aboutsummaryrefslogtreecommitdiff
path: root/package/network
Commit message (Collapse)AuthorAge
* wifi-scripts: fix fullmac phy detectionFelix Fietkau2024-02-09
| | | | | | | | | Checking for AP_VLAN misdetects ath10k-ath12k as fullmac, because of software crypto limitations. Check for monitor mode support instead, which is more reliable. Fixes: https://github.com/openwrt/openwrt/issues/14575 Signed-off-by: Felix Fietkau <nbd@nbd.name>
* dropbear: better handle interfacesKonstantin Demin2024-02-09
| | | | | | | | | | - introduce 'DirectInterface' option to bind exactly to specified interface; fixes #9666 and late IPv4/IPv6 address assignment - option 'DirectInterface' takes precedence over 'Interface' - improve interface/address handling, e.g. verify count of listening endpoints due to dropbear limit (10 for now) Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
* dropbear: better handle receive window sizeKonstantin Demin2024-02-09
| | | | | | | | | | - correct maximum receive window size - adjust receive window size against maximum allowed value - warn about too high receive window size in syslog improves f95eecfb Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
* dropbear: adjust file permissionsKonstantin Demin2024-02-09
| | | | | | | | | | | runtime: - adjust ownership/permissions while starting dropbear build time: - correct file permissions for preseed files in $(TOPDIR)/files/etc/dropbear/ (if any) closes #10849 Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
* dropbear: 'rsakeyfile' -> 'keyfile' transitionKonstantin Demin2024-02-09
| | | | | | | | | end users should have done this since OpenWrt 19.07. if they didn't do this yet - perform auto-transition. schedule 'rsakeyfile' removal for next year release. Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
* dropbear: failsafe: handle all supported key typesKonstantin Demin2024-02-09
| | | | | | dropbear may be configured and compiled with support for different host key types Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
* dropbear: minor config reorderKonstantin Demin2024-02-09
| | | | | | move DROPBEAR_ASKPASS under DROPBEAR_DBCLIENT (in all meanings) Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
* dropbear: split U2F/FIDO supportKonstantin Demin2024-02-09
| | | | | | | | these options allow one to configure U2F/FIDO support in more granular way inspired by upstream commit aa6559db Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
* dropbear: add option to enable modern crypto onlyKonstantin Demin2024-02-09
| | | | | | | | | | reduces binary/package size and increases overall performance also: - adjust 910-signkey-fix-use-of-rsa-sha2-256-pubkeys.patch to build without DROPBEAR_RSA/DROPBEAR_RSA_SHA256 Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
* dropbear: adjust allowed shell listKonstantin Demin2024-02-09
| | | | | | this takes an effect only if getusershell(3) is missing Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
* dropbear: honor CONFIG_TARGET_INIT_PATHKonstantin Demin2024-02-09
| | | | | | fixes 65256aee Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
* dropbear: disable two weak kex/mac algorithmsKonstantin Demin2024-02-09
| | | | | | | | | | | | | | | | hmac-sha1 and diffie-hellman-group14-sha1 are weak algorithms. A future deprecation notice of ssh-rsa (2048-bit) has been issued. [1] It has no place in a potentially internet-facing daemon like dropbear. Upstream has acknowledged this and offered this solution to disable these two until this is made to be the default in the next release of dropbear next year. [2] 1. https://www.openssh.com/txt/release-8.2 2. https://github.com/mkj/dropbear/issues/138 Signed-off-by: John Audia <therealgraysky@proton.me> Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
* dropbear: minor config clarificationKonstantin Demin2024-02-09
| | | | | | | | | | - "default n" is not needed: options are not selected by default - wrap config on 80 characters width (assuming tab is 8 characters long) - add feature cost size and security notes for DROPBEAR_AGENTFORWARD and DROPBEAR_DBCLIENT_AGENTFORWARD: describe why and where it should be disabled Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
* dropbear: better object cleanupKonstantin Demin2024-02-09
| | | | | | improves b78aae79 Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
* dropbear: allow more complex configurationKonstantin Demin2024-02-09
| | | | | | | | | | | | | | - switch DB_OPT_COMMON and DB_OPT_CONFIG to comma-separated lists: this allows to have values with "|" in DB_OPT_COMMON and DB_OPT_CONFIG which is more likely to be than values with commas; use $(comma) variable for values with commas. - sort DB_OPT_COMMON and DB_OPT_CONFIG to have "overrides" on top of list. - allow DB_OPT_COMMON to have values with commas. - allow to replace multiline definitions in sysoptions.h. improves e1bd9645 Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
* dropbear: cherry-pick upstream patchesKonstantin Demin2024-02-09
| | | | | | | | | | | | | | | | | | | | | | critical fixes: - libtommath: possible integer overflow (CVE-2023-36328) - implement Strict KEX mode (CVE-2023-48795) various fixes: - fix DROPBEAR_DSS and DROPBEAR_RSA config options - y2038 issues - remove SO_LINGER socket option - make banner reading failure non-fatal - fix "noremotetcp" behavior - don't try to shutdown a pty - fix test for multiuser kernels adds new features: - option to bind to interface - allow inetd with non-syslog - ignore unsupported command line options with dropbearkey Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
* dropbear: bump to 2022.83Konstantin Demin2024-02-09
| | | | | | | | | | | | - update dropbear to latest stable 2022.83; for the changes see https://matt.ucc.asn.au/dropbear/CHANGES - drop patches: - 001-fix-MAX_UNAUTH_CLIENTS-regression.patch - rework patches: - 901-bundled-libs-cflags.patch - refresh remaining patches Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
* lldpd: add option to force EDPStephen Howell2024-02-08
| | | | | | allow EDP support if compiled and add force EDP option Signed-off-by: Stephen Howell <howels@allthatwemight.be>
* lldpd: only use snmp options when compiled inStephen Howell2024-02-08
| | | | | | prevent SNMP options being passed unless lldpd supports them Signed-off-by: Stephen Howell <howels@allthatwemight.be>
* lldpd: Update Makefile package releaseStephen Howell2024-02-08
| | | | | | increment Makefile package release to reflect changes to init script Signed-off-by: Stephen Howell <howels@allthatwemight.be>
* lldpd: add option for tx delay and tx holdStephen Howell2024-02-08
| | | | | | add option to set LLDP transmit delay, hold timers to set update frequency Signed-off-by: Stephen Howell <howels@allthatwemight.be>
* lldpd: add option to set system platformStephen Howell2024-02-08
| | | | | | add option to override system platform instead of using kernel name Signed-off-by: Stephen Howell <howels@allthatwemight.be>
* lldpd: add option to force SONMP enabledStephen Howell2024-02-08
| | | | | | add option to force SONMP to be enabled even when no peer detected Signed-off-by: Stephen Howell <howels@allthatwemight.be>
* lldpd: add option to force FDP onStephen Howell2024-02-08
| | | | | | add option to force FDP when no peers detected Signed-off-by: Stephen Howell <howels@allthatwemight.be>
* lldpd: set CDP version and allow forcing CDP onStephen Howell2024-02-08
| | | | | | add option to specify CDPv1 or CDPv2 and separately enable or force each Signed-off-by: Stephen Howell <howels@allthatwemight.be>
* lldpd: allow disabling LLDP protcolStephen Howell2024-02-08
| | | | | | add option to allow LLDP disabling while using other supported protocols Signed-off-by: Stephen Howell <howels@allthatwemight.be>
* lldpd: add portidsubtype optionStephen Howell2024-02-08
| | | | | | add option portidsubtype to correct port identifiers and descriptions Signed-off-by: Stephen Howell <howels@allthatwemight.be>
* lldpd: add agent-type optionStephen Howell2024-02-08
| | | | | | add option to set agent-type to control propogation Signed-off-by: Stephen Howell <howels@allthatwemight.be>
* lldpd: add LLDP MED optionsStephen Howell2024-02-08
| | | | | | add option to enable LLDP MED fast-start and set fast-start timer Signed-off-by: Stephen Howell <howels@allthatwemight.be>
* lldpd: option to disable LLDP-MED inventory TLVStephen Howell2024-02-08
| | | | | | add option to disable LLDP-MED inventory TLV transmission Signed-off-by: Stephen Howell <howels@allthatwemight.be>
* lldpd: Init adds no-version optionStephen Howell2024-02-08
| | | | | | add option to disable advertising kernel version Signed-off-by: Stephen Howell <howels@allthatwemight.be>
* lldpd: Allow neighbour filteringStephen Howell2024-02-08
| | | | | | add filter option to init script. Signed-off-by: Stephen Howell <howels@allthatwemight.be>
* lldpd: LLDPD binds to only specified interfacesStephen Howell2024-02-08
| | | | | | | Bind to the configured system interfaces only. Switchport interfaces are no longer ignored and uci interface values for LLDPD are honored. Signed-off-by: Stephen Howell <howels@allthatwemight.be>
* lldpd: Init config read on reloadStephen Howell2024-02-08
| | | | | | | | | Init script reload with trigger to detect config file update. Reload command added to attempt non-impactful lldpd reload where lldpcli can be used to update config without process restart. Config hash function used to track whether process restart is needed. Signed-off-by: Stephen Howell <howels@allthatwemight.be>
* wifi-scripts: fix copy&paste issue in metadataFelix Fietkau2024-02-06
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* wifi-scripts: add script to add phy capabilities to board.jsonFelix Fietkau2024-02-03
| | | | | | | Useful for UI and config generators. Will be used as intermediate step for generating the default wifi configuration Signed-off-by: Felix Fietkau <nbd@nbd.name>
* wifi-scripts: add new package, move wifi scripts to a single placeFelix Fietkau2024-02-03
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* uhttpd: bump PKG_RELEASEDaniel Golle2024-02-02
| | | | | | | | Bump PKG_RELEASE which should have been done by commit 7b1c3068b7 ("uhttpd: restart when interface to listen becomes available"). Fixes: 7b1c3068b7 ("uhttpd: restart when interface to listen becomes available") Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* uhttpd: restart when interface to listen becomes availableDaniel Golle2024-02-01
| | | | | | | | Currently uhttpd won't start with a listening interface configured if the interface isn't already up at the time uhttpd starts. Make sure we attempt to start uhttpd when it comes up. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* iwinfo: update to latest git HEADÁlvaro Fernández Rojas2024-01-26
| | | | | | | | | | | Adds MediaTek MT7916AN and Cypress CYW43455 (Raspberry Pi 5) devices. a34977c devices: add device id for Cypress CYW43455 3eb34df devices: add device id for MediaTek MT7916AN There are no ABI changes. Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
* hostapd: fail R0KH and R1KH derivation when wpa_psk_file is usedRany Hany2024-01-25
| | | | | | | | | When wpa_psk_file is used, there is a chance that no PSK is set. This means that the FT key will be generated using only the mobility domain which could be considered a security vulnerability but only for a very specific and niche config. Signed-off-by: Rany Hany <rany_hany@riseup.net>
* hostapd: fix 11r defaults when using SAEJesus Fernandez Manzano2024-01-25
| | | | | | | | When using WPA3-SAE or WPA2/WPA3 Personal Mixed, we can not use ft_psk_generate_local because it will break FT for SAE. Instead use the r0kh and r1kh configuration approach. Signed-off-by: Jesus Fernandez Manzano <jesus.manzano@galgus.ai>
* hostapd: fix 11r defaults when using WPAJesus Fernandez Manzano2024-01-25
| | | | | | | | | | | | | | 802.11r can not be used when selecting WPA. It needs at least WPA2. This is because 802.11r advertises FT support in-part through the Authentication and Key Management (AKM) suites in the Robust Security Network (RSN) Information Element, which was included in the 802.11i amendment and WPA2 certification program. Pre-standard WPA did not include the RSN IE, but the WPA IE. This IE can not advertise the AKM suite for FT. Signed-off-by: Jesus Fernandez Manzano <jesus.manzano@galgus.ai>
* hostapd: remove obsolete functionFelix Fietkau2024-01-25
| | | | | | Leftover from authsae, which was removed a long time ago Signed-off-by: Felix Fietkau <nbd@nbd.name>
* iproute2: update to 6.7.0Nick Hainke2024-01-25
| | | | | | | | | | | | | | | | | | | | | | | Release Notes: https://lwn.net/Articles/957171/ Remove patch "100-configure.patch" because support for ATM was dropped [0]. Manually refresh: - 200-drop_libbsd_dependency.patch Automatic refresh: - 130-no_netem_tipc_dcb_man_vdpa.patch - 140-keep_libmnl_optional.patch - 145-keep_libelf_optional.patch - 150-keep_libcap_optional.patch - 155-keep_tirpc_optional.patch - 190-fix-nls-rpath-link.patch - 300-selinux-configurable.patch [0] - https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit/?id=a66a73af6db74fdb64439316c69aa0e35dd02c47 Signed-off-by: Nick Hainke <vincent@systemli.org>
* wireguard-tools: avoid redundant jsonfilter callsJo-Philipp Wich2024-01-23
| | | | | | | | Use a single jsonfilter expression to yield the list of logical wireguard interface names in shell compatible notation. Supersedes: #12344 Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* hostapd: ACS: Fix typo in bw_40 frequency arrayDavid Bauer2024-01-18
| | | | | | | | | | | [Upstream Backport] The range for the 5 GHz channel 118 was encoded with an incorrect channel number. Fixes: ed8e13decc71 (ACS: Extract bw40/80/160 freqs out of acs_usable_bwXXX_chan()) Signed-off-by: Michael Lee <michael-cy.lee@mediatek.com> Signed-off-by: David Bauer <mail@david-bauer.net>
* uqmi: update to git HEADDaniel Golle2024-01-16
| | | | | | | c3488b8 uqmi: cancel all requests on SYNC indication reception dfa612e uqmi: improve response detection Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* hostapd: add back missing function for updating wpa_supplicant macaddr listFelix Fietkau2024-01-13
| | | | | | | Make the call deferred instead of blocking to avoid deadlock issues Fixes: 3df9322771cc ("hostapd: make ubus calls to wpa_supplicant asynchronous") Signed-off-by: Felix Fietkau <nbd@nbd.name>
* hostapd: fix an exception in hostapd.uc on interface add failureFelix Fietkau2024-01-13
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
Powered by cgit, Themed by Ted Yin.