aboutsummaryrefslogtreecommitdiffstats
path: root/package/network
Commit message (Collapse)AuthorAgeFilesLines
* firewall: small improvements in nat reflectionJo-Philipp Wich2013-10-101-2/+2
| | | | | | | - do not insert duplicate rules when setting up reflection to a zone containing multiple interfaces - set up reflection for any protocol, not just TCP and UDP SVN-Revision: 38361
* ppp: correct module loaded check in proto_pptp_setupJo-Philipp Wich2013-10-101-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | proto_pptp_setup is responsible for loading the required modules to establish a pptp connection to a foreign peer. The function checks whether all required modules are already loaded, before actually loading them. It seems that the filter being used to accomplish this, is not restrictive enough in some cases. For instance when pptp nat helper modules are present on a system, and already loaded before a pptp connection is enabled. Then the search filter (possibly) returns the following for module=pptp, where actually no matches are expected, resulting in the pptp.ko module not being loaded, thereby failing to establish the pptp connection. # module="pptp" ; grep "$module" /proc/modules nf_nat_pptp 1312 0 - Live 0x86ce7000 nf_conntrack_pptp 3072 1 nf_nat_pptp, Live 0x86cb9000 nf_nat_proto_gre 784 1 nf_nat_pptp, Live 0x86cba000 nf_conntrack_proto_gre 2368 1 nf_conntrack_pptp, Live 0x86cbf000 nf_nat 9792 13 nf_nat_rtsp,nf_nat_tftp,nf_nat_sip,nf_nat_pptp,nf_nat_h323,nf_nat_proto_gre,nf_nat_amanda,nf_nat_irc,nf_nat_ftp,ipt_REDIRECT,ipt_NETMAP,ipt_MASQUERADE,iptable_nat, Live 0x86ca8000 nf_conntrack 37264 31 nf_nat_rtsp,nf_conntrack_rtsp,nf_nat_tftp,nf_conntrack_tftp,nf_nat_snmp_basic,nf_conntrack_snmp,nf_nat_sip,nf_conntrack_sip,nf_nat_pptp,nf_conntrack_pptp,nf_nat_h323,nf_conntrack_h323,nf_conntrack_proto_gre,nf_nat_amanda,nf_conntrack_amanda,nf_conntrack_broadcast,nf_nat_irc,nf_conntrack_irc,nf_nat_ftp,nf_conntrack_ftp,ipt_MASQUERADE,iptable_nat,nf_nat,xt_helper,xt_connmark,xt_connbytes,xt_conntrack,xt_CT,xt_NOTRACK,xt_state,nf_conntrack_ipv4, Live 0x86c90000 The search filter can be made more accurate/restrictive, by requiring the occurance of the exact name of the module at the beginning of a line in /proc/modules. # module="pptp" ; grep "^$module " /proc/modules pptp 13296 2 - Live 0x86e80000 Signed-off-by: Tijs Van Buggenhout <tvb@able.be> SVN-Revision: 38358
* dropbear: update to 2013.59 (released 4 october 2013)Jo-Philipp Wich2013-10-108-38/+22
| | | | | | | | | | | - drop mirror www.mirrors.wiretapped.net (not working anymore) - drop patch 300-ipv6_addr_port_split.patch, included upstream - refresh patches - various upstream changes: http://matt.ucc.asn.au/dropbear/CHANGES Signed-off-by: Catalin Patulea <cat@vv.carleton.ca> SVN-Revision: 38356
* openvpn: rework initscript (fixes #14299)Luka Perkov2013-10-091-8/+30
| | | | | | Signed-off-by: Luka Perkov <luka@openwrt.org> SVN-Revision: 38351
* hostapd: recognize 8021x as an authentication modeFelix Fietkau2013-10-081-1/+1
| | | | | | | | | | | | | | Currently, in order to configure the authentication daemon in 8021x mode, we need to set wireless.@wifi-iface[0].encryption="wpa" Though it works it confuses folks as 8021x is using WEP encryption and not WPA. Therefore the terminology itself is confusing. This change adds 8021x as a recognized string for 8021x authentication. Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com> Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com> SVN-Revision: 38339
* hostapd: add external registrar supportFelix Fietkau2013-10-081-0/+3
| | | | | | | | | | | | | Setting wireless.@wifi-iface[N].ext_registrar=1 will enable UPNP advertising and add an external registrar to the interface this vif belongs to (br-lan if the vif is included in the LAN bridge). By enabling this we append upnp_iface=xxx to the hostapd config file. Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com> Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com> Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com> SVN-Revision: 38338
* hostapd: enable WPS2 support on hostapd-full.configFelix Fietkau2013-10-081-1/+2
| | | | | | | | | | Enable CONFIG_WPS2 for hostapd. This is required to support options like Virtual Push Button in WPS. Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com> Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com> SVN-Revision: 38337
* hostapd: fix hostapd RSN preauthentication PMKSA cachingFelix Fietkau2013-10-081-4/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In 2009 OpenWrt's hostapd config added an "auth_cache" boolean to be used to address a reported issue #12129 [0] on a forum [1]. The reported issue on the ticket is different that the one described on the forum. The commit was r33359. This change broke proper RSN preauthentication [2] [3] [4] expectations on hostapd's configuration for WPA2 and this in turn disabled PMKSA caching and Opportunistic Key Caching. This change: * Leaves the "auth_cache" to be used only for WPA networks for those looking to use this as a workaround to a reported issue but annotates a warning over its usage. * Separate "auth_cache" from WPA2 RSN preauthentication, leaving WPA2 RSN preauthentication to enabled only with "rsn_preauth" with the expected and recommended settings. * Adds a new WPA2 RSN preauthentication "rsn_preauth_testing" to be used when evaluating funcionality for WPA2 RSN preauthentication with the expected and recommended settings with the only difference so far with what should be enabled by default to disable Opportunistic Key Caching. Disabling the PMKSA cache should mean the STA could not roam off and back onto the AP that had PMKSA caching disabled and would require a full authentication cycle. This fixes this for WPA2 networks with RSN preauthentication enabled. This change should be applied to AA as well as trunk. TL DR; The issue described on the forum has to do with failure of a STA being able to try to authenticate again with the AP if it failed its first try. This may have been an issue with hostapd in 2009 but as per some tests I cannot reproduce this today on a WPA2 network. The issue described on the ticket alludes to a security issue with the design of using a Radius server to authenticate to an AP. The issue vaguely alludes to the circumstances of zapping a user, deleting their authentication credentials to log in to the network, and that if RSN preauthentication is enabled with PMKSA caching that the user that was zapped would still be able to authenticate. Lets treat these as separate issues. I cannot reproduce the first issue reported on the forums of not being able to authenticate anymore on a WPA2 network. The issue reported on the ticket modified WPA2 RSN preauthentication by adding two fields to the hostapd configuration if auth_cache was enabled: * disable_pmksa_caching=1 * okc=0 The first one disables PMKSA authentication cache. The second one disables Opportunistic Key Caching. The issue reported on the ticket was fixed by implementing a workaround in hostapd's configuration. Disabling PMKSA caching breaks proper use of WPA2 RSN pre authentication. The usage of disable_pmksa_caching=1 prevents hostapd from adding PMKSA entries into its cache when a successful 802.1x authentication occurs. In practice RSN preauthentication would trigger a STA to perform authentication with other APs on the same SSID, it would then have its own supplicant PMKSA cache held. If a STA roams between one AP to another no new authenitcation would need to be performed as the new AP would already have authenticated the STA. The purpose of the PMKSA cache on the AP side would be for the AP to use the same PMKID for a STA when the STA roams off onto another BSSID and later comes back to it. Disabling Opportunistic Key Caching could help the reported issue as well but its not the correct place to address this. Opportunistic Key Caching enables an AP with different interfaces to share the PMKSA cache. Its a technical enhancement and disabling it would be useful to let a testing suite properly test for RSN preauthentication given that otherwise Opportunistic Key Caching would enable an interface being tested to derive its own derive the PMKSA entry. In production though okc=1 should be enabled to help with RSN preauthentication. The real fix for this particular issue outside of the scope of hostapd's configuration and it should not be dealt with as a workaround to its configuration and breaking expected RSN preauthentication and technical optimizations. Revert this change and enable users to pick and choose to enable or disable disable_pmksa_caching and okc expecting them to instead have read clearly more what these do. As for the core issure ported, the correct place to fix this is to enable a sort of messaging between the RADIUS server and its peers so that if caching for authentication is enabled that cache can be cleared upon user credential updates. Updating a user password (not just zapping a user) is another possible issue that would need to be resolved here. Another part of the solution might be to reduce the cache timing to account for any systematic limitations (RADIUS server not able to ask peers to clear cache might be one). [0] https://dev.openwrt.org/changeset/33359 [1] https://forum.openwrt.org/viewtopic.php?id=19596 [2] http://wireless.kernel.org/en/users/Documentation/hostapd#IEEE_802.11i.2FRSN.2FWPA2_pre-authentication [3] http://wireless.kernel.org/en/users/Documentation/wpa_supplicant#RSN_preauthentication [4] http://wiki.openwrt.org/doc/recipes/rsn_preauthentication Signed-off-by: Luis R. Rodriguez <mcgrof@do-not-panic.com> SVN-Revision: 38336
* hostapd: Add WPS unconfigured & WPS pin method supportFelix Fietkau2013-10-081-3/+13
| | | | | | | Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com> Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com> SVN-Revision: 38335
* hostapd: Add eap_reauth_period config optionFelix Fietkau2013-10-081-0/+2
| | | | | | | | | | | | This adds the eap_reauth_period to be used for modifying the RADIUS server reauthentication authentication period, a parameter that gets passed directly to the hostapd configuration file. Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com> Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com> SVN-Revision: 38334
* openvpn: switch to new procd init script styleLuka Perkov2013-10-072-65/+14
| | | | | | Signed-off-by: Luka Perkov <luka@openwrt.org> SVN-Revision: 38331
* odhcp6c: improve server selection, introduce "forceprefix" optionSteven Barth2013-10-072-4/+7
| | | | SVN-Revision: 38314
* iproute2: update to 3.11Luka Perkov2013-10-075-18/+6
| | | | | | Signed-off-by: Luka Perkov <luka@openwrt.org> SVN-Revision: 38313
* netifd: update to latest version, adds macvlan supportFelix Fietkau2013-10-031-2/+2
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 38299
* odhcp6c: validate hop-limit on RAsSteven Barth2013-10-021-2/+2
| | | | SVN-Revision: 38285
* 6relayd: remove compat ULA setting by default (too many bad sideeffects)Steven Barth2013-10-022-2/+1
| | | | SVN-Revision: 38283
* netifd: don't remove & readd addresses that only have a changed lifetimeSteven Barth2013-10-011-2/+2
| | | | SVN-Revision: 38269
* uhttpd: add a config option for using ustream-polarssl, and use it by defaultFelix Fietkau2013-09-291-2/+8
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 38250
* uhttpd: fix appending https ports to cmdlineFelix Fietkau2013-09-251-1/+1
| | | | | | | | Otherwise it is started only on non-secure ports. Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik@neratec.com> SVN-Revision: 38171
* iwinfo: add Ubiquiti WispStation M5 to hardware.txtGabor Juhos2013-09-241-0/+1
| | | | | | Signed-off-by: Gabor Juhos <juhosg@openwrt.org> SVN-Revision: 38145
* fix various init scriptsLuka Perkov2013-09-233-6/+6
| | | | | | | | | | | | Changes include: * removing unused variables * replacing spaces with tabs where appropriate * more consistency with variable declarations Signed-off-by: Luka Perkov <luka@openwrt.org> SVN-Revision: 38142
* xtables-addons: fix missing conversion from r38021 (resolves a broken ↵Felix Fietkau2013-09-221-1/+1
| | | | | | | | dependency) Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 38124
* odhcp6c: handle NoAddrsAvail IA-statusSteven Barth2013-09-211-2/+2
| | | | SVN-Revision: 38092
* odhcp6c: Restart when server returns IAID errorSteven Barth2013-09-181-2/+2
| | | | SVN-Revision: 38032
* procd: convert various packages to procd style init.d scriptsJohn Crispin2013-09-176-94/+96
| | | | | | Signed-off-by: John Crispin <blogic@openwrt.org> SVN-Revision: 38023
* kernel: make most modules use AutoProbeJohn Crispin2013-09-171-27/+27
| | | | | | | | now that we have modprobe we can set more than half of the modules to AutoProbe Signed-off-by: John Crispin <blogic@openwrt.org> SVN-Revision: 38021
* hostapd: adjust the md5sum for the uploaded source tarball (fixes #14155)Felix Fietkau2013-09-141-1/+1
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 37990
* iwinfo: when using nl80211, parse interface combinations instead of ↵Felix Fietkau2013-09-141-9/+57
| | | | | | | | creating/deleting interfaces Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 37983
* uhttpd: udpat to git headJo-Philipp Wich2013-09-131-2/+2
| | | | | | | | | | | - fixes buffer corruption with JSON-RPC list calls - change JSON-RPC protocol to include the session ID into the call attributes instead of passing it via the URL - forcibly pass effective session ID as "ubus_rpc_session" attribute to called procedures - change ubus acl checking to conform with new ubus session namespace SVN-Revision: 37962
* odhcp6c: Timing workaround for buggy serversSteven Barth2013-09-121-2/+2
| | | | SVN-Revision: 37951
* odhcp6c: more compatibility fixesSteven Barth2013-09-051-2/+2
| | | | SVN-Revision: 37907
* netfilter: Add IPv6-NAT support for kernel and ipt Thanks to Berni, Adam ↵Steven Barth2013-09-011-0/+12
| | | | | | Novak and Sedat Dilek for patches and inspiration SVN-Revision: 37866
* iptables: Update to 1.4.20Steven Barth2013-09-013-20/+7
| | | | SVN-Revision: 37865
* netifd: update to the latest version, fixes a bridge handling corner case on ↵Felix Fietkau2013-08-291-2/+2
| | | | | | | | config reload Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 37856
* lldpd: Add libbsd dependency when using eglibcVasilis Tsiligiannis2013-08-251-3/+3
| | | | | | Signed-off-by: Vasilis Tsiligiannis <acinonyx@openwrt.gr> SVN-Revision: 37837
* firewall: update to git headJo-Philipp Wich2013-08-141-2/+2
| | | | | | | - uses "-j CT --notrack" instead of deprecated "-j NOTRACK" - fixes support for rule sections with target "NOTRACK" SVN-Revision: 37777
* hostapd: fix typo in version numberFelix Fietkau2013-08-081-1/+1
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 37742
* hostapd: fix ubus reconnect handlingFelix Fietkau2013-08-081-1/+18
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 37741
* hostapd: add a build variant for wpa_supplicant with p2p (aka Wi-Fi Direct) ↵Felix Fietkau2013-08-082-2/+428
| | | | | | | | support Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 37739
* hostapd: update to latest version (20130707)Felix Fietkau2013-08-0824-284/+83
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 37738
* hostapd: Settings for DAE/CoA serverFelix Fietkau2013-08-061-0/+7
| | | | | | | | | | | | | | | | | | | | | | hostapd supports "Dynamic Authorization Extensions", making it possible to forcibly disconnect a user by sending it a RADIUS "Disconnect-Request" packet. I've added three new variables to enable setting of the "radius_das_client" and "radius_das_port" variables in the hostapd configuration, which enable these extensions. * dae_client - IP of the client that can send disconnect requests * dae_secret - shared secret for DAE packets These are combined into the "radius_das_client" option in hostapd.conf To enable the server, both dae_client and dae_secret must be set. * dae_port - optional, default value is 3799 as specified in RFC 5176 Signed-off-by: Martijn van de Streek <martijn@vandestreek.net> SVN-Revision: 37734
* hostapd: Fix WDS/WEP usageFelix Fietkau2013-08-061-0/+156
| | | | | | | | | WEP in WDS is currently broken in hostapd. Add a patch to fix the issue. Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com> SVN-Revision: 37733
* hostapd: Refresh patchesFelix Fietkau2013-08-067-18/+18
| | | | | | Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com> SVN-Revision: 37731
* hostapd: Add an option to disable beaconingFelix Fietkau2013-08-061-0/+45
| | | | | | | | | | | | Add a patch for hostapd that introduces a config option "start_disabled" which can be used to bring up an AP interface with beaconing disabled. This is useful in a Repeater-AP setup where the Repeater AP has to start beaconing only after the WDS link has been established. Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com> SVN-Revision: 37730
* uhttpd: update to the latest version, fixes a crash on early cgi/lua process ↵Felix Fietkau2013-07-311-2/+2
| | | | | | | | termination Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 37628
* iproute2: update to 3.10.0Luka Perkov2013-07-283-15/+6
| | | | | | Signed-off-by: Luka Perkov <luka@openwrt.org> SVN-Revision: 37590
* openvpn: update to 2.3.2Felix Fietkau2013-07-262-61/+2
| | | | | | | | | | | | this patches updates openvpn to v2.3.2 and adds a PKG_MD5SUM to the Makefile This release fixes a memory access violation when cipher none is used on ar71xx - at least with my config Signed-off-by: Peter Wagner <tripolar@gmx.at> SVN-Revision: 37560
* 6relayd: Overridden DNS should affect DHCPv6Steven Barth2013-07-261-2/+2
| | | | SVN-Revision: 37558
* uhttpd: update to latest version, fixes issues with POST and keep-alive (#13940)Felix Fietkau2013-07-261-2/+2
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 37556
* authsae: add myself as a maintainerFelix Fietkau2013-07-261-0/+2
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 37555
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-07 04:42:27 +0000