packages/net/shunt, branch master

shunt: tproxy improvements & fixes

2026-10-30T20:52:39Z

- report br_netfilter under a tproxy policy - skip IPv6 routes and rules on a kernel without IPv6 - report unknown section types - count kernel routes per family in the rpcd status - correct the rtnl return value note in rt.uc Co-authored-by: Claude Signed-off-by: Dirk Brenken

shunt: pad learned element timeouts against the TTL edge

2026-10-14T18:00:41Z

A client asks again when the TTL of an answer runs out, and the write for the new answer reaches the kernel up to one write interval later. With the element timed out to the second it is missing for exactly that gap, and a connection opened in it starts on the normal uplink and keeps that path for its lifetime. Co-authored-by: Claude Signed-off-by: Dirk Brenken

shunt: update to 0.2.0

2026-10-14T08:17:10Z

- new client selector src_dev: everything arriving on an ingress device, in both address families - a whole guest network or VLAN, independent of a changing IPv6 prefix; prerouting only, like src_mac - new destination selector dst_file: address and prefix lists from a file, read like domain_file and refilled atomically by `shunt refresh`; domain_file.uc becomes list_file.uc for both kinds - dport/proto alone now select traffic as documented, instead of rejecting the policy as "selects nothing" - a policy whose dst entries are all unusable is skipped instead of being widened to every destination of its clients - client and static destination sets use auto-merge, so overlapping prefixes no longer fail the whole ruleset with "conflicting intervals" - update the README Co-authored-by: Claude Signed-off-by: Dirk Brenken

shunt: update to 0.1.12

2026-10-11T18:43:56Z

- fallback 'block' now rejects instead of dropping, so clients fail at once rather than on a timeout - tproxy: a proxied flow whose listener is gone is rejected the same way, whatever the fallback - route: the policy table's fallback default is a prohibit route instead of a blackhole - update the README Co-authored-by: Claude Signed-off-by: Dirk Brenken

shunt: ignore unspecified netifd nexthop

2026-10-06T19:49:15Z

netifd always emits a nexthop for its routes, the unspecified address for a gateway-less one, e.g. wg0 with route_allowed_ips. Taken as gateway, IPv4 treats 0.0.0.0 as none, but the kernel rejects "via ::" with EINVAL, so the IPv6 policy route was never installed and marked traffic fell through to main, where the interface metrics decided (IPv6 leak via WAN). Co-authored-by: Claude Signed-off-by: Dirk Brenken

shunt: fix rpcd status call

2026-10-05T19:19:59Z

* define tproxy_available() before render(): ucode resolves the name when render() is compiled, so the later definition left it null and every status call failed - LuCI showed "no answer from the backend" Signed-off-by: Dirk Brenken

shunt: update to 0.1.11

2026-10-05T18:35:54Z

* add the per-policy action 'tproxy': hands the selected tcp/udp traffic to a transparent proxy on the router (option tproxy_port), delivered to 127.0.0.1/::1 via a 'local default dev lo' policy table * restore rules for tproxy flows carry the tproxy statement on every packet - a mark alone loses udp flows to the proxy's reply socket * a proxied flow whose listener is gone is always dropped: its conntrack entry was never NATed and would leave with the client's own address; fallback 'main'/'block' decides about new flows only * no tproxy rules in output (the kernel rejects the statement there), no keep_local rule for tproxy (main would forward socket-assigned packets) * tproxy policies are skipped as an issue without kmod-nft-tproxy instead of failing the whole nft batch * shunt check and the rpcd status report tproxy policies * readme update Co-authored-by: Claude Signed-off-by: Dirk Brenken

shunt: update 0.1.10

2026-09-18T14:06:46Z

* snooped elements expire with the TTL of the DNS answer, clamped to 60..entry_ttl; entry_ttl is now the ceiling, polled elements still use it * write cache tracks the expiry it last wrote per element and rewrites when the new expiry moves by at least half of the answer's lifetime, in either direction * a flow's route is decided on its first packet and kept on the conntrack entry: route statements set ct mark, one restore rule per policy marks later packets of the original direction, settled flows skip the lookups * LuCI: change the entry_ttl option text * update the README Co-authored-by: Claude Signed-off-by: Dirk Brenken

shunt: update to 0.1.8

2026-09-16T17:29:17Z

- new per-policy `domain_file` list: domain patterns from a file, one per line, for community-maintained lists too large for UCI. Entries are learned by snoop only, never polled - a bare name lives under /tmp/shunt (tmpfs, no flash wear), an absolute path is taken as given; a missing file is an issue, not a fatal error, the policy stays rendered with empty sets - new `shunt refresh` (ubus method `refresh`): re-reads the files and swaps the matcher in place, no restart, learned addresses stay - matcher: regex fast path, 4x faster on 100k patterns - routes and rules are written over rtnetlink via ucode-mod-rtnl instead of one `ip` process per command; route.uc renders the netlink operations, the new src/rt.uc applies them and reads the verdict from rtnl.error() - `rp_filter_manage` writes /proc/sys directly, `nft` is the last remaining child process - `+ip` dropped from DEPENDS - README update Co-authored-by: Claude Signed-off-by: Dirk Brenken

shunt: readme update

2026-09-08T09:22:42Z

- readme update regarding wg configuration, - no version bump Signed-off-by: Dirk Brenken