aboutsummaryrefslogtreecommitdiffstats
path: root/package/network
Commit message (Collapse)AuthorAgeFilesLines
...
* mdns: update and rename package to the umdnsRafał Miłecki2017-02-154-24/+24
| | | | | | | | | | | | | | This update includes numerous small fixes for: 1) Interfaces setup 2) Packets parsing 3) Sending replies Without this there were multiple problems with exchanging information between (u)mdns and other implementations (including (u)mdns as well). This also follows project rename to umdns which was required to avoid confusion with Apple's mdnsd from mDNSResponder project. Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* odhcpd: update to git HEAD version (FS#396)Hans Dedecker2017-02-091-3/+3
| | | | | | | | | 8df4253 ndp: harden netlink event socket error handling b02f3e6 ndp: close proc file descriptor also during error handling 8a615ad npd: rework IPv6 relay logic (FS#396) 0129f79 config: restore interface defaults when cleaning interface Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* odhcpd: update to git HEAD version (FS#388)Hans Dedecker2017-02-091-5/+5
| | | | | | | | 3317c86 dhcpv6-ia: apply lease delete based on assignment bound state df50429 odhcpd: properly handle netlink messages (FS#388) 83d72cf odhcpd: fix coding style Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* tcpdump: update to version 4.9.0Hauke Mehrtens2017-02-064-81/+81
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes the following 41 security problems: + CVE-2016-7922: buffer overflow in print-ah.c:ah_print(). + CVE-2016-7923: buffer overflow in print-arp.c:arp_print(). + CVE-2016-7924: buffer overflow in print-atm.c:oam_print(). + CVE-2016-7925: buffer overflow in print-sl.c:sl_if_print(). + CVE-2016-7926: buffer overflow in print-ether.c:ethertype_print(). + CVE-2016-7927: buffer overflow in print-802_11.c:ieee802_11_radio_print(). + CVE-2016-7928: buffer overflow in print-ipcomp.c:ipcomp_print(). + CVE-2016-7929: buffer overflow in print-juniper.c:juniper_parse_header(). + CVE-2016-7930: buffer overflow in print-llc.c:llc_print(). + CVE-2016-7931: buffer overflow in print-mpls.c:mpls_print(). + CVE-2016-7932: buffer overflow in print-pim.c:pimv2_check_checksum(). + CVE-2016-7933: buffer overflow in print-ppp.c:ppp_hdlc_if_print(). + CVE-2016-7934: buffer overflow in print-udp.c:rtcp_print(). + CVE-2016-7935: buffer overflow in print-udp.c:rtp_print(). + CVE-2016-7936: buffer overflow in print-udp.c:udp_print(). + CVE-2016-7937: buffer overflow in print-udp.c:vat_print(). + CVE-2016-7938: integer overflow in print-zeromq.c:zmtp1_print_frame(). + CVE-2016-7939: buffer overflow in print-gre.c, multiple functions. + CVE-2016-7940: buffer overflow in print-stp.c, multiple functions. + CVE-2016-7973: buffer overflow in print-atalk.c, multiple functions. + CVE-2016-7974: buffer overflow in print-ip.c, multiple functions. + CVE-2016-7975: buffer overflow in print-tcp.c:tcp_print(). + CVE-2016-7983: buffer overflow in print-bootp.c:bootp_print(). + CVE-2016-7984: buffer overflow in print-tftp.c:tftp_print(). + CVE-2016-7985: buffer overflow in print-calm-fast.c:calm_fast_print(). + CVE-2016-7986: buffer overflow in print-geonet.c, multiple functions. + CVE-2016-7992: buffer overflow in print-cip.c:cip_if_print(). + CVE-2016-7993: a bug in util-print.c:relts_print() could cause a buffer overflow in multiple protocol parsers (DNS, DVMRP, HSRP, IGMP, lightweight resolver protocol, PIM). + CVE-2016-8574: buffer overflow in print-fr.c:frf15_print(). + CVE-2016-8575: buffer overflow in print-fr.c:q933_print(). + CVE-2017-5202: buffer overflow in print-isoclns.c:clnp_print(). + CVE-2017-5203: buffer overflow in print-bootp.c:bootp_print(). + CVE-2017-5204: buffer overflow in print-ip6.c:ip6_print(). + CVE-2017-5205: buffer overflow in print-isakmp.c:ikev2_e_print(). + CVE-2017-5341: buffer overflow in print-otv.c:otv_print(). + CVE-2017-5342: a bug in multiple protocol parsers (Geneve, GRE, NSH, OTV, VXLAN and VXLAN GPE) could cause a buffer overflow in print-ether.c:ether_print(). + CVE-2017-5482: buffer overflow in print-fr.c:q933_print(). + CVE-2017-5483: buffer overflow in print-snmp.c:asn1_parse(). + CVE-2017-5484: buffer overflow in print-atm.c:sig_print(). + CVE-2017-5485: buffer overflow in addrtoname.c:lookup_nsap(). + CVE-2017-5486: buffer overflow in print-isoclns.c:clnp_print(). The size of the package is only incread very little: new size: 306430 tcpdump_4.9.0-1_mips_24kc.ipk 130324 tcpdump-mini_4.9.0-1_mips_24kc.ipk old size: 302782 tcpdump_4.8.1-1_mips_24kc.ipk 129033 tcpdump-mini_4.8.1-1_mips_24kc.ipk Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* hostapd: enable support for logging wpa_printf messages to syslogRafał Miłecki2017-02-052-0/+6
| | | | | | | This will allow starting hostapd with the new -s parameter and finally read all (error) messages from the syslog. Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* hostapd: backport support for sending debug messages to the syslogRafał Miłecki2017-02-056-24/+169
| | | | | | | | | | | | | | | | | It wasn't possible to read hostapd wpa_printf messages unless running hostapd manually. It was because hostapd was printing them using vprintf and not directly to the syslog. We were trying to workaround this problem by redirecting STDIN_FILENO and STDOUT_FILENO but it was working only for the initialization phase. As soon as hostapd did os_daemonize our solution stopped working. Please note despite the subject this change doesn't affect debug level messages only but just everything printed by hostapd with wpa_printf including MSG_ERROR-s. This makes it even more important as reading error messages can be quite useful for debugging. Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* ccache, samba36: fix samba.org addresses to use httpsHannu Nyman2017-02-022-5/+5
| | | | | | | | | | | | samba.org has started to enforce https and currently plain http downloads with curl/wget fail, so convert samba.org download links to use https. Modernise links at the same time. Also convert samba.org URL fields to have https. Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
* Fix dependency for hostapdWilco Baan Hofman2017-02-011-1/+1
| | | | Signed-off-by: Wilco Baan Hofman <wilco@baanhofman.nl>
* iproute2: cake: update cake supportKevin Darbyshire-Bryant2017-02-012-11/+24
| | | | | | | Updated cake's tc patch to match the official cake repository formatting. Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
* odhcp6c: use LEDE_GIT in package source urlHans Dedecker2017-02-011-1/+1
| | | | Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* odhcp6c: update to git HEAD versionHans Dedecker2017-02-011-3/+3
| | | | | | | | | | c13b6a0 dhcpv6: fix white space error e9d80cc dhcpv6: trigger restart of DHCPv6 state machine when not receiving statefull options c7122ec update README 419fb63 dhcpv6: server unicast option support Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* odhcpd: use LEDE_GIT in package source urlHans Dedecker2017-02-011-1/+1
| | | | Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* odhcpd: update to git HEAD versionHans Dedecker2017-02-011-3/+3
| | | | | | | | c4f9ace odhcpd: decrease default log level to LOG_INFO a6eadd7 odhcpd: rework IPv6 interface address dump 44965f1 odhcpd: extra syslog tracing Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* odhcpd: update to git HEAD versionHans Dedecker2017-02-011-3/+3
| | | | | | e447ff9 router: fix compile issue on 64 bit systems Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* odhcpd: update to git HEAD versionHans Dedecker2017-02-011-3/+3
| | | | | | | | | | | | 237f1f4 router: convert syslog lifetime traces into LOG_INFO prio da660c7 treewide: rework prio of syslog messages 0485580 ndp: code cleanup c5040fe router: add syslog debug tracing for trouble shooting df023ad treewide: use RELAYD_MAX_ADDRS as address array size c8ac572 ndp: don't scan netlink attributes in case of netlink route event Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* netifd: update to git HEAD versionHans Dedecker2017-02-011-3/+3
| | | | | | 650758b interface-ip: route proto config support (FS#170) Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* openvpn: ssl-enabled variants also provide a virtual openvpn-crypto packageSven Roederer2017-02-011-1/+5
| | | | | | | | | | When relying on x.509 certs for auth and / or encryption of traffic you can't use package openvpn-nossl. Just have your package depend on openvpn-crypto to have SSL-encryption and X.509-support enabled in OpenVPN. If encryption / X.509 is not a must, use virtual packge openvpn, which is provided by all OpenVPN-variants. Signed-off-by: Sven Roederer <devel-sven@geroedel.de>
* iproute2: cake: add 'mpu' minimum packet length supportKevin Darbyshire-Bryant2017-02-012-4/+28
| | | | | | | Add 'mpu' minimum length packet size parameter for scheduling/bandwidth accounting. Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
* hostapd: default to wps_independent 1Steven Honson2017-02-011-1/+2
| | | | Signed-off-by: Steven Honson <steven@honson.id.au>
* hostapd: expose wps_independent and ap_setup_locked as uci optionsSteven Honson2017-02-011-3/+5
| | | | | | | ap_setup_locked is named wps_ap_setup_locked in uci for consistency with other wps related uci options. Signed-off-by: Steven Honson <steven@honson.id.au>
* mdns: update to the latest versionFelix Fietkau2017-01-311-3/+3
| | | | | | | - fixes unaligned acccesses, causing DNS parsing issues on ARMv5 - fixes service timeout handling Signed-off-by: Felix Fietkau <nbd@nbd.name>
* openvpn: add support for various new 2.4 configuration optionsMagnus Kroken2017-01-281-24/+19
| | | | | | | Updates to openvpn.init were included in early OpenVPN 2.4 patch series, but got lost along the way and were never merged. Signed-off-by: Magnus Kroken <mkroken@gmail.com>
* packages: mark packages depending on a target as nonsharedMathias Kresin2017-01-241-0/+2
| | | | | | | | | The packages can't be build as shared packages due to the unmet dependencies. Fixes FS#418. Signed-off-by: Mathias Kresin <dev@kresin.me>
* hostapd: fix stray "out of range" shell errors in hostapd.shJo-Philipp Wich2017-01-232-3/+3
| | | | | | | | | | | | The hostapd_append_wpa_key_mgmt() procedure uses the possibly uninitialized $ieee80211r and $ieee80211w variables in a numerical comparisation, leading to stray "netifd: radio0 (0000): sh: out of range" errors in logread when WPA-PSK security is enabled. Ensure that those variables are substituted with a default value in order to avoid emitting this (harmless) shell error. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* openvpn: let all openvpn variants provide a virtual openvpn packageJo-Philipp Wich2017-01-211-1/+2
| | | | | | | | | | Add PROVIDES:=openvpn to the default recipe in order to let all build variants provide a virtual openvpn package. The advantage of this approach is that downstream packages can depend on just "openvpn" without having to require a specific flavor. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* netifd: update to git HEAD versionHans Dedecker2017-01-171-2/+2
| | | | | | a057f6e device: fix DEV_OPT_SENDREDIRECTS definition Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* curl: fix HTTPS network timeouts with OpenSSLStijn Segers2017-01-161-0/+36
| | | | | | | | | Backport an upstream change to fix HTTPS timeouts with OpenSSL. Upstream curl bug #1174. Signed-off-by: Stijn Segers <francesco.borromini@inventati.org> [Jo-Philipp Wich: reword commit message, rename patch to 001-*] Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* hostapd: fix passing jobserver to hostapd/supplicant build processesFelix Fietkau2017-01-151-3/+3
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: backport a few upstream fixesFelix Fietkau2017-01-155-4/+163
| | | | | | | | Fixes reassoc issues with WDS mode Fixes reassoc issues in AP mode Fixes IBSS reauthentication issues Signed-off-by: Felix Fietkau <nbd@nbd.name>
* firewall: fix forwarding local subnet trafficJo-Philipp Wich2017-01-131-3/+3
| | | | | | | | | | | | | Packets which are merely forwarded by the router and which are neither involved in any DNAT/SNAT nor originate locally, are considered INVALID from a conntrack point of view, causing them to get dropped in the zone_*_dest_ACCEPT chains, since those only allow stream with state NEW or UNTRACKED. Remove the ctstate restriction on dest accept chains to properly pass- through unrelated 3rd party traffic. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* dnsmasq: use ubus signalling in ntp hotplug scriptKevin Darbyshire-Bryant2017-01-131-3/+3
| | | | | | | Use ubus process signalling instead of 'kill pidof dnsmasq' for SIGHUP signalling to dnsmasq when ntp says time is valid. Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
* netifd: update to the latest versionFelix Fietkau2017-01-131-3/+3
| | | | | | | This disables IGMP snooping by default, which was causing various issues over time, like FS#95 Signed-off-by: Felix Fietkau <nbd@nbd.name>
* uqmi: mark as nonshared because of the usb dependenciesFelix Fietkau2017-01-131-0/+2
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* umbim: mark as nonshared because of the usb dependenciesFelix Fietkau2017-01-131-0/+2
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* comgt: mark as nonshared because of the usb dependenciesFelix Fietkau2017-01-131-0/+2
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* map: take over maintainershipHans Dedecker2017-01-121-1/+1
| | | | | Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> Acked-by: Jo-Philipp Wich <jo@mein.io>
* odhcp6c: take over maintainershipHans Dedecker2017-01-121-1/+1
| | | | | Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> Acked-by: Jo-Philipp Wich <jo@mein.io>
* odhcpd: take over maintainershipHans Dedecker2017-01-121-1/+1
| | | | | Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> Acked-by: Jo-Philipp Wich <jo@mein.io>
* Revert "dnsmasq: change 'add_local_hostname' to use dnsmasq '--interface-name'"Hans Dedecker2017-01-122-31/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This causes problem when a FQDN is configured in /etc/config/system. The domain name will appear twice in reverse DNS. Next to that, there seems to be a bug in dnsmasq. From the manual page: --interface-name=<name>,<interface>[/4|/6] Return a DNS record associating the name with the primary address on the given interface. This flag specifies an A or AAAA record for the given name in the same way as an /etc/hosts line, except that the address is not constant, but taken from the given interface. The interface may be followed by "/4" or "/6" to specify that only IPv4 or IPv6 addresses of the interface should be used. If the interface is down, not configured or non-existent, an empty record is returned. The matching PTR record is also created, mapping the interface address to the name. More than one name may be associated with an interface address by repeating the flag; in that case the first instance is used for the reverse address-to-name mapping. It does not just create an A/AAAA record for the primary address, it creates one for all addresses. And what is worse, it seems to actually resolve to the non-primary address first. This is quite annoying when you use floating IP addresses (e.g. VRRP), because when the floating IP is on the other device, SSH failes due to incorrect entry in the known hosts file. I know that this is not a common setup, but it would be nice if there was an option to restore the previous behaviour, rather than just forcing this new feature on everybody. Reported-by: Stijn Tintel <stijn@linux-ipv6.be> Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* map: delete map-t device when tearing down map interfaceHans Dedecker2017-01-122-2/+12
| | | | | | | | | | | | Delete the map-t device when tearing down the map-t interface; as such there's no conflict when the map-t interface comes up again when trying to add the map-t device as the map-t device was still present (Can not add: device 'map-wan6_4' already exists!). Only call ifdown in teardown for map-e and lw6o4 map interfaces types in order to suppress the trace "wan6_4 (6652): Interface wan6_4_ not found" Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* Revert the recent dependency and metadata scanning reworkFelix Fietkau2017-01-113-3/+3
| | | | | | | | | | | | | | | This reverts the following commits: fbe522d1204149b6c128d55e360bfc15fa8258e1 278ad007ee03c4455c3507322e34b0e3e6ec050d 863888e44f7a1fb1675a2e7a2eaabfec3561d2a2 96daf6352f6e04bc22789466cb5409b93fbec191 cfd83555fc4f0bab18a26f6812da18e64df46ff3 This seems to trigger some mconf bugs when built with all feeds packages, so I will try to find a less intrusive solution before the release. Signed-off-by: Felix Fietkau <nbd@nbd.name>
* comgt: allow build without USB_SUPPORTFelix Fietkau2017-01-111-1/+1
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* umbim: allow build without USB_SUPPORTFelix Fietkau2017-01-111-1/+1
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* uqmi: allow build without USB_SUPPORTFelix Fietkau2017-01-111-1/+1
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* wpa_supplicant: Fix mesh encryption configSujith Manoharan2017-01-111-1/+4
| | | | | | | | | | | | | | | wpa_supplicant allows only SAE as the key management type for mesh mode. The recent key_mgmt rework unconditionally added WPA-PSK - this breaks interface bringup and wpa_s throws this error message: Line 10: key_mgmt for mesh network should be open or SAE Line 10: failed to parse network block. Failed to read or parse configuration '/var/run/wpa_supplicant-wlan0.conf Fix this by making sure that only SAE is used for mesh. Signed-off-by: Sujith Manoharan <m.sujith@gmail.com>
* lldpd: take over maintainershipStijn Tintel2017-01-101-1/+1
| | | | | Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> Acked-by: Jo-Philipp Wich <jo@mein.io>
* lldpd: add Net-SNMP AgentX supportStijn Tintel2017-01-104-2/+15
| | | | | | | Enabling this makes it possible to query LLDP neighbors via SNMP. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> Acked-by: Jo-Philipp Wich <jo@mein.io>
* iwinfo: drop references to madwifiStijn Tintel2017-01-101-3/+1
| | | | | Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> Acked-by: Jo-Philipp Wich <jo@mein.io>
* odhcp6c: add option "keep_ra_dnslifetime"Hans Dedecker2017-01-092-5/+8
| | | | | | | | | | Add option keep_ra_dnslifetime which will preserve the received lifetime for RDNSS and DNSSL RA records and not overwrite it by the RA router lifetime as specified in RFC6106. This allows to accept RDNNS records from RAs that don't announce a default route by setting router lifetime to 0 in the RAs. Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* odhcpd: bump to git HEADHans Dedecker2017-01-071-3/+3
| | | | | | | | | | ef3c563 dhcpv6-ia: filter out prefixes having invalid length 16cd87e dhcpv6-ia: fix dereference after freeing assignment d6b0c99 dhcpv6-ia: log only IPv6 addresses which are effectively assigned to a DHCPv6 client 08a9367 config: respect ignore uci option Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-12 16:24:42 +0000