aboutsummaryrefslogtreecommitdiffstats
path: root/package/network/services
Commit message (Collapse)AuthorAgeFilesLines
* hostapd: increase PKG_RELEASE to fix buildsNick Hainke2023-09-291-1/+1
| | | | | | | | Recent hostapd changes just edited the ucode files. It is required to bump the PKG_RELEASE to include the newest changes in the latest builds. Signed-off-by: Nick Hainke <vincent@systemli.org> (cherry picked from commit 91d2ead3c3bf75b279f861ad5d11b64bf31478f0)
* hostapd: fix wpa_supplicant mac address allocation on ap+staFelix Fietkau2023-09-281-9/+10
| | | | | | | | | | | | If the full interface is restarted while bringing up an AP, it can trigger a wpa_supplicant interface start before wpa_supplicant is notified of the allocated mac addresses. Fix this by moving the iface_update_supplicant_macaddr call to just after the point where mac addresses are allocated. Reported-by: Michael-cy Lee (李峻宇) <Michael-cy.Lee@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit abceef120d57bf066941882630a76788eb4985a9)
* hostapd: fix mac address of interfaces created via wdev.ucFelix Fietkau2023-09-271-1/+1
| | | | | | | Use the wdev config with the generated MAC address Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit 0c43a48735959245f18d79a6e908d3b45cff0a94)
* hostapd: fix rare crash with AP+STA and ACS enabledFelix Fietkau2023-09-271-13/+14
| | | | | | | | Ensure that the iface disable in uc_hostapd_iface_start also clears the ACS state. Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit f1bb528ae7631c60b95499b7e8a1948c3e6a42f0)
* hostapd: fix patch rebase after a crash fixFelix Fietkau2023-09-221-5/+5
| | | | | | | | | The patch refresh accidentally moved the hostapd_ucode_free_iface call to the wrong function Fixes: e9722aef9e84 ("hostapd: fix a crash when disabling an interface during channel list update") Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit 3a5ad6e3d74da713c0fc7d63b8026a56d16e198b)
* hostapd: fix wpa_supplicant bringup with non-nl80211 driversFelix Fietkau2023-09-221-0/+17
| | | | | | | Needed for wired 802.1x Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit fd6d7aafb2c3d335a3d192c308ffdace8d292e9f)
* hostapd: add missing NULL pointer check in uc_hostapd_iface_stopFelix Fietkau2023-09-201-0/+3
| | | | | | | Avoid crashing if the interface has already been removed Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit 4145ff4d8a29c1c7a1569bb06fa4d1fe9808c94f)
* hostapd: fix a crash when disabling an interface during channel list updateFelix Fietkau2023-09-202-4/+32
| | | | | Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit e9722aef9e84110331706f74f7de0942c8d657ed)
* hostapd: use phy name for hostapd interfaces instead of first-bss ifnameFelix Fietkau2023-09-193-9/+21
| | | | | | | Improves reliability in error handling Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit a511480368a03f754aa6ce7887633247a07ea166)
* hostapd: select libopenssl-legacy for openssl variantsFelix Fietkau2023-09-181-7/+8
| | | | | | | Without it, a lot of authentication modes fail without obvious error messages Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit 560965d5826626e3be8c1f1db194db43cc7002cf)
* hostapd: remove eap-eap192 auth type valueFelix Fietkau2023-09-181-12/+4
| | | | | | | It is no longer used Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit b0501d380f65ae9f82173b35b820c9c6adb92493)
* hostapd: support eap-eap2 and eap2 auth_type valuesFelix Fietkau2023-09-181-7/+15
| | | | | | | | WPA3 Enterprise-transitional requires optional MFP support and SHA1+SHA256 WPA3 Enterprise-only requires SHA1 support disabled and mandatory MFP. Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit b63df6ce5d0639e6106967fd445c96518da52afb)
* hostapd: fix FILS key mgmt type for WPA3 Enterprise 192 bitFelix Fietkau2023-09-181-0/+4
| | | | | | | Use the SHA384 variant to account for longer keys with more security Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit f0d1349b52983400e7526f3ab57dc6a0f2cc771a)
* hostapd: backport from master, including ucode based reload supportFelix Fietkau2023-09-1865-1474/+5265
| | | | | | | This significantly improves config reload behavior and also fixes some corner cases related to running AP + mesh interfaces at the same time. Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: revert upstream commit to fix #13156Stijn Tintel2023-08-191-0/+63
| | | | | | | | | | | | | Commit e978072baaca ("Do prune_association only after the STA is authorized") causes issues when an STA roams from one interface to another interface on the same PHY. The mt7915 driver is not able to handle this properly. While the commits fixes a DoS, there are other devices and drivers with the same limitation, so revert to the orginal behavior for now, until we have a better solution in place. Fixes: #13156 Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> (cherry picked from commit 324673914d42f5fb9b70cc73e955117828b99f3b)
* hostapd: add fix for dealing with VHT 160 MHz via ext nss bwFelix Fietkau2023-08-1511-15/+156
| | | | | Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit adfeda849198b33ffa7a7ef233ae8a4df22bbc2d)
* dropbear: add ed25519 for failsafe keyEtienne Champetier2023-07-261-2/+3
| | | | | | | | | | | | At least Fedora and RHEL 9 set RSAMinSize=2048, so when trying to use failsafe, we get 'Bad server host key: Invalid key length' To workaround the issue, we can use: ssh -o RSAMinSize=1024 ... Generating 2048 bits RSA is extremely slow, so add ed25519. We keep RSA 1024 to be as compatible as possible. Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com> (cherry picked from commit 6ac61dead99ff6b9df00c29b7a858772449718b2)
* hostapd: update to 2023-06-22Andre Heider2023-07-2032-202/+162
| | | | | | | | | | | | | | | Removed, merged upstream: - 170-wpa_supplicant-fix-compiling-without-IEEE8021X_EAPOL.patch Manually refreshed: - 040-mesh-allow-processing-authentication-frames-in-block.patch - 600-ubus_support.patch - 761-shared_das_port.patch Fixes: #12661 Fixes: 304423a4 ("hostapd: update to 2023-03-29") Signed-off-by: Andre Heider <a.heider@gmail.com> (cherry picked from commit cd804c1ebb34c9740f8ad9fe393a81f3efb7b009)
* uhttpd: update to latest git HEADHauke Mehrtens2023-06-251-3/+3
| | | | | | | 34a8a74 uhttpd/file: fix string out of buffer range on uh_defer_script Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit 7a6f6b812632a5983cd34ab5c41271d5d4de5fbf)
* odhcpd: bump to latest git HEADChristian Marangi2023-06-241-3/+3
| | | | | | | | 5211264 odhcpd: add support for dhcpv6_pd_min_len parameter c6bff6f router: Add PREF64 (RFC 8781) support Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> (cherry picked from commit acd9981b4ef750544202df9d9e2d0143a6dfd478)
* unetd: update to the latest versionFelix Fietkau2023-06-121-3/+3
| | | | | | | | | | | | 412d03012f13 network: prevent adding endpoint routes for addresses on the network faaf9cee6ef4 utils: fix ipv4 checksum issue 0e1c2fad3540 pex-msg: fix memory leak on fread fail in pex_msg_update_request_init 51be0ed659d0 host: fix crash parsing gateway when no endpoint is specified ca17601dc24e wg-linux: add support for splitting netlink messages for allowed ips 7d3986b7a5a2 wg-linux: increase default messages size Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit 7b1e8983365746876034534ef22004d423c390e0)
* lldpd: update to 1.0.17Nick Hainke2023-05-241-2/+2
| | | | | | | | | Release Notes: https://github.com/lldpd/lldpd/releases/tag/1.0.17 Signed-off-by: Nick Hainke <vincent@systemli.org> (cherry picked from commit 17fbbafdcbc55d6ab3d357012f336941fa27d43e) Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* dropbear: add ForceCommand uci optionNozomi Miyamori2023-05-201-0/+2
| | | | | | | | adds ForceCommand option. If the command is specified, it forces users to execute the command when they log in. Signed-off-by: Nozomi Miyamori <inspc43313@yahoo.co.jp> Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
* umdns: Update to umdns HEADMark Baker2023-05-181-4/+4
| | | | | | | | | Update to umdns HEAD to include latest enhancements for browse method filtering, return of TXT records as an array, dumping IPv4/6 as an array, and including the interface name in a browse reply. Signed-off-by: Mark Baker <mark@vpost.net> Tested-by: Stefan Lippers-Hollmann <s.l-h@gmx.de> #ipq807x, mt7621, x86_64
* treewide: replace AUTORELEASE with real PKG_RELEASETianling Shen2023-05-184-4/+4
| | | | | | | | | | | | | | | | | | Based on Paul Fertser <fercerpav@gmail.com>'s guidance: Change AUTORELEASE in rules.mk to: ``` AUTORELEASE = $(if $(DUMP),0,$(shell sed -i "s/\$$(AUTORELEASE)/$(call commitcount,1)/" $(CURDIR)/Makefile)) ``` then update all affected packages by: ``` for i in $(git grep -l PKG_RELEASE:=.*AUTORELEASE | sed 's^.*/\([^/]*\)/Makefile^\1^';); do make package/$i/clean done ``` Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
* bridger: update to the latest versionFelix Fietkau2023-05-121-3/+3
| | | | | | | | | | | | | | d4f56f0e6971 add support for handling traffic to/from the bridge device 3ea579064c00 nl: add separate socket for netlink commands 4ec5a51c6d01 nl: fetch packet stats for offloaded flows 0319fd080bf5 add support for configuring a fixed output port for a bridge member port 5b730f0c2cf5 bridger-bpf: fix build on older kernels 00af6c6e8350 nl: process IFLA_MASTER in any nl events, but skip wireless events a2794f95756e bridger-bpf: add bpf_skb_pull_data call 6974093eb036 nl: rework vlan code to use the iflink API d0f79a16c749 nl: do not attempt to enable flow offload on older kernels Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: update to 2023-03-29Nick Hainke2023-04-2254-587/+504
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add patches: - 170-wpa_supplicant-fix-compiling-without-IEEE8021X_EAPOL.patch Remove upstreamed: - 170-DPP-fix-memleak-of-intro.peer_key.patch - 461-driver_nl80211-use-new-parameters-during-ibss-join.patch - 800-acs-don-t-select-indoor-channel-on-outdoor-operation.patch - 992-openssl-include-rsa.patch Automatically refreshed: - 011-mesh-use-deterministic-channel-on-channel-switch.patch - 021-fix-sta-add-after-previous-connection.patch - 022-hostapd-fix-use-of-uninitialized-stack-variables.patch - 030-driver_nl80211-rewrite-neigh-code-to-not-depend-on-l.patch - 040-mesh-allow-processing-authentication-frames-in-block.patch - 050-build_fix.patch - 110-mbedtls-TLS-crypto-option-initial-port.patch - 120-mbedtls-fips186_2_prf.patch - 140-tests-Makefile-make-run-tests-with-CONFIG_TLS.patch - 150-add-NULL-checks-encountered-during-tests-hwsim.patch - 160-dpp_pkex-EC-point-mul-w-value-prime.patch - 200-multicall.patch - 300-noscan.patch - 310-rescan_immediately.patch - 330-nl80211_fix_set_freq.patch - 341-mesh-ctrl-iface-channel-switch.patch - 360-ctrl_iface_reload.patch - 381-hostapd_cli_UNKNOWN-COMMAND.patch - 390-wpa_ie_cap_workaround.patch - 410-limit_debug_messages.patch - 420-indicate-features.patch - 430-hostapd_cli_ifdef.patch - 450-scan_wait.patch - 460-wpa_supplicant-add-new-config-params-to-be-used-with.patch - 463-add-mcast_rate-to-11s.patch - 465-hostapd-config-support-random-BSS-color.patch - 500-lto-jobserver-support.patch - 590-rrm-wnm-statistics.patch - 710-vlan_no_bridge.patch - 720-iface_max_num_sta.patch - 730-ft_iface.patch - 750-qos_map_set_without_interworking.patch - 751-qos_map_ignore_when_unsupported.patch - 760-dynamic_own_ip.patch - 761-shared_das_port.patch - 990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch Manually refresh: - 010-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch - 301-mesh-noscan.patch - 340-reload_freq_change.patch - 350-nl80211_del_beacon_bss.patch - 370-ap_sta_support.patch - 380-disable_ctrl_iface_mib.patch - 464-fix-mesh-obss-check.patch - 470-survey_data_fallback.patch - 600-ubus_support.patch - 700-wifi-reload.patch - 711-wds_bridge_force.patch - 740-snoop_iface.patch Tested-by: Packet Please <pktpls@systemli.org> [Fritzbox 4040 (ipq40xx), EAP225-Outdoor (ath79); 802.11s, WPA3 OWE, and WPA3 PSK] Tested-by: Andrew Sim <andrewsimz@gmail.com> [mediatek/filogic] Signed-off-by: Nick Hainke <vincent@systemli.org>
* odhcpd: bump to latest git HEADChristian Marangi2023-04-041-3/+3
| | | | | | | | | 40ab806 config: use dedicated link local function to check interface a84bff2 netlink: add support for getting interface linklocal 2ea065f Revert "config: recheck have_link_local on interface reload if already init" 4b38e6b config: fix feature for enabling service only when interface RUNNING Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* dnsmasq: configure dynamic dhcp6 and dhcp4 independentlyIan Dall2023-04-011-2/+4
| | | | | | | | Given ipv6 has SLAAC it is quite plausible to wish to use dynamic dhcp4 but static dhcp6. This patch keeps dynamicdhcp as the default option for both, but is overridden by dynamicdhcpv6 or dynamicdhcpv4 Signed-off-by: Ian Dall <ian@beware.dropbear.id.au>
* dnsmasq: add dhcphostsfile to ujail sandboxRuben Jenster2023-04-011-0/+1
| | | | | | | The dhcphostsfile must be mounted into the (ujail) sandbox. The file can not be accessed without this mount. Signed-off-by: Ruben Jenster <rjenster@gmail.com>
* odhcpd: bump to latest git HEADChristian Marangi2023-03-241-3/+3
| | | | | | 29c934d config: recheck have_link_local on interface reload if already init Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* odhcpd: bump to latest git HEADChristian Marangi2023-03-221-4/+4
| | | | | | | | | | | 7c0f603 router: skip RA and wait for LINK-LOCAL to be assigned ba30afc config: skip interface setup if interface not IFF_RUNNING 06b111e Revert "odhcpd: Reduce error messages" 90d6cc9 odhcpd: Reduce error messages Also drop AUTORELEASE since it got deprecated. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* treewide: add support for "lto" in PKG_BUILD_FLAGSAndre Heider2023-03-216-17/+11
| | | | | | | | | | | | | | | | This reduces open coding and allows to easily add a knob to enable it treewide, where chosen packages can still opt-out via "no-lto". Some packages used LTO, but not the linker plugin. This unifies 'em all to attempt to produce better code. Quoting man gcc(1): "This improves the quality of optimization by exposing more code to the link-time optimizer." Also use -flto=auto instead of -flto=jobserver, as it's not guaranteed that every buildsystem uses +$(MAKE) correctly. Signed-off-by: Andre Heider <a.heider@gmail.com>
* treewide: add support for "gc-sections" in PKG_BUILD_FLAGSAndre Heider2023-03-213-7/+10
| | | | | | | | | | | | | | | This reduces open coding and allows to easily add a knob to enable it treewide, where chosen packages can still opt-out via "no-gc-sections". Note: libnl, mbedtls and opkg only used the CFLAGS part without the LDFLAGS counterpart. That doesn't help at all if the goal is to produce smaller binaries. I consider that an accident, and this fixes it. Note: there are also packages using only the LDFLAGS part. I didn't touch those, as gc might have been disabled via CFLAGS intentionally. Signed-off-by: Andre Heider <a.heider@gmail.com>
* treewide: replace PKG_USE_MIPS16:=0 with PKG_BUILD_FLAGS:=no-mips16Andre Heider2023-03-211-1/+1
| | | | | | | Keep backwards compatibility via PKG_USE_MIPS16 for now, as this is used in all package feeds. Signed-off-by: Andre Heider <a.heider@gmail.com>
* hostapd: enable radius server supportFelix Fietkau2023-03-071-1/+1
| | | | | | This is useful in combination with the built-in eap server support Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: add missing return code for the bss_mgmt_enable ubus methodFelix Fietkau2023-03-071-0/+2
| | | | | | Fixes bogus errors on ubus calls Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: add support for defining multiple acct/auth serversFelix Fietkau2023-03-071-25/+25
| | | | | | | This allows adding backup servers, in case the primary ones fail. Assume that port and shared secret are going to be the same. Signed-off-by: Felix Fietkau <nbd@nbd.name>
* dnsmasq: bump to v2.89Kevin Darbyshire-Bryant2023-02-253-5/+5
| | | | Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* hostapd: always use sae_password for mesh/SAE authLeon M. Busch-George2023-02-191-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes a corner case when using passwords that are exactly 64 characters in length with mesh mode or passwords longer than 63 characters with SAE because 'psk' is used instead of 'sae_password'. SAE is obligatory for 802.11s (mesh point). The 'psk' option for hostapd is suited for WPA2 and enforces length restrictions on passwords. Values of 64 characters are treated as PMKs. With SAE, PMKs are always generated during the handshake and there are no length restrictions. The 'sae_password' option is more suited for SAE and should be used instead. Before this patch, the 'sae_password' option is only used with mesh mode passwords that are not 64 characters long. As a consequence: - mesh passwords can't be 64 characters in length - SAE only works with passwords with lengths >8 and <=63 (due to psk limitation). Fix this by always using 'sae_password' with SAE/mesh and applying the PMK differentiation only when PSK is used. Fixes: #11324 Signed-off-by: Leon M. Busch-George <leon@georgemail.eu> [ improve commit description ] Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* hostapd: add quotes in assignmentsLeon M. Busch-George2023-02-191-6/+6
| | | | | | It's generally advised to use quotes for variable assignments in bash. Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
* odhcpd: bump to git HEADStijn Tintel2023-02-171-3/+3
| | | | | | | | dfab0fa dhcpv4: detect noarp interfaces 5a17751 router: improve RA logging edc5e17 router: always check ra_default Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* dnsmasq: refuse to add empty DHCP rangeLeon M. George2023-02-071-7/+6
| | | | | | | | | | | | Use ipcalc's return value to react to invalid range specifications. By simply ignoring the range instead of aborting with an error code, dnsmasq should still start when there's an error (best effort). Aborting the config generation or working with invalid range specs leaves dnsmasq crash-looping which is the right thing to do concerning that particular interface but it also hinders DHCP service on other interfaces and DNS on the router itself. Signed-off-by: Leon M. George <leon@georgemail.eu>
* bridger: update to the latest versionFelix Fietkau2023-01-291-3/+3
| | | | | | 8be8bb9df789 nl: fix accessing hairpin mode and isolated from the right attribute set Signed-off-by: Felix Fietkau <nbd@nbd.name>
* uhttpd: clean up MakefileAndre Heider2023-01-281-20/+1
| | | | | | | | | | | | uhttpd's cmake options all default to ON. Either we set all of them or none if the defaults need to be changed. Let's go with the latter. Because support for all modules is always compiled in, remove two unused and useless config toggles. uhttpd detects and uses libcrypt itself, no need to add it here again. Signed-off-by: Andre Heider <a.heider@gmail.com>
* relayd: bump to version 2023-01-28Hauke Mehrtens2023-01-281-3/+3
| | | | | | f646ba4 route: Fix compile warning with glibc Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* uhttpd: update to latest Git HEADHauke Mehrtens2023-01-281-3/+3
| | | | | | | 47561aa mimetypes: add audio/video support for apple airplay 6341357 ucode: respect all arguments passed to send() Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* dnsmasq: set an increased cachesize default valueHannu Nyman2023-01-211-0/+1
| | | | | | | | Dnsmasq DNS cache size is only 150 by default. Set the uci default value to 1000, so that cache gets used more and unnecessary DNS queries to upstream can be avoided. Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
* lldpd: use release tar instead of codeloadChristian Marangi2023-01-121-2/+2
| | | | | | | | | | | | | | | | | | | There is currently a problem with making reproducible version of lldpd. The tool version is generated based on 3 source: 1. .dist-version file in release tar 2. git hash with presence of .git directory 3. current date Using the codeload tar from github results in getting the repo without the .git directory and since they are not release tar, we don't have .dist-version. This results in having lldpd bin with a version set to the current build time. Switch to release tar so that we correctly have a .dist-version file and the version is not based on the build time. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> Reviewed-by: Robert Marko <robimarko@gmail.com>
* bridger: update to the latest versionFelix Fietkau2023-01-031-3/+3
| | | | | | | | | def7755c459d add missing copyright headers f68307fd96d7 add hairpin mode support 9ee8f433ba4e nl: do not pass NDA_VLAN with vid=0 978c1f9eed07 add support for the bridge port isolated flag Signed-off-by: Felix Fietkau <nbd@nbd.name>
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-13 09:51:47 +0000