aboutsummaryrefslogtreecommitdiffstats
path: root/package/network/services
Commit message (Collapse)AuthorAgeFilesLines
* dnsmasq: backport official fix for CVE-2017-13704Kevin Darbyshire-Bryant2017-09-073-38/+95
| | | | | | | | | Remove LEDE partial fix for CVE-2017-13704. Backport official fix from upstream. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> (PKG_RELEASE increase)
* Revert "dropbear: Link ssh and scp command to /bin instead of /usr/bin"John Crispin2017-08-311-3/+3
| | | | | | This reverts commit f7528ed0a8586434e18e9007b1bf0d05a18d6418. Signed-off-by: John Crispin <john@phrozen.org>
* dropbear: Link ssh and scp command to /bin instead of /usr/binRosen Penev2017-08-311-3/+3
| | | | | | | | ssh and scp commands interfere with OpenSSH when installed in /usr/bin . One use case is when installing dropbear to get root access when only OpenSSH is available (OpenSSH disallows root password logins). Once dropbear installs, it replaces OpenSSH's executables, even when removed with opkg. OpenSSH must be reinstalled to get them back. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* samba36: Remove syslog and load printers lines.Rosen Penev2017-08-301-2/+0
| | | | | | printer support is removed using 200-remove_printer_support.patch. the syslog parameter requires samba to be compiled with --with-syslog. Currently samba does not log to syslog and probably has not for a long time. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* samba36: Don't resolve interfaces.Rosen Penev2017-08-302-7/+2
| | | | | | | It's redundant and also buggy. IPv6 link local addresses and ::1 are not resolved for example. Doesn't matter since lo and br-lan for example, resolve to them. Signed-off-by: Rosen Penev <rosenp@gmail.com> Acked-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
* samba36: Remove guest ok since LuCI configures it.Rosen Penev2017-08-301-2/+1
| | | | | | guest ok is set per share and as such, don't override it. also, fix an error introduced in the last commit. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* dnsmasq: forward.c: fix CVE-2017-13704Kevin Darbyshire-Bryant2017-08-302-1/+38
| | | | | | | | | | | | | | | | Fix SIGSEGV in rfc1035.c answer_request() line 1228 where memset() is called with header & limit pointing at the same address and thus tries to clear memory from before the buffer begins. answer_request() is called with an invalid edns packet size provided by the client. Ensure the udp_size provided by the client is bounded by 512 and configured maximum as per RFC 6891 6.2.3 "Values lower than 512 MUST be treated as equal to 512" The client that exposed the problem provided a payload udp size of 0. Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk> Acked-by: Hans Dedecker <dedeckeh@gmail.com>
* dnsmasq: fix indentationHans Dedecker2017-08-251-3/+3
| | | | Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* dnsmasq: add support for multiple tags for each host.Kuang Rufan2017-08-252-2/+7
| | | | | | | | | | | | | | | | | | | | | | | Currently, dnsmasq support assigning multiple tags to a host record (--dhcp-host), but we only support only 1 tag for a host. The commit makes the following config to be valid: config host option name 'computer' option mac '00:11:22:33:44:55' option ip '192.168.1.100' list tag 'vendor_class' list tag 'vendor_id' config tag 'vendor_class' list dhcp_option 'option:vendor-class,00:...<omitted>' config tag 'vendor_id' option force '1' list dhcp_option 'option:vendor-id-encap,00:...<omitted>' Signed-off-by: Kuang Rufan <kuangrufan@pset.suntec.net> Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* samba36-net: new packageAnsuel Smith2017-08-231-1/+14
| | | | | | Samba could also be usefull for sending commands to windows pc (like shoutdown command). This new package add the bin to include this kind of command to the samba package. Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
* dnsmasq: add ubus notifications for new leasesJohn Crispin2017-08-223-2/+143
| | | | Signed-off-by: John Crispin <john@phrozen.org>
* hostapd: add additional ubus notificationsJohn Crispin2017-08-223-2/+107
| | | | Signed-off-by: John Crispin <john@phrozen.org>
* odhcpd: update to latest git HEADHans Dedecker2017-08-161-3/+3
| | | | | | | 94e65ee ndp: use IPv4 address list when comparing IPv4 addresses ff5020d dhcpv6-ia: rework reconfigure accept logic Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* wpa_supplicant: log to syslog instead of stdoutStijn Tintel2017-08-101-1/+1
| | | | | | | | While debugging an issue with a client device, wpa_supplicant did not seem to log anything at all. Make wpa_supplicant log to syslog instead of stdout, to make debugging easier and to be consistent with hostapd. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* odhcpd: update to latest git HEAD (FS#402, FS#524)Hans Dedecker2017-08-031-3/+3
| | | | | | | 296b4a0 dhcpv6: assign all viable DHCPv6 addresses by default (FS#402, FS#524) f4d38e0 treewide: reflect managed mode is related to RA Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* samba36: Remove legacy optionsRosen Penev2017-07-222-8/+3
| | | | | | | | | | | | | Browseable is now set through LuCI per share, so remove it. Same with writeable (inverted synonym for read only). domain master and preferred master seem to be legacy settings for Windows 9x. encrypt passwords defaults to yes. Probably should not be disabled either. Also reordered alphabetically. Signed-off-by: Rosen Penev <rosenp@gmail.com> [rewrap commit message, fix SoB, fix author, bump pkg revsion] Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* dnsmasq: introduce config support for forced DHCP optionsJo-Philipp Wich2017-07-211-5/+9
| | | | | | | | | | | Introduce a new UCI list setting `list dhcp_option_force` which is available in sections of type `dnsmasq` and `dhcp`. The `dhcp_option_force` setting has the same semantics as `dhcp_option` but generates `dhcp-option-force` directives instead of `dhcp-option` ones in emitted native configuration. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* dnsmasq: backport remove ping check of configured dhcp addressHans Dedecker2017-07-182-1/+29
| | | | | | | Remove ping check in DHCPDISCOVER case as too many buggy clients leave an interface in configured state causing the ping check to fail. Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* dnsmasq: restore ability to include/exclude raw device namesJo-Philipp Wich2017-07-102-3/+3
| | | | | | | | | | | | | Commit 5cd88f4 "dnsmasq: remove use of uci state for getting network ifname" broke the ability to specify unmanaged network device names for inclusion and exclusion in the uci configuration. Restore support for raw device names by falling back to the input value when "network_get_device" yields no result. Fixes FS#876. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* odhcpd: update to the latest versionHans Dedecker2017-07-061-3/+3
| | | | | | | | | | | | f0d78e7 ndp: optimize check_addr6_updates code 94afe3b ndp: fix syslog tracing for netlink neigbor and address events 18df6cc treewide: rework logic to retrieve IPv6 interface addresses 803b83e router: use enum to specify order and index of iov struct 5dad295 treewide: rework code to get rid of fixed IPv6 address arrays 3e4c8ad config: rework code to get rid of IFNAMSIZ usage ab7813e treewide: use angle-brackets to include libubox header files Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* dnsmasq: dnsmasq --rev-server supportDUPONCHEEL Sébastien2017-07-032-1/+6
| | | | | | | | | | This is functionally the same as --server, but provides some syntactic sugar to make specifying address-to-name queries easier. For example --rev-server=1.2.3.0/24,192.168.0.1 is exactly equivalent to --server=/3.2.1.in-addr.arpa/192.168.0.1 Signed-off-by: DUPONCHEEL Sébastien <sebastien.duponcheel@corp.ovh.com>
* dnsmasq: backport patch fixing DNS failover (FS#841)Hans Dedecker2017-06-281-0/+31
| | | | | | | Backport upstream dnsmasq patch fixing DNS failover when first servers returns REFUSED in strict mode; fixes issue FS#841. Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* dropbear: add option to set max auth triesStijn Tintel2017-06-282-2/+4
| | | | | | | Add a uci option to set the new max auth tries paramater in dropbear. Set the default to 3, as 10 seems excessive. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* dropbear: server support option '-T' max auth triesKevin Darbyshire-Bryant2017-06-282-2/+132
| | | | | | | | | | | | Add support for '-T n' for a run-time specification for maximum number of authentication attempts where 'n' is between 1 and compile time option MAX_AUTH_TRIES. A default number of tries can be specified at compile time using 'DEFAULT_AUTH_TRIES' which itself defaults to MAX_AUTH_TRIES for backwards compatibility. Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
* hostapd: configure NAS ID regardless of encryptionYury Shvedov2017-06-281-3/+3
| | | | | | | | | | | RADIUS protocol could be used not only for authentication but for accounting too. Accounting could be configured for any type of networks. However there is no way to configure NAS Identifier for non-WPA networks without this patch. Signed-off-by: Yury Shvedov <yshvedov@wimarksystems.com> [cleanup commit message] Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* hostapd: add acct_interval optionYury Shvedov2017-06-281-2/+5
| | | | | | | | Make an ability to configure Accounting-Interim-Interval via UCI Signed-off-by: Yury Shvedov <yshvedov@wimarksystems.com> [add hostapd prefix, cleanup commit message] Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* dnsmasq: backport tweak ICMP ping logic for DHCPv4Hans Dedecker2017-06-262-1/+26
| | | | | | | | | | Don't start ping-check of address in DHCP discover if there already exists a lease for the address. It has been reported under some circumstances android and netbooted windows devices can reply to ICMP pings if they have a lease and thus block the allocation of the IP address the device already has during boot. Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* openvpn: update to 2.4.3Magnus Kroken2017-06-265-13/+14
| | | | | | | | | | | | | | | | | | | | Fixes for security and other issues. See security announcement for more details: https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243 * Remotely-triggerable ASSERT() on malformed IPv6 packet (CVE-2017-7508) * Pre-authentication remote crash/information disclosure for clients (CVE-2017-7520) * Potential double-free in --x509-alt-username (CVE-2017-7521) * Remote-triggerable memory leaks (CVE-2017-7512) * Post-authentication remote DoS when using the --x509-track option (CVE-2017-7522) * Null-pointer dereference in establish_http_proxy_passthru() * Restrict --x509-alt-username extension types * Fix potential 1-byte overread in TCP option parsing * Fix mbedtls fingerprint calculation * openssl: fix overflow check for long --tls-cipher option * Ensure option array p[] is always NULL-terminated * Pass correct buffer size to GetModuleFileNameW() (Quarkslabs finding 5.6) Signed-off-by: Magnus Kroken <mkroken@gmail.com>
* hostapd: add support for acs_chan_bias optionKevin Darbyshire-Bryant2017-06-242-2/+6
| | | | | | | | | | During auto channel selection we may wish to prefer certain channels over others. e.g. we can just squeeze 4 channels into europe so '1:0.8 5:0.8 9:0.8 13:0.8' does that. Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
* dnsmasq: add dhcp-range tags configurationGrégoire Delattre2017-06-202-2/+9
| | | | | | | | | | | | | | | | | | | dnsmasq can match tags in its dhcp-range configuration, this commit adds the option to configure it in the dhcp section uci configuration: config dhcp 'lan' option interface 'lan' list tag 'blue' list tag '!red' option start '10' option limit '150' option leasetime '12h' generated dnsmasq configuration: dhcp-range=tag:blue,tag:!red,set:lan,192.168.1.10,192.168.1.159,255.255.255.0,12h Signed-off-by: Grégoire Delattre <gregoire.delattre@gmail.com>
* dropbear: fix service trigger syntax errorKevin Darbyshire-Bryant2017-06-162-2/+2
| | | | | | The classic single '&' when double '&&' conditional was meant. Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
* Revert "dnsmasq: manage resolv.conf if when listening on 127.0.0.1#53"Hans Dedecker2017-06-142-36/+26
| | | | | | This reverts commit a53f8ba6771de64c9c82a2e6867791226f3003cb. Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* dnsmasq: manage resolv.conf if when listening on 127.0.0.1#53Paul Oranje2017-06-122-26/+36
| | | | | | | | | | With this patch the dnsmasq init script manages resolv.conf if and only if when dnsmasq will listen on 127.0.0.1#53 (is main resolver instance). Also, resolvfile is now set irrespective of the value of noresolv. Fixes (partially) FS#785 Signed-off-by: Paul Oranje <por@xs4all.nl>
* dnsmasq: make bind-dynamic 'non-wildcard' interfaces defaultKevin Darbyshire-Bryant2017-06-113-4/+6
| | | | | | | | | | | | | | | 'non-wildcard' interfaces enables dnsmasq's '--bind-dynamic' mode. This binds to interfaces rather than wildcard addresses *and* keeps track of interface comings/goings via a unique Linux api. Quoting dnsmasq's author "bind-dynamic (bind individual addresses, keep up with changes in interface config) ... On linux, there's actually no sane reason not to use --bind-dynamic, and it's only not the default for historical reasons." Let's change history, well on LEDE at least, and change the default! Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
* dnsmasq: add dhcp-script hook conditionallyHans Dedecker2017-06-092-2/+14
| | | | | | | | | | | | Commit b32689afd6a661339861086c669e15c936293cf8 added support for dhcp-script hook. Adding dhcp-script config option results into two instances of dnsmasq being run which triggered oom issues on platforms having low memory. The dnsmasq dhcp-script config option will now only be added if at least one of the dhcp, tftp, neigh hotplug dirs has a regular hotplug file or if the dhcpscript uci config option is specified. Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* umdns: remove superfluous include in init scriptJo-Philipp Wich2017-06-021-2/+0
| | | | | | | | | | | | | The umdns init script includes function/network.sh globally, outside of any service procedure. This causes init script activation to fail in buildroot and IB context if umdns is set to builtin. Additionally, the network.sh helper is not actually used. Drop the entire include in order to repair init script activation in build host context. Fixes FS#658. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* dnsmasq: bump to 2.77Kevin Darbyshire-Bryant2017-06-011-4/+4
| | | | | | Bump to the 2.77 release after quite a few test & release candidates. Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
* ppp: propagate master firewall zone to dynamic slave interfaceHans Dedecker2017-05-312-1/+4
| | | | | | | | | | Assign the virtual DHCPv6 interface the firewall zone of the parent interface so fw3 knows the zone to which the virtual DHCPv6 interface belongs. This guarantees the firewall settings are applied correctly for the virtual DHCPv6 interface and allows to query the zone to which the virtual DHCPv6 interface belongs via the fw3 network option. Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* openvpn-easy-rsa: update to 3.0.1Luiz Angelo Daros de Luca2017-05-315-169/+26
| | | | | | | | | | | | | | | | | | | | | | easy-rsa v3 is now a single script. It expects a 'vars' configuration file which path can be set using easy-rsa options, environment variables or just looking in the current directory. The default usage would be: # cd /etc/easy-rsa # easy-rsa COMMAND [command-options] Following upstream changes, /etc/easy-rsa/pki replaces /etc/easy-rsa/keys directory. The default /etc/easy-rsa/pki dir is marked to be kept during upgrade (WARN: priv keys are saved in the system backup) /etc/easy-rsa/openssl.1.0.cnf is now marked as config file while index and serial got removed. Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
* samba: bump PKG_RELEASEJo-Philipp Wich2017-05-271-1/+1
| | | | | | | | | | | The previous CVE bugfix commit did not adjust PKG_RELEASE, therefor the fixed samba package does not appear as opkg update. Bump the PKG_RELEASE to signify upgrades to downstream users. Ref: https://forum.lede-project.org/t/sambacry-are-lede-devices-affected/3972/4 Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* dnsmasq: add dhcp-script hook for other packagesNick Brassel2017-05-263-5/+59
| | | | | | | | | | | | | Adds a script which acts as a hook for when dnsmasq creates/destroys a lease, or completes a TFTP file transfer. The hook loops through scripts in appropriate directories inside '/etc/hotplug.d', executing each one with the same arguments supplied by dnsmasq. In case dnsmasq is jailed by ujail the dhcp-script hook will not work as expected as ujail does not yet support executing a script within a jail. Signed-off-by: Nick Brassel <nick@tzarc.org> Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* lldpd: bump to 0.9.7Stijn Tintel2017-05-241-2/+2
| | | | Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* samba: fix CVE-2017-7494Stijn Tintel2017-05-242-4/+33
| | | | Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* dnsmasq: bump to 2.77rc5Hans Dedecker2017-05-221-3/+3
| | | | | | | | | | | | | Some small tweaks and improvements : 9828ab1 Fix compiler warning. f77700a Fix compiler warning. 0fbd980 Fix compiler warning. 43cdf1c Remove automatic IDN support when building i18n. ff19b1a Fix &/&& confusion. 2aaea18 Add .gitattributes to substitute VERSION on export. Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* umdns: update to the version 2017-05-22Rafał Miłecki2017-05-221-3/+3
| | | | | | | | | | | | | | | | This includes following changes: 0e8b948 Support specifying instance name in JSON file 49fdb9f Support PTR queries for a specific service 26ce7dc Allow filtering with instance name in service_reply 920c62a Store instance name in the struct service ff09d9a Rename service_name function to the service_instance_name 64f78f1 Rename mdns_hostname variable to the umdns_host_label Previous package update pulled commit 70c66fbbcde86 ("Fix sending replies to PTR questions") which introduced a regression which this update fixes. Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* dropbear: bump to 2017.75Kevin Darbyshire-Bryant2017-05-212-17/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | - Security: Fix double-free in server TCP listener cleanup A double-free in the server could be triggered by an authenticated user if dropbear is running with -a (Allow connections to forwarded ports from any host) This could potentially allow arbitrary code execution as root by an authenticated user. Affects versions 2013.56 to 2016.74. Thanks to Mark Shepard for reporting the crash. CVE-2017-9078 https://secure.ucc.asn.au/hg/dropbear/rev/c8114a48837c - Security: Fix information disclosure with ~/.ssh/authorized_keys symlink. Dropbear parsed authorized_keys as root, even if it were a symlink. The fix is to switch to user permissions when opening authorized_keys A user could symlink their ~/.ssh/authorized_keys to a root-owned file they couldn't normally read. If they managed to get that file to contain valid authorized_keys with command= options it might be possible to read other contents of that file. This information disclosure is to an already authenticated user. Thanks to Jann Horn of Google Project Zero for reporting this. CVE-2017-9079 https://secure.ucc.asn.au/hg/dropbear/rev/0d889b068123 Refresh patches, rework 100-pubkey_path.patch to work with new authorized_keys validation. Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
* lldpd: drop specific respawn params [use system-wide]Alexandru Ardelean2017-05-181-3/+0
| | | | | | | I think I added these respawn params [a while back], when I did the conversion to procd init script format. Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* dnsmasq: add IPv6 nameserver configuration in server modeArjen de Korte2017-05-162-1/+11
| | | | | | | | | | | When in ra server mode, configure nameservers passed in router announcements from the dns value (which is already used by odhcpd). This also fixes FS#677 by using the global IPv6 address of the router instead of the link local address (if no nameservers are configured). Signed-off-by: Arjen de Korte <build+lede@de-korte.org> Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> [PKG_RELEASE increase]
* uhttpd: Enable integrated Lua by defaultAnsuel Smith2017-05-162-4/+17
| | | | | | We enabled lua interpreter by default as it doesn't make any problem in the uhttpd config file and we modify the index page to use it. Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
* odhcpd: update to git HEAD versionHans Dedecker2017-05-151-3/+3
| | | | | | | | | | | | | | | | | | 93abe6f config: fix invalid hoplimit in RA message 2ae08d1 config: fix invalid retranstime in RA message 0005cb4 config: fix invalid reachabletime in RA message 5683dd2 config: limit ra_mtu to 65535 f8d40a5 router: fix interface mtu read error f8f4b87 config: limit ra_retranstime to 60000 a2d8bf6 dhcpv4: display two hex digits per octet in syslog a9e9bc4 config: make RA retransTime configurable via uci 2cb6b48 config: make RA reachableTime configurable via uci e4504db config: make RA curHopLimit configurable via uci 9dd5316 config: make RA mtu configurable via UCI 29cb2ff config: fix dhcpv4 server being started 0ef74ec ndp.c: add switch/case fallthrough comments Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-08 17:00:30 +0000