Re: [OpenWrt-Devel] [PATCH] zones: enforce forward policy with zone_NAME_src_POLICY

2019-12-13 Thread Jo-Philipp Wich
Hi, per definition, zone forward policies were only ever meant to apply to traffic between interfaces within the same zone *not* to traffic anywhere else. Your patch would break that assumption as far as I can see. ~ Jo signature.asc Description: OpenPGP digital signature

Re: [OpenWrt-Devel] Preserving configs over sysupgrade on ath79/tiny broken for some boards (on 19.07 and master), possible solutions

2019-12-30 Thread Jo-Philipp Wich
Hi, given that (binary release) support for 4MB devices will end with 19.07, I'd vote for reverting the 4K sector change in ath79 and stick with 64K ones as common denominator across the entire target. That will be the least invasive and most robust fix. Regards, Jo signature.asc Description:

Re: [OpenWrt-Devel] [PATCH] busybox: Include hdparm by default on nas type device

2020-01-01 Thread Jo-Philipp Wich
Hi Linus, can you move the condition before the sed program populating the initial config? That should restore the ability for users to deselect busybox hdparm (e.g. to replace it with something different). ~ Jo signature.asc Description: OpenPGP digital signature _

[OpenWrt-Devel] Merged: openssl: update to version 1.0.2u

2020-01-01 Thread Jo-Philipp Wich
Merged into openwrt-18.06 at http://git.openwrt.org/?p=openwrt/openwrt.git. Thank you! ___ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/mailman/listinfo/openwrt-devel

[OpenWrt-Devel] Merged: libcxx: Build with the libsupc++ ABI

2020-01-01 Thread Jo-Philipp Wich
Merged into master at http://git.openwrt.org/?p=openwrt/openwrt.git. Thank you! ___ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/mailman/listinfo/openwrt-devel

[OpenWrt-Devel] Merged: libcxx: Add size optimizations

2020-01-01 Thread Jo-Philipp Wich
Merged into master at http://git.openwrt.org/?p=openwrt/openwrt.git. Thank you! ___ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/mailman/listinfo/openwrt-devel

[OpenWrt-Devel] Merged: scripts/gen-dependencies.sh: use /bin/sh

2020-01-01 Thread Jo-Philipp Wich
Merged into master at http://git.openwrt.org/?p=openwrt/openwrt.git. Thank you! ___ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/mailman/listinfo/openwrt-devel

[OpenWrt-Devel] Merged: scripts/gen-dependencies.sh: replacebackticks with $()

2020-01-01 Thread Jo-Philipp Wich
Merged into master at http://git.openwrt.org/?p=openwrt/openwrt.git. Thank you! ___ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/mailman/listinfo/openwrt-devel

Re: [OpenWrt-Devel] [PATCH] scripts/gen_image_generic.sh: Replace -o with ||

2020-01-01 Thread Jo-Philipp Wich
Hi, > [...] > +if [ ! $# -eq 5 ] || [ ! $# -eq 6 ]; then why not simply "-ne" ? ~ Jo signature.asc Description: OpenPGP digital signature ___ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/mailman/listinfo/openw

Re: [OpenWrt-Devel] [PATCH 1/2] scripts/flashing: Switch from echo -en to printf

2020-01-01 Thread Jo-Philipp Wich
Hi. $ patch -p1 < 1216552.patch patching file scripts/flashing/flash.sh Hunk #1 FAILED at 51. 1 out of 1 hunk FAILED -- saving rejects to file scripts/flashing/flash.sh.rej ~ Jo signature.asc Description: OpenPGP digital signature ___ openwrt-devel m

Re: [OpenWrt-Devel] dev.archive.openwrt.org cert expired

2020-01-01 Thread Jo-Philipp Wich
Hi, thanks. The cert was auto-renewed but the nginx reload failed due to `service` not being in $PATH for cronjobs. ~ Jo signature.asc Description: OpenPGP digital signature ___ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists

[OpenWrt-Devel] Merged: cryptodev-linux: remove DEFAULT redefinition

2020-01-15 Thread Jo-Philipp Wich
Merged into my staging tree at http://git.openwrt.org/?p=openwrt/staging/jow.git. Thank you! ___ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/mailman/listinfo/openwrt-devel

Re: [OpenWrt-Devel] [PATCH v2] wireguard: fix interface remove for lonely peers

2020-01-16 Thread Jo-Philipp Wich
Hi, I think this behavior is not really acceptable. Programs, init scripts, hotplug events etc. should not automatically modify (and commit) uci configurations, especially not such vital ones like the network config. The main problem I see is that you do not know what state the config is in at an

Re: [OpenWrt-Devel] [PATCH v2] wireguard: skip peer config if public key of the peer is not defined

2020-01-16 Thread Jo-Philipp Wich
Hi, > + if [ -z "$public_key" ]; then > + echo "Skipping peer config $peer_config because public key is > not defined." > + return 0 > + fi I guess there will be other error conditions that could cause the wg setup to fail... is there any more robust way to check

Re: [OpenWrt-Devel] [PATCH v2 5/5] hostapd: wpa_supplicant: enable proper GCMP cipher support

2020-01-16 Thread Jo-Philipp Wich
Hi, > + case "$wpa_cipher" in > + GCMP) > + append network_data "pairwise=GCMP" "$N$T" > + append network_data "group=GCMP" "$N$T" > + ;; > + esac > + how is this supposed to work and look like in uci? I couldn't find any oth

Re: Interface names when putting 802.1q VLAN on top of bonding configuration

2021-05-28 Thread Jo-Philipp Wich
Hi, the following should do what you want. config device option type 8021q option ifname bonding-lan option vid 20 option name vlan20 config interface vlan20 option ifname vlan20 option proto static option ipaddr 172.20.34.2 option netmask 255.255.255.128 ~ Jo signature.asc

Re: Luci->Network->Interfaces is broken

2021-05-31 Thread Jo-Philipp Wich
Hi, > This is the reason. Long time ago, I did select the option 'Remove ipkg/opkg > status data files in final images' to reduce the image size. Since such an > option can be selected, LuCI cannot assume, that the file netifd.control > exists. fixed. ~ Jo signature.asc Description: OpenPGP

Re: [PATCH] base-files: simplify setting device MAC

2021-06-01 Thread Jo-Philipp Wich
Hi, > Ideally you should be able to use jsonfilter too but I don't know how to > deal with "-" in a property name. Use bracket notation. > Following doesn't work for me: > > ubus call network.device status '{ "name": "br-lan" }' | jsonfilter -e > "$.bridge-members" ubus call network.device sta

Re: Interface names when putting 802.1q VLAN on top of bonding configuration

2021-06-01 Thread Jo-Philipp Wich
Hi, > One more question, now I'm trying to put a bridge on top of each of these > vlan* interfaces so that I can map those to a few physical interfaces. I also > need several vlans to map to one of the interfaces (tagged).. not sure how to > do that yet either. Any suggestions with this config?

Re: [PATCH] busybox: sysntpd: add trigger to reload server

2021-06-01 Thread Jo-Philipp Wich
Hi, >> start_service() { >> +. /lib/functions/network.sh > > > This doesn't look right. It's usually added at the top of the file, unnested. Which would be the wrong thing to do here. Since the init script is run on the host system during build (to enable it), it must not source files whic

Re: [PATCH 19.07] ubus: update to version 2021-06-03

2021-06-03 Thread Jo-Philipp Wich
Hi Petr, does that change the libubus abi? ~ Jo signature.asc Description: OpenPGP digital signature ___ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/mailman/listinfo/openwrt-devel

Re: Luci->Network->Interfaces is broken

2021-06-09 Thread Jo-Philipp Wich
Hi, > It works now (no error message), but the bad thing is, it isn't visible in > LuCI, which wireless adapter's are attached to the bridge and it needs some > clicks to see which interfaces (wired ports) are attached to the bridge. > > I don't like this solution in LuCI. Fixed with https://git

Re: ip rule processing partly broken (21.02 and Master)

2021-06-14 Thread Jo-Philipp Wich
Hi, the ip rules encoded in /etc/config/network are processed by netifd C code directly, they're not translated into busybox ip calls. The entire busybox ip.c code contains not a single instance of FIB_RULE_INVERT so it simply does not implement inversion. It will also not be able to report inver

Re: [PATCH 19.07 4/4] treewide: mark selected packages nonshared

2021-07-03 Thread Jo-Philipp Wich
Hi, > I've never seen a non integer release, is there a special reason for this? I used to do that in the past when backporting master changes to branches that didn't apply cleanly anymore. In this case the package contents between master and release branches deviated while keeping the same soft

Re: [PATCH luci] luci-mod-network: wireless.js: allow changing the 60 GHz radio's frequency

2021-07-09 Thread Jo-Philipp Wich
Hi Alex, thank you for this patch. Based on your submission I pushed a somewhat smaller fix to LuCI master which omits the last two hunks: https://github.com/openwrt/luci/commit/e5626ece12236f6be9dbb6da6eb90fcbb469a1f0 The code related to the `hwmode` option is there for backwards compatibility r

Re: [PATCH] base-files: make os-release symbolic link absolute

2021-09-08 Thread Jo-Philipp Wich
Hi, > Did you check that none of the build scripts try to access this file? In > case they do, they'd fail since an absolute path wouldn't exists on the > building host system. apart from that it might break 3rd party workflows for no obvious reason. The existing absolute symlinks mentioned all p

Re: RFC: toolchain for building eBPF modules within the OpenWrt build system

2021-10-04 Thread Jo-Philipp Wich
Hi Felix, I'd suggest to require a preinstalled host toolchain for the time being. ~ Jo ___ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/mailman/listinfo/openwrt-devel

Re: [PATCH 2/2] hostapd: force ieee80211w instead of setting a default

2021-10-11 Thread Jo-Philipp Wich
Hi, > Doesn't that downgrade PSK-SAE which the user configured to be with > mandatory MFP to now only have optional MFP? yes. The way I read it, it also prevents using the WPA3 protocol without obligatory MFP (afair some users use that for limited drivers) ~ Jo signature.asc Description: Ope

Re: [PATCH 2/2] hostapd: force ieee80211w instead of setting a default

2021-10-11 Thread Jo-Philipp Wich
Hi, > right now luci will force 2 nope, it will not. It calculates the dynamic default according to the logic in hostapd.sh and will remove the value from uci if the selected user value matches the dynamic default [1]. So with WPA3 selected and choosing 11w ... ... required -> remove option iee

Re: [PATCH] nftables: bump to 1.0.0

2021-10-17 Thread Jo-Philipp Wich
Hi, > Signed-off-by: Stijn Tintel Acked-by: Jo-Philipp Wich signature.asc Description: OpenPGP digital signature ___ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/mailman/listinfo/openwrt-devel

Re: [PATCH firewall4 1/2] tests: adapt test to new ICMP print logic

2021-10-24 Thread Jo-Philipp Wich
Hi, merged both patches, thank you! ~ Jo signature.asc Description: OpenPGP digital signature ___ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/mailman/listinfo/openwrt-devel

Re: Missing 'libubus.so' and change of ABI in 19.07.8

2021-11-13 Thread Jo-Philipp Wich
Hi, > But I really can't see the breaking change, could you please point it out for > me? struct ubus_client changed its layout. > The second question is the change of the library name from 'libubus.so' to > 'libubus.so.20210603'. Was this intended? Yes, it was intentional. Programs should li

[PATCH] procd: setup /dev/stdin, /dev/stdout and /dev/stderr symlinks

2021-11-18 Thread Jo-Philipp Wich
Extend the hotplug.json ruleset to setup the common /dev/std{in,out,err} symbolic links which are needed by some applications, e.g. nftables when applying rulesets from stdin. Signed-off-by: Jo-Philipp Wich --- package/system/procd/files/hotplug.json | 12 +++- 1 file changed, 11

[RFC PATCH] treewide: drop librt and libpthread packages

2021-11-18 Thread Jo-Philipp Wich
ship them as extra shared libraries. Signed-off-by: Jo-Philipp Wich --- package/devel/perf/Makefile | 2 +- package/devel/valgrind/Makefile | 2 +- package/libs/libevent2/Makefile | 2 +- package/libs/libnl/Makefile | 1 - package

[PATCH] procd: procd.sh: make no assumptions about init script path

2021-11-23 Thread Jo-Philipp Wich
` which corresponds to `argv[0]` when readlink failed. This fixes reload trigger setup for init script symlinks that point to files with different base names. Signed-off-by: Jo-Philipp Wich --- package/system/procd/files/procd.sh | 10 -- 1 file changed, 4 insertions(+), 6 deletions(-) diff

Re: dnsmasq issue

2021-12-05 Thread Jo-Philipp Wich
Hi, > Or does this phenomenon also happen if running without ujail? afair it also happens without ujail. Whenever handler scripts are enabled, dnsmasq will spawn a secondary helper process. This was also the reason why /etc/hotplug.d/*/ support is only conditionally enabled if installed scripts a

Re: [PATCH] netifd: system-linux: add dev_type info for ubus network.device status

2021-12-06 Thread Jo-Philipp Wich
Hi, imho these types are not that useful in practice (e.g. tap devices etc. are all reported as "ethernet". Maybe expose /sys/class/net/$devname/uevent DEVTYP= instead. ~ Jo signature.asc Description: OpenPGP digital signature ___ openwrt-devel maili

Re: [PATCH] netifd: system-linux: add dev_type info for ubus network.device status

2021-12-07 Thread Jo-Philipp Wich
Hi, > I have now taken a look at your suggestion. > Unfortunately, I found that not all network interfaces have set the DEVTYPE > attribute set in their uevent file. I have not yet found any information > who sets this value. Does this do the driver or the subsystem? afair it is set by the respon

[RFC] Stop providing binary package updates for release builds?

2021-12-12 Thread Jo-Philipp Wich
Hi, since the release of LEDE 17.01.0, OpenWrt started offering updated binary packages for released versions, means the HEAD of a released stable branch is continuously getting rebuilt and the resulting binaries are uploaded to the release repositories. Users will see those updated packages as "u

Re: [PATCH] toolchain: musl: disable crypt size hack on !SMALL_FLASH devices

2021-12-14 Thread Jo-Philipp Wich
Hi, while the decision to do that seems obvious on first sight, I think that supporting different password hashing algorithms on different targets might lead to unexpected surprises for downstream users. E.g. when precalculated password hashes taken from one device are built inside custom firmware

Merged: opkg_remove: avoid remove pkg repeatly with option--force-removal-of-dependent-packages

2022-01-26 Thread Jo-Philipp Wich
Merged into project/opkg-lede.git, branch master. Thank you! ___ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/mailman/listinfo/openwrt-devel

Re: Firewall question

2022-02-09 Thread Jo-Philipp Wich
Hello Hartmut, [...] > If I check the logs from apache2, I see from lan network only the gateway > or router ip and no client ip's. From guest network, I see every individual > client ip's. Yeah, for lan this is expected. The automatic NAT reflection consists of one DNAT rule to forward the curr

Re: Drop CONFIG_IPV6 ?

2022-03-14 Thread Jo-Philipp Wich
Hi, > Is anyone disabling CONFIG_IPV6 ? no. > Do people agree we can drop CONFIG_IPV6 ? yes. > Should we do this before we branch 22.x ? yes please. I am tired of sprinkling ifdefs, maintaining separate package build flavors, conditional dependency forests and runtime checks for IPv6 presence

Re: [PATCH] kernel/kmod-lib-lzo: include the lzo-rle kmod in the package

2022-03-22 Thread Jo-Philipp Wich
original patch: > https://patchwork.ozlabs.org/project/openwrt/patch/541cbfbd-76f2-59b3-a867-47b6f0fc7...@gmail.com/ > > Signed-off-by: Rui Salvaterra Acked-by: Jo-Philipp Wich signature.asc Description: OpenPGP digital signature ___ openwr

Re: [PATCH] packages: nvram: add NVRAM quirks for bcm53xx target

2022-05-03 Thread Jo-Philipp Wich
Hi, > I think boot() would look better, but it would be good to keep this consistent > with the bcm47xx code. Using boot() or start() does not make a big difference, > boot() calls start() anyway. an "/etc/init.d/whatever restart" will not execute boot(), which would be a reason to prefer it over

Re: Unpatched DNS bug affects millions of routers and IoT devices

2022-05-04 Thread Jo-Philipp Wich
Hi, > [QUOTE] > > The library uClibc and its fork from the OpenWRT team, uClibc-ng. Both > variants are widely used by major vendors like Netgear, Axis, and > Linksys, as well as Linux distributions suitable for embedded > applications. > > [/QUOTE] > > Does it affect my TP-link AC1200 wireless

Re: [PATCH 1/4] uclient-fetch: --header option to pass additional raw HTTP headers

2022-05-10 Thread Jo-Philipp Wich
Hi Sergey, a minor nitpick inline below. On 5/9/22 11:59 PM, Sergey Ponomarev wrote: > You can add a custom HTTP header(s) to request: > > wget --header='Authorization: Bearer TOKEN' \ > --header='If-Modified-Since: Wed, 9 May 2021 12:16:00 GMT' \ > https://example.com/ > >

Re: Question about DNS-Tap integration

2022-05-16 Thread Jo-Philipp Wich
Hi, > My question is about whether are you planning to introduce the DNS-Tap > over TCP/IP to some version of the OpenWRT Router firmware. It's the emerging > technology which might be very useful in the future. you probably should direct these questions to the upstream DNSmasq project. > You mig

Re: [PATCH firewall4] ruleset: add missing pre_* chains

2022-05-18 Thread Jo-Philipp Wich
Hi, can't you do the same by dropping a snippet into /etc/nftables.d/ which simply registers chain with lower priority hooks? In fact there already is an example [1]. So in order to achieve what you want, create an `/etc/nftables.d/10-pre-chains.nft with the following contents: -- 8< -- chain pr

Re: Wrong hash for firewall package?

2022-05-20 Thread Jo-Philipp Wich
Hi, I compared the package stored on the source mirror with the locally generated mismatching one. The contained .tar has the same checksum but the compressed xz file is different. I suppose this is due to the recent enabling of multithreaded xz compression which yields different results on differ

Re: Wrong hash for firewall package?

2022-05-20 Thread Jo-Philipp Wich
Hi again, please ignore my previous message, that was an incorrect observation on my side. In fact my locally generated source archive matches the one on the source mirror, so I assume Rui's recent bump simply added a wrong checksum. ~ Jo signature.asc Description: OpenPGP digital signature __

Re: Query regd. rw rootfs

2022-06-16 Thread Jo-Philipp Wich
Hi, > [...] > Is this behavior the same with procd? it is not the same. There is no special handling for specific overlay file paths in procd. ~ Jo signature.asc Description: OpenPGP digital signature ___ openwrt-devel mailing list openwrt-devel@lis

Re: Query regd. rw rootfs

2022-06-16 Thread Jo-Philipp Wich
Hi, > If the behavior is not same, can you let me know how "below" is > handled/taken care in OpenWRT? "changes made to sensitive files for e.g. > /etc/passwd (deleting a line. Deleting passwd file etc.) will have adverse > impact on security and some init scripts may not start etc." OpenWrt d

Re: Query regd. rw rootfs

2022-06-16 Thread Jo-Philipp Wich
Hi, > As mentioned in https://openwrt.org/docs/techref/preinit_mount#failsafeBy, > rootfs is made rw via overlay. So, even a non-root user will have the > ability to modify (for e.g. delete dnsmasq entry in /etc/passwd). no, a non-root user will lack sufficient permission to modify these files.

Re: [PATCH 1/2] ubox: fix GCC fanalyzer warnings

2022-07-18 Thread Jo-Philipp Wich
Hi, > [...] > - free(aliases); > + if (aliases) > + free(aliases); This check is redundant, the free() function is guaranteed to be NULL-safe in the standard: The free() function shall cause the space pointed to by ptr to be deallocated; that is, made available for further

Re: [PATCH firewall4] fw4: add support for include.d dir

2022-07-22 Thread Jo-Philipp Wich
Hi, instead of introducing uci includes that configure nft includes, why not encode the chain/position etc. values directly into the path/filename and directly include the file if it exists at the expected location? A potential pattern could be "[0-9][0-9]_{ruleset_pre,ruleset_post,table_pre,tabl

Re: Question about ancient TARGET_CFLAGS in rules.mk?

2022-07-23 Thread Jo-Philipp Wich
Hi, > I mean I know they are gigantic corner case where you can build an entire > house in the corner... But what are the drawbacks of such small fix? The > NULL check one for example seems pretty important... Adding that null check there seems redundant, any code path that could lead to blob_n

Re: Contributions to netifd

2022-08-03 Thread Jo-Philipp Wich
Hi Joerg, > we are a company of experts for automotive software and are working for > many customers in the automotive industry. > > One of our customers (a big german automotive supplier) is looking for a > network configuration solution with some specific limitations and after > evaluating sev

Re: [PATCH firewall4] fw4: add support for include.d dir

2022-08-11 Thread Jo-Philipp Wich
tc/config/firewall which it isn't since it'll silently ignore any non-include section type being put there I have attached my proposal as patch for reference. Kind regards, Jo From 5ab0f61350f02590c5e6c1981bce4531510517de Mon Sep 17 00:00:00 2001 From: Jo-Philipp Wich Date: Thu, 11 Aug 20

Re: [PATCH] build: always set CONFIG_IPV6

2022-08-20 Thread Jo-Philipp Wich
Hi, > [...] > This patch sets the related CONFIG to always true and removes the > config prompt, keeping the change minimal, and, should !CONFIG_IPV6 ever > be fixed, easy to revert. > > Signed-off-by: Thibaut VARÈNE Acked-by: Jo-Philipp Wich signature.asc Descriptio

Re: [PATCH rpcd] sys: mitigate possible strncpy string truncation

2022-08-24 Thread Jo-Philipp Wich
Hi, comment below. ~ Jo On 8/24/22 10:14 AM, Petr Štetiar wrote: > [...] > --- a/sys.c > +++ b/sys.c > @@ -224,7 +224,8 @@ procstr: > continue; > > if (!strcmp(var, "Package:")) { > - strncpy(pkg, p1, sizeof(pkg)); > +

Re: DSA Mini-tutorial

2022-09-07 Thread Jo-Philipp Wich
Hi, >> I wrote this mostly because the LuCI interface itself makes a distinction >> between the "Devices" tab and the "Interfaces" tab. But maybe this isn't the >> best way to describe what goes there. > > I agree that there are inconsistencies in LuCI. The only place I see the > terminology corr

Re: DSA Mini-tutorial still marked as Work In Progress

2022-09-07 Thread Jo-Philipp Wich
Hi Rich, that tutorial is good ground work imho. One thing I repeatedly noticed (not in the document, but in forum and irc chatter) is that over the time, DSA and bridge VLAN filtering became conflated into one concept while they're actually different pieces; one can do bridge VLAN filtering witho

Re: DSA Mini-tutorial

2022-09-08 Thread Jo-Philipp Wich
Hi, > [...] > Meanwhile I wonder if a few specific cases wouldn't need to be better > addressed. For instance ppp or wwan create extra « Interfaces » (in current > Luci lingo), some having the related protocol - PPPoE/NCM, some having > protocol « Virtual Dynamic Interface » (for ipv4/ipv6) - whic

Re: DSA Terminology

2022-09-13 Thread Jo-Philipp Wich
Hi, > IMHO changing, in /etc/config/network: > "config interface" -> "config network" > "config device" -> "config interface" > would eliminate this semantic inconsistency and bring the naming > convention more in line with what Rich referred to in his comments > above. This cannot be done in a s

Re: DSA Terminology

2022-09-13 Thread Jo-Philipp Wich
Hi, >> Well, it would still be less confusing than the state we're currently in. >> Anyway, converting "config interface" to "config network" and "config >> device" to "config iface" is an option. I don't like `iface`, it is also easily confused with `interface` (which - as explained - still has

Re: Add SoB tag to hack patches on generic target

2022-09-21 Thread Jo-Philipp Wich
Hi, to be pragamtic, set a `Submitted-by`, `Added-by`, `Introduced-by` or similar tag. This should provide enough clue to locate the original author without the need to "forge" Sob. ~ Jo signature.asc Description: OpenPGP digital signature ___ openwr

Re: [PATCH] Send bad forward_zone packets to verdict_from_zone

2022-09-28 Thread Jo-Philipp Wich
Hi, the forward policy for zones is supposed to only apply to forwarded traffic among interfaces of the same zone. If I read it correctly, your patch would change this long standing behavior to something else. ~ Jo signature.asc Description: OpenPGP digital signature __

Re: [musl] nslookup failures with coarse CLOCK_MONOTONIC

2022-10-07 Thread Jo-Philipp Wich
Hi, > [...] > Which implementation of nslookup is this? Busybox? It would probably > be useful to hear thoughts on it from their side. assuming the OP is using standard OpenWrt nslookup, it is the "big" busybox nslookup implementation, which is using the res_*() api and name lookup logic borrowed

Re: [PATCH] netifd: add accept_ra support

2022-10-09 Thread Jo-Philipp Wich
Hi, > Make the "Accept Router Advertisements" configurable. This is needed if > you do not want to use odhcp6c and let the kernel handle the RAs. This > can save some diskspace. NACK from me. As it will interfere with odhcp6c operation in the default setup I don't think that it is a good idea to

Re: lua 5.1.5 CVEs / lua 5.3 with luci

2022-10-26 Thread Jo-Philipp Wich
Hi, all errors you quoted are occurring within Lua code. The view rendering etc. mostly happens in JavaScript on the client side, this is why things /seem/ to work. Many backend actions are implemented as rpcd plugins in Lua code though, and all those seem to fail (not register with rpcd in the fi

Re: lua 5.1.5 CVEs / lua 5.3 with luci

2022-10-26 Thread Jo-Philipp Wich
Hi, > Can one be curious and ask what is gonna be used instead of lua, or is > that still not 100% decided yet? you can find more details at https://forum.openwrt.org/t/luci-rewrite-in-ucode-testers-wanted/137250 ~ Jo signature.asc Description: OpenPGP digital signature __

Re: [PATCH] fw4: fix handling of unaccepted forward packets

2022-11-03 Thread Jo-Philipp Wich
Hi, you misunderstand the purpose of the zone forward policy. It is not meant to catch traffic from a zone to another zone, but traffic relayed from one interface to another interface within the same zone. Traffic from one zone to another zone is solely handled by the global forward policy in the

Re: [RFC] dropping of $(AUTORELEASE) feature

2022-11-07 Thread Jo-Philipp Wich
Hi, yes, please kill it. The $(AUTORELEASE) option does not work for sources without Git history, it produces different results depending on the history, it causes package bumps for even trivial cosmetic fixes. It can also lead to situations where packages on different branches end up with the ex

Re: [RFC] dropping of $(AUTORELEASE) feature

2022-11-07 Thread Jo-Philipp Wich
Hi, > The AUTORELEASE has been a nice feature from the package PR maintenance > perspective. > > Earlier there was constant trouble with concurrent PRs for the same package > having the same PKG_RELEASE bump, or the maintainer doing a small change with > a bump while there was an open PR with the

Re: firewall4 question

2022-11-26 Thread Jo-Philipp Wich
Hi, try adding `option dest lan` to your block rule. Without any destination, it is treated as input rule, not a forwarding one. ~ Jo signature.asc Description: OpenPGP digital signature ___ openwrt-devel mailing list openwrt-devel@lists.openwrt.org

Re: ui.waitReconnect() may load over HTTP instead of HTTPS

2022-12-28 Thread Jo-Philipp Wich
Hi, ui.awaitReconnect() tries both http:// and https:// access simultaneously and redirects to whatever URL loads successfully. HTTPS access might be unavailable, e.g. when flashing an image without SSL support built in. This used to be the norm before OpenWrt enabled HTTPS by default in 22.03.

Re: Secure cookie handling upon https to http downgrade

2022-12-30 Thread Jo-Philipp Wich
Hi, > [...] > I renamed the new cookies to "http-sysauth" and "https-sysauth", to work > around this and it seems to do the right thing.  But there is still a fault > here. Already fixed with https://github.com/jow-/lucihttp/commit/6e68a1065f3ed1889e5fa053b206bd3aa108bd5f ~ Jow signature.as

Re: Secure cookie handling upon https to http downgrade

2023-01-02 Thread Jo-Philipp Wich
Hi, > More generally, and regard to the earlier suggestion, I would still suggest > splitting the http vs https cookie names in any ongoing luci rework in order > to avoid this situation. this also has been implemented already, see https://github.com/openwrt/luci/commit/08fb38399f5b297be7d460703b

Re: [PATCH] iwinfo: devices: add Qualcomm Atheros IPQ8074 WiSoC

2023-01-06 Thread Jo-Philipp Wich
Hi Robert, I know that you're just expanding existing code (which I recently noticed for the first time) but I think that adding more and more if/else clauses with further hardware matches for purely cosmetic reasons* is a good way forward. At the very least a mechanism should be added to configu

Re: [PATCH v3 6/7] ucode: Update to latest

2023-01-12 Thread Jo-Philipp Wich
Hi, > Can you change that? Could you also please omit the merge commits from the listing in the commit message? ~ Jo signature.asc Description: OpenPGP digital signature ___ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.op

Re: [OpenWrt-Devel] [PATCH] fw3: robustify flow table detection.

2020-01-23 Thread Jo-Philipp Wich
Hi, > This doesn't seem right to me in case target > 12, > MIN(sizeof(line), strlen(target)) perhaps? a simple strcmp() without len will be the most appropriate since both line (produced by fgets()) and target (a constant string literal) will be \0 terminated. ~ Jo signature.asc Description:

[OpenWrt-Devel] Merged: fw3: robustify flow table detection.

2020-01-28 Thread Jo-Philipp Wich
Merged into project/firewall3.git, branch master at http://git.lede-project.org/?p=project/firewall3.git. Thank you! ___ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/mailman/listinfo/openwrt-devel

[OpenWrt-Devel] OpenWrt 18.06.7 service release

2020-01-31 Thread Jo-Philipp Wich
Hi, The OpenWrt Community is proud to announce the seventh service release of the stable OpenWrt 18.06 series. OpenWrt 18.06.7 incorporates important security updates for base packages, new versions of the Linux kernel and fixes for various devices. Selected highlights of this service releas

[OpenWrt-Devel] OpenWrt 19.07.1 service release

2020-01-31 Thread Jo-Philipp Wich
Hi, The OpenWrt Community is proud to announce the first service release of the stable OpenWrt 19.07 series. OpenWrt 19.07.1 incorporates important security updates for base packages, fixes for 5GHz performance issues and flow offloading memory leaks as well as new versions of the Linux kernel and

[OpenWrt-Devel] Security Advisory 2020-01-31-1 - Opkg susceptible to MITM (CVE-2020-7982)

2020-01-31 Thread Jo-Philipp Wich
DESCRIPTION A bug in the package list parse logic of OpenWrt's opkg fork caused the package manager to ignore SHA-256 checksums embedded in the signed repository index, effectively bypassing integrity checking of downloaded .ipk artifacts. The bug has been introduced with commit https://git.openw

[OpenWrt-Devel] Security Advisory 2020-01-31-2 - libubox tagged binary data JSON serialization vulnerability (CVE-2020-7248)

2020-01-31 Thread Jo-Philipp Wich
ed in the OpenWrt 19.07.1, 18.06.7 and subsequent releases. Older versions of OpenWrt (e.g. OpenWrt 15.05 and LEDE 17.01) are end of life and not supported any more. Other users of libubox should update to the latest version ASAP. CREDITS The issues were discovered and fixed by Petr Štetiar and Jo-P

Re: [OpenWrt-Devel] RFI: OpenWRT Upgrade System; ENH,SEC suggestions

2020-02-01 Thread Jo-Philipp Wich
Hi Wes, > It's definitely an issue that the sha256 checksum check was broken. > But, can someone explain why a person who is MITM'ing ipk downloads > would change the package and not the checksum? the repository index files containing the SHA256 checksums are signed using usign, which is a deriva

[OpenWrt-Devel] Merged: buildbot: signall.sh store usign.key asusign.sec

2020-02-02 Thread Jo-Philipp Wich
Merged into buildbot.git, branch master at http://git.lede-project.org/?p=buildbot.git. Thank you! ___ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/mailman/listinfo/openwrt-devel

Re: [OpenWrt-Devel] [PATCH] ath79: introduces KERNEL_LZMA variable for common build sequence

2020-02-03 Thread Jo-Philipp Wich
Hi, what is the actual benefit of this? The image building recipes are hard enough to understand as-is, is it really worth it to replace a plain "kernel-bin | append-dtb | lzma" command sequence with yet another variable indirection just to safe a few bytes in the Makefile? I could understand the

[OpenWrt-Devel] [PATCH ustream-ssl] add support for specifying usable ciphers

2020-02-15 Thread Jo-Philipp Wich
https://tls.mbed.org/api/ssl_8h.html#a9914cdf5533e813e1ea7ca52981aa006 Signed-off-by: Jo-Philipp Wich --- ustream-internal.h | 1 + ustream-mbedtls.c | 66 ++ ustream-mbedtls.h | 1 + ustream-openssl.c | 11 +++- ustream-ssl.c | 1 + ustream-

[OpenWrt-Devel] [PATCH uhttpd] tls: support specifying accepted TLS ciphers

2020-02-15 Thread Jo-Philipp Wich
y: Jo-Philipp Wich --- main.c | 12 +--- tls.c | 7 ++- tls.h | 4 ++-- 3 files changed, 17 insertions(+), 6 deletions(-) diff --git a/main.c b/main.c index 6c29afe..26e74ec 100644 --- a/main.c +++ b/main.c @@ -139,6 +139,7 @@ static int usage(const char *name) "

[OpenWrt-Devel] [PATCH uclient] uclient-fetch: support specifying advertised TLS ciphers

2020-02-15 Thread Jo-Philipp Wich
ff-by: Jo-Philipp Wich --- uclient-fetch.c | 12 1 file changed, 12 insertions(+) diff --git a/uclient-fetch.c b/uclient-fetch.c index 38c9c53..a06be5d 100644 --- a/uclient-fetch.c +++ b/uclient-fetch.c @@ -467,6 +467,7 @@ static int usage(const char *progname) "HTT

[OpenWrt-Devel] Next maintenance releases

2020-02-21 Thread Jo-Philipp Wich
Hi, I'd like to release 19.07.2 and 18.06.8 sometime between Sun 23rd and Tue 25th. If you have pending important fixes you like to see backported to the respective branches please do so ASAP or mention the commits in a reply to this mail. Regards, Jo ___

Re: [OpenWrt-Devel] [PATCH v2] wireguard: fix interface remove for lonely peers

2020-03-03 Thread Jo-Philipp Wich
Hi Florian, > Deleting an interface section in LuCI is generic. So I don't know if we should > do this and make an exception for wireguard. proper removal of wg peer sections is in LuCI master and openwrt-19.07 now. ~ Jo signature.asc Description: OpenPGP digital signature ___

Re: [OpenWrt-Devel] Security implications for consideration [Was: Re: [openwrt/openwrt] rpcd: add respawn param]

2020-03-04 Thread Jo-Philipp Wich
Hi, > [...] feel free to revert it. ~ Jo signature.asc Description: OpenPGP digital signature ___ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/mailman/listinfo/openwrt-devel

Re: [OpenWrt-Devel] [PATCH] rpcd: fix respawn settings

2020-03-05 Thread Jo-Philipp Wich
Hi, > rpcd crashes for me daily, to the point where i have a script that restarts it > every 5 minutes. > > It also gets hung a lot without crashing, and stops serving responses to ubus > traffic. I've never heard about anything like that until now, not even in the forum or IRC chatter. Getting

[OpenWrt-Devel] [PATCH ustream-ssl] ustream-openssl: clear error stack before SSL_read/SSL_write

2020-03-13 Thread Jo-Philipp Wich
id results. Signed-off-by: Jo-Philipp Wich --- ustream-openssl.c | 14 -- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/ustream-openssl.c b/ustream-openssl.c index 049aa40..f8e848d 100644 --- a/ustream-openssl.c +++ b/ustream-openssl.c @@ -266,6 +266,8 @@ __h

[OpenWrt-Devel] [PATCH uhttpd] client: allow keep-alive for POST requests

2020-03-13 Thread Jo-Philipp Wich
: Jo-Philipp Wich --- client.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/client.c b/client.c index 92f7609..2a2393f 100644 --- a/client.c +++ b/client.c @@ -194,8 +194,7 @@ static int client_parse_request(struct client *cl, char *data) req->method = h_met

[OpenWrt-Devel] [PATCH] pkgconf: always retain -I and -L flags

2020-03-13 Thread Jo-Philipp Wich
fd6e65989bee184 Signed-off-by: Jo-Philipp Wich --- tools/pkgconf/files/pkg-config | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tools/pkgconf/files/pkg-config b/tools/pkgconf/files/pkg-config index fa1faccc6c..2c6fd08b4a 100755 --- a/tools/pkgconf/files/pkg-config +++ b/tools/pkgconf/files/pkg

<    1   2   3   4   5   6   7   8   9   10   >