If the MTU of one of an attached interface becomes too small to transmit
the local translation table then it must be resized to fit inside all
fragments (when enabled) or a single packet.
But if the MTU becomes too low to transmit even the header + the VLAN
specific part then the resizing of the local TT will never succeed. This
can for example happen when the usable space is 110 bytes and 11 VLANs are
on top of batman-adv. In this case, at least 116 byte would be needed.
There will just be an endless spam of
batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (110)
in the log but the function will never finish. Problem here is that the
timeout will be halved all the time and will then stagnate at 0 and
therefore never be able to reduce the table even more.
There are other scenarios possible with a similar result. The number of
BATADV_TT_CLIENT_NOPURGE entries in the local TT can for example be too
high to fit inside a packet. Such a scenario can therefore happen also with
only a single VLAN + 7 non-purgable addresses - requiring at least 120
bytes.
While this should be handled proactively when:
* interface with too low MTU is added
* VLAN is added
* non-purgeable local mac is added
* MTU of an attached interface is reduced
* fragmentation setting gets disabled (which most likely requires dropping
attached interfaces)
not all of these scenarios can be prevented because batman-adv is only
consuming events without the the possibility to prevent these actions
(non-purgable MAC address added, MTU of an attached interface is reduced).
It is therefore necessary to also make sure that the code is able to handle
also the situations when there were already incompatible system
configuration are present.
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Maintainer: Rob White rob@blue-wave.net
Compile tested: All
Run tested: arm_cortex-a7_neon-vfpv4, mipsel_24kc, mips_24kc, aarch64_cortex-a53, x86-64
On 23.5 and master/snapshot.
Description:
mesh11sd (3.1.0)
This release contains new functionality and numerous fixes.
New functionality includes support of non-mesh segments of backhaul
with blocking of bridge loops and spanning tree priority settable in the configuration
Details can be found here:
https://github.com/openNDS/mesh11sd/releases/tag/v3.1.0
Signed-off-by: Rob White <rob@blue-wave.net>
(cherry picked from commit 4af9b69e1b)
With the commit 01e5cfc "CI: Add target/arch tags (no suffix) for
snapshot images"[1] the os/platform is set for all images, which is usually
different from what the GitHub action runner uses (x86). The Docker
deamon still tries to fetch the x86 version and fails.
This commit explicitly sets the fitting arch.
[1]: 01e5cfccd7
Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit d359fa04eda29638b9326c194490685c1177fd49)
(cherry picked from commit da3b77402d)
The batadv_vlan proto doesn't need to do anything when it gets teared down.
But the scripts are still trying to call the teardown function of this
proto. This results in warnings like:
daemon.notice netifd: batmesh1 (18940): ./batadv_vlan.sh: eval: line 37: proto_batadv_vlan_teardown: not found
Just providing a stub function avoids this log spam.
Fixes: #1044
Reported-by: Rani Hod <rani.hod@gmail.com>
Fixes: f5205d7d24 ("batman-adv: upgrade package to latest release 2014.2.0")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
The newest Linux stable kernel releases:
* v5.10.205
* v5.15.144
* v6.1.69
received a backported version of commit 1f5020acb33f ("net: vlan: introduce
skb_vlan_eth_hdr()"). batman-adv must therefore not provide this function
any longer for these kernel versions.
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Maintainer: Rob White rob@blue-wave.net
Compile tested: arm_cortex-a7_neon-vfpv4, mipsel_24kc, x86-64
Run tested: arm_cortex-a7_neon-vfpv4, mipsel_24kc, x86-64; on snapshot, 23.05, 22.03
Description:
opennds (10.2.0) - This version is a minor upgrade that introduces some significant additional functionality.
In addition it includes numerous enhancements bug fixes and cosmetic fixes.
Additional functionality includes:
* Pre-emptive Client Lists
* Autonomous Block Lists
* Internet hosted https FAS support for resource limited routers
* Fair Usage Policy
Details can be found here:
https://github.com/openNDS/openNDS/releases/tag/v10.2.0
Signed-off-by: Rob White <rob@blue-wave.net>
(cherry picked from commit a5ec54aee3)
Fix a buffer overflow in case the
query string is too long.
Signed-off-by: Moritz Warning <moritzwarning@web.de>
(cherry picked from commit fe1c67fb3d)
DependencyBot, which are using is sending us emails about these CVEs:
CVE-2012-6708
CVE-2020-23064
CVE-2019-11358
This was reported to maintainer in April 2023, but no one stepped it to fix that,
so let's drop this.
Replacement could be luci-app-bmx7.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit c2124dd2ad)
This package is no longer maintained by us or by upstream developers.
The last version in the GitHub repository is from 2020 with no activity so far.
We are using version 0.1-alpha.
Because LuCI app is vulnerable to several CVEs and DependencyBot still
sends emails about it, let's drop it.
If anyone wants, they can use bmx7.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 9fb9d9343e)
Maintainer: Rob White rob@blue-wave.net
Compile tested: arm_cortex-a7_neon-vfpv4, mipsel_24kc, x86-64
Run tested: arm_cortex-a7_neon-vfpv4, mipsel_24kc, x86-64; on snapshot, 23.05, 22.03
Description:
opennds (10.1.3)
Security Advisory. This version contains fixes for multiple potential security vulnerabilities
Credit - Stanislav Dashevskyi - standash.github.io [standash]
It also contains some minor bug fixes
* Fix - Buffer overflow causing segfault - CVE-2023-41101 [bluewavenet]
* Fix - Memory leaks due to passing allocated buffer into safe_asprintf() - CVE-2023-41102 [bluewavenet]
* Fix - Remove deprecated preauth option [bluewavenet]
* Fix - missing free in show_preauth_page if MHD does not respond [bluewavenet]
* Fix - more safe_asprintf memory leaks [bluewavenet]
* Fix - missing free for mark_auth [bluewavenet]
* Fix - memory leak after starting authmon daemon [bluewavenet]
* Fix - memory leak in encode_and_redirect_to_splashpage [bluewavenet]
* Fix - Community themespec, voucher css and logo image [bluewavenet]
* Fix - ThemeSpec, path to logo in page footer [bluewavenet]
* Fix - ensure gatewayurl is urldecoded to fix broken css and images in themespec [bluewavenet]
* Add - set default fas remote fqdn to disabled [bluewavenet]
Signed-off-by: Rob White <rob@blue-wave.net>
(cherry picked from commit 88c98c910a)
The automatic recalculation of the maximum allowed MTU is usually triggered
by code sections which are already rtnl lock protected by callers outside
of batman-adv. But when the fragmentation setting is changed via
batman-adv's own batadv genl family, then the rtnl lock is not yet taken.
But dev_set_mtu requires that the caller holds the rtnl lock because it
uses netdevice notifiers. And this code will then fail the check for this
lock:
RTNL: assertion failed at net/core/dev.c (1953)
Fixes: c738e4751e ("batman-adv: Merge bugfixes from 2023.2")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
* Broken sync while rescheduling delayed work
* compat: Use native kstrtox.h for 5.10.185
* Do not get eth header before batadv_check_management_packet
* Trigger events for auto adjusted MTU
* Don't increase MTU when set by user
* Fix TT global entry leak when client roamed back
* Fix batadv_v_ogm_aggr_send memory leak
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Maintainer: Rob White rob@blue-wave.net
Compile tested: All
Run tested: arm_cortex-a7_neon-vfpv4, mipsel_24kc, x86-64, on 21.02, 22.03 and snapshot.
Description:
mesh11sd (2.0.0)
This release contains new functionality.
Autonomous portal mode is introduced. This simplifies the rollout of meshnodes allowing a common configuration to be used on all nodes.
Remote administration is introduced, allowing files to be copied and terminal sessions to be opened on established meshnodes, identifying remote nodes by mac address.
* Add - Update config file [bluewavenet]
* Add - implementation of remote copy [bluewavenet]
* Add - implementation of remote connect [bluewavenet]
* Add - Autonomous portal mode [bluewavenet]
-- Rob White dot@blue-wave.net Mon, 31 Jul 2023 16:59:52 +0000
Signed-off-by: Rob White <rob@blue-wave.net>
(cherry picked from commit 5beb3be9b8)
Maintainer: Rob White rob@blue-wave.net
Compile tested: arm_cortex-a7_neon-vfpv4, mipsel_24kc, x86-64
Run tested: arm_cortex-a7_neon-vfpv4, mipsel_24kc, x86-64; on snapshot, 23.05, 22.03
Description:
opennds (10.1.2)
Security Advisory. This version contains fixes for multiple potential security vulnerabilities
Credit - Stanislav Dashevskyi - standash.github.io [standash]
It also contains some minor bug fixes
* Fix - Generate unique sha256 faskey if not set in config - CVE-2023-38324 [bluewavenet]
* Fix - NULL pointer dereference if user_agent is NULL - CVE-2023-38320, CVE-2023-38322 [bluewavenet]
* Fix - NULL pointer dereference if authdir is called with an incomplete or missing query string - CVE-2023-38313, CVE-2023-38314, CVE-2023-38315 [bluewavenet]
* Fix - remove deprecated and non-functioning unescape callback - CVE-2023-38316 [bluewavenet]
* Fix - prevent potential recursive dependency and detect if conflicting package is installed [bluewavenet]
Signed-off-by: Rob White <rob@blue-wave.net>
(cherry picked from commit 3eb9aa3056)
Announcement:
https://alioth-lists.debian.net/pipermail/babel-users/2023-July/004100.html
Babeld removed diversity routing [0], so we need to adjust ubus
bindings. Further. we need to add a patch that makes local_kind
accessible again: "100-local-make-local_kind-function-accessible.patch"
Refresh patches:
- 600-add-ubus.patch
[0] - a081608335
Signed-off-by: Nick Hainke <vincent@systemli.org>
(cherry picked from commit 9e13652bbf)
OpenNDS lists nodogsplash a conflict as well.
This causes a circular reference that is not allowed.
Signed-off-by: Moritz Warning <moritzwarning@web.de>
Maintainer: Rob White rob@blue-wave.net
Compile tested: arm_cortex-a7_neon-vfpv4, mipsel_24kc, x86-64
Run tested: arm_cortex-a7_neon-vfpv4, mipsel_24kc, x86-64; on snapshot, 23.05, 22.03
opennds (10.1.1)
* This version contains some minor bug fixes and documentation updates
* Fix - send only contents of buffer, not entire buffer when serving page511 [bluewavenet]
* Fix - Set fas_remotefqdn to gw_fqdn when overriding FAS settings [bluewavenet]
* Fix - use absolute path for css and images in ThemeSpec [bluewavenet]
* Fix - revert to old option names without underscores [bluewavenet]
* Fix - FAS URL when fas_remotefqdn is not set [bluewavenet]
Signed-off-by: Rob White <rob@blue-wave.net>
(cherry picked from commit 26f5f0f812)
Maintainer: Rob White rob@blue-wave.net
Compile tested: arm_cortex-a7_neon-vfpv4, mipsel_24kc, x86-64
Run tested: arm_cortex-a7_neon-vfpv4, mipsel_24kc, x86-64; on snapshot, 23.05, 22.03
opennds (10.1.0)
This version is a major upgrade including full migration to nftables and native
uci configuration support even for generic Linux distributions.
It also includes a significant refactoring of inbuilt memory management,
improving long term reliability, fixing several memory leaks, buffer overflows and several edge case crashes.
* Add - support for included custom binauth script [bluewavenet]
* Add - emit a useful stderr message if auth_restore fails [bluewavenet]
* Add - procd respawn threshold, respawn timeout and respawn retry parameters [bluewavenet]
* Add - user friendly commandline message if already running [bluewavenet]
* Fix - Enabling of Data volume quotas [bluewavenet]
* Fix - use get_list_from_config instead of get_option_from_config [bluewavenet]
* Fix - compiler warning - unused variable [bluewavenet]
* Fix - remove redundant function call ipsetconf [bluewavenet]
* Fix - walledgarden for both nftset and ipset on OpenWrt [bluewavenet]
* Add - more meaningful output if attempt is made to restart when already running [bluewavenet]
* Fix - resolve gatewayfqdn after startup [bluewavenet]
* Fix - Choose forground or background running according to commandline arguments [bluewavenet]
* Fix - remove superfluous debug message [bluewavenet]
* Fix - replace sleep with procd_set_param term_timeout [bluewavenet]
* Fix - make option enabled default to enabled [bluewavenet]
* Fix - report authmon pid instead of opennds pid from authmon [bluewavenet]
* Fix - ensure correct pid obtained for opennds [bluewavenet]
* Add - StartLimitIntervalSec and StartLimitBurst to systemd service script [bluewavenet]
* Fix - refactor remote downloads [bluewavenet]
* Fix - suppress error message on ipset test failure [bluewavenet]
* Fix - send non-syslog debug information to stdout by default [bluewavenet]
* Add - C function to check heartbeat watchdog [bluewavenet]
* Fix - Update generic Linux makefile [bluewavenet]
* Fix - remove redundant ruleset struct definition [bluewavenet]
* Fix - potential buffer overflow issue during config stage [bluewavenet]
* Fix - remove unnecessary calls to free() in page 404 processing [bluewavenet]
* Fix - remove redundant code from fw_iptables [bluewavenet]
* Add - updates to binauth_log script [bluewavenet]
* Add - updates for service startup, systemd and procd [bluewavenet]
* Add - refactoring of commandline processing [bluewavenet]
* Fix - remove debugging message [bluewavenet]
* Fix - typo in client ruleset [bluewavenet]
* Add - Refactor to use uci config directly even for Generic Linux [bluewavenet]
* Add - Parsing for multi item lists with spaces in items [bluewavenet]
* Add - use common library call get_option_fom_config [bluewavenet]
* Add - support for direct use of uci format config file - string and integer parameters [bluewavenet]
* Fix - Remove deprecated syslog_facility config setting [bluewavenet]
* Add - thread busy message to ndsctl [bluewavenet]
* Add - refactor configure_log_location [bluewavenet]
* Fix - suppress LOG_NOTICE message when getting mac of interface [bluewavenet]
* Fix - ndsctl error message [bluewavenet]
* Fix - get_client_interface for levels 2 and 3 [bluewavenet]
* Add - use common library write_log function [bluewavenet]
* Add - Refactor memory management [bluewavenet]
* Fix - fix and refactor upload rate limiting rules [bluewavenet]
* Fix - Change a debug message from err to info [bluewavenet]
* Add - refine common buffer sizes [bluewavenet]
* Add - use initialised heap memory for redirect_to_splashpage [bluewavenet]
* Add - user message to themespec [bluewavenet]
* Add - auth_restore support ie reauth clients after a restart by default. [bluewavenet]
* Add - Library call to preemptively re-auth clients after a restart or crash [bluewavenet]
* Add - BinAuth, write an authenticated clients list [bluewavenet]
* Add - library call "check_heartbeat" [bluewavenet]
* Fix - Tidy up redundant code [bluewavenet]
* Fix - change warning message to debug message when iw not installed [bluewavenet]
* Add - library call to log to syslog [bluewavenet]
* Fix - use initialised heap memory for client list entries [bluewavenet]
* Fix - ignore legacy ipset firewall rule [bluewavenet]
* Fix - refactor memory management for MHD calls - use heap memory for buffers etc [bluewavenet]
* Fix - missing free causing memory leak [bluewavenet]
* Fix - predefine and initialise buffer for send_redirect_temp [bluewavenet]
* Add - support protocol "all" in firewall ruleset [bluewavenet]
* Add - pre-allocation of initialised buffers [bluewavenet]
* Fix - prevent buffer overrun on removing client [bluewavenet]
* Add - update MHD connection timeout and connection limit [bluewavenet]
* Add - chain ndsDLR for dynamic client download rate limiting rules [bluewavenet]
* Add - Use Internal Polling Thread / Thread Per Connection in MHD [bluewavenet]
* Add - some new default values [bluewavenet]
* Fix - remove some redundant code and fix some compiler warnings [bluewavenet]
* Fix - remove redundant library command string [bluewavenet]
* Fix - Tidy up redundant iptables code [bluewavenet]
* Add - convert trusted client support to nftables [bluewavenet]
* Add - refer to nftables [bluewavenet]
* Add - move code for generating authentication mark string to initial setup [bluewavenet]
* Add - full nftset support with ipset import where required [bluewavenet]
* Add - nftset support library calls [bluewavenet]
* Add - ipset_to_nftset library call [bluewavenet]
* Add - support for nftables version of append_ruleset and nftables_compile [bluewavenet]
* Fix - buffer overflow in page_511 generation [bluewavenet]
* Add - more nftables migration including rate quotas [bluewavenet]
* Fix - change GatewayInterface to lower case [bluewavenet]
* Add - upload and download limiting client flags for future use [bluewavenet]
* add - lib calls "pad_string" and "replace_client_rule" [bluewavenet]
* Add - further nftables migration [bluewavenet]
* Fix - correctly parse options from legacy conf file [bluewavenet]
* Fix - some compiler warnings and set min iptables version [bluewavenet]
* Add - Generic Linux configure walledgarden [bluewavenet]
* Add - Implementation of nftsets for walledgarden [bluewavenet]
* Add - migration to nftables, next phase. [bluewavenet]
* Add - library function delete_client_rule [bluewavenet]
* Fix - remove duplicate definition [bluewavenet]
* Add - First stage migration to nftables [bluewavenet]
Signed-off-by: Rob White <rob@blue-wave.net>
(cherry picked from commit 7b1911020b)
- armvirt target has been renamed to armsr (Arm SystemReady) [1].
- armsr-armv8 has been switched to aarch64_generic architecture [2].
1. 40b02a2301
2. e0f06ddc23
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 04a287eea0)
Add concurrency rules to skip redundant build to skip extra build test
on force push on pull request.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 5aa683be13)
Currently, the package run-test phase will fail for PRs that only
add/update host-only packages, as no target packages (*.ipk) are built.
This checks if any target packages are built before attempting the
run-tests.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 299ee2b1cf)
Some packages variants have conflicting dependencies with the
base packages and the CI test will fail to install before anything
can be done by the packages to setup the system for install.
This change adds a pre-test.sh that runs before the install so things
like the default libustream variant can be swapped out as shown in the
updated cache-domains.
Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>
(cherry picked from commit 61997c86b0)
To test each package, the CI-built target package (ipk) file is
installed, but currently the target package's dependencies are installed
from the standard opkg feeds.
There are cases when the CI-built target packages should be
installed/tested together:
* If a pull request contains several new packages that depend on each
other, the test step will fail as the new dependencies cannot be found
in the current packages feed.
* If a pull request upgrades a source package that builds several target
packages that depend on each other, the test step may fail due to the
version/ABI mismatch between a newer target package and the older
dependencies installed from the packages feed.
This sets up a local feed for the CI-built packages so that dependencies
are also installed from the same set of packages.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit f818fe716e)
836b4e1c734f9705bfd8db0da0c04214c2647932 added
--force-removal-of-dependent-packages but it does not do what the commit
message says it does.
When package A depends on package B (package B is a dependency of
package A; package A is a dependent of package B), trying to remove
package B while package A is installed will result in an error. Adding
--force-removal-of-dependent-packages in this case will cause the
removal of package B and package A (package B's dependent).
But in the case of the CI testing step, it is package A that is being
installed and removed. Removing package A with
--force-removal-of-dependent-packages will not cause package B (package
A's dependency) to be removed.
This adds --autoremove to actually remove the package's dependencies.
This also ignores any errors returned by opkg remove as --autoremove can
sometimes falsely return an error[1].
[1]: https://github.com/openwrt/openwrt/issues/12241
Fixes: 836b4e1c734f ("github-ci: add --force-removal-of-dependent-packages")
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 53a53b8ee3)
OpenWrt master is no longer providing any kernels older than 5.15. Just
drop the compat-hacks/patches for older kernels to make it easier to
maintain the package.
Signed-off-by: Sven Eckelmann <sven@narfation.org>
* support latest kernels (4.14 - 6.4)
* drop single unicast transfer optimization for unsnoopable IP addresses
* prepare infrastructure for multicast packets with multiple unicast destination
addresses
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Simon Wunderlich