Commit Graph

219 Commits

Author SHA1 Message Date
Beginner
0baa3ca219
uhttpd: update to latest Git HEAD (#8832)
* uhttpd: make organization (O=) of the cert configurable via uci

Make the organization (O=) of the cert configurable via uci. If not
configured, use a combination of "OpenWrt" and an unique id like it was
done before.

Signed-off-by: Martin Schiller <ms@dev.tdt.de>

* uhttpd: add config option for json_script

Add a config option for json_script instead of unconditionally including
all json files in /etc/uhttpd in every uhttpd instance. This makes it
possible to configure a single instance with an unconditional redirect,
which currently renders all other uhttpd instances unusable.

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Acked-by: Felix Fietkau <nbd@nbd.name>

* uhttpd: update to latest Git HEAD

2f8b136 main: fix leaking -p/-s argument values
881fd3b ucode: adjust to latest ucode api
8b2868e file: specify UTF-8 as charset for dirlists, add option to override
3a5bd84 main: add ucode options to help text
16aa142 examples: add ucode handler example
3ceccd0 ucode: add ucode plugin support
f0f1406 examples: add example Lua handler script
9e87095 listen: avoid invalid memory access

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

Co-authored-by: Martin Schiller <ms@dev.tdt.de>
Co-authored-by: Stijn Tintel <stijn@linux-ipv6.be>
Co-authored-by: Jo-Philipp Wich <jo@mein.io>
2022-02-08 12:32:05 +08:00
Beginner
308842ef19
shellsync: cleanup package (#8812)
Co-authored-by: AmadeusGhost <42570690+AmadeusGhost@users.noreply.github.com>
2022-02-02 12:01:01 +08:00
Beginner
238eb30fa0
dnsmasq: fix ismounted check (#8300)
Fix the return value, shell return codes should be 0 to indicate success
(i.e. mount point found), 1 should be failure (i.e. mount point not-found).

Fixes: ac4e8aa ("dnsmasq: fix more dnsmasq jail issues")
Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

Co-authored-by: Oldřich Jedlička <oldium.pro@gmail.com>
2021-11-24 14:37:04 +08:00
Rosy Song
3b9dc892cb ppp: don't start ppp with IPv6 support if ipv6 is not supported
Fixes: #8286

Signed-off-by: Rosy Song <rosysong@rosinson.com>
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
2021-11-24 14:03:24 +08:00
lean
e3fdf4d8f6 ppp: bump to 2.4.9 2021-11-16 18:05:30 +08:00
Beginner
9e8387f5bb
dnsmasq: sync upstream (#8245)
* dnsmasq: add ubus acl to allow calls to hotplug.tftp object

dnsmasq may call hotplug.dhcp, hotplug.neigh and hotplug.tftp.
Only the first two callees were listed in the ACL, so add missing
hotplug.tftp.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

* dnsmasq: fix the dynamic dns object names patch

We can't use booleans, since we're not including stdbool.h. Use integers
instead.

Fixes: 0b79e7c01e ("dnsmasq: generate the dns object name dynamically")

Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>

Co-authored-by: Daniel Golle <daniel@makrotopia.org>
Co-authored-by: Rui Salvaterra <rsalvaterra@gmail.com>
2021-11-16 16:19:06 +08:00
Beginner
ed74889e7e
dnsmasq: generate the dns object name dynamically (#8227)
Fixes an issue with running multiple dnsmasq instances

Signed-off-by: Felix Fietkau <nbd@nbd.name>

Co-authored-by: Felix Fietkau <nbd@nbd.name>
2021-11-11 09:22:18 +08:00
Beginner
38162e62b3
dnsmasq: sync upstream (#8212)
* dnsmasq: add support for monitoring and modifying dns lookup results via ubus

The monitoring functionality will be used for dns rule support in qosify

Signed-off-by: Felix Fietkau <nbd@nbd.name>

* dnsmasq: add match_tag for --dhcp-host

A set of tags can be specified for --dhcp-host option to restrict the
assignment to the requests which match all the tags.

Example usage:

config vendorclass
        option networkid 'udhcp'
        option vendorclass 'udhcp'

config host
        option mac '*:*:*:*:*:*'
        list match_tag 'switch.10'
        list match_tag 'udhcp'
        option ip '192.168.25.10'

Signed-off-by: Paul Fertser <fercerpav@gmail.com>

Co-authored-by: Felix Fietkau <nbd@nbd.name>
Co-authored-by: Paul Fertser <fercerpav@gmail.com>
2021-11-10 15:42:48 +08:00
Beginner
20c5ace4e4
dnsmasq: fix jail mount in case of ignore_hosts_dir being set (#8164)
Commit a2fcd3900c ("dnsmasq: improve init script") broke the existing
handling for hosts_dir. Remove the redundant mount again to fix it.

Reported-by: Hartmut Birr <e9hack@gmail.com>
Fixes: a2fcd3900c ("dnsmasq: improve init script")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>

Co-authored-by: Daniel Golle <daniel@makrotopia.org>
2021-11-02 19:39:12 +08:00
Beginner
163eff7fa9
hostapd: avoid unnecessary package rebuilds (#8162)
Package hostapd-common is a dependency of every other package defined in
hostpad Makefile.  It is currently built next to the bottom of that
Makefile's package list.

If you run make back to back, then check-compile will compare the
hostapd-common timestamp to the variant being compiled, to decide if the
varint needs to be rebuilt or not.  Since the hostapd-conf package is
built towards the end of the list, it will be newer than most of the
variants, causing unnecessary package rebuilds.

Move it to the top, so that its timestamp will be older than dependent
packages, avoiding unnecessary rebuild of every selected variant.

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>

Co-authored-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
2021-11-02 19:38:59 +08:00
Beginner
4b32d3505c
dnsmasq: improve init script (#8153)
* fix restart in LuCI (inherited umask was to restrictive)
 * make directory of hosts-file (!= /tmp) accessible in ujail

Reported-by: Hannu Nyman <hannu.nyman@iki.fi>
Signed-off-by: Daniel Golle <daniel@makrotopia.org>

Co-authored-by: Daniel Golle <daniel@makrotopia.org>
2021-11-01 15:29:44 +08:00
Beginner
f100ebf845
hostapd: sync upstream (#8101)
* hostapd: fix a race condition on adding AP mode wds sta interfaces

Both hostapd and netifd attempt to add a VLAN device to a bridge.
Depending on which one wins the race, bridge vlan settings might be incomplete,
or hostapd might run into an error and refuse to service the client.
Fix this by preventing hostapd from adding interfaces to the bridge and
instead rely entirely on netifd handling this properly

Signed-off-by: Felix Fietkau <nbd@nbd.name>

* hostapd: fix up patches after the last commit

Signed-off-by: Felix Fietkau <nbd@nbd.name>

* hostapd: ubus: fix uninitialized pointer

This fixes passing a bogus non-null pointer to the ubus handler in case
the transition request is rejected.

Signed-off-by: David Bauer <mail@david-bauer.net>

Co-authored-by: Felix Fietkau <nbd@nbd.name>
Co-authored-by: David Bauer <mail@david-bauer.net>
2021-10-22 11:56:24 +08:00
Beginner
03ff629884
hostapd: sync upstream (#8078)
* hostapd: ubus: add notification for BSS transition response

To allow steering daemons to be aware of the STA-decided transition
target, publish WNM transition responses to ubus. This way, steerings
daemons can learn about STA-chosen targets and send a better selection
of transition candidates.

Signed-off-by: David Bauer <mail@david-bauer.net>

* hostapd: ubus: add BSS transtiton request method

The existing wnm_disassoc_imminent ubus method only supports issuing a
bss transition request with the disassoc imminent flag set.
For use-cases, where the client is requested to roam to another BSS
without a pending disassoc, this existing method is not suitable.

Add a new bss_transition_request ubus method, which provides a more
universal way to dispatch a transition request. It takes the following
arguments:

Required:
addr: String - MAC-address of the STA to send the request to (colon-seperated)

Optional:
abridged - Bool - Indicates if the abridged flag is set
disassociation_imminent: Bool - Whether or not the disassoc_imminent
                         flag is set
disassociation_timer: I32 - number of TBTTs after which the client will
                      be disassociated
validity_period: I32 - number of TBTTs after which the beacon
                 candidate list (if included) will be invalid
neighbors: blob-array - Array of strings containing neighbor reports as
           hex-string

Signed-off-by: David Bauer <mail@david-bauer.net>

* hostapd: fix goto loop for ubus assoc handler

When a ubus event handler denies a association with a non-zero return
value, the code jumps to preceeding code, creating an endless loop until
the event handler accepts the assc request.

Move the ubus handler further up the code to avoid creating such a loop.

Signed-off-by: David Bauer <mail@david-bauer.net>

Co-authored-by: David Bauer <mail@david-bauer.net>
2021-10-20 17:29:38 +08:00
Beginner
7d2c39e087
dnsmasq: add explicit "set:" for client-matching options (#7993)
Bring the usage in line with the dnsmasq man page and the other options
where set: is mandatory.

No functional change.

Signed-off-by: Paul Fertser <fercerpav@gmail.com>

Co-authored-by: Paul Fertser <fercerpav@gmail.com>
2021-10-06 11:30:27 +08:00
Beginner
be087a4f7e
hostapd: sync upstream (#7925)
* hostapd: let netifd set bridge port attributes for snooping

Avoids race conditions on bridge member add/remove

Signed-off-by: Felix Fietkau <nbd@nbd.name>

* hostapd: fix segfault when deinit mesh ifaces

In hostapd_ubus_add_bss(), ubus objects are not registered for mesh
interfaces. This provokes a segfault when accessing the ubus object in
mesh deinit.

This commit adds the same condition to hostapd_ubus_free_bss() for
discarding those mesh interfaces.

Signed-off-by: Jesus Fernandez Manzano <jesus.manzano@galgus.net>

Co-authored-by: Felix Fietkau <nbd@nbd.name>
Co-authored-by: Jesus Fernandez Manzano <jesus.manzano@galgus.net>
2021-09-25 01:42:07 +08:00
breakings
368e31dc7c
dnsmasq: update to version 2.86 (#7909)
Co-authored-by: breakings <skygmin@yahoo.com>
2021-09-23 22:22:07 +08:00
Beginner
f350ecc799
hostapd: sync upstream (#7771)
* hostapd: refresh patches

Signed-off-by: David Bauer <mail@david-bauer.net>

* hostapd: fix Proxy-ARP with Hotspot 2.0 disabled

The disable_dgaf config fiels is only available in case Hostapd is
compiled with Hotspot 2.0 support, however Proxy-ARP does not depend on
Hotspot 2.0.

Only add the code related to this config field when Hotspot 2.0 is
enabled to fix compilation with the aformentioned preconditions.

Signed-off-by: David Bauer <mail@david-bauer.net>

* hostapd: enable proxy-arp support for hostapd-full

The hostapd.sh script already has support for configuring proxy-ARP,
however no built variant has support for it enabled.

Enable proxy-ARP support for hostapd-full builds in order to allow users
to actually use this feature.

Signed-off-by: David Bauer <mail@david-bauer.net>

Co-authored-by: David Bauer <mail@david-bauer.net>
2021-08-31 01:07:54 +08:00
Beginner
b23e6fa3ee
hostapd: enable ht40 in wpa_supplicant when using wider HE modes (#7737)
Signed-off-by: Felix Fietkau <nbd@nbd.name>

Co-authored-by: Felix Fietkau <nbd@nbd.name>
2021-08-25 01:46:50 +08:00
Beginner
0a5b74053a
hostapd: fix broken check in radar detection notification (#7663)
This check was accidentally left in after reworking the code,
causing a segfault

Signed-off-by: Felix Fietkau <nbd@nbd.name>

Co-authored-by: Felix Fietkau <nbd@nbd.name>
2021-08-12 16:01:08 +08:00
Beginner
6240e663d4
hostapd: respect fixed channel BW in HE20 mode (#7629)
When using htmode 'HE20' with a radio mode that uses wpa-supplicant
(like mesh or sta), it will default to 40 MHz bw if disable_ht40 is not
set. This commit fixes this behaviour.

Signed-off-by: Jesus Fernandez Manzano <jesus.manzano@galgus.net>

Co-authored-by: Jesus Fernandez Manzano <jesus.manzano@galgus.net>
2021-08-09 22:35:40 +08:00
Beginner
9dc595bade
dnsmasq: reset EXTRA_MOUNT in the right place (#7585)
* dnsmasq: fix more dnsmasq jail issues

 * remove superflus mounts of /dev/null and /dev/urandom
 * reset EXTRA_MOUNTS at the beginning of the script
 * add mount according to ignore_hosts_dir
 * don't add mount for file which is inside a directory already in the
   EXTRA_MOUNTS list

Fixes: 59c63224e1 ("dnsmasq: rework jail mounts")
Reported-by: Hartmut Birr <e9hack@gmail.com>
Signed-off-by: Daniel Golle <daniel@makrotopia.org>

* dnsmasq: reset EXTRA_MOUNT in the right place

EXTRA_MOUNT variable should be reset in dnsmasq_start() rather than
just once at the beginning of the script.

Fixes: ac4e8aa2f8 ("dnsmasq: fix more dnsmasq jail issues")
Reported-by: Hartmut Birr <e9hack@gmail.com>
Signed-off-by: Daniel Golle <daniel@makrotopia.org>

Co-authored-by: Daniel Golle <daniel@makrotopia.org>
2021-08-01 22:26:58 +08:00
Beginner
7777b3ad7d
dnsmasq: rework jail mounts (#7578)
* split into multiple lines to improve readability
 * use EXTRA_MOUNT for addnhosts instead of blindly adding /tmp/hosts
 * remove no longer needed mount for /sbin/hotplug-call
 * add dhcp-script.sh dependencies (jshn, ubus)

Fixes: 3a94c2ca5c ("dnsmasq: add /tmp/hosts/ to jail_mount")
Fixes: aed95c4cb8 ("dnsmasq: switch to ubus-based hotplug call")
Reported-by: Stijn Tintel <stijn@linux-ipv6.be>
Signed-off-by: Daniel Golle <daniel@makrotopia.org>

Co-authored-by: Daniel Golle <daniel@makrotopia.org>
2021-08-01 17:50:30 +08:00
Beginner
b72f6d6fa1
hostapd: add missing chunk for the snoop interface fix (#7551)
Fixes: 7b46377a0cd9 ("hostapd: make the snooping interface (for proxyarp) configurable")
Signed-off-by: Felix Fietkau <nbd@nbd.name>

Co-authored-by: Felix Fietkau <nbd@nbd.name>
2021-07-28 23:44:50 +08:00
Beginner
3c6aadc40e
hostapd: sync upstream (#7549)
* hostapd: make the snooping interface (for proxyarp) configurable

Use the VLAN interface instead of the bridge, to ensure that hostapd receives
untagged DHCP packets

Signed-off-by: Felix Fietkau <nbd@nbd.name>

* hostapd: fix a segfault on sta disconnect with proxy arp enabled

Signed-off-by: Felix Fietkau <nbd@nbd.name>

* hostapd: make proxyarp work with libnl-tiny

Remove a dependency on libnl3-route

Signed-off-by: Felix Fietkau <nbd@nbd.name>

Co-authored-by: Felix Fietkau <nbd@nbd.name>
2021-07-28 13:41:38 +08:00
Beginner
7f94662b94
dnsmasq: add /tmp/hosts/ to jail_mount (#7438)
Programs like the olsr-name-plugin write hostname files to "/tmp/hosts/".
If you don't add this to the jail_mount, dnsmasq can't read it anymore.

Signed-off-by: Nick Hainke <vincent@systemli.org>

Co-authored-by: Nick Hainke <vincent@systemli.org>
2021-07-19 12:49:50 +00:00
Beginner
5aa1f7fcbd
hostapd: add "force" parameter for channel switch (#7394)
This will restart the interface in case the CSA fails and can be used to
force the device on a DFS channel (including full CAC)

Signed-off-by: Felix Fietkau <nbd@nbd.name>

Co-authored-by: Felix Fietkau <nbd@nbd.name>
2021-07-15 13:31:45 +00:00
Beginner
4641e712d0
hostapd: sync upstream (#7361)
* hostapd: make it possible to update station airtime weights via ubus

This allows dynamic tuning based on other runtime information

Signed-off-by: Felix Fietkau <nbd@nbd.name>

* hostapd: add support for enabling HE on channel switch

Signed-off-by: Felix Fietkau <nbd@nbd.name>

* hostapd: initialize ht/vht/he mode on channel switch by default

Use the current mode, but allow overwriting via ubus command parameters

Signed-off-by: Felix Fietkau <nbd@nbd.name>

* hostapd: fix uninitialized stack variable on CSA

Signed-off-by: Felix Fietkau <nbd@nbd.name>

Co-authored-by: Felix Fietkau <nbd@nbd.name>
2021-07-12 14:06:20 +00:00
David Bauer
40b63f28e8 hostapd: add HE flag to get_clients
Expose the hostapd HE flag via ubus to indicate HE capable devices.

Signed-off-by: David Bauer <mail@david-bauer.net>
2021-07-06 14:30:48 +08:00
Martin Weinelt
935151084e hostapd: remove unused mac_buff allocation
Signed-off-by: Martin Weinelt <hexa@darmstadt.ccc.de>
2021-07-06 14:30:34 +08:00
Martin Weinelt
1754452baa hostapd: report bssid, ssid and channel over ubus
Imports a function from iw to convert frequencies to channel numbers.

Co-authored-by: David Bauer <mail@david-bauer.net>
Signed-off-by: Martin Weinelt <hexa@darmstadt.ccc.de>
[fix potential out of bounds read]
Signed-off-by: David Bauer <mail@david-bauer.net>
2021-07-06 14:30:16 +08:00
Kevin Darbyshire-Bryant
0c8e2bd7d0 dnsmasq: use local option for local domain parameter
'--local' is a synonym for '--server' so let's use '--local' in the
resultant config file for uci's 'local' instead of uci's local
parameter being turned into '--server'.  Slightly less confusion all
round.

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
2021-07-06 14:28:49 +08:00
coolsnowwolf
4a0fbb84ad dropbear: use old extra_command wrapper 2021-06-30 21:26:45 +08:00
coolsnowwolf
8fc5020e3e dnsmasq: sync upstream 2021-06-30 16:16:46 +08:00
Beginner
d7e0201ce9
dnsmasq: distinct Ubus names for multiple instances (#7225)
Currently, when using multiple dnsmasq instances they are all assigned
to the same Ubus instance name. This does not work, as only a single
instance can register with Ubus at a time. In the log, this leads to
`Cannot add object to UBus: Invalid argument` error messages.
Furthermore, upstream 3c93e8eb41952a9c91699386132d6fe83050e9be changes
behaviour so that instead of the log, dnsmasq exits at start instead.

With this patch, all dnsmasq instances are assigned unique names so that
they can register with Ubus concurrently. One of the enabled instances
is always assigned the previous default name "dnsmasq" to avoid breaking
backwards compatibility with other software relying on that default.
Previously, a random instance got assigned that name (while the others
produced error logs). Now, the first unnamed dnsmasq config section is
assigned the default name. If there are no unnamed dnsmasq sections the
first encountered named dnsmasq config section is assigned instead.

A similar issue exists for Dbus and was similarly addressed.

Signed-off-by: Etan Kissling <etan.kissling@gmail.com>
[tweaked commit message] dnsmasq was not crashing it is exiting
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>

Co-authored-by: Etan Kissling <etan.kissling@gmail.com>
2021-06-30 05:05:20 +00:00
AmadeusGhost
41ba774971
ath10k: re-added 256qam support (#7200)
* mac80211: allow VHT on 2.4GHz

Allow VHT rate on 2.4GHz in order to use 256-QAM

Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>

* ath10k: allow VHT on 2.4GHz

Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>

* hostapd: add vendor_vht option

hostapd has vendor_vht option to enable VHT (256-QAM) on 2.4GHz
Add this option to hostapd.sh so users can enable it via uci

Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>

* mac80211: ath.mk: typo fixes

Co-authored-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
2021-06-27 17:47:04 +08:00
Beginner
39fc6395fd
hostapd: add support for providing vendor specific IE elements (#7178)
They can be added as hex digit strings via the 'vendor_elements' option

Signed-off-by: Felix Fietkau <nbd@nbd.name>

Co-authored-by: Felix Fietkau <nbd@nbd.name>
2021-06-25 04:40:25 +00:00
dansir
6abd652604
hostapd: disassoc_low_ack disable by default (#7160)
https://openwrt.org/faq/disconnected_due_to_excessive_missing_acks
https://openwrt.org/faq/deauthenticated_due_to_inactivity
2021-06-24 05:26:23 +00:00
Beginner
6752f7970f
hostapd: add default_disabled option to the supplicant (#7165)
With the default configuration we generate, the supplicant starts
scanning and tries to connect to any open network when the interface
is enabled.

In some cases it can be desirable to prevent the supplicant from
scanning by itself. For example, if on the same radio an AP is
configured and an unconfigured STA is added (to be configured with
WPS), the AP might not be able to beacon until the STA stops
scanning.

In such a case, the STA configuration can still be required to set
specific settings (e.g. multi_ap_backhaul_sta) so it can't be set to
"disabled" in uci (because that would prevent the supplicant from
being run at all). The alternative is to add the "disabled" parameter
to the default network block in the supplicant configuration.

This patch adds a "default_disabled" setting in UCI which, when set,
adds the "disabled" parameter to the supplicant default network block.

Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>

Co-authored-by: Raphaël Mélotte <raphael.melotte@mind.be>
2021-06-24 05:25:38 +00:00
coolsnowwolf
fb9568cbe3 kernel: bump 5.4 to 5.4.128 2021-06-24 10:49:50 +08:00
Beginner
3929e40fda
hostapd: make wnm_sleep_mode_no_keys configurable (#7150)
In the aftermath of the KRACK attacks, hostapd gained an AP-side workaround
against WNM-Sleep Mode GTK/IGTK reinstallation attacks. WNM Sleep Mode is not
enabled by default on OpenWrt, but it is configurable through the option
wnm_sleep_mode. Thus, make the AP-side workaround configurable as well by
exposing the option wnm_sleep_mode_no_keys. If you use the option
wpa_disable_eapol_key_retries and have wnm_sleep_mode enabled, you might
consider using this workaround.

Signed-off-by: Timo Sigurdsson <public_timo.s@silentcreek.de>

Co-authored-by: Timo Sigurdsson <public_timo.s@silentcreek.de>
2021-06-23 13:22:57 +08:00
Beginner
2c7a6b92b0
hostapd: sync upstream (#7135)
* hostapd: make country3 option configurable

The country3 option in hostapd.conf allows the third octet of the country
string to be set. It can be used e.g. to indicate indoor or outdoor use (see
hostapd.conf for further details). Make this option configurable but optional
in OpenWrt.

Signed-off-by: Timo Sigurdsson <public_timo.s@silentcreek.de>

* hostapd: fix handling of the channel utilization options

Commit 0a7657c ("hostapd: add channel utilization as config option") added the
two new uci options bss_load_update_period and chan_util_avg_period. However,
the corresponding "config_add_int" calls for these options weren't added, so
attempting to actually use these options and change their values is bound to
fail - they always stay at their defaults. Add the missing code to actually
make these options work.

Fixes: 0a7657c ("hostapd: add channel utilization as config option")
Signed-off-by: Timo Sigurdsson <public_timo.s@silentcreek.de>

Co-authored-by: Timo Sigurdsson <public_timo.s@silentcreek.de>
2021-06-22 11:07:36 +00:00
Michael Yartys
248dbdb904 hostapd: add support for setting sae_pwe
Make it possible to specify the SAE mechanism for PWE derivation. The
following values are possible:

0 = hunting-and-pecking loop only
1 = hash-to-element only
2 = both hunting-and-pecking loop and hash-to-element enabled

hostapd currently defaults to hunting-and-pecking loop only.

Signed-off-by: Michael Yartys <michael.yartys@protonmail.com>
2021-06-21 15:49:10 +08:00
Dobroslaw Kijowski
31d876d11a hostapd: stop advertising 11w feature
This is a follow up of 1a9b896d ("treewide: nuke DRIVER_11W_SUPPORT").
LuCI commit ab010406 ("luci-mod-network: skip check for 802.11w feature")
skips check of the 11w feature [1]. Now advertising it in hostapd is
superfluous so stop doing it.

[1]: https://github.com/openwrt/luci/pull/4689

Signed-off-by: Dobroslaw Kijowski <dobo90@gmail.com>
[remove outdated PKG_RELEASE bump and update to SPDX]
Signed-off-by: Paul Spooren <mail@aparcar.org>
2021-06-21 15:48:51 +08:00
dansir
89d2ce56df
dropbear: set listen interface to lan (#7100)
默认设置为“未指定”不安全
2021-06-20 05:29:18 +00:00
lean
260fbd3a46 dnsmasq: unselect DNSEC 2021-06-19 20:19:26 +08:00
lean
a3f1e837fd x64: fix grub2 booting 2021-06-15 17:58:07 +08:00
lean
7a50383ab6 add kernel 5.10 support and sync with upstream 2021-06-14 18:30:08 +08:00
Beginner
79b427589c
wireguard,wireguard-tools: update to 1.0.20210424 (#6864)
Co-authored-by: Tianling Shen <cnsztl@immortalwrt.org>
2021-05-21 18:57:54 +08:00
AmadeusGhost
d7a249a5c2
dnsmasq: Update to version 2.85 (#6795)
Fixes issue with merged DNS requests in 2.83/2.84 not being
retried on the firsts failed request causing lookup failures.

Also fixes the following security problem in dnsmasq:
* CVE-2021-3448:
  If specifiying the source address or interface to be used
  when contacting upstream name servers such as:
  server=8.8.8.8@1.2.3.4, server=8.8.8.8@1.2.3.4#66 and
  server=8.8.8.8@eth0 then all would use the same socket
  bound to the explicitly configured port. Now only
  server=8.8.8.8@1.2.3.4#66 will use the explicitly
  configured port and the others random source ports.

Remove upstreamed patches and update remaining patch.

Signed-off-by: Alan Swanson <reiver@improbability.net>
[refreshed old runtime support patch]
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>

Co-authored-by: Alan Swanson <reiver@improbability.net>
2021-05-05 23:24:23 +08:00
z826540272
d3d6f3a2c4
DNSMASQ ttl config (#6779)
默认情况下 SSR PLUS DNS结果根本无法缓存(由于引入拒绝ipv6结果导致的问题),nslookup & dig 延迟每次依然有200-300多.
dnsmasq处设置缓存依然无效,设置TTL也无效,应该是bug。
解决办法是手动指定缓存TTL为最大一小时。域名查询实测有效缓存0延迟。 

此变更仅使开启dnsmasq缓存的情况下正常工作。
2021-05-03 22:50:02 +08:00
ricksuzade-maker
8188790996
Bump wireguard to the latest version (#6716) 2021-04-19 10:24:39 +08:00
ricksuzade-maker
3da0060131
Bump wireguard to 1.0.20210124 (#6285) 2021-02-01 11:16:20 +08:00
pupie
96f26d716a
Add scramble option in options file. (#6287) 2021-01-31 14:49:19 +08:00
xiaobaishu1
7daf3edcec
Update Makefile (#6290)
切换到正式版本
2021-01-31 14:48:11 +08:00
AmadeusGhost
b95ffef87f
Revert "dnsmasq: force sync with official code" (#6266)
Fixes: 9170d18d0d ("dnsmasq: Update to 2.84test3")
2021-01-27 17:12:30 +08:00
Beginner
9170d18d0d
dnsmasq: Update to 2.84test3 (#6259) 2021-01-26 18:38:30 +08:00
eSir
b927a69df8
Upgrade OpenVPN to 2.5.0 & Add xorpatch as a scramble option (#6249) 2021-01-25 16:33:40 +08:00
xiaobaishu1
e780247bf7
Update DNSMASQ (#6250) 2021-01-25 16:31:52 +08:00
AmadeusGhost
1c271cdd2c
dnsmasq: Update to version 2.83 (#6245)
This fixes the following security problems in dnsmasq:
* CVE-2020-25681:
  Dnsmasq versions before 2.83 is susceptible to a heap-based buffer
  overflow in sort_rrset() when DNSSEC is used. This can allow a remote
  attacker to write arbitrary data into target device's memory that can
  lead to memory corruption and other unexpected behaviors on the target
  device.
* CVE-2020-25682:
  Dnsmasq versions before 2.83 is susceptible to buffer overflow in
  extract_name() function due to missing length check, when DNSSEC is
  enabled. This can allow a remote attacker to cause memory corruption
  on the target device.
* CVE-2020-25683:
  Dnsmasq version before 2.83 is susceptible to a heap-based buffer
  overflow when DNSSEC is enabled. A remote attacker, who can create
  valid DNS replies, could use this flaw to cause an overflow in a heap-
  allocated memory. This flaw is caused by the lack of length checks in
  rtc1035.c:extract_name(), which could be abused to make the code
  execute memcpy() with a negative size in get_rdata() and cause a crash
  in Dnsmasq, resulting in a Denial of Service.
* CVE-2020-25684:
  A lack of proper address/port check implemented in Dnsmasq version <
  2.83 reply_query function makes forging replies easier to an off-path
  attacker.
* CVE-2020-25685:
  A lack of query resource name (RRNAME) checks implemented in Dnsmasq's
  versions before 2.83 reply_query function allows remote attackers to
  spoof DNS traffic that can lead to DNS cache poisoning.
* CVE-2020-25686:
  Multiple DNS query requests for the same resource name (RRNAME) by
  Dnsmasq versions before 2.83 allows for remote attackers to spoof DNS
  traffic, using a birthday attack (RFC 5452), that can lead to DNS
  cache poisoning.
* CVE-2020-25687:
  Dnsmasq versions before 2.83 is vulnerable to a heap-based buffer
  overflow with large memcpy in sort_rrset() when DNSSEC is enabled. A
  remote attacker, who can create valid DNS replies, could use this flaw
  to cause an overflow in a heap-allocated memory. This flaw is caused
  by the lack of length checks in rtc1035.c:extract_name(), which could
  be abused to make the code execute memcpy() with a negative size in
  sort_rrset() and cause a crash in dnsmasq, resulting in a Denial of
  Service.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

Co-authored-by: Hauke Mehrtens <hauke@hauke-m.de>
2021-01-25 01:37:23 +08:00
AmadeusGhost
69f46989e2
mac80211: update to 5.8.18-1 (#6200)
ath10k-ct-firmware: update to 2020-11-08
ath10k-ct: update to 2020-12-24
mt76: update to 2020-12-18
wireless-regdb: update to version 2020.11.20
2021-01-18 13:06:03 +08:00
AmadeusGhost
0456744e39
mac80211: sync upstream source code (#5860)
[mac80211]
  08a42ef mac80211: fix memory leak on filtered powersave frames
  daeda8a mac80211: pass phy name to hostapd_set_bss_options
  7ca9b82 mac80211: Fix wpa_supplicant config removal ubus call
  bf3158b mac80211: backport the new tasklet API
  0bb5d39 mac80211: add minstrel fixes that fix mt76 issues in legacy mode

[ath10k]
  c3b2efa linux-firmware: ath10k: add board firmware packages
  655091e ath10k-ct-firmware: switch to linux-firmware board binaries
  61e381d ath10k-firmware: remove unused package
2020-12-02 12:24:26 +08:00
ricksuzade-maker
02eae7a969
Bump wireguard to 1.0.20201112 (#5786) 2020-11-15 09:10:56 +08:00
虾哥哥
78cff4a63a
set default interface to lan to avoid attacks (#5773)
to avoid attacks from WAN
2020-11-14 00:53:25 +08:00
AmadeusGhost
5d98c4178e
kernel: bump 5.4 to 5.4.75 (#5780)
[mac80211]
 5b29614 mac80211: another fix for the sta connection monitor
 1ed6eb1 mac80211: backport sched_set_fifo_low
 cba4120 mac80211: add support for specifying a per-device scan list
 e0d482f rt2x00: mt7620: differentiate based on SoC's CHIP_VER

[package]
 amd64-microcode/intel-microcode/linux-firmware: update version
2020-11-14 00:52:35 +08:00
AmadeusGhost
86bc29e4a8
kernel: bump 5.4 to 5.4.68 (#5555)
[mac80211]
 ca5ee6e mac80211: Fix potential endless loop
 2c14710 mac80211: add more AQL fixes/improvements
 91fb3ce mac80211: remove an obsolete patch that is no longer doing anything useful
 acf1733 mac80211: add preliminary support for enabling 802.11ax in config
 d717343 mac80211: update encap offload patches to the latest version
 673062f mac80211: allow bigger A-MSDU sizes in VHT, even if HT is limited
 caf7277 mac80211: do not allow bigger VHT MPDUs than the hardware supports
 cd36c0d mac80211: select the first available channel for 5GHz interfaces
 1c6d456 mac80211: fix regression in station connection monitor optimization
 4bd7689 mac80211: update sta connection monitor regression fix

[target]
 Sync: at91, ath25, ath79, lantiq, mediatek, mvebu.
2020-10-03 00:36:16 +08:00
ricksuzade-maker
9a482a15a3
Wireguard: bump to 1.0.20200908 (#5535) 2020-09-24 10:01:24 +08:00
AmadeusGhost
404209f6c4
kernel: bump to 4.14.193, 4.19.138, 5.4.59 (#5350)
kernel: bump to 4.14.193, 4.19.138, 5.4.59 (#5350)
  431fb8c mac80211: add AQL improvements
  6bdd4c9 mac80211: add missing backports for building with 4.14 kernels
  0106820 mac80211: add missing return code checks in AQL improvements
  e7f7101 mac80211: rework encapsulation offload support

[package]
  base-files: add function for generating random MAC
  dnsmasq: abort dhcp_check on interface state
  boot: sync upstream source code
  ath10k-ct-firmware/mt76/sch_cake: update to latest git HEAD

[script]
  download: add China Mirror Station

[target]
  Sync: arc770, ath79, bcm63xx, kirkwood, lantiq, layerscape,
        mediatek, mvebu, octeon, oxnas, pistachio, uml
  Sync most of the target patches.

Run-compiled-on: ipq40xx (4.19 & 5.4), ramips
2020-08-26 11:31:50 +08:00
AmadeusGhost
7e3464582c
mac80211-5.8: fix build on kernel 4.14 and sync upstream commit (#5295)
* mac80211-5.8: fix build on kernel 4.14

* mac80211: sync upstream commit
2020-08-09 15:47:25 +08:00
AmadeusGhost
b1677a562c
mac80211: bump to 5.8-rc2, add ath10k VHT support and very basic support for ipq807x ath11k (#5288)
* mac80211: bump to 5.8-rc2

changelog:
  dfe0bc8 mac80211: allow ACS restriction with fixed channel
  727685c mac80211: rt2x00: define RF5592 in init_eeprom routine
  cfd2f3b mac80211: create channel list for fixed channel operation
  d1100c7 mac80211: Update to version 5.7.5-1
  ed2015c mac80211: Update to version 5.8-rc2-1
  a956c14 mac80211: util: don't warn on missing sband iftype data
  8b3e170 hostapd: fix incorrect service name
  68bf5a9 mac80211: don't kill wireless daemon on teardown
  25e0ae6 mac80211: make cfg80211 testmode support optional (and disabled by default)
  b7727a8 mac80211: fix AQL issues
  3d731fc mac80211: merge performance improvement patches

* mt76: update to 2020-07-22

Signed-off-by: Felix Fietkau <nbd@nbd.name>

* mac80211: allow VHT on 2.4GHz

Allow VHT rate on 2.4GHz in order to use 256-QAM

Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>

* ath10k: allow VHT on 2.4GHz

Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>

* hostapd: add vendor_vht option

hostapd has vendor_vht option to enable VHT (256-QAM) on 2.4GHz
Add this option to hostapd.sh so users can enable it via uci

Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>

* ipq807x: Refresh kernel configuration

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

* ipq807x: Add WCSS bus

This is needed to build ath11k.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

* mac80211: Add ath11k

This adds the Qualcomm 802.11ax wireless chipset support.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

Co-authored-by: Felix Fietkau <nbd@nbd.name>
Co-authored-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
Co-authored-by: Hauke Mehrtens <hauke@hauke-m.de>
2020-08-07 23:53:02 +08:00
ricksuzade-maker
1b96532fcb
Bump wireguard to 1.0.20200729 (#5221) 2020-07-30 08:46:16 +08:00
ricksuzade-maker
90571f5db1
Bump wireguard to 1.0.20200712 (#5100) 2020-07-14 13:17:09 +08:00
coolsnowwolf
37c63e9b3d ppp: add shellsync support 2020-07-08 14:45:43 +08:00
coolsnowwolf
2c8ea33784 odhcpd: fix compilation with GCC10 2020-07-03 18:02:13 +08:00
coolsnowwolf
96652f8f80 dnsmasq: disable dhcpv6 by default 2020-07-03 13:58:59 +08:00
coolsnowwolf
57c30e4128 uhttpd: disable https redir 2020-07-03 13:40:31 +08:00
coolsnowwolf
33abeff31c Sync to snapshot kernel 5.4 version 2020-07-02 23:30:56 +08:00
ricksuzade-maker
c6bb4b7e88
Bump wireguard to 1.0.20200623
Bump wireguard to the newest version
2020-06-24 08:51:46 +08:00
coolsnowwolf
763184143e
firewall: refresh 900-filter-aaaa.patch (#4698)
Signed-off-by: Chuck <fanck0605@qq.com>
2020-06-19 10:58:10 +08:00
coolsnowwolf
7e3bbbd936 Revert "dnsmasq: add auto multiple service instances for dns performance boost"
This reverts commit 3a0adfef15.
2020-06-19 10:57:41 +08:00
coolsnowwolf
3a0adfef15 dnsmasq: add auto multiple service instances for dns performance boost 2020-06-16 18:37:34 +08:00
ricksuzade-maker
e7e68c3352
Bump wireguard to v1.0.20200611 (#4778)
Bump wireguard to the newest version
2020-06-12 12:18:29 +08:00
HiGarfield
e0c345df71
ppp: syncppp: further fix grep's regex match (#4623)
/etc/config/network这个文件里的写法可以各种各样,pppoe外面可以有引号,也可以没引号。proto与pppoe之间可以有不同类型、不同数量的空格(或Tab)。用uci show,可以把输出格式统一掉,省得考虑配置文件不同写法的区别。
2020-06-09 16:14:26 +08:00
Chuck
929f3953dd firewall: refresh 900-filter-aaaa.patch
Signed-off-by: Chuck <fanck0605@qq.com>
2020-05-31 15:39:00 +08:00
coolsnowwolf
bbe99b4fdf mac80211:update ath10k upstream patches 2020-05-27 11:58:24 +08:00
coolsnowwolf
d1f2153ca4 hostapd: disable wifi-reload 2020-05-27 00:17:15 +08:00
coolsnowwolf
bb3276ef05 mac80211: fix RT-ACRH17 2.4Ghz wifi performance issus 2020-05-26 23:18:25 +08:00
ricksuzade-maker
c289a1c598
Bump wireguard to 1.0.20200520 (#4675) 2020-05-26 15:29:36 +08:00
Chuck
8f9bc86de1
ppp: syncppp: fix grep's regex match (#4609) 2020-05-15 20:10:48 +08:00
AmadeusGhost
5591c36728
Revert "ipq40xx: update ath10k firmware" (#4590)
This reverts commit 2c37fa71f9.
2020-05-12 18:58:46 +08:00
coolsnowwolf
2c37fa71f9 ipq40xx: update ath10k firmware 2020-05-09 14:36:43 +08:00
ricksuzade-maker
585ca34a6b
Bump wireguard to version 1.0.20200506 (#4560) 2020-05-08 20:42:57 +08:00
ricksuzade-maker
5b88caedf6
Bump wireguard to 1.0.20200429 (#4536) 2020-05-04 18:24:01 +08:00
AmadeusGhost
23378ed9a4
netifd: add dynamic wireless reconfiguration (#4518)
Set new option 'reconf' in 'wifi-device' section to enable dynamic re-configuration on that radio. Also fix wifi relay and 'netifd: radio1 (9654): Command failed'.
2020-05-02 19:11:45 +08:00
Chuck
55e06fdb00
dropbear: only bind lan by default (#4456) 2020-04-27 12:31:07 +08:00
AmadeusGhost
463b6ac050
mac80211: fixed slow wireless startup (#4420)
* hostapd: reduce to a single instance per service

* mac80211: sync upstream source code

* iw: bump to 5.4
2020-04-23 16:42:46 +08:00
ricksuzade-maker
b8f8afb7d0
Bump wireguard to 1.0.20200413 (#4361)
Bump to the newest version of wireguard
2020-04-18 11:20:24 +08:00
coolsnowwolf
036efba3c1 hostapd: backport usleep patch 2020-04-16 12:59:49 +08:00
ricksuzade-maker
cef6bffa6f
Bump wireguard to 1.0.20200401 (#4217)
The newest official stable release.
2020-04-07 23:41:56 +08:00
lean
8faac30089 mac80211: Update to version 5.4.27 2020-04-03 23:29:36 +08:00
lean
aadf217f55 dropbear: bump to 2019.78 2020-03-22 18:35:41 +08:00