CURL download errors with BanIP and libmbedtls ver 3.6.6-r1

[p.p]

The PR is not yet merged, so of course there is no new package version.

[octopus]

Thanks,
I'm not know how it work in this case.
Where can I se what it's merged and what waiting to be merged in que?

[p.p]

Did you even click on the GitHub link? If you don't know what a PR is, here's some information about that.

Addendum regarding the "queue": You can see the list of open PRs in the OpenWrt repo (there are similar lists for other parts like LuCI and Packages). But it is not a queue, PRs are not guaranteed to be looked at or merged, and there is no defined order.

[Renato]

@octopus

I can't still not se any updated libmbedtls-3.6.6-r2 when using owut

I don't believe you will see any update soon...

This workaround worked for me:

banIP support thread

Disclaimer: I’m not a developer, and currently don’t have an available test device to try this. Not sure if it will work. If you want though, maybe try this as a temporary fix by editing /usr/lib/banip-functions.sh and modifying line 92 from being ban_fetchparm="" to new value: ban_fetchparm="--tlsv1.2 --tlsmax 1.2" (Pay attention to specific spacing above. Also, you should probably make a backup copy of file before editing.) [image] I could be wrong, but this may work for you…

[JustAnotherEndUser]

UPDATE to post above. For BanIP, there was already a “Download Parameters” section in the config GUI that I overlooked - which allows the TLS 1.2 option to be added for CURL.

Just add: --tlsv1.2 --tls-max 1.2

[dibdot]

@JustAnotherEndUser

Just add: --tlsv1.2 --tls-max 1.2

Sorry, that's wrong.
You have to define all download parameters if you're going the manual way (not only the tls tweaks) ... for correct curl download parameters see here:

banIP support thread

You didn't specify the fetchparm option at all? Try something like that ... option ban_fetchparm '--connect-timeout 20 --tlsv1.2 --tls-max 1.2 --retry-delay 10 --retry 5 --retry-all-errors --fail --silent --show-error --location -o'

[JustAnotherEndUser]

Commit for mbedtls 3.6.6-r2

mbedtls: backport upstream patches to fix TLS 1.2 client issues

[newsense]

Which is in the upcoming 25.12.3

https://openwrt.org/releases/25.12/changelog-25.12.3

[JustAnotherEndUser]

It is listed as a fix in 25.12.3

I just did a fresh install of 25.12.3 on a test device. The "Country Lists” downloads from ipdeny .com are still not working though.

Also, shouldn’t the libmbedtls:

be version 3.6.6-r2 now?

._______

EDIT: Disregard. I just saw this post that clarifies:

OpenWrt 25.12.3 - Service Release

Yes, the fix will be available in 25.12.3 once all the packages get rebuilt (separate build phase from the main images).

[JustAnotherEndUser]

Oddly, even with a fresh install of 25.12.3, with the updated libmbedtls 3.6.6-r2, still getting download errors with BanIP for the Countryv4 lists from ipdeny .com

For a sanity check, I simulated download with CURL from the command line:

EDIT: This resolved after some time and a device restart. BanIP is now pulling the Country list again as expected. Not sure what the issue was.