Use common function to toggle ip address in /var/state/mwan3.
Change also to use toggle function and not set function. If ip address
is often changed every change is saved to /var/state/mwan3.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
If enough tracking ip are pinged skip the reset. They are not needed
anymore to mark the interface as up.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
fix Makefile chmod (644)
replace MD5SUM with HASH
add PKG_MIRROR_HASH when PKG_SOURCE_PROTO:=git
(PKG_SOURCE_PROTO:=svn tarballs are not reproducible for now)
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
ipset command line utility supports ranges of address: IP-IP, but the
dash character is also valid character in host names. If we have a
remote server ss-00.example.com, ipset may complain that
ipset v6.32: Syntax error: cannot parse ss: resolving to IPv4 address failed
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
ubox 'list' type is for validating multiple elements separated by
tabs/whitespaces in a single value. E.g. The following should not be
accepted
list src_ip_bypass '1.2.3.4 4.3.2.1'
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
======================== ========================================
features dependency
======================== ========================================
HTTPS OSX or GnuTLS or OpenSSL or Windows
SFTP libssh2
BitTorrent None. Optional: libnettle+libgmp or
libgcrypt or OpenSSL
Metalink libxml2 or Expat.
Checksum None. Optional: OSX or libnettle or
libgcrypt or OpenSSL or Windows
gzip, deflate in HTTP zlib
Async DNS C-Ares
Firefox3/Chromium cookie libsqlite3
XML-RPC libxml2 or Expat.
JSON-RPC over WebSocket libnettle or libgcrypt or OpenSSL
======================== ========================================
Add 'CONFIG_' to 'PKG_CONFIG_DEPENDS'.
Signed-off-by: Hsing-Wang Liao <kuoruan@gmail.com>
* Add aria2 user and group.
* Use procd to start service.
* Add more supported options.
Compatible with previous version.
Signed-off-by: Hsing-Wang Liao <kuoruan@gmail.com>
When building on hosts with lmdb installed, bind configure phase fails:
configure: error: found lmdb include but not library.
Solve this by disabling lmdb. Fixes#4748.
Fixes: eab56b6bee ("bind: version update to 9.11.2")
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* backend/frontend: supports a Connection Limit ('trm_maxretry')
of '0', to disable this feature (unlimited retries)
Signed-off-by: Dirk Brenken <dev@brenken.org>
- New UCI options ifnames, dst_default
- UCI options src_ips_xxx now accept cidr as their values
- Export ipset names as part of the interface so that it can be
depended on and used by other programs
- Bypass only remote servers used ss-redir instances, so that it's
possible to let other servers to go through existing re-redir
instances
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
Remove an improperly placed semicolon in order to solve the following
compiler error:
.../main.c:144:3: error: this 'if' clause does not guard... [-Werror=misleading-indentation]
if (execl("/bin/busybox", "/bin/busybox", "md5sum", file, NULL));
^~
.../main.c:145:4: note: ...this statement, but the latter is misleadingly indented as if it were guarded by the 'if'
return NULL;
^~~~~~
cc1: all warnings being treated as errors
Fixes#4723.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Fixes the following bugs introduced in commit 815e83d4:
- hotplug: invalid parameter order when initial interface state is "online",
mwan3track expects initial state to be the third argument
- hotplug: missing source ip address when initial interface state is "offline"
- mwan3track: source ip address should be the fourth argument
Signed-off-by: Marcin Jurkowski <marcin1j@gmail.com>
On some environments, connecting to localhost was resolving to ::1,
which didn't match the bind to the explicit 127.0.0.1.
Signed-off-by: Karl Palsson <karlp@etactica.com>
Added many more UCI config options, particularly for bridge connections
The recently introduced username/password options for bridges are kept,
even though they have been deprecated upstream for a while. In keeping
with this, while support is kept in UCI, the generated mosquitto.conf
file will always generate the "modern" remote_username/remote_password
options preferred by mosquitto instead.
Likewise for bridge clientid and remote_clientid options.
Signed-off-by: Karl Palsson <karlp@etactica.com>
Dynu.com already support IPV6 updates using the parameter myipv6, adding to services_ipv6 to enable support in OpenWRT/LEDE
Signed-off-by: Phil John <philjohn@gmail.com>
Define package config files to preserve
/usr/share/nlbwmon/protocols across sysupgrade
Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
This is the default value taken by ss-server and ss-redir. After this
change ss_rules section can still use those ss-redir instances who do
not have mode explicitly specified.
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
Add new globals config section with option local_source.
With this config option the self interface generation will be done now
automatically on hotplug event. You can specify which interface (ip)
sould be used for router traffic. To replace the self intereface in the
config set local_source to "lan".
The default option is none, so it will not change default behavior if a
"self" interface is configured in the network section.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
To know how old the ubus output is, add an age parameter which indicats
how old the check informations on the interface are.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Add new interface config option "inital_state".
If interface comeing up the first time(mwan3 start, boot),
there are now two option for interface behaviour:
- online (default as is now)
Set up interface regardless wether tracking ip are reachable or not.
- offline
Set up interface first to ping tracking ip and if they are reachable set up
the interface completely.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Even though error was fixed the interface checks still fails, if last_resort
was set to blackhole or unreachable.
To fix this issue do not remove failure interface from iptables change on
down event.
Reported-by: Colby Whitney <colby.whitney@luxul.com>
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
If two interface have the same prefix "wan" for example "wan" and "wan1"
pgrep returns the PID for wan1 also "pgrep -f mwan3track wan".
Before this fix "wan1" was also killed! This is not what we want.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* print only 'missing plugins support warning' if user really configured
'blacklist' or 'block_ipv6' parameter.
Signed-off-by: Dirk Brenken <dev@brenken.org>
When the strongswan service is running, `ipsec status` returns 0. Check
the return value instead of checking its output.
While at it, remove the [[ ]] bashism, use rereadall instead of
(reread)secrets, and move it inside the if statement.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
In commit 36e073d820, some checks were
added to see if the UCI config file exists and if there are any peers
configured in it. Due to these checks, if /etc/config/ipsec exists, but
contains no enabled peers, strongswan will not be started. This is not
ideal, as a user might want to experiment with the UCI config while
keeping existing connections in /etc/ipsec.conf operational.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Since the strongswan-utils package now only contains the aging ipsec
utility, rename it to strongswan-ipsec.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
We currently include the SCEP client in strongswan-utils, which is a
dependency of the strongswan-default meta-package. As it's generally not
recommended to generate keys on embedded devices due to lack of entropy,
move the SCEP client to a separate package, and only depend on it in the
strongswan-full meta-package.
While at it, add scepclient.conf to the package.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
We currently include the PKI tool in strongswan-utils, which is a
dependency of the strongswan-default meta-package. As it's generally not
recommended to generate keys on embedded devices due to lack of entropy,
move the PKI tool to a separate package, and only depend on it in the
strongswan-full meta-package.
While at it, add pki.conf to the package.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* Update nmap-suite to 7.60
* Use PKG_HASH as PKG_MD5SUM is deprecated
* Switch download URL to HTTPS
* Add zlib as dependency and link libpcre dynamically
Signed-off-by: Daniel Engberg <daniel.engberg.lists@pyret.net>
* Start dnscrypt-proxy from procd interface trigger rather than
immediately in init, to fix a possible race condition during boot and
get rid of rc.local restarts. You can restrict trigger interface(s) by
'procd_trigger' in new global config section.
* tab/whitespace cosmetics
Signed-off-by: Dirk Brenken <dev@brenken.org>
* add preliminary kresd dns backend support for turris devices,
see readme (experimental / untested!)
* use tld compression for overall list, too
* cosmetics
Signed-off-by: Dirk Brenken <dev@brenken.org>
Adds support for interface tracking using either ping, arping or
httping. This allows to track interface status on networks with filtered
ICMP traffic or simply to monitor data link layer etc.
To facilitate binding to a specified interface its IP address is passed
as a new mwan3track parameter. It's currently required by httping
and possibly by other tools that may be added in the future.
Signed-off-by: Marcin Jurkowski <marcin1j@gmail.com>
0.9.1
backend:
* load procd reload trigger only in 'manual' mode
* documentation update
frontend:
* further optimized Station Overview & Scan page,
especially for mobile devices
* add a "Rescan" button in manual mode on overview page
* XHTML fixes
Signed-off-by: Dirk Brenken <dev@brenken.org>
I do not use this software any more and due to lack of time, I give the
maintenance responsibility back to the community.
Signed-off-by: Christian Schoenebeck <christian.schoenebeck@gmail.com>
This commit introduces nlbwmon, the lightweight NetLink BandWidth Montor.
The nlbwmon daemon gathers per-host traffic statistics by querying netlink
accounting data. Due to this approach, the executable is very small and does
not rely on libpcap and CPU intensive raw sockets to monitor traffic.
Besides raw per-host traffic counters, nlbwmon also support rudimentary
traffic classification by observing IP protocols and used port numbers.
Gathered accounting data is stored into a series of database files which
are regularily committed to persistent storage.
Refresh, commit and accounting intervals are freely configurable as well
as the layer7 protocol mapping rules and observed source subnets.
This package also bundles a cli client which can be used to dump the
gathered traffic data as JSON, CSV or plaintext data. A pull request to
add a graphical LuCI frontend for nlbwmon is pending.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
The softethervpn does not actually supported CCFLAGS, or other standard
variables, so we need to override CC to include all of those to fix
build errors with external toolchains.
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
- It's a common practice that assert should be ignored in release build
- Whether to enable ssp should be decided by the config of build system
This was taken from Makefile in shadowsocks/openwrt-shadowsocks.
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
Package version upgraded to 2.5 with patches:
- Fixed compiler warnings
- Fixed miscalculated response time
- Reduced binary size by stripping unused code
Signed-off-by: Marcin Jurkowski <marcin1j@gmail.com>
Notable changes since 3.0.6
f308dde ss-server: fix a use-after-free bug
0b2dce5 ss-redir: fix a mem leak
b7bdb16 ss-local: SOCKS5 UDP associate terminates the connection prematurely
3f0d39a ss-local: use getsockname udp_fd where it applies (fixes local_port==0)
eb30a3d fix possible data loss with salsa20 cipher
0559d8c fix partial nonce data being overwritten
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
The change is mainly for keeping compatibility with old validate_data
before ubox commit ac481cdd999ee84d3f115c33a56397237e95ec64 in Sat Jul
16 14:52:36 2016 +0200. The behaviour change comes with that commit can
be seen with the following command line session
root@LEDE:/usr/bin# validate_data network interface wan 'disabled:bool:false'
network.wan.disabled is unset and defaults to bool false
disabled=0; root@LEDE:/usr/bin#
root@OpenWrt:/# validate_data network interface lan 'disabled:bool:false'
disabled='false'; root@OpenWrt:/#
This will cause shadowsocks-libev in current master branch fail on OpenWrt
15.01 though they actually should only use packages from the 15.01 branch...
Fixesopenwrt/packages#4614
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
backend:
* handle errors due to misconfigured uplinks
* various bugfixes
luci frontend:
* add a powerful wireless station manager to edit and delete existing
interfaces or scan for new uplinks
Signed-off-by: Dirk Brenken <dev@brenken.org>
New upstream release includes fixes for the following security issues:
* CVE-2017-3140: With certain RPZ configurations, a response with TTL 0 could
cause named to go into an infinite query loop
* CVE-2017-3142: An error in TSIG handling could permit unauthorized zone
transfers or zone updates.
* CVE-2017-3143: An error in TSIG handling could permit unauthorized zone
transfers or zone updates.
Signed-off-by: Noah Meyerhans <frodo@morgul.net>
afraid.org has a new update API with better IPV6 support. It needs to be
specifically enabled for each domain, so the original v1 api has been
Signed-off-by: Thomas Guyot-Sionnest <dermoth@aei.ca>
For now building from git using latest SHA (commits are relatively
infrequent). Set priority to come up immediately after network
interfaces are brought up. Patches have been submitted upstream
(but not yet accepted) to fix:
* a somewhat cross-compile unfriendly makefile;
* a header inclusion issue which causes MUSL compilation warnings;
* using the somewhat arcane posix_fallocate() in favor of the
more ubiquitous ftruncate() system call instead.
Hopefully the next release will include our submitted fixes and
we can transition to a numbered release.
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
If lighttpd's scripts are rotated from under it while they're still open,
this will cause some weird things to happen. Give it a heads up that
the logs have moved.
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
Add enabled config option in the global uci section; it allows to put into
place the snmpd config but not yet start the netsnmp daemon.
If config option is unset; netsnmp daemon will be started as before.
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
Primarily a bugfix release for a CVE that doesn't affect lede/openwrt,
but also includes some websockets perfomance fixes.
Release notes at https://mosquitto.org/2017/07/version-1-4-13-released/
Signed-off-by: Karl Palsson <karlp@etactica.com>
This brings the route_allowed_ips option into parity with the addresses
option, which makes these same assumption. The parsing selection is made
to be identical between these two settings.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wait for hostapd comes up during boot
* remove needless ubus call during script startup
* remove needless iwinfo check (covered by package dependency)
Signed-off-by: Dirk Brenken <dev@brenken.org>
- Selecting only a single or subset of all components of shadowsocks-libev is
now possible (this is the main motivation behind the rewrite)
- Configuring multiple instances of the same component is now also possible
- Same option names as with the json config
- Unified configuration generation method for each component
- Add support for ss-local, ss-tunnel, ss-server
- Most data validation is now done with validate_data
- USE_PROCD=1
- Update ss-rules with the one from shadowsocks/luci-app-shadowsocks
- Add README.md
- Set myself as the maintainer
Addresses #4435
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* made DNS restart conditional (compare list hash values),
to prevent needless restarts of the DNS backend
Signed-off-by: Dirk Brenken <dev@brenken.org>
Apparently, even if you don't select the `openvswitch-python` package,
Python still gets built (for the target build).
But, if the python dependencies are conditional on the
`PACKAGE_openvswitch-python` symbol then they aren't build.
This should improve build times, if you only want to build the
`openvswitch` package.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
Seems it was not failing for me because it was probably
using my host Python, which may have the `six` package
available.
This patch enforces the use of the packaged Python.
That way, it's more consistent that the python-six
package is available.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
The most important change is local redirects being disabled by default.
There is an option called cgi.local-redir that allows enabling this
optimization manually back if needed.
Local redirects were initially introduced in 1.4.40 but caused many
problems for *some* web services.
One of problems is breaking Post/Redirect/Get design pattern. With
redirects handled on server side there is no browser redirection making
it "lose" the POST data.
Another possible issue are HTML forms with action="". With CGI local
redirects browser may be sending form data to the wrong URL (the one
that was supposed to redirect the browser).
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
From upstream's changelog:
* main: annotate init/exit functions to save memory
* selftest: remove antique siphash self test
* haskell: re-add updated haskell example
* socket: use ip_rt_put instead of dst_release
* device: avoid double icmp send on routing loop
* compat: clean up cruft
* global: cleanup IP header checking
* compat: do not export symbols unnecessarily
Various cleanups and updates.
* device: netdevice destruction logic change for 4.12
When Linux 4.12 is released next week, we're good to go.
* device: only use one sleep notifier
Rather than have a separate sleep notification for every interface, we now
have a single notifier for every interface. This improves performance,
especially when creating many interfaces at once.
* device: remove icmp conntrack hacks
We're moving hacks upstream the proper way, and then backporting them to
compat.
* receive: extend rate limiting to 1 second after under load detection
After we determine that we're under load, we now wait 1 second before not
being under load again, a timer which is global across all interfaces on a
given system.
* curve25519: satisfy sparse and use short types
* curve25519: keep certain sandy2x functions in C
Certain functions have been made into C, which should improve stack frames and
reliability.
* ratelimiter: rewrite from scratch
This is a big change. We no longer rely on x_tables or xt_hashlimit, instead
using a super minimal and sleek token bucket ratelimiter. This works much
better than the old cruft and should allow us to run more places. It also has
the benefit of being global, so that it's possible to have thousands of
interfaces without killing the system with separate GCs and vmallocs, which is
what happened prior.
* socket: verify saddr belongs to interface
We now more quickly react to changes of the v4 routing table, by ensuring that
the sticky source address is actually still valid.
* wg-quick: properly match IPv6 endpoint
wg-quick now works better with IPv6.
* wg-quick: use printf -v instead of namerefs for bash 4.2
This adds support for old bash, which means wg-quick should be generically
"bash 4 and up". I'm not happy about this but EL7 uses old bash, so we're
stuck with it.
* compat: support EL7.3
Support for RHEL, CentOS, ScientificLinux, and so forth.
* compat: support Ubuntu 14.04
An old crufty Ubuntu is now supported, since it's LTS.
* add bind support (see readme)
* export all blocked domains in one central file (adb_list.overall)
* prerequisite for proper bind support
* much faster sort operation with less memory consumption
* backups are still handled per source separately,
to be more flexible in adding/removing block list sources
* add additional 'wan6' interface trigger in default configuration
* various small fixes & optimizations
Signed-off-by: Dirk Brenken <dev@brenken.org>
If more then one interface get up/down at once mwan3 could be in a
undefined state, because more then one mwan3 hotplug script are running
and editing the iptables.
Lock the critical section should solve this issue.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
A lot of autoconf-based scripts expect --with-foo-dir=$(STAGING_DIR)/usr
and break if they can't find bin/foo-config as a child of that path.
Putting things in $(STAGING_DIR)/host/bin seems to be suboptimal; I
could change the install path but there's no saying what that would
break.
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
With this patch the unbound init routines manage resolv.conf if and only if
when unbound will listen on 127.0.0.1#53 and dnsmasq is not.
Also logs some cases where config values are overriden with sane defaults.
Fixes (partially) LEDE FS#785
Fixesopenwrt/packages#4487
Signed-off-by: Paul Oranje <por@xs4all.nl>
luci2-io-helper: bugfix buckup script read timeout
Reading files from stdin will block for ever. The uhttpd is killing the
backup process after script_timeout.
Switching read to non blocking mode and add a waitpid for the slave
process does not end in a script_timeout anymore.
Signed-off-by: Florian Eckert <Eckert.Florian@googlemail.com>
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* use iwinfo instead iw for wlan scanning,
scanning now works on radio-level
* enhance multiple radio support:
* support STA-only radio configurations,
e.g first radio with local AP, second radio
with a bunch of STAs (without APs)
Signed-off-by: Dirk Brenken <dev@brenken.org>
Add config support which allow snmpd to take a more active role by sending
traps.
Following config options are supported which map directly on snmpd directives:
-trapcommunity
-trapsink
-trap2sink
-informsink
-authtrapenable
-v1trapaddress
-trapsess
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
- use exec directly to eliminate a level in the process tree
- use "$@" instead of "$*" to pass arguments to openconnect
According to openconnect(8), openconnect will call vpnc-script to
cleanup before quit when it received SIGINT(2) and will quit immediately
when it received SIGTERM (the default signal by kill command)
Before and after the change, openconnect process will be killed first
with SIGINT sent from netifd. This was decided by the
'proto_kill_command "$config" 2' notify call in the proto script.
SIGKILL is the only other signal that can be sent from netifd when the
process did not quit on SIGINT on time. There should be no need to trap
on signal 1 3 6 9 (HUP QUIT ABRT KILL)
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
Fixes build errors with external toolchains:
[ 33%] Building C object CMakeFiles/cgi-io.dir/main.c.o
/home/florian/dev/openwrt/trunk/build_dir/target-mipsel-unknown-linux-gnu_glibc/cgi-io/main.c:30:21:
fatal error: libubus.h: No such file or directory
#include <libubus.h>
^
compilation terminated.
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
According to openconnect --help output:
-m, --mtu=MTU Request MTU from server
--base-mtu=MTU Indicate path MTU to/from server
Fixes#2099 by allowing setting tunnel mtu
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
It was introduced with 41f8d5465 ("openconnect: fix a couple of minor
things and add an interface option") and not needed since 4083de9d7
("openconnect: use proto_add_host_dependency")
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
We would not be able to search for pcap.h because CFLAGS are not passed
from src/Makefile down to src/wps/Makefile:
make[4]: Entering directory
'/home/florian/dev/openwrt/trunk/build_dir/target-mipsel-unknown-linux-gnu_glibc/reaver-1.4/src/wps'
mipsel-linux-gnu-gcc -I../utils -I ../ wps_attr_build.c -c
mipsel-linux-gnu-gcc -I../utils -I ../ wps_attr_parse.c -c
mipsel-linux-gnu-gcc -I../utils -I ../ wps_attr_process.c -c
mipsel-linux-gnu-gcc -I../utils -I ../ wps.c -c
mipsel-linux-gnu-gcc -I../utils -I ../ wps_common.c -c
mipsel-linux-gnu-gcc -I../utils -I ../ wps_dev_attr.c -c
mipsel-linux-gnu-gcc -I../utils -I ../ wps_enrollee.c -c
mipsel-linux-gnu-gcc -I../utils -I ../ wps_registrar.c -c
In file included from ../misc.h:41:0,
from wps_registrar.c:27:
../defs.h:43:18: fatal error: pcap.h: No such file or directory
#include <pcap.h>
^
compilation terminated.
Makefile:28: recipe for target 'wps_registrar.o' failed
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
There are no other "echo" debug lines in this file, and it seems
clear that this one was accidentally left as a debugging line,
since it misspelled "dependency". So, we just remove this line.
We don't bump the package version, though, because this is
pretty inconsequential.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
From upstream's changelog:
* timers: queue up killing ephemerals only if not already
We fix up a small detail in the timer logic that changed during the last
snapshot.
* receive: trim incoming packets to IP header length
Packets are now trimmed to their actual length, not their length+padding,
before handing to the rest of the network subsystem, so that packets look
pretty in tcpdump. This doesn't actually affect what userspace sees, since the
kernel trims it at a later stage, but it does make pcaps a bit nicer to use.
* curve25519: use more standard label convention in asm
This ensures that perf(1) shows the function name instead of the label name.
* compat: remove padata hotplug code
Fixes building on kernels that have HOTPLUG enabled but no PADATA support.
* config: add new line for style
* device: do-while assignment style
* peer: explicitly initialize atomic
Style.
* noise: fix race when replacing handshake
Handle a situation in which three peers, all running on the same system, begin
a handshake with all three of each other, at exactly the same time, on a
multi-CPU system.
* random: wait for random bytes when generating nonces and ephemerals
We've been working with upstream to add a new API to the kernel for ensuring
that the RNG actually is seeded. Until they merge it for 4.13, we provide a
poly-fill to the compat code. This means that WireGuard will block during
handshakes until the RNG has enough entropy, so that it's never in a
circumstance in which ephemeral keys are generated from bad randomness.
* go test: properly pad message
* go test: correct tai64n and formatting
* external-tests: add keepalive packet
* go test: use x/crypto for blake2s now that we have 128-bit mac
* external-tests: trim the fat
Improvements for the external tests.
* wg-quick: make sure we have empty table for both v6 and v4
* wg-quick: match ipv6 default route more broadly
Tiny nits with wg-quick, one of which should now allow multiple v6-only
wg-quick instances running at the same time.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
backend:
* cosmetics
frontend:
* "Save & Reply" now distinguish between normal and manual/backup mode
and triggers an appropriate reload or a start action
Signed-off-by: Dirk Brenken <dev@brenken.org>
Script priority adjusted.
Custom memory management turned off to save some memory on low-end device.
Signed-off-by: Antonio Paunovic <antonio.paunovic@sartura.hr>
backend:
* add new 'manual mode' to re-use blocklist backups during startup,
get fresh lists only via manual reload or restart action
* additional free memory check during dns restart to prevent OOM errors
* removed palevo tracker from default config,
this tracker has been discontinued
* cosmetics
LuCI frontend (see luci repo):
* add new 'manual mode' under extra options
Signed-off-by: Dirk Brenken <dev@brenken.org>
