Commit Graph

4015 Commits

Author SHA1 Message Date
Tianling Shen
843fdec0fe
Revert "firewall3: fix locking issue"
This patch was upstreamed already.

This reverts commit 89f7addccd.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2022-06-07 06:37:38 +08:00
Tianling Shen
ccd0c25d49
Merge Official Source
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2022-06-06 17:58:44 +08:00
Stijn Tintel
d5e48a1e8e hostapd: drop wnm_disassoc_imminent
All known users of this ubus method have been updated to use the new
bss_transition_request method instead.

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Acked-by: David Bauer <mail@david-bauer.net>
2022-06-06 11:19:20 +03:00
ZiMing Mo
89f7addccd
firewall3: fix locking issue
(cherry picked from commit c7a557861a)
2022-06-04 18:15:53 +08:00
Tianling Shen
3272539aaa
dnsmasq: enable cache by default
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2022-06-03 23:13:26 +08:00
Tianling Shen
5bee1c10ed
Merge Official Source
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2022-06-02 16:15:24 +08:00
Daniel Golle
7eb83b2015
netifd: update to git HEAD
2e1fcf4 netifd: fix hwmode for 60g band
 39ef9fe interface-ip: fix memory corruption bug when using jail network namespaces

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2022-06-01 20:49:14 +01:00
Christian 'Ansuel' Marangi
419a7ad2dd uhttpd: update to latest Git HEAD
d59d732 client: fix compilation error with GCC 12
51283f9 fix compiler uninitialized variable

Signed-off-by: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
2022-06-01 14:41:46 +02:00
Jo-Philipp Wich
a7ddef6ef1 firewall4: update to latest Git HEAD
210991d fw4: prefer /dev/stdin if available
4e5e322 fw4: make `fw4 restart` behavior more robust
221040e ruleset: emit time ranges when both start and stop times are specified
30a7d47 fw4: fix datetime parsing
fb9a6b2 ruleset: correct mangle_output chain type
6dd2617 fw4: fix logic flaw in testing hw flow offloading support
c7c9c84 fw4: ensure that negative bitcounts are properly translated
c4a78ed fw4: fix typo in emitted set types

Fixes: #9764, #9923, #9927, #9935, #9955
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2022-05-31 21:17:37 +02:00
ZiMing Mo
8b954cf179
dnsmasq: code alignment 2022-05-31 00:52:14 +08:00
ZiMing Mo
51c9f6fe81
dnsmasq: add family selection flag
NAT rules without any AF specific bits and unspecified family should default to IPv4 for backwards compatibility rightnow
via: https://git.openwrt.org/?p=project/firewall4.git;a=commit;h=b479815b198900a65fa42833b12bce689f8f395f

Signed-off-by: ZiMing Mo <msylgj@immortalwrt.org>
2022-05-28 18:59:21 +08:00
Tianling Shen
5e1c52f744
Merge Official Source
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2022-05-27 14:03:47 +08:00
ZiMing Mo
0b84c145d8
dnsmasq: use inet family & fix ruleset order 2022-05-25 14:14:15 +08:00
ZiMing Mo
0e70827090
dnsmasq: renew nft ruleset 2022-05-25 02:56:16 +08:00
Felix Fietkau
24cc341fdc netifd: update to the latest version
4b4849cf5e5a interface-ip: unify host and proto route handling
507c0513d176 interface-ip: add support for excluding interfaces in host route lookup

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-05-23 14:12:44 +02:00
ZiMing Mo
7c48873a7d
firewall4: refresh fullcone patch 2022-05-23 01:59:04 +08:00
Tianling Shen
77fe1044a7
Merge Official Source
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2022-05-21 14:54:52 +08:00
Jo-Philipp Wich
2df17604a4 firewall4: update to latest Git HEAD
c22eeef fw4: support negative CIDR bit notation
628d791 hotplug: reliably handle interfaces with ubus zone hints
d005293 fw4: store zone associations from ubus in statefile as well
b268225 fw4: filter non hw-offload capable devices when resolving lower devices
57984e0 fw4: always resolve lower flowtable devices
7782017 tests: fix mocked `fd.read("line")` api
72b196d config: remove restictions on DHCPv6 allow rule
f0cc317 fw4: refactor family selection for forwarding rules
b0b8122 treewide: use modern syntax
05995f1 fw4: fix emitting device jump rules for family restricted zones
b479815 fw4: fix family auto-selection for config nat rules
2816a82 ruleset: ensure that family-agnostic ICMP rules cover ICMPv6 as well
2379c3d tests: add test coverage for zone family selection logic

Fixes: #5066, #9611, #9765, #9854
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2022-05-20 19:53:04 +02:00
ZiMing Mo
5dd4ff5cd6
Merge Official Source
Signed-off-by: ZiMing Mo <msylgj@immortalwrt.org>
2022-05-11 20:55:23 +08:00
ZiMing Mo
fccf23e848
Revert "firewall4: disable ipv6 fullcone nat"
This reverts commit 308317f29a.

Fixed by a60a51b5b6

Signed-off-by: ZiMing Mo <msylgj@immortalwrt.org>
2022-05-10 23:34:18 +08:00
ZiMing Mo
a60a51b5b6
fullconenat-nft: bump to latest git source
Fix IPv6 handling

Signed-off-by: ZiMing Mo <msylgj@immortalwrt.org>
2022-05-10 23:28:10 +08:00
Tiago Gaspar
65258f5d60 firewall: config: remove restictions on DHCPv6 allow rule
Remove restrictions on source and destination addresses, which aren't
specified on RFC8415, and for some reason in openwrt are configured
to allow both link-local and ULA addresses.
As cleared out in issue #5066 there are some ISPs that use Gloabal
Unicast addresses, so fix this rule to allow them.

Fixes: #5066

Signed-off-by: Tiago Gaspar <tiagogaspar8@gmail.com>
[rebase onto firewall3, clarify subject, bump PKG_RELEASE]
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2022-05-04 15:26:16 +02:00
ZiMing Mo
8ce6cf0220
dnsmasq: use nft ruleset for dns_redirect 2022-05-04 16:28:13 +08:00
ZiMing Mo
308317f29a
firewall4: disable ipv6 fullcone nat
IPv6 fullcone nat based on nft-fullcone will lead to kernel panic rightnow.
2022-05-04 16:18:21 +08:00
Tianling Shen
ac60824d7a
Merge Official Source
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2022-05-04 14:54:03 +08:00
Jan Hoffmann
1daaef31b3 ltq-vdsl-app: disconnect when service is stopped
Stop the connection when the control daemon is terminated. The code is
a modified version of the termination routine in version 4.23.1 of the
daemon (which doesn't support VR9 modems anymore).

This could also be implemented by calling the acos and acs commands via
dsl_cpe_pipe.sh in the init script. However, doing it in the daemon
itself has the advantage of also working if it is terminated in another
way (for example during sysupgrade).

Signed-off-by: Jan Hoffmann <jan@3e8.eu>
Tested-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
2022-05-04 01:38:04 +01:00
Daniel Golle
51c442c265
uqmi: update to git HEAD
56cb2d4 nas: add decoding of cell_id
 9a9019a uqmi: wms - added storage to read text messages

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2022-05-04 01:33:21 +01:00
Bruno Victal
0276fab649 dnsmasq: fix jail_mount for serversfile
Fix 'serversfile' option not being jail_mounted by the init script.

Signed-off-by: Bruno Victal <brunovictal@outlook.com>
2022-05-02 18:57:49 +01:00
David Bauer
f757a8a098 iwinfo: update to latest HEAD
dc6847e iwinfo: nl80211: omit A-hwmode on non-5GHz hardware

Signed-off-by: David Bauer <mail@david-bauer.net>
2022-04-27 00:54:24 +02:00
Daniel Golle
2b5fa44f60
dnsmasq: add logfacility file to jail mounts
If logfacility is a path to a file it needs to be r/w mounted in the
sandbox as well for dnsmasq to work.

Reported-by: @iointerrupt
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2022-04-25 19:28:12 +01:00
ZiMing Mo
08cd2c39bf
Merge Official Source
Signed-off-by: ZiMing Mo <msylgj@immortalwrt.org>
2022-04-25 22:13:01 +08:00
David Bauer
46980294f6 iwinfo: update to latest HEAD
a479b9b devices: remove whitespace
562d015 iwinfo: nl80211: fix hwmode parsing for multi-band NICs

Signed-off-by: David Bauer <mail@david-bauer.net>
2022-04-24 23:09:51 +02:00
ZiMing Mo
a8717e9d47
firewall4: renew fullcone patch 2022-04-23 22:04:59 +08:00
Syrone Wong
ae33beb603
firewall4: add fullcone support
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Signed-off-by: ZiMing Mo <msylgj@immortalwrt.org>
2022-04-22 15:25:20 +08:00
Syrone Wong
fb1a04f94b
nftables: add fullcone expression support
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Signed-off-by: ZiMing Mo <msylgj@immortalwrt.org>
2022-04-22 15:25:20 +08:00
Syrone Wong
3455d1d612
fullconenat-nft: add new package
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Signed-off-by: ZiMing Mo <msylgj@immortalwrt.org>
2022-04-22 15:24:52 +08:00
Jo-Philipp Wich
af02a12d7c firewall4: update to latest Git HEAD
fc83d46 ruleset: set auto-merge directive for interval sets
9bce873 fw4: fix skipping invalid ipset entries
425ea8a fw4: fix applying zone flags for source bound rules

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2022-04-22 00:50:36 +02:00
Tianling Shen
197ee85e5f
Merge Official Source
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2022-04-17 13:07:08 +08:00
Cezary Jackiewicz
e02fb42c53 comgt: support ZTE MF286R modem
The modem is based on Marvell PXA1826 and uses ACM+RNDIS interface to
establish connection with custom commands specific to ZTE modems.
Two variants of modems were discovered, some identifying themselves
as "ZTE", and others as plain "Marvell", the chipset manufacturer.
The modem itself runs a fork of OpenWrt inside, which root shell can be
accessed via ADB interface.

Signed-off-by: Cezary Jackiewicz <cezary@eko.one.pl>
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
2022-04-16 14:02:11 +02:00
Lech Perczak
ed7957810c comgt: ncm: try to detect interface for ttyACM ports
Some modems expose ttyACM as their control ports, which have the
"device" symlink pointing one level down in sysfs tree. Try to find
network interfaces for them as well, this is commonly used for modems
exposing ACM + RNDIS or ACM + ECM interface combinations.

Co-developed-by: Cezary Jackiewicz <cezary@eko.one.pl>
Signed-off-by: Cezary Jackiewicz <cezary@eko.one.pl>
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
2022-04-16 14:02:11 +02:00
Lech Perczak
b2940bb8b2 comgt: ncm: select first available network interface for device
Some modems expose multiple network interfaces on the same USB device,
causing the connection setup script to fail, because glob matching in
the detection phase causes 'ls' to output more than one interface name
plus their base directories in sysfs. Avoid that by listing the
directories explicitly and then selecting first available interface.
This is the case for some variants of ZTE MF286R built-in modem, which
exposes both RNDIS and CDC-ECM network interfaces, causing the
connection setup to fail.

Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
2022-04-16 14:02:11 +02:00
Lech Perczak
a67629bbe2 comgt: ncm: allow specification of interface name
Add ifname property to UCI, which can be used to override the
autodetected interface name in case the detection fails due to having
none or more than one interface exposed by the modem, which is not
explicitly linked to TTY port. This is needed on certain variants of ZTE
MF286R built-in modem, which exposes both RNDIS and CDC-ECM interfaces
on the modem, on which the automatic detection may select the wrong
network interface.

Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
2022-04-16 14:02:11 +02:00
Tianling Shen
e6cbb6469a
Merge Official Source
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2022-04-16 00:49:06 +08:00
Daniel Golle
c5f113c43f
netifd: relax check in dhcp proto handler
Checking whether /sbin/udhcpc is a symbolic link breaks using the
DHCP proto handler inside procd-ujail where bind-mounts are used for
the resolved link. Check whether /sbin/udhcpc is executable instead
to allow using the proto handler for DHCP-provisioned containers.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2022-04-13 19:51:00 +01:00
Rui Salvaterra
435d7a052b firewall3: bump to latest git HEAD
4cd7d4f Revert "firewall3: support table load on access on Linux 5.15+"
50979cc firewall3: remove unnecessary fw3_has_table

Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
2022-04-13 17:08:17 +01:00
Tianling Shen
aa9c3f36d5
Merge Official Source
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2022-04-13 05:55:35 +08:00
Eneas U de Queiroz
1135b75d1f nftables: add CONFLICT between versions
Have nftables-json conflict with nftables-nojson.

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
2022-04-11 21:41:03 +02:00
Konstantin Demin
65256aee23 dropbear: bump to 2022.82
- update dropbear to latest stable 2022.82;
  for the changes see https://matt.ucc.asn.au/dropbear/CHANGES
- use $(AUTORELEASE) in PKG_RELEASE
- use https for all uris
- refresh all patches
- rewrite patches:
  - 100-pubkey_path.patch
  - 130-ssh_ignore_x_args.patch

binary/pkg size changes:
- ath79/generic, mips:
  - binary: 215112 -> 219228 (+4116)
  - pkg: 111914 -> 113404 (+1490)
- ath79/tiny, mips:
  - binary: 172501 -> 172485 (-16)
  - pkg: 89871 -> 90904 (+1033)

Tested-by: Stijn Segers <foss@volatilesystems.org>
Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
2022-04-09 19:31:31 +02:00
AmadeusGhost
3bd3039de4
fullconenat: move to network
(cherry picked from commit eb0e45cb52)
2022-04-09 23:14:37 +08:00
Tianling Shen
e8c2e5dc7d
Merge Official Source
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2022-04-09 00:16:07 +08:00