Current version of ath10k in the recently updated wireless-testing
package requires a new firmware. This patch fixes the issue.
v2:
* fix (hopefully) the mangled whitespaces
* actually install the new firmware instead of the old
Signed-off-by: Matti Laakso <malaakso@elisanet.fi>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38835 3c298f89-4303-0410-b956-a3cf2f4a3e73
This patch was copied from a more recent backports versions. This fixes
a build problem with kernel < 3.6.
This closes#14475
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38833 3c298f89-4303-0410-b956-a3cf2f4a3e73
move log service from procd to ubox
some debloating on procd
the preinit part of procd is now also a seperate binary
Signed-off-by: John Crispin <blogic@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38822 3c298f89-4303-0410-b956-a3cf2f4a3e73
The correct bits are now cleared in the IPv6 address as the shift
value to the correct byte in the IPv6 address was wrong. Depending
on the stack values this could result in a hanging 6rdcalc program
due to an endless loop.
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38818 3c298f89-4303-0410-b956-a3cf2f4a3e73
RIPEMD is needed to update erlang and i'd like to enable RIPEMD160 support in openssh.
Size compared:
openssl without RIPEMD/160 support:
647K 29. Okt 20:00 bin/ar71xx/packages/libopenssl_1.0.1e-2_ar71xx.ipk
openssl with RIPEMD/160 support:
652K 8. Nov 15:11 bin/ar71xx/packages/libopenssl_1.0.1e-2_ar71xx.ipk
So the file size just grows ~5kb, which shouldn't be a problem.
Signed-off-by: Peter Wagner <tripolar@gmx.at>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38809 3c298f89-4303-0410-b956-a3cf2f4a3e73
The current implementation of mtd will not append the backup
file created by sysupgrade to the correct partition, as mtd will append
the data to first jffs2 partition it finds. As the kernel is also
stored on a jffs2 partition (which resides before the overlay
partition), the data will be appended to this partition.
To fix this problem, a new option
-s <number> skip the first n bytes when appending data to the jffs2 partiton, defaults to "0"
is added to mtd.
Signed-off-by: Peter Wagner <tripolar@gmx.at>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38807 3c298f89-4303-0410-b956-a3cf2f4a3e73
In commit r38690, the MAC address canonicalization
has been converted to use 'tr' instead of 'printf'.
This only works if with MAC addresses which uses
the 'xx:xx:xx:xx:xx:xx' format.
However on some boards, the MAC addresses are stored
in different format in the mtd partition. Some vendors
are using hyphens or dots as separators instead of
colons. Also the leading zeroes may be missing from the
individual octets or those are replaced with spaces.
Add a new function which can be used to convert these
into the 'xx:xx:xx:xx:xx:xx' format. Also update the
'mtd_get_mac_ascii' function to use the new helper.
The helper function is based on this code:
http://isquared.nl/blog/2010/08/11/Bash-function-to-canonicalize-MAC-addresses/
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38803 3c298f89-4303-0410-b956-a3cf2f4a3e73
This was copied from wireless-regdb.git commit a14052b85e5d70e37a31962a9c56c0cdbb9acafc
The passive-scan/no-ibss flag of channels 36-48 in the world regd were
removed like it was done in r32126.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38797 3c298f89-4303-0410-b956-a3cf2f4a3e73
swapon/swapoff are no longer provided by swap-utils; they are provided
by block-mount instead.
Signed-off-by: Nathan Hintz <nlhintz@hotmail.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38795 3c298f89-4303-0410-b956-a3cf2f4a3e73
this includes the first wip version of the uci validation backend
Signed-off-by: John Crispin <blogic@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38786 3c298f89-4303-0410-b956-a3cf2f4a3e73
- enable building uboot for imx23 along sbImage by default
- (doc updated)
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38781 3c298f89-4303-0410-b956-a3cf2f4a3e73
Fixes failsafe issues with switches after r38725.
Signed-off-by: Luka Perkov <luka@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38770 3c298f89-4303-0410-b956-a3cf2f4a3e73
'nas' requires probe of 'wds' devices to be successful;
so don't fail them.
Signed-off-by: Nathan Hintz <nlhintz@hotmail.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38763 3c298f89-4303-0410-b956-a3cf2f4a3e73
When enabling multiple VIFS, the driver sometimes crashes. The frequency
of the crash increases as more VIFS are enabled.
Signed-off-by: Nathan Hintz <nlhintz@hotmail.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38762 3c298f89-4303-0410-b956-a3cf2f4a3e73
Read the number of virtual interfaces to support from the device
capabilities; as some newer devices can support up to 16.
Signed-off-by: Nathan Hintz <nlhintz@hotmail.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38759 3c298f89-4303-0410-b956-a3cf2f4a3e73
Some devices initialize with a default address (common to all H/W).
The address needs to be changeable so that a unique address can be
assigned to each AP.
Signed-off-by: Nathan Hintz <nlhintz@hotmail.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38757 3c298f89-4303-0410-b956-a3cf2f4a3e73
Default gmode to "GOnly" unless explicitly overwridden. This corrects
processing for 11ng to specify "GOnly" for gmode instead of "Auto"
(which translated to "bg").
Signed-off-by: Nathan Hintz <nlhintz@hotmail.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38754 3c298f89-4303-0410-b956-a3cf2f4a3e73
'nas' must be shutdown independently for each 'wl' device to properly
support devices with multiple radios. Do the shutdown when the device
is disabled instead of when it is brought up.
Signed-off-by: Nathan Hintz <nlhintz@hotmail.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38753 3c298f89-4303-0410-b956-a3cf2f4a3e73
A single instance of 'nas' can support multiple interfaces; there's
no need to run multiple instances.
Signed-off-by: Nathan Hintz <nlhintz@hotmail.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38752 3c298f89-4303-0410-b956-a3cf2f4a3e73
Modify the band reporting for broadcom devices to correctly report
HW capability. Currently, 802.11na devices report "bgn"; but should be
reporting "an".
Signed-off-by: Nathan Hintz <nlhintz@hotmail.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38749 3c298f89-4303-0410-b956-a3cf2f4a3e73
'netifd' treats all devices with a "." in their name as vlan devices.
Modify the name of virtual/WDS interfaces created by broadcom-wl to use
a "-" instead of a ".", so they will be treated as simple devices
by 'netifd'.
Signed-off-by: Nathan Hintz <nlhintz@hotmail.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38748 3c298f89-4303-0410-b956-a3cf2f4a3e73
Delete the return value (nvram_exit is declared with a 'void' return).
Signed-off-by: Nathan Hintz <nlhintz@hotmail.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38747 3c298f89-4303-0410-b956-a3cf2f4a3e73
The associations list for Broadcom WDS interfaces are duplicate to those
reported by the corresponding AP interface; so there is no need to report
them again.
Signed-off-by: Nathan Hintz <nlhintz@hotmail.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38746 3c298f89-4303-0410-b956-a3cf2f4a3e73
Modify the hwmodelist reporting for broadcom devices to include
proper reporting of 802.11n support.
Signed-off-by: Nathan Hintz <nlhintz@hotmail.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38745 3c298f89-4303-0410-b956-a3cf2f4a3e73
make sure that automatic respawning is turned off during upgrade
Signed-off-by: John Crispin <blogic@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38695 3c298f89-4303-0410-b956-a3cf2f4a3e73
The mtd_get_mac_ascii utility function was broken. This fixes it.
- Remove the superfluous include of /lib/functions.sh. The
function is already in that file so it is pointless,
- only use a variable if the whole key word matches,
- don't try to process the MAC address if it is empty,
- use 'tr' to canonicalize the MAC address,
Signed-off-by: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us>
[juhosg: add more fixes, update commit message]
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38690 3c298f89-4303-0410-b956-a3cf2f4a3e73
support for specifying swap priority from the command line
Signed-off-by: John Crispin <blogic@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38679 3c298f89-4303-0410-b956-a3cf2f4a3e73
adds support for events in the lua binding
Signed-off-by: John Crispin <blogic@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38678 3c298f89-4303-0410-b956-a3cf2f4a3e73
swapon/swapoff are no longer provided by swap-utils, so remove them from
the description as well.
Signed-off-by: Nathan Hintz <nlhintz@hotmail.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38672 3c298f89-4303-0410-b956-a3cf2f4a3e73
'swapon/swapoff' are now provided by 'block-mount'; enabling them by default in busybox is no longer required and adds unnecessary bloat.
Signed-off-by: Nathan Hintz <nlhintz@hotmail.com>
Signed-off-by: John Crispin <blogic@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38671 3c298f89-4303-0410-b956-a3cf2f4a3e73
Only reload hostname and timezone config on /etc/init.d/boot restart.
Module loading and basic boot setup is only done during boot.
Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38670 3c298f89-4303-0410-b956-a3cf2f4a3e73
The jffs2_ready() function in mount_root.c checks
the presence of various JFFS2 markers at the start
of a given MTD device. The function works on NOR
flashes because JFFS2 puts 'cleanmarker' nodes at
the start of freshly erased blocks.
However if jffs2 is used on a MTD device emulated
by the gluebi layer, the 'cleanmarker' nodes are
not present and the jffs2_ready() function fails.
Update the code to handle jffs2 correctly even on
MTD devices emulated by the gluebi layer.
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38654 3c298f89-4303-0410-b956-a3cf2f4a3e73
Changeset r36943 ("dnsmasq: use host-record instead of address") removed
the automatic domain expansion for config domain sections, this breaks
existing setups and alters the old behaviour in unexpected ways, therfore
restore behaviour of the current stable release.
Additionally handle fully qualified hostnames properly when setting up the
own hostrecord by stripping the local domain part form the given name
instead of unconditionally appending it, so that "example.lan" results
in "example example.lan" and not "example.lan example.lan.lan".
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38648 3c298f89-4303-0410-b956-a3cf2f4a3e73
- clean up duplication of procd instance handling code
- using --cd *after* --config is rather pointless
- to be able to log errors properly, --syslog needs to be passed before --config
- tell procd about the generated or referenced config file instead of
the uci file. this avoids having to restart all instances if only one
of them changes.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38632 3c298f89-4303-0410-b956-a3cf2f4a3e73
Un-reverts the previous update commit and forward-ports the patch
to improve legacy SSLv2 handshake handling.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38609 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Various RFC compliance fixes (thanks to Hans Dedecker)
* Fix RA spam filter logic causing ipv6 connection issues
* Fix parameters -F and -P being order dependent
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38577 3c298f89-4303-0410-b956-a3cf2f4a3e73
Reverts the CyaSSL version bump for now since the update completely broke
trunk building due to incompatible changes in the IO callback API which in
turn breaks the core ustream-ssl package.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38576 3c298f89-4303-0410-b956-a3cf2f4a3e73
This package is required for network drivers such as pcnet32
Signed-off-by: Florian Fainelli <florian@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38530 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Use network.interface dump call instead of individual status calls
to reduce overall netifd lookups and invokes to 1 per fw3 process.
* Allow protocol handlers to assign a firewall zone for an interface
in the data section to allow for dynamic firewall zone assignment.
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38504 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Add ubus methods for global interface status
* Add ubus function to create nested interfaces
* Add protocol update notifications and hotplug legacy calls
* Fix: key to data elements point at wrong memory area
* Add support for source-restricted routes
* Add option "delegate" to toggle prefix delegation
* Reevaluate target routes also on interface update
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38453 3c298f89-4303-0410-b956-a3cf2f4a3e73
wpa_supplicant expects beacon_int instead of beacon_interval in its config
file.
Signed-off-by: Bruno Randolf <br1@einfach.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38451 3c298f89-4303-0410-b956-a3cf2f4a3e73
A similar change was recently merged in iw commit
58b46da26ab9b5ff31c7033e175351eb1301d9af
Signed-off-by: Bruno Randolf <br1@einfach.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38449 3c298f89-4303-0410-b956-a3cf2f4a3e73
There are several cases within 'luci' that attempt to access the interface
'type' from within the 'type' specific meta tables; however, 'type' is not
currently available there. Replicate the common metadata in the 'type'
specific meta tables.
Signed-off-by: Nathan Hintz <nlhintz@hotmail.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38448 3c298f89-4303-0410-b956-a3cf2f4a3e73
Possible parameters are yes, no and adaptive. See manpage for more information.
Signed-off-by: Philipp Borgers <borgers@mi.fu-berlin.de>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38412 3c298f89-4303-0410-b956-a3cf2f4a3e73
Fixes issues with UBIFS file system when due to unclean shutdown files would
end up with size 0. Furthermore, few style fixes are included too.
Signed-off-by: Luka Perkov <luka@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38410 3c298f89-4303-0410-b956-a3cf2f4a3e73
Also, scripts can be installed as data so let's change that here too.
Signed-off-by: Luka Perkov <luka@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38403 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Make SOL_MAX_RT configurable and default back to 120s
* Prefer servers with bigger prefixes (allows to use Comcast /60)
* Don't hang indefinitely if DHCPv6 REQUEST is not answered
Signed-off-by: Steven Barth <steven@midlink.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38393 3c298f89-4303-0410-b956-a3cf2f4a3e73
The kmodloader executable disregarded the global directory prefix in
scan_module_folder() leading to a broken extroot for non-builtin modules.
Update to current git head to fix the prefix handling again.
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38392 3c298f89-4303-0410-b956-a3cf2f4a3e73
This is to work around issues with package list generators creating
empty fields in some environments.
Based on a patch by Paul Selkrik <pselkrik@isc.org>
Signed-off-by: Steven Barth <steven@midlink.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38390 3c298f89-4303-0410-b956-a3cf2f4a3e73
ping is now working for me with -Os on brcm47xx.
This revert r26278.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38389 3c298f89-4303-0410-b956-a3cf2f4a3e73
The switch driver is not used by brcm47xx any more and can be removed,
instead of this switch driver b53 is used now.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38387 3c298f89-4303-0410-b956-a3cf2f4a3e73
Config options in backports are starting with CPTCFG and not with CONFIG_.
CONFIG_B43_BCMA was never true.
This closes#13883.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38385 3c298f89-4303-0410-b956-a3cf2f4a3e73
These URLs where missing and causes build failures.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38376 3c298f89-4303-0410-b956-a3cf2f4a3e73
Fixes compilation for linux 3.10.
Signed-off-by: Jonas Gorski <jogo@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38367 3c298f89-4303-0410-b956-a3cf2f4a3e73
Update proc code to new proc_create to allow compilation with
linux 3.10+.
Signed-off-by: Jonas Gorski <jogo@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38366 3c298f89-4303-0410-b956-a3cf2f4a3e73
There are certain consumer devices which are outliers in protocol conformance.
An example is Samsung bluray players, which require broadcast DHCP responses
(on Ethernet only, strangely not on Wifi).
By specifying:
config host
...
option broadcast 1
this will enable the response to be sent as an Ethernet broadcast and not as
a unicast.
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38365 3c298f89-4303-0410-b956-a3cf2f4a3e73
- do not insert duplicate rules when setting up reflection to a zone containing multiple interfaces
- set up reflection for any protocol, not just TCP and UDP
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38361 3c298f89-4303-0410-b956-a3cf2f4a3e73
proto_pptp_setup is responsible for loading the required modules to establish
a pptp connection to a foreign peer. The function checks whether all required
modules are already loaded, before actually loading them.
It seems that the filter being used to accomplish this, is not restrictive
enough in some cases. For instance when pptp nat helper modules are present on
a system, and already loaded before a pptp connection is enabled. Then the
search filter (possibly) returns the following for module=pptp, where actually
no matches are expected, resulting in the pptp.ko module not being loaded,
thereby failing to establish the pptp connection.
# module="pptp" ; grep "$module" /proc/modules
nf_nat_pptp 1312 0 - Live 0x86ce7000
nf_conntrack_pptp 3072 1 nf_nat_pptp, Live 0x86cb9000
nf_nat_proto_gre 784 1 nf_nat_pptp, Live 0x86cba000
nf_conntrack_proto_gre 2368 1 nf_conntrack_pptp, Live 0x86cbf000
nf_nat 9792 13 nf_nat_rtsp,nf_nat_tftp,nf_nat_sip,nf_nat_pptp,nf_nat_h323,nf_nat_proto_gre,nf_nat_amanda,nf_nat_irc,nf_nat_ftp,ipt_REDIRECT,ipt_NETMAP,ipt_MASQUERADE,iptable_nat, Live 0x86ca8000
nf_conntrack 37264 31 nf_nat_rtsp,nf_conntrack_rtsp,nf_nat_tftp,nf_conntrack_tftp,nf_nat_snmp_basic,nf_conntrack_snmp,nf_nat_sip,nf_conntrack_sip,nf_nat_pptp,nf_conntrack_pptp,nf_nat_h323,nf_conntrack_h323,nf_conntrack_proto_gre,nf_nat_amanda,nf_conntrack_amanda,nf_conntrack_broadcast,nf_nat_irc,nf_conntrack_irc,nf_nat_ftp,nf_conntrack_ftp,ipt_MASQUERADE,iptable_nat,nf_nat,xt_helper,xt_connmark,xt_connbytes,xt_conntrack,xt_CT,xt_NOTRACK,xt_state,nf_conntrack_ipv4, Live 0x86c90000
The search filter can be made more accurate/restrictive, by requiring the
occurance of the exact name of the module at the beginning of a line in
/proc/modules.
# module="pptp" ; grep "^$module " /proc/modules
pptp 13296 2 - Live 0x86e80000
Signed-off-by: Tijs Van Buggenhout <tvb@able.be>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38358 3c298f89-4303-0410-b956-a3cf2f4a3e73
Currently, in order to configure the authentication daemon in
8021x mode, we need to set wireless.@wifi-iface[0].encryption="wpa"
Though it works it confuses folks as 8021x is using WEP
encryption and not WPA. Therefore the terminology itself is
confusing. This change adds 8021x as a recognized string for 8021x
authentication.
Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38339 3c298f89-4303-0410-b956-a3cf2f4a3e73
Setting wireless.@wifi-iface[N].ext_registrar=1 will enable UPNP
advertising and add an external registrar to the interface this vif
belongs to (br-lan if the vif is included in the LAN bridge). By
enabling this we append upnp_iface=xxx to the hostapd config file.
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38338 3c298f89-4303-0410-b956-a3cf2f4a3e73
Enable CONFIG_WPS2 for hostapd. This is required to support
options like Virtual Push Button in WPS.
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38337 3c298f89-4303-0410-b956-a3cf2f4a3e73
In 2009 OpenWrt's hostapd config added an "auth_cache" boolean
to be used to address a reported issue #12129 [0] on a forum [1].
The reported issue on the ticket is different that the one
described on the forum. The commit was r33359. This change broke
proper RSN preauthentication [2] [3] [4] expectations on hostapd's
configuration for WPA2 and this in turn disabled PMKSA caching and
Opportunistic Key Caching. This change:
* Leaves the "auth_cache" to be used only for WPA networks for those
looking to use this as a workaround to a reported issue but annotates
a warning over its usage.
* Separate "auth_cache" from WPA2 RSN preauthentication, leaving
WPA2 RSN preauthentication to enabled only with "rsn_preauth" with
the expected and recommended settings.
* Adds a new WPA2 RSN preauthentication "rsn_preauth_testing" to
be used when evaluating funcionality for WPA2 RSN preauthentication
with the expected and recommended settings with the only difference
so far with what should be enabled by default to disable Opportunistic
Key Caching.
Disabling the PMKSA cache should mean the STA could not roam off and back
onto the AP that had PMKSA caching disabled and would require a full
authentication cycle. This fixes this for WPA2 networks with
RSN preauthentication enabled.
This change should be applied to AA as well as trunk.
TL DR;
The issue described on the forum has to do with failure of a STA
being able to try to authenticate again with the AP if it failed
its first try. This may have been an issue with hostapd in 2009
but as per some tests I cannot reproduce this today on a WPA2
network.
The issue described on the ticket alludes to a security issue with the
design of using a Radius server to authenticate to an AP. The issue
vaguely alludes to the circumstances of zapping a user, deleting their
authentication credentials to log in to the network, and that if
RSN preauthentication is enabled with PMKSA caching that the user
that was zapped would still be able to authenticate.
Lets treat these as separate issues.
I cannot reproduce the first issue reported on the forums of not
being able to authenticate anymore on a WPA2 network.
The issue reported on the ticket modified WPA2 RSN preauthentication
by adding two fields to the hostapd configuration if auth_cache
was enabled:
* disable_pmksa_caching=1
* okc=0
The first one disables PMKSA authentication cache.
The second one disables Opportunistic Key Caching.
The issue reported on the ticket was fixed by implementing a workaround
in hostapd's configuration. Disabling PMKSA caching breaks proper use
of WPA2 RSN pre authentication. The usage of disable_pmksa_caching=1
prevents hostapd from adding PMKSA entries into its cache when a successful
802.1x authentication occurs. In practice RSN preauthentication would
trigger a STA to perform authentication with other APs on the same SSID,
it would then have its own supplicant PMKSA cache held. If a STA roams
between one AP to another no new authenitcation would need to be performed
as the new AP would already have authenticated the STA. The purpose of the
PMKSA cache on the AP side would be for the AP to use the same PMKID for
a STA when the STA roams off onto another BSSID and later comes back to it.
Disabling Opportunistic Key Caching could help the reported issue
as well but its not the correct place to address this. Opportunistic
Key Caching enables an AP with different interfaces to share the
PMKSA cache. Its a technical enhancement and disabling it would
be useful to let a testing suite properly test for RSN preauthentication
given that otherwise Opportunistic Key Caching would enable an
interface being tested to derive its own derive the PMKSA entry.
In production though okc=1 should be enabled to help with RSN
preauthentication.
The real fix for this particular issue outside of the scope of hostapd's
configuration and it should not be dealt with as a workaround to
its configuration and breaking expected RSN preauthentication and
technical optimizations. Revert this change and enable users to pick
and choose to enable or disable disable_pmksa_caching and okc expecting them
to instead have read clearly more what these do.
As for the core issure ported, the correct place to fix this is to
enable a sort of messaging between the RADIUS server and its peers
so that if caching for authentication is enabled that cache can be
cleared upon user credential updates. Updating a user password
(not just zapping a user) is another possible issue that would need
to be resolved here. Another part of the solution might be to reduce
the cache timing to account for any systematic limitations (RADIUS
server not able to ask peers to clear cache might be
one).
[0] https://dev.openwrt.org/changeset/33359
[1] https://forum.openwrt.org/viewtopic.php?id=19596
[2] http://wireless.kernel.org/en/users/Documentation/hostapd#IEEE_802.11i.2FRSN.2FWPA2_pre-authentication
[3] http://wireless.kernel.org/en/users/Documentation/wpa_supplicant#RSN_preauthentication
[4] http://wiki.openwrt.org/doc/recipes/rsn_preauthentication
Signed-off-by: Luis R. Rodriguez <mcgrof@do-not-panic.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38336 3c298f89-4303-0410-b956-a3cf2f4a3e73
This adds the eap_reauth_period to be used for modifying
the RADIUS server reauthentication authentication period,
a parameter that gets passed directly to the hostapd
configuration file.
Signed-off-by: Mathieu Olivari <mathieu@qca.qualcomm.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38334 3c298f89-4303-0410-b956-a3cf2f4a3e73
WL_TI is bool but was set to =m, which deactivated it. Now it is set to
=y and should be activated in the config so the wl12xx driver gets
build.
This closes#14212.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38333 3c298f89-4303-0410-b956-a3cf2f4a3e73
Somehow BRCMFMAC_USB was not set in the build and brcmfmac.ko did not had usb support.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38332 3c298f89-4303-0410-b956-a3cf2f4a3e73
based on a patch by Evan Hunt <each@isc.org>
Signed-off-by: Steven Barth <steven@midlink.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38302 3c298f89-4303-0410-b956-a3cf2f4a3e73
Change the autoload number from '5' to '05' so the module loads earlier (as intended).
Signed-off-by: Nathan Hintz <nlhintz@hotmail.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38293 3c298f89-4303-0410-b956-a3cf2f4a3e73
Add package signing key and certificate configuration options to the
"Image configuration" submenu. If enabled, the Packages.gz list will
be signed as file Packages.sig. The passphrase for the signing key can
be sourced from a file or entered by the user. The signing certificate
is automatically added to the firmware image if opkg-smime is selected.
Signed-off-by: Evan Hunt <each@isc.org>
Signed-off-by: Steven Barth <steven@midlink.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38284 3c298f89-4303-0410-b956-a3cf2f4a3e73
this fixes the syslog problem when using eglibc on x86.
Signed-off-by: John Crispin <blogic@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38267 3c298f89-4303-0410-b956-a3cf2f4a3e73
After this change, "rmmod" and "modinfo" works even if the user gives
the file name spelling instead of the kernel internal one, so that e.g.
"rmmod nls_iso8859-1.ko" and "rmmod nls_iso8859_1" will both succeed.
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38252 3c298f89-4303-0410-b956-a3cf2f4a3e73
Instead of canonicalizing module names in the internal avl tree simpyl use a
custom strcmp() variant for the avl tree key comparisation. The custom comperator
simply treats dashes and underscores the same, so "nls_iso8859-15" is equal to
"nls-iso8859-15".
This allows us to simplify the code considerably and makes manual "modprobe"
invocations more forgiving when looking up the given module name.
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38248 3c298f89-4303-0410-b956-a3cf2f4a3e73
it has a conditional #ifdef based dependency on it, which trips up on
some targets
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38242 3c298f89-4303-0410-b956-a3cf2f4a3e73
Hauke Mehrtens
John Crispin
Steven Barth
Felix Fietkau
Gabor Juhos
Imre Kaloz
Zoltan HERPAI
Jo-Philipp Wich
Luka Perkov
Florian Fainelli
Jonas Gorski