Currently its only possible to disable port forwarding only for specific
keys, via the OpenSSH-style restriction in `authorized_keys` file.
In some use cases it might be feasible to disable such features globally
on service level, so lets add new LocalPortForward and RemotePortForward
config knobs.
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Link: https://github.com/openwrt/openwrt/pull/21071
(cherry picked from commit 83f6177dbf)
[ fix conflict error ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Co-authored-by: Lienol <23146169+Lienol@users.noreply.github.com>
(squashed from 99bfa54acfecf409cb46e4f3f31350541ef81891)
Signed-off-by: Liangbin Lian <jjm2473@gmail.com>
A lot of recent commits in odhcpd main branch are structural/semantic
changes, so instead of adding those changes to 24.10 branch it's better
to focus on the fixes.
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
b14cf98 router: log “Sending a RA on lan” at LOG_DEBUG
c2810fe odhcpd: update cmake file
8c2c065 odhcpd: convert README to markdown
3b96480 odhcpd: allow the use of an alternative cfg file
7328bfe odhcpd: remove confusing #defines
cdb9e5b odhcpd: improve RFC9096 § 3.5 SLAAC compliance
RFC9096 § 3.5 SLAAC compliance introduces a new config option (odhcpd
piofolder), which may wear out the flash under certain conditions (for
example: ISPs with dynamic IPv6 prefixes which disconnect the clients
every X hours).
Therefore, setting "dhcp.odhcpd.piofolder" to persistent storage in the
router flash is not advisable and should be set to other kinds of
persistent storage such as USBs, SDs, NVMEs...
In order to prevent wearing out the router flash it's set to ephemeral
storage by default (tmp):
uci set dhcp.odhcpd.piofolder="/tmp/odhcpd-piofolder"
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
(cherry picked from commit ea79b5875a)
2859741d971e dhcpv4: store reqopts as uint8_t
6d342cc03bf7 odhcpd: add DNR (RFC 9463) support
c89b8b3f2ff3 odhcpd: make the IPv6 RA DNR lifetime configurable
066b3dc6ec1a netlink: fix a memory leak
171140e90b6a odhcpd: add a helper function for addr6/prefix parsing
5585b969c18f router: move pref64 calculations to the config stage
4308384748be dhcpv6: add ipv6 pxe support
6e1ad492cef5 router: replace ssize_t with size_t
Signed-off-by: David Härdeman <david@hardeman.nu>
Link: https://github.com/openwrt/openwrt/pull/20022
Signed-off-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
(cherry picked from commit a6da0e0d37)
* commit '5ff7149a08df0a5f408ceb48c1b0ca2a40b49b3e': (142 commits)
OpenWrt v24.10.2: revert to branch defaults
OpenWrt v24.10.2: adjust config defaults
ramips: mt7621: include uboot-envtools in some missed devices
ipq806x: fix Extreme Networks AP3935 LAN/WAN ports
ipq806x: fix Extreme Networks AP3935 LAN LED order
kernel: Fix IPv6 UDP fragmentation regression
wifi-scripts: add missing mesh_nolearn
hostapd: fix generating own neighbor report for dynamically added/changed interfaces
hostapd: fix dealing with mac address changes for the primary BSS
perf: disable slang support
mediatek: filogic: add support for Cudy WR3000E v1
mediatek: Create common DTSI for WR3000H and WR3000S
mediatek: filogic: fix 2.5G phy compatible for WR3000H
mediatek: filogic: Cudy WR3000H: Fix SUPPORTED_DEVICES
mediatek: filogic: Add support for cudy wr3000h
tools/expat: bump to 2.7.1 to fix several CVEs
tools/patch: bump version to v2.8
strace: Update to version 6.12
arm-trusted-firmware-stm32: bump to v2.10.17
include/trusted-firmware-a.mk: support LTS releases
...
Signed-off-by: Liangbin Lian <jjm2473@gmail.com>
# Conflicts:
# package/kernel/r8101/Makefile
# package/kernel/r8125/Makefile
# package/kernel/r8126/Makefile
# package/kernel/r8127/Makefile
# package/kernel/r8168/Makefile
hostapd_neighbor_set_own_report is normally called from interface setup only.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 9850052190)
Ensure that hapd->own_addr is set properly, since hostapd_setup_bss
only handles it for secondary BSS interfaces
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 3ebf110711)
lldpd can send several hardware inventory TLV fields. Extend the init
script to provide these when the existing flag 'lldpmed_no_inventory' is
disabled. Five new methods provide default values for some of them,
taken from /etc/os-release and /etc/board.json.
There is no homogeneous method to determine the hardware serial number,
so it can be provided manually, as can asset ID.
Note: properties >= 32 characters are truncated at send time (by lldpd),
and some (Cisco) equipment displays junk after strings >= 32 characters.
So truncate to 31.
Tested on: 24.10.0 (known compatible with 22 and 23 also)
===
Example
===
The following lldpd config lines:
configure inventory hardware-revision "v0"
configure inventory software-revision "r28427-6df0e3d02a"
configure inventory firmware-revision "OpenWrt 24.10.0"
configure inventory serial-number "ABCDEF-123456"
configure inventory manufacturer "glinet"
configure inventory model "GL.iNet GL-MT6000"
# 32 characters:
configure inventory asset "abcdefghijklmnopqrstuvwxyz 12345"
Produce the following TLV (decoded by Wireshark):
Telecommunications Industry Association TR-41 Committee - Inventory - Hardware Revision
1111 111. .... .... = TLV Type: Organization Specific (127)
.... ...0 0000 0110 = TLV Length: 6
Organization Unique Code: 00:12:bb (Telecommunications Industry Association TR-41 Committee)
Media Subtype: Inventory - Hardware Revision (0x05)
Hardware Revision: v0
Telecommunications Industry Association TR-41 Committee - Inventory - Firmware Revision
1111 111. .... .... = TLV Type: Organization Specific (127)
.... ...0 0001 0011 = TLV Length: 19
Organization Unique Code: 00:12:bb (Telecommunications Industry Association TR-41 Committee)
Media Subtype: Inventory - Firmware Revision (0x06)
Firmware Revision: OpenWrt 24.10.0
Telecommunications Industry Association TR-41 Committee - Inventory - Software Revision
1111 111. .... .... = TLV Type: Organization Specific (127)
.... ...0 0001 0101 = TLV Length: 21
Organization Unique Code: 00:12:bb (Telecommunications Industry Association TR-41 Committee)
Media Subtype: Inventory - Software Revision (0x07)
Software Revision: r28427-6df0e3d02a
Telecommunications Industry Association TR-41 Committee - Inventory - Serial Number
1111 111. .... .... = TLV Type: Organization Specific (127)
.... ...0 0001 0100 = TLV Length: 20
Organization Unique Code: 00:12:bb (Telecommunications Industry Association TR-41 Committee)
Media Subtype: Inventory - Serial Number (0x08)
Serial Number: ABCDEF-123456
Telecommunications Industry Association TR-41 Committee - Inventory - Manufacturer Name
1111 111. .... .... = TLV Type: Organization Specific (127)
.... ...0 0000 1010 = TLV Length: 10
Organization Unique Code: 00:12:bb (Telecommunications Industry Association TR-41 Committee)
Media Subtype: Inventory - Manufacturer Name (0x09)
Manufacturer Name: glinet
Telecommunications Industry Association TR-41 Committee - Inventory - Model Name
1111 111. .... .... = TLV Type: Organization Specific (127)
.... ...0 0001 0101 = TLV Length: 21
Organization Unique Code: 00:12:bb (Telecommunications Industry Association TR-41 Committee)
Media Subtype: Inventory - Model Name (0x0a)
Model Name: GL.iNet GL-MT6000
Telecommunications Industry Association TR-41 Committee - Inventory - Asset ID
1111 111. .... .... = TLV Type: Organization Specific (127)
.... ...0 0010 0011 = TLV Length: 35
Organization Unique Code: 00:12:bb (Telecommunications Industry Association TR-41 Committee)
Media Subtype: Inventory - Asset ID (0x0b)
Asset ID: abcdefghijklmnopqrstuvwxyz 1234
The Cisco DUT displays:
Hardware Revision: v0
Firmware Revision: OpenWrt 24.10.0
Software Revision: r28427-6df0e3d02a
Serial Number: ABCDEF-123456
Manufacturer Name: glinet
Model Name: GL.iNet GL-MT6000
Asset ID: abcdefghijklmnopqrstuvwxyz 1234
Signed-off-by: Paul Donald <newtwen+github@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/18354
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 412c850f07)
Link: https://github.com/openwrt/openwrt/pull/18469
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Do not verify the format of TLV. Leave that to lldpd.
These lldpd config entries:
config custom-tlv
list ports 'eth0'
option tlv 'replace oui 33,44,55 subtype 254 oui-info 55,55,55,55,55'
config custom-tlv
option tlv 'oui 33,44,44 subtype 232'
list ports 'br-lan'
list ports 'eth0'
config custom-tlv # oui-info truncated
option tlv 'add oui 33,44,33 subtype 66 oui-info 5555555555'
config custom-tlv
option tlv 'add oui 33,44,31 subtype 44'
config custom-tlv # invalid oui
option tlv 'add oui 3322 subtype 79'
config custom-tlv # invalid oui
option tlv 'oui 3312 subtype 74'
Produce the following lldpd.conf content:
configure ports eth0 lldp custom-tlv replace oui 33,44,55 subtype 254 oui-info 55,55,55,55,55
configure ports br-lan,eth0 lldp custom-tlv oui 33,44,44 subtype 232
configure lldp custom-tlv add oui 33,44,33 subtype 66 oui-info 5555555555
configure lldp custom-tlv add oui 33,44,31 subtype 44
configure lldp custom-tlv add oui 3322 subtype 79
configure lldp custom-tlv oui 3312 subtype 74
And lldpd (v1.0.13 on v22) logs the following:
Sat Mar 16 19:11:39 2024 daemon.info lldpd[10916]: custom TLV op replace oui 33:44:55 subtype fe
Sat Mar 16 19:11:39 2024 daemon.info lldpd[10916]: custom TLV op add oui 33:44:44 subtype e8
Sat Mar 16 19:11:39 2024 daemon.info lldpd[10916]: custom TLV op add oui 33:44:33 subtype 42
Sat Mar 16 19:11:39 2024 daemon.info lldpd[10916]: custom TLV op add oui 33:44:33 subtype 42
Sat Mar 16 19:11:39 2024 daemon.info lldpd[10916]: custom TLV op add oui 33:44:31 subtype 2c
Sat Mar 16 19:11:39 2024 daemon.info lldpd[10916]: custom TLV op add oui 33:44:31 subtype 2c
Sat Mar 16 19:11:39 2024 daemon.warn lldpcli[10915]: invalid OUI value '3322'
Sat Mar 16 19:11:39 2024 daemon.info lldpcli[10915]: an error occurred while executing last command
Sat Mar 16 19:11:39 2024 daemon.warn lldpcli[10915]: invalid OUI value '3312'
Sat Mar 16 19:11:39 2024 daemon.info lldpcli[10915]: an error occurred while executing last command
Sat Mar 16 19:11:39 2024 daemon.info lldpcli[10915]: lldpd should resume operations
( The last two TLV are invalid: their oui must be three hex bytes, comma
separated. Only the first hex byte of oui-info 5555555555 is used )
Depends on #14867 and its release version bump
Tested on: 22.03.6
Signed-off-by: Paul Donald <newtwen+github@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/14872
(cherry picked from commit 8d1fe32c2c)
Link: https://github.com/openwrt/openwrt/pull/18343
Signed-off-by: Robert Marko <robimarko@gmail.com>
where csv = comma separated value(s)
Make the function more generic. Can use it for not only 'config'.
Now it can be used to parse interfaces for additional lldpd settings,
e.g. custom-tlv.
Tested on: 22.03.6
Signed-off-by: Paul Donald <newtwen+github@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/14872
(cherry picked from commit a015f59880)
Link: https://github.com/openwrt/openwrt/pull/18343
Signed-off-by: Robert Marko <robimarko@gmail.com>
d8b43985e4d7 ubus: fix token_create policy
7326459bd743 ubus: dump service information on network_get
6c9c8fbd8128 service: add @all as alias for all members, unless defined differently
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 84909c62c8)
`ucv_array_set` releases the array's reference to the object being cleared.
If this is the last reference to the object, it will be freed, making our
pointer `val` invalid.
To avoid this, we need to obtain our own reference to the object so we
can safely return `val`.
Signed-off-by: Matthew Cather <mattbob4@gmail.com>
(cherry picked from commit 6a10da2934)
Since `wpa_ucode_registry_add` collects its own reference to the values added, the
two functions `hostapd_ucode_bss_get_uval` and `hostapd_ucode_iface_get_uval` would
sometimes return a referenced object (from `uc_resource_new`) and sometimes return
an unreferenced object (from `wpa_ucode_registry_get`). Now, both functions always
return a referenced object.
This change also indirectly fixes `hostapd_ucode_bss_get_uval`, ensuring it now
always returns a referenced object.
Signed-off-by: Matthew Cather <mattbob4@gmail.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 7729f96093)
Remove extra ucv_get calls when passing a referenced value to an object
without using it further.
Signed-off-by: Matthew Cather <mattbob4@gmail.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 22eaf18647)
This fixes a common reference counting bug typically along the lines of:
```
uc_value_push(ucv_get(ucv_string_new(...)));
```
This would leave our new string with a reference count of 2, one from
the construction of the string, the other from `ucv_get`. This would
prevent the strings from being correctly cleaned up when it goes out
of scope.
Signed-off-by: Matthew Cather <mattbob4@gmail.com>
(cherry picked from commit f79968ee0f)
75a236be122a service: add missing null pointer check
f5341f327539 ubus: add api for generating and validating security tokens
3fab99eab4d5 add udebug support
28d86bd30e97 pex: only respond to update requests when we have network data
8e6f37cc361e pex-msg: ignore no-data responses if version is zero
12e6cf7f63e1 pex: create pex host from update responses
edc8fdae463a ubus: show the local addresses in network status
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit ce68f61cb6)
Depending on the config / circumstances, the get_psk call can be called
multiple times from differnt places, which can lead to wrong sta->psk_idx
values. The correct call is the one that is also interested in the vlan_id,
so use the vlan_id pointer as indication of when to set sta->psk_idx.
Also fix off-by-one error for secondary PSKs
Fixes: b2a2c28617 ("hostapd: add support for authenticating with multiple PSKs via ubus helper")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 8118b2dace)
93458ac dns: fix response to TYPE_PTR query
68af311 fix unicast response port and timeout
a2b4979 service: announce all services in single dns answer
4537734 display announced services in ubus call umdns browse
0b50c29 display more srv attributes in output of ubus browse function
Signed-off-by: John Crispin <john@phrozen.org>
(cherry picked from commit d162fd5ed4)
322500403615 service: add default group @ to match all nodes
5f7860306200 ubus: rename unetd_ubus_notify to unetd_ubus_network_notify
d13752814651 enroll: add PEX sub-protocol to support enrolling new nodes into a network
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit c0f06cb6ac)
Makes it easier to enable MDNS on wan without having to edit the firewall
configuration for it
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 05138fe898)
Unless another toolchain is present (or selected), build the bpf toolchain
whenever a package is selected that needs it.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 6605e45676)
The lldp_class and lldp_location config option are only valid when
compiled with LLDP-MED support. If not they will cause lldpd not to
start.
Signed-off-by: Sebastian Pflieger <sebastian@pflieger.email>
Link: https://github.com/openwrt/openwrt/pull/17571
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 2c22d7c3a4)
lldpd was updated, so reset PKG_RELEASE after the PKG_VERSION update.
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit abbec429b4)
