packages/net/ddns-scripts/Makefile, branch master

ddns-scripts: fix root command injection through ddns_dateformat

2026-07-30T09:43:04Z

The date format read from the UCI option ddns.global.ddns_dateformat was embedded into a command string that is later executed through "eval", both for the recurring log timestamps DATE_PROG="date +'$ddns_dateformat'" ... write_log 5 "PID '$$' started at $(eval $DATE_PROG)" and for the "last update" timestamp in the updater EPOCH_TIME="date -d @$EPOCH_TIME +'$ddns_dateformat'" write_log 7 "last update: $(eval $EPOCH_TIME)" The value is only wrapped in single quotes, so a single quote inside it closes that quote and starts a new shell word. A user who can write the ddns configuration - a delegated DDNS operator who was never granted shell access - can set ddns_dateformat="%F'; touch /tmp/pwned; '" and have arbitrary commands run as root, because the updater runs as root. The injection triggers on the next start of the updater, so in practice on the next reconfiguration or reboot. Stop building shell code from the option. Provide date_prog() as an ordinary shell function and pass the format as a single quoted argument in both places, which leaves no way for its content to be interpreted by the shell. The remaining use of ddns_dateformat in dynamic_dns_updater.sh, for NEXT_CHECK_TIME, already substituted it as a quoted argument without eval and was not affected. luci-app-ddns consumes the same option and is fixed separately in the LuCI repository. Reported-by: Matthew Hickey (Hacker Fantastic, https://hacker.house) Fixes: 1c20dcb71a69 ("ddns-scripts: update to 2.7.6-1") Assisted-by: Claude:claude-opus-5 Signed-off-by: Hauke Mehrtens

ddns-scripts: update to 2.8.4

2026-07-07T06:02:21Z

Bump PKG_VERSION for the ddns-scripts changes and reset PKG_RELEASE to 1 as requested. Signed-off-by: Jiang Tengfei

ddns-scripts: fix one.com prerm test syntax

2026-07-07T06:02:21Z

Add the missing spaces around the test bracket in the one.com pre-removal script and escape IPKG_INSTROOT consistently with the other subpackages. Signed-off-by: Jiang Tengfei

ddns-scripts: add EuroDNS provider

2026-07-06T08:59:48Z

Add EuroDNS provider for IPv4 and IPv6 Howto: set [USERNAME] to username set [PASSWORD] to password set [DOMAIN] to domain https://help.eurodns.com/s/article/How-do-I-configure-DYNDNS?language=en_US Signed-off-by: Angus Young

ddns-scripts: add fallback for default values

2026-06-09T09:19:35Z

In luci, the `interface` value has `o.default = 'wan'` configured. Due to a behavior fix in 'o.default', values matching the default are no longer saved. Currently, this is workedaround by disabling 'o.rmempty' in luci, but handling this compatibility fallback on the backend is a cleaner and superior approach. Ref: https://github.com/openwrt/luci/commit/b004197a277804ec0c8f092412b91c1d3e5936fa Signed-off-by: Andy Chiang

ddns-scripts: add blazingfast.io Anycast DNS provider

2026-05-22T13:07:28Z

Add DDNS update support for blazingfast.io Anycast DNS via their REST API. Authentication is performed via JWT token obtained from the login endpoint. Zone records are fetched to verify the record type before update, ensuring IPv4 services only target A records and IPv6 services only target AAAA records. Service, zone and record IDs are passed via param_opt as space-separated key=value pairs: service_id=X zone_id=Y record_id=Z curl --config file approach is used throughout to avoid eval and shell injection from user-controlled values. Supports both IPv4 and IPv6. For dual-stack, create two separate DDNS service sections with their respective record IDs. Tested on GL.iNet MT5000 (Brume 3) running OpenWrt with ddns-scripts 2.8.2. Signed-off-by: Fotios Kitsantas

ddns-scripts: add blazingfast.io Anycast DNS provider

2026-05-18T09:44:25Z

ddns-scripts: fix option name in updater messages

2026-05-05T08:21:21Z

On master, updater help and missing-option text still refer to '-N'. Use '-S' instead so the messages match accepted script options. Also clarify that SECTION is the UCI section name/id to start. This is a text-only change; runtime behavior is unchanged. Bump PKG_RELEASE to 4. Fixes: #27737 Signed-off-by: Dharmik Parmar

ddns-scripts: netcup.com adjust update error path

2026-04-27T12:26:29Z

Adjust the update error handling path to avoid hard failures on recoverable errors. This allows ddns to retry updates after the configured retry interval and improves reliability. Signed-off-by: Tim Flubshi

ddns-scripts: add netcup.com support

2026-03-25T06:31:57Z

Add a new netcup DDNS provider using the netcup DNS api (ccp.netcup.net) with API key authentication. Configuration mapping: * username = netcup customer number * password = netcup API password * param_enc = netcup API key (generated in the CCP) * domain = fully qualified subdomain to update (e.g. home.example.de) * param_opt = (optional) root/zone domain override (e.g. example.de) When omitted the root domain is derived by stripping the leftmost label from 'domain'. This only works correctly for a single subdomain level (e.g. "home.example.de"). param_opt MUST be set explicitly in two cases: 1. Deep subdomains: domain=test.internal.example.org 2. ccSLD apex domains: domain=example.co.nz Signed-off-by: Tim Flubshi