packages/net/banip, branch master

banip: replace the CARTO basemap with local outlines

2026-08-27T09:06:55Z

CARTO now requires an API key for the raster basemaps at basemaps.cartocdn.com and watermarks every unauthenticated tile request, so the GeoIP map currently renders "API KEY REQUIRED" across the whole viewport. Therefore in luci-app-banip the basemap is now drawn from country outlines that ship with the package: Natural Earth 1:110m, public domain, all attributes stripped, simplified to 36 kB (~10 kB in the apk). readme changes in the base package only Signed-off-by: Dirk Brenken

banip: release 1.8.12-1

2026-08-21T19:47:17Z

* new option ban_monitorallowed: in allowlist-only mode the log monitor only honours the local allowlist, so attackers from an explicitly allowed segment can be banned (fixes openwrt/luci#8950) * adds the allowlist.local.v4/.v6 Sets, built from /etc/banip/banip.allowlist only, referenced by no rule * allowlist-only mode: skip only those external feeds whose direction is fully covered by the allowlist, instead of skipping all or none — split Sets included * f_lookup keeps the monitor Set in sync with resolved domains * f_restore: no more bogus per-proto restore attempts for the allowlist * f_report: batched and deduplicated geo lookups, correct Set names in the report * readme update Signed-off-by: Dirk Brenken

banip: fix cpu core calculation

2026-08-10T17:36:15Z

- only cap the cpu core count by available memory if it was auto-detected, a manually set 'ban_cores' is now authoritative and no longer lowered - readme update: clarify that the auto-cap does not apply to a manually set core count Signed-off-by: Dirk Brenken

banip: report the last run timestamp as ISO 8601

2026-08-06T19:26:44Z

The runtime status reported the last run as DD/MM/YYYY, which reads as a different date entirely for anyone used to month first ordering. Use YYYY-MM-DD instead for the frontpage and the Set reporting. The new ISO 8601 format is unambiguous regardless of the reader's locale. Signed-off-by: Dirk Brenken

banip: fix the local uplink lookup of the GeoIP map

2026-07-26T17:54:08Z

- better extract Uplink addresses - the map array anchor was written inside the runtime file branch, so a missing runtime file dropped the entire map instead of just the local marker Signed-off-by: Dirk Brenken

banip: release 1.8.10-1

2026-06-28T21:22:58Z

- fixed log monitor source-IP spoofing (GHSA-r6hx-4f83-vp8m) Fix: per-ban_logterm source anchoring — the real source (last IP in the line) is used by default; opt-in 'first:' prefix for source-first formats (web-server access logs). - add f_mem() helper to read MemAvailable from /proc/meminfo - cap the auto-detected CPU core count by available memory in f_system: ban_cores is limited to MemAvailable / 48 (MiB per job), floored to at least 1 core; this bounds the number of feeds processed in parallel on constrained devices, a user-set ban_cores is still honored as a ceiling (the cap only ever lowers it). - derive the GNU sort buffer size from available memory, applied only when coreutils sort is present; busybox sort is a no-op Signed-off-by: Dirk Brenken

banip: update 1.8.9-2

2026-06-21T16:46:38Z

default feed updates: - urlhaus, urlvir, webclient: switched from in to out and added a tcp udp 80 443 port limit (destination feeds for LAN-initiated traffic) - feodo, spamhaus, threat, threatview, proxy, tor, vpn, vpndc: switched from in to inout - threatview: added url_6, as the source ships IPv4 and IPv6 in a single file - country / asn: intentionally left on in; documented how to switch them to outbound/both for the recurring "block connections to country X" case - readme update: - corrected the feed table to match the above, - removed the stale drop row (replaced by spamhaus), - and reworked the chain explanation to clarify the inbound-vs-outbound (source-IP vs destination-IP) model - significantly expanded the custom-feeds section (all JSON fields, rule parameters, etc. Signed-off-by: Dirk Brenken

banip: release 1.8.9-1

2026-06-12T20:28:10Z

* f_conf: ignore empty UCI option values so they don't override sane defaults * f_etag: strip CR in ETag header extraction (gsub(/[\r"]/,…)) — fixes empty-but-present etag * f_fetch: validate ban_fetchretry * fix feed padding in allowlistonly mode * readme update Signed-off-by: Dirk Brenken

banip: update 1.8.8-5

2026-05-29T11:57:31Z

* bugfix: only load the configuration once per run: a new `ban_confload` guard short-circuits `f_conf()` on subsequent calls, avoiding repeated `config_load` invocations * new: the per-set report now sorts elements by their packet counter in descending order before truncating to the top 50, so the report shows the most active elements instead of just the first 50 found Signed-off-by: Dirk Brenken

banip: update 1.8.8-4

2026-05-18T21:21:43Z

- f_etag performance optimization: single-pass awk consolidating count+match - f_report performance optimization: significantly reduce subshell spawning - f_lookup performance optimization: DNS resolution parallelized per domain via subshells - LuCI: prevent possible report refresh timeouts Signed-off-by: Dirk Brenken