aboutsummaryrefslogtreecommitdiffstats
path: root/package/network/services
Commit message (Collapse)AuthorAgeFilesLines
...
* dropbear: add config options for agent-forwarding supportSven Roederer2021-10-302-1/+13
| | | | | | | | | | * SSH agent forwarding might cause security issues, locally and on the jump machine (https://defn.io/2019/04/12/ssh-forwarding/). So allow to completely disabling it. * separate options for client and server * keep it enabled by default Signed-off-by: Sven Roederer <devel-sven@geroedel.de>
* umdns: add missing syscall to seccomp filterMichael Peleshenko2021-10-271-0/+1
| | | | | | | The 'madvise', syscall is missing. Found with 'utrace /usr/sbin/umdns' on an R7800 and RT3200. Signed-off-by: Michael Peleshenko <mpeleshenko@gmail.com>
* umdns: add missing syscall to seccomp filterMichael Peleshenko2021-10-231-0/+1
| | | | | | | The 'clock_gettime64', syscall is missing. Found with 'utrace /usr/sbin/umdns' on an R7800. Signed-off-by: Michael Peleshenko <mpeleshenko@gmail.com>
* hostapd: ubus: fix uninitialized pointerDavid Bauer2021-10-211-1/+1
| | | | | | | This fixes passing a bogus non-null pointer to the ubus handler in case the transition request is rejected. Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: fix up patches after the last commitFelix Fietkau2021-10-214-8/+8
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: fix a race condition on adding AP mode wds sta interfacesFelix Fietkau2021-10-212-1/+23
| | | | | | | | | | Both hostapd and netifd attempt to add a VLAN device to a bridge. Depending on which one wins the race, bridge vlan settings might be incomplete, or hostapd might run into an error and refuse to service the client. Fix this by preventing hostapd from adding interfaces to the bridge and instead rely entirely on netifd handling this properly Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: fix goto loop for ubus assoc handlerDavid Bauer2021-10-191-8/+7
| | | | | | | | | | When a ubus event handler denies a association with a non-zero return value, the code jumps to preceeding code, creating an endless loop until the event handler accepts the assc request. Move the ubus handler further up the code to avoid creating such a loop. Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: ubus: add BSS transtiton request methodDavid Bauer2021-10-131-40/+112
| | | | | | | | | | | | | | | | | | | | | | | | | | | The existing wnm_disassoc_imminent ubus method only supports issuing a bss transition request with the disassoc imminent flag set. For use-cases, where the client is requested to roam to another BSS without a pending disassoc, this existing method is not suitable. Add a new bss_transition_request ubus method, which provides a more universal way to dispatch a transition request. It takes the following arguments: Required: addr: String - MAC-address of the STA to send the request to (colon-seperated) Optional: abridged - Bool - Indicates if the abridged flag is set disassociation_imminent: Bool - Whether or not the disassoc_imminent flag is set disassociation_timer: I32 - number of TBTTs after which the client will be disassociated validity_period: I32 - number of TBTTs after which the beacon candidate list (if included) will be invalid neighbors: blob-array - Array of strings containing neighbor reports as hex-string Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: ubus: add notification for BSS transition responseDavid Bauer2021-10-133-0/+74
| | | | | | | | | To allow steering daemons to be aware of the STA-decided transition target, publish WNM transition responses to ubus. This way, steerings daemons can learn about STA-chosen targets and send a better selection of transition candidates. Signed-off-by: David Bauer <mail@david-bauer.net>
* umdns: add missing syscalls to seccomp filterRonny Kotzschmar2021-10-071-0/+3
| | | | | | | The 'mmap', 'mmap2', 'munmap' syscalls are missing. Found with 'utrace /usr/sbin/umdns'. Signed-off-by: Ronny Kotzschmar <ro.ok@me.com>
* dnsmasq: add explicit "set:" for client-matching optionsPaul Fertser2021-10-031-6/+6
| | | | | | | | | Bring the usage in line with the dnsmasq man page and the other options where set: is mandatory. No functional change. Signed-off-by: Paul Fertser <fercerpav@gmail.com>
* hostapd: fix segfault when deinit mesh ifacesJesus Fernandez Manzano2021-09-241-0/+5
| | | | | | | | | | | In hostapd_ubus_add_bss(), ubus objects are not registered for mesh interfaces. This provokes a segfault when accessing the ubus object in mesh deinit. This commit adds the same condition to hostapd_ubus_free_bss() for discarding those mesh interfaces. Signed-off-by: Jesus Fernandez Manzano <jesus.manzano@galgus.net>
* hostapd: let netifd set bridge port attributes for snoopingFelix Fietkau2021-09-211-1/+30
| | | | | | Avoids race conditions on bridge member add/remove Signed-off-by: Felix Fietkau <nbd@nbd.name>
* ustp: update to the latest versionFelix Fietkau2021-09-211-3/+3
| | | | | | | | c62d85cf7a0d bridge: check port bpdu filter status and apply it to the config 25555611be91 libnetlink: turn rtnetlink error answers into debug msgs 462b3a491347 build: use pthread cflags/ldflags Signed-off-by: Felix Fietkau <nbd@nbd.name>
* dnsmasq: add config option for connmark DNS filteringEtan Kissling2021-09-141-0/+12
| | | | | | | | | This adds uci support to configure connmark based DNS filtering. Signed-off-by: Etan Kissling <etan_kissling@apple.com> (imported from upstream mailing list https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2021q2/015151.html) Signed-off-by: Etan Kissling <etan.kissling@gmail.com>
* dnsmasq: Update to version 2.86Etan Kissling2021-09-142-5/+5
| | | | | | | | | | | | | | | | | | | | | Summary of upstream CHANGELOG: * Handle DHCPREBIND requests in the DHCPv6 server code. * Fix bug which caused dnsmasq to lose track of processes forked. * Major rewrite of the DNS server and domain handling code. * Revise resource handling for number of concurrent DNS queries. * Improve efficiency of DNSSEC. * Connection track mark based DNS query filtering. * Allow smaller than 64 prefix lengths in synth-domain. * Make domains generated by --synth-domain appear in replies when in authoritative mode. * Ensure CAP_NET_ADMIN capability is available when conntrack is configured. * When --dhcp-hostsfile --dhcp-optsfile and --addn-hosts are given a directory as argument, define the order in which files within that directory are read. * Support some wildcard matching of input tags to --tag-if. Signed-off-by: Etan Kissling <etan.kissling@gmail.com>
* hostapd: enable proxy-arp support for hostapd-fullDavid Bauer2021-08-283-0/+9
| | | | | | | | | | The hostapd.sh script already has support for configuring proxy-ARP, however no built variant has support for it enabled. Enable proxy-ARP support for hostapd-full builds in order to allow users to actually use this feature. Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: fix Proxy-ARP with Hotspot 2.0 disabledDavid Bauer2021-08-281-0/+51
| | | | | | | | | | | The disable_dgaf config fiels is only available in case Hostapd is compiled with Hotspot 2.0 support, however Proxy-ARP does not depend on Hotspot 2.0. Only add the code related to this config field when Hotspot 2.0 is enabled to fix compilation with the aformentioned preconditions. Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: refresh patchesDavid Bauer2021-08-286-12/+12
| | | | Signed-off-by: David Bauer <mail@david-bauer.net>
* ustp: add OpenWrt STP/RSTP daemonFelix Fietkau2021-08-262-0/+55
| | | | | | | | | This integrates with netifd in order to provide STP/RSTP protocol support in user space. It defaults to using RSTP for bridges with stp enabled. This daemon has no config files, it uses the configuration passed from netifd via ubus Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: enable ht40 in wpa_supplicant when using wider HE modesFelix Fietkau2021-08-241-1/+1
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* uhttpd: add config option for json_scriptStijn Tintel2021-08-242-2/+3
| | | | | | | | | | Add a config option for json_script instead of unconditionally including all json files in /etc/uhttpd in every uhttpd instance. This makes it possible to configure a single instance with an unconditional redirect, which currently renders all other uhttpd instances unusable. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> Acked-by: Felix Fietkau <nbd@nbd.name>
* odhcpd: update to latest git HEADHans Dedecker2021-08-231-3/+3
| | | | | | | 01b4e60 dhcpv4: fix uninitialized hostname in some ubus events 1666769 dhcpv6-ia: allow up to 64 bit wide hostid Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* lldpd: bump to 1.0.12Stijn Tintel2021-08-221-3/+3
| | | | Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* dropbear: allow to use with xinetdFritz D. Ansel2021-08-211-2/+0
| | | | | | | | | | | | | with xinetd allowed+blocked (ipv6) hosts could be set what is not possible with stock dropbear package The file size increased 12 Bytes, so this "opimisation" did not really helped. Within a compressed storage format it is 0.. ipk: 111.171 -> 111.361 = 190 bytes bin: 215.128 -> 215.140 = 12 bytes Signed-off-by: Fritz D. Ansel <fdansel@yandex.ru>
* hostapd: fix broken check in radar detection notificationFelix Fietkau2021-08-111-3/+0
| | | | | | | This check was accidentally left in after reworking the code, causing a segfault Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: respect fixed channel BW in HE20 modeJesus Fernandez Manzano2021-08-081-1/+1
| | | | | | | | When using htmode 'HE20' with a radio mode that uses wpa-supplicant (like mesh or sta), it will default to 40 MHz bw if disable_ht40 is not set. This commit fixes this behaviour. Signed-off-by: Jesus Fernandez Manzano <jesus.manzano@galgus.net>
* dnsmasq: reset EXTRA_MOUNT in the right placeDaniel Golle2021-08-011-2/+2
| | | | | | | | | EXTRA_MOUNT variable should be reset in dnsmasq_start() rather than just once at the beginning of the script. Fixes: ac4e8aa2f8 ("dnsmasq: fix more dnsmasq jail issues") Reported-by: Hartmut Birr <e9hack@gmail.com> Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* dnsmasq: fix more dnsmasq jail issuesDaniel Golle2021-08-011-10/+26
| | | | | | | | | | | | * remove superflus mounts of /dev/null and /dev/urandom * reset EXTRA_MOUNTS at the beginning of the script * add mount according to ignore_hosts_dir * don't add mount for file which is inside a directory already in the EXTRA_MOUNTS list Fixes: 59c63224e1 ("dnsmasq: rework jail mounts") Reported-by: Hartmut Birr <e9hack@gmail.com> Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* dnsmasq: rework jail mountsDaniel Golle2021-08-011-1/+7
| | | | | | | | | | | | * split into multiple lines to improve readability * use EXTRA_MOUNT for addnhosts instead of blindly adding /tmp/hosts * remove no longer needed mount for /sbin/hotplug-call * add dhcp-script.sh dependencies (jshn, ubus) Fixes: 3a94c2ca5c ("dnsmasq: add /tmp/hosts/ to jail_mount") Fixes: aed95c4cb8 ("dnsmasq: switch to ubus-based hotplug call") Reported-by: Stijn Tintel <stijn@linux-ipv6.be> Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* hostapd: add missing chunk for the snoop interface fixFelix Fietkau2021-07-281-4/+7
| | | | | Fixes: 7b46377a0cd9 ("hostapd: make the snooping interface (for proxyarp) configurable") Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: make proxyarp work with libnl-tinyFelix Fietkau2021-07-281-0/+275
| | | | | | Remove a dependency on libnl3-route Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: fix a segfault on sta disconnect with proxy arp enabledFelix Fietkau2021-07-281-0/+19
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: make the snooping interface (for proxyarp) configurableFelix Fietkau2021-07-282-0/+35
| | | | | | | Use the VLAN interface instead of the bridge, to ensure that hostapd receives untagged DHCP packets Signed-off-by: Felix Fietkau <nbd@nbd.name>
* dnsmasq: add /tmp/hosts/ to jail_mountNick Hainke2021-07-191-1/+1
| | | | | | | Programs like the olsr-name-plugin write hostname files to "/tmp/hosts/". If you don't add this to the jail_mount, dnsmasq can't read it anymore. Signed-off-by: Nick Hainke <vincent@systemli.org>
* odhcpd: fix invalid DHCPv6 ADVERTSIE with small configured leasetime (FS#3935)Hans Dedecker2021-07-181-3/+3
| | | | | | bc9d317 dhcpv6-ia: fix invalid preferred lifetime Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* hostapd: add "force" parameter for channel switchFelix Fietkau2021-07-151-1/+21
| | | | | | | This will restart the interface in case the CSA fails and can be used to force the device on a DFS channel (including full CAC) Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: fix uninitialized stack variable on CSAFelix Fietkau2021-07-121-0/+25
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: initialize ht/vht/he mode on channel switch by defaultFelix Fietkau2021-07-121-2/+24
| | | | | | Use the current mode, but allow overwriting via ubus command parameters Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: add support for enabling HE on channel switchFelix Fietkau2021-07-121-0/+3
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: make it possible to update station airtime weights via ubusFelix Fietkau2021-07-122-0/+99
| | | | | | This allows dynamic tuning based on other runtime information Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: add HE flag to get_clientsDavid Bauer2021-07-061-0/+1
| | | | | | Expose the hostapd HE flag via ubus to indicate HE capable devices. Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: remove unused mac_buff allocationMartin Weinelt2021-07-061-1/+0
| | | | Signed-off-by: Martin Weinelt <hexa@darmstadt.ccc.de>
* hostapd: report bssid, ssid and channel over ubusMartin Weinelt2021-07-061-0/+38
| | | | | | | | | Imports a function from iw to convert frequencies to channel numbers. Co-authored-by: David Bauer <mail@david-bauer.net> Signed-off-by: Martin Weinelt <hexa@darmstadt.ccc.de> [fix potential out of bounds read] Signed-off-by: David Bauer <mail@david-bauer.net>
* dnsmasq: use local option for local domain parameterKevin Darbyshire-Bryant2021-07-051-1/+1
| | | | | | | | | '--local' is a synonym for '--server' so let's use '--local' in the resultant config file for uci's 'local' instead of uci's local parameter being turned into '--server'. Slightly less confusion all round. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: distinct Ubus names for multiple instancesEtan Kissling2021-06-291-3/+29
| | | | | | | | | | | | | | | | | | | | | | | | Currently, when using multiple dnsmasq instances they are all assigned to the same Ubus instance name. This does not work, as only a single instance can register with Ubus at a time. In the log, this leads to `Cannot add object to UBus: Invalid argument` error messages. Furthermore, upstream 3c93e8eb41952a9c91699386132d6fe83050e9be changes behaviour so that instead of the log, dnsmasq exits at start instead. With this patch, all dnsmasq instances are assigned unique names so that they can register with Ubus concurrently. One of the enabled instances is always assigned the previous default name "dnsmasq" to avoid breaking backwards compatibility with other software relying on that default. Previously, a random instance got assigned that name (while the others produced error logs). Now, the first unnamed dnsmasq config section is assigned the default name. If there are no unnamed dnsmasq sections the first encountered named dnsmasq config section is assigned instead. A similar issue exists for Dbus and was similarly addressed. Signed-off-by: Etan Kissling <etan.kissling@gmail.com> [tweaked commit message] dnsmasq was not crashing it is exiting Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* Revert "dnsmasq: Update to version 2.86test3"Kevin Darbyshire-Bryant2021-06-262-5/+5
| | | | | | | | This reverts commit 3628870015ef46eacf2c936f36e3c1ed3b4c9855. dnsmasq v2.86test3 has some issues with ubus, so is being reverted. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* Revert "dnsmasq: add config option for connmark DNS filtering"Kevin Darbyshire-Bryant2021-06-261-12/+0
| | | | | | | | | This reverts commit dea4bae7c2b963af02e1e3e3bdb5cd656a5ea3d3. dnsmasq v2.86test3 has some issues with ubus and needs reverting, hence this needs reverting. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: add config option for connmark DNS filteringEtan Kissling2021-06-261-0/+12
| | | | | | | | This adds uci support to configure connmark based DNS filtering. Signed-off-by: Etan Kissling <etan_kissling@apple.com> (See https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2021q2/015151.html) Signed-off-by: Etan Kissling <etan.kissling@gmail.com>
* dnsmasq: Update to version 2.86test3Etan Kissling2021-06-262-5/+5
| | | | | | | | | | | | | | Need this version to add config option for connmark DNS filtering. Summary of upstream CHANGELOG: * Handle DHCPREBIND requests in the DHCPv6 server code. * Fix bug which caused dnsmasq to lose track of processes forked. * Major rewrite of the DNS server and domain handling code. * Revise resource handling for number of concurrent DNS queries. * Improve efficiency of DNSSEC. * Connection track mark based DNS query filtering. Signed-off-by: Etan Kissling <etan.kissling@gmail.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-25 13:23:29 +0000