b52053b 6in4: https support for he.net tunnel api
introduced HTTPS support using wget.
The busybox version of wget, however, doesn't support the -V option,
thus poluting logfiles with a full invalid-parameter-output.
Redirect stderr to fix that.
As libcurl and curl support selecting the SSL library of your choice,
also add support for curl which is more commonly used on OpenWrt than
"real" wget which needs libopenssl.
Also make sure to respect SSL_CERT_DIR and increase timeouts.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
SVN-Revision: 43228
This patch adds the userspace and kernelspace for
- match NETFILTER_XT_MATCH_CLUSTER
This match can be used to deploy gateway and back-end load-sharing clusters.
- target IP_NF_TARGET_CLUSTERIP
This module allows you to configure a simple cluster of nodes
that share a certain IP and MAC address
without an explicit load balancer in front of them.
Connections are statically distributed between the nodes in this cluster.
This is used i.e. by strongswan-ha.
Signed-off-by: Christian Scheele <cs@embedd.com>
SVN-Revision: 43174
Note, that licensing stuff is a nightmare: many packages does not clearly
state their licenses, and often multiple source files are simply copied
together - each with different licensing information in the file headers.
I tried hard to ensure, that the license information extracted into the OpenWRT's
makefiles fit the "spirit" of the packages, e.g. such small packages which
come without a dedicated source archive "inherites" the OpenWRT's own license
in my opinion.
However, I can not garantee that I always picked the correct information
and/or did not miss license information.
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
SVN-Revision: 43155
Port Debians adaptive LCP echo patch to pppd, make it configurable with UCI
and enable it by default.
When adaptive LCP echo is enabled, LCP echo requests are only sent if the
link is idle, this avoids the common situation where a congested PPP link
(e.g. during torrenting) is falsely detected as disconnected because the
LCP replies are not received in time.
Also bump the copyright year in the Makefile, remove a redundant maintainer
entry and fix the shell processing of the keepalive option when the two-
value syntax is used.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
SVN-Revision: 43143
HE.net tunnel update API requests are now made via https if an
SSL-capable wget is installed. Certificate validation is
conditionally enabled if the CA certs are available.
Signed-off-by: Andrew Skalski <askalski@gmail.com>
SVN-Revision: 43124
I had to use a VDSL-only tone-setup to get show-time.
Handle this in uci by checking if annex is unset.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
SVN-Revision: 43114
* Fixes sending an extraneous message body for 204 and 304 resoponses which
breaks Chrome in keep-alive mode.
* Adds mimetypes for JSON and JSONP.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
SVN-Revision: 43078
The wpa_psk_file option offers the possibility to use a different WPA-PSK key for each client. The directive points to a file with the following syntax:
mac_address wpa_passphrase_or_hex_key
Example:
00:11:22:33:44:55 passphrase_for_client_1
00:11:22:33:44:67 passphrase_for_client_2
00:11:22:33:44:89 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
So it is possible to specify both ASCII passphrases and raw 64-chars hex keys.
Signed-off-by: Vittorio Gambaletta <openwrt@vittgam.net>
SVN-Revision: 43001
* Rewrite ndp proxy using kernel proxying
* Aid flash-renumbering in hybrid DHCPv6-mode
* Unicast RAs to RS senders
* Add support for router address
Signed-off-by: Steven Barth <steven@midlink.org>
SVN-Revision: 42944
[base-files] shell-scripting: fix wrong usage of '==' operator
normally the '==' is used for invoking a regex parser and is a bashism.
all of the fixes just want to compare a string. the used busybox-ash
will silently "ignore" this mistake, but make it portable/clean at least.
this patch does not change the behavior/logic of the scripts.
Signed-off-by: Bastian Bittorf <bittorf@bluebottle.com>
SVN-Revision: 42911
Patch allows to configure the mtu of the dynamic 6rd tunnel interface when created by dhcp script.
In some setups it's desirable to have config control over the 6rd tunnel mtu to maximize the traffic throughput
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
SVN-Revision: 42871
This is not needed after all:
Omitting option ipv6 or setting it to 'auto' will
fire up a dhcpv6 subprotocol (this was added).
Setting ipv6 to 1 will only cause the IPv6 link to
be brought up and an accompanying dhcpv6 or static
interface with ifname @wan can be used to configure addresses.
Signed-off-by: Steven Barth <steven@midlink.org>
SVN-Revision: 42859
Use network_get_ipaddrs_all to get all ip-addresses of an interface. If the
function fails, the interface does not exists or has not any suiteable ip
addresses assigned.
Use the returned ip-address(es) to construct the dropbear listen address.
Signed-off-by: Mathias Kresin <openwrt@kresin.me>
SVN-Revision: 42857
this proto handler will detect which of 3g, qmi, mbim, ncm or directip you need
for a stick and setup uci automagically
Signed-off-by: John Crispin <blogic@openwrt.org>
SVN-Revision: 42837
Some ISP seem to only do stateful DHCPv6 and not sending RAs.
This is technically broken because plain DHCPv6 doesn't carry routes.
We work around here by faking a default route to the DHCPv6 server
if we do not receive a useful RA from the ISP.
This workaround can be turned off with: option fakeroutes 0
Signed-off-by: Steven Barth <steven@midlink.org>
SVN-Revision: 42803
The AR9580 with the new ID can be found in the EnGenius ESR900 and the
QCA9880 without any subsystem IDs can be found in the EnGenius ESR1750.
Signed-off-by: Forest Crossman <cyrozap@gmail.com>
SVN-Revision: 42793
In r41872 Dynamic VLAN support was reintroduced, but the vlan_naming
parameter is not read while setting up the config, so it always
defaults to 1.
Signed-off-by: Reiner Herrmann <reiner@reiner-h.de>
SVN-Revision: 42787
Send a netlink call to leave the mesh when meshd exits
Make hunting-and-pecking loop (more) resistant to side channel attack
Signed-off-by: Michel Stam <m.stam@fugro.nl>
SVN-Revision: 42750
Tos support is added as a string parameter which can have the following values :
-inherit (outer header inherits the tos value of the inner header)
-hex value
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
SVN-Revision: 42749
Tos support is added as a string parameter which can have the following values :
-inherit (outer header inherits the tos value of the inner header)
-hex value
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
SVN-Revision: 42748
Tos support is added as a string parameter which can have the following values :
-inherit (outer header inherits the tos value of the inner header)
-hex value
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
SVN-Revision: 42747
The package supports IP in IP by registering the ipip protocol handler
Following options are configurable
-peeraddr (IPv4 remote address)
-ipaddr (IPv4 local address)
-ttl (time to live of encapsulating packet)
-tos (type of service of encapsulating packet either inherit (outer header inherits the value of the inner header) or hex value)
-df (don't fragment flag of encapsulating packet)
-mtu (IPIP tunnel mtu)
-tunlink (bind tunnel to this interface)
-zone (firewall zone to which the IPIP tunnel will be added)
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
SVN-Revision: 42746
When 'wifi down' is called by /etc/init.d/network, it is run from
stop_service( ). This function is in turn invoked from stop( ).
stop( ) messes up the order by first procd_kill-ing the network
settings, then calling wifi to down the wifi networking
interfaces. By redefining stop( ) instead, the proper order is
restored.
Signed-off-by: Michel Stam <m.stam@fugro.nl>
SVN-Revision: 42745
Instead of connecting once and saving the packet data handle, let the
firmware handle connecting/reconnecting automatically. This is more
reliable and reduces reliance on potentially stale data.
Use the global packet data handle to attempt to disable autoconnect
before restarting the connection. This ensures that the firmware will
take the new APN/auth settings.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
SVN-Revision: 42721
Tos support is added as a generic grev4/grev6 parameter which can have the following values :
-inherit (outer header inherits the tos value of the inner header)
-hex value
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
SVN-Revision: 42700
Main changes:
- URL parser: IPv6 zone identifiers are now supported
- cyassl: Use error-ssl.h when available (drop local patch)
- polarssl: support CURLOPT_CAPATH / --capath
- mkhelp: generate code for --disable-manual as well (drop local patch)
Full release notes: http://curl.haxx.se/changes.html
MIPS 34kc binary size:
- 7.36.0 before: 82,539 bytes
- 7.38.0 after: 83,321 bytes
Signed-off-by: Catalin Patulea <cat@vv.carleton.ca>
SVN-Revision: 42517
With this patch WPS discovery can be started or canceled over ubus if
WPS is enabled in wireless configuration. This is equivalent of
'hostapd_cli wps_pbc' and 'hostapd_cli wps_cancel' commands.
Signed-off-by: Petar Koretic <petar.koretic@sartura.hr>
SVN-Revision: 42459
* ipv6
* 4 bugs in the dns parser
* service announcement
* tx goodbye support
* proper handling of rx goodbye
Signed-off-by: John Crispin <blogic@openwrt.org>
SVN-Revision: 42325
Use an if/else statement to cover the two different syntaxes. Add
comments explaining what the end results should look like.
This patch should not change the script's output.
Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
SVN-Revision: 42320
An entry like this in /etc/config/dhcp:
config 'host'
option 'name' 'pc2'
option 'ip' '192.168.100.56'
option 'dns' '1'
results in a /tmp/hosts/dhcp entry that looks like this:
192.168.100.56 .lan
Obviously it should say "pc2.lan".
This happens because $name is set to "" in order to support the MAC-less
syntax: "--dhcp-host=lap,192.168.0.199". Fix this by reordering the
operations. Also, refuse to add a DNS entry if the hostname or IP is
missing.
Fixes#17683
Reported-by: Kostas Papadopoulos <kpapad75@travelguide.gr>
Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
SVN-Revision: 42319
LuCI creates "domain" UCI config sections, which the dnsmasq init file
then, currently, translates into "address" config lines. This is not
the correct usage of "address" (see r36943), and also causes rDNS
records to not be created. This patches dnsmasq.init to utilize the
additional hosts file introduced in r40799 for such domain names,
resolving both issues.
Signed-off-by: Tyler Fenby <tylerf@securecominc.com>
SVN-Revision: 42318
A quite frequent problem after sysupgrading from an older, SSL enabled build
is that ustream-ssl is not installed so uhttpd fails to come up again due to
https listening directives in the preserved configuration.
Skip key/cert and ssl listen options when libustream-ssl.so is not present.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
SVN-Revision: 42284
somebody started to set a function returncode in the validation
stuff and everybody copies it, e.g.
myfunction()
{
fire_command
return $?
}
a function automatically returns with the last returncode,
so we can safely remove the command 'return $?'. reference:
http://tldp.org/LDP/abs/html/exit-status.html
"The last command executed in the function or script determines the exit status."
Signed-off-by: Bastian Bittorf <bittorf@bluebottle.com>
SVN-Revision: 42278
Disable MIPS16 to prevent it negatively affecting performance.
Observed was a increase of connection delay from ~6 to ~11 seconds
and a reduction of scp speed from 1.1MB/s to 710kB/s on brcm63xx.
Fixes#15209.
Signed-off-by: Jonas Gorski <jogo@openwrt.org>
SVN-Revision: 42250
Add a further upstream commit to more closely match the keepalive
to OpenSSH.
Should now really fix#17523.
Signed-off-by: Jonas Gorski <jogo@openwrt.org>
SVN-Revision: 42249
Don't send SSH_MSG_UNIMPLEMENTED for keepalive responses, which broke
at least putty.
Fixes#17522 / #17523.
Signed-off-by: Jonas Gorski <jogo@openwrt.org>
SVN-Revision: 42162
This is a bug revealed in r41830.
First, the static variable `char nif[IFNAMSIZ]` of nl80211_phy2ifname()
would be zeroed out if the argument is "wlan0" or the like. This will
happen in the following call stack.
nl80211_get_scanlist("radio0", buf, len);
nl80211_phy2ifname("radio0") // return static var nif with content "wlan0"
nl80211_get_scanlist(nif, buf, len); // tail call
nl80211_get_mode(nif);
nl80211_phy2ifname(nif); // zero out nif
Later we try nl80211_ifadd("") which was supposed to create interface
"tmp.", but that won't happen because nl80211_msg() will put an invalid
ifidx 0 to the nlmsg.
Then iwinfo_ifup() and iwinfo_ifdown() would fail and happily
nl80211_get_scanlist() returned 0 and left *len undefined.
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
SVN-Revision: 42151
Utilize the new selective conntrack flushing facility to clear
out active conntrack entries referring to old IP addresses after
a firewall reload.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
SVN-Revision: 42114
NFLOG and NFQUEUE targets' full support for iptables.
Includes all needed kernel modules (Xtables's and Netlink's)
and userspace libraries.
All added kernel modules can be individually disabled,
all other new libraries get their own individual packages.
Reported-by: Fabian Hugelshofer <hugelshofer2006@gmx.ch>
Reported-by: Rainer Poisel <rainer.poisel@fhstp.ac.at>
Reported-by: Derek LaHousse <dlahouss@mtu.edu>
Signed-off-by: Guillaume Déflache <guillaume.deflache@ibwag.com>
SVN-Revision: 42022
This commit implements a new netfilter match "xt_id" which can be used to
attach unsigned 32bit IDs to iptables rules.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
SVN-Revision: 41945
The package supports Generic Routing Encapsulation support by registering following protocol kinds:
-gre
-gretap
-grev6
-grev6tap
Following options are valid for gre and gretap kinds:
-ipaddr
-peeraddr
-df
-mtu
-ttl
-tunlink
-zone
-ikey
-okey
-icsum
-ocsum
-iseqno
-oseqno
The gretap kind supports additionally the network option
Following options are valid for grev6 and grev6tap kinds:
-ip6addr
-peer6addr
-weakif
-mtu
-ttl
-tunlink
-zone
-ikey
-okey
-icsum
-ocsum
-iseqno
-oseqno
The grev6tap kind supports additionally the network option
Typical network config for a GREv4 tunnel :
config interface 'gre'
option peeraddr '172.16.18.240'
option mtu '1400'
option proto 'gre'
option tunlink 'wan'
option zone 'tunnel'
Typical network config for a GREv4 tap tunnel :
config interface 'gretap'
option peeraddr '195.207.5.79'
option mtu '1400'
option proto 'gretap'
option zone 'tunnel'
option tunlink 'wan'
option network 'wlan_ap'
I added myself as maintainer for the moment; feel free to change.
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
SVN-Revision: 41897
This patch brings full dynamic vlan support to netifd that existed in hostapd.sh in Attitude Adjustment.
Signed-off-by: Joseph CG Walker <Joe@ChubbyPenguin.net>
[jow@openwrt.org: changed commit message, rebased on top of current hostapd.sh]
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
SVN-Revision: 41872
If the iface to scan on already is in ad-hoc, station or monitor mode
then do not spawn a temporary iface.
Also preventively disable IPv6 on temporary ifaces before bringing them
up to avoid potential security issues.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
SVN-Revision: 41830
So far iwinfo aborted a wifi scan attempt if the mac of the spawned
interface could not be changed. Change the code to try anyway - this
should fix wifi scanning on RaLink devices.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
SVN-Revision: 41826
the IB tries to run the enable target on all init.d scripts.
It fails when including the dsl_control helper. Check for existence
prior to the include.
Signed-off-by: John Crispin <blogic@openwrt.org>
SVN-Revision: 41787
Properly parse and pass arbritary netmasks to iptables, this allows
specifying ranges like '::c23f:eff:fe7a:a094/::ffff:ffff:ffff:ffff' to
match the host part of an IPv6 address regardless of the currently active
IPv6 prefix.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
SVN-Revision: 41760
Split connection mark into two parts:
The lower nibble contains the confirmed conntrack mark which is not
generated by default/reclassify rules.
The upper nibble contains the current value specified by
default/reclassify rules.
For egress, the default/reclassify value is preferred
For ingress, the connection mark is preferred
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
SVN-Revision: 41682
The commit 92281eb747b56e748b7c3d754055919c23befdd4 broke fw3_ubus_addresses() so that
no addresses where returned at all, this caused fw3 to not emit NAT reflection rules
anymore.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
SVN-Revision: 41556
They should be unnecessary with fq_codel, and simplifying rules helps
with performance
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
SVN-Revision: 41549
currently the keepalive option needs to be removed to fully disable it. this patch allows us to set it to 0.
Signed-off-by: John Crispin <blogic@openwrt.org>
SVN-Revision: 41438
The preferred he.net /nic/update endpoint expects the password or updatekey in
plain text and not as md5 sum, therfore remove the hashing operation from the
script.
This effectively renders the "updatekey" option redundant but we keep it around
for backwards compatibility. Both "option password" and "option updatekey" will
have end up in the "&password=" parameter of the update url and are passed through
unmodified.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
SVN-Revision: 41358
this is still wip, you can use the following ubus calls.
ubus call mdns scan # triggers a scan
ubus call mdns browse # look at the currenlty cached records
ubus call mdns hosts # look at the currenlty cached hosts
TODO
- ipv6, currenlty AAAA records are handled but only on v4 sockets
- finish the service announce code
Signed-off-by: John Crispin <blogic@openwrt.org>
SVN-Revision: 41345
Reworks the handling of RT_TABLE_MAIN in system-linux.c so that ip rules
with lookup main can be properly setup.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
SVN-Revision: 41282
* Add Authoritative DNS and IPSET to full variant
* Remove some bloat from IPSET support
* Reintroduce "DHCP no address warning"-patch
Signed-off-by: Steven Barth <steven@midlink.org>
SVN-Revision: 41246
Ship keys for the root zone and add two uci options to enable
DNSSEC checks:
Option 'dnssec': Activate DNSSEC validation
Option 'dnsseccheckunsigned': Ensure answers without DNSSEC are in
unsigned zones.
Signed-off-by: Andre Heider <a.heider@gmail.com>
SVN-Revision: 41245
This variant includes support for DHCPv6 and DNSSEC.
DNSSEC adds a dependency on libnettle.
Signed-off-by: Andre Heider <a.heider@gmail.com>
SVN-Revision: 41244
As documented in config.h.
Doing otherwise will break dnsmasq's pkg-wrapper script to find its
libs to link to.
Signed-off-by: Andre Heider <a.heider@gmail.com>
SVN-Revision: 41241
Fixed wpa_supplicant when the radio is in 40MHz mode so that it no
longer restarts hostapd with the second channel disabled.
Signed-off-by: Lance Chaney <furryfur1@gmail.com>
SVN-Revision: 41019
rsn_preauth is used outside of "case $auth_type", so if it is set
for an EAP-enabled SSID, it would also be set for the following
non-EAP-enabled SSIDs, because it would not be read again.
Signed-off-by: Reiner Herrmann <reiner@reiner-h.de>
SVN-Revision: 41012
Let the first parameter of function config_get be local, because there
is a chance that config_get won't export the variable.
Signed-off-by: Zhao, Gang <gamerh2o@gmail.com>
SVN-Revision: 41000
In case of .11ac device the hwmode was not properly displayed.
This patch fixes it.
Signed-off-by: Marek Kwaczynski <marek.kwaczynski@tieto.com>
Signed-off-by: Bartosz Markowski <bartosz.markowski@tieto.com>
SVN-Revision: 40953
- The package does not compile at the moment. Since there is a new
upstream version avaiable, use this new source instead.
- Upstream has already included our both patches.
- This is only compile tested, since I do not own any test hardware.
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
SVN-Revision: 40940
It's quite unconveniet to remember which ports are used by which applications, especially for not so advanced users.
Together with luci patch (discussed on IRC) this improves qos-scripts usability.
Signed-off-by: Roman Yeryomin <roman@advem.lv>
SVN-Revision: 40935
`own_ip_addr` is used by hostapd as NAS-IP-Address.
This is used to identify the AP that is requesting the authentication of the
user and could be used to define which AP's can authenticate users.
Some vendors implement only NAS-Identifier or NAS-IP-Address and not both.
This patch adds ownip as an optional parameter in /etc/config/wireless.
Signed-off-by: Thomas Wouters <thomaswouters@gmail.com>
SVN-Revision: 40934
allows to set PPP interface name manually via new
network interface option pppname.
If not set, default naming will be used (e.g. pppoe-eth0)
Signed-off-by: Ulrich Weber <uw@ocedo.com>
SVN-Revision: 40933
when disabling ipv6, the iptables build breaks without a manul clean or this patch
Signed-off-by: Bastian Bittorf <bittorf@bluebottle.com>
SVN-Revision: 40916
Many of the 4G/LTE and 3G modems utilize the QMI-protocol to control the
modem. At the moment there is no support for them in OpenWrt. This
patch adds support for them in the form of a netifd script and a
control utility. Tested with Huawei E398 and ZTE MF820D (which requires
a delay of ~30 s before responding to QMI commands). I put myself up as
the maintainer, feel free to change this if you desire.
Signed-off-by: Matti Laakso <malaakso@elisanet.fi>
SVN-Revision: 40868
DHCP entries in /etc/config/dhcp will not automatically create A or PTR
records. Add an "option dns" directive which appends an entry to
/tmp/hosts/dhcp to facilitate forward and reverse DNS lookups. For
instance, this item:
config host
option ip '192.168.0.10'
option mac '00:13:57:9b:df:02'
option name 'winpc'
option dns '1'
will add a corresponding entry to /tmp/hosts/dhcp:
192.168.0.10 winpc.lan
This keeps the hostname/IP/MAC in a single place, for easy maintenance.
Related: ticket #13854 reports an regression involving missing PTR
records when using "config domain" to define static DNS entries for
individual hosts. However, per Simon Kelley[1], the --address feature
used by "config domain" was never intended to generate DNS A records for
hosts. It would probably be better for the reporter to apply this patch,
and then use "config host" sections instead of "config domain" sections.
[1] http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2008q4/002498.html
Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Signed-off-by: Florian Fainelli <florian@openwrt.org>
SVN-Revision: 40799
This updates samba to the most recent minor version.
This patch is based on a patch by Anton van Bohemen <avbohemen@ziggo.nl>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
SVN-Revision: 40618
This patch fixes compilation failure for hostapd when using eglibc 2.15.
Signed-off-by: Zachery Stoddard <zacherystoddard@gmail.com>
SVN-Revision: 40575
Gives the user the control to select the correct WAN IPv4 address to be used by the 6rd tunnel when mutiple WAN interfaces are configured
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
SVN-Revision: 40566
This patch implements support for 802.11s protected mesh wireless networks (using authsae) in the netifd framework.
Until meshd-nl80211 implements a proper -P option for the PID file, this uses shell backgrounding in order to be able to get the PID for the process.
Signed-off-by: Vittorio Gambaletta <openwrt@vittgam.net>
SVN-Revision: 40497
r39995 introduced a new parameter wps_pbc_in_m1 to wifi wps config, but
apparently did not provide a default value 0.
When that option's non-existing value is later evaluated in
/lib/netifd/hostapd.sh, it causes the "bad number" error to be logged in
syslog if user has not set the wps_pbc_in_m1 option. The error materialises
only if user has enabled wps.
Sat Apr 12 13:25:01 2014 daemon.notice netifd: radio1 (1254): sh: bad number
Sat Apr 12 13:25:01 2014 daemon.notice netifd: radio0 (1253): sh: bad number
Discussion in bug 15508: https://dev.openwrt.org/ticket/15508#comment:3
Error is caused by line 282:
https://dev.openwrt.org/browser/trunk/package/network/services/hostapd/files/netifd.sh#L282
My patch sets the parameter's default value to 0, which does nothing. The
default might also be set a bit later in the function, but this felt like the
most clear place to do that.
Signed-off-by hnyman <hannu.nyman@iki.fi>
SVN-Revision: 40469
* atm module needs to be loaded before linux-atm
* use absolute firmware paths
* extended validation
* add a script for mounting an optional firmware partition
Signed-off-by: John Crispin <blogic@openwrt.org>
SVN-Revision: 40460
fixes incremental build with change to CONFIG_DROPBEAR_ECC
drop --with-shared which is unknown to configure
Patch by Catalin Patulea <cat@vv.carleton.ca>
SVN-Revision: 40300
Without timeout mechanism, if ssh client disconnected without sending
FIN or RST, forked dropbear servers would hang there for
KEX_RETRY_TIMEOUT seconds (8 hours).
TCP keepalive is not implemented in dropbear yet, thus the name
SSHKeepAlive.
300 seconds in this patch is selected from the default value of
ServerAliveInterval for Debian ssh client (See man ssh_config).
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
SVN-Revision: 40299
Option pbc_in_m1 is being used as a WPS capability discovery
workaround for PBC with Windows 7.
Add possibility to enable this workaround from UCI.
To enable it, turn on wps and set wps_pbc_in_m1 parameter to 1.
Signed-off-by: Pawel Kulakowski <pawel.kulakowski@tieto.com>
SVN-Revision: 39995
This patch removes dependancy of PPP from chat application as chat application can be used for other serial communication as well that is not dependant on PPP and therefore one should be able to install chat without PPP. There also are no dependencies within chat application for PPP.
Signed-off-by: Oskari Rauta <oskari.rauta at gmail.com>
SVN-Revision: 39992
This change creates a new ip-full variant for the ip package.
It disables IP_CONFIG_TINY to make some iproute2 features available like xfrm, gretap, ...
Signed-off-by: Thomas Wouters <thomaswouters@gmail.com>
SVN-Revision: 39854
* Reduce RA/DHCPv6 spam filter to 30s by default and make it configurable
* Don't set nd_ra_{reachable,retransmit] to 0 when received in RAs
SVN-Revision: 39775
Similarly to the previously broken address pools, DNS-servers and some
MSRs could be advertised incorrectly as well. This is now fixed.
SVN-Revision: 39739
- Do not consider bitmap storage for IPv6 family sets
- Move ipset family parameter before any additional option
- Only emit family parameter for hash sets
- Do not allow IPv6 iprange for IPv4 sets and vice versa
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
SVN-Revision: 39647
6in4 historically allowed an ip6addr without a mask however the newly
introduced source-routing segfaulted in this scenario (#14958 + #14858).
Fixes include: "Fix ubus route src mask printing" and
"Disable netlink auto ack" (thanks to Hans Dedecker)
SVN-Revision: 39586
- update iw to 3.14
- remove some patches that are obsolete
- 200-reduce_size.patch has new coalesce removed from Makefile matching prev. ver
- refresh patches
This increases the size of the binary by 6.7%:
87801 4400 320 92521 16969 iw-3.10/iw
93995 4424 324 98743 181b7 iw-3.14/iw
Signed-off-by: Dirk Neukirchen <dirkneukirchen@web.de>
SVN-Revision: 39486
This patch introduces 802.11ac support to mac80211 and hostapd. The split of
VHT160 in two 80 MHz bands is not yet supported, since it requires an
additional user supplied parameter for the channel of the second band.
Signed-off-by: Matti Laakso <malaakso@elisanet.fi>
Signed-off-by: Simon Wunderlich <simon@open-mesh.com>
[sven@open-mesh.com: Rebased patch, merged htmode and vhtmode,
removed special hwmode, replaced uci vht_capab list with overwritable
autoconfig, fixed hostapd integration, fixed commit description, add HT40+/-
for VHT modes, add VHT40 center_freq autoconfig, refactored major parts]
Signed-off-by: Sven Eckelmann <sven@open-mesh.com>
SVN-Revision: 39456
Latest changes broke source-restriction of on-link routes. Restoring
old-behaviour but adding correct source-restrictions which prevents
the offlink handler to remove the on-link route.
SVN-Revision: 39454
* Fixed broken stateless-mode (fixes#14863)
* Support for multiple IAIDs, improved server compatibility,
improved NTP/SNTP support and other fixes (thanks to T-Labs)
SVN-Revision: 39433
Make the IPv4 "do not fragment" bit a configurable variable for the 6rd
tunnel interface as the bit should not be set in the encapsulating IPv4
header according to RFC3056.
On top the config variable allows to enable/disable path mtu discovery
for tunnel interfaces.
Config variable can be passed to netifd as tunnel config support is
already present for the "do not fragment" bit.
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
SVN-Revision: 39370
Introduced by ("netifd: add wireless configuration support and port mac80211 to
the new framework")
Reported-by: René van Weert <r.vanweert@sowifi.com>
Signed-off-by: Antonio Quartulli <antonio@meshcoding.com>
SVN-Revision: 39288
Introduced by ("netifd: add wireless configuration support and port mac80211 to
the new framework")
Reported-by: René van Weert <rene@sowifi.com>
Signed-off-by: Antonio Quartulli <antonio@meshcoding.com>
SVN-Revision: 39231
- cache udhcp check results to speed up subsequent reloads
- enable procd file tracking for /var/etc/dnsmasq.conf to only reload service if needed
- implement reload action to only restart dnsmasq if /var/etc/dnsmasq.conf actually changed
- launch dnsmasq from interface hotplug to avoid race conditions with network bringup
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
SVN-Revision: 39152
The firewall3 implementation as well as the shell implementation predating it
used to process the tcp_ecnoption as boolean while it actually is an integer.
Change the code to parse tcp_ecn as integer.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
SVN-Revision: 39122
This commit changes the dnsmasq init script to use the interface
status exposed by netifd. The old references to scan_interfaces()
and (indirect) accesses to uci state variables are removed and
replaced with corresponding network_*() calls.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
SVN-Revision: 39101
Before this patch, if we specify a plugin specific option through
`pppd_options` in /etc/config/network, e.g. `rp_pppoe_verbose 1`, pppd
would quit with the following error in log.
Wed Oct 9 09:42:58 2013 daemon.notice netifd: GORG (1689): /usr/sbin/pppd: unrecognized option 'rp_pppoe_verbose'
Wed Oct 9 09:42:58 2013 daemon.err pppd[1689]: unrecognized option 'rp_pppoe_verbose'
Wed Oct 9 09:42:58 2013 daemon.notice netifd: GORG (1689): pppd version 2.4.5
Wed Oct 9 09:42:58 2013 daemon.notice netifd: GORG (1689): Usage: /usr/sbin/pppd [ options ], where options are:
This is due to the requirement that function add_option() should be
called by the plugin_init() function first before pppd can parse those
options.
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
SVN-Revision: 38911
- instead of writing one (or more) ACCEPT rules in the filter table
for each redirect install a global ctstate DNAT accept rule per zone
- discard rules and redirects which have invalid options set instead
of silently skipping the invalid values
SVN-Revision: 38849
The correct bits are now cleared in the IPv6 address as the shift
value to the correct byte in the IPv6 address was wrong. Depending
on the stack values this could result in a hanging 6rdcalc program
due to an endless loop.
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
SVN-Revision: 38818
The associations list for Broadcom WDS interfaces are duplicate to those
reported by the corresponding AP interface; so there is no need to report
them again.
Signed-off-by: Nathan Hintz <nlhintz@hotmail.com>
SVN-Revision: 38746
Modify the hwmodelist reporting for broadcom devices to include
proper reporting of 802.11n support.
Signed-off-by: Nathan Hintz <nlhintz@hotmail.com>
SVN-Revision: 38745
Changeset r36943 ("dnsmasq: use host-record instead of address") removed
the automatic domain expansion for config domain sections, this breaks
existing setups and alters the old behaviour in unexpected ways, therfore
restore behaviour of the current stable release.
Additionally handle fully qualified hostnames properly when setting up the
own hostrecord by stripping the local domain part form the given name
instead of unconditionally appending it, so that "example.lan" results
in "example example.lan" and not "example.lan example.lan.lan".
SVN-Revision: 38648
- clean up duplication of procd instance handling code
- using --cd *after* --config is rather pointless
- to be able to log errors properly, --syslog needs to be passed before --config
- tell procd about the generated or referenced config file instead of
the uci file. this avoids having to restart all instances if only one
of them changes.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
SVN-Revision: 38632
* Various RFC compliance fixes (thanks to Hans Dedecker)
* Fix RA spam filter logic causing ipv6 connection issues
* Fix parameters -F and -P being order dependent
SVN-Revision: 38577
* Use network.interface dump call instead of individual status calls
to reduce overall netifd lookups and invokes to 1 per fw3 process.
* Allow protocol handlers to assign a firewall zone for an interface
in the data section to allow for dynamic firewall zone assignment.
SVN-Revision: 38504
* Add ubus methods for global interface status
* Add ubus function to create nested interfaces
* Add protocol update notifications and hotplug legacy calls
* Fix: key to data elements point at wrong memory area
* Add support for source-restricted routes
* Add option "delegate" to toggle prefix delegation
* Reevaluate target routes also on interface update
SVN-Revision: 38453
A similar change was recently merged in iw commit
58b46da26ab9b5ff31c7033e175351eb1301d9af
Signed-off-by: Bruno Randolf <br1@einfach.org>
SVN-Revision: 38449
There are several cases within 'luci' that attempt to access the interface
'type' from within the 'type' specific meta tables; however, 'type' is not
currently available there. Replicate the common metadata in the 'type'
specific meta tables.
Signed-off-by: Nathan Hintz <nlhintz@hotmail.com>
SVN-Revision: 38448
Possible parameters are yes, no and adaptive. See manpage for more information.
Signed-off-by: Philipp Borgers <borgers@mi.fu-berlin.de>
SVN-Revision: 38412
* Make SOL_MAX_RT configurable and default back to 120s
* Prefer servers with bigger prefixes (allows to use Comcast /60)
* Don't hang indefinitely if DHCPv6 REQUEST is not answered
Signed-off-by: Steven Barth <steven@midlink.org>
SVN-Revision: 38393
The switch driver is not used by brcm47xx any more and can be removed,
instead of this switch driver b53 is used now.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
SVN-Revision: 38387
There are certain consumer devices which are outliers in protocol conformance.
An example is Samsung bluray players, which require broadcast DHCP responses
(on Ethernet only, strangely not on Wifi).
By specifying:
config host
...
option broadcast 1
this will enable the response to be sent as an Ethernet broadcast and not as
a unicast.
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
SVN-Revision: 38365
- do not insert duplicate rules when setting up reflection to a zone containing multiple interfaces
- set up reflection for any protocol, not just TCP and UDP
SVN-Revision: 38361
proto_pptp_setup is responsible for loading the required modules to establish
a pptp connection to a foreign peer. The function checks whether all required
modules are already loaded, before actually loading them.
It seems that the filter being used to accomplish this, is not restrictive
enough in some cases. For instance when pptp nat helper modules are present on
a system, and already loaded before a pptp connection is enabled. Then the
search filter (possibly) returns the following for module=pptp, where actually
no matches are expected, resulting in the pptp.ko module not being loaded,
thereby failing to establish the pptp connection.
# module="pptp" ; grep "$module" /proc/modules
nf_nat_pptp 1312 0 - Live 0x86ce7000
nf_conntrack_pptp 3072 1 nf_nat_pptp, Live 0x86cb9000
nf_nat_proto_gre 784 1 nf_nat_pptp, Live 0x86cba000
nf_conntrack_proto_gre 2368 1 nf_conntrack_pptp, Live 0x86cbf000
nf_nat 9792 13 nf_nat_rtsp,nf_nat_tftp,nf_nat_sip,nf_nat_pptp,nf_nat_h323,nf_nat_proto_gre,nf_nat_amanda,nf_nat_irc,nf_nat_ftp,ipt_REDIRECT,ipt_NETMAP,ipt_MASQUERADE,iptable_nat, Live 0x86ca8000
nf_conntrack 37264 31 nf_nat_rtsp,nf_conntrack_rtsp,nf_nat_tftp,nf_conntrack_tftp,nf_nat_snmp_basic,nf_conntrack_snmp,nf_nat_sip,nf_conntrack_sip,nf_nat_pptp,nf_conntrack_pptp,nf_nat_h323,nf_conntrack_h323,nf_conntrack_proto_gre,nf_nat_amanda,nf_conntrack_amanda,nf_conntrack_broadcast,nf_nat_irc,nf_conntrack_irc,nf_nat_ftp,nf_conntrack_ftp,ipt_MASQUERADE,iptable_nat,nf_nat,xt_helper,xt_connmark,xt_connbytes,xt_conntrack,xt_CT,xt_NOTRACK,xt_state,nf_conntrack_ipv4, Live 0x86c90000
The search filter can be made more accurate/restrictive, by requiring the
occurance of the exact name of the module at the beginning of a line in
/proc/modules.
# module="pptp" ; grep "^$module " /proc/modules
pptp 13296 2 - Live 0x86e80000
Signed-off-by: Tijs Van Buggenhout <tvb@able.be>
SVN-Revision: 38358
Currently, in order to configure the authentication daemon in
8021x mode, we need to set wireless.@wifi-iface[0].encryption="wpa"
Though it works it confuses folks as 8021x is using WEP
encryption and not WPA. Therefore the terminology itself is
confusing. This change adds 8021x as a recognized string for 8021x
authentication.
Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
SVN-Revision: 38339
Setting wireless.@wifi-iface[N].ext_registrar=1 will enable UPNP
advertising and add an external registrar to the interface this vif
belongs to (br-lan if the vif is included in the LAN bridge). By
enabling this we append upnp_iface=xxx to the hostapd config file.
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
SVN-Revision: 38338
Enable CONFIG_WPS2 for hostapd. This is required to support
options like Virtual Push Button in WPS.
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
SVN-Revision: 38337
In 2009 OpenWrt's hostapd config added an "auth_cache" boolean
to be used to address a reported issue #12129 [0] on a forum [1].
The reported issue on the ticket is different that the one
described on the forum. The commit was r33359. This change broke
proper RSN preauthentication [2] [3] [4] expectations on hostapd's
configuration for WPA2 and this in turn disabled PMKSA caching and
Opportunistic Key Caching. This change:
* Leaves the "auth_cache" to be used only for WPA networks for those
looking to use this as a workaround to a reported issue but annotates
a warning over its usage.
* Separate "auth_cache" from WPA2 RSN preauthentication, leaving
WPA2 RSN preauthentication to enabled only with "rsn_preauth" with
the expected and recommended settings.
* Adds a new WPA2 RSN preauthentication "rsn_preauth_testing" to
be used when evaluating funcionality for WPA2 RSN preauthentication
with the expected and recommended settings with the only difference
so far with what should be enabled by default to disable Opportunistic
Key Caching.
Disabling the PMKSA cache should mean the STA could not roam off and back
onto the AP that had PMKSA caching disabled and would require a full
authentication cycle. This fixes this for WPA2 networks with
RSN preauthentication enabled.
This change should be applied to AA as well as trunk.
TL DR;
The issue described on the forum has to do with failure of a STA
being able to try to authenticate again with the AP if it failed
its first try. This may have been an issue with hostapd in 2009
but as per some tests I cannot reproduce this today on a WPA2
network.
The issue described on the ticket alludes to a security issue with the
design of using a Radius server to authenticate to an AP. The issue
vaguely alludes to the circumstances of zapping a user, deleting their
authentication credentials to log in to the network, and that if
RSN preauthentication is enabled with PMKSA caching that the user
that was zapped would still be able to authenticate.
Lets treat these as separate issues.
I cannot reproduce the first issue reported on the forums of not
being able to authenticate anymore on a WPA2 network.
The issue reported on the ticket modified WPA2 RSN preauthentication
by adding two fields to the hostapd configuration if auth_cache
was enabled:
* disable_pmksa_caching=1
* okc=0
The first one disables PMKSA authentication cache.
The second one disables Opportunistic Key Caching.
The issue reported on the ticket was fixed by implementing a workaround
in hostapd's configuration. Disabling PMKSA caching breaks proper use
of WPA2 RSN pre authentication. The usage of disable_pmksa_caching=1
prevents hostapd from adding PMKSA entries into its cache when a successful
802.1x authentication occurs. In practice RSN preauthentication would
trigger a STA to perform authentication with other APs on the same SSID,
it would then have its own supplicant PMKSA cache held. If a STA roams
between one AP to another no new authenitcation would need to be performed
as the new AP would already have authenticated the STA. The purpose of the
PMKSA cache on the AP side would be for the AP to use the same PMKID for
a STA when the STA roams off onto another BSSID and later comes back to it.
Disabling Opportunistic Key Caching could help the reported issue
as well but its not the correct place to address this. Opportunistic
Key Caching enables an AP with different interfaces to share the
PMKSA cache. Its a technical enhancement and disabling it would
be useful to let a testing suite properly test for RSN preauthentication
given that otherwise Opportunistic Key Caching would enable an
interface being tested to derive its own derive the PMKSA entry.
In production though okc=1 should be enabled to help with RSN
preauthentication.
The real fix for this particular issue outside of the scope of hostapd's
configuration and it should not be dealt with as a workaround to
its configuration and breaking expected RSN preauthentication and
technical optimizations. Revert this change and enable users to pick
and choose to enable or disable disable_pmksa_caching and okc expecting them
to instead have read clearly more what these do.
As for the core issure ported, the correct place to fix this is to
enable a sort of messaging between the RADIUS server and its peers
so that if caching for authentication is enabled that cache can be
cleared upon user credential updates. Updating a user password
(not just zapping a user) is another possible issue that would need
to be resolved here. Another part of the solution might be to reduce
the cache timing to account for any systematic limitations (RADIUS
server not able to ask peers to clear cache might be
one).
[0] https://dev.openwrt.org/changeset/33359
[1] https://forum.openwrt.org/viewtopic.php?id=19596
[2] http://wireless.kernel.org/en/users/Documentation/hostapd#IEEE_802.11i.2FRSN.2FWPA2_pre-authentication
[3] http://wireless.kernel.org/en/users/Documentation/wpa_supplicant#RSN_preauthentication
[4] http://wiki.openwrt.org/doc/recipes/rsn_preauthentication
Signed-off-by: Luis R. Rodriguez <mcgrof@do-not-panic.com>
SVN-Revision: 38336
This adds the eap_reauth_period to be used for modifying
the RADIUS server reauthentication authentication period,
a parameter that gets passed directly to the hostapd
configuration file.
Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
SVN-Revision: 38334
Changes include:
* removing unused variables
* replacing spaces with tabs where appropriate
* more consistency with variable declarations
Signed-off-by: Luka Perkov <luka@openwrt.org>
SVN-Revision: 38142
- fixes buffer corruption with JSON-RPC list calls
- change JSON-RPC protocol to include the session ID into the call
attributes instead of passing it via the URL
- forcibly pass effective session ID as "ubus_rpc_session" attribute
to called procedures
- change ubus acl checking to conform with new ubus session namespace
SVN-Revision: 37962
