aboutsummaryrefslogtreecommitdiffstats
path: root/package/network
Commit message (Collapse)AuthorAgeFilesLines
...
* igmpproxy: bump to 0.2.1Kevin Darbyshire-Bryant2018-05-0710-679/+4
| | | | | | | | | | | | | | The sender domain has a DMARC Reject/Quarantine policy which disallows sending mailing list messages using the original "From" header. To mitigate this problem, the original message has been wrapped automatically by the mailing list software. Point at github which is new, maintained location for igmpproxy. Remove all patches as all have been upstreamed. Closes FS#1456 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* igmpproxy: fix creation of firewall rulesJaap Buurman2018-05-073-9/+14
| | | | | | | | The init sccript for igmpproxy uses the option 'network' both as an interface name for fetching the l3_device name and for creating the firewall rules. This only works if the name of the network and firewall zone are identical. This commit introduces a new option 'zone' for configuring the upstream and downstream firewall zones in order for the init script to create the required firewall rules automatically. When no such options are given, the init script falls back to not creating the firewall rules and the user can opt to create these manually. Signed-off-by: Jaap Buurman <jaapbuurman@gmail.com>
* hostapd: add channel utilization as config optionNick Hainke2018-05-071-2/+7
| | | | | | Add the channel utilization as hostapd configuration option. Signed-off-by: Nick Hainke <vincent@systemli.org>
* iproute2: import latest cakeKevin Darbyshire-Bryant2018-05-072-446/+425
| | | | | | | | | | | | | | | | | | The sender domain has a DMARC Reject/Quarantine policy which disallows sending mailing list messages using the original "From" header. To mitigate this problem, the original message has been wrapped automatically by the mailing list software. Bearing fruits of the latest upstreaming efforts on cake. Changes: diffserv-llt dropped. The paper describing this DSCP allocation has gone stale and doesn't appear used. The userspace to kernel netlink messages for cake have been reworked in a backwards incompatible way, so tc & cake must be bumped together this once. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* iproute2: backport json_print-fix-hidden-64-bit-type-promotionKevin Darbyshire-Bryant2018-05-072-1/+289
| | | | | | | | | | | | | | | | | | | | | | | The sender domain has a DMARC Reject/Quarantine policy which disallows sending mailing list messages using the original "From" header. To mitigate this problem, the original message has been wrapped automatically by the mailing list software. print_uint() will silently promote its variable type to uint64_t, but there is nothing that ensures that the format string specifier passed along with it fits (and the function name suggest to pass "%u"). Fix this by changing print_uint() to use a native 'unsigned int' type, and introduce a separate print_u64() function for printing 64-bit values. All call sites that were actually printing 64-bit values using print_uint() are converted to use print_u64() instead. Since print_int() was already using native int types, just add a print_s64() to match, but don't convert any call sites. Fixes wonkyness in some stats from some qdiscs under tc Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* hostapd: fix a mesh mode crash with CONFIG_TAXONOMY enabledFelix Fietkau2018-05-031-0/+23
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* samba36: add hotplug supportRosy Song2018-05-023-0/+114
| | | | | | | | Add hotplug handle script for storage devices, this will add corresponding option in the /etc/config/samba file automatically. Signed-off-by: Rosy Song <rosysong@rosinson.com>
* iproute2: update to 4.16Hans Dedecker2018-05-024-17/+7
| | | | | | | | | Update to latest version of iproute2, refresh patches. See https://lkml.org/lkml/2018/4/2/349 for a full overview of the changes in 4.16. Build and tested on AR7xxx against musl Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* iptables: fix per object LDFLAGS for aggragate object buildsJohn Crispin2018-05-011-5/+5
| | | | | | | Without this patch the extra LDFLAGS of objects were selected based on the name of the extension being built, which breaks for aggregate so builds. Signed-off-by: John Crispin <john@phrozen.org>
* odhcp6c: update to latest git HEADHans Dedecker2018-04-291-3/+3
| | | | | | | 5316d7f ra: always trigger update in case of RA parameter change 327f73d dhcpv6: fix strncpy bounds Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* netifd: update to latest git HEAD (Coverity fixes)Hans Dedecker2018-04-271-3/+3
| | | | | | | 56ceced interface-ip: remove superfluous iface check in interface_ip_set_enabled() 4f4a8c0 system-linux: fix strncpy bounds Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* iftop: bump to latestKevin Darbyshire-Bryant2018-04-271-3/+3
| | | | | | | | | | | | The sender domain has a DMARC Reject/Quarantine policy which disallows sending mailing list messages using the original "From" header. To mitigate this problem, the original message has been wrapped automatically by the mailing list software. Choose first running interface, rather than first "up" interface (Redhat #1403025) Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* odhcpd: update to latest git HEADHans Dedecker2018-04-231-4/+4
| | | | | | | 4136529 dhcpv6-ia: keep tentative assignments alive for a short time 200cc8f dhcpv6-ia: make assignment lookup more strict Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* wireguard: bump to 20180420Kevin Darbyshire-Bryant2018-04-201-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | 7cc2668 version: bump snapshot 860c7c7 poly1305: do not place constants in different sections 5f1e4ca compat: remove unused dev_recursion_level backport 7e4b991 blake2s: remove unused helper 13225fc send: simplify skb_padding with nice macro a1525bf send: account for route-based MTU bbb2fde wg-quick: account for specified fwmark in auto routing mode c452105 qemu: bump default version dbe5223 version: bump snapshot 1d3ef31 chacha20poly1305: put magic constant behind macro cdc164c chacha20poly1305: add self tests from wycheproof 1060e54 curve25519: add self tests from wycheproof 0e1e127 wg-quick.8: fix typo 2b06b8e curve25519: precomp const correctness 8102664 curve25519: memzero in batches 1f54c43 curve25519: use cmov instead of xor for cswap fa5326f curve25519: use precomp implementation instead of sandy2x 9b19328 compat: support OpenSUSE 15 3102d28 compat: silence warning on frankenkernels 8f64c61 compat: stable kernels are now receiving b87b619 62127f9 wg-quick: hide errors on save Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* hostapd: fix encrypted mesh channel settingsDaniel Golle2018-04-205-1/+226
| | | | | | | | | | | | | | | Import two patches from Peter Oh to allow setting channel bandwidth in the way it already works for managed interfaces. This fixes mesh interfaces on 802.11ac devices always coming up in VHT80 mode. Add a patch to allow HT40 also on 2.4GHz if noscan option is set, which also skips secondary channel scan just like noscan works in AP mode. This time also make sure to add all files to the patch before committing it... Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* Revert "hostapd: fix encrypted mesh channel settings"Felix Fietkau2018-04-205-213/+1
| | | | | | | This reverts commit 7f52919a2f2894125b4dca611eb2d30181af7e0b, which is currently breaking the builds and needs to be reworked Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: fix encrypted mesh channel settingsDaniel Golle2018-04-205-1/+213
| | | | | | | | | | | | Import two patches from Peter Oh to allow setting channel bandwidth in the way it already works for managed interfaces. This fixes mesh interfaces on 802.11ac devices always coming up in VHT80 mode. Add a patch to allow HT40 also on 2.4GHz if noscan option is set, which also skips secondary channel scan just like noscan works in AP mode. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* netifd: update to latest git HEADDaniel Golle2018-04-201-3/+3
| | | | | | b3dca7b wireless: include noscan option in common wdev vars Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* odhcpd: update to latest git HEAD (FS#1457)Hans Dedecker2018-04-191-4/+4
| | | | | | dcfc06a router: fix managed address configuration setting Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* network/uqmi: pipe the output off qmi_wds_stop to /dev/nullFlorian Eckert2018-04-191-3/+8
| | | | | | | | | | Pipe uqmi output from qmi_wds_stop function into /dev/null. This will supress the following output in proto teardown. netifd: wwan (x): "No effect" netifd: wwan (x): Command failed: Permission denied Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* hostapd: mesh: make forwarding configurableDaniel Golle2018-04-183-2/+245
| | | | | | | | | | | For unencrypted mesh networks our scripts take care of setting the various mesh_param values. wpa_supplicant changes somes of them when being used for SAE encrypted mesh and previously didn't allow configuring any of them. Add support for setting mesh_fwding (which has to be set to 0 when using other routing protocols on top of 802.11s) and update our script to pass the value to wpa_supplicant. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* curl: Deprecate idn(1) support and switch to xz tarballDaniel Engberg2018-04-162-8/+9
| | | | | | | libidn(1) is deprecated, add libidn2 support Switch to xz tarball (smaller size) Signed-off-by: Daniel Engberg <daniel.engberg.lists@pyret.net>
* netifd: update to latest git HEAD (coverity fixes)Hans Dedecker2018-04-161-3/+3
| | | | | | | | | | | | 513eb27 system-linux: check ioctl return value in system_vlan() df1625d system-linux: check ioctl return value in system_if_flags() 209c508 system-linux: fix segfault on alloc failure in system_if_check() 4a8e20e system-linux: fix segfault on error in system_add_ip6_tunnel() 36e4700 handler: fix resource leak on error in netifd_init_script_handlers() 86a0e7c system-linux: remove unnecessary open call in system_if_dump_info() 1e2cf67 system-linux: fix memory leak on error in system_add_vxlan() Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* lldpd: bump to 1.0.1Stijn Tintel2018-04-151-2/+2
| | | | Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* hostapd: fix compile of -mini variantsDaniel Golle2018-04-131-0/+23
| | | | | | Fixes commit d88934aa5a (hostapd: update to git snapshot of 2018-04-09) Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* hostapd: update to git snapshot of 2018-04-09Daniel Golle2018-04-1332-76/+1085
| | | | | | | | | And import patchset to allow 802.11s mesh on DFS channels, see also http://lists.infradead.org/pipermail/hostap/2018-April/038418.html Fix sae_password for encryption mesh (sent upstream as well). Also refreshed existing patches and fixed 463-add-mcast_rate-to-11s. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* ebtables: update to latest git 2018-04-11Matthias Schiffer2018-04-122-5/+5
| | | | | | | | | | | 2e783b227766 ebt_ip: add support for matching IGMP type b5fbb8d786c9 ebt_ip: add support for matching ICMP type and code c5e5b784fd1a Move ICMP type handling functions from ebt_ip6 to useful_functions.c 11da52177196 include: sync linux/netfilter_bridge/ebt_ip.h with kernel Note: the new features require at least kernel 4.17 or backported patches. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* iptables: split physdev match out as a separate packageMatthias Schiffer2018-04-091-1/+10
| | | | | | | Split physdev match out of ipt-extra to allow installing ipt-extra without pulling in br-netfilter. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* dnsmasq: remove example domains from rfc6761.conf (FS#1447)Hans Dedecker2018-04-092-5/+1
| | | | | | | | | | | | RFC6771 does not exclude the forwarding of the example domain as it states : "Caching DNS servers SHOULD NOT recognize example names as special and SHOULD resolve them normally." Example domains cannot be assigned to any user or person by DNS registrars as they're registered in perpetuity to IANA meaning they can be resolved; therefore let's remove the example domains from the rfc6761.conf file. Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* odhcpd: update to latest git HEADHans Dedecker2018-04-091-4/+4
| | | | | | 31f217f router: improve RFC7084 compliancy Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* odhcp6c: update to latest git HEADHans Dedecker2018-04-051-4/+4
| | | | | | | | 74b5a3 script: fix possible negative delay 473f248 dhcpv6: always trigger script update in case of IA updates ea18935 ra: rework route information option handling Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* firewall: update to the latest version, adds hw flow offload supportFelix Fietkau2018-04-051-3/+3
| | | | | | 35b3e74 defaults: add support for setting --hw on the xt_FLOWOFFLOAD rule Signed-off-by: Felix Fietkau <nbd@nbd.name>
* kernel: add support for enabling hardware flow offload via iptablesFelix Fietkau2018-04-051-5/+82
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* samba36: fix some security problemsHauke Mehrtens2018-04-038-3/+322
| | | | | | | | | | This Adds fixes for the following security problems based on debians patches: CVE-2016-2125: Unconditional privilege delegation to Kerberos servers in trusted realms CVE-2017-12163: Server memory information leak over SMB1 CVE-2017-12150: SMB1/2/3 connections may not require signing where they should CVE-2018-1050: Denial of Service Attack on external print server. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* netifd: update to latest git HEADHans Dedecker2018-04-031-3/+3
| | | | | | 3dc8c91 interface-ip: fix memory leak in interface_ip_add_target_route() Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* odhcp6c: update to latest git HEADHans Dedecker2018-03-311-3/+3
| | | | | | | | | | 5cbd305 odhcp6c: improve code readibility eb83b7e treewide: improve error handling b7b11cb dhcpv6: initialize ifreq struct f0469e2 ra: handle socket fail creation d573461 odhcp6c: fix file pointer leakage Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* Revert "iproute2: fix hidden uint to uin64_t promotion in json_print"Kevin Darbyshire-Bryant2018-03-312-66/+1
| | | | | | | | | | This reverts commit 745d0e7f4b6e8659cc967291acd33889035127f0. It looks like upstream don't want the patch so let's revert it here too. I hope a fix from upstream is forthcoming. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* map: fix psidlen becoming negative (FS#1430)Hans Dedecker2018-03-292-11/+17
| | | | | | | | | Fix psidlen becomes negative in case embedded address bit lenght is smaller than IPv4 suffix length. While at it improve parameter checking making the code more logical and easier to read. Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* Revert "ppp: make ppp-multilink provide ppp"Felix Fietkau2018-03-291-10/+9
| | | | | | | | | | opkg currently has some issues with Provides and this change makes the image builder fail because of that. Revert the change for now until opkg is fixed This reverts commit 092d75aa3e86db8331fffdbd0a99987df9dc438b. Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: update to git snapshot of 2018-03-26Daniel Golle2018-03-2735-1530/+153
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The following patches were merged upstream: 000-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch replaced by commit 0e3bd7ac6 001-Prevent-reinstallation-of-an-already-in-use-group-ke.patch replaced by commit cb5132bb3 002-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch replaced by commit 87e2db16b 003-Prevent-installation-of-an-all-zero-TK.patch replaced by commit 53bb18cc8 004-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch replaced by commit 0adc9b28b 005-TDLS-Reject-TPK-TK-reconfiguration.patch replaced by commit ff89af96e 006-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch replaced by commit adae51f8b 007-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch replaced by commit 2a9c5217b 008-WPA-Extra-defense-against-PTK-reinstalls-in-4-way-ha.patch replaced by commit a00e946c1 009-Clear-PMK-length-and-check-for-this-when-deriving-PT.patch replaced by commit b488a1294 010-Optional-AP-side-workaround-for-key-reinstallation-a.patch replaced by commit 6f234c1e2 011-Additional-consistentcy-checks-for-PTK-component-len.patch replaced by commit a6ea66530 012-Clear-BSSID-information-in-supplicant-state-machine-.patch replaced by commit c0fe5f125 013-WNM-Ignore-WNM-Sleep-Mode-Request-in-wnm_sleep_mode-.patch replaced by commit 114f2830d Some patches had to be modified to work with changed upstream source: 380-disable_ctrl_iface_mib.patch (adding more ifdef'ery) plus some minor knits needed for other patches to apply which are not worth being explicitely listed here. For SAE key management in mesh mode, use the newly introduce sae_password parameter instead of the psk parameter to also support SAE keys which would fail the checks applied on the psk field (ie. length and such). This fixes compatibility issues for users migrating from authsae. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* netifd: update to the latest version (fixes FS#1452)Felix Fietkau2018-03-271-4/+4
| | | | | | 9c8d781 netifd: return the interface for locally addressable host dependencies Signed-off-by: Felix Fietkau <nbd@nbd.name>
* dnsmasq: improve init script portability (FS#1446)Hans Dedecker2018-03-242-2/+2
| | | | | | | | | | | | | Improve portability of init script by declaring resolvfile as local in dnsmasq_stop function. Fixes resolvfile being set for older busybox versions in dnsmasq_start in a multi dnsmasq instance config when doing restart; this happens when the last instance has a resolvfile configured while the first instance being started has noresolv set to 1. Base on a patch by "Phil" Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* ethtool: Update to 4.15.Rosen Penev2018-03-231-2/+2
| | | | | | Contains kernel 4.14 updates. Compile tested on mvebu. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* iproute2: cake: support new overhead reporting & stats structuresKevin Darbyshire-Bryant2018-03-231-266/+969
| | | | | | | | | | | | | | | | | | | | | | Cake in kernel space now splits stats structure handling across netlink messages to reduce stack usage issue flagged by upstream kernel checks. Update user space (tc) qdisc handling to understand this new regime. Cake also reports packet overheads & compensation in a different way so add display code for this. e.g. 'tc -s qdisc show dev eth0' reports this extra detail: min/max transport layer size: 28 / 1500 min/max overhead-adjusted size: 65 / 1550 average transport hdr offset: 14 Cake also supports output in JSON format. Patch is bulkier than before because a (slightly out of date - see above stats) man page is included for reference. Better than nothing! Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* firewall: update to latest git HEADHans Dedecker2018-03-221-3/+3
| | | | | | | | | 5cdf15e helpers.conf: add CT rtsp helper d5923f1 Reword rule comments c1a295a defaults: add support for xt_FLOWOFFLOAD rule 41c2ab5 ipsets: add support for specifying entries Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* openvpn: remove deprecated config optionsHans Dedecker2018-03-202-8/+1
| | | | | | | | Remove deprecated config options in 2.5 as described in [0] [0] https://community.openvpn.net/openvpn/wiki/DeprecatedOptions Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* iproute2: fix hidden uint to uin64_t promotion in json_printKevin Darbyshire-Bryant2018-03-192-1/+66
| | | | | | | | | | | | | | | | | | | | | | | | | print_int used 'int' type internally, whereas print_uint used 'uint64_t' These helper functions eventually call vfprintf(fp, fmt, args) which is a variable argument list function and is dependent upon 'fmt' containing correct information about the length of the passed arguments. Unfortunately print_int v print_uint offered no clue to the programmer that internally passed ints to print_uint were being promoted to 64bits, thus the format passed in 'fmt' string vs the actual passed integer could be different lengths. This is even more interesting on big endian architectures where 'vfprintf' would be looking in the middle of an int64 type. Symptoms of this included tc qdisc showing bizarre values for a variety of fields across a variety of qdiscs (e.g. refcnt, flows, quantum) print_u/int now stick with native int size. A similar patch has been sent upstream. Fixes FS#1425 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: bump to 2.79 releaseKevin Darbyshire-Bryant2018-03-191-3/+3
| | | | | | | 94b6878 Tidy crypto.c of old library compat. Now need libnettle 3. 8b96552 Fix compiler warning. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* curl: Update to 7.59Rosen Penev2018-03-191-2/+2
| | | | | | Compile tested on ar71xx. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* openvpn: add config param verify_client_certChristian Bayer2018-03-172-1/+2
| | | | | | | | | Option --client-cert-not-required DEPRECATED is deprecated in v2.4 and removed in OpenVPN 2.5. Replaced by param --verify-client-cert none|optional|require in v2.4 see https://community.openvpn.net/openvpn/wiki/ DeprecatedOptions#a--client-cert-not-required Signed-off-by: Christian Bayer <cave@cavebeat.org> Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> [PKG_ RELEASE increase]
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-06 03:09:44 +0000