aboutsummaryrefslogtreecommitdiffstats
path: root/package/network/services
Commit message (Collapse)AuthorAgeFilesLines
* hostapd: revert upstream commit to fix #13156Stijn Tintel2023-08-191-0/+63
| | | | | | | | | | | | | Commit e978072baaca ("Do prune_association only after the STA is authorized") causes issues when an STA roams from one interface to another interface on the same PHY. The mt7915 driver is not able to handle this properly. While the commits fixes a DoS, there are other devices and drivers with the same limitation, so revert to the orginal behavior for now, until we have a better solution in place. Fixes: #13156 Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> (cherry picked from commit 324673914d42f5fb9b70cc73e955117828b99f3b)
* hostapd: add fix for dealing with VHT 160 MHz via ext nss bwFelix Fietkau2023-08-1511-15/+156
| | | | | Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit adfeda849198b33ffa7a7ef233ae8a4df22bbc2d)
* dropbear: add ed25519 for failsafe keyEtienne Champetier2023-07-261-2/+3
| | | | | | | | | | | | At least Fedora and RHEL 9 set RSAMinSize=2048, so when trying to use failsafe, we get 'Bad server host key: Invalid key length' To workaround the issue, we can use: ssh -o RSAMinSize=1024 ... Generating 2048 bits RSA is extremely slow, so add ed25519. We keep RSA 1024 to be as compatible as possible. Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com> (cherry picked from commit 6ac61dead99ff6b9df00c29b7a858772449718b2)
* hostapd: update to 2023-06-22Andre Heider2023-07-2032-202/+162
| | | | | | | | | | | | | | | Removed, merged upstream: - 170-wpa_supplicant-fix-compiling-without-IEEE8021X_EAPOL.patch Manually refreshed: - 040-mesh-allow-processing-authentication-frames-in-block.patch - 600-ubus_support.patch - 761-shared_das_port.patch Fixes: #12661 Fixes: 304423a4 ("hostapd: update to 2023-03-29") Signed-off-by: Andre Heider <a.heider@gmail.com> (cherry picked from commit cd804c1ebb34c9740f8ad9fe393a81f3efb7b009)
* uhttpd: update to latest git HEADHauke Mehrtens2023-06-251-3/+3
| | | | | | | 34a8a74 uhttpd/file: fix string out of buffer range on uh_defer_script Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit 7a6f6b812632a5983cd34ab5c41271d5d4de5fbf)
* odhcpd: bump to latest git HEADChristian Marangi2023-06-241-3/+3
| | | | | | | | 5211264 odhcpd: add support for dhcpv6_pd_min_len parameter c6bff6f router: Add PREF64 (RFC 8781) support Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> (cherry picked from commit acd9981b4ef750544202df9d9e2d0143a6dfd478)
* unetd: update to the latest versionFelix Fietkau2023-06-121-3/+3
| | | | | | | | | | | | 412d03012f13 network: prevent adding endpoint routes for addresses on the network faaf9cee6ef4 utils: fix ipv4 checksum issue 0e1c2fad3540 pex-msg: fix memory leak on fread fail in pex_msg_update_request_init 51be0ed659d0 host: fix crash parsing gateway when no endpoint is specified ca17601dc24e wg-linux: add support for splitting netlink messages for allowed ips 7d3986b7a5a2 wg-linux: increase default messages size Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit 7b1e8983365746876034534ef22004d423c390e0)
* lldpd: update to 1.0.17Nick Hainke2023-05-241-2/+2
| | | | | | | | | Release Notes: https://github.com/lldpd/lldpd/releases/tag/1.0.17 Signed-off-by: Nick Hainke <vincent@systemli.org> (cherry picked from commit 17fbbafdcbc55d6ab3d357012f336941fa27d43e) Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* dropbear: add ForceCommand uci optionNozomi Miyamori2023-05-201-0/+2
| | | | | | | | adds ForceCommand option. If the command is specified, it forces users to execute the command when they log in. Signed-off-by: Nozomi Miyamori <inspc43313@yahoo.co.jp> Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
* umdns: Update to umdns HEADMark Baker2023-05-181-4/+4
| | | | | | | | | Update to umdns HEAD to include latest enhancements for browse method filtering, return of TXT records as an array, dumping IPv4/6 as an array, and including the interface name in a browse reply. Signed-off-by: Mark Baker <mark@vpost.net> Tested-by: Stefan Lippers-Hollmann <s.l-h@gmx.de> #ipq807x, mt7621, x86_64
* treewide: replace AUTORELEASE with real PKG_RELEASETianling Shen2023-05-184-4/+4
| | | | | | | | | | | | | | | | | | Based on Paul Fertser <fercerpav@gmail.com>'s guidance: Change AUTORELEASE in rules.mk to: ``` AUTORELEASE = $(if $(DUMP),0,$(shell sed -i "s/\$$(AUTORELEASE)/$(call commitcount,1)/" $(CURDIR)/Makefile)) ``` then update all affected packages by: ``` for i in $(git grep -l PKG_RELEASE:=.*AUTORELEASE | sed 's^.*/\([^/]*\)/Makefile^\1^';); do make package/$i/clean done ``` Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
* bridger: update to the latest versionFelix Fietkau2023-05-121-3/+3
| | | | | | | | | | | | | | d4f56f0e6971 add support for handling traffic to/from the bridge device 3ea579064c00 nl: add separate socket for netlink commands 4ec5a51c6d01 nl: fetch packet stats for offloaded flows 0319fd080bf5 add support for configuring a fixed output port for a bridge member port 5b730f0c2cf5 bridger-bpf: fix build on older kernels 00af6c6e8350 nl: process IFLA_MASTER in any nl events, but skip wireless events a2794f95756e bridger-bpf: add bpf_skb_pull_data call 6974093eb036 nl: rework vlan code to use the iflink API d0f79a16c749 nl: do not attempt to enable flow offload on older kernels Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: update to 2023-03-29Nick Hainke2023-04-2254-587/+504
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add patches: - 170-wpa_supplicant-fix-compiling-without-IEEE8021X_EAPOL.patch Remove upstreamed: - 170-DPP-fix-memleak-of-intro.peer_key.patch - 461-driver_nl80211-use-new-parameters-during-ibss-join.patch - 800-acs-don-t-select-indoor-channel-on-outdoor-operation.patch - 992-openssl-include-rsa.patch Automatically refreshed: - 011-mesh-use-deterministic-channel-on-channel-switch.patch - 021-fix-sta-add-after-previous-connection.patch - 022-hostapd-fix-use-of-uninitialized-stack-variables.patch - 030-driver_nl80211-rewrite-neigh-code-to-not-depend-on-l.patch - 040-mesh-allow-processing-authentication-frames-in-block.patch - 050-build_fix.patch - 110-mbedtls-TLS-crypto-option-initial-port.patch - 120-mbedtls-fips186_2_prf.patch - 140-tests-Makefile-make-run-tests-with-CONFIG_TLS.patch - 150-add-NULL-checks-encountered-during-tests-hwsim.patch - 160-dpp_pkex-EC-point-mul-w-value-prime.patch - 200-multicall.patch - 300-noscan.patch - 310-rescan_immediately.patch - 330-nl80211_fix_set_freq.patch - 341-mesh-ctrl-iface-channel-switch.patch - 360-ctrl_iface_reload.patch - 381-hostapd_cli_UNKNOWN-COMMAND.patch - 390-wpa_ie_cap_workaround.patch - 410-limit_debug_messages.patch - 420-indicate-features.patch - 430-hostapd_cli_ifdef.patch - 450-scan_wait.patch - 460-wpa_supplicant-add-new-config-params-to-be-used-with.patch - 463-add-mcast_rate-to-11s.patch - 465-hostapd-config-support-random-BSS-color.patch - 500-lto-jobserver-support.patch - 590-rrm-wnm-statistics.patch - 710-vlan_no_bridge.patch - 720-iface_max_num_sta.patch - 730-ft_iface.patch - 750-qos_map_set_without_interworking.patch - 751-qos_map_ignore_when_unsupported.patch - 760-dynamic_own_ip.patch - 761-shared_das_port.patch - 990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch Manually refresh: - 010-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch - 301-mesh-noscan.patch - 340-reload_freq_change.patch - 350-nl80211_del_beacon_bss.patch - 370-ap_sta_support.patch - 380-disable_ctrl_iface_mib.patch - 464-fix-mesh-obss-check.patch - 470-survey_data_fallback.patch - 600-ubus_support.patch - 700-wifi-reload.patch - 711-wds_bridge_force.patch - 740-snoop_iface.patch Tested-by: Packet Please <pktpls@systemli.org> [Fritzbox 4040 (ipq40xx), EAP225-Outdoor (ath79); 802.11s, WPA3 OWE, and WPA3 PSK] Tested-by: Andrew Sim <andrewsimz@gmail.com> [mediatek/filogic] Signed-off-by: Nick Hainke <vincent@systemli.org>
* odhcpd: bump to latest git HEADChristian Marangi2023-04-041-3/+3
| | | | | | | | | 40ab806 config: use dedicated link local function to check interface a84bff2 netlink: add support for getting interface linklocal 2ea065f Revert "config: recheck have_link_local on interface reload if already init" 4b38e6b config: fix feature for enabling service only when interface RUNNING Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* dnsmasq: configure dynamic dhcp6 and dhcp4 independentlyIan Dall2023-04-011-2/+4
| | | | | | | | Given ipv6 has SLAAC it is quite plausible to wish to use dynamic dhcp4 but static dhcp6. This patch keeps dynamicdhcp as the default option for both, but is overridden by dynamicdhcpv6 or dynamicdhcpv4 Signed-off-by: Ian Dall <ian@beware.dropbear.id.au>
* dnsmasq: add dhcphostsfile to ujail sandboxRuben Jenster2023-04-011-0/+1
| | | | | | | The dhcphostsfile must be mounted into the (ujail) sandbox. The file can not be accessed without this mount. Signed-off-by: Ruben Jenster <rjenster@gmail.com>
* odhcpd: bump to latest git HEADChristian Marangi2023-03-241-3/+3
| | | | | | 29c934d config: recheck have_link_local on interface reload if already init Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* odhcpd: bump to latest git HEADChristian Marangi2023-03-221-4/+4
| | | | | | | | | | | 7c0f603 router: skip RA and wait for LINK-LOCAL to be assigned ba30afc config: skip interface setup if interface not IFF_RUNNING 06b111e Revert "odhcpd: Reduce error messages" 90d6cc9 odhcpd: Reduce error messages Also drop AUTORELEASE since it got deprecated. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* treewide: add support for "lto" in PKG_BUILD_FLAGSAndre Heider2023-03-216-17/+11
| | | | | | | | | | | | | | | | This reduces open coding and allows to easily add a knob to enable it treewide, where chosen packages can still opt-out via "no-lto". Some packages used LTO, but not the linker plugin. This unifies 'em all to attempt to produce better code. Quoting man gcc(1): "This improves the quality of optimization by exposing more code to the link-time optimizer." Also use -flto=auto instead of -flto=jobserver, as it's not guaranteed that every buildsystem uses +$(MAKE) correctly. Signed-off-by: Andre Heider <a.heider@gmail.com>
* treewide: add support for "gc-sections" in PKG_BUILD_FLAGSAndre Heider2023-03-213-7/+10
| | | | | | | | | | | | | | | This reduces open coding and allows to easily add a knob to enable it treewide, where chosen packages can still opt-out via "no-gc-sections". Note: libnl, mbedtls and opkg only used the CFLAGS part without the LDFLAGS counterpart. That doesn't help at all if the goal is to produce smaller binaries. I consider that an accident, and this fixes it. Note: there are also packages using only the LDFLAGS part. I didn't touch those, as gc might have been disabled via CFLAGS intentionally. Signed-off-by: Andre Heider <a.heider@gmail.com>
* treewide: replace PKG_USE_MIPS16:=0 with PKG_BUILD_FLAGS:=no-mips16Andre Heider2023-03-211-1/+1
| | | | | | | Keep backwards compatibility via PKG_USE_MIPS16 for now, as this is used in all package feeds. Signed-off-by: Andre Heider <a.heider@gmail.com>
* hostapd: enable radius server supportFelix Fietkau2023-03-071-1/+1
| | | | | | This is useful in combination with the built-in eap server support Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: add missing return code for the bss_mgmt_enable ubus methodFelix Fietkau2023-03-071-0/+2
| | | | | | Fixes bogus errors on ubus calls Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: add support for defining multiple acct/auth serversFelix Fietkau2023-03-071-25/+25
| | | | | | | This allows adding backup servers, in case the primary ones fail. Assume that port and shared secret are going to be the same. Signed-off-by: Felix Fietkau <nbd@nbd.name>
* dnsmasq: bump to v2.89Kevin Darbyshire-Bryant2023-02-253-5/+5
| | | | Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* hostapd: always use sae_password for mesh/SAE authLeon M. Busch-George2023-02-191-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes a corner case when using passwords that are exactly 64 characters in length with mesh mode or passwords longer than 63 characters with SAE because 'psk' is used instead of 'sae_password'. SAE is obligatory for 802.11s (mesh point). The 'psk' option for hostapd is suited for WPA2 and enforces length restrictions on passwords. Values of 64 characters are treated as PMKs. With SAE, PMKs are always generated during the handshake and there are no length restrictions. The 'sae_password' option is more suited for SAE and should be used instead. Before this patch, the 'sae_password' option is only used with mesh mode passwords that are not 64 characters long. As a consequence: - mesh passwords can't be 64 characters in length - SAE only works with passwords with lengths >8 and <=63 (due to psk limitation). Fix this by always using 'sae_password' with SAE/mesh and applying the PMK differentiation only when PSK is used. Fixes: #11324 Signed-off-by: Leon M. Busch-George <leon@georgemail.eu> [ improve commit description ] Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* hostapd: add quotes in assignmentsLeon M. Busch-George2023-02-191-6/+6
| | | | | | It's generally advised to use quotes for variable assignments in bash. Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
* odhcpd: bump to git HEADStijn Tintel2023-02-171-3/+3
| | | | | | | | dfab0fa dhcpv4: detect noarp interfaces 5a17751 router: improve RA logging edc5e17 router: always check ra_default Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* dnsmasq: refuse to add empty DHCP rangeLeon M. George2023-02-071-7/+6
| | | | | | | | | | | | Use ipcalc's return value to react to invalid range specifications. By simply ignoring the range instead of aborting with an error code, dnsmasq should still start when there's an error (best effort). Aborting the config generation or working with invalid range specs leaves dnsmasq crash-looping which is the right thing to do concerning that particular interface but it also hinders DHCP service on other interfaces and DNS on the router itself. Signed-off-by: Leon M. George <leon@georgemail.eu>
* bridger: update to the latest versionFelix Fietkau2023-01-291-3/+3
| | | | | | 8be8bb9df789 nl: fix accessing hairpin mode and isolated from the right attribute set Signed-off-by: Felix Fietkau <nbd@nbd.name>
* uhttpd: clean up MakefileAndre Heider2023-01-281-20/+1
| | | | | | | | | | | | uhttpd's cmake options all default to ON. Either we set all of them or none if the defaults need to be changed. Let's go with the latter. Because support for all modules is always compiled in, remove two unused and useless config toggles. uhttpd detects and uses libcrypt itself, no need to add it here again. Signed-off-by: Andre Heider <a.heider@gmail.com>
* relayd: bump to version 2023-01-28Hauke Mehrtens2023-01-281-3/+3
| | | | | | f646ba4 route: Fix compile warning with glibc Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* uhttpd: update to latest Git HEADHauke Mehrtens2023-01-281-3/+3
| | | | | | | 47561aa mimetypes: add audio/video support for apple airplay 6341357 ucode: respect all arguments passed to send() Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* dnsmasq: set an increased cachesize default valueHannu Nyman2023-01-211-0/+1
| | | | | | | | Dnsmasq DNS cache size is only 150 by default. Set the uci default value to 1000, so that cache gets used more and unnecessary DNS queries to upstream can be avoided. Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
* lldpd: use release tar instead of codeloadChristian Marangi2023-01-121-2/+2
| | | | | | | | | | | | | | | | | | | There is currently a problem with making reproducible version of lldpd. The tool version is generated based on 3 source: 1. .dist-version file in release tar 2. git hash with presence of .git directory 3. current date Using the codeload tar from github results in getting the repo without the .git directory and since they are not release tar, we don't have .dist-version. This results in having lldpd bin with a version set to the current build time. Switch to release tar so that we correctly have a .dist-version file and the version is not based on the build time. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> Reviewed-by: Robert Marko <robimarko@gmail.com>
* bridger: update to the latest versionFelix Fietkau2023-01-031-3/+3
| | | | | | | | | def7755c459d add missing copyright headers f68307fd96d7 add hairpin mode support 9ee8f433ba4e nl: do not pass NDA_VLAN with vid=0 978c1f9eed07 add support for the bridge port isolated flag Signed-off-by: Felix Fietkau <nbd@nbd.name>
* treewide: Trigger reinstall of all wolfssl dependenciesHauke Mehrtens2023-01-011-1/+1
| | | | | | | | The ABI of the wolfssl library changed a bit between version 5.5.3 and 5.5.4. This release update will trigger a rebuild of all packages which are using wolfssl to make sure they are adapted to the new ABI. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* tree-wide: Do not use package librt and libpthreadHauke Mehrtens2022-12-291-5/+0
| | | | | | | | | | | The libraries libpthread, libdl, libutil, libanl have been integrated into the libc library in version 2.34. it is not needed to explicitly link them any more. Most of the functions have been moved from the librt.so into libc.so some time ago already. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* hostapd: allow sharing the incoming DAS port across multiple interfacesFelix Fietkau2022-12-271-0/+298
| | | | | | Use the NAS identifier to find the right receiver context on incoming messages Signed-off-by: Felix Fietkau <nbd@nbd.name>
* uhttpd: update to latest Git HEADHauke Mehrtens2022-12-261-4/+4
| | | | | | 2397755 client: fix incorrectly emitting HTTP 413 for certain content lengths Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* dnsmasq: bump to v2.88Kevin Darbyshire-Bryant2022-12-253-8/+8
| | | | | | | Most relevant feature for openwrt in this release, supports dynamically removing hosts from 'hostsdir' supplied host files. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* hostapd: add mbedtls variantRosen Penev2022-12-1911-12/+10188
| | | | | | | This adds the current WIP mbedtls patches for hostapd. The motivation here is to reduce size. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* hostapd: enable coredumpsFelix Fietkau2022-12-161-0/+2
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: always set a default for the nas identifierFelix Fietkau2022-12-161-2/+3
| | | | | | | It is used for both 802.11r and WPA enterprise. Setting it when not needed is harmless Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: add support for automatically setting RADIUS own-ip dynamicallyFelix Fietkau2022-12-162-2/+118
| | | | | | Some servers use the NAS-IP-Address attribute as a destination address Signed-off-by: Felix Fietkau <nbd@nbd.name>
* treewide: remove DRIVER_11N_SUPPORTAndre Heider2022-12-133-15/+0
| | | | | | | | | | | | hostapd's compile time option CONFIG_IEEE80211N was removed almost 3 years ago, 80.211n/HT is always included since then. Noticed because `hostapd -v11n` confusingly returned an error. See hostapd's commit: f3bcd69603 "Remove CONFIG_IEEE80211N build option" Signed-off-by: Andre Heider <a.heider@gmail.com>
* hostapd: fix 350-nl80211_del_beacon_bss.patchAndre Heider2022-12-131-1/+1
| | | | | | | | | | | | | | | | | Pass the expected struct: ../src/drivers/driver_nl80211.c: In function 'wpa_driver_nl80211_del_beacon': ../src/drivers/driver_nl80211.c:2945:31: warning: passing argument 1 of 'nl80211_bss_msg' from incompatible pointer type [-Wincompatible-pointer-types] 2945 | msg = nl80211_bss_msg(drv, 0, NL80211_CMD_DEL_BEACON); | ^~~ | | | struct wpa_driver_nl80211_data * ../src/drivers/driver_nl80211.c:695:50: note: expected 'struct i802_bss *' but argument is of type 'struct wpa_driver_nl80211_data *' 695 | struct nl_msg * nl80211_bss_msg(struct i802_bss *bss, int flags, uint8_t cmd) | ~~~~~~~~~~~~~~~~~^~~ Fixes: 35ff1affe8 "hostapd: update to 2022-05-08" Signed-off-by: Andre Heider <a.heider@gmail.com>
* hostapd: remove an unused function from ubus.cAndre Heider2022-12-131-26/+0
| | | | | | | eee80211_frequency_to_channel() isn't used anymore, which is a leftover from: 2a31e9ca97 "hostapd: add op-class to get_status output" Signed-off-by: Andre Heider <a.heider@gmail.com>
* hostapd: use wpa_supplicant for unencrypted mesh connectionsFelix Fietkau2022-12-102-2/+6
| | | | | | It's more reliable than using iw Signed-off-by: Felix Fietkau <nbd@nbd.name>
* dnsmasq: add option to expose additional paths to jailDaniel Golle2022-11-272-1/+8
| | | | | | | | | | Add new UCI list 'addn_mount' allowing the expose additional filesystem paths to the jailed dnsmasq process. This is useful e.g. in case of manually configured includes to the configuration file or symlinks pointing outside of the exposed paths as used by e.g. the safe-search package in the packages feed. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-20 21:07:23 +0000