aboutsummaryrefslogtreecommitdiffstats
path: root/package/network
Commit message (Collapse)AuthorAgeFilesLines
* hostapd: update packaging and patchesDaniel Golle2018-12-1834-445/+366
| | | | | | | | | | | | | Clean up conflicts/provides/depends hell and add PROVIDES for eapol-test variants while at it. Update mesh-DFS patchset from Peter Oh to v5 (with local fixes) which allows to drop two revert-patches for upstream commits which previously were necessary to un-break mesh-DFS support. Signed-off-by: Daniel Golle <daniel@makrotopia.org> (backported from 78f1974bc565d7544589a49ad8efd92c4ddec5b3) (rebased patches) Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* hostapd: convert ssl provider build options to variantsDaniel Golle2018-12-182-85/+285
| | | | | | | | | | | | Instead of selecting the SSL provider at compile time, build package variants for each option so users can select the binary package without having to build it themselves. Most likely not all variants have actually ever been user by anyone. We should reduce the selection to the reasonable and most used combinations at some point in future. For now, build them all. Signed-off-by: Daniel Golle <daniel@makrotopia.org> (backported from c8fdd0e9c843dd483f6677dc41f7df17313aa3cd)
* hostapd: update to git HEAD of 2018-05-21, allow build against wolfsslDaniel Golle2018-12-1841-325/+627
| | | | | | | | | | Support for building wpa_supplicant/hostapd against wolfssl has been added upstream recently, add build option to allow users using it. Signed-off-by: Daniel Golle <daniel@makrotopia.org> (backported from 69f544937f8498e856690f9809a016f0d7f5f68b) (rebased patches) Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* nftables: bump to 0.8.5 versionRosy Song2018-12-188-1594/+8
| | | | | Signed-off-by: Rosy Song <rosysong@rosinson.com> (backported from 39e87e0ffc4eabf27d25459a369be425e9ef0474)
* ebtables: update to latest git 2018-05-15Hans Dedecker2018-12-183-5/+16
| | | | | | | | | | | 66a9701 ebtables: Fix build errors and warnings 9fff3d5 include: Fix musl libc compatibility b1cdae8 extensions: Add string filter to ebtables Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> (backported from ac70ac3532fefa78c944d8a26c8df0ca5d88d04e) (rebased patches) Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* openvpn: re-add option comp_lzoMartin Schiller2018-12-122-1/+2
| | | | | | | | | | | This option is deprecated but needs to be kept for backward compatibility. [0] [0] https://community.openvpn.net/openvpn/wiki/DeprecatedOptions#a--comp-lzo Signed-off-by: Martin Schiller <ms@dev.tdt.de> Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> [PKG_RELEASE increase] (cherry picked from commit 3850b41f01925a7eddc24033ed155503c1ad2112)
* uhttpd: update to latest Git headJo-Philipp Wich2018-11-281-3/+3
| | | | | | | | | | | cdfc902 cgi: escape url in 403 error output 0bba1ce uhttpd: fix building without TLS and Lua support 2ed3341 help: document -A option fa5fd45 file: fix CPP syntax error 77b774b build: avoid redefining _DEFAULT_SOURCE Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit 56378bc12da1aa4f9434bd1119ec770096d92cac)
* uhttpd: support multiple Lua prefixesJo-Philipp Wich2018-11-283-21/+32
| | | | | | | | | | | | | | | | | | | | Update to latest git HEAD in order to support configuring multiple concurrent Lua prefixes in a single uhttpd instance: b741dec lua: support multiple Lua prefixes Additionally rework the init script and update the default configuration example to treat the lua_prefix option as key=value uci list, similar to the interpreter extension mapping. Support for the old "option lua_prefix" plus "option lua_handler" notation is still present. Finally drop the sed postinstall hack in uhttpd-mod-lua to avoid mangling files belonging to other packages. Since Lua prefixes have precedence over CGI prefixes, simply register `/cgi-bin/luci` as Lua handler which will only become active if both luci-base and uhttpd-mod-lua is installed. Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit 214146c6f298e593695c29b8c04a418dac914040)
* uhttpd: update to latest Git headJo-Philipp Wich2018-11-281-3/+3
| | | | | | | | 952bf9d build: use _DEFAULT_SOURCE 30a18cb uhttpd: recognize PATCH, PUT and DELETE HTTP methods Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit 22681cdef21be45d4d2c3e21939209ea618b66e4)
* tcpdump: explicitly disable libcap-ng supportStijn Tintel2018-11-131-0/+1
| | | | | | | | If libcap-ng is detected during tcpdump build, support for it is enabled and the binary is linked against it. Explicitly disable libcap-ng support to avoid build failing due to a missing depndency. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* dnsmasq: bump to v2.80Kevin Darbyshire-Bryant2018-10-225-137/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-picked & squashed from relevant commits from master: dnsmasq v2.80 release Change from rc1: 91421cb Fix compiler warning. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit 6c4d3d705a0d6e508de94dc49736c250ecdae27c) dnsmasq: remove creation of /etc/ethers Remove creation of file /etc/ethers in dnsmasq init script as the file is now created by default in the base-files package by commit fa3301a28e Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> (cherry picked from commit 6c227e45cb6a97c61d9fa2ffa35cebee2a048739) dnsmasq: bump to dnsmasq v2.80test5 Refresh patches Remove 240-ubus patch as upstream accepted. Add uci option ubus which allows to enable/disable ubus support (enabled by default) Upstream commits since last bump: da8b651 Implement --address=/example.com/# c5db8f9 Tidy 7f876b64c22b2b18412e2e3d8506ee33e42db7c 974a6d0 Add --caa-record b758b67 Improve logging of RRs from --dns-rr. 9bafdc6 Tidy up file parsing code. 97f876b Properly deal with unaligned addresses in DHCPv6 packets. cbfbd17 Fix broken DNSSEC records in previous. b6f926f Don't return NXDOMAIN to empty non-terminals. c822620 Add --dhcp-name-match 397c050 Handle case of --auth-zone but no --auth-server. 1682d15 Add missing EDNS0 section. EDNS0 section missing in replies to EDNS0-containing queries where answer generated from --local=/<domain>/ dd33e98 Fix crash parsing a --synth-domain with no prefix. Problem introduced in 2.79/6b2b564ac34cb3c862f168e6b1457f9f0b9ca69c c16d966 Add copyright to src/metrics.h 1dfed16 Remove C99 only code. 6f835ed Format fixes - ubus.c 9d6fd17 dnsmasq.c fix OPT_UBUS option usage 8c1b6a5 New metrics and ubus files. 8dcdb33 Add --enable-ubus option. aba8bbb Add collection of metrics caf4d57 Add OpenWRT ubus patch Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> (cherry picked from commit 3d377f4375c6e4a66c6741bbd2549ad53ef671b3) dnsmasq: bump to dnsmasq 2.80test6 Refresh patches Changes since latest bump: af3bd07 Man page typo. d682099 Picky changes to 47b45b2967c931fed3c89a2e6a8df9f9183a5789 47b45b2 Fix lengths of interface names 2b38e38 Minor improvements in lease-tools 282eab7 Mark die function as never returning c346f61 Handle ANY queries in context of da8b6517decdac593e7ce24bde2824dd841725c8 03212e5 Manpage typo. Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> (cherry picked from commit 43d4b8e89e68fcab00698ee3b70a58c74813a6a7) dnsmasq: Handle memory allocation failure in make_non_terminals() Backport upstream commit: ea6cc33 Handle memory allocation failure in make_non_terminals() Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit 687168ccd9154b1fb7a470fa8f42ce64a135f51d) dnsmasq: Change behavior when RD bit unset in queries. Backport upstream commit Change anti cache-snooping behaviour with queries with the recursion-desired bit unset. Instead to returning SERVFAIL, we now always forward, and never answer from the cache. This allows "dig +trace" command to work. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit 6c4cbe94bd940b5c061e27744eb78805764d6b34) dnsmasq: bump to v2.80test7 Bump to latest test release: 3a610a0 Finesse allocation of memory for "struct crec" cache entries. 48b090c Fix b6f926fbefcd2471699599e44f32b8d25b87b471 to not SEGV on startup (rarely). 4139298 Change behavior when RD bit unset in queries. 51cc10f Add warning about 0.0.0.0 and :: addresses to man page. ea6cc33 Handle memory allocation failure in make_non_terminals() ad03967 Add debian/tmpfiles.conf f4fd07d Debian bugfix. e3c08a3 Debian packaging fix. (restorecon) 118011f Debian packaging fix. (tmpfiles.d) Delete our own backports of ea6cc33 & 4139298, so the only real changes here, since we don't care about the Debian stuff are 48b090c & 3a610a0 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit d9a37d8d1eb7d117d5aa44924064a4a3b5517ddd) dnsmasq: bump to v2.80test8 e1791f3 Fix logging of DNSSEC queries in TCP mode. Destination server address was misleading. 0fdf3c1 Fix dhcp-match-name to match hostname, not complete FQDN. ee1df06 Tweak strategy for confirming SLAAC addresses. 1e87eba Clarify manpage for --auth-sec-servers 0893347 Make interface spec optional in --auth-server. 7cbf497 Example config file fix for CERT Vulnerability VU#598349. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit 30cc5b0bf4f3cdfe950ca7fc380a34c81dd9d7e4) dnsmasq: add dhcp-ignore-names support - CERT VU#598349 dnsmasq v2.80test8 adds the ability to ignore dhcp client's requests for specific hostnames. Clients claiming certain hostnames and thus claiming DNS namespace represent a potential security risk. e.g. a malicious host could claim 'wpad' for itself and redirect other web client requests to it for nefarious purpose. See CERT VU#598349 for more details. Some Samsung TVs are claiming the hostname 'localhost', it is believed not (yet) for nefarious purposes. /usr/share/dnsmasq/dhcpbogushostname.conf contains a list of hostnames in correct syntax to be excluded. e.g. dhcp-name-match=set:dhcp_bogus_hostname,localhost Inclusion of this file is controlled by uci option dhcpbogushostname which is enabled by default. To be absolutely clear, DHCP leases to these requesting hosts are still permitted, but they do NOT get to claim ownership of the hostname itself and hence put into DNS for other hosts to be confused/manipulate by. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit a45f4f50e16cd2d0370a4470c3ede0c6c7754ba9) dnsmasq: fix compile issue Fix compile issue in case HAVE_BROKEN_RTC is enabled Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> (cherry picked from commit 39e5e17045aceb2bfbd6b5c6ecfd6cfbce2f3311) dnsmasq: bump to v2.80rc1 53792c9 fix typo df07182 Update German translation. Remove local patch 001-fix-typo which is a backport of the above 53792c9 There is no practical difference between our test8 release and this rc release, but this does at least say 'release candidate' Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit b8bc672f247a68bc6f72f08f9352cd7aaa5cb9c4) dnsmasq: fix dnsmasq failure to start when ujail'd This patch fixes jailed dnsmasq running into the following issue: |dnsmasq[1]: cannot read /usr/share/dnsmasq/dhcpbogushostname.conf: No such file or directory |dnsmasq[1]: FAILED to start up |procd: Instance dnsmasq::cfg01411c s in a crash loop 6 crashes, 0 seconds since last crash Fixes: a45f4f50e16 ("dnsmasq: add dhcp-ignore-names support - CERT VU#598349") Signed-off-by: Christian Lamparter <chunkeey@gmail.com> [bump package release] Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit 583466bb5b374b29b6b7cba6f065e97c4734f742) Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* iperf: fix --daemon optionRafał Miłecki2018-10-073-1/+205
| | | | | | | | | | | | | | | | Support for -D got broken in the 2.0.11 release by the upstream commit 218d8c667944 ("first pass L2 mode w/UDP checks, v4 only"). After that commit clients were still able to connect but no traffic was passed. It was reported and is fixed now in the upstream git repository. Backport two patches to fix this. The first one is just a requirement for the later to apply. The second one is the real fix and it needed only a small adjustment to apply without backporing the commit 10887b59c7e7 ("fix --txstart-time report messages"). Fixes: 7d15f96eaf76 ("iperf: bump to 2.0.12") Signed-off-by: Rafał Miłecki <rafal@milecki.pl> (cherry picked from commit 87cd118794cc9375260ea213838e80ad5295e83c)
* netifd: fix segfault (FS#1875)Hans Dedecker2018-10-071-3/+3
| | | | | | d0fa124 iprule: fix segfault (FS#1875) Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* uqmi: pass-through ipXtable to child interfacesDaniel Golle2018-09-172-2/+5
| | | | | | | | | Allow setting specific routing tables via the ip4table and ip6table options also when ${ifname}_4 and ${ifname}_6 child interfaces are being created. Signed-off-by: Daniel Golle <daniel@makrotopia.org> (cherry picked from commit e51aa699f7ca3ce83a0add622c0fd17d0caafc46)
* iproute2: q_cake: Also print nonat, nowash and no-ack-filter keywordsKevin Darbyshire-Bryant2018-09-152-3/+7
| | | | | | | | | Pull in latest upstream tweaks: Similar to the previous patch for no-split-gso, the negative keywords for 'nat', 'wash' and 'ack-filter' were not printed either. Add those as well. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit 033f02b9b5580e67e2f1b623f62da60d645e7ba2)
* iproute2: q_cake: Add printing of no-split-gso optionKevin Darbyshire-Bryant2018-09-122-2/+4
| | | | | | | | | When the GSO splitting was turned into dual split-gso/no-split-gso options, the printing of the latter was left out. Add that, so output is consistent with the options passed Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit 8cac8572897c28e902218b445aa9bed82c40989f)
* iproute2: update cake man pageKevin Darbyshire-Bryant2018-09-122-3/+81
| | | | | | | | | | | | CAKE supports overriding of its internal classification of packets through the tc filter mechanism. Update the man page in our package, even though we don't build them. Someone may find the documentation useful. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit 30598a05385b0ac2380dd4f30037a9f9d0318cf2) (cherry picked from commit dc9388ac5506f2d0ea0fee6967c003b9129c8ca5)
* iproute2: cake: make gso/gro splitting configurableKevin Darbyshire-Bryant2018-09-122-2/+11
| | | | | | | | | | | | | | | | | | | This patch makes sch_cake's gso/gro splitting configurable from userspace. To disable breaking apart superpackets in sch_cake: tc qdisc replace dev whatever root cake no-split-gso to enable: tc qdisc replace dev whatever root cake split-gso Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk> Signed-off-by: Dave Taht <dave.taht@gmail.com> [pulled from netdev list - no API/ABI change] Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit 3e8a9389961cd866b867740a2f71c2a0af97ab56)
* odhcp6c: add client fqdn and reconfigure optionspacien2018-09-082-3/+9
| | | | | | | | | Allowing DHCPV6_CLIENT_FQDN and DHCPV6_ACCEPT_RECONFIGURE to be turned off. Defaulting to false, former behavior remains unchanged. Signed-off-by: pacien <pacien.trangirard@pacien.net> Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> [PKG_RELEASE increase] (cherry picked from commit ef01c1d308d1cb200fc14ab49f0d3d0a07e1a9fe)
* dnsmasq: allow dnsmasq variants to be included in imageHenrique de Moraes Holschuh2018-09-061-0/+2
| | | | | | | | | | | The dnsmasq variants should provide dnsmasq, otherwise it is impossible to include them in the image. This change allows one to have CONFIG_PACKAGE_dnsmasq=m and CONFIG_PACKAGE_dnsmasq-full=y, e.g. because you want DNSSEC support, or IPSETs suport on your 3000-devices fleet ;-) Signed-off-by: Henrique de Moraes Holschuh <henrique@nic.br>
* uqmi: wait for the control device tooThomas Equeter2018-08-301-2/+2
| | | | | | | | | | | | | | | | The control device /dev/cdc-wdm0 is not available immediately on the D-Link DWR-921 Rev.C3, therefore the wwan interface fails to start at boot with a "The specified control device does not exist" error. This patch alters /lib/netifd/proto/qmi.sh to wait for network.wwan.delay earlier, before checking for the control device, instead of just before interacting with the modem. One still has to use network.wwan.proto='qmi', as the "wwan" proto performs that sort of check before any delay is possible, failing with a "No valid device was found" error. Signed-off-by: Thomas Equeter <tequeter@users.noreply.github.com>
* comgt: increase timeout on runcommandsGiuseppe Lippolis2018-08-291-1/+1
| | | | | | | | | | Some combination of modem/wireless operator requires more time to execute the commands. Tested on DWR-512 embedded wwan modem and italian operator iliad (new virtual operator). Signed-off-by: Giuseppe Lippolis <giu.lippolis@gmail.com> (cherry picked from commit 774d7fc9f2897d7b33ef15ddaa3522531eb85970)
* dropbear: backport upstream fix for CVE-2018-15599Hans Dedecker2018-08-243-3/+224
| | | | | | | | | | CVE description : The recv_msg_userauth_request function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability because username validity affects how fields in SSH_MSG_USERAUTH messages are handled, a similar issue to CVE-2018-15473 in an unrelated codebase. Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* wpa_supplicant: fix CVE-2018-14526John Crispin2018-08-101-0/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Unauthenticated EAPOL-Key decryption in wpa_supplicant Published: August 8, 2018 Identifiers: - CVE-2018-14526 Latest version available from: https://w1.fi/security/2018-1/ Vulnerability A vulnerability was found in how wpa_supplicant processes EAPOL-Key frames. It is possible for an attacker to modify the frame in a way that makes wpa_supplicant decrypt the Key Data field without requiring a valid MIC value in the frame, i.e., without the frame being authenticated. This has a potential issue in the case where WPA2/RSN style of EAPOL-Key construction is used with TKIP negotiated as the pairwise cipher. It should be noted that WPA2 is not supposed to be used with TKIP as the pairwise cipher. Instead, CCMP is expected to be used and with that pairwise cipher, this vulnerability is not applicable in practice. When TKIP is negotiated as the pairwise cipher, the EAPOL-Key Key Data field is encrypted using RC4. This vulnerability allows unauthenticated EAPOL-Key frames to be processed and due to the RC4 design, this makes it possible for an attacker to modify the plaintext version of the Key Data field with bitwise XOR operations without knowing the contents. This can be used to cause a denial of service attack by modifying GTK/IGTK on the station (without the attacker learning any of the keys) which would prevent the station from accepting received group-addressed frames. Furthermore, this might be abused by making wpa_supplicant act as a decryption oracle to try to recover some of the Key Data payload (GTK/IGTK) to get knowledge of the group encryption keys. Full recovery of the group encryption keys requires multiple attempts (128 connection attempts per octet) and each attempt results in disconnection due to a failure to complete the 4-way handshake. These failures can result in the AP/network getting disabled temporarily or even permanently (requiring user action to re-enable) which may make it impractical to perform the attack to recover the keys before the AP has already changes the group keys. By default, wpa_supplicant is enforcing at minimum a ten second wait time between each failed connection attempt, i.e., over 20 minutes waiting to recover each octet while hostapd AP implementation uses 10 minute default for GTK rekeying when using TKIP. With such timing behavior, practical attack would need large number of impacted stations to be trying to connect to the same AP to be able to recover sufficient information from the GTK to be able to determine the key before it gets changed. Vulnerable versions/configurations All wpa_supplicant versions. Acknowledgments Thanks to Mathy Vanhoef of the imec-DistriNet research group of KU Leuven for discovering and reporting this issue. Possible mitigation steps - Remove TKIP as an allowed pairwise cipher in RSN/WPA2 networks. This can be done also on the AP side. - Merge the following commits to wpa_supplicant and rebuild: WPA: Ignore unauthenticated encrypted EAPOL-Key data This patch is available from https://w1.fi/security/2018-1/ - Update to wpa_supplicant v2.7 or newer, once available Signed-off-by: John Crispin <john@phrozen.org> (cherry picked from commit 1961948585e008ad0095d7074784893229b00d06)
* curl: Fix CVE-2018-0500Hauke Mehrtens2018-08-082-1/+33
| | | | | | | | This backports a fix for: * CVE-2018-0500 SMTP send heap buffer overflow See here for details: https://curl.haxx.se/docs/adv_2018-70a2.html Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* mbedtls: Update to 2.12.0Hauke Mehrtens2018-08-082-2/+2
| | | | | | | | | | | | | | | | | | | Multiple security fixes * CVE-2018-0497 Remote plaintext recovery on use of CBC based ciphersuites through a timing side-channel * CVE-2018-0498 Plaintext recovery on use of CBC based ciphersuites through a cache based side-channel Disable OFB block mode and XTS block cipher mode, added in 2.11.0. Disable Chacha20 and Poly1305 cryptographic primitives, added in 2.12.0 Patch the so version back to the original one, the API changes are looking no so invasive. The size of mbedtls increased a little bit: ipkg for mips_24kc before: 163.967 Bytes ipkg for mips_24kc after: 164.753 Bytes Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* wwan: Fix teardown for sierra_net driverMasashi Honma2018-08-081-1/+1
| | | | | | | | The sierra_net driver is using proto_directip_setup for setup. So use proto_directip_teardown for teardown. Signed-off-by: Masashi Honma <masashi.honma@gmail.com> (cherry picked from commit d05967baecca33774ab95d4ffabbcb4cc9d0a1bf)
* dropbear: close all active clients on shutdownChristian Schoenebeck2018-08-081-0/+5
| | | | | | | | | | | | | | | | | | | | | | Override the default shutdown action (stop) and close all processes of dropbear Since commit 498fe85, the stop action only closes the process that's listening for new connections, maintaining the ones with existing clients. This poses a problem when restarting or shutting-down a device, because the connections with existing SSH clients, like OpenSSH, are not properly closed, causing them to hang. This situation can be avoided by closing all dropbear processes when shutting-down the system, which closes properly the connections with current clients. Signed-off-by: Christian Schoenebeck <christian.schoenebeck@gmail.com> [Luis: Rework commit message] Signed-off-by: Luis Araneda <luaraneda@gmail.com> (cherry picked from commit 1e177844bc814d3846312c91cd0f7a54df4f32b9)
* netifd: update to latest git HEADJohn Crispin2018-08-061-3/+3
| | | | | | | | | | | | | | | | | | | | | | | a0a1e52 fix compile error 75ee790 interface-ip: fix eui64 ifaceid generation (FS#1668) ca97097 netifd: make sure the vlan ifname fits into the buffer b8c1bca iprule: remove bogus assert calls a2f952d iprule: fix broken in_dev/out_dev checks 263631a vlan: use alloca to get rid of IFNAMSIZE in vlan_dev_set_name() 291ccbb ubus: display correct prefix size for IPv6 prefix address 908a9f4 CMakeLists.txt: add -Wimplicit-fallthrough to the compiler flags b06b011 proto-shell.c: add a explicit "fall through" comment to make the compiler happy 60293a7 replace fall throughs in switch/cases where possible with simple code changes 5cf7975 iprule: rework interface based rules to handle dynamic interfaces 57f87ad Introduce new interface event "create" (IFEV_CREATE) 03785fb system-linux: fix build error on older kernels d1251e1 system-linux: adjust bridge isolate mode for upstream attribute naming e9eff34 system-linux: extend link mode speed definitions c1f6a82 system-linux: add autoneg and link-partner output Signed-off-by: John Crispin <john@phrozen.org> (cherry picked from commit 3c4eeb5d21073dea5a021012f9e65ce95f81806e) Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* iperf: bump to 2.0.12Koen Vandeputte2018-08-021-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 2.0.12 change set (as of June 25th 2018) o Change the unicast TTL default value from 1 to the system default (to be compatable with previous versions.) Mulitcast still defaults to 1. o adpative formatting bug fix: crash occurs when values exceed 1 Tera. Add support for Tera and Peta and eliminate the potential crash condition o configure default compile to include isochronous support (use configure --disable-isochronous to remove support) o replace 2.0.11's --vary-load option with a more general -b option to include <mean>,<stdev>, e.g. -b 100m,40m, which will pull from a log normal distribution every 0.1 seconds o fixes for windows cross compile (using mingw32) o compile flags of -fPIE for android o configure --enable-checkprograms to compile ancillary binaries used to test things such as delay, isoch, pdf generation o compile tests when trying to use 64b seq numbers on a 32b platform o Fix GCC ver 8 warnings 2.0.11 change set (as of May 24th, 2018) o support for -b on server (read rate limiting) o honor -T (ttl) for unicast. (Note: the default value is 1 so this will impact unicast tests that require routing) o support for --isochronous traffic with optional frames per second, mean and variance uses a log normal distribution (requires configure w/-enable-isochronous and compile) o support for --udp triggers (requires configure w/ --enable-udptriggers, early code with very limited support) o support for --udp-histogram with optional bin width and number of bins (default is 1 millisecond bin width and 1000 bins) o support for frame (burst) latency histograms when --isochronous is set o support for --tx-sync with -P for synchonrized writes. Initial use is for WiFi OFDMA latency testing. o support for --incr-dstip with -P for simultaneous flows to multiple destinations (use case is for OFDMA) o support for --vary-load with optional weight, uses log normal distribution (requires -b to set the mean) o support for --l2checks to detect L2 length errors not detected by v4 or v6 payload length errors (requires linux, berkeley packet filters BPFs and AF_PACKET socket support) o support for server joining mulitcast source specific multicast (S,G) and (*,G) for both v4 and v6 on platforms that support it o improved write counters (requires -e) o accounting bug fix on client when write fails, this bug was introduced in 2.0.10 o slight restructure client/server traffic thread code for maintainability o python: flow example script updates o python: ssh node object using asyncio o python: histograms in flows with plotting (assumed gnuplot available) o python: hierarchical clustering of latency histograms (early code) o man pages updates o Note: latency histograms require client and server system clock synchronization. A GPS disciplined oscillator using Precision Time Protocol works well for this. Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* iwinfo: update to version 2018-07-24Nick Hainke2018-07-301-4/+4
| | | | | | | | | | Update to new iwinfo version. Adds support for channel survey. Adds ubus support. Etc. Signed-off-by: Nick Hainke <vincent@systemli.org> (cherry picked from commit 296ae7ab89c179ff39feff973000fcb864754df7)
* iwinfo: bump to latest git HEADJohn Crispin2018-07-301-3/+3
| | | | | | | | | e59f925 hardware: add device ids for QCA9984, 88W8887 and 88W8964 radios 2a82f87 nl80211: back out early when receiving FAIL-BUSY reply 77c32f0 nl80211: fix code calculating average signal and rate Signed-off-by: John Crispin <john@phrozen.org> (cherry picked from commit 20b76c0a5bb7a13dcc739bd644f0f968e3b3c68a)
* dnsmasq: bump to dnsmasq v2.80test3Kevin Darbyshire-Bryant2018-07-2820-1565/+6
| | | | | | | | | | | | | | | | | | Refresh patches Upstream commits since last bump: 3b6eb19 Log DNSSEC trust anchors at startup. f3e5787 Trivial comment change. c851c69 Log failure to confirm an address in DHCPv6. a3bd7e7 Fix missing fatal errors when parsing some command-line/config options. ab5ceaf Document the --help option in the french manual 1f2f69d Fix recurrent minor spelling mistake in french manual f361b39 Fix some mistakes in french translation of the manual eb1fe15 When replacing cache entries, preserve CNAMES which target them. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit 1e93ef84981f2722138824413a1b197fdab7fb6c)
* dnsmasq: don't use network functions at boottime (FS#1542)Hans Dedecker2018-07-282-6/+15
| | | | | | | | | | | | | As dnsmasq is started earlier than netifd usage of network.sh functions at boottime will fail; therefore don't call at boottime the functions which construct the dhcp pool/relay info. As interface triggers are installed the dhcp pool/relay info will be constructed when the interface gets reported as up by netifd. At the same time also register interface triggers based on DHCP relay config. Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> (cherry picked from commit 2336b942b37f265c59547d738ca558b61102833d)
* dnsmasq: bump to latest patches on 2.80rc2Kevin Darbyshire-Bryant2018-07-2819-11/+406
| | | | | | | | | | | | | | | | Refresh patches and backport upstream to current HEAD: a997ca0 Fix sometimes missing DNSSEC RRs when DNSSEC validation not enabled. 51e4eee Fix address-dependent domains for IPv6. 05ff659 Fix stupid infinite loop introduced by preceding commit. db0f488 Handle some corner cases in RA contructed interfaces with addresses changing interface. 7dcca6c Warn about the impact of cache-size on performance. 090856c Allow zone transfer in authoritative mode whenever auth-peer is specified. cc5cc8f Sane error message when pcap file header is wrong. c488b68 Handle standard and contructed dhcp-ranges on the same interface. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit fbf475403b911f46e91b57fb7a6cf3c65276464c)
* odhcpd: update to latest git HEADJo-Philipp Wich2018-07-261-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes: 81a281e dhcpv6-ia: fix border assignment size setting a2ffc59 dhcpv6-ia: fix status code for not on link IAs 5b087a6 dhcpv6-ia: improve error checking in assign_pd() c9114a1 config: fix wrong assignment bb8470f dhcpv4: delay forced renew transaction start 62a1b09 dhcpv4: fix DHCP address space logic d5726ff dhcpv4: improve logging when sending DHCP messages 9484351 odhcpd: call handle_error when socket error can be retrieved c45e2eb dhcpv6: fix out of bounds write in handle_nested_message() c2ff5af dhcpv6-ia: log renew messages as well 676eb38 router: fix possible segfault in send_router_advert() 392701f odhcpd: fix passing possible negative parameter 029123b treewide: switch to C-code style comments 6b79748 router: improve error checking 12e21bc netlink: fix incorrect sizeof argument d7aa414 dhcpv6: improve error checking in dhcpv6_setup_interface() 373495a ubus: fix invalid ipv6-prefix json 79d5e6f ndp: improve error checking d834ae3 dhcpv4: fix error checking in dhcpv4_setup_interface() f2aa383 dhcpv4: fix out of bound access in dhcpv4_put 4591b36 dhcpv4: improve error checking in dhcpv4_setup_interface() 4983ee5 odhcpd: fix strncpy bounds c0f6390 odhcpd: Check if open the ioctl socket failed 345bba0 dhcpv4: improve error checking in handle_dhcpv4() 44cce31 ubus: avoid dumping interface state with NULL message Cherry picked and squashed from commits: b7ef10cbf0 odhcpd: update to latest git HEAD 98a6bee09a odhcpd: update to latest git HEAD 88c88823d5 odhcpd: update to latest git HEAD Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* firewall: update to latest git HEAD and build with LTOHans Dedecker2018-07-261-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | Reduces .ipk size on MIPS from 41.6k to 41.1k Changes: 30463d0 zones: add interface/subnet bound LOG rules 0e77bf2 options: treat time strings as UTC times d2bbeb7 firewall3: make reject types selectable by user aa8846b ubus: avoid dumping interface state with NULL message Cherry picked and squashed from commits: a3f2451fba firewall: update to latest git HEAD 433d71e73e fw3: update to latest git HEAD ef96d1e34a firewall: compile with LTO enabled 1e83f775a3 firewall3: update to latest git HEAD 3ee2c76ae0 firewall: update to latest git HEAD Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> Signed-off-by: John Crispin <john@phrozen.org> Signed-off-by: Felix Fietkau <nbd@nbd.name> Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* wireguard-tools: add wireguard_watchdog scriptAleksandr V. Piskunov2018-07-252-2/+63
| | | | | | | | | | | | | This watchdog script tries to re-resolve hostnames for inactive WireGuard peers. Use it for peers with a frequently changing dynamic IP. persistent_keepalive must be set, recommended value is 25 seconds. Run this script from cron every minute: echo '* * * * * /usr/bin/wireguard_watchdog' >> /etc/crontabs/root Signed-off-by: Aleksandr V. Piskunov <aleksandr.v.piskunov@gmail.com> [bump the package release] Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit 20c4819c7baf6f9b91420849caf30e5137bd75d6)
* wireguard: bump to 0.0.20180718Jason A. Donenfeld2018-07-251-2/+2
| | | | | | | | | | | | | | | 80b41cd version: bump snapshot fe5f0f6 recieve: disable NAPI busy polling e863f40 device: destroy workqueue before freeing queue 81a2e7e wg-quick: allow link local default gateway 95951af receive: use gro call instead of plain call d9501f1 receive: account for zero or negative budget e80799b tools: only error on wg show if all interfaces failk Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> [Added commit log to commit description] Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit 57b808ec88315db6743b3159a04dbb16097597ea)
* wireguard: bump to 0.0.20180708Jason A. Donenfeld2018-07-251-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | * device: print daddr not saddr in missing peer error * receive: style Debug messages now make sense again. * wg-quick: android: support excluding applications Android now supports excluding certain apps (uids) from the tunnel. * selftest: ratelimiter: improve chance of success via retry * qemu: bump default kernel version * qemu: decide debug kernel based on KERNEL_VERSION Some improvements to our testing infrastructure. * receive: use NAPI on the receive path This is a big change that should both improve preemption latency (by not disabling it unconditionally) and vastly improve rx performance on most systems by using NAPI. The main purpose of this snapshot is to test out this technique. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> (cherry picked from commit 4630159294024c0718077e49dbb440919440de87)
* iproute2: tc: backport canonical cake supportKevin Darbyshire-Bryant2018-07-212-150/+154
| | | | | | | | | | | | | | | | | | | iproute2's tc was updated to support the recently upstreamed cake qdisc. Backport this canonical support from upstream into iproute2 v4.16 There is no kernel kmod/userspace tc ABI change in this release from the previous package bump, so everyone can breath a sigh of relief. This is largely a code style change, the exception to prove the rule: option 'autorate_ingress' has been changed to 'autorate-ingress' to fit in with upstream option naming expectations. No openwrt package (e.g. sqm-scripts) has knowledge of 'autorate_ingress' thus only users who made their own scripts or used it within the 'dangerous configuration' options of sqm-scripts will be affected. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* igmpproxy: run in foreground for procdKevin Darbyshire-Bryant2018-07-182-2/+2
| | | | | | | | | | procd needs processes to stay in foreground to remain under its gaze and control. Failure to do so means service stop commands fail to actually stop the process (procd doesn't think it's running 'cos the process has exited already as part of its forking routing) Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit 9d5a2469304eb23b6d09432a6d9b6a57d0019d2a)
* qos-scripts: fix uci callback handlingTony Ambardar2018-07-163-29/+29
| | | | | | | | | | | | | | | | | The previous callback code was fragile, dependent on some UCI callback bugs and side-effects now fixed in master commit 73d8a6ab. Update scripts to use callbacks where appropriate and necessary, while using normal UCI config parsing for all else. This results in smaller, simpler, more robust code. Use callbacks in generate.sh to only process 'interface' defaults and the varying entries for 'reclassify', 'default' and 'classify' sections. Also switch qos-stat to use non-callback UCI handling. The current changes work independently of 73d8a6ab (i.e. both before and after), and are consistent with UCI config parsing documentation. Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
* odhcp6c: add noserverunicast config option for broken DHCPv6 serversHans Dedecker2018-07-152-6/+9
| | | | | | | | | | | Fix broken DHCPv6 servers which provide the server unicast option but do not reply on DHCPv6 renew messages directed to the IPv6 address contained in the server unicast option which results in broken IPv6 connectivity. 67ae6a7 odhcp6c: add option to ignore Server Unicast option Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* odhcp6c: update to latest git HEADHans Dedecker2018-07-151-4/+4
| | | | | | b99c1f6 odhcp6c: remove len check in option parsing handle Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* odhcp6c: user string option supportHans Dedecker2018-07-151-3/+3
| | | | | | ca8822b odhcp6c: add support for user string options Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* uhttpd: update to latest Git headJo-Philipp Wich2018-07-151-3/+3
| | | | | | | | | | | db86175 lua: honour size argument in recv() function d3b9560 utils: add uh_htmlescape() helper 8109b95 file: escape strings in HTML output 393b59e proc: expose HTTP Origin header in process environment 796d42b client: flush buffered SSL output when tearing down client ustream Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit b54bef205846e2b30da23c1316c4a9b941c5078d)
* wireguard: bump to 0.0.20180625Kevin Darbyshire-Bryant2018-07-071-2/+2
| | | | | | | | | | | | | | | | | | | | | dfd9827 version: bump snapshot 88729f0 wg-quick: android: prevent outgoing handshake packets from being dropped 1bb9daf compat: more robust ktime backport 68441fb global: use fast boottime instead of normal boottime d0bd6dc global: use ktime boottime instead of jiffies 18822b8 tools: fix misspelling of strchrnul in comment 0f8718b manpages: eliminate whitespace at the end of the line 590c410 global: fix a few typos bb76804 simd: add missing header 7e88174 poly1305: give linker the correct constant data section size fd8dfd3 main: test poly1305 before chacha20poly1305 c754c59 receive: don't toggle bh Compile-tested-for: ath79 Archer C7 v2 Run-tested-on: ath79 Archer C7 v2 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit 3ce11588f6346ebedde68ef30a06e01999e292bb)
* iproute2: tc: update support for cakeKevin Darbyshire-Bryant2018-07-071-28/+83
| | | | | | | | | | Bump iproute2/tc support of cake. Add support for cake's change to u64 attribute passing for certain attributes (rate & byte counts) Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit a2165f936e94ed71dff5fdbf0fbc58c88fb17158)
* iptables: set nonshared flagJohn Crispin2018-06-221-0/+1
| | | | | | | this makes sure that offloading support is properly included for v4.14 targets. Signed-off-by: John Crispin <john@phrozen.org> (cherry picked from commit ebe1216c7cd10357c3277fb25bae4e508d4b165a)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-23 08:47:56 +0000