aboutsummaryrefslogtreecommitdiffstats
path: root/package/network
Commit message (Collapse)AuthorAgeFilesLines
* hostapd: add mbedtls variantRosen Penev2022-12-1911-12/+10188
| | | | | | | This adds the current WIP mbedtls patches for hostapd. The motivation here is to reduce size. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* iproute2: update to 6.1.0Nick Hainke2022-12-182-4/+4
| | | | | | | | | | Announcement: https://lore.kernel.org/netdev/20221214094130.7b11ec2e@hermes.local/T/#t Refresh patch: - 170-ip_tiny.patch Signed-off-by: Nick Hainke <vincent@systemli.org>
* hostapd: enable coredumpsFelix Fietkau2022-12-161-0/+2
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: always set a default for the nas identifierFelix Fietkau2022-12-161-2/+3
| | | | | | | It is used for both 802.11r and WPA enterprise. Setting it when not needed is harmless Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: add support for automatically setting RADIUS own-ip dynamicallyFelix Fietkau2022-12-162-2/+118
| | | | | | Some servers use the NAS-IP-Address attribute as a destination address Signed-off-by: Felix Fietkau <nbd@nbd.name>
* iwinfo: update to latest Git HEADJo-Philipp Wich2022-12-161-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 8d15809 cli: print current HT mode 8f86dd6 cli: use IWINFO_HTMODE_COUNT f36b72b cli: use IWINFO_KMGMT_NAMES 91be7e0 cli: use IWINFO_CIPHER_NAMES 49b6ec9 cli: fix printing the scan channel width b1c8873 cli: fix marking the active channel 9e14e64 utils: add iwinfo_band2ghz() and iwinfo_ghz2band() helpers e084781 utils: add helper functions to get names by values d09a77a utils: add iwinfo_htmode_is_{ht|vht|he} helpers 8752977 utils: add and use iwinfo_format_hwmodes() 02f433e lib: add IWINFO_80211_COUNT and IWINFO_80211_NAMES 1d30df1 lib: add IWINFO_BAND_COUNT and IWINFO_BAND_NAMES aefd0ef lib: use common IWINFO_CIPHER_NAMES strings a5b30de lib: add IWINFO_OPMODE_COUNT and use it for IWINFO_OPMODE_NAMES 9f29e79 lib: constify and fixup the string array definitions fddc015 nl80211: mark frequencies where HE operation in not allowed 6d50a7c nl80211: add support for HE htmodes 4ba5713 nl80211: properly get available bands for the hwmode 91b2ada nl80211: update the kernel header nl80211.h 3f619a5 nl80211: fix frequency/channel conversion for the 6G band a77d915 nl80211: don't guess if a name is an ifname c27ce71 devices: add usb device MediaTek MT7921AU 14f864e nl80211: add ability to describe USB devices a5a75fd nl80211: remove ancient wpa_supplicant ctrl socket path dd4e1ff nl80211: fix wpa supplicant ctrl socket permissions d638163 fix -Wdangling-else warnings 4aa6c5a fix -Wreturn-type warning 3112726 fix -Wpointer-sign warning ebd5f84 fix -Wmaybe-uninitialized warning 5469898 fix -Wunused-variable warnings 462b679 fix -Wduplicate-decl-specifier warnings ccaabb4 fix -Wformat-truncation warnings 50380db enable useful compiler warnings via -Wall Fixes: https://github.com/openwrt/openwrt/issues/10158 Fixes: https://github.com/openwrt/openwrt/issues/10687 Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* treewide: remove DRIVER_11N_SUPPORTAndre Heider2022-12-133-15/+0
| | | | | | | | | | | | hostapd's compile time option CONFIG_IEEE80211N was removed almost 3 years ago, 80.211n/HT is always included since then. Noticed because `hostapd -v11n` confusingly returned an error. See hostapd's commit: f3bcd69603 "Remove CONFIG_IEEE80211N build option" Signed-off-by: Andre Heider <a.heider@gmail.com>
* hostapd: fix 350-nl80211_del_beacon_bss.patchAndre Heider2022-12-131-1/+1
| | | | | | | | | | | | | | | | | Pass the expected struct: ../src/drivers/driver_nl80211.c: In function 'wpa_driver_nl80211_del_beacon': ../src/drivers/driver_nl80211.c:2945:31: warning: passing argument 1 of 'nl80211_bss_msg' from incompatible pointer type [-Wincompatible-pointer-types] 2945 | msg = nl80211_bss_msg(drv, 0, NL80211_CMD_DEL_BEACON); | ^~~ | | | struct wpa_driver_nl80211_data * ../src/drivers/driver_nl80211.c:695:50: note: expected 'struct i802_bss *' but argument is of type 'struct wpa_driver_nl80211_data *' 695 | struct nl_msg * nl80211_bss_msg(struct i802_bss *bss, int flags, uint8_t cmd) | ~~~~~~~~~~~~~~~~~^~~ Fixes: 35ff1affe8 "hostapd: update to 2022-05-08" Signed-off-by: Andre Heider <a.heider@gmail.com>
* hostapd: remove an unused function from ubus.cAndre Heider2022-12-131-26/+0
| | | | | | | eee80211_frequency_to_channel() isn't used anymore, which is a leftover from: 2a31e9ca97 "hostapd: add op-class to get_status output" Signed-off-by: Andre Heider <a.heider@gmail.com>
* umbim: Allow roaming and partner connectionsJulio Gonzalez Gil2022-12-111-6/+25
| | | | | | | | | | Allow registration if the SIM is roaming or partner mode, by adding two new options to the protocol. Until now, such registration failed because umbim returns exit codes 4 and 5 for such situations. Signed-off-by: Julio Gonzalez Gil <git@juliogonzalez.es>
* mac80211: update to linux 6.1-rc8Felix Fietkau2022-12-102-533/+238
| | | | | | This should help stay in sync with upstream development Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: use wpa_supplicant for unencrypted mesh connectionsFelix Fietkau2022-12-102-2/+6
| | | | | | It's more reliable than using iw Signed-off-by: Felix Fietkau <nbd@nbd.name>
* comgt-ncm: add support for quectel modem EC200T-EUJan-Niklas Burfeind2022-12-072-0/+22
| | | | | | | | | context_type is an integer mapping of pdptype: 1: IPV4 2: IPV6 3: IPV4V6 Signed-off-by: Jan-Niklas Burfeind <git@aiyionpri.me>
* firewall4: add missing PKG_MIRROR_HASHJo-Philipp Wich2022-12-071-1/+1
| | | | | Fixes: 84183f0d98 ("firewall4: update to latest Git HEAD") Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* firewall4: update to latest Git HEADJo-Philipp Wich2022-12-061-3/+3
| | | | | | | | 700a925 fw4: prevent null access when no ipsets are defined 6443ec7 config: drop input traffic by default 119ee1a ruleset: drop ctstate invalid traffic for masq-enabled zones Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* dnsmasq: add option to expose additional paths to jailDaniel Golle2022-11-272-1/+8
| | | | | | | | | | Add new UCI list 'addn_mount' allowing the expose additional filesystem paths to the jailed dnsmasq process. This is useful e.g. in case of manually configured includes to the configuration file or symlinks pointing outside of the exposed paths as used by e.g. the safe-search package in the packages feed. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* ipset: update to 7.16Nick Hainke2022-11-273-96/+3
| | | | | | | | | | | | | Release Notes: https://lore.kernel.org/netfilter-devel/d65fe5d8-d5ea-ef7-102d-aa1d15bb4d69@netfilter.org/T/#u Patch "0001-lib-ipset-fix-printf-warning.patch" replaced upstream by: http://git.netfilter.org/ipset/commit/?id=e39e3466d2d38cdfe83447f391b550e607bc3ce8 Remove upstreamed: - 0002-Fix-IPv6-sets-nftables-translation.patch Signed-off-by: Nick Hainke <vincent@systemli.org>
* lldpd: update to 1.0.16Nick Hainke2022-11-181-2/+2
| | | | | | | Release Notes: https://github.com/lldpd/lldpd/releases/tag/1.0.16 Signed-off-by: Nick Hainke <vincent@systemli.org>
* dnsmasq: add support for filter-AAAA/AChen Minqiang2022-11-122-0/+5
| | | | | | | | This add --filter-A and --filter-AAAA options, to remove IPv4 or IPv6 addresses from DNS answers. these options is supported since version 2.87. Co-authored-by: NueXini <nuexini@alumni.tongji.edu.cn> Signed-off-by: Chen Minqiang <ptpt52@gmail.com>
* hostapd: remove invalid dtim_period option processingFelix Fietkau2022-11-101-2/+1
| | | | | | | | dtim_period is a bss property, not a device one. It is already handled properly in mac80211.sh Fixes: 30c64825c7ed ("hostapd: add dtim_period, local_pwr_constraint, spectrum_mgmt_required") Signed-off-by: Felix Fietkau <nbd@nbd.name>
* dnsmasq: remove backported CVE patchKevin Darbyshire-Bryant2022-11-061-179/+0
| | | | | | Patch no longer applies/required since bump to v2.87 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: Support nftables nftsetsKevin Darbyshire-Bryant2022-11-062-11/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add build option for nftables sets. By default disable iptables ipset support. By default enable nftable nftset support since this is what fw4 uses. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> dnsmasq: nftset: serve from ipset config Use existing ipset configs as source for nftsets to be compatible with existing configs. As the OS can either have iptables XOR nftables support, it's fine to provide both to dnsmasq. dnsmasq will silently fail for the present one. Depending on the dnsmasq compile time options, the ipsets or nftsets option will not be added to the dnsmasq config file. dnsmasq will try to add the IP addresses to all sets, regardless of the IP version defined for the set. Adding an IPv6 to an IPv4 set and vice versa will silently fail. Signed-off-by: Mathias Kresin <dev@kresin.me> dnsmasq: support populating nftsets in addition to ipsets Tell dnsmasq to populate nftsets instead of ipsets, if firewall4 is present in the system. Keep the same configuration syntax in /etc/config/dhcp, for compatibility purposes. Huge thanks to Jo-Philipp Wich for basically writing the function. Signed-off-by: Jo-Philipp Wich <jo@mein.io> Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com> dnsmasq: obtain nftset ip family from nft Unfortunately dnsmasq nft is noisy if an attempt to add a mismatched ip address family to an nft set is made. Heuristic to guess which ip family a nft set might belong by inferring from the set name. In order of preference: If setname ends with standalone '4' or '6' use that, else if setname has '4' or '6' delimited by '-' or '_' use that (eg foo-4-bar) else If setname begins with '4' or '6' standalone use that. By standalone I mean not as part of a larger number eg. 24 If the above fails then use the existing nft set query mechanism and if that fails, well you're stuffed! With-thanks-to: Jo-Philipp Wich <jo@mein.io> who improved my regexp knowledge. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> dnsmasq: specify firewall table for nftset Permit ipsets to specify an nftables table for the set. New config parameter is 'table'. If not specified the default of 'fw4' is used. config ipset list name 'BK_4,BK_6' option table 'dscpclassify' option table_family 'ip' option family '4' list domain 'ms-acdc.office.com' list domain 'windowsupdate.com' list domain 'update.microsoft.com' list domain 'graph.microsoft.com' list domain '1drv.ms' list domain '1drv.com' The table family can also be specified, usually 'ip' or 'ip6' else the default 'inet' capable of both ipv4 & ipv6 is used. If the table family is not specified then finally a family option is available to specify either '4' or '6' for ipv4 or ipv6 respectively. This is all in addition to the existing heuristic that will look in the nftset name for an ip family clue, or in total desperation, query the value from the nftset itself. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: add uci-defaults script for ipset migrationMathias Kresin2022-11-062-0/+33
| | | | | | | | When running sysupgrade from an existing configuration, move existing ipset definitions to a dedicated config section. Later on, it will allow to serve ipset as well as nftable sets from the same configuration. Signed-off-by: Mathias Kresin <dev@kresin.me>
* dnsmasq: bump to 2.87Kevin Darbyshire-Bryant2022-11-063-10/+10
| | | | | | Bump dnsmasq to 2.87 & refresh patches Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: Backport DHCPv6 server fix (CVE-2022-0934)Hauke Mehrtens2022-11-051-0/+179
| | | | | | | | | | | This backports a commit from upstream dnsmasq to fix CVE-2022-0934. CVE-2022-0934 description: A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an attacker who sends a crafted packet processed by dnsmasq, potentially causing a denial of service. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* uhttpd: use procd to reload on acme renewGlen Huang2022-11-043-6/+2
| | | | | | | Calling /etc/init.d/uhttpd reload directly in the acme hotplug script can inadvertently start a stopped instance. Signed-off-by: Glen Huang <i@glenhuang.com>
* firewall: config: drop input traffic by defaultBaptiste Jonglez2022-11-011-1/+1
| | | | | | | | | | | | | | | | | | | This is necessary with firewall4 to avoid a hard-to-diagnose race condition during boot, causing DNAT rules not to be taken into account correctly. The root cause is that, during boot, the ruleset is mostly empty, and interface-related rules (including DNAT rules) are added incrementally. If a packet hits the input chain before the DNAT rules are setup, it can create buggy conntrack entries that will persist indefinitely. This new default should be safe because firewall4 explicitly accepts authorized traffic and rejects the rest. Thus, in normal operations, the default policy is not used. Fixes: #10749 Ref: https://github.com/openwrt/openwrt/issues/10749 Signed-off-by: Baptiste Jonglez <git@bitsofnetworks.org>
* iwinfo: update to the latest versionHauke Mehrtens2022-11-011-3/+3
| | | | | | 00aab87 Correctly identify key management algorithms starting with "FT-" Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* odhcpd: update to git HEADHans Dedecker2022-10-311-3/+3
| | | | | | | | a92c0a7 dhcpv6-ia: make tmp lease file hidden 4a673e1 fix null pointer dereference for INFORM messages 860ca90 odhcpd: Support for Option NTP and SNTP Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* ltq-vdsl-vr9-app: extend ubus call to provide DSL statisticsRoland Barenbrug2022-10-301-2/+130
| | | | | | | | | Adding a new method to `ubus call dsl` to retrieve DSL statistics used to feed the DSL charts (bit allocation, SNR, QLN and HLOG) Signed-off-by: Roland Barenbrug <roland@treslong.com> [fix pointer error, clean up] Signed-off-by: Andre Heider <a.heider@gmail.com>
* ltq-vdsl-vr9-app: skip invalid line status valuesRoland Barenbrug2022-10-301-7/+9
| | | | | | | | | DSL_G997_LineStatusData_t defines special invalid values, skip these metrics. Signed-off-by: Roland Barenbrug <roland@treslong.com> [split patch] Signed-off-by: Andre Heider <a.heider@gmail.com>
* iproute2: update to 6.0.0Nick Hainke2022-10-2210-34/+11
| | | | | | | | | | | | | | | | | | | | Release Notes: https://lore.kernel.org/netdev/20221004082610.56b04719@hermes.local/t/ Remove upstreamed patch: - 010-ipstats-Add-param.h-for-musl.patch Refreshed: - 140-keep_libmnl_optional.patch - 145-keep_libelf_optional.patch - 150-keep_libcap_optional.patch - 155-keep_tirpc_optional.patch - 170-ip_tiny.patch - 190-fix-nls-rpath-link.patch - 200-drop_libbsd_dependency.patch - 300-selinux-configurable.patch Signed-off-by: Nick Hainke <vincent@systemli.org>
* thc-ipv6: update to 3.8Nick Hainke2022-10-223-14/+14
| | | | | | | | | | | | | | | | | | Remove upstreamed patches: - 000-cflags_override.patch Manually refresh patches: - 100-no-ssl.patch Add patches: - 101-remove-march-native.patch Add THC_APPLETS: - toobigsniff6 - flood_unreach6 - connect6 Signed-off-by: Nick Hainke <vincent@systemli.org>
* wireless-tools: add package CPE IDPetr Štetiar2022-10-191-0/+1
| | | | | | | | Common Platform Enumeration (CPE) is a structured naming scheme for information technology systems, software, and packages. Suggested-by: Steffen Pfendtner <s.pfendtner@ads-tec.de> Signed-off-by: Petr Štetiar <ynezz@true.cz>
* ethtool: update to 6.0Nick Hainke2022-10-181-2/+2
| | | | | | | Release Notes: https://lwn.net/Articles/910841/ Signed-off-by: Nick Hainke <vincent@systemli.org>
* firewall4: update to latest Git HEADJo-Philipp Wich2022-10-181-3/+3
| | | | | | 7ae5e14 fw4: gracefully handle `null` return values from `fd.read("line")` Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* uhttpd: use acme hotplugGlen Huang2022-10-182-1/+6
| | | | | | | Reload uhttpd after certificates are renewed with acme. Reviewed-by: Toke Høiland-Jørgensen <toke@toke.dk> Signed-off-by: Glen Huang <i@glenhuang.com>
* firewall4: update to latest Git HEADJo-Philipp Wich2022-10-151-3/+3
| | | | | | | | | | | | | | | 4fbf6d7 ruleset.uc: log forwarded traffic not matched by zone policies c7201a3 main.uc: reintroduce set reload restriction 756f1e2 ruleset: fix emitting set_mark/set_xmark rules with masks 3db4741 ruleset: properly handle zone names starting with a digit 43d8ef5 fw4: fix formatting of default log prefix 592ba45 main.uc: remove uneeded/wrong set reload restrictions b0a6bff tests: fix testcases 145e159 fw4: recognize `option log` and `option counter` in `config nat` sections ce050a8 fw4: fall back to device if l3_device is not available in ifstatus Fixes: #10639, #10965 Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* iwinfo: update to the latest versionFelix Fietkau2022-10-141-3/+3
| | | | | | 0496c722f1d7 nl80211: fix issues with renamed wiphy and multiple phy per device Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: add measurement report value for beacon reportsNick Hainke2022-10-131-0/+1
| | | | | | | | | | | | | | | | | Add the measurement report value to the beacon reports send via ubus. It is possible to derive from the measurement report if a station refused to do a beacon report and why. It is important to know why a station refuses to do a beacon-report. In particular, we should not request a beacon report from a station again that refused a beacon-report before. The rejection reasons can be found by looking at the bits defined by: - MEASUREMENT_REPORT_MODE_ACCEPT - MEASUREMENT_REPORT_MODE_REJECT_LATE - MEASUREMENT_REPORT_MODE_REJECT_INCAPABLE - MEASUREMENT_REPORT_MODE_REJECT_REFUSED Suggested-by: Ian Clowes <clowes_ian@hotmail.com> Signed-off-by: Nick Hainke <vincent@systemli.org>
* odhcp6c: respect 'delegate' option for 464XLAT sub-interfaceLech Perczak2022-10-092-1/+2
| | | | | | | | | dhcpv6.script contained support for disabling prefix delegation of 464XLAT sub-interface, but netifd protocol handler was missing the required export to disable this. Add missing export, akin to DS-Lite and MAP. Signed-off-by: Lech Perczak <lech.perczak@gmail.com> Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> [PKG_RELEASE increase]
* build: prefer HTTPS if available (for packages)Daniel Cousens2022-10-055-5/+5
| | | | | | | | Changes PKG_SOURCE_URL's for arptables, bsdiff, dnsmasq, fortify-headers, ipset, ipset-dns, libaudit, libpcap, libressl, lua, lua5.3, tcpdump and valgrind, to HTTPS Signed-off-by: Daniel Cousens <github@dcousens.com>
* treewide: fix security issues by bumping all packages using libwolfsslPetr Štetiar2022-10-031-1/+1
| | | | | | | | | | | | | | | | | As wolfSSL is having hard time maintaining ABI compatibility between releases, we need to manually force rebuild of packages depending on libwolfssl and thus force their upgrade. Otherwise due to the ABI handling we would endup with possibly two libwolfssl libraries in the system, including the patched libwolfssl-5.5.1, but still have vulnerable services running using the vulnerable libwolfssl-5.4.0. So in order to propagate update of libwolfssl to latest stable release done in commit ec8fb542ec3e4 ("wolfssl: fix TLSv1.3 RCE in uhttpd by using 5.5.1-stable (CVE-2022-39173)") which fixes several remotely exploitable vulnerabilities, we need to bump PKG_RELEASE of all packages using wolfSSL library. Signed-off-by: Petr Štetiar <ynezz@true.cz>
* qos-scripts: fix trailing whitespace in config filesManas Sambhus2022-09-274-8/+7
| | | | Signed-off-by: Manas Sambhus <manas.sambhus+github@gmail.com>
* qos-scripts: replace modprobe by rmmodManas Sambhus2022-09-271-2/+1
| | | | | | modprobe -r is not available on all platforms, hence use rmmod Signed-off-by: Manas Sambhus <manas.sambhus+github@gmail.com>
* ppp: use modprobe in place of insmodManas Sambhus2022-09-272-15/+5
| | | | | | | This will prevent `module is already loaded` lines from appearing in the logs when a PPP connection is reconnecting Signed-off-by: Manas Sambhus <manas.sambhus+github@gmail.com>
* nftables: backport fix to interval based rulesKevin Darbyshire-Bryant2022-09-262-1/+24
| | | | | | | | | 'rule inet dscpclassify dscp_match meta l4proto { udp } th dport { 3478 } th sport { 3478-3497, 16384-16387 } goto ct_set_ef' works with 'nft add', but not 'nft insert', the latter yields: "BUG: unhandled op 4". Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* iwinfo: update to the latest versionFelix Fietkau2022-09-221-3/+3
| | | | | | | | | | 46f04f3808e8 devices: add MediaTek MT7986 WiSoC b3e08c8b5a8f ops: make support for wireless extensions optional 1f695d9c7f82 nl80211: allow phy names that don't start with 'phy' b7f9f06e1594 nl80211: fix phy/netdev index lookup 4a43b0d40ba5 nl80211: look up the phy name instead of assuming name == phy<idx> Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: add ubus notification on sta authorizedFelix Fietkau2022-09-223-2/+79
| | | | | | | Also include the station auth_type in the ubus and log message in order to detect, if clients used FT or FILS to associate Signed-off-by: Felix Fietkau <nbd@nbd.name>
* kernel: disable wireless extensions only when neededFelix Fietkau2022-09-221-0/+1
| | | | | | They are only needed by a few very old drivers Signed-off-by: Felix Fietkau <nbd@nbd.name>
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-20 11:25:51 +0000