* Use network.interface dump call instead of individual status calls
to reduce overall netifd lookups and invokes to 1 per fw3 process.
* Allow protocol handlers to assign a firewall zone for an interface
in the data section to allow for dynamic firewall zone assignment.
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38504 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Add ubus methods for global interface status
* Add ubus function to create nested interfaces
* Add protocol update notifications and hotplug legacy calls
* Fix: key to data elements point at wrong memory area
* Add support for source-restricted routes
* Add option "delegate" to toggle prefix delegation
* Reevaluate target routes also on interface update
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38453 3c298f89-4303-0410-b956-a3cf2f4a3e73
wpa_supplicant expects beacon_int instead of beacon_interval in its config
file.
Signed-off-by: Bruno Randolf <br1@einfach.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38451 3c298f89-4303-0410-b956-a3cf2f4a3e73
A similar change was recently merged in iw commit
58b46da26ab9b5ff31c7033e175351eb1301d9af
Signed-off-by: Bruno Randolf <br1@einfach.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38449 3c298f89-4303-0410-b956-a3cf2f4a3e73
There are several cases within 'luci' that attempt to access the interface
'type' from within the 'type' specific meta tables; however, 'type' is not
currently available there. Replicate the common metadata in the 'type'
specific meta tables.
Signed-off-by: Nathan Hintz <nlhintz@hotmail.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38448 3c298f89-4303-0410-b956-a3cf2f4a3e73
Possible parameters are yes, no and adaptive. See manpage for more information.
Signed-off-by: Philipp Borgers <borgers@mi.fu-berlin.de>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38412 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Make SOL_MAX_RT configurable and default back to 120s
* Prefer servers with bigger prefixes (allows to use Comcast /60)
* Don't hang indefinitely if DHCPv6 REQUEST is not answered
Signed-off-by: Steven Barth <steven@midlink.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38393 3c298f89-4303-0410-b956-a3cf2f4a3e73
ping is now working for me with -Os on brcm47xx.
This revert r26278.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38389 3c298f89-4303-0410-b956-a3cf2f4a3e73
The switch driver is not used by brcm47xx any more and can be removed,
instead of this switch driver b53 is used now.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38387 3c298f89-4303-0410-b956-a3cf2f4a3e73
These URLs where missing and causes build failures.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38376 3c298f89-4303-0410-b956-a3cf2f4a3e73
There are certain consumer devices which are outliers in protocol conformance.
An example is Samsung bluray players, which require broadcast DHCP responses
(on Ethernet only, strangely not on Wifi).
By specifying:
config host
...
option broadcast 1
this will enable the response to be sent as an Ethernet broadcast and not as
a unicast.
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38365 3c298f89-4303-0410-b956-a3cf2f4a3e73
- do not insert duplicate rules when setting up reflection to a zone containing multiple interfaces
- set up reflection for any protocol, not just TCP and UDP
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38361 3c298f89-4303-0410-b956-a3cf2f4a3e73
proto_pptp_setup is responsible for loading the required modules to establish
a pptp connection to a foreign peer. The function checks whether all required
modules are already loaded, before actually loading them.
It seems that the filter being used to accomplish this, is not restrictive
enough in some cases. For instance when pptp nat helper modules are present on
a system, and already loaded before a pptp connection is enabled. Then the
search filter (possibly) returns the following for module=pptp, where actually
no matches are expected, resulting in the pptp.ko module not being loaded,
thereby failing to establish the pptp connection.
# module="pptp" ; grep "$module" /proc/modules
nf_nat_pptp 1312 0 - Live 0x86ce7000
nf_conntrack_pptp 3072 1 nf_nat_pptp, Live 0x86cb9000
nf_nat_proto_gre 784 1 nf_nat_pptp, Live 0x86cba000
nf_conntrack_proto_gre 2368 1 nf_conntrack_pptp, Live 0x86cbf000
nf_nat 9792 13 nf_nat_rtsp,nf_nat_tftp,nf_nat_sip,nf_nat_pptp,nf_nat_h323,nf_nat_proto_gre,nf_nat_amanda,nf_nat_irc,nf_nat_ftp,ipt_REDIRECT,ipt_NETMAP,ipt_MASQUERADE,iptable_nat, Live 0x86ca8000
nf_conntrack 37264 31 nf_nat_rtsp,nf_conntrack_rtsp,nf_nat_tftp,nf_conntrack_tftp,nf_nat_snmp_basic,nf_conntrack_snmp,nf_nat_sip,nf_conntrack_sip,nf_nat_pptp,nf_conntrack_pptp,nf_nat_h323,nf_conntrack_h323,nf_conntrack_proto_gre,nf_nat_amanda,nf_conntrack_amanda,nf_conntrack_broadcast,nf_nat_irc,nf_conntrack_irc,nf_nat_ftp,nf_conntrack_ftp,ipt_MASQUERADE,iptable_nat,nf_nat,xt_helper,xt_connmark,xt_connbytes,xt_conntrack,xt_CT,xt_NOTRACK,xt_state,nf_conntrack_ipv4, Live 0x86c90000
The search filter can be made more accurate/restrictive, by requiring the
occurance of the exact name of the module at the beginning of a line in
/proc/modules.
# module="pptp" ; grep "^$module " /proc/modules
pptp 13296 2 - Live 0x86e80000
Signed-off-by: Tijs Van Buggenhout <tvb@able.be>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38358 3c298f89-4303-0410-b956-a3cf2f4a3e73
Currently, in order to configure the authentication daemon in
8021x mode, we need to set wireless.@wifi-iface[0].encryption="wpa"
Though it works it confuses folks as 8021x is using WEP
encryption and not WPA. Therefore the terminology itself is
confusing. This change adds 8021x as a recognized string for 8021x
authentication.
Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38339 3c298f89-4303-0410-b956-a3cf2f4a3e73
Setting wireless.@wifi-iface[N].ext_registrar=1 will enable UPNP
advertising and add an external registrar to the interface this vif
belongs to (br-lan if the vif is included in the LAN bridge). By
enabling this we append upnp_iface=xxx to the hostapd config file.
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38338 3c298f89-4303-0410-b956-a3cf2f4a3e73
Enable CONFIG_WPS2 for hostapd. This is required to support
options like Virtual Push Button in WPS.
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38337 3c298f89-4303-0410-b956-a3cf2f4a3e73
In 2009 OpenWrt's hostapd config added an "auth_cache" boolean
to be used to address a reported issue #12129 [0] on a forum [1].
The reported issue on the ticket is different that the one
described on the forum. The commit was r33359. This change broke
proper RSN preauthentication [2] [3] [4] expectations on hostapd's
configuration for WPA2 and this in turn disabled PMKSA caching and
Opportunistic Key Caching. This change:
* Leaves the "auth_cache" to be used only for WPA networks for those
looking to use this as a workaround to a reported issue but annotates
a warning over its usage.
* Separate "auth_cache" from WPA2 RSN preauthentication, leaving
WPA2 RSN preauthentication to enabled only with "rsn_preauth" with
the expected and recommended settings.
* Adds a new WPA2 RSN preauthentication "rsn_preauth_testing" to
be used when evaluating funcionality for WPA2 RSN preauthentication
with the expected and recommended settings with the only difference
so far with what should be enabled by default to disable Opportunistic
Key Caching.
Disabling the PMKSA cache should mean the STA could not roam off and back
onto the AP that had PMKSA caching disabled and would require a full
authentication cycle. This fixes this for WPA2 networks with
RSN preauthentication enabled.
This change should be applied to AA as well as trunk.
TL DR;
The issue described on the forum has to do with failure of a STA
being able to try to authenticate again with the AP if it failed
its first try. This may have been an issue with hostapd in 2009
but as per some tests I cannot reproduce this today on a WPA2
network.
The issue described on the ticket alludes to a security issue with the
design of using a Radius server to authenticate to an AP. The issue
vaguely alludes to the circumstances of zapping a user, deleting their
authentication credentials to log in to the network, and that if
RSN preauthentication is enabled with PMKSA caching that the user
that was zapped would still be able to authenticate.
Lets treat these as separate issues.
I cannot reproduce the first issue reported on the forums of not
being able to authenticate anymore on a WPA2 network.
The issue reported on the ticket modified WPA2 RSN preauthentication
by adding two fields to the hostapd configuration if auth_cache
was enabled:
* disable_pmksa_caching=1
* okc=0
The first one disables PMKSA authentication cache.
The second one disables Opportunistic Key Caching.
The issue reported on the ticket was fixed by implementing a workaround
in hostapd's configuration. Disabling PMKSA caching breaks proper use
of WPA2 RSN pre authentication. The usage of disable_pmksa_caching=1
prevents hostapd from adding PMKSA entries into its cache when a successful
802.1x authentication occurs. In practice RSN preauthentication would
trigger a STA to perform authentication with other APs on the same SSID,
it would then have its own supplicant PMKSA cache held. If a STA roams
between one AP to another no new authenitcation would need to be performed
as the new AP would already have authenticated the STA. The purpose of the
PMKSA cache on the AP side would be for the AP to use the same PMKID for
a STA when the STA roams off onto another BSSID and later comes back to it.
Disabling Opportunistic Key Caching could help the reported issue
as well but its not the correct place to address this. Opportunistic
Key Caching enables an AP with different interfaces to share the
PMKSA cache. Its a technical enhancement and disabling it would
be useful to let a testing suite properly test for RSN preauthentication
given that otherwise Opportunistic Key Caching would enable an
interface being tested to derive its own derive the PMKSA entry.
In production though okc=1 should be enabled to help with RSN
preauthentication.
The real fix for this particular issue outside of the scope of hostapd's
configuration and it should not be dealt with as a workaround to
its configuration and breaking expected RSN preauthentication and
technical optimizations. Revert this change and enable users to pick
and choose to enable or disable disable_pmksa_caching and okc expecting them
to instead have read clearly more what these do.
As for the core issure ported, the correct place to fix this is to
enable a sort of messaging between the RADIUS server and its peers
so that if caching for authentication is enabled that cache can be
cleared upon user credential updates. Updating a user password
(not just zapping a user) is another possible issue that would need
to be resolved here. Another part of the solution might be to reduce
the cache timing to account for any systematic limitations (RADIUS
server not able to ask peers to clear cache might be
one).
[0] https://dev.openwrt.org/changeset/33359
[1] https://forum.openwrt.org/viewtopic.php?id=19596
[2] http://wireless.kernel.org/en/users/Documentation/hostapd#IEEE_802.11i.2FRSN.2FWPA2_pre-authentication
[3] http://wireless.kernel.org/en/users/Documentation/wpa_supplicant#RSN_preauthentication
[4] http://wiki.openwrt.org/doc/recipes/rsn_preauthentication
Signed-off-by: Luis R. Rodriguez <mcgrof@do-not-panic.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38336 3c298f89-4303-0410-b956-a3cf2f4a3e73
This adds the eap_reauth_period to be used for modifying
the RADIUS server reauthentication authentication period,
a parameter that gets passed directly to the hostapd
configuration file.
Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38334 3c298f89-4303-0410-b956-a3cf2f4a3e73
Otherwise it is started only on non-secure ports.
Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik@neratec.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38171 3c298f89-4303-0410-b956-a3cf2f4a3e73
now that we have modprobe we can set more than half of the modules to AutoProbe
Signed-off-by: John Crispin <blogic@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38021 3c298f89-4303-0410-b956-a3cf2f4a3e73
- fixes buffer corruption with JSON-RPC list calls
- change JSON-RPC protocol to include the session ID into the call
attributes instead of passing it via the URL
- forcibly pass effective session ID as "ubus_rpc_session" attribute
to called procedures
- change ubus acl checking to conform with new ubus session namespace
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37962 3c298f89-4303-0410-b956-a3cf2f4a3e73
Thanks to Berni, Adam Novak and Sedat Dilek for patches and inspiration
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37866 3c298f89-4303-0410-b956-a3cf2f4a3e73
hostapd supports "Dynamic Authorization Extensions", making it possible
to forcibly disconnect a user by sending it a RADIUS "Disconnect-Request"
packet.
I've added three new variables to enable setting of the
"radius_das_client" and "radius_das_port" variables in the hostapd
configuration, which enable these extensions.
* dae_client - IP of the client that can send disconnect requests
* dae_secret - shared secret for DAE packets
These are combined into the "radius_das_client" option in hostapd.conf
To enable the server, both dae_client and dae_secret must be set.
* dae_port - optional, default value is 3799 as specified in RFC 5176
Signed-off-by: Martijn van de Streek <martijn@vandestreek.net>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37734 3c298f89-4303-0410-b956-a3cf2f4a3e73
WEP in WDS is currently broken in hostapd. Add a patch
to fix the issue.
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37733 3c298f89-4303-0410-b956-a3cf2f4a3e73
Add a patch for hostapd that introduces a config option
"start_disabled" which can be used to bring up an AP
interface with beaconing disabled. This is useful in
a Repeater-AP setup where the Repeater AP has to start
beaconing only after the WDS link has been established.
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37730 3c298f89-4303-0410-b956-a3cf2f4a3e73
this patches updates openvpn to v2.3.2
and adds a PKG_MD5SUM to the Makefile
This release fixes a memory access violation when cipher none is used
on ar71xx - at least with my config
Signed-off-by: Peter Wagner <tripolar@gmx.at>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37560 3c298f89-4303-0410-b956-a3cf2f4a3e73
This patch modifies the uci scripts to be able to
start meshd-nl80211 for encrypted mesh networks,
therefor a new script (authsae.sh) is inserted.
Signed-off-by: Emanuel Taube <emanuel.taube@gmail.com>
[etienne.champetier@free.fr: just update mac80211.sh path]
Signed-off-by: Etienne CHAMPETIER <etienne.champetier@free.fr>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37554 3c298f89-4303-0410-b956-a3cf2f4a3e73
This patch adds authsae open80211s authentication daemon (http://open80211s.org)
It's a rework of Peter Naulls patch (http://patchwork.openwrt.org/patch/1350/)
I've excluded the sample conf file as it's useless when used with mac80211.sh (Emanuel Taube patch)
It now link against libnl-tiny instead of libnl (patch merged in authsae git)
Authsae is 58 Ko (OPENSSL_WITH_EC option adds 35Ko to libopenssl)
Signed-off-by: Peter Naulls <peter@chocky.org>
Signed-off-by: Etienne CHAMPETIER <etienne.champetier@free.fr>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37553 3c298f89-4303-0410-b956-a3cf2f4a3e73
- handles redirects as port relocations if the dest_ip points to the router itself
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37374 3c298f89-4303-0410-b956-a3cf2f4a3e73
The reap functionality appears to have been accidentally disabled by
commit 74ded7257e5da5e309844d386290f24ae91950a6 to iptables.git, see:
git://git.netfilter.org/iptables.git
and subsequently in iptables 1.4.15 and later. This adds a patch to
restore reap functionality for recent_opts_v1.
Signed-off-by: Russell Senior <russell@personaltelco.net>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37328 3c298f89-4303-0410-b956-a3cf2f4a3e73
with this option enabled it's possible to create empty bridges
Signed-off-by: Luka Perkov <luka@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37318 3c298f89-4303-0410-b956-a3cf2f4a3e73
This makes it possible to use swconfig to controll the switch.
This was tested with devices using b43 and bgmac.
This was not tested on devices using tg3.
This does not support the adm switch used in some very old devices.
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37304 3c298f89-4303-0410-b956-a3cf2f4a3e73
lldpd 0.7.1 has several alignment issues that trip a system configured
to fault on misaligned accesses. Version 0.7.5 fixes that along with a
few other minor issues.
Signed-off-by: John Szakmeister <john@szakmeister.net>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37168 3c298f89-4303-0410-b956-a3cf2f4a3e73
- uses custom formatting for mac addresses to ensure leading zeroes, required for older iptables mac match parser
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37082 3c298f89-4303-0410-b956-a3cf2f4a3e73
AVR32 misses a bunch of updated syscalls, including timerfd_create()
which is used by 6relayd. Since that requires Linux/libc changes, just
prevent building it for now.
Signed-off-by: Florian Fainelli <florian@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37040 3c298f89-4303-0410-b956-a3cf2f4a3e73
this cause the wps trigegr to be copied to the wrong place
https://dev.openwrt.org/ticket/13753
Signed-off-by: John Crispin <blogic@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37031 3c298f89-4303-0410-b956-a3cf2f4a3e73
Make hostapd.sh correctly handle the macfile uci option.
Such option specifies the macfile name to pass into the
hostapd configuration file. Moreover, if a maclist option
has been specified, copy the macfile before appending new
entries.
Signed-off-by: Antonio Quartulli <antonio@open-mesh.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36944 3c298f89-4303-0410-b956-a3cf2f4a3e73
Using "--address" for individual host A records is broken, use "--host-record" instead.
The following patch changes dnsmasq.init to build individual host records using "--host-record" instead of "--address".
Signed-off-by: Adam Gensler <openwrt at gnslr.us>
[jow: shorter description, simplified shell script code]
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36943 3c298f89-4303-0410-b956-a3cf2f4a3e73
- properly process intermediate "!" options in argument list (fixes negated ipsets)
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36935 3c298f89-4303-0410-b956-a3cf2f4a3e73
- fixes handling of reject target for rule sections with specific destination zone
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36933 3c298f89-4303-0410-b956-a3cf2f4a3e73
wpa_supplicant may send log and event messages intermixed with the
expected scan results. This makes "iwinfo wlan0 scan" and LuCI
"site survey" display nothing when many AP's are around.
Eliminate the CTRL-EVENT-BSS-ADDED events, interspersed log messages,
lines with unexpected format. Increase timeout to handle the max
number of channels (2.4, 3.6, 4.9, 5 GHz). Insure receive buffer is
null-terminated.
Signed-off-by: Jean-Pierre Tosoni <jp.tosoni@acksys.fr>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36888 3c298f89-4303-0410-b956-a3cf2f4a3e73
works around wifiX references not being freed on network restart.
Signed-off-by: Jonas Gorski <jogo@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36883 3c298f89-4303-0410-b956-a3cf2f4a3e73
- optimizes chain usage for ingress rules
- adds limit match support for redirect rules
- fixes automatic redirect dest detection on little endian systems
- leaves base chains in place on reload to allow user rules to target e.g. "reject"
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36871 3c298f89-4303-0410-b956-a3cf2f4a3e73
- simplifies using ipsets for rules and redirects, match direction can be specified in-place like option ipset 'setname src dst dst'
- uses zone_name_src_ACTION chains for input rules, this fixes logging with log enabled src zones
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36854 3c298f89-4303-0410-b956-a3cf2f4a3e73
- Fixes problems with reusing matches or targets from loadable extensions
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36826 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Make the "best" address / prefix the first one being announced
* Only add the "best" address to the hosts-file
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36772 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Announce delegated prefixes using route info according to RFC 6204 L-3
* Enable hybrid stateless + stateful DHCPv6-mode as default
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36738 3c298f89-4303-0410-b956-a3cf2f4a3e73
- allows building without IPv6 support
- uses more robust rules to cope with missing libext.a
- uses better linking strategy to avoid symbol clashes with older iptables
- introduces source compatiblity layer for different libxtables versions
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36736 3c298f89-4303-0410-b956-a3cf2f4a3e73
- allows symbolic notation for src_ip, src_dip and dest_ip options, e.g. option src_ip 'lan' to automatically resolve to "192.168.1.0/24"
- automatically infer destination zone for redirects from target ip, this makes 'dest' optional and nat reflection setup more robust
- properly support output rules with dest '*' to hook directly into delegate_output
- fixes crash when processing rules with unresolved targets
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36721 3c298f89-4303-0410-b956-a3cf2f4a3e73
- Use weak references for instantiating libext*.a matches, makes fw3 independant from the compile time features of iptables
- Do not leak memory when processing rules with unknown targets or matches
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36698 3c298f89-4303-0410-b956-a3cf2f4a3e73
- fixes reload when firewall is not running already
- fixes crash when ipsets are supported but undeclared
- fixes handling of per zone user chains on reload
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36689 3c298f89-4303-0410-b956-a3cf2f4a3e73
- fixes segfault in flush command if ipset support is not available
- fixes internal rule generation if custom chains are enabled
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36686 3c298f89-4303-0410-b956-a3cf2f4a3e73
* use libiptc and libxtables directly to manage ruleset, iptables-restore is unreliable and prone to race conditions
* make ipset integration more reliable
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36681 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Be more standards-compliant in stateful mode
* Handle hostnames from Windows-clients correctly
* Handle messages from DHCPv6-relays better
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36677 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Add management_level option (0: set O-flag, >=1: set M-flag)
* Add support for static DHCPv6-leases
* Various fixes for DHCPv6-PD
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36654 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Add interface option to set routing table for protocol routes
* Enabled for IPv6 for source-based filtering, disabled for IPv4
Based on a patch by Kristian Evensen. Thank You.
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36653 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Add support for IP-in-IPv6 tunnels (DS-Lite)
* Use source-based routing for IPv6 to allow multi-wan
* Various smaller tunnel setup improvements
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36627 3c298f89-4303-0410-b956-a3cf2f4a3e73
This patch simply adds support for the "--proxy-dnssec" command in dnsmasq into the init file so it can be used with /etc/config/dhcp.
Signed-off-by: Adam Gensler <openwrt@kristenandadam.net>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36570 3c298f89-4303-0410-b956-a3cf2f4a3e73
Previously if the upstream router did not provide any DHCPv6-service
the wan6 interface would not come up even if RAs were received. The new
behavior allows the wan6 interface to comeup with RA-only configuration
after a timeout of 10s.
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36555 3c298f89-4303-0410-b956-a3cf2f4a3e73
- assume "tcp+udp" if no protcol is specified in rules or redirects (#13422, #13386)
- add support for fwmark matches and mark setting targets
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36521 3c298f89-4303-0410-b956-a3cf2f4a3e73
libiptc.pc depends on libip[4|6]tc.pc, thus all of those need to be
installed.
Should fix collectd build and thus #13146; which should make collectd
appear in snapshots again.
Signed-off-by: Danny Baumann <dannybaumann@web.de>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36509 3c298f89-4303-0410-b956-a3cf2f4a3e73
This fixes working behind another router which gives out ULAs.
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36416 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Add preliminary support for RFC 6603 prefix exclusion
* Fix reconfigure-support and reconfigure authentication
* Set maximum retransmission timeout for solicitations to 2h
* Fix a segfault when parsing IA_PD in advertise messages
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36382 3c298f89-4303-0410-b956-a3cf2f4a3e73
make the syntax more compatible with kernel menuconfig
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36351 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Fix a memory corruption when updating IPv6 prefixes
* Fix route sorting order (nbd)
* Add support for ip rules (jow)
* Implement support for route / route6 table attribute (jow)
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36196 3c298f89-4303-0410-b956-a3cf2f4a3e73
Thanks to Markus Stenberg for investigating and providing a fix
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36132 3c298f89-4303-0410-b956-a3cf2f4a3e73
* fixes parsing of src/dest '*'
* fixes parsing of proto 'all'
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36111 3c298f89-4303-0410-b956-a3cf2f4a3e73
This patch fixes some compile problems with kernel 3.9 and adds some missing linux 3.9 handling into kernel packages.
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36098 3c298f89-4303-0410-b956-a3cf2f4a3e73
* fixes reload handling of zones and ipsets that are still running but already deleted from the config
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36092 3c298f89-4303-0410-b956-a3cf2f4a3e73
- support network names in per-zone 'masq_src', 'masq_dest' and 'subnet' options (#13197)
- do not allow src_mac option for SNAT rules
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36090 3c298f89-4303-0410-b956-a3cf2f4a3e73
Supports listing, removing and banning clients, and hooking into
probe/assoc/auth requests via object subscribe.
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36081 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Introduce "option reload" for includes to specify whether includes should be processed on reload (e.g. when tapping into internal chains)
* Allow "network" and "device" commands while firewall is running (to make them usable in includes)
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36009 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Adds support for emitting hotplug events when creating and clearing zones (fixes miniupnpd)
* Make NAT reflection direction configurable
* Map init script stop action to flush
* Map init script reload action to reload
* Respect init script disabled state in hotplug handler
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35998 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Fixes compilation against eglibc
* Fixes tracking logic when selectively restarting IPv4 or IPv6 firewall
* Fixes tracking logic for user chains by differentiating between reloads and restarts
* Introduces per-zone user chains {input,output,forwarding,prerouting,postrouting}_$zone_rule
* Supports legacy "tcpudp" protocol notation again
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35969 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Don't prematurely send RENEW / REBIND when T1 or T2 is > 1 day
* Add "norelease" option to not send a RELEASE when stopping
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35902 3c298f89-4303-0410-b956-a3cf2f4a3e73
Spurious errors when receiving netlink-messages lead to unhandled errors
which caused SIGBUS. Thanks to tdavis for debugging
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35836 3c298f89-4303-0410-b956-a3cf2f4a3e73
cap preferred and valid lifetimes at more reasonable limits
decrease memory usage (remove unnecessary book-keeping)
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35835 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Announce ULA as deprecated if other addresses are available
* Allow the announced DNS-server to be overwritten
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35803 3c298f89-4303-0410-b956-a3cf2f4a3e73
- all uci rules are boxed in custom chains now, so a firewall stop leaves user rules intact
- properly handle selective ipv4 or ipv6 only firewall start/stop/restart actions
- support ip ranges (e.g. option src_ip '!192.168.1.1-192.168.1.100' -> -m iprange ! --src-range 192.168.1.1-192.168.1.100')
- support time options (e.g. option weekdays 'Mon Tue Sat' -> -m time --weekdays 1,2,6')
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35738 3c298f89-4303-0410-b956-a3cf2f4a3e73
Spotted by doing an ARM hard float build.
Signed-off-by: Florian Fainelli <florian@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35685 3c298f89-4303-0410-b956-a3cf2f4a3e73
Based on a patch from НКВД. Closes#12962.
Signed-off-by: Jonas Gorski <jogo@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35610 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Don't send undesired suggestions for preferred and valid lifetimes
* Be less verbose in logging
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35553 3c298f89-4303-0410-b956-a3cf2f4a3e73
- reduce mssfix related log spam (#10681)
- separate src and dest terminal chains (#11453, #12945)
- disable per-zone custom chains by default, they're rarely used
Additionally introduce options "device", "subnet", "extra", "extra_src" and "extra_dest"
to allow defining zones not related to uci interfaces, e.g. to match "ppp+" or any tcp
traffic to and from a specific port.
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35484 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Fix reloading of ula-prefixes
* Added support for temporary addresses and routes
* Added support for offlink addresses
* Improved status-output for assigned prefixes
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35420 3c298f89-4303-0410-b956-a3cf2f4a3e73
Steven Barth
Jo-Philipp Wich
Luka Perkov
Hauke Mehrtens
Felix Fietkau
Gabor Juhos
John Crispin
Vasilis Tsiligiannis
Florian Fainelli
Jonas Gorski