packages/net/shunt/src, branch master

shunt: update to 0.1.12

2026-10-11T18:43:56Z

- fallback 'block' now rejects instead of dropping, so clients fail at once rather than on a timeout - tproxy: a proxied flow whose listener is gone is rejected the same way, whatever the fallback - route: the policy table's fallback default is a prohibit route instead of a blackhole - update the README Co-authored-by: Claude Signed-off-by: Dirk Brenken

shunt: ignore unspecified netifd nexthop

2026-10-06T19:49:15Z

netifd always emits a nexthop for its routes, the unspecified address for a gateway-less one, e.g. wg0 with route_allowed_ips. Taken as gateway, IPv4 treats 0.0.0.0 as none, but the kernel rejects "via ::" with EINVAL, so the IPv6 policy route was never installed and marked traffic fell through to main, where the interface metrics decided (IPv6 leak via WAN). Co-authored-by: Claude Signed-off-by: Dirk Brenken

shunt: update to 0.1.11

2026-10-05T18:35:54Z

* add the per-policy action 'tproxy': hands the selected tcp/udp traffic to a transparent proxy on the router (option tproxy_port), delivered to 127.0.0.1/::1 via a 'local default dev lo' policy table * restore rules for tproxy flows carry the tproxy statement on every packet - a mark alone loses udp flows to the proxy's reply socket * a proxied flow whose listener is gone is always dropped: its conntrack entry was never NATed and would leave with the client's own address; fallback 'main'/'block' decides about new flows only * no tproxy rules in output (the kernel rejects the statement there), no keep_local rule for tproxy (main would forward socket-assigned packets) * tproxy policies are skipped as an issue without kmod-nft-tproxy instead of failing the whole nft batch * shunt check and the rpcd status report tproxy policies * readme update Co-authored-by: Claude Signed-off-by: Dirk Brenken

shunt: update 0.1.10

2026-09-18T14:06:46Z

* snooped elements expire with the TTL of the DNS answer, clamped to 60..entry_ttl; entry_ttl is now the ceiling, polled elements still use it * write cache tracks the expiry it last wrote per element and rewrites when the new expiry moves by at least half of the answer's lifetime, in either direction * a flow's route is decided on its first packet and kept on the conntrack entry: route statements set ct mark, one restore rule per policy marks later packets of the original direction, settled flows skip the lookups * LuCI: change the entry_ttl option text * update the README Co-authored-by: Claude Signed-off-by: Dirk Brenken

shunt: update to 0.1.8

2026-09-16T17:29:17Z

- new per-policy `domain_file` list: domain patterns from a file, one per line, for community-maintained lists too large for UCI. Entries are learned by snoop only, never polled - a bare name lives under /tmp/shunt (tmpfs, no flash wear), an absolute path is taken as given; a missing file is an issue, not a fatal error, the policy stays rendered with empty sets - new `shunt refresh` (ubus method `refresh`): re-reads the files and swaps the matcher in place, no restart, learned addresses stay - matcher: regex fast path, 4x faster on 100k patterns - routes and rules are written over rtnetlink via ucode-mod-rtnl instead of one `ip` process per command; route.uc renders the netlink operations, the new src/rt.uc applies them and reads the verdict from rtnl.error() - `rp_filter_manage` writes /proc/sys directly, `nft` is the last remaining child process - `+ip` dropped from DEPENDS - README update Co-authored-by: Claude Signed-off-by: Dirk Brenken

shunt: update to 0.1.6

2026-09-07T19:50:46Z

- *Per-policy `action`, `route` (default) or `bypass` - the equivalent of pbr's `ignore`, an exception carved out of every policy below it. - `keep_local`, default on - a marked packet to one of your own subnets stays on `main` instead of taking the policy's default route. - The ruleset is re-applied when the table is deleted - e.g. with `/etc/init.d/firewall stop` - README update Signed-off-by: Dirk Brenken Co-authored-by: Claude Signed-off-by: Dirk Brenken

shunt: add new package

2026-08-25T19:24:47Z

shunt is a policy-based routing daemon for OpenWrt. Policies select traffic by client address or MAC, destination address, domain, port and protocol, and route it into any netifd interface or device via fwmark and per-policy routing tables in nftables/fw4. Domains are covered by a passive DNS observer (AF_PACKET + BPF) that works with any resolver - dnsmasq, unbound, AGH, a remote DoH client - because it reads answers on the LAN bridges instead of integrating with a specific DNS backend. An optional poller pre-warms configured names. Learned addresses are written in adaptive batches to stay usable beside packages that keep very large nft sets (e.g. banIP). Written in ucode, no dependencies beyond ucode modules, nft and ip. Companion LuCI app is submitted separately to openwrt/luci. Signed-off-by: Dirk Brenken Co-authored-by: Claude Signed-off-by: Dirk Brenken