fix

fullconenat/Makefile

@@ -0,0 +1,62 @@
+#
+# Copyright (C) 2022 Chion Tang <tech@chionlab.moe>
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=fullconenat
+PKG_RELEASE:=9
+
+PKG_SOURCE_DATE:=2022-02-13
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_URL:=https://github.com/llccd/netfilter-full-cone-nat.git
+PKG_SOURCE_VERSION:=108a36cbdca17e68c9e6e7fd5e26156a88f738e8
+PKG_MIRROR_HASH:=00d749235271dee194dcd23c22e6e85207ea90192a62a110b2af0b4e4de1971f
+
+PKG_LICENSE:=GPL-2.0
+PKG_LICENSE_FILES:=LICENSE
+PKG_MAINTAINER:=Chion Tang <tech@chionlab.moe>
+
+include $(INCLUDE_DIR)/kernel.mk
+include $(INCLUDE_DIR)/package.mk
+
+define Package/iptables-mod-fullconenat
+  SUBMENU:=Firewall
+  SECTION:=net
+  CATEGORY:=Network
+  TITLE:=FULLCONENAT iptables extension
+  DEPENDS:=+iptables +kmod-ipt-fullconenat
+endef
+
+define Package/iptables-mod-fullconenat/install
+	$(INSTALL_DIR) $(1)/usr/lib/iptables
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/libipt_FULLCONENAT.so $(1)/usr/lib/iptables
+endef
+
+define KernelPackage/ipt-fullconenat
+  SUBMENU:=Netfilter Extensions
+  TITLE:=FULLCONENAT netfilter module
+  DEPENDS:=+kmod-nf-ipt +kmod-nf-nat
+  KCONFIG:=  \
+	CONFIG_NF_CONNTRACK_EVENTS=y \
+	CONFIG_NF_CONNTRACK_CHAIN_EVENTS=y
+  FILES:=$(PKG_BUILD_DIR)/xt_FULLCONENAT.ko
+endef
+
+include $(INCLUDE_DIR)/kernel-defaults.mk
+
+define Build/Compile
+	+$(MAKE) $(PKG_JOBS) -C "$(LINUX_DIR)" \
+		CROSS_COMPILE="$(TARGET_CROSS)" \
+		ARCH="$(LINUX_KARCH)" \
+		M="$(PKG_BUILD_DIR)" \
+		EXTRA_CFLAGS="$(BUILDFLAGS)" \
+		modules
+	$(call Build/Compile/Default)
+endef
+
+$(eval $(call KernelPackage,ipt-fullconenat))
+$(eval $(call BuildPackage,iptables-mod-fullconenat))

fullconenat/patches/001-fix-init-Repeat-definition.patch

@@ -0,0 +1,20 @@
+--- a/libip6t_FULLCONENAT.c
++++ b/libip6t_FULLCONENAT.c
+@@ -214,6 +214,7 @@ static struct xtables_target fullconenat_tg_reg = {
+ 	.x6_options	= FULLCONENAT_opts,
+ };
+ 
++#define _init __attribute__((constructor)) _INIT
+ void _init(void)
+ {
+ 	xtables_register_target(&fullconenat_tg_reg);
+--- a/libipt_FULLCONENAT.c
++++ b/libipt_FULLCONENAT.c
+@@ -235,6 +235,7 @@ static struct xtables_target fullconenat_tg_reg = {
+ 	.x6_options	= FULLCONENAT_opts,
+ };
+ 
++#define _init __attribute__((constructor)) _INIT
+ void _init(void)
+ {
+ 	xtables_register_target(&fullconenat_tg_reg);

fullconenat/patches/001-linux-6.1-support.patch

@@ -0,0 +1,26 @@
+--- a/xt_FULLCONENAT.c
++++ b/xt_FULLCONENAT.c
+@@ -325,7 +325,11 @@
+     /* for now we do the same thing for both --random and --random-fully */
+ 
+     /* select a random starting point */
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 1, 0)
++    start = (uint16_t)(get_random_u32() % (u32)range_size);
++#else
+     start = (uint16_t)(prandom_u32() % (u32)range_size);
++#endif
+   } else {
+ 
+     if ((original_port >= min && original_port <= min + range_size - 1)
+@@ -995,7 +999,11 @@
+     /* for now we do the same thing for both --random and --random-fully */
+ 
+     /* select a random starting point */
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 1, 0)
++    start = (uint16_t)(get_random_u32() % (u32)range_size);
++#else
+     start = (uint16_t)(prandom_u32() % (u32)range_size);
++#endif
+   } else {
+ 
+     if ((original_port >= min && original_port <= min + range_size - 1)

fullconenat/src/Makefile

@@ -0,0 +1,6 @@
+libipt_FULLCONENAT.so: libipt_FULLCONENAT.o
+	$(CC) -shared -lxtables -o $@ $^;
+libipt_FULLCONENAT.o: libipt_FULLCONENAT.c
+	$(CC) ${CFLAGS} -fPIC -D_INIT=$*_init -c -o $@ $<;
+
+obj-m += xt_FULLCONENAT.o

mptcp/files/usr/share/omr/post-tracking.d/010-services

@@ -121,19 +121,6 @@ if ([ -f /etc/init.d/shadowsocks-libev ] && [ "$(uci -q get shadowsocks-libev.ss
 	[ -n "$(uci -q changes openmptcprouter)" ] && uci -q commit openmptcprouter
 fi
 
-restart_omrtracker() {
-	[ -n "$(pgrep -f "omr-tracker $1)" ] && return
-	config_get multipath "$1" multipath
-	config_get ifenabled "$1" auto
-	[ -z "$multipath" ] || [ "$multipath" = "off" ] && return
-	[ "$ifenabled" = "0" ] && return
-	/etc/init.d/omr-tracker start_interface "$1"
-	sleep 10
-}
-
-config_load network
-config_foreach restart_omrtracker interface
-
 if [ -f /etc/init.d/shadowsocks-libev ] && [ "$(uci -q get shadowsocks-libev.sss0.disabled)" != "1" ] && [ "$(uci -q get shadowsocks-libev.sss0.key)" != "" ] && [ "$(uci -q get shadowsocks-libev.sss0.server)" != "" ] && [ "$(uci -q get shadowsocks-libev.sss0.server)" != "192.18.1.3" ] && [ "$(pgrep -f omr-tracker-ss)" = "" ] && [ "$(pgrep -f '/etc/init.d/omr-tracker')" = "" ]; then
 	_log "Can't find omr-tracker-ss, restart omr-tracker..."
 	/etc/init.d/omr-tracker restart 2>&1 >/dev/null

openvpn/files/openvpn.config

@@ -279,6 +279,17 @@ config openvpn sample_server
 	# Use BF-CBC as fallback
 #	option data_ciphers_fallback 'BF-CBC'
 
+	# OpenVPN versions 2.4 and later will attempt to
+	# automatically negotiate the most secure cipher
+	# between the client and server, regardless of a
+	# configured "option cipher" (see below).
+	# Automatic negotiation is recommended.
+	#
+	# Uncomment this option to disable this behavior,
+	# and force all OpenVPN peers to use the configured
+	# cipher option instead (not recommended).
+#	option ncp_disable
+
 	# Enable compression on the VPN link.
 	# If you enable it here, you must also
 	# enable it in the client config file.

openvpn/files/openvpn.options

@@ -166,6 +166,7 @@ mlock
 mtu_test
 multihome
 mute_replay_warnings
+ncp_disable
 nobind
 opt_verify
 passtos