aboutsummaryrefslogtreecommitdiffstats
path: root/package/network/services
Commit message (Collapse)AuthorAgeFilesLines
* unetd: only depend on bpf-headers if BPF toolchain support is availableFelix Fietkau2022-09-121-1/+1
| | | | | | If BPF is unavailable, unetd can be built without it (by disabling VXLAN support). Signed-off-by: Felix Fietkau <nbd@nbd.name>
* lldpd: update to 1.0.15Nick Hainke2022-09-111-2/+2
| | | | | | | Release Notes: https://github.com/lldpd/lldpd/releases/tag/1.0.15 Signed-off-by: Nick Hainke <vincent@systemli.org>
* lldpd: add PKG_CPE_IDNick Hainke2022-09-061-0/+1
| | | | | | Add CPE ID for tracking CVEs. Signed-off-by: Nick Hainke <vincent@systemli.org>
* hostapd: rename hostapd multicast_to_unicast option to multicast_to_unicast_allFelix Fietkau2022-09-061-5/+5
| | | | | | | | | | | | | | | | | | | | There are two feature currently altered by the multicast_to_unicast option. 1. bridge level multicast_to_unicast via IGMP snooping 2. hostapd/mac80211 config multicast_to_unicast setting The hostapd/mac80211 setting has the side effect of converting *all* multicast or broadcast traffic into per-station duplicated unicast traffic, which can in some cases break expectations of various protocols. It also has been observed to cause ARP lookup failure between stations connected to the same interface. The bridge level feature is much more useful, since it only covers actual multicast traffic managed by IGMP, and it implicitly defaults to 1 already. Renaming the hostapd/mac80211 option to multicast_to_unicast_all should avoid unintentionally enabling this feature Signed-off-by: Felix Fietkau <nbd@nbd.name>
* unetd: update to the latest versionFelix Fietkau2022-09-012-3/+11
| | | | | | | | | | f5d02c32f811 pex: add support for sending endpoint notification from the wg port via raw socket c3b1127236a0 ubus: add support for querying active networks 8ad119715168 ubus: add support for adding auth_connect hosts at runtime 26dc52789d41 network: add support for configuring extra peers via a separate json file d7fb9e5b065b ubus: add reload command Signed-off-by: Felix Fietkau <nbd@nbd.name>
* unetd: fix handling of connect/tunnel listFelix Fietkau2022-09-011-3/+5
| | | | | | change the type to array, so that uci lists can be used Signed-off-by: Felix Fietkau <nbd@nbd.name>
* mac80211: disable ft-over-ds by defaultFelix Fietkau2022-08-301-1/+1
| | | | | | | | Testing has shown it to be very unreliable in variety of configurations. It is not mandatory, so let's disable it by default until we have a better solution. Signed-off-by: Felix Fietkau <nbd@nbd.name>
* unetd: update to the latest version, makes VXLAN/eBPF optionalFelix Fietkau2022-08-291-8/+22
| | | | | | | | | | b75791a6db25 scripts/update-cmd.pl: reorder add/remove calls to better deal with dynamic changes c29e1ad045d0 scripts/update-cmd.pl: set device up before adding routes/addresses 5ad35ce4beea scripts/update-cmd.pl: run update two times 5d79b88f00c1 add support for overriding peer-exchange-port for individual hosts 0041fcacb624 add support for disabling VXLAN/eBPF support Signed-off-by: Felix Fietkau <nbd@nbd.name>
* unetd: update to the latest versionFelix Fietkau2022-08-281-3/+3
| | | | | | | | 5cbd55f60346 unet-cli: fix formatting of help text 59b97448b636 build.sh: force use of -fPIC on static libraries to fix build error 74a14c00abb0 pex-msg: fix siphash key initializer Signed-off-by: Felix Fietkau <nbd@nbd.name>
* unetd: add WireGuard based VPN connection manager for OpenWrtFelix Fietkau2022-08-273-0/+187
| | | | | | | | | | | | This package simplifies setting up wireguard networks on OpenWrt by a wireguard network as a JSON file, which can be shared across all participating nodes. It can be signed with an authentication key and automatically kept in sync. unetd also supports deterministically generating ipv6 addresses for each host based on the public key and storing those in a hosts file that can be used with dnsmasq. It also supports automatically creating VXLAN tunnels between multiple endpoints. Signed-off-by: Felix Fietkau <nbd@nbd.name>
* uhttpd: update to latest Git HEADJo-Philipp Wich2022-08-241-3/+3
| | | | | | | | | | | | e3395cd ucode: initialize search path before VM init 8cb3f85 ucode: initialize default library search path 188dea2 utils: accept '?' as path terminator in uh_path_match() c5eac5d file: support using dynamic script handlers as error pages 290ff88 relay: trigger close if in header read state with pending data f9db538 ucode: ignore exit exceptions 8ba0b64 cmake: use variables and find_library for dependency Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* hostapd: fix WPA3 enterprise keys and ciphersJoerg Werner2022-08-201-3/+10
| | | | | | | | WPA3 enterprise requires group_mgmt_cipher=BIP-GMAC-256 and if 802.11r is active also wpa_key_mgmt FT-EAP-SHA384. This commit also requires corresponding changes in netifd. Signed-off-by: Joerg Werner <schreibubi@gmail.com>
* hostapd: add mbo flag to get_clients ubus methodStijn Tintel2022-08-151-0/+4
| | | | | | | | | There is no WLAN_STA_MBO flag, but according to the hostapd source code, when an STA does not support MBO, cell_capa will be 0. Use this to indicate MBO support in the get_clients ubus method. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> Reviewed-by: David Bauer <mail@david-bauer.net>
* umdns: add missing syscall to seccomp filterChen Minqiang2022-08-051-0/+4
| | | | | | | | | | | | | There is some syscall missing: 'getdents64' 'getrandom' 'statx' 'newfstatat' Found with: 'mkdir /etc/umdns; ln -s /tmp/1.json /etc/umdns/; utrace /usr/sbin/umdns' Signed-off-by: Chen Minqiang <ptpt52@gmail.com>
* hostapd: prevent unused crypto lib dependencies from being compiledBoris Krasnovskiy2022-07-311-16/+16
| | | | | | Prevented unused crypto lib dependencies from being compiled Signed-off-by: Boris Krasnovskiy <borkra@gmail.com>
* hostapd: add ppsk option (private psk)Manuel Giganto2022-07-151-3/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR allows a user to enable a private psk, where each station may have it's own psk or use a common psk if it is not defined. The private psk is defined using the sta's mac and a radius server is required. ppsk option should be enabled in the wireless configuration along with radius server details. When using PPSK, the key is ignored, it will be retrieved from radius server. SAE is not yet supported (private sae) in hostapd. Wireless example configuration: option encryption 'psk2+ccmp' option ppsk '1' option auth_server '127.0.0.1' option auth_secret 'radiusServerPassword' If you want to use dynamic VLAN on PPSK also include: option dynamic_vlan '2' option vlan_tagged_interface 'eth0' option vlan_bridge 'br-vlan' option vlan_naming '0' It works enabling mac address verification on radius server and requiring the tunnel-password (the private psk) from radius server. In the radius server we need to configure the users. In case of freeradius: /etc/freeradius3/mods-config/files/authorize The user and Cleartext-Password should be the mac lower case using the format "aabbccddeeff" <sta mac> Cleartext-Password := "<sta mac>" Tunnel-Password = <Private Password> Example of a user configured in radius and using dynamic VLAN5: 8cb84a000000 Cleartext-Password := "8cb84a000000" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 5, Tunnel-Password = MyPrivPw If we want to have a default or shared psk, used when the mac is not found in the list, we need to add the following at the end of the radius authorize file: DEFAULT Auth-Type := Accept Tunnel-Password = SharedPw And if using VLANs, for example VLAN6 for default users: DEFAULT Auth-Type := Accept Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 6, Tunnel-Password = SharedPw Signed-off-by: Manuel Giganto <mgigantoregistros@gmail.com>
* hostapd: apply patch to fix building openssl variantPaul Blazejowski2022-07-111-0/+32
| | | | | | | | Add patch from: https://patchwork.ozlabs.org/project/hostap/patch/20220622121355.1337612-1-a.heider@gmail.com/ Fixes: dab9103 ("hostapd: update to 2022-06-02") Signed-off-by: Paul Blazejowski <paulb@blazebox.homeip.net>
* lldpd: update to 1.0.14Nick Hainke2022-07-101-3/+3
| | | | | | | | | | | | Changes - Add configure commands to alter inventory TLVs Fixes - Update seccomp rules for newer kernel/libc - Correctly handle an interface whose index has changed - Don't send VLANs when there are too many Signed-off-by: Nick Hainke <vincent@systemli.org>
* lldpd: switch to codeload.github.comNick Hainke2022-07-101-3/+3
| | | | | | | The mirror does not seem to work well anymore. Switch to codeload.github.com. Signed-off-by: Nick Hainke <vincent@systemli.org>
* wpa_supplicant: compile with OCV supportMichael Yartys2022-07-033-3/+5
| | | | | | | | | | | | | Operating Channel Validation (OCV) is a security feature designed to prevent person-in-the-middle multi-channel attacks. Compile -basic and -full variants with support for OCV. This feature can be configured in the wireless config by setting ocv equal to one of the following values: 0 = disabled (hostapd/wpa_supplicant default) 1 = enabled if wpa_supplicant's SME in use. Otherwise enabled only when the driver indicates support for operating channel validation. Signed-off-by: Michael Yartys <michael.yartys@protonmail.com>
* hostapd: enable compilation of OCV and add build feature discoveryMichael Yartys2022-07-034-3/+11
| | | | | | | | | | | | | | | Operating Channel Validation (OCV) is a security feature designed to prevent person-in-the-middle multi-channel attacks. Compile the -basic and -full variants of hostapd with this feature, and enable discovery of this feature for future luci integration. OCV can be configured by setting ocv equal to one of the following values in the wireless config: 0 = disabled (hostapd/wpa_supplicant default) 1 = enabled 2 = enabled in workaround mode - Allow STA that claims OCV capability to connect even if the STA doesn't send OCI or negotiate PMF. Signed-off-by: Michael Yartys <michael.yartys@protonmail.com>
* hostapd: disable mbo by defaultStijn Tintel2022-06-281-6/+1
| | | | | | | | | | Enabling mbo by default on 802.11ax devices breaks for encryption types that do not enable 802.11w by default. Disable mbo by default to fix this. Enabling mbo by default on 802.11ax devices was not explained in the commit message anyway. Fixes: 6eee9836565c ("hostapd: introduce mbo option") Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* hostapd: support MBO in bss_transition_requestStijn Tintel2022-06-282-3/+61
| | | | | | | Support the use of MBO in the bss_transition_request ubus method. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> Acked-by: David Bauer <mail@david-bauer.net>
* hostapd: introduce mbo optionStijn Tintel2022-06-281-2/+9
| | | | | | | | Introduce a new option mbo to toggle Multi Band Operation aka Agile Multiband for a BSS. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> Acked-by: David Bauer <mail@david-bauer.net>
* hostapd: enable MBO if 802.11ax is enabledStijn Tintel2022-06-281-0/+1
| | | | | | | | Multi Band Operation is required for 802.11ax certification, so let's enable it if 802.11ax support is enabled. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> Acked-by: David Bauer <mail@david-bauer.net>
* hostapd: add config symbol to enable MBOStijn Tintel2022-06-282-0/+15
| | | | | | | | | | Multi Band Operation aka Agile Multiband introduces new Transition and Transition Rejection Reason Codes that should improve client steering. Add a config symbol to enable it, and enable it by default for the full variants. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> Acked-by: David Bauer <mail@david-bauer.net>
* dropbear: cherry-pick upstream commit 544f28a0Konstantin Demin2022-06-271-0/+134
| | | | | | | Resolves #10081 Reported-By: Chen Minqiang <ptpt52@gmail.com> Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
* hostapd: document ubus methodsStijn Tintel2022-06-211-0/+416
| | | | | | | Document the ubus methods we added to hostapd so that people don't have to read code to figure out which methods are available and what they do. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* hostapd: update to 2022-06-02David Bauer2022-06-182-3/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 4383528e0 P2P: Use weighted preferred channel list for channel selection f2c5c8d38 QCA vendor attribute to configure RX link speed threshold for roaming 94bc94b20 Add QCA vendor attribute for DO_ACS to allow using existing scan entries b9e2826b9 P2P: Filter 6 GHz channels if peer doesn't support them d5a9944b8 Reserve QCA vendor sub command id 206..212 ed63c286f Remove space before tab in QCA vendor commands e4015440a ProxyARP: Clear bridge parameters on deinit only if hostapd set them 02047e9c8 hs20-osu-client: Explicit checks for snprintf() result cd92f7f98 FIPS PRF: Avoid duplicate SHA1Init() functionality 5c87fcc15 OpenSSL: Use internal FIPS 186-2 PRF with OpenSSL 3.0 9e305878c SAE-PK: Fix build without AES-SIV c41004d86 OpenSSL: Convert more crypto_ec_key routines to new EVP API 667a2959c OpenSSL: crypto_ec_key_get_public_key() using new EVP_PKEY API 5b97395b3 OpenSSL: crypto_ec_key_get_private_key() using new EVP_PKEY API 177ebfe10 crypto: Convert crypto_ec_key_get_public_key() to return new ec_point 26780d92f crypto: Convert crypto_ec_key_get_private_key() to return new bignum c9c2c2d9c OpenSSL: Fix a memory leak on crypto_hash_init() error path 6d19dccf9 OpenSSL: Free OSSL_DECODER_CTX in tls_global_dh() 4f4479ef9 OpenSSL: crypto_ec_key_parse_{priv,pub}() without EC_KEY API b092d8ee6 tests: imsi_privacy_attr 563699174 EAP-SIM/AKA peer: IMSI privacy attribute 1004fb7ee tests: Testing functionality to discard DPP Public Action frames 355069616 tests: Add forgotten files for expired IMSI privacy cert tests b9a222cdd tests: sigma_dut and DPP curve-from-URI special functionality fa36e7ee4 tests: sigma_dut controlled STA and EAP-AKA parameters 99165cc4b Rename wpa_supplicant imsi_privacy_key configuration parameter dde7f90a4 tests: Update VM setup example to use Ubuntu 22.04 and UML 426932f06 tests: EAP-AKA and expired imsi_privacy_key 35eda6e70 EAP-SIM peer: Free imsi_privacy_key on an error path 1328cdeb1 Do not try to use network profile with invalid imsi_privacy_key d1652dc7c OpenSSL: Refuse to accept expired RSA certificate 866e7b745 OpenSSL: Include rsa.h for OpenSSL 3.0 bc99366f9 OpenSSL: Drop security level to 0 with OpenSSL 3.0 when using TLS 1.0/1.1 39e662308 tests: Work around reentrant logging issues due to __del__ misuse 72641f924 tests: Clean up failed test list in parallel-vm.py e36a7c794 tests: Support pycryptodome a44744d3b tests: Set ECB mode for AES explicitly to work with cryptodome e90ea900a tests: sigma_dut DPP TCP Configurator as initiator with addr from URI ed325ff0f DPP: Allow TCP destination (address/port) to be used from peer URI e58dabbcf tests: DPP URI with host info 37bb4178b DPP: Host information in bootstrapping URI 1142b6e41 EHT: Do not check HE PHY capability info reserved fields 7173992b9 tests: Flush scan table in ap_wps_priority to make it more robust b9313e17e tests: Update ap_wpa2_psk_ext_delayed_ptk_rekey to match implementation bc3699179 Use Secure=1 in PTK rekeying EAPOL-Key msg 1/4 and 2/4 d2ce1b4d6 tests: Wait for request before responding in dscp_response Compile-tested: all versions / ath79-generic, ramips-mt7621 Run-tested: hostapd-wolfssl / ath79-generic, ramips-mt7621 Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: add owe_transition_ifnameDavid Bauer2022-06-161-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add the owe_transition_ifname config option to wifi-ifaces. This allows to configure OWE transition VAPs without adding SSID / BSSID to the uci conifg but instead autodiscovering these parameters from other networks on the same PHY. The following configuration creates a OWE transition mode network constellation. config wifi-iface 'open0' option device 'radio0' option ifname 'open0' option network 'lan' option mode 'ap' option ssid 'FreeNet' option encryption 'none' option owe_transition_ifname 'owe0' config wifi-iface 'owe0' option device 'radio0' option ifname 'owe0' option network 'lan' option mode 'ap' option ssid 'owe_tm.FreeNet' option encryption 'owe' option hidden '1' option owe_transition_ifname 'open0' Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: fix feature detectionRobert Marko2022-06-121-1/+1
| | | | | | | | | | | Fix hostapd feature detection after the bump to 2022-05-08. getopt was not updated correctly after upstream added support for -q arg. This reenables feature detection so that LuCi can check for features like SAE, fast roaming etc. Fixes: c35ff1affe8f ("hostapd: update to 2022-05-08") Signed-off-by: Robert Marko <robimarko@gmail.com>
* hostapd: fix missing HS20 support for hostapd-fullDavid Bauer2022-06-081-1/+1
| | | | | | | | | | | | | | | commit c3a4cddaaf45 ("hostapd: remove hostapd-hs20 variant") as well as commit 9f1927173ac6 ("hostapd: wpas: add missing config symbols") indicate hostapd-full should support Hotspot 2.0 already, but only wpa_supplicant (and wpad) do. How this happened is not really clear, as no commit adding support for Hotspot 2.0 is in the history. Fix this and add Hotspot 2.0 capability to hostapd-full. Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: ubus: add bss-color to get_statusDavid Bauer2022-06-081-0/+6
| | | | | | | | Add the current BSS color to hostapd get_status method. This field is set to -1 in case BSS color is not active for the BSS. Signed-off-by: David Bauer <mail@david-bauer.net> Tested-by: Stijn Tintel <stijn@linux-ipv6.be>
* hostapd: randomize default BSS colorDavid Bauer2022-06-082-1/+25
| | | | | | | In case no specific BSS color is configured, set it to a random value. Signed-off-by: David Bauer <mail@david-bauer.net> Tested-by: Stijn Tintel <stijn@linux-ipv6.be>
* hostapd: update to 2022-05-08David Bauer2022-06-088-86/+94
| | | | | | | | | | Update hostapd to Git HEAD from 2022-05-08. This allows us to take advantage of background radar-detection as well as BSS color collision detection. Suggested-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: David Bauer <mail@david-bauer.net> Tested-by: Stijn Tintel <stijn@linux-ipv6.be>
* hostapd: Radius based VLANs on AP with PSKBernd Naumann2022-06-081-0/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch allows the user to set `auth_server` and related settings on non WPA2 Enterprise AP modes in `/etc/config/wireless`, too, so the Radius Attributes for Dynamic VLAN Assignment can be fetched from Radius. Without this patch, `auth_server` and other needed options are only written to `hostapd-phy<n>.conf` when `option encryption wpa2` is set. `hostapd` however supports "Station MAC address -based authentication" for non WPA Enterprise Modes, too. A classic approch is to use `accept_mac_file` which contains MAC addr and VLAN-ID pairs. But, using `accept_mac_file` does not support VLAN assignment for unknown stations. This is a sample `freeradius3` config, where a known station ("7e:a6:a7:2a:93:d2") is assigned to VLAN `65` and unknown stations are assigned to VLAN `67`. ``` "7ea6a72a93d2" Cleartext-Password := "7ea6a72a93d2" Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id = 65 DEFAULT Cleartext-Password := "%{User-Name}" Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id = 67 ``` Other option is to configure known stations via `accept_mac_file` and using only Radius for unknown stations. I tested this patch only with `wpa_key_mgmt=WPA-PSK`, and assumed that it should work with other Encryption/Access Mode, too. Signed-off-by: Bernd Naumann <bernd.naumann@kr217.de>
* hostapd: drop wnm_disassoc_imminentStijn Tintel2022-06-061-45/+0
| | | | | | | | All known users of this ubus method have been updated to use the new bss_transition_request method instead. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> Acked-by: David Bauer <mail@david-bauer.net>
* uhttpd: update to latest Git HEADChristian 'Ansuel' Marangi2022-06-011-3/+3
| | | | | | | d59d732 client: fix compilation error with GCC 12 51283f9 fix compiler uninitialized variable Signed-off-by: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
* dnsmasq: fix jail_mount for serversfileBruno Victal2022-05-021-1/+8
| | | | | | Fix 'serversfile' option not being jail_mounted by the init script. Signed-off-by: Bruno Victal <brunovictal@outlook.com>
* dnsmasq: add logfacility file to jail mountsDaniel Golle2022-04-251-2/+6
| | | | | | | | If logfacility is a path to a file it needs to be r/w mounted in the sandbox as well for dnsmasq to work. Reported-by: @iointerrupt Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* dropbear: bump to 2022.82Konstantin Demin2022-04-099-66/+90
| | | | | | | | | | | | | | | | | | | | | | - update dropbear to latest stable 2022.82; for the changes see https://matt.ucc.asn.au/dropbear/CHANGES - use $(AUTORELEASE) in PKG_RELEASE - use https for all uris - refresh all patches - rewrite patches: - 100-pubkey_path.patch - 130-ssh_ignore_x_args.patch binary/pkg size changes: - ath79/generic, mips: - binary: 215112 -> 219228 (+4116) - pkg: 111914 -> 113404 (+1490) - ath79/tiny, mips: - binary: 172501 -> 172485 (-16) - pkg: 89871 -> 90904 (+1033) Tested-by: Stijn Segers <foss@volatilesystems.org> Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
* hostapd: add ubus link-measurements notificationsDavid Bauer2022-04-083-0/+43
| | | | | | Notify external ubus subscribers of received link-measurement reports. Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: add ubus method for requesting link measurementsDavid Bauer2022-04-081-0/+65
| | | | | | | | | | Add a ubus method to request link-measurements from connected STAs. In addition to the STAs address, the used and maximum transmit power can be provided by the external process for the link-measurement. If they are not provided, 0 is used as the default value. Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: add support for enabling link measurementsDavid Bauer2022-04-081-0/+10
| | | | | | | Allow external processes to enable advertisement of link-measurement RRM capability. Signed-off-by: David Bauer <mail@david-bauer.net>
* dnsmasq: add procd interface index trackingValentyn Datsko2022-04-061-0/+5
| | | | | | | | | | | | | Problem exist when dnsmasq is exclusively bind to particular interface. After reconfiguring or restarting this interface, its index changes, but dnsmasq uses the old one. When this problem occurs, dnsmasq does not listen on the correct interface so DHCP does not work, and clients do not get an IP address. Procd netdev param can be added to restart dnsmasq when the interface index is changed. Signed-off-by: Valentyn Datsko <valikk.d@gmail.com> [combined into a single &&-connected statement] Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* bridger: add bridge forwarding acceleratorFelix Fietkau2022-04-063-0/+109
| | | | | | | | | This package uses BPF to create a fast path which improves bridging performance by bypassing the bridge layer. It also supports creating tc offload rules for hardware that supports it. Hardware offload support can be used with MT7622 + MT7915 once it is merged Signed-off-by: Felix Fietkau <nbd@nbd.name>
* odhcpd: update to git HEADHans Dedecker2022-03-221-3/+3
| | | | | | | 860ca90 odhcpd: Support for Option NTP and SNTP 83e14f4 router: advertise removed addresses as invalid in 3 consecutive RAs Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* hostapd: SAE - Enable hunting-and-pecking and H2ENick Lowe2022-02-241-0/+2
| | | | | | | | | | | | | | | | | | | | | | | Enable both the hunting-and-pecking loop and hash-to-element mechanisms by default in OpenWRT with SAE. Commercial Wi-Fi solutions increasingly frequently now ship with both hunting-and-pecking and hash-to-element (H2E) enabled by default as this is more secure and more performant than offering hunting-and-pecking alone for H2E capable clients. The hunting and pecking loop mechanism is inherently fragile and prone to timing-based side channels in its design and is more computationally intensive to perform. Hash-to-element (H2E) is its long-term replacement to address these concerns. For clients that only support the hunting-and-pecking loop mechanism, this is still available to use by default. For clients that in addition support, or were to require, the hash-to-element (H2E) mechanism, this is then available for use. Signed-off-by: Nick Lowe <nick.lowe@gmail.com>
* hostapd: fallback to psk when generating r0kh/r1khEneas U de Queiroz2022-02-191-4/+4
| | | | | | | | | | | | | | | | The 80211r r0kh and r1kh defaults are generated from the md5sum of "$mobility_domain/$auth_secret". auth_secret is only set when using EAP authentication, but the default key is used for SAE/PSK as well. In this case, auth_secret is empty, and the default value of the key can be computed from the SSID alone. Fallback to using $key when auth_secret is empty. While at it, rename the variable holding the generated key from 'key' to 'ft_key', to avoid clobbering the PSK. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com> [make ft_key local] Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: add STA extended capabilities to get_clientsDavid Bauer2022-02-191-0/+10
| | | | | | | | | | Add the STAs extended capabilities to the ubus STA information. This way, external daemons can be made aware of a STAs capabilities. This field is of an array type and contains 0 or more bytes of a STAs advertised extended capabilities. Signed-off-by: David Bauer <mail@david-bauer.net>
generated by cgit v1.2.3 (git 2.25.1) at 2025-02-06 13:16:44 +0000