aboutsummaryrefslogtreecommitdiff
path: root/net
Commit message (Collapse)AuthorAge
* samba4: update to 4.13.3, enbale io_uringAndy Walsh2021-01-08
| | | | | | | | | | | * update to 4.13.3 * enable vfs io_uring module by default, if kernel supports it * fix for possible exploit openwrt/packages#13758 * sanetize all external template/config inputs * fix some shellcheck warnings * remove old aio modules/deps Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
* Merge pull request #14415 from linosgian/openssh_add_fido2_supportRosen Penev2021-01-08
|\ | | | | openssh: Add FIDO2 hardware token support
| * openssh: Add FIDO2 hardware token supportLinos Giannopoulos2021-01-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Version 8.2[0] added support for two new key types: "ecdsa-sk" and "ed25519-sk". These two type enable the usage of hardware tokens that implement the FIDO (or FIDO2) standard, as an authentication method for SSH. Since we're already on version 8.4 all we need to do is to explicitly enable the support for hardware keys when compiling OpenSSH and add all the missing dependencies OpenSSH requires. OpenSSH depends on libfido2[1], to communicate with the FIDO devices over USB. In turn, libfido2 depends on libcbor, a C implementation of the CBOR protocol[2] and OpenSSL. [0]: https://lwn.net/Articles/812537/ [1]: https://github.com/Yubico/libfido2 [2]: tools.ietf.org/html/rfc7049 Signed-off-by: Linos Giannopoulos <linosgian00@gmail.com>
* | transmission: add syscalls needed on PPC to seccomp rulesDaniel Golle2021-01-06
| | | | | | | | | | | | | | Add fadvise64_64 and fchmod syscalls needed on PowerPC platforms to seccomp rules of transmission-daemon. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* | https-dns-proxy: update to 2020-11-25: add HTTP auth and DSCP codepoint supportStan Grishin2021-01-06
| | | | | | | | Signed-off-by: Stan Grishin <stangri@melmac.net>
* | Merge pull request #14063 from peter-stadler/etebaseRosen Penev2021-01-06
|\ \ | | | | | | [RFC] etebase: add package
| * | etebase: upgrade to 0.6.1Peter Stadler2020-12-20
| | | | | | | | | | | | Signed-off-by: Peter Stadler <peter.stadler@student.uibk.ac.at>
| * | etesync-server: rename to etebasePeter Stadler2020-12-20
| | | | | | | | | | | | Signed-off-by: Peter Stadler <peter.stadler@student.uibk.ac.at>
* | | Merge pull request #13405 from peter-stadler/nginx-util-uciRosen Penev2021-01-06
|\ \ \ | | | | | | | | [RFC] nginx-util: use UCI for server configuration
| * | | nginx-util: use UCI for server configurationPeter Stadler2020-11-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | **tl;dr:** The functions `{add,del}_ssl` modify a server section of the UCI config if there is no `.conf` file with the same name in `/etc/nginx/conf.d/`. Then `init_lan` creates `/var/lib/nginx/uci.conf` files by copying the `/etc/nginx/uci.conf.template` and standard options from the UCI config; additionally the special path `logd` can be used in `{access,error}_log`. The init does not change the configuration beside re-creating self-signed certificates when needed. This is also the only purpose of the new `check_ssl`, which is installed as yearly cron job. **Initialization:** Invoking `nginx-util init_lan` parses the UCI configuration for package `nginx`. It creates a server part in `/var/lib/nginx/uci.conf` for each `section server '$name'` by copying all UCI options but the following: * `option uci_manage_ssl` is skipped. It is set to 'self-signed' by `nginx-util add_ssl $name`, removed by `nginx-util del_ssl $name` and used by `nginx-util check_ssl` (see below). * `logd` as path in `error_log` or `access_log` writes them to STDERR respective STDOUT, which are fowarded by Nginx's init to the log daemon. Specifically: `option error_log 'logd'` becomes `error_log stderr;` and `option access_log 'logd openwrt'` becomes `access_log /proc/self/fd/1 openwrt;` Other `[option|list] key 'value'` entries just become `key value;` directives. The init.d calls internally also `check_ssl` for rebuilding self-signed SSL certificates if needed (see below). And it still sets up `/var/lib/nginx/lan{,_ssl}.listen` files as it is doing in the current version (so they stay available). **Defaults:** The package installs the file `/etc/nginx/restrict_locally` containing allow/deny directives for restricting the access to LAN addresses by including it into a server part. The default server '_lan' includes this file and listens on all IPs (instead of only the local IPs as it did before; other servers do not need to listen explicitly on the local IPs anymore). The default server is contained together with a server that redirects HTTP requests for inexistent URLs to HTTPS in the UCI configuration file `/etc/config/nginx`. Furthermore, the packages installs a `/etc/nginx/uci.conf.template` containing the current setup and a marker, which will be replaced by the created UCI servers when calling `init_lan`. **Other:** If there is a file named `/etc/nginx/conf.d/$name.conf` the functions `init_lan`, `add_ssl $name` and `del_ssl $name` will use that file instead of a UCI server section (this is similar to the current version). Else it selects the UCI `section server $name`, or, when there is no such section, it searches for the first one having `option server_name '… $name …'`. For this section: * `nginx-util add_ssl $name` will add to it: `option uci_manage_ssl 'self-signed'` `option ssl_certificate '/etc/nginx/conf.d/$name.crt'` `option ssl_certificate_key '/etc/nginx/conf.d/$name.key'` `option ssl_session_cache 'shared:SSL:32k'` `option ssl_session_timeout '64m'` If these options are already present, they will stay the same; just the first option `uci_manage_ssl` will always be changed to 'self-signed'. The command also changes all `listen` list items to use port 443 and ssl instead of port 80 (without ssl). If they stated another port than 80 before, they are kept the same. Furthermore, it creates a self-signed SSL certificate if necessary, i.e., if there is no *valid* certificate and key at the locations given by the options `ssl_certificate` and `ssl_certificate_key`. * `nginx-util del_ssl $name` checks if `uci_manage_ssl` is set 'self-signed' in the corresponding UCI section. Only then it removes all of the above options regardless of the value looking just at the key name. Then, it also changes all `listen` list items to use port 80 (without ssl) instead of port 443 with ssl. If stating another port than 443, they are kept the same. Furthermore, it removes the SSL certificate and key that were indicated by `ssl_certificate{,_key}`. * `nginx-util check_ssl` looks through all server sections of the UCI config for `uci_manage_ssl 'self-signed'`. On every hit it checks if the SSL certificate-key-pair indicated by the options `ssl_certificate{,_key}` is expired. Then it re-creates a self-signed certificate. If there exists at least one `section server` with `uci_manage_ssl 'self-signed'`, it will try to install itself as cron job. If there are no such sections, it removes that cron job if possible. For installing a ssl certificate and key managed by another app, you can call: `nginx-util add_ssl $name $manager $crtpath $keypath` Hereby `$name` is as above, `$manager` is an arbitrary string, and the the ssl certificate and its key are indicated by their absolute path. If you want to remove the directives again, then you can use: `nginx-util del_ssl $name $manager` Signed-off-by: Peter Stadler <peter.stadler@student.uibk.ac.at>
* | | | Merge pull request #14299 from wulfy23/nftqosinitRosen Penev2021-01-05
|\ \ \ \ | | | | | | | | | | nft-qos: silence buildsystem errors
| * | | | nft-qos: silence buildsystem errorsImran Khan2020-12-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | add IPKG_INSTROOT to init script to silence build system errors Signed-off-by: Imran Khan <gururug@gmail.com>
* | | | | Merge pull request #14416 from dobo90/adguardhome_v0.104.3Rosen Penev2021-01-05
|\ \ \ \ \ | | | | | | | | | | | | [v2] adguardhome: upstream upgrade to v0.104.3
| * | | | | adguardhome: upstream upgrade to v0.104.3Dobroslaw Kijowski2021-01-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Full changelog available at: * https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.104.2 * https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.104.3 Signed-off-by: Dobroslaw Kijowski <dobo90@gmail.com>
* | | | | | Merge pull request #14362 from neheb/hwdRosen Penev2021-01-03
|\ \ \ \ \ \ | |/ / / / / |/| | | | | hwdata: introduce package and use
| * | | | | usbip: use new usbids packageRosen Penev2020-12-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It's more consistent since it installs to the same place. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* | | | | | Merge pull request #14413 from aaronjg/bugfix/mwan3-ipv6-regressionEtienne Champetier2021-01-03
|\ \ \ \ \ \ | | | | | | | | | | | | | | mwan3: fix regression in ipv6 routing tables
| * | | | | | mwan3: fix regression in ipv6 routing tablesAaron Goodman2021-01-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Aaron Goodman <aaronjg@stanford.edu>
* | | | | | | rsync: enable iconv if NLS support is enabled globallyMaxim Storchak2021-01-02
| |_|_|_|_|/ |/| | | | | | | | | | | | | | | | | Signed-off-by: Maxim Storchak <m.storchak@gmail.com>
* | | | | | Merge pull request #14402 from wongsyrone/update-miniupnpcRosen Penev2021-01-01
|\ \ \ \ \ \ | | | | | | | | | | | | | | net/miniupnpc: update to 2.2.1
| * | | | | | net/miniupnpc: update to 2.2.1Syrone Wong2021-01-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Syrone Wong <wong.syrone@gmail.com>
* | | | | | | net/miniupnpd: update to 2.2.1Syrone Wong2021-01-01
|/ / / / / / | | | | | | | | | | | | | | | | | | Signed-off-by: Syrone Wong <wong.syrone@gmail.com>
* | | | | | Merge pull request #14400 from FrederickGeek8/fix-14287Nikos Mavrogiannopoulos2021-01-01
|\ \ \ \ \ \ | | | | | | | | | | | | | | openconnect: Fix secondary password script overwriting primary
| * | | | | | openconnect: Fix secondary password script overwriting primaryFrederick Morlock2021-01-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When specifying a secondary password script, the output should be appended to the temporary password file and shouldn't overwrite it. If you refer to the case where there is a static secondary password, you can see that the secondary password is appended. Without this fix, only the secondary password is passed to the `openconnect` session. Signed-off-by: Frederick Morlock <FrederickGeek8@gmail.com>
* | | | | | | Merge pull request #14342 from neheb/transmisRosen Penev2020-12-31
|\ \ \ \ \ \ \ | | | | | | | | | | | | | | | | transmission: do not use wolfSSL
| * | | | | | | transmission: do not use wolfSSLRosen Penev2020-12-31
| | |_|/ / / / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There's some kind of crash internally in wolfSSL. It doesn't seem like anyone knows how to fix it. Just disable it for now. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* | | | | | | gitolite: change symlink from absolute to relativeRosen Penev2020-12-31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes bad symlink under InstallDev. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* | | | | | | freeradius3: add missing libbsd dependency to glibcRosen Penev2020-12-31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes packages generation. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* | | | | | | Merge pull request #14388 from Bloup1net/phantapresolvEtienne Champetier2020-12-31
|\ \ \ \ \ \ \ | | | | | | | | | | | | | | | | phantap: Update to latest commit
| * | | | | | | phantap: Update to latest commitDiana Dragusin2020-12-31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | a717723 Get resolvfile from configuration Signed-off-by: Diana Dragusin <diana.dragusin@nccgroup.com>
* | | | | | | | sqm-scripts: Update PKG_MIRROR_HASHToke Høiland-Jørgensen2020-12-31
|/ / / / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Forgot to update the MIRROR_HASH Fixes: 2c652128c52e: ("sqm-scripts: Bump to v1.5.0") Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* | | | | | | sqm-scripts: Bump to v1.5.0Toke Høiland-Jørgensen2020-12-31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* | | | | | | Merge pull request #14377 from neheb/bfdRosen Penev2020-12-31
|\ \ \ \ \ \ \ | | | | | | | | | | | | | | | | bfdd: fix compilation with glibc
| * | | | | | | bfdd: fix compilation with glibcRosen Penev2020-12-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove uClibc-ng patch as it's not in the tree anymore. Also remove the _GNU_SOURCE CFLAG for the same reason. Refreshed patches. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* | | | | | | | Merge pull request #14374 from neheb/ksmbdtRosen Penev2020-12-30
|\ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | ksmbd-tools: fix compilation with glibc
| * | | | | | | | ksmbd-tools: fix compilation with glibcRosen Penev2020-12-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Needs to be linked to lpthread. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* | | | | | | | | Merge pull request #14375 from neheb/cRosen Penev2020-12-30
|\ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | coova-chili: fix compilation with glibc
| * | | | | | | | | coova-chili: fix compilation with glibcRosen Penev2020-12-30
| |/ / / / / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Disable Werror as it errors on pointless stuff. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* | | | | | | | | Merge pull request #14379 from neheb/atftRosen Penev2020-12-30
|\ \ \ \ \ \ \ \ \ | |_|/ / / / / / / |/| | | | | | | | atftp: fix compilation with glibc
| * | | | | | | | atftp: fix compilation with glibcRosen Penev2020-12-30
| |/ / / / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It's defining two functions twice for some reason. Refreshed patches. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* / / / / / / / dawn: bump to latest versionNick Hainke2020-12-31
|/ / / / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Includes: CMakeList: fix compiling with glibc Signed-off-by: Nick Hainke <vincent@systemli.org>
* / / / / / / banip: DHCPv6 bugfixDirk Brenken2020-12-30
|/ / / / / / | | | | | | | | | | | | | | | | | | | | | | | | * ignore local DHCPv6 related and local icmpv6 traffic in banIP chain Signed-off-by: Dirk Brenken <dev@brenken.org>
* | | | | | Merge pull request #14345 from lucize/frrupRosen Penev2020-12-28
|\ \ \ \ \ \ | | | | | | | | | | | | | | frr: update stable to 2020-12-22
| * | | | | | frr: update stable to 2020-12-22Lucian Cristian2020-12-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Lucian Cristian <lucian.cristian@gmail.com>
* | | | | | | lighttpd: update to lighttpd 1.4.58 release hashGlenn Strauss2020-12-27
|/ / / / / / | | | | | | | | | | | | | | | | | | Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
* | | | | | Merge pull request #14309 from neheb/squidRosen Penev2020-12-24
|\ \ \ \ \ \ | |_|/ / / / |/| | | | | squid: update to 4.13
| * | | | | squid: update to 4.13Rosen Penev2020-12-22
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Rosen Penev <rosenp@gmail.com>
* | | | | | Merge pull request #14318 from zhanhb/wgetRosen Penev2020-12-23
|\ \ \ \ \ \ | | | | | | | | | | | | | | wget: fix build
| * | | | | | wget: fix buildHuangbin Zhan2020-12-23
| | |/ / / / | |/| | | | | | | | | | | | | | | | Signed-off-by: Huangbin Zhan <zhanhb88@gmail.com>
* / | | | | adblock: fix when PROCD_RELOAD_DELAY is setThiago de Arruda Padilha2020-12-23
|/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | Move the "PROCD_RELOAD_DELAY" line to after the "delay" variable is set. Signed-off-by: Thiago de Arruda Padilha <tpadilha84@gmail.com>
Powered by cgit, Themed by Ted Yin.