It was requested as it can be useful under certain circumstances.
Disabled rpc_whitelist by default. Not only is there a firewall, but it denies access when IP address of the device is changed.
Added group support in UCI. Fixes cases where group does not match the user (nobody:nogroup).
Signed-off-by: Rosen Penev <rosenp@gmail.com>
* union 'automatic' and 'trigger' mode, now much more responsive
if an uplink suddenly disappears
* tidy up (disable) travelmate related uplink connections
if you disable the service
* change default config ('trm_automatic' removal)
* documentation update
* LuCI: remove needless 'automatic' and 'trigger' options
plus small fixes
Signed-off-by: Dirk Brenken <dev@brenken.org>
Considering that ipv6 NPT/NAT/NETMAP is done manually by user,
mwan3 can balance ipv6 interfaces as it does with ipv4.
Interface wan2 was renamed to wanb as wan2, wan3, ... will eventually
colide with OpenWrt with default wan6 interface when more than 6
interfaces are in use.
New interfaces, members for wan6 and wanb6 where created, both disabled
by default. Policies where adapted as well.
The option "family" is set respectively in each interface. When missing,
mwan3 assumes ipv4, that will fail when interface is IPv6 only.
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
Add missing globals config section with default values.
Without the correctly named section, mwan3 startup will fail with the error - Warning: mwan3 is global disabled. Usage: /etc/init.d/mwan3 start.
Compile: not required
Run tested: LEDE 17.01.04
Author-name: Rob White
Maintainer: Florian Eckert <fe@dev.tdt.de>
Signed-off-by: Rob White <rob@blue-wave.net>
Commit 384c2a8cfd added support for symlinking
net-snmp-config into $(STAGING_DIR)/usr/bin but forgot to install first
$(STAGING_DIR)/usr/bin resulting into a compile issue if
$(STAGING_DIR)/usr/bin is not yet present.
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
Allow specifying NTP servers, search domains, etc. by the administrator
directly specifying DHCP options (per interface, i.e. per pool).
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
Setting a domain now results in 'option domain-name "xyzzy";'
being generated globally.
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
The IPsec ip route table has the default number 220.
If mwan3 has more then 7 bits set (124 interfaces) then if mwan3 down is
executed the table is also cleared. To solve this set default max 7
bits in the mmx_mask for mwan3.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
xinetd.org has been defunct for a long time and it seems the main developer moved everything to GitHub.
Discovered with uscan.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
be35e54 Optimized by use ipset
2dcc126 Optimize kernel module code
08231b4 Remove url param of login api
bf7b435 Support compile kernel module on ubuntu for test
ffca07a Optimize kernel module
b03c757 Optimize code
Signed-off-by: Jianhui Zhao <jianhuizhao329@gmail.com>
Adjust the dependency from ip-full back to ip.
Returning back to "ip" is now possible as busybox does not provide
"ip" any more, making "ip" again reference to ip-tiny or ip-full.
Reference to discussion in #5747
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Bug: If DHCPv4 MAC are used to infer SLAAC and the forth position of
the subnet /64 is 0 (X:X:X:0::/64), then DNS records where malformed.
Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
- Add domain_forward to permit designated domains to forward instead
of recurse as listed in resolve.conf.auto from DHCP WAN client
- Update rebind_protection and add rebind_interface to protect IP6
GLA locally just like RFC 1918 protection
- Rename trigger to trigger_interface with backwards compatability
- Update odhcpd script for efficiency handling many clients
Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
We need always three of the firewall mask value for
* default routing table
* blackhole
* unreachable
the other will be used for the interfaces.
* If we have set the mmx_mask to max 0xFF00 (8 bit set) we could use max 252
interfaces.
* If we have set the mmx_mask to min 0x0E00 (3 bit set) we could use max 4
interfaces.
Only the ones are counting from the firewall mask value.
Minimal three firewall mask bit vaules must be set.
Maximal eight firewall mask bit vaules could be set.
Table overview mmx_mask value bits vs. max interfaces
mmx_mask value bits set 1 -> not usefull
mmx_mask value bits set 2 -> not usefull
mmx_mask value bits set 3 -> 4 Interfaces (mask example 0x0E)
mmx_mask value bits set 4 -> 12 Interfaces
mmx_mask value bits set 5 -> 28 Interfaces
mmx_mask value bits set 6 -> 60 Interfaces
mmx_mask value bits set 7 -> 124 Interfaces
mmx_mask value bits set 8 -> 252 Interfaces (mask example 0xFF)
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Add a new ACTIONs:
* connected ACTION is called once if mwan3track reach all configured track_ips
* disconnected ACTION is called once if mwan3track is unable to reach the track_ips
The connected/disconnected will called only by mwan3track in opposite
the ACTIONs ifup/ifdown will also be called by netifd.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
As it currently stands, the version of coova-chilli the packages feed
will not compile against 4fd87220567f1ae3ad209da1f602dc81c6b4d6b1
I've quasi-backported (could not find a single commit which fixes these
particular issues) https://github.com/coova/coova-chilli 's formatting
on the impacted sections, and it compiles.
Once a new version is added to the feed this patch can likely be
dropped.
Signed-off-by: Marty E. Plummer <hanetzer@startmail.com>
The code assumes pre-C99 inlining. This causes issues with GCC7 which assumes C11. Add std=gnu89 to restore proper behavior.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Changes since 2.8.2 as recorded in NEWS-2.8.2
- NSH implementation now conforms to latest draft (draft-ietf-sfc-nsh-28).
- Bug fixes
0006-adapt-ovs-scripts.patch was splited into two separate patches as
the original patch does not apply against 2.8.2 anymore. Other patches
are just re-numbered without actual function change
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
From the package description:
PageKite is a system for running publicly visible servers (generally
web servers) on machines without a direct connection to the Internet,
such as mobile devices or computers behind restrictive firewalls.
PageKite works around NAT, firewalls and IP-address limitations by
using a combination of tunnels and reverse proxies.
This package provides an implementation of the PageKite Protocol in C,
optimized for high-performance or embedded applications.
Signed-off-by: Karl Palsson <karlp@tweak.net.au>
* The mwan3 scripts sources ". /usr/share/libubox/jshn.sh"
* Mwan3 only works if ip-full is installed
Error -> "ip: invalid argument '0xfd00/0xff00' to 'fwmark'"
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
ppp has multiple variants, so selecting one of them introduces a
recursive dependency for any packge selecting it.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Use ppp-mod-pppoe instead of shipping its own broken plugin
Always use rp-pppoe.so instead of the (not packaged) pppoe user space
implementation
Signed-off-by: Felix Fietkau <nbd@nbd.name>
At the time of this writing, Open vSwitch official website suggests
http://openvswitch.org whose https couterpart uses a self-signed
certificate, but it redirects to http://www.openvswitch.org, which has a
working https equivalent.
Reported-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
- KCONFIG: bridge compatibility was removed since Open vSwitch 1.10.
See Open vSwitch FAQ.md for details
- The module does not depend on kmod-gre, kmod-vxlan
- Use AutoProbe to remove dependecy on specific priority
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
Open vSwitch needs to run python on build machine to make build-time
required files. python-six library is only required by the openvswitch
python library on target machine, not a build dependency.
We override host PYTHONPATH by overriding it in MAKE_VARS. This way we
can remove 0003-override-pythonpath-via-make-vars.patch
This also fixes shebang wrongly pointing to python on host
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
The python library is a standalone unit. Remove dependency on
PACKAGE_openvswitch to allow users to use it with maybe remote
openvswitch services.
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
This subdir contains multiple pid, unix domain socket files. It's a
custom to put them in it's own subdir
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
Quote from Open vSwitch FAQ.md
Open vSwitch userspace should also work with the Linux kernel module
built into Linux 3.3 and later.
Open vSwitch userspace is not sensitive to the Linux kernel version. It
should build against almost any kernel, certainly against 2.6.32 and
later.
The SUPPORTED_KERNEL dependency for openvswitch kernel module only
makes sense when we are building it from the ovs release tarballs
against mainline kernels. Now that we are using the module from vanilla
kernel itself, the dependency does not exist anymore
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
- Update haproxy download URL and hash
- Update the haproxy homepage
- Add libatomic to the dependencies as 1.8 needs it
- Make USE_REGPARM an x86-only option as this fixes many warnings and does not do much on non-x86 platforms
- Add USE_GETADDRINFO=1 to use getaddrinfo() to resolve IPv6 host names
- Add USE_TFO=1 to enable TCP fast open
- Unbreak CFLAGS, LD and LDFLAGS by adding the missing backslash after $(ADDON)
- Unbreak IGNOREGIT=1 option (typo)
- Rework LDFLAGS and add libatomic
- Add MEDIUM+ patches (see https://www.haproxy.org/bugs/bugs-1.8.4.html)
Signed-off-by: Christian Lachner <gladiac@gmail.com>
- the Lua-support logic was cleaned up to unbreak Lua-support on non-mips(el) targets. Previously, no target had Lua-support.
- mips and mipsel are both known to currently not build with Lua-support enabled => disable both.
- mips64 and mips64el were tested fine with Lua-support enabled.
Signed-off-by: Christian Lachner <gladiac@gmail.com>
HTTPS verification is totally broken in Transmission. Unclear why. Disabling as a result.
Safari exposes a JavaScript bug that makes it not load. Fixed.
Portcheck was backported to HTTPS for testing initially. Seems like a good idea.
Makefile was also fixed to use the external libnatpmp. Smaller binary.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
The script removes the UCI option ucitrack.@sqm[0] if present and then
returns success. If that UCI option is already absent however, the
script incorrectly returns failure, which blocks upgrade of the
luci-app-sqm package.
Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
Currently the Makefile creates a v---.tar.gz file which can conflict with other packages. Standardize the format.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Bump version plus changes to address concerns regarding default config for stubby provided with this package
Signed-off-by: David Mora <iamperson347+public@gmail.com>
* checks continuously the signal quality for conditional
uplink (dis-) connections
* captive portal detection with internet online check and
a 'heartbeat' function to keep the uplink connection up & running
Signed-off-by: Dirk Brenken <dev@brenken.org>
OpenSSL grew the ability to turn off TLS-PSK support. Make sure that
mosquitto turns on/off TLS-PSK support based on this OpenSSL config.
Fixes https://github.com/openwrt/packages/issues/5633
Signed-off-by: Karl Palsson <karlp@etactica.com>
Sysrepo version 0.7.3 features following improvements:
* possibility to uninstall more modules in one command with sysrepoctl
* several bugfixes
Signed-off-by: Mislav Novakovic <mislav.novakovic@sartura.hr>
Fix breakage caused by 44df061c48 by removing the leftover
usage of the removed SUPPORTED_KERNELS variable
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
libnatpmp was added as a dependancy to avoid built-in version.
Makefile went through a few adjustments to make it simpler.
CMake support is not happening since Travis is using a broken Ubuntu install.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
For a while now OVS has been using the kernel's kmod.
So it doesn't make sense to limit the package build for a specific set of
kernels anymore.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
pixiewps has its own CFLAGS setting and uses LDFLAGS from
environment variable. When PKG_ALSR_PIE was enabled, objects were not
compiled with -fPIC supplied from the build system and the final link
step would fail because of the -pie option
Fixes#5590
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
Move all shell commands which are executed during /lib/mwan3/mwan3.sh
sourceing into a seperate init function which must be called at first.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
In some situation it is not enough to send a SIGTERM to mwan3track to
ask service to stop accurate. If this does not work send him a SIGKILL
to prevent mwan3track running more then once per interface.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Notable changes since 3.1.2
afce1b3 eliminate timered delay between handshake and data stream #1572
539bf6e sni in redir removed and no disable_sni option #1876
1d94442..29ff5d3 udprelay fix (no idea what's the problem...) #1883
Now disable_sni=true is the default. Existing uci configs setting it
will be a nop
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
Ran the transmission init script through shellcheck and fixed errors. Also cleaned up a bit.
Removed ionice support. Will reintroduce if procd adds support.
Removed config_overwrite debugging variable. No need for it.
Enabled TLS verify by default. Added a dependancy to ca-bundle as a result. This is a default in current trunk.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
* major performance boost: add a flexible 'Download Queue' to handle
downloads & list processing in parallel, default queue size is '4',
you can raise this e.g. to '8' or '16' to get it really fast
* replace former 'whitelist mode': the new 'Jail' option
builds an additional 'adb_list.jail' list in parallel
which can be used manually for guest wifi or kidsafe configurations
* regex parser & query function now fully support IDN domains
with non-ASCII characters
* add error handling in tld compression,
to handle OOM conditions better
* adblock.notify sends now html emails,
to get a better look & feel, even on mobile devices
* add czech regional blocklist maintained by turris omnia users
* LuCI: Support new 'Download Queue' & 'Jail' options
* LuCI: fix field width in "Runtime Information" section
Signed-off-by: Dirk Brenken <dev@brenken.org>
The original patch that forced internal usage hid an actual issue in the build system. Replace patch with upstream one.
Also reorganized the Makefile a bit and removed some cruft.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
DNS rebinding protection introduced a new option. Use it to disable it as OpenWrt does not need it.
Adjusted Makefile to use the release instead of a git version. Also cleaned up and added LICENSE entries.
Eliminated useless patches. The syslog one actually doesn't log much. No need to mask the os release anymore either.
Added group entry to init script. Otherwise files end up being owned by user:root which is bogus.
v2: Previous maintainer relied on git version of Transmission for mbedtls support. Backport it to the stable instead.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
