aboutsummaryrefslogtreecommitdiffstats
path: root/package/network/services
Commit message (Collapse)AuthorAgeFilesLines
* uhttpd: use P-256 for certsPaul Spooren2020-11-091-2/+2
| | | | | | | | | | | | The uhttpd package takes care of creating self-signed certificates if px5g is installed. This improves the security of router management as it encrypts the LuCI connection. The EC P-256 curve is faster than RSA which which improves the user experience on embedded devices. EC P-256 is support for as old devices as Android 4.4. Signed-off-by: Paul Spooren <mail@aparcar.org>
* hostapd: add a hostapd-basic-wolfssl variantRui Salvaterra2020-11-081-0/+13
| | | | | | | | | | | | If only AP mode is needed, this is currently the most space-efficient way to provide support for WPA{2,3}-PSK, 802.11w and 802.11r. openwrt-ath79-generic-ubnt_nanostation-loco-m-squashfs-sysupgrade.bin sizes: 4719426 bytes (with wpad-basic-wolfssl) 4457282 bytes (with hostapd-basic-wolfssl) Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
* dropbear: use new extra_command wrapperFlorian Eckert2020-11-022-3/+3
| | | | | | Use new `extra_command` wrapper to fix the alignement. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* odhcpd: fix compile problem on 64-bit systemsHans Dedecker2020-11-011-3/+3
| | | | | | | | 735c783 dhcpv6: fix size_t fields in syslog format Fixes 5cdc65f6d1 Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* odhcpd: update to latest git HEADHans Dedecker2020-10-311-3/+3
| | | | | | | | | 5700919 dhcpv6: add explicit dhcpv4o6 server address e4f4e62 dhcpv6: add DHCPv4-over-DHCPv6 support aff290b dhcpv6: check message type 2677fa1 router: fix advertisement interval option Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* hostapd: enable OWE for the basic-{openssl, wolfssl} variantsRui Salvaterra2020-10-311-0/+6
| | | | | | | Opportunistic Wireless Encryption is needed to create/access encrypted networks which don't require authentication. Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
* hostapd: remove hostapd-hs20 variantDaniel Golle2020-10-301-18/+0
| | | | | | | | Hotspot 2.0 AP features have been made available in the -full variants of hostapd and wpad. Hence we no longer need a seperate package for that. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* hostapd: add {hostapd,wpad}-basic-openssl variantsRui Salvaterra2020-10-302-0/+28
| | | | | | | | | Add OpenSSL-linked basic variants (which provides WPA-PSK only, 802.11r and 802.11w) of both hostapd and wpad. For people who don't need the full hostapd but are stuck with libopenssl for other reasons, this saves space by avoiding the need of an additional library (or a larger hostapd with built-in crypto). Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
* hostapd: wpas: add missing config symbolsDavid Bauer2020-10-282-3/+3
| | | | | | | | | | | | | | | This adds missing config symbols for interworking as well as Hotspot 2.0 to the wpa_supplicant-full configuration. These symbols were added to the hostapd-full configuration prior to this commit. Without adding them to the wpa_supplicant configuration, building of wpad-full fails. Thanks to Rene for reaching out on IRC. Fixes: commit be9694aaa297 ("hostapd: add UCI support for Hotspot 2.0") Fixes: commit 838b412cb527 ("hostapd: add interworking support") Signed-off-by: David Bauer <mail@david-bauer.net>
* dnsmasq: install /etc/hotplug.d/ntp/25-dnsmasqsec world-readableDaniel Golle2020-10-281-2/+2
| | | | | | | | /etc/hotplug.d/ntp/25-dnsmasqsec is being sourced by /sbin/hotplug-call running as ntpd user. For that to work the file needs to be readable by that user. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* hostapd: bump PKG_RELEASEDavid Bauer2020-10-281-1/+1
| | | | Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: add interworking supportDavid Bauer2020-10-282-1/+79
| | | | | | | | | | | | | | | | | | | | | | | | This adds configuration options to enable interworking for hostapd. All options require iw_enabled to be set to 1 for a given VAP. All IEEE802.11u related settings are supported with exception of the venue information which will be added as separate UCI sections at a later point. The options use the same name as the ones from the hostapd.conf file with a "iw_" prefix added. All UCI configuration options are passed without further modifications to hostapd with exceptions of the following options, whose elements can be provided using UCI lis elements: - iw_roaming_consortium - iw_anqp_elem - iw_nai_realm - iw_domain_name - iw_anqp_3gpp_cell_net Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: add FTM responder supportDavid Bauer2020-10-281-0/+13
| | | | | | | | | | | | | | | This adds support for enabling the FTM responder flag for the APs extended capabilities. On supported hardware, enabling the ftm_responder config key for a given AP will enable the FTM responder bit. FTM support itself is unconditionally implemented in the devices firmware (ath10k 2nd generation with 3.2.1.1 firmware). There's currently no softmac implementation. Also allow to configure LCI and civic location information which can be transmitted to a FTM initiator. Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: remove ieee80211v optionDavid Bauer2020-10-281-14/+6
| | | | | | | | | | | | | Remove the ieee80211v option. It previously was required to be enabled in order to use time_advertisement, time_zone, wnm_sleep_mode and bss_transition, however it didn't enable any of these options by default. Remove it, as configuring these options independently is enough. This change does not influence the behavior of any already configured setting. Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: make rrm report independent of ieee80211k settingDavid Bauer2020-10-281-5/+4
| | | | | | | | Allow to configure both RRM beacon as well as neighbor reports independently and only enable them by default in case the ieee80211k config option is set. Signed-off-by: David Bauer <mail@david-bauer.net>
* umdns: update to version 2020-10-26Petr Štetiar2020-10-271-3/+3
| | | | | | | | | | | | | | | 59e4fc98162d cache: cache_answer: fix off by one 4cece9cc7db4 cache: cache_record_find: fix buffer overflow be687257ee0b cmake: tests: provide umdns-san binary bf01f2dd0089 tests: add dns_handle_packet_file tool 134afc728846 tests: add libFuzzer based fuzzing de08a2c71ca8 cmake: create static library cdc18fbb3ea8 interface: fix possible null pointer dereference 1fa034c65cb6 interface: fix value stored to 'fd' is never read 3a67ebe3fc66 Add initial GitLab CI support 50caea125517 cmake: fix include dirs and libs lookup Signed-off-by: Petr Štetiar <ynezz@true.cz>
* dnsmasq: include IPv6 local nameserver entryJoel Johnson2020-10-261-0/+1
| | | | | | | | | For IPv6 native connections when using IPv6 DNS lookups, there is no valid default resolver if ignoring WAN DHCP provided nameservers. This uses a runtime check to determine if IPv6 is supported on the host. Signed-off-by: Joel Johnson <mrjoel@lixil.net>
* busybox: make username consistentDaniel Golle2020-10-251-1/+1
| | | | | | | | | ntpd in packages feed had already a user 'ntp' with UID 123 declared. Rename the username of busybox-ntpd to be 'ntp' instead of 'ntpd' so it doesn't clash. Reported-by: Etienne Champetier <champetier.etienne@gmail.com> Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* dnsmasq: adapt to non-root ntpdDaniel Golle2020-10-252-1/+10
| | | | Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* uhttpd: adapt defaults for changes ubus.sock pathDaniel Golle2020-10-223-2/+7
| | | | Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* hostapd: ubus: add handler for wps_status and guard WPS callsDaniel Golle2020-10-163-1/+57
| | | | | | | | | Expose WPS ubus API only if compiled with WPS support and add new handler for wps_status call. Also add '-v wps' option to check whether WPS support is present in hostapd. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* ppp: update to version 2.4.8.git-2020-10-03Hans Dedecker2020-10-051-3/+3
| | | | | | | 2937722 Enable IPv6 by default (#171) 6d39c65 pppd: Fix blank password usage Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* uhttpd: update to latest Git HEADJo-Philipp Wich2020-10-041-3/+3
| | | | | | | | | | | | | 14a3cb4 ubus: fix legacy empty reply format 0f38b03 client: fix spurious keepalive connection timeouts 88ba2fa client: really close connection on timeout c186212 ubus: support GET method with CORS requests Fixes: FS#3369 Fixes: https://github.com/openwrt/luci/issues/4467 Fixes: https://github.com/openwrt/luci/issues/4470 Fixes: https://github.com/openwrt/luci/issues/4479 Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* mac80211: add support for specifying a per-device scan listFelix Fietkau2020-09-291-0/+1
| | | | | | | This is useful to bring up multiple client mode interfaces on a single channel much faster without having to scan through a lot of channels Signed-off-by: Felix Fietkau <nbd@nbd.name>
* dnsmasq: fix handling ignore condition for dnssecYousong Zhou2020-09-252-1/+2
| | | | | | | | | | It should return false to indicate that the option should not be ignored Fixes 064dc1e8 ("dnsmasq: abort when dnssec requested but not available") Reported-by: Sami Olmari <sami@olmari.fi> Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* dnsmasq: support tftp_unique_root in /etc/config/dhcpW. Michael Petullo2020-09-242-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | The TFTP server provided by dnsmasq supports serving a select boot image based on the client's MAC or IP address. This allows an administrator to activate this feature in /etc/config/dhcp. Here is an example /etc/config/dhcp that configures dnsmasq with --tftp-unique-root=mac: ... config dnsmasq option enable_tftp 1 option tftp_root /usr/libexec/tftpboot option tftp_unique_root mac config boot router option serveraddress 192.168.1.1 option servername tftp.example.com option filename openwrt-initramfs-kernel.bin ... With this configuration, dnsmasq will serve /usr/libexec/tftpboot/00-11-22-33-44-55/openwrt-initramfs-kernel.bin to the client with MAC address 00:11:22:33:44:55. Signed-off-by: W. Michael Petullo <mike@flyn.org>
* hostapd: ubus: make (B)SSID optional for neighbor reportDavid Bauer2020-09-222-10/+25
| | | | | | | | | | | Make the BSSID and SSID fields optional when configuring a neighbor report into hostapd. Both options can now be an empty string. For the BSSID, the first 6 byte are copied from the neighbor report. For the SSID, the SSID for the affected hostapd BSS is used. Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: ubus: send notification instead of eventDavid Bauer2020-09-222-12/+13
| | | | | | | | | | | Rafal Milecki pointed out that ubus events are meant for low-level ubus events only (e.g. addition or removal of an object). Higher level events should happen as notifications on the ubus object itself. Dispatch BSS events on the main hostapd ubus object instead of publishing them as ubus events. Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: ubus: fix infinite loop when configuring RRM NRDavid Bauer2020-09-212-3/+2
| | | | | | | The return-code was set, however it was never returned, nor was the loop interrupted. Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: send procd event on BSS updateDavid Bauer2020-09-212-4/+36
| | | | | | | Dispatch ubus events also to procd in order to trigger service reloads on hostapd updates. Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: send ubus event on BSS updateDavid Bauer2020-09-212-2/+24
| | | | | | | | | | | hostapd will emit a ubus event with the eventname hostapd.<ifname>.<event> when adding, removing or reloading a BSS. This way, services which install state (for example the RMM neighbor list) can on-demand reinstall this information for the BSS without polling this state. Signed-off-by: David Bauer <mail@david-bauer.net>
* odhcpd: number UCI defaults scriptStijn Segers2020-09-211-1/+1
| | | | | | | | | UCI defaults scripts are supposed to be numbered, but odhcpd's lacked numbering, which turned out to mess up my custom scripts numbered 9[0-9]_*. The idea is to have high number (custom) scripts executed last. Jow confirmed numbering is the default case, not the exception (thanks). Signed-off-by: Stijn Segers <foss@volatilesystems.org>
* uhttpd: update to the latest masterRafał Miłecki2020-09-181-3/+3
| | | | | | 47c34bd ubus: add ACL support for "subscribe" request Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* uhttpd: update to the latest masterRafał Miłecki2020-09-151-3/+3
| | | | | | | | 1172357 ubus: add new RESTful API fe1888f ubus: fix blob_buf initialization Fixes: 3d167ed805a9 ("uhttpd: update to the latest master") Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* hostapd: add support for per-BSS airtime configurationDavid Bauer2020-09-113-4/+14
| | | | | | | | | | | | Add support for per-BSS airtime weight configuration. This allows to set a airtime weight per BSS as well as a ratio limit based on the weight. Support for this feature is only enabled in the full flavors of hostapd. Consult the hostapd.conf documentation (Airtime policy configuration) for more information on the inner workings of the exposed settings. Signed-off-by: David Bauer <mail@david-bauer.net>
* openvpn: fix shell compare operator in openvpn.initMartin Schiller2020-09-092-2/+2
| | | | | | | | Don't use bash syntax, because /bin/sh is used here. Signed-off-by: Martin Schiller <ms@dev.tdt.de> [bump PKG_RELEASE] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* wireguard: bump to 1.0.20200908Jason A. Donenfeld2020-09-091-2/+2
| | | | | | | | | | | | | | | * compat: backport kfree_sensitive and switch to it * netlink: consistently use NLA_POLICY_EXACT_LEN() * netlink: consistently use NLA_POLICY_MIN_LEN() * compat: backport NLA policy macros Backports from upstream changes. * peerlookup: take lock before checking hash in replace operation A fix for a race condition caught by syzkaller. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* hostapd: add UCI support for Hotspot 2.0Daniel Golle2020-09-083-3/+107
| | | | Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* dropbear: Enable Ed25519 for normal devicesPaul Spooren2020-09-062-3/+4
| | | | | | | | | | | | | | | | | | | | The Ed25519 key pairs are much shorter than RSA pairs and are supported by default in OpenSSH. Looking at websites explaining how to create new SSH keys, many suggest using Ed25519 rather than RSA, however consider the former as not yet widely established. OpenWrt likely has a positive influence on that development. As enabling Ed25519 is a compile time option, it is currently not possible to install the feature via `opkg` nor select that option in an ImageBuilder. Due to the size impact of **12kB** the option should only be enabled for devices with `!SMALL_FLASH`. This approach seems cleaner than splitting `dropbear` into two packages like `dropbear` and `dropbear-ed25519`. Signed-off-by: Paul Spooren <mail@aparcar.org>
* ppp: update to latest git HEADHans Dedecker2020-09-051-3/+3
| | | | | | | af30be0 Fix setting prefix for IPv6 link-local addresss 0314df4 Disable asking password again when prompt program returns 128 Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* hostapd: add hs20 variantDaniel Golle2020-09-011-1/+21
| | | | | | Add hostapd variant compiled with support for Hotspot 2.0 AP features. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* hostapd: Fix compile errors after wolfssl updateHauke Mehrtens2020-08-271-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes the following compile errors after the wolfssl 4.5.0 update: LD wpa_cli ../src/crypto/tls_wolfssl.c: In function 'tls_match_alt_subject': ../src/crypto/tls_wolfssl.c:610:11: error: 'GEN_EMAIL' undeclared (first use in this function); did you mean 'ENAVAIL'? type = GEN_EMAIL; ^~~~~~~~~ ENAVAIL ../src/crypto/tls_wolfssl.c:610:11: note: each undeclared identifier is reported only once for each function it appears in ../src/crypto/tls_wolfssl.c:613:11: error: 'GEN_DNS' undeclared (first use in this function) type = GEN_DNS; ^~~~~~~ ../src/crypto/tls_wolfssl.c:616:11: error: 'GEN_URI' undeclared (first use in this function) type = GEN_URI; ^~~~~~~ ../src/crypto/tls_wolfssl.c: In function 'wolfssl_tls_cert_event': ../src/crypto/tls_wolfssl.c:902:20: error: 'GEN_EMAIL' undeclared (first use in this function); did you mean 'ENAVAIL'? if (gen->type != GEN_EMAIL && ^~~~~~~~~ ENAVAIL ../src/crypto/tls_wolfssl.c:903:20: error: 'GEN_DNS' undeclared (first use in this function) gen->type != GEN_DNS && ^~~~~~~ ../src/crypto/tls_wolfssl.c:904:20: error: 'GEN_URI' undeclared (first use in this function) gen->type != GEN_URI) ^~~~~~~ Makefile:2029: recipe for target '../src/crypto/tls_wolfssl.o' failed Fixes: 00722a720c77 ("wolfssl: Update to version 4.5.0") Reported-by: Andre Heider <a.heider@gmail.com> Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* dnsmasq: abort dhcp_check on interface stateDavid Bauer2020-08-201-2/+2
| | | | | | | | | Abort the dhcp-check based on the interface instead of the carrier state. In cases where the interface is up but the carrier is down, netifd won't cause a dnsmasq reload, thus dhcp won't become active on this interface. Signed-off-by: David Bauer <mail@david-bauer.net>
* dropbear: allow disabling support for scpRui Salvaterra2020-08-152-4/+10
| | | | | | | | | | | | | If not needed, disabling scp allows for a nice size reduction. Dropbear executable size comparison: 153621 bytes (baseline) 133077 bytes (without scp) In other words, we trim a total of 20544 bytes. Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
* dropbear: fix ssh alternative when dbclient isn't builtRui Salvaterra2020-08-121-3/+3
| | | | | | | The ssh symlink was still being created even when dbclient was disabled in the build configuration. Fix this annoyance. Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
* ppp: update to latest git HEADHans Dedecker2020-08-115-9/+9
| | | | | | | | | | | | 677aa53 Fix -W option for pppoe-discovery utility (#157) 115c419 Accept Malformed Windows Success Message (#156) 5bdb148 pppd: Add documentation of stop-bits option to pppd man page (#154) 2a7981f Add ipv6cp-accept-remote option 0678d3b pppd: Fix the default value for ipv6cp-accept-local to false Refresh patches Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* hostapd: recognize option "key" as alias for "auth_secret"Jo-Philipp Wich2020-08-072-2/+2
| | | | | | | | | | | | | | The hostapd configuration logic is supposed to accept "option key" as legacy alias for "option auth_secret". This particular fallback option failed to work though because "key" was not a registered configuration variable. Fix this issue by registering the "key" option as well, similar to the existing "server" nad "port" options. Ref: https://github.com/openwrt/openwrt/pull/3282 Suggested-by: Michael Jones <mike@meshplusplus.com> Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* hostapd: make "key" option optional if "wpa_psk_file" is providedJo-Philipp Wich2020-08-071-5/+5
| | | | | | | | | | | | | If an existing "wpa_psk_file" is passed to hostapd, the "key" option may be omitted. While we're at it, also improve the passphrase length checking to ensure that it is either exactly 64 bytes or 8 to 63 bytes. Fixes: FS#2689 Ref: https://github.com/openwrt/openwrt/pull/3283 Suggested-by: Michael Jones <mike@meshplusplus.com> Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* hostapd: add wpad-basic-wolfssl variantPetr Štetiar2020-08-072-0/+16
| | | | | | | | | Add package which provides size optimized wpad with support for just WPA-PSK, SAE (WPA3-Personal), 802.11r and 802.11w. Signed-off-by: Petr Štetiar <ynezz@true.cz> [adapt to recent changes, add dependency for WPA_WOLFSSL config] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* dnsmasq: abort when dnssec requested but not availableYousong Zhou2020-08-072-3/+7
| | | | | | | | | | | | | | | | | | | | | | Before this commit, if uci option "dnssec" was set, we pass "--dnssec" and friends to dnsmasq, let it start and decide whether to quit and whether to emit message for diagnosis # dnsmasq --dnssec; echo $? dnsmasq: DNSSEC not available: set HAVE_DNSSEC in src/config.h 1 DNSSEC as a feature is different from others like dhcp, tftp in that it's a security feature. Better be explicit. With this change committed, we make it so by not allowing it in the first in the initscript, should dnsmasq later decides to not quit (not likely) or quit without above explicit error (unlikely but less so ;) So this is just being proactive. on/off choices with uci option "dnssec" are still available like before Link: https://github.com/openwrt/openwrt/pull/3265#issuecomment-667795302 Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-10 02:59:27 +0000