Commit graph

611 commits

Author SHA1 Message Date
Felix Fietkau
603c532eed hostapd: fix maclist processing with netifd
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38991
2013-12-03 09:02:58 +00:00
Felix Fietkau
3c50feca19 wifi: rename the "reload" (restarting non-netifd wifi) command to "reload_legacy"
Add a new "reload" command that reloads the netifd config as well

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38989
2013-12-02 16:53:24 +00:00
Felix Fietkau
498d84fc4e netifd: add wireless configuration support and port mac80211 to the new framework
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38988
2013-12-02 16:41:03 +00:00
Felix Fietkau
a26242cb63 hostapd: change the wildcard for the hostapd control socket directory
prepare for using /var/run/hostapd instead of /var/run/hostapd-phy*

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38986
2013-12-02 13:08:14 +00:00
Felix Fietkau
9381eaccb3 wpa_supplicant: clean up hostapd control socket on exit to fix socket leak in ap+sta mode on wifi restarts
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38985
2013-12-02 13:08:11 +00:00
Felix Fietkau
6960ae4e65 hostapd: fix os_daemonize vs starting process race by creating the pid file in the parent
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38984
2013-12-02 13:08:08 +00:00
Felix Fietkau
107bcb5de3 netifd: remove redundant calls to /sbin/wifi down
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38982
2013-12-02 13:08:00 +00:00
Felix Fietkau
5022b3949a hostapd: always include p2p options in wpa_cli
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38981
2013-12-02 13:07:46 +00:00
Felix Fietkau
15b4975925 hostapd: add support for auto-channel selection
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38915
2013-11-25 15:43:30 +00:00
Felix Fietkau
1d75f7506d hostapd: update to version 2013-11-20
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38914
2013-11-25 15:43:15 +00:00
John Crispin
cba772f5bc pppd: Place plugin-specific options after plugin name.
Before this patch, if we specify a plugin specific option through
`pppd_options` in /etc/config/network, e.g. `rp_pppoe_verbose 1`, pppd
would quit with the following error in log.

    Wed Oct  9 09:42:58 2013 daemon.notice netifd: GORG (1689): /usr/sbin/pppd: unrecognized option 'rp_pppoe_verbose'
    Wed Oct  9 09:42:58 2013 daemon.err pppd[1689]: unrecognized option 'rp_pppoe_verbose'
    Wed Oct  9 09:42:58 2013 daemon.notice netifd: GORG (1689): pppd version 2.4.5
    Wed Oct  9 09:42:58 2013 daemon.notice netifd: GORG (1689): Usage: /usr/sbin/pppd [ options ], where options are:

This is due to the requirement that function add_option() should be
called by the plugin_init() function first before pppd can parse those
options.

Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>

SVN-Revision: 38911
2013-11-25 14:09:16 +00:00
Felix Fietkau
5143157af8 uhttpd: update to the latest version, fixes crashes in the ubus plugin
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38888
2013-11-21 21:52:24 +00:00
Felix Fietkau
cd1c8d463f hostapd: remove random pool support - the entropy it gathers is questionable and we have better entropy sources on common platforms now
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38852
2013-11-18 13:54:26 +00:00
Jo-Philipp Wich
bc9043cc53 firewall: optimize DNAT rules and skip invalid rules and redirects (#14485)
- instead of writing one (or more) ACCEPT rules in the filter table
	  for each redirect install a global ctstate DNAT accept rule per zone

	- discard rules and redirects which have invalid options set instead
	  of silently skipping the invalid values

SVN-Revision: 38849
2013-11-18 11:59:27 +00:00
Steven Barth
b5a4fb1c95 6rd: Clear correct IPv6 address bits in 6rdcalc
The correct bits are now cleared in the IPv6 address as the shift
value to the correct byte in the IPv6 address was wrong. Depending
on the stack values this could result in a hanging 6rdcalc program
due to an endless loop.

Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>

SVN-Revision: 38818
2013-11-16 09:18:14 +00:00
John Crispin
a9cfb4b827 procd: fixup 2 wrong option types
Signed-off-by: John Crispin <blogic@openwrt.org>

SVN-Revision: 38789
2013-11-13 11:07:24 +00:00
John Crispin
1f93857092 procd: convert services to the new validation api
Signed-off-by: John Crispin <blogic@openwrt.org>

SVN-Revision: 38787
2013-11-13 10:49:41 +00:00
Felix Fietkau
37756a97a0 hostapd: remove #ifdef MULTICALL around ap+sta support code (to support separately installed supplicant+hostapd)
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38782
2013-11-12 22:11:14 +00:00
Jo-Philipp Wich
7ad5350dfb Add patch to fix ipset timeout setting problem
Fixes #14325

Signed-off-by: Nikolay Martynov <mar.kolya@gmail.com>

SVN-Revision: 38779
2013-11-12 11:01:11 +00:00
Jo-Philipp Wich
c9bc0e12a9 Update ipset to version 6.20.1
Signed-off-by: Nikolay Martynov <mar.kolya@gmail.com>

SVN-Revision: 38778
2013-11-12 11:00:49 +00:00
Hauke Mehrtens
20d64e929f iwinfo: don't report associations for broadcom wds interfaces
The associations list for Broadcom WDS interfaces are duplicate to those
reported by the corresponding AP interface; so there is no need to report
them again.

Signed-off-by: Nathan Hintz <nlhintz@hotmail.com>

SVN-Revision: 38746
2013-11-11 21:54:55 +00:00
Hauke Mehrtens
e3a5401fb2 iwinfo: fix hwmodelist reporting for broadcom wl
Modify the hwmodelist reporting for broadcom devices to include
proper reporting of 802.11n support.

Signed-off-by: Nathan Hintz <nlhintz@hotmail.com>

SVN-Revision: 38745
2013-11-11 21:54:25 +00:00
Jo-Philipp Wich
8a1d77efed uhttpd: return after processing -d switch, only set ubus prefix if not already defined
SVN-Revision: 38743
2013-11-11 19:14:01 +00:00
John Crispin
989783255e uhttp: add ubus.default
Signed-off-by: John Crispin <blogic@openwrt.org>

SVN-Revision: 38741
2013-11-11 18:12:26 +00:00
John Crispin
f48568af8e pppd: don't call modprobe at all from pppoatm
Signed-off-by: John Crispin <blogic@openwrt.org>

SVN-Revision: 38737
2013-11-11 13:40:28 +00:00
John Crispin
3cc0f479dc uhttp: make the service auto respawn if it crashes
Signed-off-by: John Crispin <blogic@openwrt.org>

SVN-Revision: 38724
2013-11-11 12:19:02 +00:00
John Crispin
9f3b161a57 uhttp: make sure that the ubus module is loaded when when installed
Signed-off-by: John Crispin <blogic@openwrt.org>

SVN-Revision: 38723
2013-11-11 12:18:58 +00:00
Felix Fietkau
e78e720a6f netifd: remove connect_time from /var/state, it is unused
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38704
2013-11-10 10:01:33 +00:00
John Crispin
edf6236838 lantiq: fix vdsl-app dependency
Signed-off-by: John Crispin <blogic@openwrt.org>

SVN-Revision: 38666
2013-11-07 12:45:39 +00:00
Jo-Philipp Wich
5db9587b5f dnsmasq: fix backward compatibility with existing configs
Changeset r36943 ("dnsmasq: use host-record instead of address") removed
the automatic domain expansion for config domain sections, this breaks
existing setups and alters the old behaviour in unexpected ways, therfore
restore behaviour of the current stable release.

Additionally handle fully qualified hostnames properly when setting up the
own hostrecord by stripping the local domain part form the given name
instead of unconditionally appending it, so that "example.lan" results
in "example example.lan" and not "example.lan example.lan.lan".

SVN-Revision: 38648
2013-11-04 22:40:56 +00:00
Felix Fietkau
2c84ff42f7 openvpn: clean up and fix the init script
- clean up duplication of procd instance handling code
- using --cd *after* --config is rather pointless
- to be able to log errors properly, --syslog needs to be passed before --config
- tell procd about the generated or referenced config file instead of
  the uci file. this avoids having to restart all instances if only one
  of them changes.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38632
2013-10-31 17:36:24 +00:00
Felix Fietkau
e16f104a6f netifd: update to the latest version, fixes regression in proto-shell scripts (#14400, #14402)
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38627
2013-10-31 11:22:01 +00:00
Felix Fietkau
22890e6382 netifd: update to latest version, adds fixes and some preparation for supporting wifi devices
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38606
2013-10-30 11:25:01 +00:00
Steven Barth
dfa9ca772b odhcp6c: Multiple improvements and fixes
* Various RFC compliance fixes (thanks to Hans Dedecker)
* Fix RA spam filter logic causing ipv6 connection issues
* Fix parameters -F and -P being order dependent

SVN-Revision: 38577
2013-10-29 13:23:28 +00:00
Steven Barth
d8d0e2c536 odhcp6c: filter similar RAs spammed by some ISPs
SVN-Revision: 38505
2013-10-23 10:31:06 +00:00
Steven Barth
bb699867e0 firewall: Improve ubus support
* Use network.interface dump call instead of individual status calls
  to reduce overall netifd lookups and invokes to 1 per fw3 process.

* Allow protocol handlers to assign a firewall zone for an interface
  in the data section to allow for dynamic firewall zone assignment.

SVN-Revision: 38504
2013-10-23 10:25:26 +00:00
Steven Barth
a54f104701 odhcpd: fix cleaning of configuration on reload
SVN-Revision: 38503
2013-10-23 09:30:28 +00:00
Steven Barth
1ff15bfe83 6relayd: reduce fallout of RA spamming a bit
SVN-Revision: 38488
2013-10-21 10:26:57 +00:00
Steven Barth
91b173d231 netifd: Fix ifupdate events
SVN-Revision: 38458
2013-10-19 11:01:25 +00:00
Steven Barth
579e2df8c5 odhcpd: various bugfixes
SVN-Revision: 38454
2013-10-18 13:39:48 +00:00
Steven Barth
c3bcdd59de netifd: various improvements
* Add ubus methods for global interface status
* Add ubus function to create nested interfaces
* Add protocol update notifications and hotplug legacy calls
* Fix: key to data elements point at wrong memory area
* Add support for source-restricted routes
* Add option "delegate" to toggle prefix delegation
* Reevaluate target routes also on interface update

SVN-Revision: 38453
2013-10-18 13:39:43 +00:00
Jo-Philipp Wich
4f1e282238 wpa_supplicant: fix beacon_int configuration option
wpa_supplicant expects beacon_int instead of beacon_interval in its config
file.

Signed-off-by: Bruno Randolf <br1@einfach.org>

SVN-Revision: 38451
2013-10-18 11:47:47 +00:00
Jo-Philipp Wich
6da1c9d3ea iw: add patch to support 802.11j frequencies
A similar change was recently merged in iw commit
58b46da26ab9b5ff31c7033e175351eb1301d9af

Signed-off-by: Bruno Randolf <br1@einfach.org>

SVN-Revision: 38449
2013-10-18 11:43:02 +00:00
Jo-Philipp Wich
c8e0c28c15 iwinfo: make 'type' visible in wrapped iwinfo
There are several cases within 'luci' that attempt to access the interface
'type' from within the 'type' specific meta tables; however, 'type' is not
currently available there.  Replicate the common metadata in the 'type'
specific meta tables.

Signed-off-by: Nathan Hintz <nlhintz@hotmail.com>

SVN-Revision: 38448
2013-10-18 11:42:43 +00:00
Steven Barth
56bc536713 netifd: rename customopts to sendopts for consistency
SVN-Revision: 38437
2013-10-17 13:12:06 +00:00
Steven Barth
c759b49a4f Added 'customopts' dhcp protocol option, which is an array passed along to udhcpc as series of -x options.
Signed-off-by: Markus Stenberg <markus.stenberg@iki.fi>

SVN-Revision: 38436
2013-10-17 12:55:40 +00:00
Steven Barth
7e13c80b3d odhcp6c: fix parsing of IA_PD adverts
SVN-Revision: 38433
2013-10-17 07:19:32 +00:00
Steven Barth
76dfe21a27 odhcpd: add new experimental dhcp-server
SVN-Revision: 38428
2013-10-16 09:03:55 +00:00
Jo-Philipp Wich
fce216ac7e dropbear: add dropbear.nl mirror, provided by dropbear maintainer
Signed-off-by: Catalin Patulea <cat@vv.carleton.ca>

SVN-Revision: 38413
2013-10-15 13:10:32 +00:00
Luka Perkov
5dc102ce04 openvpn: make comp_lzo a parameter
Possible parameters are yes, no and adaptive. See manpage for more information.

Signed-off-by: Philipp Borgers <borgers@mi.fu-berlin.de>

SVN-Revision: 38412
2013-10-15 12:42:58 +00:00
Jo-Philipp Wich
eda0fc3c6c openvpn-easy-rsa: restore essential patch to make it actually work on the target (#14324)
SVN-Revision: 38411
2013-10-15 12:23:21 +00:00
Steven Barth
156ea733d4 odhcp6c: various fixes
* Make SOL_MAX_RT configurable and default back to 120s
* Prefer servers with bigger prefixes (allows to use Comcast /60)
* Don't hang indefinitely if DHCPv6 REQUEST is not answered

Signed-off-by: Steven Barth <steven@midlink.org>

SVN-Revision: 38393
2013-10-14 18:53:02 +00:00
Hauke Mehrtens
232a654833 iputils: do not compile this for brcm47xx with -O2
ping is now working for me with -Os on brcm47xx.
This revert r26278.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

SVN-Revision: 38389
2013-10-13 22:51:33 +00:00
Hauke Mehrtens
e1523b5504 switch: remove old switch driver
The switch driver is not used by brcm47xx any more and can be removed,
instead of this switch driver b53 is used now.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

SVN-Revision: 38387
2013-10-13 22:15:31 +00:00
Hauke Mehrtens
af32e63bae lantiq: add some missing PKG_SOURCE_URLs
These URLs where missing and causes build failures.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

SVN-Revision: 38376
2013-10-12 22:33:55 +00:00
Jo-Philipp Wich
78f69b66d4 dnsmasq: add option broadcast to host sections
There are certain consumer devices which are outliers in protocol conformance.
An example is Samsung bluray players, which require broadcast DHCP responses
(on Ethernet only, strangely not on Wifi).

By specifying:

config host
	...
	option broadcast 1

this will enable the response to be sent as an Ethernet broadcast and not as
a unicast.

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>

SVN-Revision: 38365
2013-10-11 18:33:15 +00:00
Jo-Philipp Wich
db3013852a firewall: small improvements in nat reflection
- do not insert duplicate rules when setting up reflection to a zone containing multiple interfaces
	- set up reflection for any protocol, not just TCP and UDP

SVN-Revision: 38361
2013-10-10 18:15:10 +00:00
Jo-Philipp Wich
5380fa27e9 ppp: correct module loaded check in proto_pptp_setup
proto_pptp_setup is responsible for loading the required modules to establish
a pptp connection to a foreign peer. The function checks whether all required
modules are already loaded, before actually loading them.

It seems that the filter being used to accomplish this, is not restrictive
enough in some cases. For instance when pptp nat helper modules are present on
a system, and already loaded before a pptp connection is enabled. Then the
search filter (possibly) returns the following for module=pptp, where actually
no matches are expected, resulting in the pptp.ko module not being loaded,
thereby failing to establish the pptp connection.

# module="pptp" ; grep "$module" /proc/modules
nf_nat_pptp 1312 0 - Live 0x86ce7000
nf_conntrack_pptp 3072 1 nf_nat_pptp, Live 0x86cb9000
nf_nat_proto_gre 784 1 nf_nat_pptp, Live 0x86cba000
nf_conntrack_proto_gre 2368 1 nf_conntrack_pptp, Live 0x86cbf000
nf_nat 9792 13 nf_nat_rtsp,nf_nat_tftp,nf_nat_sip,nf_nat_pptp,nf_nat_h323,nf_nat_proto_gre,nf_nat_amanda,nf_nat_irc,nf_nat_ftp,ipt_REDIRECT,ipt_NETMAP,ipt_MASQUERADE,iptable_nat, Live 0x86ca8000
nf_conntrack 37264 31 nf_nat_rtsp,nf_conntrack_rtsp,nf_nat_tftp,nf_conntrack_tftp,nf_nat_snmp_basic,nf_conntrack_snmp,nf_nat_sip,nf_conntrack_sip,nf_nat_pptp,nf_conntrack_pptp,nf_nat_h323,nf_conntrack_h323,nf_conntrack_proto_gre,nf_nat_amanda,nf_conntrack_amanda,nf_conntrack_broadcast,nf_nat_irc,nf_conntrack_irc,nf_nat_ftp,nf_conntrack_ftp,ipt_MASQUERADE,iptable_nat,nf_nat,xt_helper,xt_connmark,xt_connbytes,xt_conntrack,xt_CT,xt_NOTRACK,xt_state,nf_conntrack_ipv4, Live 0x86c90000

The search filter can be made more accurate/restrictive, by requiring the
occurance of the exact name of the module at the beginning of a line in
/proc/modules.

# module="pptp" ; grep "^$module " /proc/modules
pptp 13296 2 - Live 0x86e80000

Signed-off-by: Tijs Van Buggenhout <tvb@able.be>

SVN-Revision: 38358
2013-10-10 14:58:12 +00:00
Jo-Philipp Wich
61e83f9c29 dropbear: update to 2013.59 (released 4 october 2013)
- drop mirror www.mirrors.wiretapped.net (not working anymore)
- drop patch 300-ipv6_addr_port_split.patch, included upstream
- refresh patches
- various upstream changes: http://matt.ucc.asn.au/dropbear/CHANGES

Signed-off-by: Catalin Patulea <cat@vv.carleton.ca>

SVN-Revision: 38356
2013-10-10 14:42:05 +00:00
Luka Perkov
cdb871ac48 openvpn: rework initscript (fixes #14299)
Signed-off-by: Luka Perkov <luka@openwrt.org>

SVN-Revision: 38351
2013-10-09 11:25:09 +00:00
Felix Fietkau
ff40bc2db9 hostapd: recognize 8021x as an authentication mode
Currently, in order to configure the authentication daemon in
8021x mode, we need to set wireless.@wifi-iface[0].encryption="wpa"
Though it works it confuses folks as 8021x is using WEP
encryption and not WPA. Therefore the terminology itself is
confusing. This change adds 8021x as a recognized string for 8021x
authentication.

Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>

SVN-Revision: 38339
2013-10-08 11:09:52 +00:00
Felix Fietkau
9beaea6fc2 hostapd: add external registrar support
Setting wireless.@wifi-iface[N].ext_registrar=1 will enable UPNP
advertising and add an external registrar to the interface this vif
belongs to (br-lan if the vif is included in the LAN bridge). By
enabling this we append upnp_iface=xxx to the hostapd config file.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>

SVN-Revision: 38338
2013-10-08 11:09:48 +00:00
Felix Fietkau
246e9b449b hostapd: enable WPS2 support on hostapd-full.config
Enable CONFIG_WPS2 for hostapd. This is required to support
options like Virtual Push Button in WPS.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>

SVN-Revision: 38337
2013-10-08 11:09:44 +00:00
Felix Fietkau
bcbc9b1e89 hostapd: fix hostapd RSN preauthentication PMKSA caching
In 2009 OpenWrt's hostapd config added an "auth_cache" boolean
to be used to address a reported issue #12129 [0] on a forum [1].
The reported issue on the ticket is different that the one
described on the forum. The commit was r33359. This change broke
proper RSN preauthentication [2] [3] [4] expectations on hostapd's
configuration for WPA2 and this in turn disabled PMKSA caching and
Opportunistic Key Caching. This change:

  * Leaves the "auth_cache" to be used only for WPA networks for those
    looking to use this as a workaround to a reported issue but annotates
    a warning over its usage.

  * Separate "auth_cache" from WPA2 RSN preauthentication, leaving
    WPA2 RSN preauthentication to enabled only with "rsn_preauth" with
    the expected and recommended settings.

  * Adds a new WPA2 RSN preauthentication "rsn_preauth_testing" to
    be used when evaluating funcionality for WPA2 RSN preauthentication
    with the expected and recommended settings with the only difference
    so far with what should be enabled by default to disable Opportunistic
    Key Caching.

Disabling the PMKSA cache should mean the STA could not roam off and back
onto the AP that had PMKSA caching disabled and would require a full
authentication cycle. This fixes this for WPA2 networks with
RSN preauthentication enabled.

This change should be applied to AA as well as trunk.

  TL DR;

The issue described on the forum has to do with failure of a STA
being able to try to authenticate again with the AP if it failed
its first try. This may have been an issue with hostapd in 2009
but as per some tests I cannot reproduce this today on a WPA2
network.

The issue described on the ticket alludes to a security issue with the
design of using a Radius server to authenticate to an AP. The issue
vaguely alludes to the circumstances of zapping a user, deleting their
authentication credentials to log in to the network, and that if
RSN preauthentication is enabled with PMKSA caching that the user
that was zapped would still be able to authenticate.

Lets treat these as separate issues.

I cannot reproduce the first issue reported on the forums of not
being able to authenticate anymore on a WPA2 network.

The issue reported on the ticket modified WPA2 RSN preauthentication
by adding two fields to the hostapd configuration if auth_cache
was enabled:

  * disable_pmksa_caching=1
  * okc=0

The first one disables PMKSA authentication cache.
The second one disables Opportunistic Key Caching.

The issue reported on the ticket was fixed by implementing a workaround
in hostapd's configuration. Disabling PMKSA caching breaks proper use
of WPA2 RSN pre authentication. The usage of disable_pmksa_caching=1
prevents hostapd from adding PMKSA entries into its cache when a successful
802.1x authentication occurs. In practice RSN preauthentication would
trigger a STA to perform authentication with other APs on the same SSID,
it would then have its own supplicant PMKSA cache held. If a STA roams
between one AP to another no new authenitcation would need to be performed
as the new AP would already have authenticated the STA. The purpose of the
PMKSA cache on the AP side would be for the AP to use the same PMKID for
a STA when the STA roams off onto another BSSID and later comes back to it.

Disabling Opportunistic Key Caching could help the reported issue
as well but its not the correct place to address this. Opportunistic
Key Caching enables an AP with different interfaces to share the
PMKSA cache. Its a technical enhancement and disabling it would
be useful to let a testing suite properly test for RSN preauthentication
given that otherwise Opportunistic Key Caching would enable an
interface being tested to derive its own derive the PMKSA entry.
In production though okc=1 should be enabled to help with RSN
preauthentication.

The real fix for this particular issue outside of the scope of hostapd's
configuration and it should not be dealt with as a workaround to
its configuration and breaking expected RSN preauthentication and
technical optimizations. Revert this change and enable users to pick
and choose to enable or disable disable_pmksa_caching and okc expecting them
to instead have read clearly more what these do.

As for the core issure ported, the correct place to fix this is to
enable a sort of messaging between the RADIUS server and its peers
so that if caching for authentication is enabled that cache can be
cleared upon user credential updates. Updating a user password
(not just zapping a user) is another possible issue that would need
to be resolved here. Another part of the solution might be to reduce
the cache timing to account for any systematic limitations (RADIUS
server not able to ask peers to clear cache might be
one).

[0] https://dev.openwrt.org/changeset/33359
[1] https://forum.openwrt.org/viewtopic.php?id=19596
[2] http://wireless.kernel.org/en/users/Documentation/hostapd#IEEE_802.11i.2FRSN.2FWPA2_pre-authentication
[3] http://wireless.kernel.org/en/users/Documentation/wpa_supplicant#RSN_preauthentication
[4] http://wiki.openwrt.org/doc/recipes/rsn_preauthentication

Signed-off-by: Luis R. Rodriguez <mcgrof@do-not-panic.com>

SVN-Revision: 38336
2013-10-08 11:09:40 +00:00
Felix Fietkau
40aec9ed46 hostapd: Add WPS unconfigured & WPS pin method support
Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>

SVN-Revision: 38335
2013-10-08 11:09:36 +00:00
Felix Fietkau
4689bc8517 hostapd: Add eap_reauth_period config option
This adds the eap_reauth_period to be used for modifying
the RADIUS server reauthentication authentication period,
a parameter that gets passed directly to the hostapd
configuration file.

Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>

SVN-Revision: 38334
2013-10-08 11:09:27 +00:00
Luka Perkov
c5bd00d82a openvpn: switch to new procd init script style
Signed-off-by: Luka Perkov <luka@openwrt.org>

SVN-Revision: 38331
2013-10-07 21:28:14 +00:00
Steven Barth
6dbfe22601 odhcp6c: improve server selection, introduce "forceprefix" option
SVN-Revision: 38314
2013-10-07 08:43:33 +00:00
Luka Perkov
702936f4c9 iproute2: update to 3.11
Signed-off-by: Luka Perkov <luka@openwrt.org>

SVN-Revision: 38313
2013-10-07 08:26:41 +00:00
Felix Fietkau
e96695df10 netifd: update to latest version, adds macvlan support
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38299
2013-10-03 14:51:34 +00:00
Steven Barth
95e9c260bc odhcp6c: validate hop-limit on RAs
SVN-Revision: 38285
2013-10-02 14:16:05 +00:00
Steven Barth
0ad1d06c13 6relayd: remove compat ULA setting by default (too many bad sideeffects)
SVN-Revision: 38283
2013-10-02 06:14:39 +00:00
Steven Barth
1d485c737e netifd: don't remove & readd addresses that only have a changed lifetime
SVN-Revision: 38269
2013-10-01 17:30:05 +00:00
Felix Fietkau
f8ee248701 uhttpd: add a config option for using ustream-polarssl, and use it by default
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38250
2013-09-29 11:26:09 +00:00
Felix Fietkau
59c05778f0 uhttpd: fix appending https ports to cmdline
Otherwise it is started only on non-secure ports.

Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik@neratec.com>

SVN-Revision: 38171
2013-09-25 07:44:48 +00:00
Gabor Juhos
99d13b09b9 iwinfo: add Ubiquiti WispStation M5 to hardware.txt
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>

SVN-Revision: 38145
2013-09-24 05:58:29 +00:00
Luka Perkov
ef5f836207 fix various init scripts
Changes include:

* removing unused variables
* replacing spaces with tabs where appropriate
* more consistency with variable declarations

Signed-off-by: Luka Perkov <luka@openwrt.org>

SVN-Revision: 38142
2013-09-23 21:58:36 +00:00
Felix Fietkau
5137cdb1e1 xtables-addons: fix missing conversion from r38021 (resolves a broken dependency)
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 38124
2013-09-22 19:49:23 +00:00
Steven Barth
4894800bdd odhcp6c: handle NoAddrsAvail IA-status
SVN-Revision: 38092
2013-09-21 10:54:13 +00:00
Steven Barth
808a1c7808 odhcp6c: Restart when server returns IAID error
SVN-Revision: 38032
2013-09-18 10:27:15 +00:00
John Crispin
f874094402 procd: convert various packages to procd style init.d scripts
Signed-off-by: John Crispin <blogic@openwrt.org>

SVN-Revision: 38023
2013-09-17 21:45:30 +00:00
John Crispin
f12f4074af kernel: make most modules use AutoProbe
now that we have modprobe we can set more than half of the modules to AutoProbe

Signed-off-by: John Crispin <blogic@openwrt.org>

SVN-Revision: 38021
2013-09-17 21:45:17 +00:00
Felix Fietkau
b2447d1fca hostapd: adjust the md5sum for the uploaded source tarball (fixes #14155)
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 37990
2013-09-14 20:07:35 +00:00
Felix Fietkau
28eceb0343 iwinfo: when using nl80211, parse interface combinations instead of creating/deleting interfaces
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 37983
2013-09-14 14:46:51 +00:00
Jo-Philipp Wich
c3cc912ed9 uhttpd: udpat to git head
- fixes buffer corruption with JSON-RPC list calls
	- change JSON-RPC protocol to include the session ID into the call
	  attributes instead of passing it via the URL
	- forcibly pass effective session ID as "ubus_rpc_session" attribute
	  to called procedures
	- change ubus acl checking to conform with new ubus session namespace

SVN-Revision: 37962
2013-09-13 13:24:45 +00:00
Steven Barth
eba3ab9ade odhcp6c: Timing workaround for buggy servers
SVN-Revision: 37951
2013-09-12 12:57:42 +00:00
Steven Barth
b2a71fedd9 odhcp6c: more compatibility fixes
SVN-Revision: 37907
2013-09-05 21:13:51 +00:00
Steven Barth
0a85c59040 netfilter: Add IPv6-NAT support for kernel and ipt Thanks to Berni, Adam Novak and Sedat Dilek for patches and inspiration
SVN-Revision: 37866
2013-09-01 17:59:48 +00:00
Steven Barth
3e647ac9b6 iptables: Update to 1.4.20
SVN-Revision: 37865
2013-09-01 13:46:10 +00:00
Felix Fietkau
7fc90889d5 netifd: update to the latest version, fixes a bridge handling corner case on config reload
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 37856
2013-08-29 22:20:36 +00:00
Vasilis Tsiligiannis
03b1d4289b lldpd: Add libbsd dependency when using eglibc
Signed-off-by: Vasilis Tsiligiannis <acinonyx@openwrt.gr>

SVN-Revision: 37837
2013-08-25 18:47:08 +00:00
Jo-Philipp Wich
2864fb107f firewall: update to git head
- uses "-j CT --notrack" instead of deprecated "-j NOTRACK"
	- fixes support for rule sections with target "NOTRACK"

SVN-Revision: 37777
2013-08-14 15:40:38 +00:00
Felix Fietkau
4cda88a879 hostapd: fix typo in version number
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 37742
2013-08-08 20:45:15 +00:00
Felix Fietkau
9df75e7f34 hostapd: fix ubus reconnect handling
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 37741
2013-08-08 20:45:12 +00:00
Felix Fietkau
750197b3af hostapd: add a build variant for wpa_supplicant with p2p (aka Wi-Fi Direct) support
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 37739
2013-08-08 16:24:50 +00:00
Felix Fietkau
f53b96813e hostapd: update to latest version (20130707)
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 37738
2013-08-08 16:04:19 +00:00
Felix Fietkau
9a22315ca4 hostapd: Settings for DAE/CoA server
hostapd supports "Dynamic Authorization Extensions", making it possible
to forcibly disconnect a user by sending it a RADIUS "Disconnect-Request"
packet.

I've added three new variables to enable setting of the
"radius_das_client" and "radius_das_port" variables in the hostapd
configuration, which enable these extensions.

* dae_client - IP of the client that can send disconnect requests
* dae_secret - shared secret for DAE packets

These are combined into the "radius_das_client" option in hostapd.conf
To enable the server, both dae_client and dae_secret must be set.

* dae_port - optional, default value is 3799 as specified in RFC 5176

Signed-off-by: Martijn van de Streek <martijn@vandestreek.net>

SVN-Revision: 37734
2013-08-06 18:55:30 +00:00
Felix Fietkau
91f0b411f4 hostapd: Fix WDS/WEP usage
WEP in WDS is currently broken in hostapd. Add a patch
to fix the issue.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>

SVN-Revision: 37733
2013-08-06 17:59:12 +00:00
Felix Fietkau
76ca564e79 hostapd: Refresh patches
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>

SVN-Revision: 37731
2013-08-06 17:59:05 +00:00
Felix Fietkau
22e012bad8 hostapd: Add an option to disable beaconing
Add a patch for hostapd that introduces a config option
"start_disabled" which can be used to bring up an AP
interface with beaconing disabled. This is useful in
a Repeater-AP setup where the Repeater AP has to start
beaconing only after the WDS link has been established.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>

SVN-Revision: 37730
2013-08-06 17:59:02 +00:00
Felix Fietkau
719adb6471 uhttpd: update to the latest version, fixes a crash on early cgi/lua process termination
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 37628
2013-07-31 22:07:09 +00:00
Luka Perkov
1646bd096c iproute2: update to 3.10.0
Signed-off-by: Luka Perkov <luka@openwrt.org>

SVN-Revision: 37590
2013-07-28 23:27:35 +00:00
Felix Fietkau
aff8c18ad0 openvpn: update to 2.3.2
this patches updates openvpn to v2.3.2
and adds a PKG_MD5SUM to the Makefile

This release fixes a memory access violation when cipher none is used
on ar71xx - at least with my config

Signed-off-by: Peter Wagner <tripolar@gmx.at>

SVN-Revision: 37560
2013-07-26 12:35:22 +00:00
Steven Barth
4d37ae33b6 6relayd: Overridden DNS should affect DHCPv6
SVN-Revision: 37558
2013-07-26 11:59:25 +00:00
Felix Fietkau
8faa8a6420 uhttpd: update to latest version, fixes issues with POST and keep-alive (#13940)
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 37556
2013-07-26 10:03:07 +00:00
Felix Fietkau
3d2ace5d71 authsae: add myself as a maintainer
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 37555
2013-07-26 10:03:03 +00:00
Felix Fietkau
4478c69b86 authsae: adapt uci scripts to use authsae
This patch modifies the uci scripts to be able to
start meshd-nl80211 for encrypted mesh networks,
therefor a new script (authsae.sh) is inserted.

Signed-off-by: Emanuel Taube <emanuel.taube@gmail.com>
[etienne.champetier@free.fr: just update mac80211.sh path]
Signed-off-by: Etienne CHAMPETIER <etienne.champetier@free.fr>

SVN-Revision: 37554
2013-07-26 10:02:59 +00:00
Felix Fietkau
6dbea6416b authsae 80211s authentication daemon
This patch adds authsae open80211s authentication daemon (http://open80211s.org)
It's a rework of Peter Naulls patch (http://patchwork.openwrt.org/patch/1350/)
I've excluded the sample conf file as it's useless when used with mac80211.sh (Emanuel Taube patch)
It now link against libnl-tiny instead of libnl (patch merged in authsae git)
Authsae is 58 Ko (OPENSSL_WITH_EC option adds 35Ko to libopenssl)

Signed-off-by: Peter Naulls <peter@chocky.org>
Signed-off-by: Etienne CHAMPETIER <etienne.champetier@free.fr>

SVN-Revision: 37553
2013-07-26 10:02:55 +00:00
Felix Fietkau
85e585ddce ead: fix compile errors with recent kernels
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 37482
2013-07-20 12:56:07 +00:00
Hauke Mehrtens
96f1953fb1 kernel: fix xtables-addons dependencies with kernel 3.3
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

SVN-Revision: 37461
2013-07-19 22:36:47 +00:00
Jo-Philipp Wich
7bbe1656cb xtables-addons: use a select of kmod-ipt-core instead of depending on it
SVN-Revision: 37425
2013-07-19 09:58:17 +00:00
Jo-Philipp Wich
d474a77edf xtables-addons: add missing kmod dependencies
SVN-Revision: 37424
2013-07-19 09:58:11 +00:00
Jo-Philipp Wich
d6e8047f83 firewall: update to git head
- handles redirects as port relocations if the dest_ip points to the router itself

SVN-Revision: 37374
2013-07-16 14:04:59 +00:00
Steven Barth
54ae5ce507 netifd: Fix IPv6-prefix assignment with continuous hints
SVN-Revision: 37371
2013-07-16 12:07:11 +00:00
Steven Barth
6a034ce5b1 6relayd: Fix DHCPv6-PD with continuous hints
SVN-Revision: 37370
2013-07-16 12:07:06 +00:00
Steven Barth
0444e32acd Bump iptables version
SVN-Revision: 37329
2013-07-15 06:12:07 +00:00
Steven Barth
ea6a5d0c22 iptables: restore reap functionality to recent module
The reap functionality appears to have been accidentally disabled by
commit 74ded7257e5da5e309844d386290f24ae91950a6 to iptables.git, see:

  git://git.netfilter.org/iptables.git

and subsequently in iptables 1.4.15 and later.  This adds a patch to
restore reap functionality for recent_opts_v1.

Signed-off-by: Russell Senior <russell@personaltelco.net>

SVN-Revision: 37328
2013-07-15 06:12:03 +00:00
Luka Perkov
1a963355b0 netifd: update to latest version, add bridge_empty option
with this option enabled it's possible to create empty bridges

Signed-off-by: Luka Perkov <luka@openwrt.org>

SVN-Revision: 37318
2013-07-14 18:50:04 +00:00
John Crispin
7d7c2ff5f9 swconfig: fix dependency bug introduced by [37304]
Signed-off-by: John Crispin <blogic@openwrt.org>

SVN-Revision: 37316
2013-07-14 18:16:42 +00:00
Hauke Mehrtens
f8d55e7541 brcm47xx: use b53 phy driver for the switch in kernel 3.10
This makes it possible to use swconfig to controll the switch.

This was tested with devices using b43 and bgmac.
This was not tested on devices using tg3.
This does not support the adm switch used in some very old devices.

SVN-Revision: 37304
2013-07-14 14:11:17 +00:00
John Crispin
8d546699c5 dropbear: register a config.change trigger
Signed-off-by: John Crispin <blogic@openwrt.org>

SVN-Revision: 37245
2013-07-11 17:00:40 +00:00
Felix Fietkau
4e042e4a84 ipset: force the shell to bash to fix build issues on mac os x
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 37227
2013-07-10 14:59:00 +00:00
Felix Fietkau
4a0c312dc3 xtables-addons: update to version 2.3, adds linux 3.10 compatibility
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 37226
2013-07-10 14:51:13 +00:00
Felix Fietkau
f98f69adc9 firewall: add missing dependencies
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 37224
2013-07-10 11:33:48 +00:00
John Crispin
fc40051569 lantiq: move dsl tools to package/network/config
Signed-off-by: John Crispin <blogic@openwrt.org>

SVN-Revision: 37198
2013-07-08 09:01:38 +00:00
Luka Perkov
4a7439401b linux-atm: fix dependencies
Signed-off-by: Luka Perkov <luka@openwrt.org>

SVN-Revision: 37189
2013-07-08 00:37:49 +00:00
Jo-Philipp Wich
4aa82d07a6 firewall: allow routed lan<->lan traffic by default
SVN-Revision: 37171
2013-07-04 18:10:36 +00:00
Jo-Philipp Wich
2561bce232 lldpd: upgrade to 0.7.5
lldpd 0.7.1 has several alignment issues that trip a system configured
to fault on misaligned accesses.  Version 0.7.5 fixes that along with a
few other minor issues.

Signed-off-by: John Szakmeister <john@szakmeister.net>

SVN-Revision: 37168
2013-07-04 16:57:03 +00:00
Steven Barth
e3a369e597 odhcp6c: avoid integer overflows in resend logic
SVN-Revision: 37150
2013-07-03 16:14:24 +00:00
Steven Barth
b9aa47d5b6 odhcp6c: add missing config parameter
SVN-Revision: 37148
2013-07-03 13:50:06 +00:00
Jo-Philipp Wich
7c197d9f0e hostapd: truncate default mac file before adding entries to it (#13797)
SVN-Revision: 37114
2013-07-01 10:52:35 +00:00
Felix Fietkau
ee68734929 hostapd: fix multi-ssid and AP+STA, clean up code
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 37111
2013-06-30 21:01:13 +00:00
Felix Fietkau
60b040bbaf hostapd: update to latest git version
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 37110
2013-06-30 20:27:38 +00:00
Felix Fietkau
12c033dfd9 mac80211: update to wireless-testing 2013-06-27, fix ATH_USER_REGD handling
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 37097
2013-06-30 10:44:19 +00:00
Jo-Philipp Wich
2d506f46fb firewall: update to git head
- uses custom formatting for mac addresses to ensure leading zeroes, required for older iptables mac match parser

SVN-Revision: 37082
2013-06-29 13:28:27 +00:00
Steven Barth
d8051a8814 netifd: fix typo in dhcp script
SVN-Revision: 37051
2013-06-28 04:19:21 +00:00
Florian Fainelli
fe7c236a06 6relayd: prevent build on AVR32
AVR32 misses a bunch of updated syscalls, including timerfd_create()
which is used by 6relayd. Since that requires Linux/libc changes, just
prevent building it for now.

Signed-off-by: Florian Fainelli <florian@openwrt.org>

SVN-Revision: 37040
2013-06-27 15:33:05 +00:00
Steven Barth
cb66ed972b odhcp6c: Add missing config option "ifaceid"
SVN-Revision: 37033
2013-06-25 05:18:20 +00:00
John Crispin
e7dbdad43b hostapd: fix superflous coma
this cause the wps trigegr to be copied to the wrong place

https://dev.openwrt.org/ticket/13753

Signed-off-by: John Crispin <blogic@openwrt.org>

SVN-Revision: 37031
2013-06-24 16:44:18 +00:00
Steven Barth
eecce5abad arptables: Bump to 0.0.4
SVN-Revision: 37020
2013-06-24 05:48:12 +00:00
Steven Barth
69cd09ebbf 6relayd: don't accidentally remove regular prefix routes
SVN-Revision: 37018
2013-06-23 16:26:09 +00:00
Steven Barth
f47c4c80d4 6relayd: fix lease-update behaviour for clients without reconfigure
SVN-Revision: 37011
2013-06-22 08:31:28 +00:00
Steven Barth
d0d5f109d8 6relayd: Keep PD-downstream across RENEW/REBIND
SVN-Revision: 37009
2013-06-22 08:19:25 +00:00
John Crispin
4ebf19b48f packages: clean up the package folder
Signed-off-by: John Crispin <blogic@openwrt.org>

SVN-Revision: 37007
2013-06-21 16:54:37 +00:00
John Crispin
4999ae4236 hostapd: remove old button hotplug script
Signed-off-by: John Crispin <blogic@openwrt.org>

SVN-Revision: 36991
2013-06-21 16:53:07 +00:00
Steven Barth
5108318edb 6relayd: Fix DHCPv6-PD assignment logic
SVN-Revision: 36980
2013-06-21 06:15:09 +00:00
Steven Barth
de2a7547b7 6relayd: correctly set downstream routes for DHCPv6-PD
SVN-Revision: 36969
2013-06-19 13:08:33 +00:00
Felix Fietkau
b4babf9f81 netifd: update to latest version, fixes a NULL pointer deref bug
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 36965
2013-06-18 16:24:48 +00:00
Jo-Philipp Wich
65f82e2311 firewall: update to git head
- fixes misprocessing of unknown symbolic protocol names

SVN-Revision: 36963
2013-06-18 14:30:51 +00:00
Jo-Philipp Wich
37ae268729 firewall: update to git head
- fixes calculation of IPv4 netmasks derived from 0.0.0.0/0 CIDRs

SVN-Revision: 36960
2013-06-18 14:14:35 +00:00