Mohd Husaam Mehdi authored 3 years ago and Markus Gothe committed 7 months ago

Merge commit : cd2778a4c9cb30210d1823ff90d2f50fbc8f3b28
to GNX-11.

Cherry-picked and tested on GNX-11.

Change-Id: I9693b06a2942c9920efcb8a52ef56d2a5846eb60

Mohd Husaam Mehdi authored 3 years ago and Markus Gothe committed 7 months ago

Merge from genexis-10 to genexis-11.
Added support for rx and tx multicast packet counters.
Extended ifXTable of IF-MIB for the same.

Change-Id: Ia5a790fc046d14f45f6a0b3a88073ff951d3325f

Rohit Topno authored 3 years ago and Markus Gothe committed 7 months ago

Fix: Admin status of all ports are now up by default and
the admin status is fetched correctly for all ports.

Test - Admin status of all ports are up by default.
root@D_wan_115_1:~# snmpwalk -v 2c -c public 172.25.115.100 .1.3.6.1.2.1.2.2.1.7
iso.3.6.1.2.1.2.2.1.7.1 = INTEGER: 1
iso.3.6.1.2.1.2.2.1.7.2 = INTEGER: 1
iso.3.6.1.2.1.2.2.1.7.3 = INTEGER: 1
iso.3.6.1.2.1.2.2.1.7.4 = INTEGER: 1
iso.3.6.1.2.1.2.2.1.7.5 = INTEGER: 1

After changing the status of eth1 to down, the admin status is as below
root@D_wan_115_1:~# snmpget -v 2c -c public 172.25.115.100 .1.3.6.1.2.1.2.2.1.7.2
iso.3.6.1.2.1.2.2.1.7.2 = INTEGER: 2

Similar testing is conducted on all ports.

(cherry picked from commit 95e8257bf4adf6bd96a666426c4b47083aa78e17)
Change-Id: I1145c8f513463f41179674bd7ac693d32fd0e99c

Rohit Topno authored 4 years ago and Markus Gothe committed 7 months ago

SNMP features have been cherry-picked from genexis-10 branch to genexis-11 branch

Fix : Makefile is modified to fix compilation error

(cherry picked from commit 62d19691f951f0ea4b7a0f39507952cb9300adbe)
(cherry picked from commit f505502c30b0e31b39c335835ba7bc2c5fa0715e)
(cherry picked from commit 991d0e3bbac3e74cc24a610e902f5fef8728ac05)
(cherry picked from commit 4146a86dc998d458e391883b6dae5252f7d55008)
(cherry picked from commit ecffcfa7beddcc63c0e45a0a5c5b2bf9e10bd12f)
(cherry picked from commit faaeb94f619ee5b981b0df80dca55b0154b84d49)
(cherry picked from commit 097add11715ba9a3276801083aa93ba81218c195)
(cherry picked from commit 3734410f22f40facbdf37ac007004cfae529e295)
(cherry picked from commit 54206a33df28bc1101a8aebfb9b4cbbff873b571)
(cherry picked from commit 32eb6af13736fb18a4afd1d0d37d59ed2668c176)
(cherry picked from commit 8e6a0911a46250d9fc77d0bd077c8aad30fd964a)
(cherry picked from commit 63fbe5e05288c3eb953212384d99f9b20fb3f15c)
(cherry picked from commit ab35e69d6e08d6c262b880129fb5a6013e0871cd)
Change-Id: I45e8be160a53ba6c97bdea6c426ca4b02d6d5849

Mohd Husaam Mehdi authored 1 year ago and Markus Gothe committed 7 months ago

Fallback to Radius authentication if local user is not present,
but in that case, the user will be logged in as root.

Change-Id: I0d9030f04bc0acfdf24d0403127c97935a5c7607

Mohd Husaam Mehdi authored 2 years ago and Markus Gothe committed 7 months ago

* Modifies openssh defaults to allow ssh for root.
* Adds commented pam_radius_auth.so to sshd.pam so that user does not have to manually copy it.

Change-Id: Ib5d78d2defb201f048cf04aee13adbb1e5c55c8e

Add logic for https-dns-proxy to not modify
dhcp-configuration unless DNS-over-HTTPS has
been configured.

Change-Id: I3578a917b4f748f31d8b6035f39f8c077c6e3986

George Yang authored 2 years ago and Markus Gothe committed 7 months ago

The patch addressed following 2 ddns-scripts issues:

 * procd_lock is not released by dynamic_dns_updater.sh daemons
   which caused later /etc/init.d/ddns always locked out.

   It caused hang of "ubus call luci.ddns get_ddns_state",
   and further hang of webgui Dynamic DNS.

 * /etc/init.d/ddns reload did not function

   Under current /bin/sh, "killall -1 dynamic_dns_updater.sh"
   does not send signal to the dynamic_dns_updater.sh daemon.

Change-Id: I9fa1d773dd8e4c4971f3c4cf053b13dbc99048c9

Erik Karlsson authored 4 years ago and Markus Gothe committed 7 months ago

There is a hack for building subdirectories before the parent
directory. There is a bug in this which causes the EXPORTS and
PRIVATE_EXPORTS targets to be built twice leading to a race condition.

Change-Id: I94230722671aa6c0c10afdfe376bbb3fa86d109f

Erik Karlsson authored 9 months ago and Vivek Dutta committed 9 months ago

Otherwise it is possible to write to the socket pair when there is no
consumer resulting in the buffer growing indefinitely. This issue
manifests itself when an external event loop is used together with
mosquitto_loop_read/mosquitto_loop_write/mosquitto_loop_misc instead
of using mosquitto_loop, mosquitto_loop_forever or threaded mode with
mosquitto_loop_start/mosquitto_loop_stop


(cherry picked from commit 3f96b060)

* add rsa-sha2-512 and rsa-sha2-256 to default list of HostKeyAlgorithms

this option is needed to announce http servers via mdns as DNS-SD
services

* since there are multiple ways in which port can be set in the
  server section, and the order can also be changed, the logic has
  been updated to handle these conditions while announcing the
  port number on which server is running
* nginx does not allow adding options to server section, so option
  mdns which controls whether services have to announced over
  mdns, has been moved to the global section
* add support for announcing service if non-standard ports are
  used

Add support and set defaults for following in default sshd config:

* Ciphers:		aes256-ctr, aes192-ctr, aes128-ctr

* HostKeyAlgorithms:	ssh-dss, ssh-rsa, ecdsa-sha2-nistp521,
			ecdsa-sha2-nistp384,ecdsa-sha2-nistp256

* HostKeyFiles:		default is empty

* KexAlgorithms:	diffie-hellman-group-exchange-sha256,
			diffie-hellman-group14-sha1,
			ecdh-sha2-nistp521,ecdh-sha2-nistp384,
			ecdh-sha2-nistp256

* add uci-default script that will generate an sshd config from
  dropbear config, if present (to preserve settings from previous
  image which had dropbear), or with default values if sshd config
  is also not present

* the script will also check for dropbear key file and if found,
  place them where sshd expects them

the values read from uci will now be written to a config file
which will be passed to sshd, instead of passing the values
as command line arguments to sshd

nginx-ubus-module version was not updated since past 4 years.
It had many security and memory related fixes along with optimizations

This reverts commit 8b2c130b.

While 743f0c5b (perl: Run make depend to fix build race condition,
2024-03-05) fixed 98% of all parallel build failures there is still some
flakiness left in the perl build process. For now, give up instead of
digging deep into the perl build process to debug this.

We may later revert this commit to see whether the issue is fixed in a
later perl version in a later OpenWrt release.

Signed-off-by: Andreas Gnau <andreas.gnau@iopsys.eu>

Mohd Mehdi authored 11 months ago and Rahul Thakur committed 11 months ago

* openssh package is missing uci support in openwrt,
this commit implements the same. The init script
now reads from the uci and passes the arguments to
openssh.
* support for handling multiple instances is also
added.

note: the same has been up-streamed and has also got
1 approval already.

disable ftp by default so that the port is not open

The following init scripts have been modified to use procd:
* atftpd
* vsftpd

The following services are being advertised:

* atftpd: tftp
* nginx: http, https, http-alt, pcsync-https
* vsftpd: ftp
* xl2tpd: l2tp

Run make depend before building perl. This fixes parallel build failures
on machines with a high number of cores.

Example error 1:

    /bin/ln -s /build/staging_dir/hostpkg/usr/bin/generate_uudmap generate_uidmap
    make[5]: ./generate_uudmap: Command not found
    make[5]: *** [Makefile:321: bitcount.h] Error 127

Example error 2:

    /bin/ln -s /build/staging_dir/hostpkg/usr/bin/generate_uudmap generate_udmap
    ./generate_uudmap uudmap.h bitcount.h mg_data.h
    /bin/ln: failed to create symbolic link 'generate_uudmap': File exists
    make[5]: *** [Makefile:325: generate_uudmap] Error 1

Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=996953
Link: https://salsa.debian.org/perl-team/interpreter/perl/-/commit/366bc98c916a3455f15c532aa33a5636d2fe2803
Closes: https://github.com/openwrt/packages/issues/8238


Signed-off-by: Andreas Gnau <andreas.gnau@iopsys.eu>

libstrophe is dual-licensed as MIT OR GPL-3.0-only, which is also
reflected by the SPDX-License-Identifier lines in the source files.
Correct PKG_LICENSE in the Makefile accordingly.

Signed-off-by: Andreas Gnau <andreas.gnau@iopsys.eu>
(cherry picked from commit ccb4632c57d456289e79e6062b3349c8779bf8ce)

Instead of /sbin/ install logread to /usr/sbin/logread. This works
around a conflict with the logd package.

Signed-off-by: Andreas Gnau <andreas.gnau@iopsys.eu>

Amit Kumar authored 1 year ago and Rahul Thakur committed 1 year ago

child expect entry timeout value set handled
in the response message of PAUSE with condition
verification of cseq value.

This makes it consistent with configuration for busybox in IOWRT and
is needed for compatibility with pam_unix which lacks bcrypt support.