Commit graph

8282 commits

Author SHA1 Message Date
Felix Fietkau
d45a1618eb ath9k: add some cleanups and minor fixes
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38354
2013-10-10 14:31:22 +00:00
Luka Perkov
cdb871ac48 openvpn: rework initscript (fixes #14299)
Signed-off-by: Luka Perkov <luka@openwrt.org>

SVN-Revision: 38351
2013-10-09 11:25:09 +00:00
Felix Fietkau
d1794a7536 procd: fix command handling in procd_add_instance()
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38350
2013-10-09 11:07:23 +00:00
Imre Kaloz
430e641a08 IPv6 support should depend on if we've enabled it
Signed-off-by: Imre Kaloz <kaloz@openwrt.org>

SVN-Revision: 38349
2013-10-09 11:03:00 +00:00
Hauke Mehrtens
b814661167 mac80211: rtlwifi: Align private space in rtl_priv struct
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

SVN-Revision: 38346
2013-10-09 09:13:41 +00:00
John Crispin
925f37a5a6 kernel: dont rely on library modules to be depended on
fixes https://dev.openwrt.org/ticket/14257

Signed-off-by: John Crispin <blogic@openwrt.org>

SVN-Revision: 38341
2013-10-08 15:08:33 +00:00
Felix Fietkau
ff40bc2db9 hostapd: recognize 8021x as an authentication mode
Currently, in order to configure the authentication daemon in
8021x mode, we need to set wireless.@wifi-iface[0].encryption="wpa"
Though it works it confuses folks as 8021x is using WEP
encryption and not WPA. Therefore the terminology itself is
confusing. This change adds 8021x as a recognized string for 8021x
authentication.

Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>

SVN-Revision: 38339
2013-10-08 11:09:52 +00:00
Felix Fietkau
9beaea6fc2 hostapd: add external registrar support
Setting wireless.@wifi-iface[N].ext_registrar=1 will enable UPNP
advertising and add an external registrar to the interface this vif
belongs to (br-lan if the vif is included in the LAN bridge). By
enabling this we append upnp_iface=xxx to the hostapd config file.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>

SVN-Revision: 38338
2013-10-08 11:09:48 +00:00
Felix Fietkau
246e9b449b hostapd: enable WPS2 support on hostapd-full.config
Enable CONFIG_WPS2 for hostapd. This is required to support
options like Virtual Push Button in WPS.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>

SVN-Revision: 38337
2013-10-08 11:09:44 +00:00
Felix Fietkau
bcbc9b1e89 hostapd: fix hostapd RSN preauthentication PMKSA caching
In 2009 OpenWrt's hostapd config added an "auth_cache" boolean
to be used to address a reported issue #12129 [0] on a forum [1].
The reported issue on the ticket is different that the one
described on the forum. The commit was r33359. This change broke
proper RSN preauthentication [2] [3] [4] expectations on hostapd's
configuration for WPA2 and this in turn disabled PMKSA caching and
Opportunistic Key Caching. This change:

  * Leaves the "auth_cache" to be used only for WPA networks for those
    looking to use this as a workaround to a reported issue but annotates
    a warning over its usage.

  * Separate "auth_cache" from WPA2 RSN preauthentication, leaving
    WPA2 RSN preauthentication to enabled only with "rsn_preauth" with
    the expected and recommended settings.

  * Adds a new WPA2 RSN preauthentication "rsn_preauth_testing" to
    be used when evaluating funcionality for WPA2 RSN preauthentication
    with the expected and recommended settings with the only difference
    so far with what should be enabled by default to disable Opportunistic
    Key Caching.

Disabling the PMKSA cache should mean the STA could not roam off and back
onto the AP that had PMKSA caching disabled and would require a full
authentication cycle. This fixes this for WPA2 networks with
RSN preauthentication enabled.

This change should be applied to AA as well as trunk.

  TL DR;

The issue described on the forum has to do with failure of a STA
being able to try to authenticate again with the AP if it failed
its first try. This may have been an issue with hostapd in 2009
but as per some tests I cannot reproduce this today on a WPA2
network.

The issue described on the ticket alludes to a security issue with the
design of using a Radius server to authenticate to an AP. The issue
vaguely alludes to the circumstances of zapping a user, deleting their
authentication credentials to log in to the network, and that if
RSN preauthentication is enabled with PMKSA caching that the user
that was zapped would still be able to authenticate.

Lets treat these as separate issues.

I cannot reproduce the first issue reported on the forums of not
being able to authenticate anymore on a WPA2 network.

The issue reported on the ticket modified WPA2 RSN preauthentication
by adding two fields to the hostapd configuration if auth_cache
was enabled:

  * disable_pmksa_caching=1
  * okc=0

The first one disables PMKSA authentication cache.
The second one disables Opportunistic Key Caching.

The issue reported on the ticket was fixed by implementing a workaround
in hostapd's configuration. Disabling PMKSA caching breaks proper use
of WPA2 RSN pre authentication. The usage of disable_pmksa_caching=1
prevents hostapd from adding PMKSA entries into its cache when a successful
802.1x authentication occurs. In practice RSN preauthentication would
trigger a STA to perform authentication with other APs on the same SSID,
it would then have its own supplicant PMKSA cache held. If a STA roams
between one AP to another no new authenitcation would need to be performed
as the new AP would already have authenticated the STA. The purpose of the
PMKSA cache on the AP side would be for the AP to use the same PMKID for
a STA when the STA roams off onto another BSSID and later comes back to it.

Disabling Opportunistic Key Caching could help the reported issue
as well but its not the correct place to address this. Opportunistic
Key Caching enables an AP with different interfaces to share the
PMKSA cache. Its a technical enhancement and disabling it would
be useful to let a testing suite properly test for RSN preauthentication
given that otherwise Opportunistic Key Caching would enable an
interface being tested to derive its own derive the PMKSA entry.
In production though okc=1 should be enabled to help with RSN
preauthentication.

The real fix for this particular issue outside of the scope of hostapd's
configuration and it should not be dealt with as a workaround to
its configuration and breaking expected RSN preauthentication and
technical optimizations. Revert this change and enable users to pick
and choose to enable or disable disable_pmksa_caching and okc expecting them
to instead have read clearly more what these do.

As for the core issure ported, the correct place to fix this is to
enable a sort of messaging between the RADIUS server and its peers
so that if caching for authentication is enabled that cache can be
cleared upon user credential updates. Updating a user password
(not just zapping a user) is another possible issue that would need
to be resolved here. Another part of the solution might be to reduce
the cache timing to account for any systematic limitations (RADIUS
server not able to ask peers to clear cache might be
one).

[0] https://dev.openwrt.org/changeset/33359
[1] https://forum.openwrt.org/viewtopic.php?id=19596
[2] http://wireless.kernel.org/en/users/Documentation/hostapd#IEEE_802.11i.2FRSN.2FWPA2_pre-authentication
[3] http://wireless.kernel.org/en/users/Documentation/wpa_supplicant#RSN_preauthentication
[4] http://wiki.openwrt.org/doc/recipes/rsn_preauthentication

Signed-off-by: Luis R. Rodriguez <mcgrof@do-not-panic.com>

SVN-Revision: 38336
2013-10-08 11:09:40 +00:00
Felix Fietkau
40aec9ed46 hostapd: Add WPS unconfigured & WPS pin method support
Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>

SVN-Revision: 38335
2013-10-08 11:09:36 +00:00
Felix Fietkau
4689bc8517 hostapd: Add eap_reauth_period config option
This adds the eap_reauth_period to be used for modifying
the RADIUS server reauthentication authentication period,
a parameter that gets passed directly to the hostapd
configuration file.

Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>

SVN-Revision: 38334
2013-10-08 11:09:27 +00:00
Hauke Mehrtens
c8e742a080 mac80211: wl12xx: build them again
WL_TI is bool but was set to =m, which deactivated it. Now it is set to
=y and should be activated in the config so the wl12xx driver gets
build.

This closes #14212.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

SVN-Revision: 38333
2013-10-07 22:16:17 +00:00
Hauke Mehrtens
16675de754 mac80211: brcmfmac: BRCMFMAC_USB was not set in config
Somehow BRCMFMAC_USB was not set in the build and brcmfmac.ko did not had usb support.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

SVN-Revision: 38332
2013-10-07 21:49:28 +00:00
Luka Perkov
c5bd00d82a openvpn: switch to new procd init script style
Signed-off-by: Luka Perkov <luka@openwrt.org>

SVN-Revision: 38331
2013-10-07 21:28:14 +00:00
Luka Perkov
d6415bf1bd polarssl: update to 1.2.9
Signed-off-by: Luka Perkov <luka@openwrt.org>

SVN-Revision: 38330
2013-10-07 21:28:12 +00:00
John Crispin
c1316c09a1 lantiq: fix ltq_ptm compile
Signed-off-by: John Crispin <blogic@openwrt.org>

SVN-Revision: 38329
2013-10-07 20:13:32 +00:00
Steven Barth
6dbfe22601 odhcp6c: improve server selection, introduce "forceprefix" option
SVN-Revision: 38314
2013-10-07 08:43:33 +00:00
Luka Perkov
702936f4c9 iproute2: update to 3.11
Signed-off-by: Luka Perkov <luka@openwrt.org>

SVN-Revision: 38313
2013-10-07 08:26:41 +00:00
Felix Fietkau
048fc8f0c1 ath9k: fix tx queueing issues after background scans
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38304
2013-10-05 12:12:21 +00:00
Steven Barth
8b7b7cabf2 opkg: add support for SHA256 verification
based on a patch by Evan Hunt <each@isc.org>
Signed-off-by: Steven Barth <steven@midlink.org>

SVN-Revision: 38302
2013-10-04 05:56:20 +00:00
Felix Fietkau
e96695df10 netifd: update to latest version, adds macvlan support
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38299
2013-10-03 14:51:34 +00:00
Hauke Mehrtens
caff3b5aee broadcom-diag: fix 'autoload' number of diag.ko
Change the autoload number from '5' to '05' so the module loads earlier (as intended).

Signed-off-by: Nathan Hintz <nlhintz@hotmail.com>

SVN-Revision: 38293
2013-10-02 23:14:08 +00:00
Steven Barth
03b0c3b5a6 package/index: fix index creating when building without signing
Signed-off-by: Alexander Couzens <lynxis@fe80.eu>

SVN-Revision: 38287
2013-10-02 16:38:28 +00:00
Steven Barth
95e9c260bc odhcp6c: validate hop-limit on RAs
SVN-Revision: 38285
2013-10-02 14:16:05 +00:00
Steven Barth
cbdd346b11 Add package signing infrastructure
Add package signing key and certificate configuration options to the
"Image configuration" submenu. If enabled, the Packages.gz list will
be signed as file Packages.sig. The passphrase for the signing key can
be sourced from a file or entered by the user. The signing certificate
is automatically added to the firmware image if opkg-smime is selected.

Signed-off-by: Evan Hunt <each@isc.org>
Signed-off-by: Steven Barth <steven@midlink.org>

SVN-Revision: 38284
2013-10-02 12:12:10 +00:00
Steven Barth
0ad1d06c13 6relayd: remove compat ULA setting by default (too many bad sideeffects)
SVN-Revision: 38283
2013-10-02 06:14:39 +00:00
Hauke Mehrtens
302d27f268 c80211: add iwldvm to iwlwifi, this is needed to support the old wifi card.
This closes #14258

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

SVN-Revision: 38277
2013-10-01 22:41:46 +00:00
Hauke Mehrtens
c57ac5fcb7 kernel: add industrialio-triggered-buffer.ko only when the config option is selected.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

SVN-Revision: 38276
2013-10-01 22:40:32 +00:00
Hauke Mehrtens
1158f22b02 ep93xx: fix sound dependencies for ep93xx
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

SVN-Revision: 38274
2013-10-01 22:38:40 +00:00
Steven Barth
1d485c737e netifd: don't remove & readd addresses that only have a changed lifetime
SVN-Revision: 38269
2013-10-01 17:30:05 +00:00
Jo-Philipp Wich
2a2d408024 procd: fix incorrect use of sizeof() in vsnprintf()
SVN-Revision: 38268
2013-10-01 14:41:07 +00:00
John Crispin
52b61d6325 procd: update to latest git head
this fixes the syslog problem when using eglibc on x86.

Signed-off-by: John Crispin <blogic@openwrt.org>

SVN-Revision: 38267
2013-09-30 20:48:51 +00:00
John Crispin
391ec155a0 kernel: lib-textsearch needs to be auto probed for amanda nat to work
https://dev.openwrt.org/ticket/14232

Signed-off-by: John Crispin <blogic@openwrt.org>

SVN-Revision: 38262
2013-09-30 20:48:12 +00:00
Felix Fietkau
17be4e9d14 mac80211: add AP inactivity handling / probing fixes to improve stability
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38257
2013-09-29 19:42:00 +00:00
Felix Fietkau
f07713f7cf mac80211: really fix the long standing wds ap tx power regression (#14153)
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38255
2013-09-29 12:53:21 +00:00
Jo-Philipp Wich
a94b5fbd5c rpcd: fix missing option removal when merging subsequent uci set calls
SVN-Revision: 38254
2013-09-29 11:53:25 +00:00
Jo-Philipp Wich
d11315e7c6 ubus: restrict unix domain socket permission to 0600 to disallow non-root connections
SVN-Revision: 38253
2013-09-29 11:53:20 +00:00
Jo-Philipp Wich
feab77f58e ubox: support alternative spellings for modinfo and rmmod
After this change, "rmmod" and "modinfo" works even if the user gives
the file name spelling instead of the kernel internal one, so that e.g.
"rmmod nls_iso8859-1.ko" and "rmmod nls_iso8859_1" will both succeed.

SVN-Revision: 38252
2013-09-29 11:53:17 +00:00
Jo-Philipp Wich
2ff6d48319 uci: change uci_ptr checking order in uci_delete()
SVN-Revision: 38251
2013-09-29 11:53:10 +00:00
Felix Fietkau
f8ee248701 uhttpd: add a config option for using ustream-polarssl, and use it by default
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38250
2013-09-29 11:26:09 +00:00
Felix Fietkau
2beabf6c11 ath9k: fix an AP mode powersave issue with aggregation
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38249
2013-09-29 11:07:58 +00:00
Jo-Philipp Wich
d8c154a29d ubox: fix kmod loading for modules with varying dashes & underscores in names (#14182, #14189)
Instead of canonicalizing module names in the internal avl tree simpyl use a
custom strcmp() variant for the avl tree key comparisation. The custom comperator
simply treats dashes and underscores the same, so "nls_iso8859-15" is equal to
"nls-iso8859-15".

This allows us to simplify the code considerably and makes manual "modprobe"
invocations more forgiving when looking up the given module name.

SVN-Revision: 38248
2013-09-28 13:12:42 +00:00
Felix Fietkau
32d54de3b9 kernel: disable kmod-iio for linux 3.6 as well (to avoid build issues due to missing config symbol changes)
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38247
2013-09-28 05:22:05 +00:00
Felix Fietkau
e2420239ae kernel: exclude regmap-spi.ko if SPI support cannot be selected
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38245
2013-09-27 21:12:15 +00:00
Felix Fietkau
1f037b5248 kernel: make sound-soc-core depend on kmod-ac97
it has a conditional #ifdef based dependency on it, which trips up on
some targets

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38242
2013-09-27 21:12:04 +00:00
Felix Fietkau
3c045e9933 kernel: remove old kernel compat code for pcmcia
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38239
2013-09-27 20:47:09 +00:00
Felix Fietkau
e232a92c08 kernel: mark kmod-thermal menuconfig symbol as hidden to avoid building it on targets with no thermal drivers
Should fix build errors with Linux 3.3/3.6 targets, which use different
kconfig symbols

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38238
2013-09-27 20:44:11 +00:00
Luka Perkov
eb486aadb8 kernel: add thermal modules
Signed-off-by: Luka Perkov <luka@openwrt.org>

SVN-Revision: 38230
2013-09-27 10:49:33 +00:00
Steven Barth
2d5448afb5 opkg: add build variant with signature support
SVN-Revision: 38220
2013-09-26 19:51:03 +00:00