aboutsummaryrefslogtreecommitdiffstats
path: root/package/network/utils
Commit message (Collapse)AuthorAgeFilesLines
* ethtool: fix PKG_CONFIG_DEPENDSMatthias Schiffer2020-01-071-1/+1
| | | | | | | Add missing CONFIG_ prefix. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net> (cherry picked from commit 41c19dd542973dbc1336ecceaa32777506933cdf)
* iptables: bump PKG_RELEASEYousong Zhou2019-10-241-1/+1
| | | | | | | | | Package content changed with the previous two cherry-picks dff0b2104d kernel: netfilter: Add nf_tproxy_ipv{4,6} and nf_socket_ipv{4,6} a2fe698a40 kernel: Added required dependencies for socket match. Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* tcpdump: update to 4.9.3DENG Qingfang2019-10-194-19/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixed CVEs: CVE-2017-16808 CVE-2018-10103 CVE-2018-10105 CVE-2018-14461 CVE-2018-14462 CVE-2018-14463 CVE-2018-14464 CVE-2018-14465 CVE-2018-14466 CVE-2018-14467 CVE-2018-14468 CVE-2018-14469 CVE-2018-14470 CVE-2018-14879 CVE-2018-14880 CVE-2018-14881 CVE-2018-14882 CVE-2018-16227 CVE-2018-16228 CVE-2018-16229 CVE-2018-16230 CVE-2018-16300 CVE-2018-16301 CVE-2018-16451 CVE-2018-16452 CVE-2019-15166 CVE-2019-15167 Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn> (cherry picked from commit 394273c066b8f4317b77f3ede216cfcdd45250c1)
* iptables: patch CVE-2019-11360 (security fix)Jan Pavlinec2019-08-172-1/+14
| | | | Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
* nftables: Fix compilation with uClibc-ngRosen Penev2019-08-142-1/+29
| | | | | | | | | Missing header for va_list. Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Petr Štetiar <ynezz@true.cz> [updated with upstream version of the patch] (cherry picked from commit 2f977974714468e1a0ee20e4cce233da63d06dd0)
* uqmi: bump to latest git HEADKoen Vandeputte2019-06-271-4/+4
| | | | | | | | 1965c7139374 uqmi: add explicit check for message type when expecting a response 01944dd7089b uqmi_add_command: fixed command argument assignment Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com> (cherry picked from commit 47986dc6ea1d643cd348501da09cd2e3ee2f9ee1)
* uqmi: inherit firewall zone membership to virtual sub interfacesJo-Philipp Wich2019-06-272-0/+20
| | | | | | | | | | Fix an issue where subinterfaces were not added to the same firewall zone as their parent. Fixes: FS#2122 Signed-off-by: Jo-Philipp Wich <jo@mein.io> Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com> (cherry picked from commit 64bb88841fbc2d9a9dfee12775a18e5dc89ac16e)
* uqmi: fix PIN_STATUS_FAILED error with MC7455 WCDMA/LTE modemDaniel Golle2019-06-272-2/+2
| | | | | | | | | | | | Apparently this modem replies differently to attempted --get-pin-status which makes the script fail if a pincode is set. Fix this. Manufacturer: Sierra Wireless, Incorporated Model: MC7455 Revision: SWI9X30C_02.24.05.06 r7040 CARMD-EV-FRMWR2 2017/05/19 06:23:09 Signed-off-by: Daniel Golle <daniel@makrotopia.org> (cherry picked from commit 0b373bf4d6a1a7a53e06946972ebb812b4cc2f0f)
* curl: Fix multiple security problemsHauke Mehrtens2019-05-308-1/+222
| | | | | | | | | | | | | This fixes the following security problems: * CVE-2018-14618: NTLM password overflow via integer overflow * CVE-2018-16839: SASL password overflow via integer overflow * CVE-2018-16840: use-after-free in handle close * CVE-2018-16842: warning message out-of-buffer read * CVE-2019-3823: SMTP end-of-response out-of-bounds read * CVE-2019-3822: NTLMv2 type-3 header stack buffer overflow * CVE-2018-16890: NTLM type-2 out-of-bounds buffer read Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* ethtool: update to 4.19Hans Dedecker2018-12-181-2/+2
| | | | | | | | | | 8a1ad80 Release version 4.19. ecdf295 ethtool: Fix uninitialized variable use at qsfp dump 98c148e ethtool: better syntax for combinations of FEC modes d4b9f3f ethtool: support combinations of FEC modes Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> (backported from 5617e138bdaff94587d700def3d74e81c5b2db19)
* ethtool: Update to 4.18Robert Marko2018-12-181-2/+2
| | | | | | | | | | | | Tested on 8devices Jalapeno(ipq40xx) Introduces following changes: Feature: Add support for WAKE_FILTER (WoL using filters) Feature: Add support for action value -2 (wake-up filter) Fix: document WoL filters option also in help message Feature: ixgbe dump strings for security registers Signed-off-by: Robert Marko <robimarko@gmail.com> (backported from a9d73531921ef4755e2cbd6e9e7e36c59b00655c)
* ethtool: Update to 4.17Robert Marko2018-12-181-2/+2
| | | | | | | | | | | | | | | | | Tested on 8devices Jalapeno(ipq40xx) Introduces following changes * Fix: In ethtool.8, remove superfluous and incorrect \ * Fix: fix uninitialized return value * Fix: fix RING_VF assignment * Fix: remove unused global variable * Fix: several fixes in do_gregs() * Fix: correctly free hkey when get_stringset() fails * Fix: remove unreachable code * Fix: fix stack clash in do_get_phy_tunable and do_set_phy_tunable * Feature: Add register dump support for MICROCHIP LAN78xx Signed-off-by: Robert Marko <robimarko@gmail.com> (backported from 4bb2532ec1d4f30ad44037331130daffa687eb3d)
* ethtool: Update to 4.16Rosen Penev2018-12-181-2/+2
| | | | | | | Tested on Turris Omnia (mvebu). Signed-off-by: Rosen Penev <rosenp@gmail.com> (backported from 2737cea0bb117013875ee33916bb4b9deae9ea47)
* Revert "iptables: fix dependency for libip6tc on IPV6"Petr Štetiar2018-12-181-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch reverts commit 2dc1f54b1205094e7c6036cae6275d2c326bad3e as it breaks the build for me on x86-64 if I've IPV6 support disabled. Same config builds fine on `openwrt-18.06` branch at 55d078b2. $ grep IPV6 .config # CONFIG_KERNEL_IPV6 is not set # CONFIG_IPV6 is not set Build errors out on: Package libiptc is missing dependencies for the following libraries: libip6tc.so.0 Looking at iptables-1.6.2/libiptc/Makefile.am: libiptc_la_LIBADD = libip4tc.la libip6tc.la and to iptables-1.6.2/libiptc/libiptc.pc.in: Requires: libip4tc libip6tc It seems that libiptc needs v4/v6 libs, so v6 isn't optional. Cc: Rosy Song <rosysong@rosinson.com> Signed-off-by: Petr Štetiar <ynezz@true.cz> (backported from 1b4b942bcef8638a040788ab9ae94c66e38fd960)
* uqmi: update PKG_RELEASE versionFlorian Eckert2018-12-181-1/+1
| | | | | | | update PKG_RELEASE Signed-off-by: Florian Eckert <fe@dev.tdt.de> (backported from 4cabda8b7ddb0efea23e2aa044ea8bf18e03d199)
* uqmi: stop proto handler if verify pin count is not 3Florian Eckert2018-12-181-0/+7
| | | | | | | | | Check pin count value from pin status and stop verification the pin if the value is less then 3. This should prevent the proto-handler to lock the SIM. If SIM is locked then the PUK is needed. Signed-off-by: Florian Eckert <fe@dev.tdt.de> (backported from 0c9d06b5b243334123eafaf2e26a15ec2757767e)
* uqmi: evaluate pin-status output in qmi_setup functionFlorian Eckert2018-12-181-7/+49
| | | | | | | | | | | | | | | | | | | | | | | Load the json output from uqmi --get-pin-status command and evaluate the "pin1_status" value. The following uqmi "pin1_status" values are evaluated: - disabled Do not verify PIN because SIM verification is disabled on this SIM - blocked Stop qmi_setup because SIM is locked and a PUK is required - not_verified SIM is not yet verified. Do a uqmi --verify-pin1 command if a SIM is specified - verified: Do not verify the PIN because this was already done before Signed-off-by: Florian Eckert <fe@dev.tdt.de> (backported from 4b80bd878d0fcb520f4811097900ebb5478a74fd)
* uqmi: do not block proto handler if SIM is uninitializedFlorian Eckert2018-12-181-1/+9
| | | | | | | | | QMI proto setup-handler will wait forever if SIM does not get initialized. To fix this stop polling pin status and notify netifd. Netifd will generate then a "ifup-failed" ACTION. Signed-off-by: Florian Eckert <fe@dev.tdt.de> (backported from f171a86d064ac3fcfff05d286becae87c2e26b5f)
* uqmi: do not block proto handler if modem is unable to registrateFlorian Eckert2018-12-181-1/+10
| | | | | | | | | QMI proto setup-handler will wait forever if it is unable to registrate to the mobile network. To fix this stop polling network registration status and notify netifd. Netifd will generate then a "ifup-failed" ACTION. Signed-off-by: Florian Eckert <fe@dev.tdt.de> (backported from dec1bfa0f48d43174921d1a1357a4842f9ba0cf6)
* uqmi: fix variable initilization for timeout handlingFlorian Eckert2018-12-181-0/+2
| | | | | | | Also add logging output for SIM initilization. Signed-off-by: Florian Eckert <fe@dev.tdt.de> (backported from 71865200c95d5ccebe01980c88ee44a15888bcaf)
* uqmi: add timeout option valueFlorian Eckert2018-12-181-2/+5
| | | | | | | | | | | | This value will be used for now during following situations: * Ask the sim with the uqmi --get-pin-status command. * Wait for network registration with the uqmi --get-serving-system command. This two commands wait forever in a while loop. Add a timeout to stop waiting and so inform netifd. Signed-off-by: Florian Eckert <fe@dev.tdt.de> (backported from dee93def394c9bf10d2cc3eb64d9e190ca461a67)
* uqmi: redirect uqmi commands output to /dev/nullFlorian Eckert2018-12-181-12/+12
| | | | | | | | Move uqmi std and error output on commands without using them to /dev/null. This will remove useless outputs in the syslog. Signed-off-by: Florian Eckert <fe@dev.tdt.de> (backported from 2d57aa9c4c852e847e66a3bb5c775910d0cb8d77)
* uqmi: fix indentingFlorian Eckert2018-12-181-16/+16
| | | | | | | fix indenting Signed-off-by: Florian Eckert <fe@dev.tdt.de> (backported from 692c6d9a5dbb955d00516b465271fd8a053af206)
* iw: strip a few more non-essential features from iw-tinyFelix Fietkau2018-12-181-1/+46
| | | | | Signed-off-by: Felix Fietkau <nbd@nbd.name> (backported from 518fb345e110f7028912211ebf75af92c7c10809)
* iw: fix filtering linked object files for iw-tinyFelix Fietkau2018-12-181-1/+1
| | | | | | | It was broken by the recent commit that added iw-full Signed-off-by: Felix Fietkau <nbd@nbd.name> (backported from 7999282f7f1a1ab8a965f4b5efe31a4209bac0a6)
* iw: add iw-full package without size reduction hacksFelix Fietkau2018-12-182-20/+43
| | | | | Signed-off-by: Felix Fietkau <nbd@nbd.name> (backported from 8c647e873f9adf4527e61684458075f8d2b61a97)
* ipset: update to 6.38Syrone Wong2018-12-182-27/+2
| | | | | | | dropped already upstream patch Signed-off-by: Syrone Wong <wong.syrone@gmail.com> (backported from 68f109609b613b38bb3b2e6e82a9c04ae8bd011f)
* iptables: fix dependency for libip6tc on IPV6Rosy Song2018-12-181-2/+2
| | | | | Signed-off-by: Rosy Song <rosysong@rosinson.com> (backported from 2dc1f54b1205094e7c6036cae6275d2c326bad3e)
* dante: disable sched_getscheduler() - not implemented in muslDavid Yang2018-12-181-3/+4
| | | | | | | | | | | | | | | | | | musl doesn't come with an valid implementation of `sched_getscheduler()`; it simply returns -ENOSYS for it. Without this option (and compile dante with `sched_getscheduler()` enabled), you will get error: serverinit(): sched_getscheduler(2): failed to retrieve current cpuscheduling policy: Function not implemented and dante won't start at all. Ref: http://lists.alpinelinux.org/alpine-devel/3932.html Ref: http://lists.alpinelinux.org/alpine-devel/3936.html Signed-off-by: David Yang <mmyangfl@gmail.com> [slightly reword commit message] Signed-off-by: Jo-Philipp Wich <jo@mein.io> (backported from aaf46a8fe23eca959164c1681ab3a37c6e746b05)
* iwinfo: update to latest Git HEADJo-Philipp Wich2018-12-181-3/+3
| | | | | | | | | a514139 build: compile with -ffunction-sections, -fdata-sections and LTO 3c30b17 wl: only invoke nvram executable if it exists 65b8333 Revert "build: compile with -ffunction-sections, -fdata-sections and LTO" Signed-off-by: Jo-Philipp Wich <jo@mein.io> (backported from fdd6c556ab42d040efcc92a53149e3f8ec357f69)
* ebtables: update to latest git 2018-06-27Hans Dedecker2018-12-183-5/+5
| | | | | | | | | | 48cff25 build: drop install -o/-g root 53d7e7a extensions: ebt_string: take action if snprintf discards data Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> (backported from afac2a2dd67502ef8bd9799f328fa2e3b39292b1) (rebased patches) Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* netfilter: add bpf match supportAlin Nastac2018-12-181-0/+1
| | | | | | | | | | Add xt_bpf modules to {kmod-ipt,iptables-mod}-filter. Match using Linux Socket Filter. Expects a BPF program in decimal format. This is the format generated by the nfbpf_compile utility. Signed-off-by: Alin Nastac <alin.nastac@gmail.com> (backported from ab07ae2f27dd920cb7ba186d9f7ad2ccb1c980c4)
* nftables: bump to version 0.9.0Rosy Song2018-12-181-2/+2
| | | | | Signed-off-by: Rosy Song <rosysong@rosinson.com> (backported from 1ee98fdef3d6d71c1b0b3b120a9e24ac4b93c94f)
* ebtables: update to latest git 2018-06-06Hans Dedecker2018-12-181-3/+3
| | | | | | | | 5699354 extensions: fix build failure on fc28 e6359ee build: update ebtables.h from kernel and drop local unused copy Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> (backported from 1bbe813db0bb8dc65b8ed7740cf7f35a81b8ba0e)
* curl: Add ca-bundle dependencyRosen Penev2018-12-181-1/+1
| | | | | | | | | While building, curl complains that the path specified is missing. Also, without ca-bundle, something like 'curl https://www.google.com' does not work due to a certificate verify error. Signed-off-by: Rosen Penev <rosenp@gmail.com> (backported from 7a20c7a05d52f9bb3c82742098457bfbed869a8a)
* curl: Use ca-bundle for all TLS libraries.Rosen Penev2018-12-181-4/+6
| | | | | | | | | | | | | | | | | It simplifies the Makefile a bit. In addition, using ca-bundle saves some space as well. It also fixes an issue with at least transmission, which has a dependency on ca-bundle, but currently libcurl with OpenSSL or GnuTLS cause it not to work. This has been tested on mt7621 with OpenSSL and GnuTLS just by running 'curl https://www.google.com' and seeing if there's a verify error. The rest are already using ca-bundle and therefore work fine. Signed-off-by: Rosen Penev <rosenp@gmail.com> Tested-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (backported from f97946c49680a5fe713d0e2caaf072789f70e68d)
* nftables: bump to 0.8.5 versionRosy Song2018-12-188-1594/+8
| | | | | Signed-off-by: Rosy Song <rosysong@rosinson.com> (backported from 39e87e0ffc4eabf27d25459a369be425e9ef0474)
* ebtables: update to latest git 2018-05-15Hans Dedecker2018-12-183-5/+16
| | | | | | | | | | | 66a9701 ebtables: Fix build errors and warnings 9fff3d5 include: Fix musl libc compatibility b1cdae8 extensions: Add string filter to ebtables Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> (backported from ac70ac3532fefa78c944d8a26c8df0ca5d88d04e) (rebased patches) Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* tcpdump: explicitly disable libcap-ng supportStijn Tintel2018-11-131-0/+1
| | | | | | | | If libcap-ng is detected during tcpdump build, support for it is enabled and the binary is linked against it. Explicitly disable libcap-ng support to avoid build failing due to a missing depndency. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* iperf: fix --daemon optionRafał Miłecki2018-10-073-1/+205
| | | | | | | | | | | | | | | | Support for -D got broken in the 2.0.11 release by the upstream commit 218d8c667944 ("first pass L2 mode w/UDP checks, v4 only"). After that commit clients were still able to connect but no traffic was passed. It was reported and is fixed now in the upstream git repository. Backport two patches to fix this. The first one is just a requirement for the later to apply. The second one is the real fix and it needed only a small adjustment to apply without backporing the commit 10887b59c7e7 ("fix --txstart-time report messages"). Fixes: 7d15f96eaf76 ("iperf: bump to 2.0.12") Signed-off-by: Rafał Miłecki <rafal@milecki.pl> (cherry picked from commit 87cd118794cc9375260ea213838e80ad5295e83c)
* uqmi: pass-through ipXtable to child interfacesDaniel Golle2018-09-172-2/+5
| | | | | | | | | Allow setting specific routing tables via the ip4table and ip6table options also when ${ifname}_4 and ${ifname}_6 child interfaces are being created. Signed-off-by: Daniel Golle <daniel@makrotopia.org> (cherry picked from commit e51aa699f7ca3ce83a0add622c0fd17d0caafc46)
* iproute2: q_cake: Also print nonat, nowash and no-ack-filter keywordsKevin Darbyshire-Bryant2018-09-152-3/+7
| | | | | | | | | Pull in latest upstream tweaks: Similar to the previous patch for no-split-gso, the negative keywords for 'nat', 'wash' and 'ack-filter' were not printed either. Add those as well. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit 033f02b9b5580e67e2f1b623f62da60d645e7ba2)
* iproute2: q_cake: Add printing of no-split-gso optionKevin Darbyshire-Bryant2018-09-122-2/+4
| | | | | | | | | When the GSO splitting was turned into dual split-gso/no-split-gso options, the printing of the latter was left out. Add that, so output is consistent with the options passed Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit 8cac8572897c28e902218b445aa9bed82c40989f)
* iproute2: update cake man pageKevin Darbyshire-Bryant2018-09-122-3/+81
| | | | | | | | | | | | CAKE supports overriding of its internal classification of packets through the tc filter mechanism. Update the man page in our package, even though we don't build them. Someone may find the documentation useful. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit 30598a05385b0ac2380dd4f30037a9f9d0318cf2) (cherry picked from commit dc9388ac5506f2d0ea0fee6967c003b9129c8ca5)
* iproute2: cake: make gso/gro splitting configurableKevin Darbyshire-Bryant2018-09-122-2/+11
| | | | | | | | | | | | | | | | | | | This patch makes sch_cake's gso/gro splitting configurable from userspace. To disable breaking apart superpackets in sch_cake: tc qdisc replace dev whatever root cake no-split-gso to enable: tc qdisc replace dev whatever root cake split-gso Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk> Signed-off-by: Dave Taht <dave.taht@gmail.com> [pulled from netdev list - no API/ABI change] Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> (cherry picked from commit 3e8a9389961cd866b867740a2f71c2a0af97ab56)
* uqmi: wait for the control device tooThomas Equeter2018-08-301-2/+2
| | | | | | | | | | | | | | | | The control device /dev/cdc-wdm0 is not available immediately on the D-Link DWR-921 Rev.C3, therefore the wwan interface fails to start at boot with a "The specified control device does not exist" error. This patch alters /lib/netifd/proto/qmi.sh to wait for network.wwan.delay earlier, before checking for the control device, instead of just before interacting with the modem. One still has to use network.wwan.proto='qmi', as the "wwan" proto performs that sort of check before any delay is possible, failing with a "No valid device was found" error. Signed-off-by: Thomas Equeter <tequeter@users.noreply.github.com>
* comgt: increase timeout on runcommandsGiuseppe Lippolis2018-08-291-1/+1
| | | | | | | | | | Some combination of modem/wireless operator requires more time to execute the commands. Tested on DWR-512 embedded wwan modem and italian operator iliad (new virtual operator). Signed-off-by: Giuseppe Lippolis <giu.lippolis@gmail.com> (cherry picked from commit 774d7fc9f2897d7b33ef15ddaa3522531eb85970)
* curl: Fix CVE-2018-0500Hauke Mehrtens2018-08-082-1/+33
| | | | | | | | This backports a fix for: * CVE-2018-0500 SMTP send heap buffer overflow See here for details: https://curl.haxx.se/docs/adv_2018-70a2.html Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* mbedtls: Update to 2.12.0Hauke Mehrtens2018-08-081-1/+1
| | | | | | | | | | | | | | | | | | | Multiple security fixes * CVE-2018-0497 Remote plaintext recovery on use of CBC based ciphersuites through a timing side-channel * CVE-2018-0498 Plaintext recovery on use of CBC based ciphersuites through a cache based side-channel Disable OFB block mode and XTS block cipher mode, added in 2.11.0. Disable Chacha20 and Poly1305 cryptographic primitives, added in 2.12.0 Patch the so version back to the original one, the API changes are looking no so invasive. The size of mbedtls increased a little bit: ipkg for mips_24kc before: 163.967 Bytes ipkg for mips_24kc after: 164.753 Bytes Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* wwan: Fix teardown for sierra_net driverMasashi Honma2018-08-081-1/+1
| | | | | | | | The sierra_net driver is using proto_directip_setup for setup. So use proto_directip_teardown for teardown. Signed-off-by: Masashi Honma <masashi.honma@gmail.com> (cherry picked from commit d05967baecca33774ab95d4ffabbcb4cc9d0a1bf)
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-10 17:43:44 +0000