aboutsummaryrefslogtreecommitdiff
path: root/package/network/services
Commit message (Collapse)AuthorAge
...
* dnsmasq: configure dynamic dhcp6 and dhcp4 independentlyIan Dall2023-04-01
| | | | | | | | Given ipv6 has SLAAC it is quite plausible to wish to use dynamic dhcp4 but static dhcp6. This patch keeps dynamicdhcp as the default option for both, but is overridden by dynamicdhcpv6 or dynamicdhcpv4 Signed-off-by: Ian Dall <ian@beware.dropbear.id.au>
* dnsmasq: add dhcphostsfile to ujail sandboxRuben Jenster2023-04-01
| | | | | | | The dhcphostsfile must be mounted into the (ujail) sandbox. The file can not be accessed without this mount. Signed-off-by: Ruben Jenster <rjenster@gmail.com>
* odhcpd: bump to latest git HEADChristian Marangi2023-03-24
| | | | | | 29c934d config: recheck have_link_local on interface reload if already init Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* odhcpd: bump to latest git HEADChristian Marangi2023-03-22
| | | | | | | | | | | 7c0f603 router: skip RA and wait for LINK-LOCAL to be assigned ba30afc config: skip interface setup if interface not IFF_RUNNING 06b111e Revert "odhcpd: Reduce error messages" 90d6cc9 odhcpd: Reduce error messages Also drop AUTORELEASE since it got deprecated. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* treewide: add support for "lto" in PKG_BUILD_FLAGSAndre Heider2023-03-21
| | | | | | | | | | | | | | | | This reduces open coding and allows to easily add a knob to enable it treewide, where chosen packages can still opt-out via "no-lto". Some packages used LTO, but not the linker plugin. This unifies 'em all to attempt to produce better code. Quoting man gcc(1): "This improves the quality of optimization by exposing more code to the link-time optimizer." Also use -flto=auto instead of -flto=jobserver, as it's not guaranteed that every buildsystem uses +$(MAKE) correctly. Signed-off-by: Andre Heider <a.heider@gmail.com>
* treewide: add support for "gc-sections" in PKG_BUILD_FLAGSAndre Heider2023-03-21
| | | | | | | | | | | | | | | This reduces open coding and allows to easily add a knob to enable it treewide, where chosen packages can still opt-out via "no-gc-sections". Note: libnl, mbedtls and opkg only used the CFLAGS part without the LDFLAGS counterpart. That doesn't help at all if the goal is to produce smaller binaries. I consider that an accident, and this fixes it. Note: there are also packages using only the LDFLAGS part. I didn't touch those, as gc might have been disabled via CFLAGS intentionally. Signed-off-by: Andre Heider <a.heider@gmail.com>
* treewide: replace PKG_USE_MIPS16:=0 with PKG_BUILD_FLAGS:=no-mips16Andre Heider2023-03-21
| | | | | | | Keep backwards compatibility via PKG_USE_MIPS16 for now, as this is used in all package feeds. Signed-off-by: Andre Heider <a.heider@gmail.com>
* hostapd: enable radius server supportFelix Fietkau2023-03-07
| | | | | | This is useful in combination with the built-in eap server support Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: add missing return code for the bss_mgmt_enable ubus methodFelix Fietkau2023-03-07
| | | | | | Fixes bogus errors on ubus calls Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: add support for defining multiple acct/auth serversFelix Fietkau2023-03-07
| | | | | | | This allows adding backup servers, in case the primary ones fail. Assume that port and shared secret are going to be the same. Signed-off-by: Felix Fietkau <nbd@nbd.name>
* dnsmasq: bump to v2.89Kevin Darbyshire-Bryant2023-02-25
| | | | Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* hostapd: always use sae_password for mesh/SAE authLeon M. Busch-George2023-02-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes a corner case when using passwords that are exactly 64 characters in length with mesh mode or passwords longer than 63 characters with SAE because 'psk' is used instead of 'sae_password'. SAE is obligatory for 802.11s (mesh point). The 'psk' option for hostapd is suited for WPA2 and enforces length restrictions on passwords. Values of 64 characters are treated as PMKs. With SAE, PMKs are always generated during the handshake and there are no length restrictions. The 'sae_password' option is more suited for SAE and should be used instead. Before this patch, the 'sae_password' option is only used with mesh mode passwords that are not 64 characters long. As a consequence: - mesh passwords can't be 64 characters in length - SAE only works with passwords with lengths >8 and <=63 (due to psk limitation). Fix this by always using 'sae_password' with SAE/mesh and applying the PMK differentiation only when PSK is used. Fixes: #11324 Signed-off-by: Leon M. Busch-George <leon@georgemail.eu> [ improve commit description ] Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* hostapd: add quotes in assignmentsLeon M. Busch-George2023-02-19
| | | | | | It's generally advised to use quotes for variable assignments in bash. Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
* odhcpd: bump to git HEADStijn Tintel2023-02-17
| | | | | | | | dfab0fa dhcpv4: detect noarp interfaces 5a17751 router: improve RA logging edc5e17 router: always check ra_default Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* dnsmasq: refuse to add empty DHCP rangeLeon M. George2023-02-07
| | | | | | | | | | | | Use ipcalc's return value to react to invalid range specifications. By simply ignoring the range instead of aborting with an error code, dnsmasq should still start when there's an error (best effort). Aborting the config generation or working with invalid range specs leaves dnsmasq crash-looping which is the right thing to do concerning that particular interface but it also hinders DHCP service on other interfaces and DNS on the router itself. Signed-off-by: Leon M. George <leon@georgemail.eu>
* bridger: update to the latest versionFelix Fietkau2023-01-29
| | | | | | 8be8bb9df789 nl: fix accessing hairpin mode and isolated from the right attribute set Signed-off-by: Felix Fietkau <nbd@nbd.name>
* uhttpd: clean up MakefileAndre Heider2023-01-28
| | | | | | | | | | | | uhttpd's cmake options all default to ON. Either we set all of them or none if the defaults need to be changed. Let's go with the latter. Because support for all modules is always compiled in, remove two unused and useless config toggles. uhttpd detects and uses libcrypt itself, no need to add it here again. Signed-off-by: Andre Heider <a.heider@gmail.com>
* relayd: bump to version 2023-01-28Hauke Mehrtens2023-01-28
| | | | | | f646ba4 route: Fix compile warning with glibc Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* uhttpd: update to latest Git HEADHauke Mehrtens2023-01-28
| | | | | | | 47561aa mimetypes: add audio/video support for apple airplay 6341357 ucode: respect all arguments passed to send() Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* dnsmasq: set an increased cachesize default valueHannu Nyman2023-01-21
| | | | | | | | Dnsmasq DNS cache size is only 150 by default. Set the uci default value to 1000, so that cache gets used more and unnecessary DNS queries to upstream can be avoided. Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
* lldpd: use release tar instead of codeloadChristian Marangi2023-01-12
| | | | | | | | | | | | | | | | | | | There is currently a problem with making reproducible version of lldpd. The tool version is generated based on 3 source: 1. .dist-version file in release tar 2. git hash with presence of .git directory 3. current date Using the codeload tar from github results in getting the repo without the .git directory and since they are not release tar, we don't have .dist-version. This results in having lldpd bin with a version set to the current build time. Switch to release tar so that we correctly have a .dist-version file and the version is not based on the build time. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> Reviewed-by: Robert Marko <robimarko@gmail.com>
* bridger: update to the latest versionFelix Fietkau2023-01-03
| | | | | | | | | def7755c459d add missing copyright headers f68307fd96d7 add hairpin mode support 9ee8f433ba4e nl: do not pass NDA_VLAN with vid=0 978c1f9eed07 add support for the bridge port isolated flag Signed-off-by: Felix Fietkau <nbd@nbd.name>
* treewide: Trigger reinstall of all wolfssl dependenciesHauke Mehrtens2023-01-01
| | | | | | | | The ABI of the wolfssl library changed a bit between version 5.5.3 and 5.5.4. This release update will trigger a rebuild of all packages which are using wolfssl to make sure they are adapted to the new ABI. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* tree-wide: Do not use package librt and libpthreadHauke Mehrtens2022-12-29
| | | | | | | | | | | The libraries libpthread, libdl, libutil, libanl have been integrated into the libc library in version 2.34. it is not needed to explicitly link them any more. Most of the functions have been moved from the librt.so into libc.so some time ago already. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* hostapd: allow sharing the incoming DAS port across multiple interfacesFelix Fietkau2022-12-27
| | | | | | Use the NAS identifier to find the right receiver context on incoming messages Signed-off-by: Felix Fietkau <nbd@nbd.name>
* uhttpd: update to latest Git HEADHauke Mehrtens2022-12-26
| | | | | | 2397755 client: fix incorrectly emitting HTTP 413 for certain content lengths Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* dnsmasq: bump to v2.88Kevin Darbyshire-Bryant2022-12-25
| | | | | | | Most relevant feature for openwrt in this release, supports dynamically removing hosts from 'hostsdir' supplied host files. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* hostapd: add mbedtls variantRosen Penev2022-12-19
| | | | | | | This adds the current WIP mbedtls patches for hostapd. The motivation here is to reduce size. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* hostapd: enable coredumpsFelix Fietkau2022-12-16
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: always set a default for the nas identifierFelix Fietkau2022-12-16
| | | | | | | It is used for both 802.11r and WPA enterprise. Setting it when not needed is harmless Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: add support for automatically setting RADIUS own-ip dynamicallyFelix Fietkau2022-12-16
| | | | | | Some servers use the NAS-IP-Address attribute as a destination address Signed-off-by: Felix Fietkau <nbd@nbd.name>
* treewide: remove DRIVER_11N_SUPPORTAndre Heider2022-12-13
| | | | | | | | | | | | hostapd's compile time option CONFIG_IEEE80211N was removed almost 3 years ago, 80.211n/HT is always included since then. Noticed because `hostapd -v11n` confusingly returned an error. See hostapd's commit: f3bcd69603 "Remove CONFIG_IEEE80211N build option" Signed-off-by: Andre Heider <a.heider@gmail.com>
* hostapd: fix 350-nl80211_del_beacon_bss.patchAndre Heider2022-12-13
| | | | | | | | | | | | | | | | | Pass the expected struct: ../src/drivers/driver_nl80211.c: In function 'wpa_driver_nl80211_del_beacon': ../src/drivers/driver_nl80211.c:2945:31: warning: passing argument 1 of 'nl80211_bss_msg' from incompatible pointer type [-Wincompatible-pointer-types] 2945 | msg = nl80211_bss_msg(drv, 0, NL80211_CMD_DEL_BEACON); | ^~~ | | | struct wpa_driver_nl80211_data * ../src/drivers/driver_nl80211.c:695:50: note: expected 'struct i802_bss *' but argument is of type 'struct wpa_driver_nl80211_data *' 695 | struct nl_msg * nl80211_bss_msg(struct i802_bss *bss, int flags, uint8_t cmd) | ~~~~~~~~~~~~~~~~~^~~ Fixes: 35ff1affe8 "hostapd: update to 2022-05-08" Signed-off-by: Andre Heider <a.heider@gmail.com>
* hostapd: remove an unused function from ubus.cAndre Heider2022-12-13
| | | | | | | eee80211_frequency_to_channel() isn't used anymore, which is a leftover from: 2a31e9ca97 "hostapd: add op-class to get_status output" Signed-off-by: Andre Heider <a.heider@gmail.com>
* hostapd: use wpa_supplicant for unencrypted mesh connectionsFelix Fietkau2022-12-10
| | | | | | It's more reliable than using iw Signed-off-by: Felix Fietkau <nbd@nbd.name>
* dnsmasq: add option to expose additional paths to jailDaniel Golle2022-11-27
| | | | | | | | | | Add new UCI list 'addn_mount' allowing the expose additional filesystem paths to the jailed dnsmasq process. This is useful e.g. in case of manually configured includes to the configuration file or symlinks pointing outside of the exposed paths as used by e.g. the safe-search package in the packages feed. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* lldpd: update to 1.0.16Nick Hainke2022-11-18
| | | | | | | Release Notes: https://github.com/lldpd/lldpd/releases/tag/1.0.16 Signed-off-by: Nick Hainke <vincent@systemli.org>
* dnsmasq: add support for filter-AAAA/AChen Minqiang2022-11-12
| | | | | | | | This add --filter-A and --filter-AAAA options, to remove IPv4 or IPv6 addresses from DNS answers. these options is supported since version 2.87. Co-authored-by: NueXini <nuexini@alumni.tongji.edu.cn> Signed-off-by: Chen Minqiang <ptpt52@gmail.com>
* hostapd: remove invalid dtim_period option processingFelix Fietkau2022-11-10
| | | | | | | | dtim_period is a bss property, not a device one. It is already handled properly in mac80211.sh Fixes: 30c64825c7ed ("hostapd: add dtim_period, local_pwr_constraint, spectrum_mgmt_required") Signed-off-by: Felix Fietkau <nbd@nbd.name>
* dnsmasq: remove backported CVE patchKevin Darbyshire-Bryant2022-11-06
| | | | | | Patch no longer applies/required since bump to v2.87 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: Support nftables nftsetsKevin Darbyshire-Bryant2022-11-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add build option for nftables sets. By default disable iptables ipset support. By default enable nftable nftset support since this is what fw4 uses. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> dnsmasq: nftset: serve from ipset config Use existing ipset configs as source for nftsets to be compatible with existing configs. As the OS can either have iptables XOR nftables support, it's fine to provide both to dnsmasq. dnsmasq will silently fail for the present one. Depending on the dnsmasq compile time options, the ipsets or nftsets option will not be added to the dnsmasq config file. dnsmasq will try to add the IP addresses to all sets, regardless of the IP version defined for the set. Adding an IPv6 to an IPv4 set and vice versa will silently fail. Signed-off-by: Mathias Kresin <dev@kresin.me> dnsmasq: support populating nftsets in addition to ipsets Tell dnsmasq to populate nftsets instead of ipsets, if firewall4 is present in the system. Keep the same configuration syntax in /etc/config/dhcp, for compatibility purposes. Huge thanks to Jo-Philipp Wich for basically writing the function. Signed-off-by: Jo-Philipp Wich <jo@mein.io> Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com> dnsmasq: obtain nftset ip family from nft Unfortunately dnsmasq nft is noisy if an attempt to add a mismatched ip address family to an nft set is made. Heuristic to guess which ip family a nft set might belong by inferring from the set name. In order of preference: If setname ends with standalone '4' or '6' use that, else if setname has '4' or '6' delimited by '-' or '_' use that (eg foo-4-bar) else If setname begins with '4' or '6' standalone use that. By standalone I mean not as part of a larger number eg. 24 If the above fails then use the existing nft set query mechanism and if that fails, well you're stuffed! With-thanks-to: Jo-Philipp Wich <jo@mein.io> who improved my regexp knowledge. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> dnsmasq: specify firewall table for nftset Permit ipsets to specify an nftables table for the set. New config parameter is 'table'. If not specified the default of 'fw4' is used. config ipset list name 'BK_4,BK_6' option table 'dscpclassify' option table_family 'ip' option family '4' list domain 'ms-acdc.office.com' list domain 'windowsupdate.com' list domain 'update.microsoft.com' list domain 'graph.microsoft.com' list domain '1drv.ms' list domain '1drv.com' The table family can also be specified, usually 'ip' or 'ip6' else the default 'inet' capable of both ipv4 & ipv6 is used. If the table family is not specified then finally a family option is available to specify either '4' or '6' for ipv4 or ipv6 respectively. This is all in addition to the existing heuristic that will look in the nftset name for an ip family clue, or in total desperation, query the value from the nftset itself. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: add uci-defaults script for ipset migrationMathias Kresin2022-11-06
| | | | | | | | When running sysupgrade from an existing configuration, move existing ipset definitions to a dedicated config section. Later on, it will allow to serve ipset as well as nftable sets from the same configuration. Signed-off-by: Mathias Kresin <dev@kresin.me>
* dnsmasq: bump to 2.87Kevin Darbyshire-Bryant2022-11-06
| | | | | | Bump dnsmasq to 2.87 & refresh patches Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* dnsmasq: Backport DHCPv6 server fix (CVE-2022-0934)Hauke Mehrtens2022-11-05
| | | | | | | | | | | This backports a commit from upstream dnsmasq to fix CVE-2022-0934. CVE-2022-0934 description: A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an attacker who sends a crafted packet processed by dnsmasq, potentially causing a denial of service. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* uhttpd: use procd to reload on acme renewGlen Huang2022-11-04
| | | | | | | Calling /etc/init.d/uhttpd reload directly in the acme hotplug script can inadvertently start a stopped instance. Signed-off-by: Glen Huang <i@glenhuang.com>
* odhcpd: update to git HEADHans Dedecker2022-10-31
| | | | | | | | a92c0a7 dhcpv6-ia: make tmp lease file hidden 4a673e1 fix null pointer dereference for INFORM messages 860ca90 odhcpd: Support for Option NTP and SNTP Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* uhttpd: use acme hotplugGlen Huang2022-10-18
| | | | | | | Reload uhttpd after certificates are renewed with acme. Reviewed-by: Toke Høiland-Jørgensen <toke@toke.dk> Signed-off-by: Glen Huang <i@glenhuang.com>
* hostapd: add measurement report value for beacon reportsNick Hainke2022-10-13
| | | | | | | | | | | | | | | | | Add the measurement report value to the beacon reports send via ubus. It is possible to derive from the measurement report if a station refused to do a beacon report and why. It is important to know why a station refuses to do a beacon-report. In particular, we should not request a beacon report from a station again that refused a beacon-report before. The rejection reasons can be found by looking at the bits defined by: - MEASUREMENT_REPORT_MODE_ACCEPT - MEASUREMENT_REPORT_MODE_REJECT_LATE - MEASUREMENT_REPORT_MODE_REJECT_INCAPABLE - MEASUREMENT_REPORT_MODE_REJECT_REFUSED Suggested-by: Ian Clowes <clowes_ian@hotmail.com> Signed-off-by: Nick Hainke <vincent@systemli.org>
* build: prefer HTTPS if available (for packages)Daniel Cousens2022-10-05
| | | | | | | | Changes PKG_SOURCE_URL's for arptables, bsdiff, dnsmasq, fortify-headers, ipset, ipset-dns, libaudit, libpcap, libressl, lua, lua5.3, tcpdump and valgrind, to HTTPS Signed-off-by: Daniel Cousens <github@dcousens.com>
* treewide: fix security issues by bumping all packages using libwolfsslPetr Štetiar2022-10-03
| | | | | | | | | | | | | | | | | As wolfSSL is having hard time maintaining ABI compatibility between releases, we need to manually force rebuild of packages depending on libwolfssl and thus force their upgrade. Otherwise due to the ABI handling we would endup with possibly two libwolfssl libraries in the system, including the patched libwolfssl-5.5.1, but still have vulnerable services running using the vulnerable libwolfssl-5.4.0. So in order to propagate update of libwolfssl to latest stable release done in commit ec8fb542ec3e4 ("wolfssl: fix TLSv1.3 RCE in uhttpd by using 5.5.1-stable (CVE-2022-39173)") which fixes several remotely exploitable vulnerabilities, we need to bump PKG_RELEASE of all packages using wolfSSL library. Signed-off-by: Petr Štetiar <ynezz@true.cz>
Powered by cgit, Themed by Ted Yin.