimetype");
+ 
+ 	rfd = open(fields[3], O_RDONLY);
+@@ -745,11 +745,11 @@ main_exec(int argc, char **argv)
+ 		return failure(403, 0, "Exec permission denied");
+ 
+ 	for (p = fields[5]; p && *p; p++)
+-		if (!isalnum(*p) && !strchr(" ()<>@,;:[]?.=%-", *p))
++		if (!isalnum(*p) && !strchr(" ()<>@,;:[]?.=%-_", *p))
+ 			return failure(400, 0, "Invalid characters in filename");
+ 
+ 	for (p = fields[7]; p && *p; p++)
+-		if (!isalnum(*p) && !strchr(" .;=/-", *p))
++		if (!isalnum(*p) && !strchr(" .;=/-_", *p))
+ 			return failure(400, 0, "Invalid characters in mimetype");
+ 
+ 	args = fields[3] ? parse_command(fields[3]) : NULL;

From 74dbbf244c3664478a7c77e59e2e0c7764432cf6 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Sat, 27 Aug 2022 00:46:06 +0800
Subject: [PATCH 23/56] ddns-scripts: ucitrack on ddns

---
 net/ddns-scripts/Makefile                                | 1 +
 net/ddns-scripts/files/uci.defaults                      | 9 +++++++++
 .../files/usr/lib/ddns/dynamic_dns_lucihelper.sh         | 4 ++++
 3 files changed, 14 insertions(+)
 create mode 100644 net/ddns-scripts/files/uci.defaults

diff --git a/net/ddns-scripts/Makefile b/net/ddns-scripts/Makefile
index fc929c00e6..cda06062bb 100644
--- a/net/ddns-scripts/Makefile
+++ b/net/ddns-scripts/Makefile
@@ -473,6 +473,7 @@ define Package/ddns-scripts/install
 	$(INSTALL_DIR) $(1)/etc/uci-defaults
 	$(INSTALL_DATA) ./files/etc/uci-defaults/50-ddns-migrate-retry-count \
 		$(1)/etc/uci-defaults/
+	$(INSTALL_DATA) ./files/uci.defaults $(1)/etc/uci-defaults/99-ddns
 endef
 
 
diff --git a/net/ddns-scripts/files/uci.defaults b/net/ddns-scripts/files/uci.defaults
new file mode 100644
index 0000000000..fe8daa28a2
--- /dev/null
+++ b/net/ddns-scripts/files/uci.defaults
@@ -0,0 +1,9 @@
+
+uci -q batch <<-EOF >/dev/null
+	delete ucitrack.@ddns[-1]
+	add ucitrack ddns
+	set ucitrack.@ddns[-1].init=ddns
+	commit ucitrack
+EOF
+
+exit 0
diff --git a/net/ddns-scripts/files/usr/lib/ddns/dynamic_dns_lucihelper.sh b/net/ddns-scripts/files/usr/lib/ddns/dynamic_dns_lucihelper.sh
index f6b68f3026..f7f1bdf81b 100644
--- a/net/ddns-scripts/files/usr/lib/ddns/dynamic_dns_lucihelper.sh
+++ b/net/ddns-scripts/files/usr/lib/ddns/dynamic_dns_lucihelper.sh
@@ -24,6 +24,7 @@ Commands:
  verify_dns          given DNS-SERVER
  verify_proxy        given PROXY
  start               start given SECTION
+ stop                stop given SECTION
  reload              force running ddns processes to reload changed configuration
  restart             restart all ddns processes
  stop                stop given SECTION
@@ -146,6 +147,9 @@ case "$1" in
 		[ -z "$SECTION" ] &&  usage_err "command 'start': 'SECTION' not set"
 		/etc/init.d/ddns start "$SECTION"
 		;;
+	stop)
+		[ -z "$SECTION" ] &&  usage_err "command 'start': 'SECTION' not set"
+		$DDNSPRG -v $VERBOSE -S $SECTION -- stop
 	reload)
 		/etc/init.d/ddns reload
 		;;

From a067c3b2046813ddfd5e64aa42b10dcd38ce7462 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Thu, 23 Mar 2023 23:27:25 +0800
Subject: [PATCH 24/56] xl2tpd: rename pppd client ifname

---
 .../patches/0009-ppp-ifname-for-natcap.patch  | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 net/xl2tpd/patches/0009-ppp-ifname-for-natcap.patch

diff --git a/net/xl2tpd/patches/0009-ppp-ifname-for-natcap.patch b/net/xl2tpd/patches/0009-ppp-ifname-for-natcap.patch
new file mode 100644
index 0000000000..6eb639ac6f
--- /dev/null
+++ b/net/xl2tpd/patches/0009-ppp-ifname-for-natcap.patch
@@ -0,0 +1,19 @@
+diff --git a/xl2tpd.c b/xl2tpd.c
+index 791d5a4..0f549f7 100644
+--- a/xl2tpd.c
++++ b/xl2tpd.c
+@@ -529,6 +529,14 @@ int start_pppd (struct call *c, struct ppp_opts *opts)
+     else if (!c->pppd)
+     {
+         /* child */
++        if (c->container->lns) {
++            char pppname[16];
++            snprintf(pppname, 16, "l2tp%u", getpid());
++            pppname[15] = 0;
++            stropt[pos++] = strdup("ifname");
++            stropt[pos++] = strdup(pppname);
++            stropt[pos] = NULL;
++        }
+ 
+         close (0); /* redundant; the dup2() below would do that, too */
+         close (1); /* ditto */

From a9176f6842db9883598303854216a30514b63e33 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Sun, 26 Mar 2023 20:53:39 +0800
Subject: [PATCH 25/56] pptpd: chap-secrets co-work with l2tp

---
 net/pptpd/files/pptpd.init | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/pptpd/files/pptpd.init b/net/pptpd/files/pptpd.init
index c97ce24210..39aa7856a4 100644
--- a/net/pptpd/files/pptpd.init
+++ b/net/pptpd/files/pptpd.init
@@ -35,7 +35,7 @@ setup_login() {
 	[ -n "$password" ] || return 0
 	[ -n "$remoteip" ] || remoteip=*
 
-	echo "$username pptp-server $password $remoteip" >> $CHAP_SECRETS
+	echo "$username pptp-server \"$password\" $remoteip" >> $CHAP_SECRETS.pptp
 }
 
 setup_config() {
@@ -63,9 +63,12 @@ start_service() {
 	config_load pptpd
 	validate_pptpd_section pptpd setup_config || return
 	sed -i -E "/^\w+\s+pptp-server\s+.+$/d" $CHAP_SECRETS
+	:>$CHAP_SECRETS.pptp
 	config_foreach validate_login_section login setup_login
+	cat $CHAP_SECRETS.pptp $CHAP_SECRETS.l2tp >$CHAP_SECRETS 2>/dev/null
 
-	ln -sfn $CHAP_SECRETS /etc/ppp/chap-secrets
+	readlink /etc/ppp/chap-secrets &>/dev/null || \
+	ln -sfn $CHAP_SECRETS /etc/ppp/chap-secrets &>/dev/null
 
 	procd_open_instance
 	procd_set_param command $BIN -c $CONFIG --fg -o $OPTIONS_PPTP

From 619a289927b5a1c5df8aba33b30fe71f0a6f781f Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Wed, 19 Apr 2023 23:42:57 +0800
Subject: [PATCH 26/56] pptpd: fix depends on ppp-mod-pptp instead of ppp

---
 net/pptpd/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/pptpd/Makefile b/net/pptpd/Makefile
index c6f038ffa2..174752d747 100644
--- a/net/pptpd/Makefile
+++ b/net/pptpd/Makefile
@@ -27,7 +27,7 @@ include $(INCLUDE_DIR)/package.mk
 define Package/pptpd
   SECTION:=net
   CATEGORY:=Network
-  DEPENDS:=+kmod-ppp +kmod-gre +kmod-mppe +ppp
+  DEPENDS:=+kmod-ppp +kmod-gre +kmod-mppe +ppp-mod-pptp
   TITLE:=PopTop pptp server
   URL:=https://poptop.sourceforge.net/
   SUBMENU:=VPN

From 7834f4a9e46a5250a647af7db7f565921acd24ee Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Fri, 5 May 2023 14:44:00 +0800
Subject: [PATCH 27/56] nghttp2: also enable static lib

---
 libs/nghttp2/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libs/nghttp2/Makefile b/libs/nghttp2/Makefile
index fb90982127..d37010bb29 100644
--- a/libs/nghttp2/Makefile
+++ b/libs/nghttp2/Makefile
@@ -28,7 +28,7 @@ HTTP/2 C Library
 endef
 
 CMAKE_OPTIONS += \
-        -DENABLE_LIB_ONLY=ON
+        -DENABLE_LIB_ONLY=ON -DENABLE_STATIC_LIB=ON
 
 define Build/InstallDev
 	$(call Build/InstallDev/cmake,$(1))

From de11c6141014094f78e9a9993af533ff598b6303 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Mon, 13 Nov 2023 16:28:37 +0800
Subject: [PATCH 28/56] nginx-util: default client_max_body_size 256M

---
 net/nginx-util/files/uci.conf.template | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/nginx-util/files/uci.conf.template b/net/nginx-util/files/uci.conf.template
index a9532576ce..f79d0c3af1 100644
--- a/net/nginx-util/files/uci.conf.template
+++ b/net/nginx-util/files/uci.conf.template
@@ -21,7 +21,7 @@ http {
 	default_type application/octet-stream;
 	sendfile on;
 
-	client_max_body_size 128M;
+	client_max_body_size 256M;
 	large_client_header_buffers 2 1k;
 
 	gzip on;

From 5ff90cbd8e82c80d6eb51002cced23f73a5b00d0 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Fri, 22 Mar 2024 08:03:51 +0800
Subject: [PATCH 29/56] Revert "nginx: Fix compilation with LTO"

This reverts commit 3b13b08ad98dd15999e83c98f80674c9965d7a10.
---
 net/nginx/Makefile                                | 2 +-
 net/nginx/patches/nginx/102-sizeof_test_fix.patch | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/nginx/Makefile b/net/nginx/Makefile
index 3cec6d950c..7119b6ac01 100644
--- a/net/nginx/Makefile
+++ b/net/nginx/Makefile
@@ -24,7 +24,7 @@ PKG_CPE_ID:=cpe:/a:f5:nginx_open_source
 PKG_FIXUP:=autoreconf
 PKG_BUILD_PARALLEL:=1
 PKG_INSTALL:=1
-PKG_BUILD_FLAGS:=gc-sections lto
+PKG_BUILD_FLAGS:=gc-sections
 
 # 3rd-party modules
 PKG_MOD_EXTRA := \
diff --git a/net/nginx/patches/nginx/102-sizeof_test_fix.patch b/net/nginx/patches/nginx/102-sizeof_test_fix.patch
index 823e7eabb9..7d2430eab9 100644
--- a/net/nginx/patches/nginx/102-sizeof_test_fix.patch
+++ b/net/nginx/patches/nginx/102-sizeof_test_fix.patch
@@ -4,7 +4,7 @@
  $NGX_INCLUDE_INTTYPES_H
  $NGX_INCLUDE_AUTO_CONFIG_H
  
-+volatile char object_code_block[] = {
++char object_code_block[] = {
 +	'\n', 'e', '4', 'V', 'A',
 +	'0', 'x', ('0' + sizeof($ngx_type)),
 +	'Y', '3', 'p', 'M', '\n'

From 602a46f033d840f45ee9e391de70dc68adfdeef0 Mon Sep 17 00:00:00 2001
From: Andrea Pesaresi <andreapesaresi82@gmail.com>
Date: Wed, 17 Apr 2024 19:32:39 +0200
Subject: [PATCH 30/56] tini: fix missing basename

Fix issue: https://github.com/openwrt/packages/issues/23934
Patch from: https://git.alpinelinux.org/aports/tree/community/tini/fix-missing-basename.patch

It solves the error: implicit declaration of function 'basename' with musl libc 1.2.5

Signed-off-by: Andrea Pesaresi <andreapesaresi82@gmail.com>
---
 utils/tini/patches/002-fix_missing_basename.patch | 11 +++++++++++
 1 file changed, 11 insertions(+)
 create mode 100644 utils/tini/patches/002-fix_missing_basename.patch

diff --git a/utils/tini/patches/002-fix_missing_basename.patch b/utils/tini/patches/002-fix_missing_basename.patch
new file mode 100644
index 0000000000..56f252d47a
--- /dev/null
+++ b/utils/tini/patches/002-fix_missing_basename.patch
@@ -0,0 +1,11 @@
+--- a/src/tini.c
++++ b/src/tini.c
+@@ -18,6 +18,8 @@
+ #include "tiniConfig.h"
+ #include "tiniLicense.h"
+ 
++#define basename(name) (strrchr((name),'/') ? strrchr((name),'/')+1 : (name))
++
+ #if TINI_MINIMAL
+ #define PRINT_FATAL(...)                         fprintf(stderr, __VA_ARGS__); fprintf(stderr, "\n");
+ #define PRINT_WARNING(...)  if (verbosity > 0) { fprintf(stderr, __VA_ARGS__); fprintf(stderr, "\n"); }

From 792ab1e0c2679da5b8ee1c62d5bb1157eb197879 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Sat, 20 Apr 2024 15:53:54 +0800
Subject: [PATCH 31/56] fix: net/nginx/files-luci-support/60_nginx-luci-support

---
 net/nginx/files-luci-support/60_nginx-luci-support | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/nginx/files-luci-support/60_nginx-luci-support b/net/nginx/files-luci-support/60_nginx-luci-support
index 8f1eef44e7..757727a6ae 100644
--- a/net/nginx/files-luci-support/60_nginx-luci-support
+++ b/net/nginx/files-luci-support/60_nginx-luci-support
@@ -1,5 +1,9 @@
 #!/bin/sh
 
+grep -r -l ngx_http_ubus_module.so /etc/nginx/module.d | grep -v ngx_http_ubus.module | while read file; do
+	rm -f $file
+done
+
 if nginx -V 2>&1 | grep -q ubus && [ -f /usr/lib/nginx/modules/ngx_http_ubus_module.so ]; then
 	if [ -z "$(cat /etc/nginx/conf.d/luci.locations | grep ubus)" ]; then
 		cat <<EOT >> /etc/nginx/conf.d/luci.locations

From dc1742b222adc601c49e3b921a876ed803211666 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Sun, 12 May 2024 15:50:16 +0800
Subject: [PATCH 32/56] Revert "pcre: drop package"

This reverts commit 38d5b8b3444ab83348a35adec145443d755aae45.
---
 libs/pcre/Config.in |  11 ++++
 libs/pcre/Makefile  | 129 ++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 140 insertions(+)
 create mode 100644 libs/pcre/Config.in
 create mode 100644 libs/pcre/Makefile

diff --git a/libs/pcre/Config.in b/libs/pcre/Config.in
new file mode 100644
index 0000000000..15e75fc753
--- /dev/null
+++ b/libs/pcre/Config.in
@@ -0,0 +1,11 @@
+config PCRE_JIT_ENABLED
+	bool
+	depends on PACKAGE_libpcre && (arm || i386 || i686 || x86_64 || mips || mipsel || powerpc || sparc)
+	default y if (arm || i686 || x86_64)
+	prompt "Enable JIT compiler support"
+	help
+		Enable JIT (Just-In-Time) compiler support.
+
+		Enabling this option can give an about 10x performance increase on JIT operations. It can be desireable for e.g. high performance Apache mod_rewrite or HA-Proxy reqrep operations.
+
+		However, JIT should _only_ be enabled on architectures that are supported. Enabling JIT on unsupported platforms will result in a compilation failure. A list of supported architectures can be found here: https://pcre.org/original/doc/html/pcrejit.html#SEC3 .
diff --git a/libs/pcre/Makefile b/libs/pcre/Makefile
new file mode 100644
index 0000000000..5309f81d7a
--- /dev/null
+++ b/libs/pcre/Makefile
@@ -0,0 +1,129 @@
+#
+# Copyright (C) 2006-2015 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=pcre
+PKG_VERSION:=8.45
+PKG_RELEASE:=5
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
+PKG_SOURCE_URL:=@SF/$(PKG_NAME)
+PKG_HASH:=4dae6fdcd2bb0bb6c37b5f97c33c2be954da743985369cddac3546e3218bffb8
+
+PKG_MAINTAINER:=Thomas Heil <heil@terminal-consulting.de>
+PKG_LICENSE:=BSD-3-Clause
+PKG_LICENSE_FILES:=LICENCE
+PKG_CPE_ID:=cpe:/a:pcre:pcre
+
+PKG_INSTALL:=1
+PKG_BUILD_PARALLEL:=1
+
+PKG_CONFIG_DEPENDS:=\
+	CONFIG_PACKAGE_libpcrecpp \
+	CONFIG_PCRE_JIT_ENABLED
+
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/host-build.mk
+
+define Package/libpcre/default
+  SECTION:=libs
+  CATEGORY:=Libraries
+  URL:=https://www.pcre.org/
+endef
+
+define Package/libpcre/config
+  source "$(SOURCE)/Config.in"
+endef
+
+define Package/libpcre
+  $(call Package/libpcre/default)
+  TITLE:=A Perl Compatible Regular Expression library
+endef
+
+define Package/libpcre16
+  $(call Package/libpcre/default)
+  TITLE:=A Perl Compatible Regular Expression library (16bit support)
+endef
+
+define Package/libpcre32
+  $(call Package/libpcre/default)
+  TITLE:=A Perl Compatible Regular Expression library (32bit support)
+endef
+
+define Package/libpcrecpp
+  $(call Package/libpcre/default)
+  TITLE:=C++ wrapper for Perl Compatible Regular Expression library
+  DEPENDS:=+libpcre +libstdcpp
+endef
+
+HOST_CONFIGURE_ARGS += \
+	--disable-shared \
+	--enable-utf8 \
+	--enable-unicode-properties \
+	--enable-pcre16 \
+	--with-match-limit-recursion=16000 \
+	--enable-cpp \
+	--with-pic
+
+CONFIGURE_ARGS += \
+	--enable-utf8 \
+	--enable-unicode-properties \
+	--enable-pcre16 \
+	--enable-pcre32 \
+	$(if $(CONFIG_PCRE_JIT_ENABLED),--enable-jit,--disable-jit) \
+	--with-match-limit-recursion=16000 \
+	--$(if $(CONFIG_PACKAGE_libpcrecpp),en,dis)able-cpp \
+	--with-pic
+
+MAKE_FLAGS += \
+	CFLAGS="$(TARGET_CFLAGS)"
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/pcre-config $(1)/usr/bin/
+	$(SED) 's,^\(prefix\|exec_prefix\)=.*,\1=$(STAGING_DIR)/usr,g' $(1)/usr/bin/pcre-config
+
+	$(INSTALL_DIR) $(2)/bin
+	$(LN) $(STAGING_DIR)/usr/bin/pcre-config $(2)/bin
+
+	$(INSTALL_DIR) $(1)/usr/include
+	$(CP) $(PKG_INSTALL_DIR)/usr/include/pcre*.h $(1)/usr/include/
+
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libpcre*.{a,so*} $(1)/usr/lib/
+
+	$(INSTALL_DIR) $(1)/usr/lib/pkgconfig
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libpcre*.pc $(1)/usr/lib/pkgconfig/
+endef
+
+define Package/libpcre/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libpcre{,posix}.so.* $(1)/usr/lib/
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libpcre.so $(1)/usr/lib/
+endef
+
+define Package/libpcre16/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libpcre16.so* $(1)/usr/lib/
+endef
+
+define Package/libpcre32/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libpcre32.so* $(1)/usr/lib/
+endef
+
+define Package/libpcrecpp/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libpcrecpp.so.* $(1)/usr/lib/
+endef
+
+$(eval $(call BuildPackage,libpcre))
+$(eval $(call BuildPackage,libpcre16))
+$(eval $(call BuildPackage,libpcre32))
+$(eval $(call BuildPackage,libpcrecpp))
+$(eval $(call HostBuild))

From a507ae508d10979aead9ec63542b7c158193296a Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Mon, 9 Dec 2024 01:35:02 +0800
Subject: [PATCH 33/56] ksmbd-tools: update to latest version

---
 net/ksmbd-tools/Makefile               | 11 +++++++----
 net/ksmbd-tools/files/ksmbd.init       |  2 +-
 net/ksmbd-tools/patches/030-glib.patch | 10 ----------
 3 files changed, 8 insertions(+), 15 deletions(-)
 delete mode 100644 net/ksmbd-tools/patches/030-glib.patch

diff --git a/net/ksmbd-tools/Makefile b/net/ksmbd-tools/Makefile
index 0f09c1cc31..cc979b26be 100644
--- a/net/ksmbd-tools/Makefile
+++ b/net/ksmbd-tools/Makefile
@@ -2,11 +2,11 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ksmbd-tools
 PKG_VERSION:=3.5.6
-PKG_RELEASE:=1
+PKG_RELEASE:=20251206
 
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://github.com/cifsd-team/ksmbd-tools/releases/download/$(PKG_VERSION)
-PKG_HASH:=8ce27cf947667b634478186aa7ef91fce68461c781d3880693a4639f8fecc397
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_RELEASE).tar.gz
+PKG_SOURCE_URL:=https://codeload.github.com/ptpt52/ksmbd-tools/tar.gz/$(PKG_RELEASE)?
+PKG_HASH:=49869a135fa2d0f5d2e6bf29b834a607e3344ea7f551426a46ada4e87b8fac7b
 
 PKG_LICENSE:=GPL-2.0-or-later
 PKG_LICENSE_FILES:=COPYING
@@ -18,6 +18,9 @@ include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/nls.mk
 include $(INCLUDE_DIR)/meson.mk
 
+TAR_OPTIONS+= --strip-components 1
+TAR_CMD=$(HOST_TAR) -C $(1) $(TAR_OPTIONS)
+
 define Package/ksmbd-tools/Default
   SECTION:=net
   CATEGORY:=Network
diff --git a/net/ksmbd-tools/files/ksmbd.init b/net/ksmbd-tools/files/ksmbd.init
index f87b392bde..dc6dfb60f4 100644
--- a/net/ksmbd-tools/files/ksmbd.init
+++ b/net/ksmbd-tools/files/ksmbd.init
@@ -36,7 +36,7 @@ config_get_ram()
 
 smb_header()
 {
-	config_get_sane SMBD_IFACE "$1" interface "lan"
+	config_get_sane SMBD_IFACE "$1" interface ""
 
 	# resolve interfaces
 	interfaces=$(
diff --git a/net/ksmbd-tools/patches/030-glib.patch b/net/ksmbd-tools/patches/030-glib.patch
deleted file mode 100644
index 4b9d7a4518..0000000000
--- a/net/ksmbd-tools/patches/030-glib.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- a/meson.build
-+++ b/meson.build
-@@ -21,6 +21,7 @@ include_dirs = include_directories(
- glib_dep = dependency(
-   'glib-2.0',
-   version: '>= 2.58',
-+  static: true,
- )
- libnl_dep = dependency(
-   'libnl-genl-3.0',

From b77286b52bfeed5a8d5ce4bfe811ca5033ab7e31 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Fri, 17 Jan 2025 20:38:26 +0800
Subject: [PATCH 34/56] pptpd: update pppd options

---
 net/pptpd/files/pptpd.init | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/pptpd/files/pptpd.init b/net/pptpd/files/pptpd.init
index 39aa7856a4..200e34c693 100644
--- a/net/pptpd/files/pptpd.init
+++ b/net/pptpd/files/pptpd.init
@@ -21,7 +21,7 @@ validate_pptpd_section() {
 		'enabled:bool:1' \
 		'localip:string' \
 		'remoteip:string' \
-		'mppe:list(string):required no40 no56 stateless' \
+		'mppe:list(string):nomppe-40 require-mppe-128 nomppe-stateful' \
 		'logwtmp:bool:0'
 }
 
@@ -54,7 +54,9 @@ setup_config() {
 	[ -n "$remoteip" ] && echo "remoteip  $remoteip" >> $CONFIG
 	[ "$logwtmp" -eq 1 ] && echo "logwtmp" >> $CONFIG
 
-	echo "mppe $(echo $mppe | sed -e 's/\s/,/g')" >> $OPTIONS_PPTP
+	for opt in $mppe; do
+		echo $opt >>$OPTIONS_PPTP
+	done
 
 	return 0
 }

From 605311f15ad514f64d24537cb516b6963e3c8550 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Thu, 29 May 2025 11:15:33 +0800
Subject: [PATCH 35/56] Revert "python-netifaces: drop package"

This reverts commit 8bb5a41cdfd00465527ad30a8c04c4629086985f.
---
 lang/python/python-netifaces/Makefile | 40 +++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 lang/python/python-netifaces/Makefile

diff --git a/lang/python/python-netifaces/Makefile b/lang/python/python-netifaces/Makefile
new file mode 100644
index 0000000000..351752a507
--- /dev/null
+++ b/lang/python/python-netifaces/Makefile
@@ -0,0 +1,40 @@
+#
+# Copyright (C) 2019 CZ.NIC, z. s. p. o. (https://www.nic.cz/)
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=python-netifaces
+PKG_VERSION:=0.11.0
+PKG_RELEASE:=1
+
+PYPI_NAME:=netifaces
+PKG_HASH:=043a79146eb2907edf439899f262b3dfe41717d34124298ed281139a8b93ca32
+
+PKG_MAINTAINER:=Josef Schlehofer <pepe.schlehofer@gmail.com>
+PKG_LICENSE:=MIT
+PKG_LICENSE_FILES:=LICENSE
+
+include ../pypi.mk
+include $(INCLUDE_DIR)/package.mk
+include ../python3-package.mk
+
+define Package/python3-netifaces
+  SECTION:=lang
+  CATEGORY:=Languages
+  SUBMENU:=Python
+  TITLE:=Portable network interface information
+  URL:=https://github.com/al45tair/netifaces
+  DEPENDS:=+python3-light
+endef
+
+define Package/python3-netifaces/description
+  Portable network interface information.
+endef
+
+$(eval $(call Py3Package,python3-netifaces))
+$(eval $(call BuildPackage,python3-netifaces))
+$(eval $(call BuildPackage,python3-netifaces-src))

From 521f32880327324a33d83979a4dd68d3eebd6d8f Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Thu, 29 May 2025 11:14:49 +0800
Subject: [PATCH 36/56] python3-netifaces: fix build

---
 .../python-netifaces/patches/100-fix-build.patch    | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 lang/python/python-netifaces/patches/100-fix-build.patch

diff --git a/lang/python/python-netifaces/patches/100-fix-build.patch b/lang/python/python-netifaces/patches/100-fix-build.patch
new file mode 100644
index 0000000000..6d9f00e170
--- /dev/null
+++ b/lang/python/python-netifaces/patches/100-fix-build.patch
@@ -0,0 +1,13 @@
+diff --git a/netifaces.c b/netifaces.c
+index 839c42c..8b04dc4 100644
+--- a/netifaces.c
++++ b/netifaces.c
+@@ -1805,7 +1805,7 @@ gateways (PyObject *self)
+         sizeof(sanl_from),
+         &iov,
+         1,
+-        NULL,
++        0,
+         0,
+         0
+       };

From da215843958d248a0f13972792f6529a2eac7a8f Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Fri, 13 Jun 2025 10:29:15 +0800
Subject: [PATCH 37/56] curl: drop dependency on libbrotli

---
 net/curl/Makefile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/curl/Makefile b/net/curl/Makefile
index 36029f1ae5..63c68c3d66 100644
--- a/net/curl/Makefile
+++ b/net/curl/Makefile
@@ -118,6 +118,7 @@ CONFIGURE_ARGS += \
 	--disable-ipfs \
 	--enable-shared \
 	--enable-static \
+	--without-brotli \
 	--without-nss \
 	--without-librtmp \
 	--without-ca-path \

From 52de07fb5ac594b268e0f3f37f453bcbf554d484 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Fri, 13 Jun 2025 15:57:15 +0800
Subject: [PATCH 38/56] php8-pecl-http: disable libbrotli

---
 lang/php8-pecl-http/Makefile | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lang/php8-pecl-http/Makefile b/lang/php8-pecl-http/Makefile
index 786464f037..adab786d06 100644
--- a/lang/php8-pecl-http/Makefile
+++ b/lang/php8-pecl-http/Makefile
@@ -31,6 +31,9 @@ include ../php8/pecl.mk
 
 CONFIGURE_VARS+= \
 	PECL_cv_HAVE_EXT_raphf=yes \
+	PECL_cv_libbrotlicommon_exists=no \
+	PECL_cv_libbrotlidec_exists=no \
+	PECL_cv_libbrotlienc_exists=no \
 	PECL_cv_HAVE_LIBCURL_ARES=no \
 	PECL_cv_HAVE_LIBCURL_OpenSSL=$(if $(CONFIG_LIBCURL_OPENSSL),yes,no) \
 	PECL_cv_HAVE_LIBCURL_GnuTLS=$(if $(CONFIG_LIBCURL_GNUTLS),yes,no) \

From 3b1a39f45fec6859187d0401ef49323ab613ea16 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Mon, 30 Jun 2025 23:23:05 +0800
Subject: [PATCH 39/56] Revert "avahi: remove compat library"

This reverts commit 5ae88c48b79da0732f90ae1cb54eea9212b486e5.
---
 libs/avahi/Makefile | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/libs/avahi/Makefile b/libs/avahi/Makefile
index 94433224af..9ed4a5cb7c 100644
--- a/libs/avahi/Makefile
+++ b/libs/avahi/Makefile
@@ -218,6 +218,23 @@ $(call Package/avahi/Default/description)
  For more information please see the avahi documentation.
 endef
 
+define Package/libavahi-compat-libdnssd
+  $(call Package/avahi/Default)
+  SECTION:=libs
+  CATEGORY:=Libraries
+  VARIANT:=dbus
+  DEPENDS:=+libavahi-client
+  TITLE+= (libdnssd)
+endef
+
+define Package/libavahi-compat-libdnssd/description
+$(call Package/avahi/Default/description)
+ .
+ This packages adds the libavahi-compat-libdnssd library.
+ It also automatically adds the required libavahi-client package.
+ For more information please see the avahi documentation.
+endef
+
 define Package/avahi-utils
   $(call Package/avahi/Default)
   SUBMENU:=IP Addresses and Names
@@ -280,6 +297,10 @@ CONFIGURE_ARGS += \
 	--with-autoipd-group=avahi
 
 ifeq ($(BUILD_VARIANT),dbus)
+ifneq ($(CONFIG_PACKAGE_libavahi-compat-libdnssd),)
+CONFIGURE_ARGS += \
+	--enable-compat-libdns_sd
+endif
 CONFIGURE_ARGS += \
 	--enable-dbus
 else
@@ -296,6 +317,11 @@ define Build/InstallDev
 	$(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/
 	$(INSTALL_DIR) $(1)/usr/lib
 	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libavahi-* $(1)/usr/lib/
+ifneq ($(CONFIG_PACKAGE_libavahi-compat-libdnssd),)
+ifeq ($(BUILD_VARIANT),dbus)
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libdns_sd* $(1)/usr/lib/
+endif
+endif
 	$(INSTALL_DIR) $(1)/usr/lib/pkgconfig
 	$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/* $(1)/usr/lib/pkgconfig/
 endef
@@ -318,6 +344,11 @@ define Package/libavahi-client/install
 	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libavahi-client.so.* $(1)/usr/lib/
 endef
 
+define Package/libavahi-compat-libdnssd/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libdns_sd.so* $(1)/usr/lib/
+endef
+
 define Package/avahi-utils/install
 	$(INSTALL_DIR) $(1)/usr/bin
 	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/* $(1)/usr/bin/
@@ -365,6 +396,7 @@ define Package/avahi-dnsconfd/install
 endef
 
 $(eval $(call BuildPackage,libavahi-client))
+$(eval $(call BuildPackage,libavahi-compat-libdnssd))
 $(eval $(call BuildPackage,avahi-utils))
 $(eval $(call BuildPackage,libavahi-dbus-support))
 $(eval $(call BuildPackage,libavahi-nodbus-support))

From 269413d3354d0dcce0aa79e7de3b0ee79c14b7f7 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Fri, 8 Aug 2025 07:14:10 +0800
Subject: [PATCH 40/56] utils/prometheus-node-exporter-lua: FIXME: drop mwan3
 depends

---
 utils/prometheus-node-exporter-lua/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/utils/prometheus-node-exporter-lua/Makefile b/utils/prometheus-node-exporter-lua/Makefile
index 8eaa9a79ff..a09d446b16 100644
--- a/utils/prometheus-node-exporter-lua/Makefile
+++ b/utils/prometheus-node-exporter-lua/Makefile
@@ -260,7 +260,7 @@ endef
 define Package/prometheus-node-exporter-lua-mwan3
   $(call Package/prometheus-node-exporter-lua/Default)
   TITLE+= (mwan3 collector)
-  DEPENDS:=prometheus-node-exporter-lua +mwan3
+  DEPENDS:=prometheus-node-exporter-lua
 endef
 
 define Package/prometheus-node-exporter-lua-mwan3/install

From 0e90eb223e4c1bf2ee8ca0b7d0f07ca00642a48c Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Thu, 4 Dec 2025 23:04:56 +0800
Subject: [PATCH 41/56] Revert "webui-aria2: remove package"

---
 net/webui-aria2/Makefile                      | 52 +++++++++++++++++++
 .../patches/0001-fix-favicon-path.patch       | 11 ++++
 2 files changed, 63 insertions(+)
 create mode 100644 net/webui-aria2/Makefile
 create mode 100644 net/webui-aria2/patches/0001-fix-favicon-path.patch

diff --git a/net/webui-aria2/Makefile b/net/webui-aria2/Makefile
new file mode 100644
index 0000000000..e1a9801298
--- /dev/null
+++ b/net/webui-aria2/Makefile
@@ -0,0 +1,52 @@
+#
+# Copyright (C) 2016-2020 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=webui-aria2
+PKG_SOURCE_DATE:=2018-12-09
+PKG_SOURCE_VERSION:=fb9d758d5cdc2be0867ee9502c44fd17560f5d24
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_SOURCE_DATE).tar.gz
+PKG_SOURCE_URL:=https://codeload.github.com/ziahamza/webui-aria2/tar.gz/$(PKG_SOURCE_VERSION)?
+PKG_HASH:=4cddcbd64a7b20baf0c2c31cb3c07d0fa01576a12c4e6feefd0840acd3f65919
+PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_SOURCE_VERSION)
+
+PKG_LICENSE:=MIT
+PKG_LICENSE_FILES:=LICENSE
+PKG_MAINTAINER:=Hsing-Wang Liao <kuoruan@gmail.com>
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/webui-aria2
+  SECTION:=net
+  CATEGORY:=Network
+  SUBMENU:=Download Manager
+  DEPENDS:=
+  TITLE:=An interface to interact with aria2
+  URL:=https://github.com/ziahamza/webui-aria2
+  PKGARCH:=all
+endef
+
+define Package/webui-aria2/description
+	The aim for this project is to create the worlds best and hottest interface to interact with aria2. Very simple to use.
+endef
+
+define Build/Compile
+endef
+
+define Package/webui-aria2/install
+	$(INSTALL_DIR) $(1)/www/webui-aria2 
+
+	$(CP) \
+		$(PKG_BUILD_DIR)/docs/* \
+		$(PKG_BUILD_DIR)/{LICENSE,favicon.ico} \
+		$(1)/www/webui-aria2
+endef
+
+$(eval $(call BuildPackage,webui-aria2))
diff --git a/net/webui-aria2/patches/0001-fix-favicon-path.patch b/net/webui-aria2/patches/0001-fix-favicon-path.patch
new file mode 100644
index 0000000000..2fb174971d
--- /dev/null
+++ b/net/webui-aria2/patches/0001-fix-favicon-path.patch
@@ -0,0 +1,11 @@
+--- a/docs/index.html
++++ b/docs/index.html
+@@ -3,7 +3,7 @@
+ 
+ <!-- {{{ head -->
+ <head>
+-  <link rel="icon" href="../favicon.ico" />
++  <link rel="icon" href="favicon.ico" />
+ 
+   <meta charset="utf-8">
+   <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">

From 9080b88e69b2efe4716d2cf474f7e2d00db6b301 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Sat, 14 Mar 2026 22:46:06 +0800
Subject: [PATCH 42/56] openvpn: delete old config after migrated

---
 net/openvpn/files/etc/uci-defaults/60_openvpn_migrate.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/openvpn/files/etc/uci-defaults/60_openvpn_migrate.sh b/net/openvpn/files/etc/uci-defaults/60_openvpn_migrate.sh
index b33ee2918b..cffff61b72 100644
--- a/net/openvpn/files/etc/uci-defaults/60_openvpn_migrate.sh
+++ b/net/openvpn/files/etc/uci-defaults/60_openvpn_migrate.sh
@@ -52,4 +52,6 @@ in_section {
 }
 ' "$OPENVPN_PKG" >> "$NETWORK_PKG"
 
-exit 0
\ No newline at end of file
+mv "$OPENVPN_PKG" "${OPENVPN_PKG}_migrated"
+
+exit 0

From 783e48a01bbb8146c4983fdd115743575ad63b06 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Fri, 27 Mar 2026 01:06:47 +0800
Subject: [PATCH 43/56] Revert "openvpn: disable compression in builds"

---
 net/openvpn/Config-mbedtls.in | 2 +-
 net/openvpn/Config-openssl.in | 4 ++--
 net/openvpn/Config-wolfssl.in | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/openvpn/Config-mbedtls.in b/net/openvpn/Config-mbedtls.in
index 69f9670a8f..07f0dbf84f 100644
--- a/net/openvpn/Config-mbedtls.in
+++ b/net/openvpn/Config-mbedtls.in
@@ -6,7 +6,7 @@ config OPENVPN_mbedtls_ENABLE_LZO
 
 config OPENVPN_mbedtls_ENABLE_LZ4
 	bool "Enable LZ4 compression support"
-	default n
+	default y
 
 config OPENVPN_mbedtls_ENABLE_MANAGEMENT
 	bool "Enable management server support"
diff --git a/net/openvpn/Config-openssl.in b/net/openvpn/Config-openssl.in
index 0ad3a69bca..dfd7a9e665 100644
--- a/net/openvpn/Config-openssl.in
+++ b/net/openvpn/Config-openssl.in
@@ -2,11 +2,11 @@ if PACKAGE_openvpn-openssl
 
 config OPENVPN_openssl_ENABLE_LZO
 	bool "Enable LZO compression support"
-	default n
+	default y
 
 config OPENVPN_openssl_ENABLE_LZ4
 	bool "Enable LZ4 compression support"
-	default n
+	default y
 
 config OPENVPN_openssl_ENABLE_X509_ALT_USERNAME
 	bool "Enable the --x509-username-field feature"
diff --git a/net/openvpn/Config-wolfssl.in b/net/openvpn/Config-wolfssl.in
index bad8e40a24..319b42d7bc 100644
--- a/net/openvpn/Config-wolfssl.in
+++ b/net/openvpn/Config-wolfssl.in
@@ -11,7 +11,7 @@ config OPENVPN_wolfssl_ENABLE_LZO
 
 config OPENVPN_wolfssl_ENABLE_LZ4
 	bool "Enable LZ4 compression support"
-	default n
+	default y
 
 config OPENVPN_wolfssl_ENABLE_X509_ALT_USERNAME
 	bool "Enable the --x509-username-field feature"

From 1fbbb4b6a59713274ca213c6b060682ae60ec1ad Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Fri, 27 Mar 2026 07:15:39 +0800
Subject: [PATCH 44/56] Revert "python-pysocks: remove outdated and not
 maintained package"

---
 lang/python/python-pysocks/Makefile | 45 +++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 lang/python/python-pysocks/Makefile

diff --git a/lang/python/python-pysocks/Makefile b/lang/python/python-pysocks/Makefile
new file mode 100644
index 0000000000..cf3e05bb21
--- /dev/null
+++ b/lang/python/python-pysocks/Makefile
@@ -0,0 +1,45 @@
+#
+# Copyright (C) 2021 CZ.NIC, z. s. p. o. (https://www.nic.cz/)
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=python-pysocks
+PKG_VERSION:=1.7.1
+PKG_RELEASE:=1
+
+PYPI_NAME:=PySocks
+PKG_HASH:=3f8804571ebe159c380ac6de37643bb4685970655d3bba243530d6558b799aa0
+
+PKG_MAINTAINER:=Jan Pavlinec <jan.pavlinec1@gmail.com>
+PKG_LICENSE:=MIT
+PKG_LICENSE_FILES:=LICENSE
+
+include ../pypi.mk
+include $(INCLUDE_DIR)/package.mk
+include ../python3-package.mk
+
+define Package/python3-pysocks
+  SUBMENU:=Python
+  SECTION:=lang
+  CATEGORY:=Languages
+  TITLE:=Python SOCKS client module
+  URL:=https://github.com/Anorov/PySocks
+  DEPENDS:= \
+	+python3-light \
+	+python3-logging \
+	+python3-openssl \
+	+python3-urllib
+endef
+
+define Package/python3-pysocks/description
+  PySocks lets you send traffic through SOCKS proxy servers.
+  It is a modern fork of SocksiPy with bug fixes and extra features.
+endef
+
+$(eval $(call Py3Package,python3-pysocks))
+$(eval $(call BuildPackage,python3-pysocks))
+$(eval $(call BuildPackage,python3-pysocks-src))

From 9543f4ae8c5d5576eda7e9c3b3d81859a523c657 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Fri, 27 Mar 2026 07:17:16 +0800
Subject: [PATCH 45/56] Revert "python-unidecode: drop unmaintained package"

---
 lang/python/python-unidecode/Makefile | 40 +++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 lang/python/python-unidecode/Makefile

diff --git a/lang/python/python-unidecode/Makefile b/lang/python/python-unidecode/Makefile
new file mode 100644
index 0000000000..424f361a15
--- /dev/null
+++ b/lang/python/python-unidecode/Makefile
@@ -0,0 +1,40 @@
+#
+# Copyright (C) 2019 CZ.NIC, z. s. p. o. (https://www.nic.cz/)
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=python-unidecode
+PKG_VERSION:=1.3.6
+PKG_RELEASE:=1
+
+PYPI_NAME:=Unidecode
+PKG_HASH:=fed09cf0be8cf415b391642c2a5addfc72194407caee4f98719e40ec2a72b830
+
+PKG_MAINTAINER:=Josef Schlehofer <pepe.schlehofer@gmail.com>
+PKG_LICENSE:=GPL-2.0-or-later
+PKG_LICENSE_FILES:=LICENSE
+
+include ../pypi.mk
+include $(INCLUDE_DIR)/package.mk
+include ../python3-package.mk
+
+define Package/python3-unidecode
+  SECTION:=lang
+  CATEGORY:=Languages
+  SUBMENU:=Python
+  TITLE:=ASCII transliterations of Unicode text
+  URL:=https://github.com/avian2/unidecode
+  DEPENDS:=+python3-light
+endef
+
+define Package/python-unidecode/description
+  Unidecode, lossy ASCII transliterations of Unicode text
+endef
+
+$(eval $(call Py3Package,python3-unidecode))
+$(eval $(call BuildPackage,python3-unidecode))
+$(eval $(call BuildPackage,python3-unidecode-src))

From b6ddef0952ca2d4c4f5230c7093cada7806c914e Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Wed, 29 Apr 2026 15:10:57 +0800
Subject: [PATCH 46/56] uwsgi: disable libcap

---
 net/uwsgi/Makefile                         |  2 +-
 net/uwsgi/patches/200-disable-libcap.patch | 13 +++++++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)
 create mode 100644 net/uwsgi/patches/200-disable-libcap.patch

diff --git a/net/uwsgi/Makefile b/net/uwsgi/Makefile
index ad03af9eab..ee84cba7f0 100644
--- a/net/uwsgi/Makefile
+++ b/net/uwsgi/Makefile
@@ -35,7 +35,7 @@ define Package/uwsgi
   SUBMENU:=Web Servers/Proxies
   TITLE:=The uWSGI server
   URL:=https://uwsgi-docs.readthedocs.io/en/latest/
-  DEPENDS:=+libpcre2 +libcap +libuuid
+  DEPENDS:=+libpcre2 +libuuid
 endef
 
 define Package/uwsgi-logfile-plugin
diff --git a/net/uwsgi/patches/200-disable-libcap.patch b/net/uwsgi/patches/200-disable-libcap.patch
new file mode 100644
index 0000000000..c30ce468f9
--- /dev/null
+++ b/net/uwsgi/patches/200-disable-libcap.patch
@@ -0,0 +1,13 @@
+diff --git a/uwsgiconfig.py b/uwsgiconfig.py
+index 14b4635..e562b50 100644
+--- a/uwsgiconfig.py
++++ b/uwsgiconfig.py
+@@ -1122,7 +1122,7 @@ class uConf(object):
+                 report['routing'] = True
+ 
+ 
+-        if self.has_include('sys/capability.h') and uwsgi_os == 'Linux':
++        if False and uwsgi_os == 'Linux':
+             self.cflags.append("-DUWSGI_CAP")
+             self.libs.append('-lcap')
+             report['capabilities'] = True

From ede1660f5665aa7be413860ad3f753bf93e8c2e9 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Tue, 19 May 2026 07:16:41 +0800
Subject: [PATCH 47/56] tailscale: update to latest

---
 net/tailscale/Makefile | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/net/tailscale/Makefile b/net/tailscale/Makefile
index ad60182e45..023932c9d5 100644
--- a/net/tailscale/Makefile
+++ b/net/tailscale/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=tailscale
-PKG_VERSION:=1.98.3
-PKG_RELEASE:=1
+PKG_VERSION:=1.98.5
+PKG_RELEASE:=20260606
 
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://codeload.github.com/tailscale/tailscale/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=9283ddbbf0a21ad37c725e09ac302aa96b37f00ca4b4142c00519cf983de0aa1
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_RELEASE).tar.gz
+PKG_SOURCE_URL:=https://codeload.github.com/ptpt52/tailscale/tar.gz/$(PKG_RELEASE)?
+PKG_HASH:=dd86accd36a174793264ab9ea6f615069d62d3a7b78ed12db8c4aaddfe9ee6d9
 
 PKG_MAINTAINER:=Zephyr Lykos <self@mochaa.ws>, \
 		Sandro Jäckel <sandro.jaeckel@gmail.com>
@@ -21,13 +21,13 @@ PKG_LICENSE:=BSD-3-Clause
 PKG_LICENSE_FILES:=LICENSE
 PKG_CPE_ID:=cpe:/a:tailscale:tailscale
 
-PKG_BUILD_DIR:=$(BUILD_DIR)/tailscale-$(PKG_VERSION)
+PKG_BUILD_DIR:=$(BUILD_DIR)/tailscale-$(PKG_RELEASE)
 PKG_BUILD_DEPENDS:=golang/host
 PKG_BUILD_PARALLEL:=1
 PKG_BUILD_FLAGS:=no-mips16
 
 GO_PKG:=tailscale.com/cmd/tailscaled
-GO_PKG_LDFLAGS:=-X 'tailscale.com/version.longStamp=$(PKG_VERSION)-$(PKG_RELEASE) (OpenWrt)'
+GO_PKG_LDFLAGS:=-X 'tailscale.com/version.longStamp=$(PKG_VERSION)-$(PKG_RELEASE) (X-WRT)'
 GO_PKG_LDFLAGS_X:=tailscale.com/version.shortStamp=$(PKG_VERSION)
 GO_PKG_TAGS:=ts_include_cli,ts_omit_aws,ts_omit_bird,ts_omit_completion,ts_omit_kube,ts_omit_systray,ts_omit_taildrop,ts_omit_tap,ts_omit_tpm
 

From eed9eae7a81f57995bc6a992f5179bd33eac7a01 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Tue, 26 May 2026 08:50:30 +0800
Subject: [PATCH 48/56] Revert "redsocks: remove package"

---
 net/redsocks/Makefile                         |  57 +++++++++
 net/redsocks/files/redsocks.conf              | 108 ++++++++++++++++++
 net/redsocks/files/redsocks.init              |  36 ++++++
 .../0006-fix_default_config_location.patch    |  17 +++
 ..._use_cc_dumpmachine_instead_of_uname.patch |  34 ++++++
 5 files changed, 252 insertions(+)
 create mode 100644 net/redsocks/Makefile
 create mode 100644 net/redsocks/files/redsocks.conf
 create mode 100644 net/redsocks/files/redsocks.init
 create mode 100644 net/redsocks/patches/0006-fix_default_config_location.patch
 create mode 100644 net/redsocks/patches/100_use_cc_dumpmachine_instead_of_uname.patch

diff --git a/net/redsocks/Makefile b/net/redsocks/Makefile
new file mode 100644
index 0000000000..495477ce2b
--- /dev/null
+++ b/net/redsocks/Makefile
@@ -0,0 +1,57 @@
+#
+# Copyright (C) 2014-2015 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=redsocks
+PKG_VERSION:=0.5
+PKG_RELEASE:=2
+
+PKG_SOURCE:=$(PKG_NAME)-release-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://codeload.github.com/darkk/redsocks/tar.gz/release-$(PKG_VERSION)?
+PKG_HASH:=bbeb531d7f1986d7102f1bd6733dacce41d3f3ba7d604f1aab61c63e0ba2ee62
+PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-release-$(PKG_VERSION)
+
+PKG_MAINTAINER:=Johannes Morgenroth <jm@m-network.de>
+PKG_LICENSE:=Apache-2.0
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/redsocks
+  SECTION:=net
+  CATEGORY:=Network
+  DEPENDS:=+libevent2-core
+  TITLE:=Redirect any TCP connection to a SOCKS or HTTPS proxy server
+endef
+
+define Package/redsocks/conffiles
+/etc/redsocks.conf
+endef
+
+define Package/redsocks/description
+ Redsocks is a daemon running on the local system, that will transparently
+ tunnel any TCP connection via a remote SOCKS4, SOCKS5 or HTTP proxy server. It
+ uses the system firewall's redirection facility to intercept TCP connections,
+ thus the redirection is system-wide, with fine-grained control, and does
+ not depend on LD_PRELOAD libraries.
+
+ Redsocks supports tunneling TCP connections and UDP packets. It has
+ authentication support for both, SOCKS and HTTP proxies.
+
+ Also included is a small DNS server returning answers with the "truncated" flag
+ set for any UDP query, forcing the resolver to use TCP.
+endef
+
+define Package/redsocks/install
+	$(INSTALL_DIR) $(1)/usr/sbin/
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/redsocks $(1)/usr/sbin/
+	$(INSTALL_DIR) $(1)/etc/init.d/
+	$(INSTALL_BIN) files/redsocks.init $(1)/etc/init.d/redsocks
+	$(INSTALL_CONF) files/redsocks.conf $(1)/etc/
+endef
+
+$(eval $(call BuildPackage,redsocks))
diff --git a/net/redsocks/files/redsocks.conf b/net/redsocks/files/redsocks.conf
new file mode 100644
index 0000000000..64307c715d
--- /dev/null
+++ b/net/redsocks/files/redsocks.conf
@@ -0,0 +1,108 @@
+base {
+	// debug: connection progress & client list on SIGUSR1
+	log_debug = off;
+
+	// info: start and end of client session
+	log_info = on;
+
+	/* possible `log' values are:
+	 *   stderr
+	 *   "file:/path/to/file"
+	 *   syslog:FACILITY  facility is any of "daemon", "local0"..."local7"
+	 */
+	// log = stderr;
+	// log = "file:/path/to/file";
+	log = "syslog:local7";
+
+	// detach from console
+	daemon = on;
+
+	/* Change uid, gid and root directory, these options require root
+	 * privilegies on startup.
+	 * Note, your chroot may requre /etc/localtime if you write log to syslog.
+	 * Log is opened before chroot & uid changing.
+	 */
+	// user = nobody;
+	// group = nobody;
+	// chroot = "/var/chroot";
+
+	/* possible `redirector' values are:
+	 *   iptables   - for Linux
+	 *   ipf        - for FreeBSD
+	 *   pf         - for OpenBSD
+	 *   generic    - some generic redirector that MAY work
+	 */
+	redirector = iptables;
+}
+
+redsocks {
+	/* `local_ip' defaults to 127.0.0.1 for security reasons,
+	 * use 0.0.0.0 if you want to listen on every interface.
+	 * `local_*' are used as port to redirect to.
+	 */
+	local_ip = 127.0.0.1;
+	local_port = 12345;
+
+	// listen() queue length. Default value is SOMAXCONN and it should be
+	// good enough for most of us.
+	// listenq = 128; // SOMAXCONN equals 128 on my Linux box.
+
+	// `max_accept_backoff` is a delay to retry `accept()` after accept
+	// failure (e.g. due to lack of file descriptors). It's measured in
+	// milliseconds and maximal value is 65535. `min_accept_backoff` is
+	// used as initial backoff value and as a damper for `accept() after
+	// close()` logic.
+	// min_accept_backoff = 100;
+	// max_accept_backoff = 60000;
+
+	// `ip' and `port' are IP and tcp-port of proxy-server
+	// You can also use hostname instead of IP, only one (random)
+	// address of multihomed host will be used.
+	ip = example.org;
+	port = 1080;
+
+
+	// known types: socks4, socks5, http-connect, http-relay
+	type = socks5;
+
+	// login = "foobar";
+	// password = "baz";
+}
+
+redudp {
+	// `local_ip' should not be 0.0.0.0 as it's also used for outgoing
+	// packets that are sent as replies - and it should be fixed
+	// if we want NAT to work properly.
+	local_ip = 127.0.0.1;
+	local_port = 10053;
+
+	// `ip' and `port' of socks5 proxy server.
+	ip = 10.0.0.1;
+	port = 1080;
+	login = username;
+	password = pazzw0rd;
+
+	// redsocks knows about two options while redirecting UDP packets at
+	// linux: TPROXY and REDIRECT.  TPROXY requires more complex routing
+	// configuration and fresh kernel (>= 2.6.37 according to squid
+	// developers[1]) but has hack-free way to get original destination
+	// address, REDIRECT is easier to configure, but requires `dest_ip` and
+	// `dest_port` to be set, limiting packet redirection to single
+	// destination.
+	// [1] http://wiki.squid-cache.org/Features/Tproxy4
+	dest_ip = 8.8.8.8;
+	dest_port = 53;
+
+	udp_timeout = 30;
+	udp_timeout_stream = 180;
+}
+
+dnstc {
+	// fake and really dumb DNS server that returns "truncated answer" to
+	// every query via UDP, RFC-compliant resolver should repeat same query
+	// via TCP in this case.
+	local_ip = 127.0.0.1;
+	local_port = 5300;
+}
+
+// you can add more `redsocks' and `redudp' sections if you need.
diff --git a/net/redsocks/files/redsocks.init b/net/redsocks/files/redsocks.init
new file mode 100644
index 0000000000..56c9de3273
--- /dev/null
+++ b/net/redsocks/files/redsocks.init
@@ -0,0 +1,36 @@
+#!/bin/sh /etc/rc.common
+# Copyright (C) 2007 OpenWrt.org
+
+START=90
+
+# check if configuration exists
+[ -e "/etc/redsocks.conf" ] || exit 0
+
+start() {
+	if [ -e "/var/run/redsocks.pid" ]; then
+		echo "redsocks is already running"
+		exit 0
+	fi
+
+	/bin/echo -n "running redsocks ..."
+	
+	# startup the safety-wrapper for the daemon
+	/usr/sbin/redsocks -p /var/run/redsocks.pid
+	
+	/bin/echo " done"
+}
+
+stop() {
+	if [ ! -e "/var/run/redsocks.pid" ]; then
+		echo "redsocks is not running"
+		exit 0
+	fi
+
+	/bin/echo -n "stopping redsocks ..."
+	
+	# kill the process
+	/bin/kill $(cat /var/run/redsocks.pid)
+	rm /var/run/redsocks.pid
+	
+	echo " done"
+}
diff --git a/net/redsocks/patches/0006-fix_default_config_location.patch b/net/redsocks/patches/0006-fix_default_config_location.patch
new file mode 100644
index 0000000000..cb0bdf9363
--- /dev/null
+++ b/net/redsocks/patches/0006-fix_default_config_location.patch
@@ -0,0 +1,17 @@
+Description: change the default config file location
+ redsocks by default looks for ./redsocks.conf. Change this to
+ /etc/redsocks.conf for a more deterministic behaviour.
+Author: Apollon Oikonomopoulos <apoikos@gmail.com>
+Forwared: no
+Last-Update: 2013-04-23
+--- a/main.c
++++ b/main.c
+@@ -45,7 +45,7 @@ app_subsys *subsystems[] = {
+ 	&dnstc_subsys,
+ };
+ 
+-static const char *confname = "redsocks.conf";
++static const char *confname = "/etc/redsocks.conf";
+ static const char *pidfile = NULL;
+ 
+ static void terminate(int sig, short what, void *_arg)
diff --git a/net/redsocks/patches/100_use_cc_dumpmachine_instead_of_uname.patch b/net/redsocks/patches/100_use_cc_dumpmachine_instead_of_uname.patch
new file mode 100644
index 0000000000..a56ca128e8
--- /dev/null
+++ b/net/redsocks/patches/100_use_cc_dumpmachine_instead_of_uname.patch
@@ -0,0 +1,34 @@
+From https://github.com/darkk/redsocks/pull/105
+
+commit d5cabecb6a8369fb2bd883b43205035dd87187a5
+Author: a7ypically <a7ypically@gmail.com>
+Date:   Sat Jun 3 21:33:20 2017 +0300
+
+    Update Makefile
+
+--- a/Makefile
++++ b/Makefile
+@@ -26,11 +26,11 @@ tags: *.c *.h
+ 	ctags -R
+ 
+ $(CONF):
+-	@case `uname` in \
+-	Linux*) \
++	@case `$(CC) -dumpmachine` in \
++	*linux*) \
+ 		echo "#define USE_IPTABLES" >$(CONF) \
+ 		;; \
+-	OpenBSD) \
++	*openbsd*) \
+ 		echo "#define USE_PF" >$(CONF) \
+ 		;; \
+ 	*) \
+@@ -66,7 +66,7 @@ gen/.build:
+ base.c: $(CONF)
+ 
+ $(DEPS): $(SRCS)
+-	gcc -MM $(SRCS) 2>/dev/null >$(DEPS) || \
++	$(CC) -MM $(SRCS) 2>/dev/null >$(DEPS) || \
+ 	( \
+ 		for I in $(wildcard *.h); do \
+ 			export $${I//[-.]/_}_DEPS="`sed '/^\#[ \t]*include \?"\(.*\)".*/!d;s//\1/' $$I`"; \

From 3ec6d48c0b7d167d65aa85f017b41a4529df0c79 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Sat, 15 May 2021 07:05:17 +0800
Subject: [PATCH 49/56] net/redsocks: use procd

---
 net/redsocks/files/redsocks.conf |  4 ++--
 net/redsocks/files/redsocks.init | 40 +++++++++-----------------------
 2 files changed, 13 insertions(+), 31 deletions(-)

diff --git a/net/redsocks/files/redsocks.conf b/net/redsocks/files/redsocks.conf
index 64307c715d..603bbb07f3 100644
--- a/net/redsocks/files/redsocks.conf
+++ b/net/redsocks/files/redsocks.conf
@@ -12,10 +12,10 @@ base {
 	 */
 	// log = stderr;
 	// log = "file:/path/to/file";
-	log = "syslog:local7";
+	log = "stderr";
 
 	// detach from console
-	daemon = on;
+	daemon = off;
 
 	/* Change uid, gid and root directory, these options require root
 	 * privilegies on startup.
diff --git a/net/redsocks/files/redsocks.init b/net/redsocks/files/redsocks.init
index 56c9de3273..9e5a077f96 100644
--- a/net/redsocks/files/redsocks.init
+++ b/net/redsocks/files/redsocks.init
@@ -1,36 +1,18 @@
 #!/bin/sh /etc/rc.common
 # Copyright (C) 2007 OpenWrt.org
+# Copyright (C) 2021 X-WRT
 
 START=90
+USE_PROCD=1
 
-# check if configuration exists
-[ -e "/etc/redsocks.conf" ] || exit 0
+CONF="/etc/redsocks.conf"
 
-start() {
-	if [ -e "/var/run/redsocks.pid" ]; then
-		echo "redsocks is already running"
-		exit 0
-	fi
-
-	/bin/echo -n "running redsocks ..."
-	
-	# startup the safety-wrapper for the daemon
-	/usr/sbin/redsocks -p /var/run/redsocks.pid
-	
-	/bin/echo " done"
-}
-
-stop() {
-	if [ ! -e "/var/run/redsocks.pid" ]; then
-		echo "redsocks is not running"
-		exit 0
-	fi
-
-	/bin/echo -n "stopping redsocks ..."
-	
-	# kill the process
-	/bin/kill $(cat /var/run/redsocks.pid)
-	rm /var/run/redsocks.pid
-	
-	echo " done"
+start_service() {
+	procd_open_instance
+	procd_set_param command /usr/sbin/redsocks -c "${CONF}"
+	procd_set_param stdout 1
+	procd_set_param stderr 1
+	procd_set_param file "${CONF}"
+	procd_set_param respawn 3600 1 0
+	procd_close_instance
 }

From f1f77f807bae41872bc645ad18916b20078141f3 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Tue, 9 Jun 2026 05:13:58 +0800
Subject: [PATCH 50/56] tailscale: default use iptables

---
 net/tailscale/files/tailscale.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/tailscale/files/tailscale.conf b/net/tailscale/files/tailscale.conf
index 0261582ac0..10e0316e8d 100644
--- a/net/tailscale/files/tailscale.conf
+++ b/net/tailscale/files/tailscale.conf
@@ -4,4 +4,4 @@ config settings 'settings'
 	option port '41641'
 	option state_file '/etc/tailscale/tailscaled.state'
 	# default to using nftables - change below to 'iptables' if still using iptables
-	option fw_mode 'nftables'
\ No newline at end of file
+	option fw_mode 'iptables'

From f8edc5c0005850516d4cdd167efaca2d8da5b038 Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Fri, 26 Aug 2022 05:34:04 +0800
Subject: [PATCH 51/56] miniupnpd: update to latest version

---
 net/miniupnpd/Makefile | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/net/miniupnpd/Makefile b/net/miniupnpd/Makefile
index 651fba1240..628652283d 100644
--- a/net/miniupnpd/Makefile
+++ b/net/miniupnpd/Makefile
@@ -8,12 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=miniupnpd
-PKG_VERSION:=2.3.9
-PKG_RELEASE:=3
+PKG_VERSION:=20260628
+PKG_RELEASE:=1
 
-PKG_SOURCE_URL:=https://github.com/miniupnp/miniupnp/releases/download/miniupnpd_$(subst .,_,$(PKG_VERSION))
+PKG_SOURCE_URL:=https://codeload.github.com/x-wrt/miniupnp/tar.gz/$(PKG_VERSION)?
+PKG_HASH:=9a3173b75b938473a5bb7eb20f20c981a76be52f4e00d16b813c9ca2391b1716
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_HASH:=66cb3c3d697ab2bb3a61d3c48628166d6ba328d7c2dbeb95898fdf2a3202af7b
+PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION)/miniupnpd
 
 PKG_MAINTAINER:=Alexandru Ardelean <ardeleanalex@gmail.com>
 PKG_LICENSE:=BSD-3-Clause
@@ -26,6 +27,9 @@ PKG_BUILD_PARALLEL:=1
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/version.mk
 
+TAR_OPTIONS+= --strip-components 1
+TAR_CMD=$(HOST_TAR) -C $(1)/.. $(TAR_OPTIONS)
+
 define Package/miniupnpd/Default
   SECTION:=net
   CATEGORY:=Network

From 202e23ab3fb3d9fdb0496f9c5c52cce1361255ca Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Thu, 21 Mar 2019 19:35:57 +0800
Subject: [PATCH 52/56] miniupnpd: compat with cone nat

---
 net/miniupnpd/files/firewall3.include | 5 +++--
 net/miniupnpd/files/upnpd.config      | 1 +
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/miniupnpd/files/firewall3.include b/net/miniupnpd/files/firewall3.include
index 4fd4839743..926e2c85ff 100644
--- a/net/miniupnpd/files/firewall3.include
+++ b/net/miniupnpd/files/firewall3.include
@@ -20,8 +20,9 @@ iptables_prepend_rule() {
 	local chain="$3"
 	local target="$4"
 
-	$iptables "$IPTARGS" -t "$table" -I "$chain" $($iptables "$IPTARGS" -t "$table" --line-numbers -nL "$chain" | \
-		sed -ne '$s/[^0-9].*//p') -j "$target"
+	NR=`$iptables "$IPTARGS" -t "$table" --line-numbers -nL "$chain"; $iptables "$IPTARGS" -t "$table" --line-numbers -nL "$chain" | grep ".*MASQUERADE.*udp.*random-fully.*"`
+	NR=`echo "$NR" | sed -ne '$s/[^0-9].*//p'`
+	$iptables "$IPTARGS" -t "$table" -I "$chain" $NR -j "$target"
 }
 
 ADDED=0
diff --git a/net/miniupnpd/files/upnpd.config b/net/miniupnpd/files/upnpd.config
index c4546e018f..03b54115ee 100644
--- a/net/miniupnpd/files/upnpd.config
+++ b/net/miniupnpd/files/upnpd.config
@@ -2,6 +2,7 @@ config upnpd config
 	option enabled		0
 	option enable_natpmp	1
 	option enable_upnp	1
+	option ext_allow_private_ipv4 1
 	option secure_mode	1
 	option log_output	0
 	option download		1024

From 9bdfa18e18db81e335692f6d2d6314f865d013ab Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Sat, 12 Mar 2022 14:37:43 +0800
Subject: [PATCH 53/56] miniupnpd: core scripts

---
 net/miniupnpd/Makefile                        |  6 +-
 net/miniupnpd/files/core.sh                   | 85 +++++++++++++++++++
 .../files/miniupnpd.defaults.iptables         |  8 +-
 net/miniupnpd/files/miniupnpd.init            | 26 +-----
 4 files changed, 94 insertions(+), 31 deletions(-)
 create mode 100644 net/miniupnpd/files/core.sh

diff --git a/net/miniupnpd/Makefile b/net/miniupnpd/Makefile
index 628652283d..9ad558f151 100644
--- a/net/miniupnpd/Makefile
+++ b/net/miniupnpd/Makefile
@@ -106,6 +106,10 @@ define Package/miniupnpd/install/Default
 	$(INSTALL_BIN) ./files/miniupnpd.init $(1)/etc/init.d/miniupnpd
 	$(INSTALL_CONF) ./files/upnpd.config $(1)/etc/config/upnpd
 	$(INSTALL_DATA) ./files/miniupnpd.hotplug $(1)/etc/hotplug.d/iface/50-miniupnpd
+	$(INSTALL_DIR) $(1)/usr/share/miniupnpd
+	$(INSTALL_DATA) ./files/core.sh $(1)/usr/share/miniupnpd/core.sh
+	$(INSTALL_DIR) $(1)/etc/uci-defaults
+	$(INSTALL_BIN) ./files/miniupnpd.defaults.iptables $(1)/etc/uci-defaults/99-miniupnpd-nft
 endef
 
 define Package/miniupnpd-iptables/install
@@ -118,8 +122,6 @@ endef
 
 define Package/miniupnpd-nftables/install
 	$(call Package/miniupnpd/install/Default,$1)
-	$(INSTALL_DIR) $(1)/usr/share/nftables.d
-	$(CP) ./files/nftables.d/* $(1)/usr/share/nftables.d/
 endef
 
 $(eval $(call BuildPackage,miniupnpd-iptables))
diff --git a/net/miniupnpd/files/core.sh b/net/miniupnpd/files/core.sh
new file mode 100644
index 0000000000..298d0e2833
--- /dev/null
+++ b/net/miniupnpd/files/core.sh
@@ -0,0 +1,85 @@
+#!/bin/sh
+
+#addrule ifname iaddr iport eport proto
+#delrule eport proto
+
+CMDLINE="sh $0 $@"
+cmd=$1
+
+test -e /usr/share/miniupnpd/nft.include || \
+ln -s /tmp/run/miniupnpd.nft /usr/share/miniupnpd/nft.include && \
+touch /tmp/run/miniupnpd.nft
+
+case $cmd in
+	addrule)
+	ifname=$2
+	iaddr=$3
+	iport=$4
+	eport=$5
+	proto=$6
+	nft -a list chain inet fw4 dstnat | grep -o "miniupnpd-$eport-$proto-dstnat.*" | while read _ _ _ handle; do nft delete rule inet fw4 dstnat handle $handle; done
+	line="nft insert rule inet fw4 dstnat iifname $ifname meta nfproto ipv4 $proto dport $eport counter dnat to $iaddr:$iport comment miniupnpd-$eport-$proto-dstnat"
+	$line;
+	if [ "$proto" = "udp" ]; then
+		grep "miniupnpd-$eport-$proto-dstnat" /tmp/run/miniupnpd.nft | while read _ _ _ _ _iaddr _iport _eport _proto _; do
+			sh /usr/share/natcapd/natcapd.cone_nat_unused.sh delrule $_iaddr $_iport $_eport
+		done
+		sh /usr/share/natcapd/natcapd.cone_nat_unused.sh addrule $iaddr $iport $eport
+	fi
+
+	nft -a list chain inet fw4 forward_wan | grep -o "miniupnpd-$eport-$proto-forward_wan.*" | while read _ _ _ handle; do nft delete rule inet fw4 forward_wan handle $handle; done
+	line="nft insert rule inet fw4 forward_wan ip daddr $iaddr $proto dport $iport counter accept comment miniupnpd-$eport-$proto-forward_wan"
+	$line;
+
+	nft -a list chain inet fw4 srcnat | grep -o "miniupnpd-$eport-$proto-srcnat.*" | while read _ _ _ handle; do nft delete rule inet fw4 srcnat handle $handle; done
+	line="nft insert rule inet fw4 srcnat ip saddr $iaddr $proto sport $iport counter masquerade to :$eport comment miniupnpd-$eport-$proto-srcnat"
+	$line;
+
+	sed -i "s%.*miniupnpd-$eport-$proto-dstnat%$CMDLINE #miniupnpd-$eport-$proto-dstnat%" /tmp/run/miniupnpd.nft
+	grep -q "miniupnpd-$eport-$proto-dstnat" /tmp/run/miniupnpd.nft || echo "$CMDLINE #miniupnpd-$eport-$proto-dstnat" >>/tmp/run/miniupnpd.nft
+	;;
+
+	delrule)
+	eport=$2
+	proto=$3
+	if [ "$proto" = "udp" ]; then
+		grep "miniupnpd-$eport-$proto-dstnat" /tmp/run/miniupnpd.nft | while read _ _ _ _ _iaddr _iport _eport _proto _; do
+			sh /usr/share/natcapd/natcapd.cone_nat_unused.sh delrule $_iaddr $_iport $_eport
+		done
+	fi
+	nft -a list chain inet fw4 dstnat | grep -o "miniupnpd-$eport-$proto-dstnat.*" | while read _ _ _ handle; do nft delete rule inet fw4 dstnat handle $handle; done
+
+	nft -a list chain inet fw4 forward_wan | grep -o "miniupnpd-$eport-$proto-forward_wan.*" | while read _ _ _ handle; do nft delete rule inet fw4 forward_wan handle $handle; done
+
+	nft -a list chain inet fw4 srcnat | grep -o "miniupnpd-$eport-$proto-srcnat.*" | while read _ _ _ handle; do nft delete rule inet fw4 srcnat handle $handle; done
+
+	sed -i "/.*miniupnpd-$eport-$proto-dstnat/d" /tmp/run/miniupnpd.nft
+	;;
+
+	stop)
+	grep "miniupnpd-.*-udp-dstnat" /tmp/run/miniupnpd.nft | while read _ _ _ _ _iaddr _iport _eport _proto _; do
+		sh /usr/share/natcapd/natcapd.cone_nat_unused.sh delrule $_iaddr $_iport $_eport
+	done
+	nft -a list chain inet fw4 dstnat | grep -o "miniupnpd-.*-dstnat.*" | while read _ _ _ handle; do nft delete rule inet fw4 dstnat handle $handle; done
+	nft -a list chain inet fw4 forward_wan | grep -o "miniupnpd-.*-forward_wan.*" | while read _ _ _ handle; do nft delete rule inet fw4 forward_wan handle $handle; done
+	nft -a list chain inet fw4 srcnat | grep -o "miniupnpd-.*-srcnat.*" | while read _ _ _ handle; do nft delete rule inet fw4 srcnat handle $handle; done
+	echo -n >/tmp/run/miniupnpd.nft
+	;;
+
+	delfwindex)
+	handle=$2
+	## iifname "pppoe-wan" meta nfproto ipv4 udp dport 1236 counter packets 0 bytes 0 dnat ip to 192.168.16.101:1234 comment "miniupnpd-1236-udp-dstnat" # handle 4625
+	line=$(nft -a list chain inet fw4 dstnat | grep ".* # handle $handle$")
+	proto=${line/* meta nfproto ipv4 /}
+	eport=${proto/* dport /}
+	eport=${eport/ counter */}
+	proto=${proto/ dport */}
+	lease=$(uci get upnpd.config.upnp_lease_file)
+	test -f "$lease" && {
+		PROTO=$(echo -n $proto | tr a-z A-Z)
+		sed -i "/$PROTO:$eport:/d" "$lease"
+	}
+	sh $0 delrule $eport $proto
+	/etc/init.d/miniupnpd restart
+	;;
+esac
diff --git a/net/miniupnpd/files/miniupnpd.defaults.iptables b/net/miniupnpd/files/miniupnpd.defaults.iptables
index 7271389d3b..41defc6c6f 100644
--- a/net/miniupnpd/files/miniupnpd.defaults.iptables
+++ b/net/miniupnpd/files/miniupnpd.defaults.iptables
@@ -2,12 +2,10 @@
 
 uci -q batch <<-EOT
 	delete firewall.miniupnpd
-	set firewall.miniupnpd=include
-	set firewall.miniupnpd.type=script
-	set firewall.miniupnpd.path=/usr/share/miniupnpd/firewall.include
-	set firewall.miniupnpd.family=any
-	set firewall.miniupnpd.reload=1
 	commit firewall
 EOT
 
+grep -q "^sh /usr/share/miniupnpd/nft.include" /etc/firewall.include || \
+echo "sh /usr/share/miniupnpd/nft.include" >>/etc/firewall.include
+
 exit 0
diff --git a/net/miniupnpd/files/miniupnpd.init b/net/miniupnpd/files/miniupnpd.init
index 861bec0d31..bd7cfa05a4 100644
--- a/net/miniupnpd/files/miniupnpd.init
+++ b/net/miniupnpd/files/miniupnpd.init
@@ -171,25 +171,12 @@ upnpd() {
 
 		config_foreach conf_rule_add perm_rule
 
-		if [ "$FW" = "fw4" ]; then
-			#When using nftables configure miniupnpd to use its own table and chains
-			echo "upnp_table_name=fw4"
-			echo "upnp_nat_table_name=fw4"
-			echo "upnp_forward_chain=upnp_forward"
-			echo "upnp_nat_chain=upnp_prerouting"
-			echo "upnp_nat_postrouting_chain=upnp_postrouting"
-		fi
-
 		} > "$tmpconf"
 	fi
 
 	if [ -n "$ifname" ]; then
 		# start firewall
-		if [ "$FW" = "fw4" ]; then
-			nft -s -t -n list chain inet fw4 upnp_forward >/dev/null 2>&1 || fw4 reload
-		else
-			iptables -L MINIUPNPD >/dev/null 2>&1 || fw3 reload
-		fi
+		:
 	else
 		logger -t "upnp daemon" "external interface not found, not starting"
 	fi
@@ -203,16 +190,7 @@ upnpd() {
 }
 
 stop_service() {
-	if [ "$FW" = "fw3" ]; then
-		iptables -t nat -F MINIUPNPD 2>/dev/null
-		iptables -t nat -F MINIUPNPD-POSTROUTING 2>/dev/null
-		iptables -t filter -F MINIUPNPD 2>/dev/null
-		[ -x /usr/sbin/ip6tables ] && ip6tables -t filter -F MINIUPNPD 2>/dev/null
-	else
-		nft flush chain inet fw4 upnp_forward 2>/dev/null
-		nft flush chain inet fw4 upnp_prerouting 2>/dev/null
-		nft flush chain inet fw4 upnp_postrouting 2>/dev/null
-	fi
+	sh /usr/share/miniupnpd/core.sh stop
 }
 
 start_service() {

From 032c9d84cb2ba19987bfd9aacfb750daaa7aba9e Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Thu, 30 Sep 2021 10:07:43 +0800
Subject: [PATCH 54/56] miniupnpd: change default config

disable_ipv6 by default
---
 net/miniupnpd/files/upnpd.config | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/miniupnpd/files/upnpd.config b/net/miniupnpd/files/upnpd.config
index 03b54115ee..6ffcc06183 100644
--- a/net/miniupnpd/files/upnpd.config
+++ b/net/miniupnpd/files/upnpd.config
@@ -14,6 +14,7 @@ config upnpd config
 	option upnp_lease_file	/var/run/miniupnpd.leases
 	option upnp_lease_file6	/var/run/miniupnpd.leases6
 	option igdv1		1
+	option ipv6_disable 1
 
 config perm_rule
 	option action		allow

From 39834eef2801eeb0c000139ec9545cf97626042a Mon Sep 17 00:00:00 2001
From: Chen Minqiang <ptpt52@gmail.com>
Date: Tue, 30 Jun 2026 17:18:17 +0800
Subject: [PATCH 55/56] openvpn: improve netifd runtime and route handling

Rework the OpenVPN netifd integration so runtime-generated state
is owned and cleaned up consistently under /var/run.

Copy the user config and recursively referenced config files into
/var/run, then rewrite `config` directives to point at the copied
files. This allows the proto handler to safely filter controlled
directives across the full config set before launching OpenVPN.

Add the `defaultroute` and `metric` proto options. Detect client
configs, inject redirect-gateway handling when appropriate, pass
DEFAULTROUTE, IPV6 and METRIC to the hotplug script, and apply
route metrics to server host routes so multiple OpenVPN instances
can coexist without route conflicts.

Force netifd-managed lifecycle hooks from the command line, filter
duplicate user-provided hook and persistence directives, persist
daemon state in ubus data, and add explicit cleanup handling for
runtime files and server route deletion commands.

Also redirect hotplug stderr to syslog and add the BusyBox ash
bash-compat dependency required by that shell construct.

Signed-off-by: Chen Minqiang <ptpt52@gmail.com>
---
 net/openvpn/Makefile                          |   1 +
 net/openvpn/files/lib/netifd/proto/openvpn.sh | 250 ++++++++++++++----
 net/openvpn/files/usr/libexec/openvpn-hotplug | 187 ++++++++++---
 3 files changed, 338 insertions(+), 100 deletions(-)

diff --git a/net/openvpn/Makefile b/net/openvpn/Makefile
index 44ba64192b..c677064bb1 100644
--- a/net/openvpn/Makefile
+++ b/net/openvpn/Makefile
@@ -37,6 +37,7 @@ define Package/openvpn/Default
   SUBMENU:=VPN
   MENU:=1
   DEPENDS:=+kmod-tun \
+	   +@BUSYBOX_CONFIG_ASH_BASH_COMPAT \
 	   +libcap-ng \
 	   +OPENVPN_$(1)_ENABLE_LZO:liblzo \
 	   +OPENVPN_$(1)_ENABLE_LZ4:liblz4 \
diff --git a/net/openvpn/files/lib/netifd/proto/openvpn.sh b/net/openvpn/files/lib/netifd/proto/openvpn.sh
index 2cf5dd718e..956ad6e134 100755
--- a/net/openvpn/files/lib/netifd/proto/openvpn.sh
+++ b/net/openvpn/files/lib/netifd/proto/openvpn.sh
@@ -13,6 +13,9 @@
 	init_proto "$@"
 }
 
+CONF_DIR="/var/run"
+CONF_PREFIX="${CONF_DIR}/openvpn."
+
 # Helper to DRY up repeated option handling in init/setup
 option_builder() {
 	# option_builder <action:add|build> <LIST_VAR_NAME> <type>
@@ -92,6 +95,7 @@ option_builder() {
 # Not real config params used by openvpn - only by our proto handler
 PROTO_BOOLS='
 allow_deprecated
+defaultroute
 ipv6
 '
 
@@ -102,6 +106,10 @@ cert_password
 ovpnproto
 '
 
+PROTO_INTS='
+metric
+'
+
 proto_openvpn_init_config() {
 	available=1
 	no_device=1
@@ -116,6 +124,7 @@ proto_openvpn_init_config() {
 	# Add proto config options - netifd compares these for changes between interface events
 	option_builder add PROTO_BOOLS protobool
 	option_builder add PROTO_STRINGS string
+	option_builder add PROTO_INTS integer
 	option_builder add OPENVPN_BOOLS bool
 	option_builder add OPENVPN_UINTS uinteger
 	option_builder add OPENVPN_INTS integer
@@ -124,11 +133,88 @@ proto_openvpn_init_config() {
 	option_builder add OPENVPN_LIST list
 }
 
+# rewrite_config_line <dst> <old_path> <new_path>
+# Replace a `config <old_path>` line in <dst> with `config <new_path>`.
+# Handles absolute path, relative filename, no quotes / single quotes / double quotes,
+# and optional trailing whitespace.
+rewrite_config_line() {
+	local dst="$1"
+	local old="$2"
+	local new="$3"
+	local fname="${old##*/}"
+
+	# absolute path, three quote styles
+	# and relative filename, three quote styles
+	sed -i \
+		-e "s|^\([[:space:]]*config[[:space:]]\+\)${old}[[:space:]]*$|\1${new}|" \
+		-e "s|^\([[:space:]]*config[[:space:]]\+\)'${old}'[[:space:]]*$|\1${new}|" \
+		-e "s|^\([[:space:]]*config[[:space:]]\+\)\"${old}\"[[:space:]]*$|\1${new}|" \
+		-e "s|^\([[:space:]]*config[[:space:]]\+\)${fname}[[:space:]]*$|\1${new}|" \
+		-e "s|^\([[:space:]]*config[[:space:]]\+\)'${fname}'[[:space:]]*$|\1${new}|" \
+		-e "s|^\([[:space:]]*config[[:space:]]\+\)\"${fname}\"[[:space:]]*$|\1${new}|" \
+		"$dst"
+}
+
+# Recursively copy config files referenced by `config` directives.
+# Updates the `config` paths in the destination file to point to the copies.
+# Appends all copied files to the global CONFIG_FILES variable.
+#
+# Usage: copy_config_recursive <dst_file> <visited>
+#   dst_file: the already-copied config file to scan for `config` lines
+#   visited:  pipe-delimited list of source paths already processed (cycle guard)
+copy_config_recursive() {
+	local dst="$1"
+	local visited="$2"
+	local ref dst_ref fname
+
+	while IFS= read -r ref; do
+		# skip empty lines
+		[ -n "$ref" ] || continue
+		case "$ref" in
+			*"$CONF_PREFIX"*) continue ;;
+		esac
+
+		# expand relative path to absolute using cd_dir
+		case "$ref" in
+			/*) ;;
+			*) ref="$cd_dir/$ref" ;;
+		esac
+
+		# cycle guard
+		case "$visited" in
+			*"|$ref|"*) continue ;;
+		esac
+
+		[ -f "$ref" ] || continue
+
+		fname="${ref##*/}"
+		dst_ref="${CONF_PREFIX}${config}.user_${fname}"
+
+		cp "$ref" "$dst_ref" || {
+			logger -t "openvpn_$config(proto)" -p daemon.err "failed to copy config '$ref' to '$dst_ref'"
+			continue
+		}
+
+		# rewrite the `config` line in the parent file to point to the copy
+		rewrite_config_line "$dst" "$ref" "$dst_ref"
+
+		# accumulate file list
+		CONFIG_FILES="$CONFIG_FILES $dst_ref"
+
+		# recurse
+		copy_config_recursive "$dst_ref" "$visited|$ref|"
+
+	done <<EOF
+$(sed -n "/^[[:space:]]*config[[:space:]]/ { s/^[[:space:]]*config[[:space:]][[:space:]]*//; s/^['\"]//; s/[[:space:]]*['\"][[:space:]]*$//; s/[[:space:]]*$//; p; }" "$dst")
+EOF
+}
+
 proto_openvpn_setup() {
 	local config="$1"
-	local conf_file="/var/run/openvpn.$config.conf"
+	local conf_file="${CONF_PREFIX}$config.conf"
 	local exec_params cd_dir
 
+	mkdir -p "$CONF_DIR"
 	exec_params=
 
 	json_get_var dev_type dev_type
@@ -141,7 +227,7 @@ proto_openvpn_setup() {
 	cd_dir="${config_file%/*}"
 	[ "$cd_dir" = "$config_file" ] && cd_dir="/"
 	append exec_params "--cd $cd_dir"
-	append exec_params "--status /var/run/openvpn.$config.status"
+	append exec_params "--status ${CONF_PREFIX}$config.status"
 	append exec_params "--syslog openvpn_$config"
 	append exec_params "--tmp-dir /tmp"
 
@@ -160,73 +246,29 @@ proto_openvpn_setup() {
 
 	json_get_vars auth_user_pass askpass username password cert_password
 
-	mkdir -p /var/run
-	# combine into --askpass:
-	if [ -n "$cert_password" ]; then
-		cp_file="/var/run/openvpn.$config.pass"
-		umask 077
-		printf '%s\n' "${cert_password:-}" > "$cp_file"
-		umask 022
-		append exec_params "--askpass $cp_file"
-	elif [ -n "$askpass" ]; then
-		append exec_params "--askpass $askpass"
-	fi
-
-	# combine into --auth-user-pass:
-	if [ -n "$username" ] || [ -n "$password" ]; then
-		auth_file="/var/run/openvpn.$config.auth"
-		umask 077
-		printf '%s\n' "${username:-}" "${password:-}" > "$auth_file"
-		umask 022
-		append exec_params "--auth-user-pass $auth_file"
-	elif [ -n "$auth_user_pass" ]; then
-		append exec_params "--auth-user-pass $auth_user_pass"
-	fi
-
 	# Testing option
 	# ${tls_exit:+--tls-exit} \
 
 	# Check 'script_security' option
 	json_get_var script_security script_security
-	[ -z "$script_security" ] && script_security=3
+	[ -z "$script_security" ] && script_security=2
 
-	# Add default hotplug handling if 'script_security' option is equal '3'
-	if [ "$script_security" -eq '3' ]; then
-		local ipv6
+	# Add default hotplug handling if 'script_security' option is ge '2'
+	if [ "$script_security" -ge '2' ]; then
 		local up down route_up route_pre_down
 		local client tls_client tls_server
 		local tls_crypt_v2_verify mode learn_address client_connect
 		local client_crresponse client_disconnect auth_user_pass_verify
 
-		logger -t "openvpn(proto)" \
-			-p daemon.info "Enabled default hotplug processing, as the openvpn configuration 'script_security' is '3'"
-
-		append exec_params "--setenv INTERFACE $config"
-		append exec_params "--script-security 3"
-
 		json_get_vars up down route_up route_pre_down
 		json_get_vars tls_crypt_v2_verify mode learn_address client_connect
 		json_get_vars client_crresponse client_disconnect auth_user_pass_verify
 
-		json_get_vars ipv6
-		#default ipv6 is enabled
-		[ -n "$ipv6" ] || ipv6=1
-		append exec_params "--setenv IPV6 '$ipv6'"
-
 		json_get_vars ifconfig_noexec route_noexec
-		[ -z "$ifconfig_noexec" ] && append exec_params "--ifconfig-noexec"
-		[ -z "$route_noexec" ] && append exec_params "--route-noexec"
 
-		append exec_params "--up '/usr/libexec/openvpn-hotplug'"
 		[ -n "$up" ] && append exec_params "--setenv user_up '$up'"
-
-		append exec_params "--down '/usr/libexec/openvpn-hotplug'"
 		[ -n "$down" ] && append exec_params "--setenv user_down '$down'"
-
-		append exec_params "--route-up '/usr/libexec/openvpn-hotplug'"
 		[ -n "$route_up" ] && append exec_params "--setenv user_route_up '$route_up'"
-
-		append exec_params "--route-pre-down '/usr/libexec/openvpn-hotplug'"
 		[ -n "$route_pre_down" ] && append exec_params "--setenv user_route_pre_down '$route_pre_down'"
 
 		append exec_params "--tls-crypt-v2-verify '/usr/libexec/openvpn-hotplug'"
@@ -260,16 +302,106 @@ proto_openvpn_setup() {
 			json_get_var tls_verify tls_verify
 			[ -n "$tls_verify" ] && append exec_params "--setenv user_tls_verify '$tls_verify'"
 		fi
-	else
-		logger -t "openvpn(proto)" \
-			-p daemon.warn "Default hotplug processing disabled, as the openvpn configuration 'script_security' is less than '3'"
 	fi
 
+	# Write first-phase params to conf_file
 	eval "set -- $exec_params"
 	umask 077
 	printf "%b\n" "${exec_params//--/\\n}" > "$conf_file"
 	umask 022
-	proto_run_command "$config" openvpn --config "$conf_file"
+
+	local CONFIG_FILES="$conf_file"
+	# Copy user config and recursively copy all referenced config files,
+	# rewriting `config` directives to point to the copies in CONF_DIR.
+	local user_conf="${CONF_PREFIX}$config.user.conf"
+	if [ -n "$config_file" -a -e "$config_file" ]; then
+		cp "$config_file" "$user_conf" || {
+			logger -t "openvpn_$config(proto)" -p daemon.err "failed to copy config '$config_file'"
+			return 1
+		}
+		CONFIG_FILES="$CONFIG_FILES $user_conf"
+		copy_config_recursive "$user_conf" ""
+
+		# Update the `config` reference in conf_file to point to the copied user_conf.
+		rewrite_config_line "$conf_file" "$config_file" "$user_conf"
+	fi
+
+	local ipv6 defaultroute metric
+	exec_params=
+
+	# combine into --askpass:
+	if [ -n "$cert_password" ]; then
+		cp_file="${CONF_PREFIX}$config.pass"
+		umask 077
+		printf '%s\n' "${cert_password:-}" > "$cp_file"
+		umask 022
+		append exec_params "--askpass $cp_file"
+	elif [ -n "$askpass" ]; then
+		append exec_params "--askpass $askpass"
+	fi
+
+	# combine into --auth-user-pass:
+	if [ -n "$username" ] || [ -n "$password" ]; then
+		auth_file="${CONF_PREFIX}$config.auth"
+		umask 077
+		printf '%s\n' "${username:-}" "${password:-}" > "$auth_file"
+		umask 022
+		append exec_params "--auth-user-pass $auth_file"
+	elif [ -n "$auth_user_pass" ]; then
+		append exec_params "--auth-user-pass $auth_user_pass"
+	fi
+
+	#Always Override Options
+	append exec_params "--setenv INTERFACE $config"
+	append exec_params "--script-security 3"
+	append exec_params "--ifconfig-noexec"
+	append exec_params "--route-noexec"
+	append exec_params "--up '/usr/libexec/openvpn-hotplug'"
+	append exec_params "--down '/usr/libexec/openvpn-hotplug'"
+	append exec_params "--route-up '/usr/libexec/openvpn-hotplug'"
+	append exec_params "--route-pre-down '/usr/libexec/openvpn-hotplug'"
+	append exec_params "--persist-tun"
+	append exec_params "--persist-key"
+
+	local is_client=0
+	local client_detect_file="${CONF_PREFIX}$config.client_detected"
+	rm -f "$client_detect_file"
+
+	# filter out dup options - applied to all copied config files
+	sed -i \
+		-e "/^[[:space:]]*remote[[:space:]]/w $client_detect_file" \
+		-e '/^[[:space:]]*script-security[[:space:]]*/s/^/# /' \
+		-e '/^[[:space:]]*ifconfig-noexec[[:space:]]*/s/^/# /' \
+		-e '/^[[:space:]]*route-noexec[[:space:]]*/s/^/# /' \
+		-e '/^[[:space:]]*up[[:space:]]/s/^/# /' \
+		-e '/^[[:space:]]*down[[:space:]]/s/^/# /' \
+		-e '/^[[:space:]]*route-up[[:space:]]/s/^/# /' \
+		-e '/^[[:space:]]*route-pre-down[[:space:]]/s/^/# /' \
+		-e '/^[[:space:]]*persist-tun[[:space:]]*/s/^/# /' \
+		-e '/^[[:space:]]*persist-key[[:space:]]*/s/^/# /' \
+		$CONFIG_FILES
+	[ -s "$client_detect_file" ] && {
+		is_client=1
+	}
+	rm -f "$client_detect_file"
+
+	json_get_vars ipv6 defaultroute metric
+	#default ipv6 is enabled
+	[ -n "$ipv6" ] || ipv6=1
+	append exec_params "--setenv IPV6 $ipv6"
+
+	[ -n "$metric" ] && append exec_params "--setenv METRIC $metric"
+
+	if [ "$is_client" = 1 ]; then
+		append exec_params "--redirect-gateway def1 ipv6"
+		[ -n "$defaultroute" ] || defaultroute=1
+		sed -i '/^[[:space:]]*redirect-gateway[[:space:]]*/s/^/# /' $CONFIG_FILES
+	else
+		defaultroute=0
+	fi
+	append exec_params "--setenv DEFAULTROUTE $defaultroute"
+
+	proto_run_command "$config" openvpn $exec_params --config "$conf_file"
 
 	# last param wins; user provided status or syslog supersedes.
 }
@@ -284,12 +416,14 @@ proto_openvpn_renew() {
 
 proto_openvpn_teardown() {
 	local iface="$1"
-	rm -f \
-		"/var/run/openvpn.$iface.conf" \
-		"/var/run/openvpn.$iface.pass" \
-		"/var/run/openvpn.$iface.auth" \
-		"/var/run/openvpn.$iface.status" 
+
 	proto_kill_command "$iface"
+	[ -n "$iface" ] && rm -f "${CONF_PREFIX}${iface}."*
+
+	/usr/libexec/openvpn-hotplug cleanup "$iface"
+
+	proto_init_update "*" 0
+	proto_send_update "$iface"
 }
 
 [ -n "$INCLUDE_ONLY" ] || {
diff --git a/net/openvpn/files/usr/libexec/openvpn-hotplug b/net/openvpn/files/usr/libexec/openvpn-hotplug
index 5f14be433c..d32af10ca0 100644
--- a/net/openvpn/files/usr/libexec/openvpn-hotplug
+++ b/net/openvpn/files/usr/libexec/openvpn-hotplug
@@ -1,5 +1,10 @@
 #!/bin/sh
 
+if [ "$1" = "cleanup" ]; then
+	script_type=cleanup
+	INTERFACE="$2"
+fi
+
 [ -z "$script_type" ] && {
 	logger -t "openvpn(proto)" -p daemon.warn "hotplug: variable 'script_type' not found"
 	exit
@@ -10,8 +15,44 @@
 	exit
 }
 
-. /lib/functions.sh
-. /lib/netifd/netifd-proto.sh
+exec 2> >(logger -t "openvpn_$INTERFACE(hotplug)" -p daemon.err)
+
+run_hotplug() {
+	ACTION="$script_type"
+	INSTANCE="$INTERFACE"
+
+	export ACTION
+	export INSTANCE
+	exec /sbin/hotplug-call openvpn "$@"
+}
+
+case "$script_type" in
+	cleanup)
+		. /usr/share/libubox/jshn.sh
+
+		SERVER_ROUTE_IPV4_CLEANUP_CMD=
+		SERVER_ROUTE_IPV6_CLEANUP_CMD=
+		json_data="$(ubus call network.interface."$INTERFACE" status 2>/dev/null)"
+		if json_load "$json_data" 2>/dev/null; then
+			if json_select data 2>/dev/null; then
+				json_get_var SERVER_ROUTE_IPV4_CLEANUP_CMD server_route_ipv4_cleanup_cmd
+				json_get_var SERVER_ROUTE_IPV6_CLEANUP_CMD server_route_ipv6_cleanup_cmd
+				[ -n "$SERVER_ROUTE_IPV4_CLEANUP_CMD" ] && $SERVER_ROUTE_IPV4_CLEANUP_CMD
+				[ -n "$SERVER_ROUTE_IPV6_CLEANUP_CMD" ] && $SERVER_ROUTE_IPV6_CLEANUP_CMD
+			fi
+		fi
+
+		run_hotplug "$@"
+	;;
+	up) ;;
+	*) run_hotplug "$@" ;;
+esac
+
+SERVER_ROUTE_IPV4_CLEANUP_CMD=
+SERVER_ROUTE_IPV6_CLEANUP_CMD=
+MASK_PREFIX=
+CIDR6_ADDR=
+CIDR6_PLEN=
 
 mask2prefix() {
 	local mask="$1"
@@ -31,32 +72,100 @@ mask2prefix() {
 			*)   break     ;;
 		esac
 	done
-	echo "$n"
+	MASK_PREFIX="$n"
 }
 
 parse_cidr6() {
 	local val="$1"
 	local def_plen="$2"
-	local addr="${val%/*}"
-	local plen="${val#*/}"
-	[ "$addr" = "$plen" ] && plen="$def_plen"
-	echo "$addr $plen"
+
+	CIDR6_ADDR="${val%/*}"
+	CIDR6_PLEN="${val#*/}"
+	[ "$CIDR6_ADDR" = "$CIDR6_PLEN" ] && CIDR6_PLEN="$def_plen"
+}
+
+route_path_for_target() {
+	local family="$1"
+	local target="$2"
+	local output key
+
+	route_path_gateway=
+	route_path_dev=
+
+	[ -n "$target" ] || return 1
+
+	output="$(ip "-$family" route get "$target" 2>/dev/null)" || return 1
+
+	set -- $output
+	while [ "$#" -gt 0 ]; do
+		key="$1"
+		case "$key" in
+			via)
+				shift
+				route_path_gateway="$1"
+			;;
+			dev)
+				shift
+				route_path_dev="$1"
+			;;
+		esac
+		[ "$#" -gt 0 ] && shift
+	done
+
+	[ -n "$route_path_gateway$route_path_dev" ]
+}
+
+server_route_exists() {
+	local family="$1"
+	local prefix="$2"
+	local target="$3"
+	local output
+
+	[ -n "$target" ] || return 1
+
+	output="$(ip "-$family" route show "$target/$prefix" ${METRIC:+metric $METRIC} 2>/dev/null)"
+	[ -n "$output" ]
+}
+
+is_openvpn_default_route()
+{
+	case $1 in
+		0.0.0.0/0|\
+		0.0.0.0/1|\
+		128.0.0.0/1|\
+		::/0|\
+		::/1|\
+		8000::/1|\
+		::/3|\
+		2000::/3|\
+		3000::/4|\
+		2000::/4|\
+		fc00::/7)
+			return 0
+	esac
+	return 1
 }
 
 case "$script_type" in
 	up)
-		nohostroute="$(uci_get network "$INTERFACE" nohostroute)"
+		. /lib/functions.sh
+		. /lib/netifd/netifd-proto.sh
+		. /usr/share/libubox/jshn.sh
+
 		proto_init_update "$dev" 1
 
+		[ -n "$tun_mtu" ] && /sbin/ip link set dev $dev mtu $tun_mtu
+
 		[ -n "$ifconfig_local" ] && proto_add_ipv4_address "$ifconfig_local" "${ifconfig_netmask:-255.255.255.255}"
 
-		[ -n "$trusted_ip" ] && {
-			if [ -n "$route_net_gateway" -a "$route_net_gateway" != "0.0.0.0" -a "${nohostroute}" != "1" ]; then
-				proto_add_host_dependency "$INTERFACE" "$trusted_ip"
+		if [ -n "$trusted_ip" -a "$DEFAULTROUTE" = "1" ]; then
+			if route_path_for_target 4 "$trusted_ip" && ! server_route_exists 4 32 "$trusted_ip"; then
+				ip -4 route add $trusted_ip ${route_path_gateway:+via $route_path_gateway} ${route_path_dev:+dev $route_path_dev} ${METRIC:+metric $METRIC}
+				SERVER_ROUTE_IPV4_CLEANUP_CMD="ip -4 route del $trusted_ip ${route_path_gateway:+via $route_path_gateway} ${route_path_dev:+dev $route_path_dev} ${METRIC:+metric $METRIC}"
 			fi
-		}
+		fi
 
-		[ -n "$route_vpn_gateway" ] && proto_add_ipv4_route "0.0.0.0" 0 "$route_vpn_gateway"
+		[ "$DEFAULTROUTE" = "1" ] && [ -n "$route_vpn_gateway" ] && proto_add_ipv4_route "0.0.0.0" 0 "$route_vpn_gateway"
 
 		i=0
 		while :; do
@@ -65,27 +174,26 @@ case "$script_type" in
 			[ -z "$net" ] && break
 			[ -z "$mask" ] && continue
 
-			plen=$(mask2prefix "$mask")
-			proto_add_ipv4_route "$net" "$plen" "$gw"
+			mask2prefix "$mask"
+			is_openvpn_default_route "$net/$MASK_PREFIX" && continue
+
+			proto_add_ipv4_route "$net" "$MASK_PREFIX" "$gw"
 		done
 
 		if [ "$IPV6" = "1" ]; then
 			if [ -n "$ifconfig_ipv6_local" ]; then
-				read -r v6addr v6plen <<-EOF
-					$(parse_cidr6 "$ifconfig_ipv6_local" "${ifconfig_ipv6_netbits:-128}")
-				EOF
-				proto_add_ipv6_address "$v6addr" "$v6plen"
+				parse_cidr6 "$ifconfig_ipv6_local" "${ifconfig_ipv6_netbits:-128}"
+				proto_add_ipv6_address "$CIDR6_ADDR" "$CIDR6_PLEN"
 			fi
 
-			[ -n "$trusted_ip6" ] && {
-				# to detect net_gateway_ipv6, source routing on wan6 has to be disabled
-				# consider removing check for net_gateway_ipv6
-				if [ -n "$net_gateway_ipv6" -a "$net_gateway_ipv6" != "::" -a "${nohostroute}" != "1" ]; then
-					proto_add_host_dependency "$INTERFACE" "$trusted_ip6"
+			if [ -n "$trusted_ip6" -a "$DEFAULTROUTE" = "1" ]; then
+				if route_path_for_target 6 "$trusted_ip6" && ! server_route_exists 6 128 "$trusted_ip6"; then
+					ip -6 route add $trusted_ip6 ${route_path_gateway:+via $route_path_gateway} ${route_path_dev:+dev $route_path_dev} ${METRIC:+metric $METRIC}
+					SERVER_ROUTE_IPV6_CLEANUP_CMD="ip -6 route del $trusted_ip6 ${route_path_gateway:+via $route_path_gateway} ${route_path_dev:+dev $route_path_dev} ${METRIC:+metric $METRIC}"
 				fi
-			}
+			fi
 
-			[ -n "$ifconfig_ipv6_remote" ] && proto_add_ipv6_route "::" 0 "$ifconfig_ipv6_remote"
+			[ "$DEFAULTROUTE" = "1" ] && [ -n "$ifconfig_ipv6_remote" ] && proto_add_ipv6_route "::" 0 "$ifconfig_ipv6_remote"
 
 			i=0
 			while :; do
@@ -93,15 +201,13 @@ case "$script_type" in
 				eval "net=\$route_ipv6_network_$i gw=\$route_ipv6_gateway_$i"
 				[ -z "$net" ] && break
 
-				read -r v6net v6plen <<-EOF
-					$(parse_cidr6 "$net" 128)
-				EOF
-				proto_add_ipv6_route "$v6net" "$v6plen" "$gw"
+				parse_cidr6 "$net" 128
+				is_openvpn_default_route "$CIDR6_ADDR/$CIDR6_PLEN" && continue
+
+				proto_add_ipv6_route "$CIDR6_ADDR" "$CIDR6_PLEN" "$gw"
 			done
 		fi
 
-		[ -n "$tun_mtu" ] && json_add_int mtu "$tun_mtu"
-
 		i=0
 		while :; do
 			i=$((i+1))
@@ -117,18 +223,15 @@ case "$script_type" in
 			esac
 		done
 
-		proto_send_update "$INTERFACE"
-	;;
+		proto_add_data
+		json_add_string "daemon_pid" "$daemon_pid"
+		json_add_string "ifname" "$dev"
+		[ -n "$SERVER_ROUTE_IPV4_CLEANUP_CMD" ] && json_add_string "server_route_ipv4_cleanup_cmd" "$SERVER_ROUTE_IPV4_CLEANUP_CMD"
+		[ -n "$SERVER_ROUTE_IPV6_CLEANUP_CMD" ] && json_add_string "server_route_ipv6_cleanup_cmd" "$SERVER_ROUTE_IPV6_CLEANUP_CMD"
+		proto_close_data
 
-	down)
-		proto_init_update "$dev" 0
 		proto_send_update "$INTERFACE"
 	;;
 esac
 
-ACTION="$script_type"
-INSTANCE="$INTERFACE"
-
-export ACTION="$ACTION"
-export INSTANCE="$INSTANCE"
-exec /sbin/hotplug-call openvpn "$@"
+run_hotplug "$@"

From fe2f28d6279d6204bcc7649e20caaee9cc312bfa Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 4 Jul 2026 05:02:19 +0000
Subject: [PATCH 56/56] ci: bump lewagon/wait-on-check-action from 1.8.0 to
 1.8.1

Bumps [lewagon/wait-on-check-action](https://github.com/lewagon/wait-on-check-action) from 1.8.0 to 1.8.1.
- [Release notes](https://github.com/lewagon/wait-on-check-action/releases)
- [Changelog](https://github.com/lewagon/wait-on-check-action/blob/master/CHANGELOG.md)
- [Commits](https://github.com/lewagon/wait-on-check-action/compare/v1.8.0...v1.8.1)

---
updated-dependencies:
- dependency-name: lewagon/wait-on-check-action
  dependency-version: 1.8.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/multi-arch-test-build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/multi-arch-test-build.yml b/.github/workflows/multi-arch-test-build.yml
index 4abbc72768..c8c7087222 100644
--- a/.github/workflows/multi-arch-test-build.yml
+++ b/.github/workflows/multi-arch-test-build.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-slim
     steps:
       - name: Wait for Check Run
-        uses: lewagon/wait-on-check-action@v1.8.0
+        uses: lewagon/wait-on-check-action@v1.8.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           check-name: 'FormalityCheck / Git & Commits'