aboutsummaryrefslogtreecommitdiffstats
path: root/package/network
Commit message (Collapse)AuthorAgeFilesLines
...
* dropbear: make ssh compression support configurableMarcin Jurkowski2017-12-132-3/+13
| | | | | | | | | | Adds config option to enable compression support which is usefull when using a terminal sessions over a slow link. Impact on binary size is negligible but additional 60 kB (uncompressed) is needed for a shared zlib library. Signed-off-by: Marcin Jurkowski <marcin1j@gmail.com> (cherry picked from commit a816e1eac761bfdac720d00d15feb18b7b9fd1e3)
* openvpn: update to 2.4.4Magnus Kroken2017-12-132-34/+58
| | | | | | | | | | Fixes CVE-2017-12166: out of bounds write in key-method 1. Remove the mirror that was temporarily added during the 2.4.3 release. Signed-off-by: Magnus Kroken <mkroken@gmail.com> (cherry picked from commit a9a37526a9df3b565f5242857d17887cb492afab)
* dnsmasq: Pass TARGET_CPPFLAGS to MakefileFlorian Fainelli2017-12-131-1/+1
| | | | | | | | | | With the introduction of the ubus notifications, we would now fail building dnsmasq with external toolchains that don't automatically search for headers. Pass TARGET_CPPFLAGS to the Makefile to resolve that. Fixes: 34a206bc1194 ("dnsmasq: add ubus notifications for new leases") Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> (cherry picked from commit ef485bb23d207e0b1031d264a6fafce01d2bdf8f)
* wwan: json format in some modem definitionsAlexandru Ardelean2017-12-13268-349/+349
| | | | | | | | | | | | | | | | | | | | | Method used: ``` cd package/network/utils/wwan/files/data sed -e 's/}}/}/g' -i * sed -e 's/}\t"acm": 1/\t"acm": 1/g' -i * sed -e 's/}\t"generic": 1/\t"generic": 1/g' -i * ``` Manually adjusted commas. Validated with ``` for f in `ls` ; do echo $f ; python -m json.tool < $f || break ; done ``` Thanks to @lynxis for pointing out the commas. Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com> (cherry picked from commit ad510c4d62fd6dd879a02cb2253eb37c2179d9c0)
* samba36: Remove syslog and load printers lines.Rosen Penev2017-12-131-2/+0
| | | | | | | printer support is removed using 200-remove_printer_support.patch. the syslog parameter requires samba to be compiled with --with-syslog. Currently samba does not log to syslog and probably has not for a long time. Signed-off-by: Rosen Penev <rosenp@gmail.com> (cherry picked from commit 343e3d2ba8efe20554522419697e0e4c3038c92f)
* samba36: Don't resolve interfaces.Rosen Penev2017-12-132-7/+2
| | | | | | | | It's redundant and also buggy. IPv6 link local addresses and ::1 are not resolved for example. Doesn't matter since lo and br-lan for example, resolve to them. Signed-off-by: Rosen Penev <rosenp@gmail.com> Acked-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk> (cherry picked from commit b2f60e6a7245c192703528a46dfb630c664dbc0c)
* samba36: Remove guest ok since LuCI configures it.Rosen Penev2017-12-131-2/+1
| | | | | | | guest ok is set per share and as such, don't override it. also, fix an error introduced in the last commit. Signed-off-by: Rosen Penev <rosenp@gmail.com> (cherry picked from commit ccb79a310c5273bf32d590323a99e72b587a0fb0)
* samba36: Remove legacy optionsRosen Penev2017-12-131-7/+2
| | | | | | | | | | | | | | Browseable is now set through LuCI per share, so remove it. Same with writeable (inverted synonym for read only). domain master and preferred master seem to be legacy settings for Windows 9x. encrypt passwords defaults to yes. Probably should not be disabled either. Also reordered alphabetically. Signed-off-by: Rosen Penev <rosenp@gmail.com> [rewrap commit message, fix SoB, fix author, bump pkg revsion] Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit 9dcb3fe7eb06b42c4f026e6cc5e89b2a18932782)
* netfilter: add iptables-mod-rpfilter packageAlin Nastac2017-12-131-0/+14
| | | | | | | | | | Unlike /proc/sys/net/ipv4/conf/INTF/rp_filter flag, rule iptables -t raw -I PREROUTING -m rpfilter --invert -j DROP prevents conntrack table to become full when a packet flood with randomly selected source IP addresses is received from the lan side. Signed-off-by: Alin Nastac <alin.nastac@gmail.com> (cherry picked from commit d8748e537f11ab5f2b5e2ed25d94baa5ce353984)
* dropbear: add option to set max auth triesStijn Tintel2017-12-132-2/+4
| | | | | | | | Add a uci option to set the new max auth tries paramater in dropbear. Set the default to 3, as 10 seems excessive. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> (cherry picked from commit 6371159b4ae8b4dd94d6319ac805b0c26962bb14)
* dropbear: server support option '-T' max auth triesKevin Darbyshire-Bryant2017-12-132-2/+132
| | | | | | | | | | | | | Add support for '-T n' for a run-time specification for maximum number of authentication attempts where 'n' is between 1 and compile time option MAX_AUTH_TRIES. A default number of tries can be specified at compile time using 'DEFAULT_AUTH_TRIES' which itself defaults to MAX_AUTH_TRIES for backwards compatibility. Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk> (cherry picked from commit 9aaf3d3501642640c9ec74268e671171c8de6103)
* hostapd: configure NAS ID regardless of encryptionYury Shvedov2017-12-131-3/+3
| | | | | | | | | | | | RADIUS protocol could be used not only for authentication but for accounting too. Accounting could be configured for any type of networks. However there is no way to configure NAS Identifier for non-WPA networks without this patch. Signed-off-by: Yury Shvedov <yshvedov@wimarksystems.com> [cleanup commit message] Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> (cherry picked from commit 37c1513b1f98c93bf84bbcedd9782568e7d4abba)
* hostapd: add acct_interval optionYury Shvedov2017-12-131-2/+5
| | | | | | | | | Make an ability to configure Accounting-Interim-Interval via UCI Signed-off-by: Yury Shvedov <yshvedov@wimarksystems.com> [add hostapd prefix, cleanup commit message] Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> (cherry picked from commit 0e7bbcd43b6f4b54ecc5c40130b5f86cbc9f1c07)
* ppp: propagate master firewall zone to dynamic slave interfaceHans Dedecker2017-12-132-1/+4
| | | | | | | | | | | Assign the virtual DHCPv6 interface the firewall zone of the parent interface so fw3 knows the zone to which the virtual DHCPv6 interface belongs. This guarantees the firewall settings are applied correctly for the virtual DHCPv6 interface and allows to query the zone to which the virtual DHCPv6 interface belongs via the fw3 network option. Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> (cherry picked from commit 21f25bc4a325b3075d6426047640e9cf6176894c)
* lldpd: bump to 0.9.7Stijn Tintel2017-12-131-2/+2
| | | | | Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> (cherry picked from commit 423a7a6b752d4780f7f61722443ed5f4f50e3bda)
* lldpd: drop specific respawn params [use system-wide]Alexandru Ardelean2017-12-131-3/+0
| | | | | | | | I think I added these respawn params [a while back], when I did the conversion to procd init script format. Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com> (cherry picked from commit ce8bfa9407bc1518107a99edc8568a59fe269fa5)
* comgt-3g: enable modem before to setpinGiuseppe Lippolis2017-12-131-0/+1
| | | | | | | some modems needs to be enabled with CFUN=1 before to set the pin Signed-off-by: Giuseppe Lippolis <giu.lippolis@gmail.com> (cherry picked from commit db776c01e1202307b78a4bb757f78db5ea48e27e)
* network/utils/ipset: Update to 6.32Daniel Engberg2017-12-131-2/+2
| | | | | | | Update ipset to 6.32 Signed-off-by: Daniel Engberg <daniel.engberg.lists@pyret.net> (cherry picked from commit ea2927e1eaa321033b28f08db0ec59e7df5f7806)
* hostapd: fix reload frequency change patchAbhilash Tuse2017-12-132-7/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When sta is configured, hostapd receives 'stop' and 'update' command from wpa_supplicant. In the update command, hostapd gets sta parameters with which it configures ap. Problem is, with the default wireless configuration: mode:11g freq:2.4GHz channel:1 If sta is connected to 5GHz network, then ap does not work. Ideally with 340-reload_freq_change.patch hostapd should reload the frequency changes and start ap in 5GHz, but ap becomes invisible in the network. This issue can be reproduced with following /etc/config/wireless: config wifi-device radio0 option type mac80211 option channel 1 option hwmode 11g option path 'virtual/uccp420/uccwlan' option htmode 'none' config wifi-iface 'ap' option device 'radio0' option encryption 'none' option mode 'ap' option network 'ap' option ssid 'MyTestNet' option encryption none config wifi-iface 'sta' option device radio0 option network sta option mode sta option ssid TestNet-5G option encryption psk2 option key 12345 This change updates current_mode structure based on configured hw_mode received from wpa_supplicant. Also prepare rates table after frequency selection. Signed-off-by: Abhilash Tuse <Abhilash.Tuse@imgtec.com> Signed-off-by: Felix Fietkau <nbd@nbd.name> [cleanup, patch refresh] (cherry picked from commit 41feba8c4aa33ca3c6fa7c1a6c3224aae02440a7)
* dropbear: fix procd interface trigger installHans Dedecker2017-12-131-1/+3
| | | | | | | | | Install procd interface triggers only for interfaces which are enabled so dropbear instances running on (an) enabled interface(s) are not restarted due to an interface trigger of an interface which is disabled. Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> (cherry picked from commit e5bbead1a83944293fccc27679ba9846d133374e)
* netifd: return error status in reload_serviceHans Dedecker2017-12-131-1/+4
| | | | | | | | | Based on a patch by Alexandru Ardelean. netifd ubus reload call returns the actual reload error status; return error status as well in reload_service Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> (cherry picked from commit 4b195a611fe146969e813ce77ecf74ce5f9c176b)
* iproute2: add libgenl.h and ll_map.h to InstallDev sectionHans Dedecker2017-12-131-1/+1
| | | | | | | | | Commit f4e312ddf855375667f43c842c7187934b8aca92 adds libnetlink to staging dir but did not add the header files libgenl.h and ll_map.h which define functions belonging to libnetlink lib Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> (cherry picked from commit fc859fb44b4e7a38a1f1825b05b72b81e80f82a8)
* netifd: fix fw3 warnings in dhcp scriptHans Dedecker2017-12-131-1/+1
| | | | | | | Fix fw3 warnings in dhcp script in case fw3 is not enabled Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> (cherry picked from commit 20e40db524fb6c391f47619b18bf36bf7932478a)
* lldpd: bump to 0.9.6Stijn Tintel2017-12-131-2/+2
| | | | | Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> (cherry picked from commit b03b293079ef3e6cd5488ea7f58a43a1b545c3ef)
* iwcap: fix handling kill signal during dumpFelix Fietkau2017-12-131-13/+13
| | | | | | | Do not run another loop iteration before checking the stop flag Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit 2f09a1e3c950c9b2993ae52d1b0e78317c344470)
* rssileds: Fix build with external toolchainsFlorian Fainelli2017-12-131-2/+4
| | | | | | | | | Pass down TARGET_CPPFLAGS for path to header files, and append the libraries we depend on in TARGET_LDFLAGS. Put TARGET_LDFLAGS at the end of the command line as is required by modern GCC/binutils. Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> (cherry picked from commit 30159b3886849f94cd065ecece7ac988bfb89548)
* swconfig: Link with libuboxFlorian Fainelli2017-12-131-1/+1
| | | | | | | | | | | | | | | | | | | | Fixes linking failures observed with external toolchains: /home/florian/dev/toolchains/stbgcc-4.8-1.5/bin/../lib/gcc/mipsel-linux-gnu/4.8.5/../../../../mipsel-linux-gnu/bin/ld: warning: libubox.so, needed by /home/florian/dev/openwrt/trunk/staging_dir/target-mipsel-unknown-linux-gnu_glibc/usr/lib/libuci.so, not found (try using -rpath or -rpath-link) /home/florian/dev/openwrt/trunk/staging_dir/target-mipsel-unknown-linux-gnu_glibc/usr/lib/libuci.so: undefined reference to `blobmsg_open_nested' /home/florian/dev/openwrt/trunk/staging_dir/target-mipsel-unknown-linux-gnu_glibc/usr/lib/libuci.so: undefined reference to `blobmsg_parse' /home/florian/dev/openwrt/trunk/staging_dir/target-mipsel-unknown-linux-gnu_glibc/usr/lib/libuci.so: undefined reference to `blob_nest_end' /home/florian/dev/openwrt/trunk/staging_dir/target-mipsel-unknown-linux-gnu_glibc/usr/lib/libuci.so: undefined reference to `blobmsg_add_field' Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> (cherry picked from commit fe8618a8fe0db1bc8f343c0f75082ff96e9991ab)
* omcproxy: Update to latest HEADFlorian Fainelli2017-12-131-3/+3
| | | | | | | | Brings the following change: 1fe6f48f8a50 Cmake: Find libubox/list.h Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> (cherry picked from commit 4c02435b9b985a10d33bc195acddd31c8545a277)
* thc-ipv6: Allow overriding CFLAGSFlorian Fainelli2017-12-131-0/+12
| | | | | | | | | thc-ipv6 did not allow an external environment to override CFLAGS, which would lead to our CFLAGS not being passed properly (relro, optimizations, etc...) Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> (cherry picked from commit 9b2321f42d075a12e73a81b89bd49b8696d3700f)
* uqmi: also try newer pin verificationKoen Vandeputte2017-12-111-1/+1
| | | | | | | | | Newer devices tend to only support the newer version of the pin verification command, so also try that one. Fixes PIN issues with modems like the Sierra Wireless MC7455 Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* hostapd: backport fix for wnm_sleep_mode=0Timo Sigurdsson2017-12-072-1/+36
| | | | | | | | | | | | | | | | | | wpa_disable_eapol_key_retries can't prevent attacks against the Wireless Network Management (WNM) Sleep Mode handshake. Currently, hostapd processes WNM Sleep Mode requests from clients regardless of the setting wnm_sleep_mode. Backport Jouni Malinen's upstream patch 114f2830 in order to ignore such requests by clients when wnm_sleep_mode is disabled (which is the default). Signed-off-by: Timo Sigurdsson <public_timo.s@silentcreek.de> [rewrite commit subject (<= 50 characters), bump PKG_RELEASE] Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> (cherry picked from commit bd45e15d0afe64dfed5a02a50a634f7947b50144 fixed PKG_RELEASE and renumbered patch) Conflicts: package/network/services/hostapd/Makefile
* hostapd: Expose the tdls_prohibit option to UCITimo Sigurdsson2017-12-071-1/+6
| | | | | | | | | | | | | | | | | wpa_disable_eapol_key_retries can't prevent attacks against the Tunneled Direct-Link Setup (TDLS) handshake. Jouni Malinen suggested that the existing hostapd option tdls_prohibit can be used to further complicate this possibility at the AP side. tdls_prohibit=1 makes hostapd advertise that use of TDLS is not allowed in the BSS. Note: If an attacker manages to lure both TDLS peers into a fake AP, hiding the tdls_prohibit advertisement from them, it might be possible to bypass this protection. Make this option configurable via UCI, but disabled by default. Signed-off-by: Timo Sigurdsson <public_timo.s@silentcreek.de> (cherry picked from commit 6515887ed9b3f312635409702113dca7c14043e5)
* dnsmasq: backport infinite dns retries fixHans Dedecker2017-12-062-1/+46
| | | | | | | | | | If all configured dns servers return refused in response to a query in strict mode; dnsmasq will end up in an infinite loop retransmitting the dns query resulting into high CPU load. Problem is fixed by checking for the end of a dns server list iteration in strict mode. Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* curl: apply CVE 2017-8816 and 2017-8817 security patchesStijn Segers2017-12-043-1/+209
| | | | | | | | | This commit adds the upstream patches for CVE 2017-8816 and 2017-8817 to the 17.01 Curl package. Compile-tested on ar71xx, ramips and x86. Signed-off-by: Stijn Segers <foss@volatilesystems.org>
* samba36: backport an upstream fix for an information leak (CVE-2017-15275)Felix Fietkau2017-12-042-1/+41
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* wireguard: bump to snapshot 20171127Kevin Darbyshire-Bryant2017-11-271-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | == Changes == * compat: support timespec64 on old kernels * compat: support AVX512BW+VL by lying * compat: fix typo and ranges * compat: support 4.15's netlink and barrier changes * poly1305-avx512: requires AVX512F+VL+BW Numerous compat fixes which should keep us supporting 3.10-4.15-rc1. * blake2s: AVX512F+VL implementation * blake2s: tweak avx512 code * blake2s: hmac space optimization Another terrific submission from Samuel Neves: we now have an implementation of Blake2s using AVX512, which is extremely fast. * allowedips: optimize * allowedips: simplify * chacha20: directly assign constant and initial state Small performance tweaks. * tools: fix removing preshared keys * qemu: use netfilter.org https site * qemu: take shared lock for untarring Small bug fixes. Remove myself from the maintainers list: we have enough and I'm happy to carry on doing package bumps on ad-hoc basis without the 'official' title. Run-tested: ar71xx Archer C7 v2 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* wireguard: bump to 20171122Kevin Darbyshire-Bryant2017-11-241-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bump to latest WireGuard snapshot release: ed479fa (tag: 0.0.20171122) version: bump snapshot efd9db0 chacha20poly1305: poly cleans up its own state 5700b61 poly1305-x86_64: unclobber %rbp 314c172 global: switch from timeval to timespec 9e4aa7a poly1305: import MIPS64 primitive from OpenSSL 7a5ce4e chacha20poly1305: import ARM primitives from OpenSSL abad6ee chacha20poly1305: import x86_64 primitives from OpenSSL 6507a03 chacha20poly1305: add more test vectors, some of which are weird 6f136a3 compat: new kernels have netlink fixes e4b3875 compat: stable finally backported fix cc07250 qemu: use unprefixed strip when not cross-compiling 64f1a6d tools: tighten up strtoul parsing c3a04fe device: uninitialize socket first in destruction 82e6e3b socket: only free socket after successful creation of new df318d1 compat: fix compilation with PaX d911cd9 curve25519-neon: compile in thumb mode d355e57 compat: 3.16.50 got proper rt6_get_cookie 666ee61 qemu: update kernel 2420e18 allowedips: do not write out of bounds 185c324 selftest: allowedips: randomized test mutex update 3f6ed7e wg-quick: document localhost exception and v6 rule Compile-tested-for: ar71xx Run-tested-on: ar71xx Archer C7 v2 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: load instance-specific conf-file if existsEmerson Pinter2017-11-202-8/+8
| | | | | | | Without this change, the instance-specific conf-file is being added to procd_add_jail_mount, but not used by dnsmasq. Signed-off-by: Emerson Pinter <dev@pinter.com.br>
* wireguard: fix portability issueFelix Fietkau2017-11-161-0/+18
| | | | | | | Check if the compiler defines __linux__, instead of assuming that the host OS is the same as the target OS. Signed-off-by: Felix Fietkau <nbd@nbd.name>
* wireguard: move to kernel build directoryFelix Fietkau2017-11-161-1/+1
| | | | | | It builds a kernel module, so its build dir should be target specific Signed-off-by: Felix Fietkau <nbd@nbd.name>
* wireguard: bump to 0.0.20171111Kevin Darbyshire-Bryant2017-11-161-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | edaad55 (tag: 0.0.20171111) version: bump snapshot 7a989b3 tools: allow for NULL keys everywhere 46f8cbc curve25519: reject deriving from NULL private keys 9b43542 tools: remove ioctl cruft f6cea8e allowedips: rename from routingtable 23f553e wg-quick: allow for tabs in keys ab9befb netlink: make sure we reserve space for NLMSG_DONE 73405c0 compat: 4.4.0 has strange ECN function 868be0c wg-quick: stat the correct enclosing folder of config file ceb11ba qemu: bump kernel version 0a8e173 receive: hoist fpu outside of receive loop bee188a qemu: more debugging f1fdd8d device: wait for all peers to be freed before destroying 2188248 qemu: check for memory leaks c77a34e netlink: plug memory leak 0ac8efd device: please lockdep a51e196 global: revert checkpatch.pl changes 65c49d7 Kconfig: remove trailing whitespace Compile-tested-for: ar71xx Run-tested-on: ar71xx Archer C7 v2 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* wireguard: version bump to 0.0.20171101Kevin Darbyshire-Bryant2017-11-051-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Update wireguard to latest snapshot: 9fc5daf version: bump snapshot 748ca6b compat: unbreak unloading on kernels 4.6 through 4.9 7be9894 timers: switch to kees' new timer_list functions 6be9a66 wg-quick: save all hooks on save 752e7af version: bump snapshot 2cd9642 wg-quick: fsync the temporary file before renaming b139499 wg-quick: allow for saving existing interface 582c201 contrib: add reresolve-dns 8e04be1 tools: correct type for CTRL_ATTR_FAMILY_ID c138276 wg-quick: allow for the hatchet, but not by default d03f2a0 global: use fewer BUG_ONs 6d681ce timers: guard entire setting in block 4bf32ca curve25519: only enable int128 if compiler support is sound 86e06a3 device: expand scope of destruct lock e3661ab global: get rid of useless forward declarations bedc77a device: only take reference if netns is different 7c07e22 wg-quick: remember to rewind DNS settings on failure 2352ec0 wg-quick: allow specifiying multiple hooks 573cb19 qemu: test using four cores e09ec4d global: style nits 4d3deae qemu: work around ccache bugs 7491cd4 global: infuriating kernel iterator style 78e079c peer: store total number of peers instead of iterating d4e2752 peer: get rid of peer_for_each magic 6cf12d1 compat: be sure to include header before testing 3ea08d8 qemu: allow for cross compilation d467551 crypto/avx: make sure we can actually use ymm registers c786c46 blake2: include headers for macros 328e386 global: accept decent check_patch.pl suggestions a473592 compat: fix up stat calculation for udp tunnel 9d930f5 stats: more robust accounting 311ca62 selftest: initialize mutex in routingtable selftest 8a9a6d3 netns: use time-based test instead of quantity-based e480068 netns: use read built-in instead of ncat hack for dmesg Compile-tested-for: ar71xx Run-tested-on: ar71xx Archer C7 v2 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: restore ability to include/exclude raw device namesJo-Philipp Wich2017-10-252-3/+3
| | | | | | | | | | | | | | Commit 5cd88f4 "dnsmasq: remove use of uci state for getting network ifname" broke the ability to specify unmanaged network device names for inclusion and exclusion in the uci configuration. Restore support for raw device names by falling back to the input value when "network_get_device" yields no result. Fixes FS#876. Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit a89c36b50875e61c790113d3adee10621575788a)
* wireguard: version bump to 0.0.20171017Jason A. Donenfeld2017-10-171-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a simple version bump. Changes: * noise: handshake constants can be read-only after init * noise: no need to take the RCU lock if we're not dereferencing * send: improve dead packet control flow * receive: improve control flow * socket: eliminate dead code * device: our use of queues means this check is worthless * device: no need to take lock for integer comparison * blake2s: modernize API and have faster _final * compat: support READ_ONCE * compat: just make ro_after_init read_mostly Assorted cleanups to the module, including nice things like marking our precomputations as const. * Makefile: even prettier output * Makefile: do not clean before cloc * selftest: better test index for rate limiter * netns: disable accept_dad for all interfaces Fixes in our testing and build infrastructure. Now works on the 4.14 rc series. * qemu: add build-only target * qemu: work on ubuntu toolchain * qemu: add more debugging options to main makefile * qemu: simplify shutdown * qemu: open /dev/console if we're started early * qemu: phase out bitbanging * qemu: always create directory before untarring * qemu: newer packages * qemu: put hvc directive into configuration This is the beginning of working out a cross building test suite, so we do several tricks to be less platform independent. * tools: encoding: be more paranoid * tools: retry resolution except when fatal * tools: don't insist on having a private key * tools: add pass example to wg-quick man page * tools: style * tools: newline after warning * tools: account for padding being in zero attribute Several important tools fixes, one of which suppresses a needless warning. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> (cherry picked from commit f6c4a9c045797d9be12310eebc6341050fd260ce)
* hostapd: add wpa_disable_eapol_key_retries optionStijn Tintel2017-10-172-1/+6
| | | | | | | | | | | | | | | Commit b6c3931ad6554357a108127797c8d7097a93f18f introduced an AP-side workaround for key reinstallation attacks. This option can be used to mitigate KRACK on the station side, in case those stations cannot be updated. Since many devices are out there will not receive an update anytime soon (if at all), it makes sense to include this workaround. Unfortunately this can cause interoperability issues and reduced robustness of key negotiation, so disable the workaround by default, and add an option to allow the user to enable it if he deems necessary. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> (cherry picked from commit c5f97c9372da3229350184fb263c97d9ea8944c5)
* hostapd: backport extra changes related to KRACKStijn Tintel2017-10-176-0/+730
| | | | | | | | | | | | While these changes are not included in the advisory, upstream encourages users to merge them. See http://lists.infradead.org/pipermail/hostap/2017-October/037989.html Added 013-Add-hostapd-options-wpa_group_update_count-and-wpa_p.patch so that 016-Optional-AP-side-workaround-for-key-reinstallation-a.patch applies without having to rework it. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* wireguard: add wireguard to base packagesJason A. Donenfeld2017-10-162-0/+308
| | | | | | | | | | | | | | | | | | | | | | | | Move wireguard from openwrt/packages to base a package. This follows the pattern of kmod-cake and openvpn. Cake is a fast-moving experimental kernel module that many find essential and useful. The other is a VPN client. Both are inside of core. When you combine the two characteristics, you get WireGuard. Generally speaking, because of the extremely lightweight nature and "stateless" configuration of WireGuard, many view it as a core and essential utility, initiated at boot time and immediately configured by netifd, much like the use of things like GRE tunnels. WireGuard has a backwards and forwards compatible Netlink API, which means the userspace tools should work with both newer and older kernels as things change. There should be no versioning requirements, therefore, between kernel bumps and userspace package bumps. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Acked-by: Jo-Philipp Wich <jo@mein.io> Acked-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit 699c6fcc314225f79156a26db418e15bbc6bf10f)
* hostapd: merge fixes for WPA packet number reuse with replayed messages and ↵Felix Fietkau2017-10-1611-10/+929
| | | | | | | | | | | | | | | | | | | | | | | key reinstallation Fixes: - CERT case ID: VU#228519 - CVE-2017-13077 - CVE-2017-13078 - CVE-2017-13079 - CVE-2017-13080 - CVE-2017-13081 - CVE-2017-13082 - CVE-2017-13086 - CVE-2017-13087 - CVE-2017-13088 For more information see: https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt Backport of bbda81ce3077dfade2a43a39f772cfec2e82a9a5 Signed-off-by: Felix Fietkau <nbd@nbd.name>
* uhttp: update to latest versionAdrian Panella2017-10-031-3/+3
| | | | | | | | | | | | | | 3fd58e9 2017-08-19 uhttpd: add manifest support 88c0b4b 2017-07-09 file: fix basic auth regression 99957f6 2017-07-02 file: remove unused "auth" member from struct path_info c0a569d 2017-07-02 proc: expose HTTP_AUTH_USER and HTTP_AUTH_PASS ad93be7 2017-07-02 auth: store parsed username and password fa51d7f 2017-07-02 proc: do not declare empty process variables a8bf9c0 2017-01-26 uhttpd: Add TCP_FASTOPEN support e6cfc91 2016-10-25 lua: ensure that PATH_INFO starts with a slash Signed-off-by: Adrian Panella <ianchi74@outlook.com>
* odhcpd: don't enable server mode on non-static lan portKarl Palsson2017-10-022-3/+18
| | | | | | | | | | | | Instead of blindly enabling the odhcpd v6 server and RA server on the lan port, only do that if the lan port protocol is "static" This prevents the unhelpful case of a device being a dhcpv4 client and v6 server on the same ethernet port. Signed-off-by: Karl Palsson <karlp@etactica.com> [PKG_SOURCE_DATE increase; odhcpd.defaults script cleanup] Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-18 12:41:45 +0000