This commit introduces nlbwmon, the lightweight NetLink BandWidth Montor.
The nlbwmon daemon gathers per-host traffic statistics by querying netlink
accounting data. Due to this approach, the executable is very small and does
not rely on libpcap and CPU intensive raw sockets to monitor traffic.
Besides raw per-host traffic counters, nlbwmon also support rudimentary
traffic classification by observing IP protocols and used port numbers.
Gathered accounting data is stored into a series of database files which
are regularily committed to persistent storage.
Refresh, commit and accounting intervals are freely configurable as well
as the layer7 protocol mapping rules and observed source subnets.
This package also bundles a cli client which can be used to dump the
gathered traffic data as JSON, CSV or plaintext data. A pull request to
add a graphical LuCI frontend for nlbwmon is pending.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
The softethervpn does not actually supported CCFLAGS, or other standard
variables, so we need to override CC to include all of those to fix
build errors with external toolchains.
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
- It's a common practice that assert should be ignored in release build
- Whether to enable ssp should be decided by the config of build system
This was taken from Makefile in shadowsocks/openwrt-shadowsocks.
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
Package version upgraded to 2.5 with patches:
- Fixed compiler warnings
- Fixed miscalculated response time
- Reduced binary size by stripping unused code
Signed-off-by: Marcin Jurkowski <marcin1j@gmail.com>
Notable changes since 3.0.6
f308dde ss-server: fix a use-after-free bug
0b2dce5 ss-redir: fix a mem leak
b7bdb16 ss-local: SOCKS5 UDP associate terminates the connection prematurely
3f0d39a ss-local: use getsockname udp_fd where it applies (fixes local_port==0)
eb30a3d fix possible data loss with salsa20 cipher
0559d8c fix partial nonce data being overwritten
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
The change is mainly for keeping compatibility with old validate_data
before ubox commit ac481cdd999ee84d3f115c33a56397237e95ec64 in Sat Jul
16 14:52:36 2016 +0200. The behaviour change comes with that commit can
be seen with the following command line session
root@LEDE:/usr/bin# validate_data network interface wan 'disabled:bool:false'
network.wan.disabled is unset and defaults to bool false
disabled=0; root@LEDE:/usr/bin#
root@OpenWrt:/# validate_data network interface lan 'disabled:bool:false'
disabled='false'; root@OpenWrt:/#
This will cause shadowsocks-libev in current master branch fail on OpenWrt
15.01 though they actually should only use packages from the 15.01 branch...
Fixesopenwrt/packages#4614
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
backend:
* handle errors due to misconfigured uplinks
* various bugfixes
luci frontend:
* add a powerful wireless station manager to edit and delete existing
interfaces or scan for new uplinks
Signed-off-by: Dirk Brenken <dev@brenken.org>
New upstream release includes fixes for the following security issues:
* CVE-2017-3140: With certain RPZ configurations, a response with TTL 0 could
cause named to go into an infinite query loop
* CVE-2017-3142: An error in TSIG handling could permit unauthorized zone
transfers or zone updates.
* CVE-2017-3143: An error in TSIG handling could permit unauthorized zone
transfers or zone updates.
Signed-off-by: Noah Meyerhans <frodo@morgul.net>
afraid.org has a new update API with better IPV6 support. It needs to be
specifically enabled for each domain, so the original v1 api has been
Signed-off-by: Thomas Guyot-Sionnest <dermoth@aei.ca>
For now building from git using latest SHA (commits are relatively
infrequent). Set priority to come up immediately after network
interfaces are brought up. Patches have been submitted upstream
(but not yet accepted) to fix:
* a somewhat cross-compile unfriendly makefile;
* a header inclusion issue which causes MUSL compilation warnings;
* using the somewhat arcane posix_fallocate() in favor of the
more ubiquitous ftruncate() system call instead.
Hopefully the next release will include our submitted fixes and
we can transition to a numbered release.
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
If lighttpd's scripts are rotated from under it while they're still open,
this will cause some weird things to happen. Give it a heads up that
the logs have moved.
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
Add enabled config option in the global uci section; it allows to put into
place the snmpd config but not yet start the netsnmp daemon.
If config option is unset; netsnmp daemon will be started as before.
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
Primarily a bugfix release for a CVE that doesn't affect lede/openwrt,
but also includes some websockets perfomance fixes.
Release notes at https://mosquitto.org/2017/07/version-1-4-13-released/
Signed-off-by: Karl Palsson <karlp@etactica.com>
This brings the route_allowed_ips option into parity with the addresses
option, which makes these same assumption. The parsing selection is made
to be identical between these two settings.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wait for hostapd comes up during boot
* remove needless ubus call during script startup
* remove needless iwinfo check (covered by package dependency)
Signed-off-by: Dirk Brenken <dev@brenken.org>
- Selecting only a single or subset of all components of shadowsocks-libev is
now possible (this is the main motivation behind the rewrite)
- Configuring multiple instances of the same component is now also possible
- Same option names as with the json config
- Unified configuration generation method for each component
- Add support for ss-local, ss-tunnel, ss-server
- Most data validation is now done with validate_data
- USE_PROCD=1
- Update ss-rules with the one from shadowsocks/luci-app-shadowsocks
- Add README.md
- Set myself as the maintainer
Addresses #4435
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* made DNS restart conditional (compare list hash values),
to prevent needless restarts of the DNS backend
Signed-off-by: Dirk Brenken <dev@brenken.org>
Apparently, even if you don't select the `openvswitch-python` package,
Python still gets built (for the target build).
But, if the python dependencies are conditional on the
`PACKAGE_openvswitch-python` symbol then they aren't build.
This should improve build times, if you only want to build the
`openvswitch` package.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
Seems it was not failing for me because it was probably
using my host Python, which may have the `six` package
available.
This patch enforces the use of the packaged Python.
That way, it's more consistent that the python-six
package is available.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
The most important change is local redirects being disabled by default.
There is an option called cgi.local-redir that allows enabling this
optimization manually back if needed.
Local redirects were initially introduced in 1.4.40 but caused many
problems for *some* web services.
One of problems is breaking Post/Redirect/Get design pattern. With
redirects handled on server side there is no browser redirection making
it "lose" the POST data.
Another possible issue are HTML forms with action="". With CGI local
redirects browser may be sending form data to the wrong URL (the one
that was supposed to redirect the browser).
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
From upstream's changelog:
* main: annotate init/exit functions to save memory
* selftest: remove antique siphash self test
* haskell: re-add updated haskell example
* socket: use ip_rt_put instead of dst_release
* device: avoid double icmp send on routing loop
* compat: clean up cruft
* global: cleanup IP header checking
* compat: do not export symbols unnecessarily
Various cleanups and updates.
* device: netdevice destruction logic change for 4.12
When Linux 4.12 is released next week, we're good to go.
* device: only use one sleep notifier
Rather than have a separate sleep notification for every interface, we now
have a single notifier for every interface. This improves performance,
especially when creating many interfaces at once.
* device: remove icmp conntrack hacks
We're moving hacks upstream the proper way, and then backporting them to
compat.
* receive: extend rate limiting to 1 second after under load detection
After we determine that we're under load, we now wait 1 second before not
being under load again, a timer which is global across all interfaces on a
given system.
* curve25519: satisfy sparse and use short types
* curve25519: keep certain sandy2x functions in C
Certain functions have been made into C, which should improve stack frames and
reliability.
* ratelimiter: rewrite from scratch
This is a big change. We no longer rely on x_tables or xt_hashlimit, instead
using a super minimal and sleek token bucket ratelimiter. This works much
better than the old cruft and should allow us to run more places. It also has
the benefit of being global, so that it's possible to have thousands of
interfaces without killing the system with separate GCs and vmallocs, which is
what happened prior.
* socket: verify saddr belongs to interface
We now more quickly react to changes of the v4 routing table, by ensuring that
the sticky source address is actually still valid.
* wg-quick: properly match IPv6 endpoint
wg-quick now works better with IPv6.
* wg-quick: use printf -v instead of namerefs for bash 4.2
This adds support for old bash, which means wg-quick should be generically
"bash 4 and up". I'm not happy about this but EL7 uses old bash, so we're
stuck with it.
* compat: support EL7.3
Support for RHEL, CentOS, ScientificLinux, and so forth.
* compat: support Ubuntu 14.04
An old crufty Ubuntu is now supported, since it's LTS.
* add bind support (see readme)
* export all blocked domains in one central file (adb_list.overall)
* prerequisite for proper bind support
* much faster sort operation with less memory consumption
* backups are still handled per source separately,
to be more flexible in adding/removing block list sources
* add additional 'wan6' interface trigger in default configuration
* various small fixes & optimizations
Signed-off-by: Dirk Brenken <dev@brenken.org>
If more then one interface get up/down at once mwan3 could be in a
undefined state, because more then one mwan3 hotplug script are running
and editing the iptables.
Lock the critical section should solve this issue.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
A lot of autoconf-based scripts expect --with-foo-dir=$(STAGING_DIR)/usr
and break if they can't find bin/foo-config as a child of that path.
Putting things in $(STAGING_DIR)/host/bin seems to be suboptimal; I
could change the install path but there's no saying what that would
break.
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
With this patch the unbound init routines manage resolv.conf if and only if
when unbound will listen on 127.0.0.1#53 and dnsmasq is not.
Also logs some cases where config values are overriden with sane defaults.
Fixes (partially) LEDE FS#785
Fixesopenwrt/packages#4487
Signed-off-by: Paul Oranje <por@xs4all.nl>
luci2-io-helper: bugfix buckup script read timeout
Reading files from stdin will block for ever. The uhttpd is killing the
backup process after script_timeout.
Switching read to non blocking mode and add a waitpid for the slave
process does not end in a script_timeout anymore.
Signed-off-by: Florian Eckert <Eckert.Florian@googlemail.com>
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* use iwinfo instead iw for wlan scanning,
scanning now works on radio-level
* enhance multiple radio support:
* support STA-only radio configurations,
e.g first radio with local AP, second radio
with a bunch of STAs (without APs)
Signed-off-by: Dirk Brenken <dev@brenken.org>
Add config support which allow snmpd to take a more active role by sending
traps.
Following config options are supported which map directly on snmpd directives:
-trapcommunity
-trapsink
-trap2sink
-informsink
-authtrapenable
-v1trapaddress
-trapsess
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
- use exec directly to eliminate a level in the process tree
- use "$@" instead of "$*" to pass arguments to openconnect
According to openconnect(8), openconnect will call vpnc-script to
cleanup before quit when it received SIGINT(2) and will quit immediately
when it received SIGTERM (the default signal by kill command)
Before and after the change, openconnect process will be killed first
with SIGINT sent from netifd. This was decided by the
'proto_kill_command "$config" 2' notify call in the proto script.
SIGKILL is the only other signal that can be sent from netifd when the
process did not quit on SIGINT on time. There should be no need to trap
on signal 1 3 6 9 (HUP QUIT ABRT KILL)
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
Fixes build errors with external toolchains:
[ 33%] Building C object CMakeFiles/cgi-io.dir/main.c.o
/home/florian/dev/openwrt/trunk/build_dir/target-mipsel-unknown-linux-gnu_glibc/cgi-io/main.c:30:21:
fatal error: libubus.h: No such file or directory
#include <libubus.h>
^
compilation terminated.
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
According to openconnect --help output:
-m, --mtu=MTU Request MTU from server
--base-mtu=MTU Indicate path MTU to/from server
Fixes#2099 by allowing setting tunnel mtu
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
It was introduced with 41f8d5465 ("openconnect: fix a couple of minor
things and add an interface option") and not needed since 4083de9d7
("openconnect: use proto_add_host_dependency")
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
We would not be able to search for pcap.h because CFLAGS are not passed
from src/Makefile down to src/wps/Makefile:
make[4]: Entering directory
'/home/florian/dev/openwrt/trunk/build_dir/target-mipsel-unknown-linux-gnu_glibc/reaver-1.4/src/wps'
mipsel-linux-gnu-gcc -I../utils -I ../ wps_attr_build.c -c
mipsel-linux-gnu-gcc -I../utils -I ../ wps_attr_parse.c -c
mipsel-linux-gnu-gcc -I../utils -I ../ wps_attr_process.c -c
mipsel-linux-gnu-gcc -I../utils -I ../ wps.c -c
mipsel-linux-gnu-gcc -I../utils -I ../ wps_common.c -c
mipsel-linux-gnu-gcc -I../utils -I ../ wps_dev_attr.c -c
mipsel-linux-gnu-gcc -I../utils -I ../ wps_enrollee.c -c
mipsel-linux-gnu-gcc -I../utils -I ../ wps_registrar.c -c
In file included from ../misc.h:41:0,
from wps_registrar.c:27:
../defs.h:43:18: fatal error: pcap.h: No such file or directory
#include <pcap.h>
^
compilation terminated.
Makefile:28: recipe for target 'wps_registrar.o' failed
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
There are no other "echo" debug lines in this file, and it seems
clear that this one was accidentally left as a debugging line,
since it misspelled "dependency". So, we just remove this line.
We don't bump the package version, though, because this is
pretty inconsequential.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
From upstream's changelog:
* timers: queue up killing ephemerals only if not already
We fix up a small detail in the timer logic that changed during the last
snapshot.
* receive: trim incoming packets to IP header length
Packets are now trimmed to their actual length, not their length+padding,
before handing to the rest of the network subsystem, so that packets look
pretty in tcpdump. This doesn't actually affect what userspace sees, since the
kernel trims it at a later stage, but it does make pcaps a bit nicer to use.
* curve25519: use more standard label convention in asm
This ensures that perf(1) shows the function name instead of the label name.
* compat: remove padata hotplug code
Fixes building on kernels that have HOTPLUG enabled but no PADATA support.
* config: add new line for style
* device: do-while assignment style
* peer: explicitly initialize atomic
Style.
* noise: fix race when replacing handshake
Handle a situation in which three peers, all running on the same system, begin
a handshake with all three of each other, at exactly the same time, on a
multi-CPU system.
* random: wait for random bytes when generating nonces and ephemerals
We've been working with upstream to add a new API to the kernel for ensuring
that the RNG actually is seeded. Until they merge it for 4.13, we provide a
poly-fill to the compat code. This means that WireGuard will block during
handshakes until the RNG has enough entropy, so that it's never in a
circumstance in which ephemeral keys are generated from bad randomness.
* go test: properly pad message
* go test: correct tai64n and formatting
* external-tests: add keepalive packet
* go test: use x/crypto for blake2s now that we have 128-bit mac
* external-tests: trim the fat
Improvements for the external tests.
* wg-quick: make sure we have empty table for both v6 and v4
* wg-quick: match ipv6 default route more broadly
Tiny nits with wg-quick, one of which should now allow multiple v6-only
wg-quick instances running at the same time.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
backend:
* cosmetics
frontend:
* "Save & Reply" now distinguish between normal and manual/backup mode
and triggers an appropriate reload or a start action
Signed-off-by: Dirk Brenken <dev@brenken.org>
Script priority adjusted.
Custom memory management turned off to save some memory on low-end device.
Signed-off-by: Antonio Paunovic <antonio.paunovic@sartura.hr>
backend:
* add new 'manual mode' to re-use blocklist backups during startup,
get fresh lists only via manual reload or restart action
* additional free memory check during dns restart to prevent OOM errors
* removed palevo tracker from default config,
this tracker has been discontinued
* cosmetics
LuCI frontend (see luci repo):
* add new 'manual mode' under extra options
Signed-off-by: Dirk Brenken <dev@brenken.org>
The smartsnmpd SConstruct file only accepts setting CFLAGS and does not
use CPPFLAGS, so pass both down using CFLAGS.
This fixes build errors with external toolchains that don't
automatically search for headers in $(STAGING_DIR).
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Make sure we pass down TARGET_CPPFLAGS and TARGET_LDFLAGS to fix build
with external toolchains that don't automatically search for headers and
libraries in $(STAGING_DIR).
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
This was removed in LEDE commit 0b7ed65cec8084bb98ae0e2758b7aca6c447cd4b
("kernel: remove out of tree direct-io disable hack")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
After checking in the ipkg-install dir of netatalk,
it seems that the permissions it sets to the conf-files
are 644.
# ls -la lede/build_dir/target-mips_24kc_musl/netatalk-3.1.11/ipkg-install/etc
-rw-r--r-- 1 sandu sandu 226 iun 5 20:53 afp.conf
-rw-r--r-- 1 sandu sandu 1948 iun 5 20:53 dbus-session.conf
-rw-r--r-- 1 sandu sandu 25037 iun 5 20:53 extmap.conf
While the Package/netatalk/install build rule overrides
them to 600.
According to
* https://github.com/openwrt/packages/issues/4318
* https://forum.lede-project.org/t/help-with-apple-filesharing-protocol-for-time-machine/3259/5
this is a problem in some setups.
So, this patch changes them to what the netatalk
package creators intended initially (i.e. 644).
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
The earlier commit ea119211b2 removed 'dsa' as one of the ssh_host_*_key
types that got generated. Problem was that it didn't remove that key
as one of the paths that the server looks for by default. As a
consequence, your log file might fill up with messages like:
2017-06-01T15:43:07-06:00 openwrt sshd[31929]: error: Could not load host key: /etc/ssh/ssh_host_dsa_key
The patch is forunately trivial. Don't set the path for the dsa
key file in the server configuration.
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The author (@pprindeville) of the original commit noted that the wrong
commit was picked, see
325b7d2cd2 (commitcomment-22387528)
"Err... looks like the wrong fix got committed. I was hoping that this
commit d902e5d would have gone in instead."
This reverts commit 325b7d2cd2.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Fixes the following build error with an external toolchain:
./bld/sqlite3.o: In function `fts5Bm25Function':
sqlite3.c:(.text+0x27234): undefined reference to `log'
./bld/piechart.o: In function `piechart_render':
piechart_.c:(.text+0x430): undefined reference to `sincos'
piechart_.c:(.text+0x47c): undefined reference to `sincos'
piechart_.c:(.text+0x548): undefined reference to `sincos'
collect2: error: ld returned 1 exit status
src/main.mk:526: recipe for target 'fossil' failed
make[3]: *** [fossil] Error 1
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
This backports a patch that has been accepted upstream in linuxptp:
8b61aa2c3f3103db1d4ca1d1e49bb4f8831c1abf ("udp: Avoid including
netdb.h") to fix build errors with external glibc toolchains that
provide rpc/types.h.
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Conserver is an application that allows multiple users to use
serial consoles at the same time, with logging. It has a client-
server design which makes it easy to manage a distributed set
of serial consoles. Logging makes post-crash analyses easier.
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Standard assignment is immediate expansion without any extraneous spacing, RFC822 compliant email addresses and consistent section assignments
Signed-off-by: Stephen Walker <stephendwalker+github@gmail.com>
types that got generated. Problem was that it didn't remove that key
as one of the paths that the server looks for by default. As a
consequence, your log file might fill up with messages like:
2017-06-01T15:43:07-06:00 openwrt sshd[31929]: error: Could not load host key: /etc/ssh/ssh_host_dsa_key
The patch is forunately trivial. Don't set the path for the dsa
key file in the server configuration.
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
Signed-off-by: Peter Wagner <tripolar@gmx.at>
