Commit Graph

815 Commits

Author SHA1 Message Date
Jo-Philipp Wich
2df17604a4 firewall4: update to latest Git HEAD
c22eeef fw4: support negative CIDR bit notation
628d791 hotplug: reliably handle interfaces with ubus zone hints
d005293 fw4: store zone associations from ubus in statefile as well
b268225 fw4: filter non hw-offload capable devices when resolving lower devices
57984e0 fw4: always resolve lower flowtable devices
7782017 tests: fix mocked `fd.read("line")` api
72b196d config: remove restictions on DHCPv6 allow rule
f0cc317 fw4: refactor family selection for forwarding rules
b0b8122 treewide: use modern syntax
05995f1 fw4: fix emitting device jump rules for family restricted zones
b479815 fw4: fix family auto-selection for config nat rules
2816a82 ruleset: ensure that family-agnostic ICMP rules cover ICMPv6 as well
2379c3d tests: add test coverage for zone family selection logic

Fixes: #5066, #9611, #9765, #9854
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2022-05-20 19:53:04 +02:00
Tiago Gaspar
65258f5d60 firewall: config: remove restictions on DHCPv6 allow rule
Remove restrictions on source and destination addresses, which aren't
specified on RFC8415, and for some reason in openwrt are configured
to allow both link-local and ULA addresses.
As cleared out in issue #5066 there are some ISPs that use Gloabal
Unicast addresses, so fix this rule to allow them.

Fixes: #5066

Signed-off-by: Tiago Gaspar <tiagogaspar8@gmail.com>
[rebase onto firewall3, clarify subject, bump PKG_RELEASE]
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2022-05-04 15:26:16 +02:00
Jan Hoffmann
1daaef31b3 ltq-vdsl-app: disconnect when service is stopped
Stop the connection when the control daemon is terminated. The code is
a modified version of the termination routine in version 4.23.1 of the
daemon (which doesn't support VR9 modems anymore).

This could also be implemented by calling the acos and acs commands via
dsl_cpe_pipe.sh in the init script. However, doing it in the daemon
itself has the advantage of also working if it is terminated in another
way (for example during sysupgrade).

Signed-off-by: Jan Hoffmann <jan@3e8.eu>
Tested-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
2022-05-04 01:38:04 +01:00
Jo-Philipp Wich
af02a12d7c firewall4: update to latest Git HEAD
fc83d46 ruleset: set auto-merge directive for interval sets
9bce873 fw4: fix skipping invalid ipset entries
425ea8a fw4: fix applying zone flags for source bound rules

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2022-04-22 00:50:36 +02:00
Daniel Golle
c5f113c43f
netifd: relax check in dhcp proto handler
Checking whether /sbin/udhcpc is a symbolic link breaks using the
DHCP proto handler inside procd-ujail where bind-mounts are used for
the resolved link. Check whether /sbin/udhcpc is executable instead
to allow using the proto handler for DHCP-provisioned containers.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2022-04-13 19:51:00 +01:00
Rui Salvaterra
435d7a052b firewall3: bump to latest git HEAD
4cd7d4f Revert "firewall3: support table load on access on Linux 5.15+"
50979cc firewall3: remove unnecessary fw3_has_table

Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
2022-04-13 17:08:17 +01:00
Felix Fietkau
0392644083 qosify: update to the latest version
92f5e18675bf interface: fix ifname present check in interface status
ef82defaae26 ubus: add active devices to bridger blacklist

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-04-08 13:07:47 +02:00
Jo-Philipp Wich
1a35ac9990 firewall4: update to latest Git HEAD
a378883 fw4: fix emitting family specific redirect rules without any addrs
11feddf fw4: bracketize IPv6 addresses in dnat addr:port notation
9972f7d fw4: ensure to capitalize weekday names
fde8070 treewide: forward compatibility changes

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2022-04-08 10:45:46 +02:00
Felix Fietkau
c38b2c5f16 qosify: update to the latest version
Replace the tc-full dependency with tc + libnl-tiny

1cd5e12eecdc loader/interface: attach bpf program directly using netlink

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-04-05 21:28:32 +02:00
Felix Fietkau
af434e0da2 qosify: update to the latest version
57c7817f91c2 qosify: fix dscp values of ubus-added dns host entries

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-03-22 10:28:28 +01:00
Felix Fietkau
81f3c4dbcd qosify: update to the latest version
391a9fbd5ace dns: fix parsing vlan encapsulated protocol
6aeeddbc91ad interface: extend dns filters to cover vlan tagged traffic as well
1ab53d4ca601 bpf: return TC_ACT_UNSPEC to allow other filters to proceed
ca21e729af23 interface: switch to using clsact for filters
5d158f6b3c15 interface: run ingress bpf filter on main device ingress instead of ifb egress
bdfcb11847ce interface: fix duplicated dns filter line
b97405aa632a Revert "ubus: remove dnsmasq subscriber"
8fbaf39dbc95 interface: rework adding/removing filters, do not delete clsact
d7ba5804eae4 interface: replace open-coded ifb-dns string with QOSIFY_DNS_IFNAME
91cf440db9e2 loader: fix use of deprecated functions

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-03-21 20:27:15 +01:00
Jan Hoffmann
b35d33c8b8 ltq-vdsl-app: set MAC address for vectoring error reports
This tells the modem about the WAN MAC address, which is used as source
address for vectoring error reports that are generated by the firmware.

It needs to be set early, as the MEI driver only actually writes the
value to the modem when is in reset state (i.e. the firmware has been
loaded, but connection has not started yet).

Tested-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Jan Hoffmann <jan@3e8.eu>
2022-03-21 12:28:34 +00:00
Felix Fietkau
00cbf6f6ab bpftools: update to standalone bpftools + libbpf, use the latest version
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-03-19 07:30:06 +01:00
Felix Fietkau
759149977e qosify: update to the latest version
3276aed81c73 move run_cmd() to main.c
558eabc13c64 map: move dns host based lookup code to a separate function
6ff06d66c36c dns: add code for snooping dns packets
a78bd43c4a54 ubus: remove dnsmasq subscriber
9773ffa70f1f map: process dns patterns in the order in which they were defined
f13b67c9a786 dns: allow limiting dns entry matching to cname name

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-03-06 23:01:24 +01:00
Stijn Tintel
c2d7896a65 qosify: bump to git HEAD
interface: disable autorate-ingress by default

Also change the example config to reflect this.

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
2022-03-04 20:37:05 +02:00
Stijn Tintel
1848b25cdd qosify: add PKG_RELEASE
Without PKG_RELEASE, it's impossible to trigger package updates when
changing files included in the package that are not in the qosify git
repository.

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Acked-by: Felix Fietkau <nbd@nbd.name>
2022-03-04 20:25:05 +02:00
Etienne Champetier
39d50a2008 iptables: move libiptext* to their own packages
iptables-nft doesn't depend on libip{4,6}tc, so move
libiptext* libs in their own packages to clean up dependencies
Rename libxtables-nft to libiptext-nft

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
2022-02-28 21:52:01 +01:00
Felix Fietkau
cbfce92367 qosify: update to the latest version
65b42032063f interface: add missing autorate-ingress options

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-02-20 18:13:14 +01:00
Petr Štetiar
d8bf730fe0 netifd: bump to version 2022-02-20
Contains following changes:

 136006b88826 cmake: fix usage of implicit library and include paths
 bc0e84d689e2 netifd: interface-ip: don't set fib6 policies if ipv6 disabled

Signed-off-by: Petr Štetiar <ynezz@true.cz>
2022-02-20 10:52:55 +01:00
Jo-Philipp Wich
0d1220acdf firewall4: update to latest Git HEAD
53caa1a fw4: resolve zone layer 2 devices for hw flow offloading
9fe58f5 fw4: rework and fix family inheritance logic
8795296 tests: mocklib: fix infinite recursion in wrapped print()
281b1bc tests: change mocked wan interface type to PPPoE
93b710d tests: mocklib: forward compatibility change
1a94915 fw4: only stage reflection rules if all required addrs are known
5c21714 fw4: add device iifname/oifname matches to DSCP and MARK rules
3eacc97 tests: adjust 01_ruleset test case to latest changes

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2022-02-12 20:51:22 +01:00
Felix Fietkau
8072bf3322 qosify: update to the latest version
e230e71e0a12 map: fix copy-paste error in codepoints map
580d2ccf89f3 bpf: declare tcp_ports/udp_ports without typedef
8d6c19a81f3f ubus: fix a use-after-free bug

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-02-10 21:08:09 +01:00
Jo-Philipp Wich
ae75541594 firewall4: update to latest Git HEAD
a0518b6 fw4: gracefully handle unsupported hardware offloading
ac99eba init: fix boot action in init script

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2022-02-07 23:36:06 +01:00
Jo-Philipp Wich
2dd6777f15 firewall4: update to latest Git HEAD
b54f462 fw4: parse traffic rules before forwarding rules
4d5af8b fw4: consolidate helper code
300c737 fw4: fix applying zone family restrictions to forwardings
eb9c25a tests: implement fs.opendir() mock interface
d30ff48 tests: fix mocked fs.popen() trace log
52831a0 fw4: improve flowtable handling
7cb10c8 fw4: disable "flow_offloading_hw" option for now
b2241a1 fw4: fix enabling NAT reflection rules for DNATs without explicit family

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2022-02-07 11:44:36 +01:00
Jo-Philipp Wich
3b1692c463 netifd: update to latest Git HEAD
fd4c9e1 system-linux: expose hw-tc-offload ethtool feature in device status dump
3d76f2e system-linux: add wrapper function for creating link config messages
88af2f1 system-linux: delete bridge devices using netlink
85c3548 system-linux: create bridge devices using netlink

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2022-02-07 11:44:36 +01:00
Jo-Philipp Wich
edb41fea66 firewall4: update to latest Git HEAD
16a1070 fw4.uc: handle zone masq6 option
5f61dbf ruleset: fix chain selection for mark and dscp targets
0bc844b ruleset: properly deal with wildcards in zone device selectors
101988d fw4: fix family comparisons
127dbc0 ruleset: emit AF specific rules for DSCP matches
d63cb89 fw4: fix parsing inverted numeric DSCP values
8c8a867 fw4: fix wrong `parse_network()` return value on `parse_subnet()` failure
f85bb2d ruleset: consolidate zone matches for raw_prerouting and raw_output chains
5669bc7 fw4: consolidate device grouping logic
94f03e0 ruleset: properly render redirect targets without port
fff9779 fw4: fix family selection logic for redirect rules
ca88fcd tests: update interface dump mock data
e60bb4b ruleset: support non-contiguous address masks
8fec51a fw4: fix potential crashes when parsing invalid redirect sections
c08eb44 fw4: fix redirect destination zone resolving
0df6ba0 fw4: fix address selection logic for DNAT reflection rules
60a2518 tests: add test coverage for redirect rules
e479eff fw4: add RFC-8622 'Least Effort' (LE) DSCP mark
ac8a737 ruleset: remove redundant syn check
bd5dc4b tests: run testcases in strict mode
3ee6a5c ruleset: fix undeclared variable access uncovered by strict mode

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2022-01-28 19:13:37 +01:00
Hans Dedecker
7edd10f9df netifd: update to git HEAD
ed71876 iprule: add support for uidrange

Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
2022-01-23 18:54:16 +01:00
Matthew Hagan
46ce629fe0 ipip: add 'nohostroute' option
Add the nohostroute option as available for gre and wg tunnels to
allow the user to prevent explicit creation of a route to the peer
address.

Signed-off-by: Matthew Hagan <mnhagan88@gmail.com>
2022-01-19 20:57:59 +01:00
Hans Dedecker
d9064c31ca netifd: update to git HEAD
3043206 system: fix compilation with glibc 2.34

Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
2022-01-14 21:46:29 +01:00
Hans Dedecker
7f2052ef22 netifd: update to git HEAD
96902e8 Revert "netifd: add devtype to ubus call"
29e6acf netifd: add devtype to ubus call
7ccbf08 netifd: add devtype to ubus call

Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
2022-01-12 21:14:29 +01:00
Kevin Darbyshire-Bryant
e955a08340 firewall: update to latest HEAD
0f16ea5 options.c: add DSCP code LE Least Effort
24ba465 firewall3: remove redundant syn check
df1306a firewall3: fix locking issue
3624c37 firewall3: support table load on access on Linux 5.15+

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
2022-01-10 11:45:15 +00:00
Stijn Tintel
0f50d3daff firewall4: bump to git HEAD
9a509d4 ruleset.uc: consolidate ip and ip6 offload
 21f311d ruleset.uc: don't trim newline before comment sign
 f121383 tests: enable flow offloading in tests
 550df40 tests: add test for unknown defaults option
 47c5a5b tests: add test for deprecated rule option
 69a89d6 tests: add test for unknown rule option
 07579df fw4.uc: handle interface zone option

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
2022-01-09 17:38:18 +02:00
Andre Heider
5ee1e04517 ltq-vdsl: move to the default device name /dev/dsl_cpe_api/0
This makes patching it for ltq-vdsl-app unnecessary and paves the way
for VRX518 support.

Signed-off-by: Andre Heider <a.heider@gmail.com>
2022-01-08 00:49:59 +01:00
Stijn Tintel
4d1f133561 firewall4: bump to git HEAD
main.uc: fix device gathering

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
2022-01-06 21:30:14 +02:00
Jo-Philipp Wich
7881dce7d8 firewall4: fix syntax error in dependency spec
Fixes: ae60af8572 ("firewall4: order DEPENDS alphabetically")
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2022-01-06 16:58:06 +01:00
Stijn Tintel
53b87a7a28 firewall/firewall4: provide uci-firewall
Provide uci-firewall via PROVIDES in both firewall and firewall4. This
will allow us to change the dependency of luci-app-firewall to
uci-firewall, making it possible to use it with either implementation.

Move CONFLICTS from firewall4 to firewall, to solve this recursive
dependency problem:

tmp/.config-package.in:307:error: recursive dependency detected!
tmp/.config-package.in:307:     symbol PACKAGE_firewall is selected by PACKAGE_firewall4
tmp/.config-package.in:328:     symbol PACKAGE_firewall4 depends on PACKAGE_firewall

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Reviewed-by: Jo-Philipp Wich <jo@mein.io>
2022-01-06 14:54:50 +02:00
Stijn Tintel
3ec25a657d firewall4: bump to git HEAD
4ead2a6 treewide: move executables to /sbin
 9ebc2f4 fw4.uc: filter duplicates in fw4.set
 85b74f3 treewide: support flow offloading
 be3b4e6 treewide: support hardware flow offloading
 38889b7 treewide: support set timeout
 31c7550 fw4.uc: do not skip defaults with invalid option
 334a127 fw4.uc: introduce DEPRECATED flag
 7a0d38f fw4.uc: add _name as deprecated option
 5e7ad3b fw4.uc: don't fail on unknown options
 be5f4e3 fw4.uc: allow use of cidr in ipsets

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Reviewed-by: Jo-Philipp Wich <jo@mein.io>
2022-01-06 14:54:43 +02:00
Stijn Tintel
ae60af8572 firewall4: order DEPENDS alphabetically
Add some line breaks while at at, to improve readability.

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Reviewed-by: Jo-Philipp Wich <jo@mein.io>
2022-01-06 14:54:06 +02:00
Stijn Tintel
3d4acc34bb firewall4: drop kmod-ipt-nat from CONFLICTS
The limitation of not being able to use iptables and nft nat at the same
time exists only in kernels before 4.18.

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Reviewed-by: Jo-Philipp Wich <jo@mein.io>
2022-01-06 14:53:47 +02:00
Hans Dedecker
1e57d52e2f netifd: update to latest git HEAD
5ca5e0b netifd: allow disabling rule/rule6 config sections
8875960 interface-ip: add support for IPv6 prefix invalidation
e589c05 interface-ip: use metric when looking for a route
b54ffde main: fix hotplug script usage message

Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
2021-12-17 21:06:24 +01:00
Felix Fietkau
baba2fdaa6 netifd: on dhcp interfaces, store the dhcp server in interface data
Among other things, this can be used to auto-configure the DHCP server
address for wireless APs using FILS, if the bridged interface is
configured to DHCP

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-12-10 11:33:49 +01:00
Felix Fietkau
b7ce8a8c17 qosify: remove bulk flow detection from default ports
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-12-01 16:39:12 +01:00
Felix Fietkau
ac83015621 qosify: add besteffort class and switch all default classifications to class names
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-12-01 16:39:12 +01:00
Felix Fietkau
7a496e4b4b qosify: update to the latest version
06872673c10f map: allow referring to a class index directly in tcp/udp default entries

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-11-22 17:23:15 +01:00
Felix Fietkau
3a1597c7bd qosify: install hotplug handler into /etc/hotplug.d/iface as well
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-11-22 17:23:15 +01:00
Felix Fietkau
e9610794fd qosify: add support for configuring overhead
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-11-21 13:47:18 +01:00
Felix Fietkau
9962585f2d qosify: update to the latest version
2743e58741b3 bpf: work around a verifier issue

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-11-21 13:47:18 +01:00
Felix Fietkau
b764cb9e5b qosify: add qosify-status script
This will show detailed status for all devices/interfaces

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-11-19 23:51:20 +01:00
Felix Fietkau
991966f1f5 qosify: add class specific bulk flow detection example to voice class
With the new version, priority/bulk flow detection can be selectively enabled
and configured per class

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-11-19 23:51:20 +01:00
Felix Fietkau
0351a5ff87 qosify: update to the latest version
68961a555e42 ubus: drop dnsmasq check for dns_result method
1ca3e26b8169 bpf: refactor code to support explicit opt-in for bulk+prio detection
3f0acf039f41 bpf: move flow prio/bulk detection config into a separate data structure
bc54c97e3333 map, bpf: create a separate map for configured dscp classes
46cf3eae2d99 bpf: fix bulk flow detaction
88f1db7dd611 bpf: fix priority flow detection
b5dec7874373 bpf: remove access to skb->gso_size
e728a319a9a5 interface: unify status, always include ifname, ingress, egress

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-11-19 23:51:20 +01:00
Felix Fietkau
ff6b89df70 qosify: keep ICMP in the default best-effort class
Also preserve existing DSCP tags to make it easier to test latency for
different DSCP values

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-11-19 23:51:20 +01:00
Rodrigo B. de Sousa Martins
537df46a39 qosify: move package to Base System
Since sqm-scripts and qos-scripts packages are in the same category as qosify,
the firsts being in the Base System category, I find it understandable to move
the latter to Base System instead of network section.

Signed-off-by: Rodrigo B. de Sousa Martins <rodrigo.sousa.577@gmail.com>
2021-11-19 23:51:20 +01:00
Felix Fietkau
9bd9e04b6f qosify: add missing alias support in the init script
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-11-14 19:36:34 +01:00
Paul Spooren
7bc18aa284 firewall4: update to latest Git HEAD
eb0a3ee fw4.uc: Do not quote port ranges
c5a8e3e tests: adapt test to new ICMP print logic

Also start using $(AUTORELEASE)

Signed-off-by: Paul Spooren <mail@aparcar.org>
2021-11-13 09:40:14 -10:00
Felix Fietkau
bdaacdc2fc qosify: add default alias sections
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-11-12 23:11:56 +01:00
Felix Fietkau
50d33fcf7d qosify: update to the latest version
0750f2b4d329 README: dnsmasq integration is complete
8e48d0b0cbba bpf: add initial support for splitting map dscp value into ingress and egress
bfc2cafe2a8c map: add support for defining aliases

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-11-12 23:11:56 +01:00
Felix Fietkau
a667f6b8dd qosify: mark as nonshared
The SDK does not have the LLVM toolchain yet

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-11-09 14:07:19 +01:00
Felix Fietkau
85cc004606 qosify: move files to /etc/qosify
Now that wildcard matching is supported, this makes it easier for packages
to supply their own qosify rules

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-11-08 22:26:46 +01:00
Felix Fietkau
0e4ef0e5a4 qosify: update to the latest version
737970946bc0 map: default to fnmatch matching for dns patterns. support regex via leading /
b56b112e62e2 ubus: fix crash caused by missing static keyword
3a420e272c18 qosify: support wildcards in classifier filenames

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-11-08 22:26:22 +01:00
Felix Fietkau
48c754d653 qosify: add missing dependency
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-11-08 21:32:40 +01:00
Felix Fietkau
afb9c24d90 qosify: update to the latest version
2ca7352543da map: make a helper function for freeing entries
411432ec853b map: add support for adding dns regex patterns
14803cb559d8 ubus: remove unused enum
a0740172eda6 ubus: add api for providing dns lookup results for dns regex rules
406fbf478e87 ubus: add support for dynamically adding dns based rules
5fc91183d60a README: mention dns regex entries
3ed8c3eb1a3b README: document mapping file syntax
91ce2e77d302 map: introduce low effort codepoint from RFC8622
5ff14acca0e7 interface: enable NAT on interfaces by default
e70f70e496d7 README: fix typo
f25ded617478 README: fix another typo
675238bc2ce5 loader: always reinitialize programs
010eea0d98c3 map: improve timeout handling of IP entries
7ef54a7f04a0 map: add DF codepoint
6f7fbe698555 map: increase active timeout to 300
60e06a579a13 qosify-bpf: inline check_flow() to ensure that it is jited
f5ae89e8d869 ubus: subscribe to dnsmasq.dns for dns lookup results

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-11-08 15:06:20 +01:00
Florian Eckert
b14f062849 vti: squash vtiv4 and vtiv6 packages into vti
This change adds the same package behaviour as gre package.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2021-11-03 20:34:43 +01:00
Felix Fietkau
063d49b8a0 qosify: add missing config option for nat support
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-11-03 19:41:49 +01:00
Felix Fietkau
ff4fd56732 qosify: include nls.mk to avoid build error with full NLS support enabled
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-11-03 18:54:12 +01:00
Felix Fietkau
605192f46c qosify: add missing dependency
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-11-02 10:57:29 +01:00
Felix Fietkau
9ae5f09dc8 qosify: fix package section/category
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-11-01 20:17:02 +01:00
Felix Fietkau
6738820bf6 build: fix bpf toolchain dependency for qosify
Add hidden symbols to fix defaults with CONFIG_DEVEL unset

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-11-01 18:41:20 +01:00
Felix Fietkau
f3a28b6bcf qosify: add package for simple qos based on ebpf+cake
qosify is simple daemon for setting up and managing CAKE along with a custom
eBPF based classifier that sets DSCP fields of packets.

It is configured via UCI and it supports the following features:
- simple TCP/UDP port based mapping
- IP address based mapping
- priority boosting based on average packet size
- bulk flow detection based on number of packets per second
- dynamically add IP entries with timeout

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-11-01 16:39:52 +01:00
Hans Dedecker
4eba313065 netifd: fix deletion of ip tunnels (FS#4058)
8f82742 system-linux: fix deletion of ip tunnels (FS#4058)

Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
2021-10-30 21:14:01 +02:00
Felix Fietkau
f448c26923 netifd: update to the latest version
c61a1d432b34 wireless: fix creating AP mode WDS station interfaces
f78bdec2ed5f wireless: fix handling vif attributes on reload with mode change

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-10-21 11:31:53 +02:00
Andre Heider
70729d3454 ltq-vdsl-app: add error vector counters to the ubus metrics
These are useful stats to debug vector related line deteriorations,
see [0].

Example output:
    "erb": {
	    "sent": 169925,
	    "discarded": 0
    }

[0] https://forum.openwrt.org/t/vectoring-on-lantiq-vrx200-vr9-missing-callback-for-sending-error-samples/104046

Signed-off-by: Andre Heider <a.heider@gmail.com>
2021-10-21 00:17:36 +02:00
Andre Heider
276c80bdc0 ltq-vdsl-app: prepare for multiple mei ioctls
Refactor so that the outer function opens and closes the mei fd and
passes it around, just as with the main fd.

That also allows us to use the IOCTL macro in get_vector_status() and
clean up accordingly.

Switch to AUTORELEASE while at it.

Signed-off-by: Andre Heider <a.heider@gmail.com>
2021-10-21 00:17:36 +02:00
Daniel Golle
c1685d92e4
netifd: update to git HEAD
be8cd8f interface: don't fork() to start jail interface
 7a048bd interface, ubus: rework netns up/down

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2021-10-13 00:40:23 +01:00
Felix Fietkau
fa13dd658f netifd: update to the latest version
186f6eaeba70 wireless: display log messages for setup/teardown/retry
fac471c4934a wireless: process and close script file descriptor when rerunning setup
62e2bb56f48e main: poll process log stream even if processes are killed
0e311d3f2d1a wireless: reset number of retries on config change
e467e0ff44c0 wireless: reset retry counter when setup succeeds
448ffc154fe7 wireless: fix index for stations

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-09-30 11:33:37 +02:00
Felix Fietkau
9c3b1d5563 netifd: update to the latest version
4d0c2ad3fd26 wireless: fix applying wireless devices attributes on hotplug events

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-09-28 14:27:34 +02:00
Felix Fietkau
6cd54254e4 netifd: update to the latest version
5a4ac30c7a15 netifd: rework/fix device free handling

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-09-27 19:00:28 +02:00
Felix Fietkau
c0d77852a7 netifd: update to the latest version
d590fbd255ce wireless: always enable bpdu filter for AP interfaces and VLANs
f8ff6d820283 system-linux: remove copy&paste from /proc and /sys path names
300b1220fab3 wireless: improve reliability of proxyarp support
5ba9744aac6d device: add support for configuring bonding devices
6fa9b042ff4d wireless: only apply wireless device attributes to the base vif interface
06d11bbf1f2b wireless: only enable proxyarp/isolate for AP vifs
08e954e137ff bonding: claim the port device before creating the bonding device

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-09-21 19:43:20 +02:00
Jo-Philipp Wich
eebc25ccae firewall4: update to latest Git HEAD
cf835ce treewide: convert deprecated syntax
c9a3bf5 tests: adapt to latest ucode

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2021-09-01 15:40:27 +02:00
Felix Fietkau
1796812e1d netifd: update to the latest version
94170ae24bc9 device: extend device settings flags to 64 bit
1eb0fafaa986 device: add support for configuring device link speed/duplex
ed84473b7af9 bridge: memset bst->config by default to avoid stale config values
6519cf31e4b0 bridge: add support for an external STP daemon
454e9c33c906 bridge: tune default stp parameters

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-08-24 17:35:45 +02:00
Jan Hoffmann
9754b6ba6f ltq-vdsl/ltq-vdsl-app: clean up configure args
The userspace application now uses the model=full option to match the
configuration of the kernel module. The source no longer contains SOAP
support, which was the primary reason to build only typical instead
of full before.

This makes several CLI commands, which were already supported in the
kernel module, available in the userspace application. For example, this
includes bbsg which allows to get information about VDSL2 bands.

Some previously applied build options were redundant. Disabling ADSL MIB
support is unnecessary, as it only applies to Danube. ADSL LED support
is no longer included in the source. ReTx counters are already included
with model type full.

This increases the size of the userspace application by approximately
15 kB (uncompressed). The kernel module does not change at all.

Signed-off-by: Jan Hoffmann <jan@3e8.eu>
2021-08-21 15:59:39 +02:00
Kevin Darbyshire-Bryant
45d2d4e65a firewall: update to git HEAD
40e5f6a ipsets: permit default timeout of 0

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
2021-08-15 10:23:27 +01:00
Felix Fietkau
39f81b0bf6 netifd: update to the latest version
440eb0647708 bridge: fix regression in bringing up bridge ports

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-07-26 20:43:15 +02:00
Felix Fietkau
2801fe6132 netifd: update to the latest version
85f01c44a950 bridge: check bridge port vlan membership on link-up events
17e453bd68b4 wireless: add back regular virtual interfaces on hotplug-add events as well

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-07-25 06:26:47 +02:00
Felix Fietkau
d1a812c49b netifd: update to the latest version
7f24a063475e vlan: fix device vlan alias handling

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-07-14 15:32:17 +02:00
Felix Fietkau
1236cbe30c netifd: update to the latest version
f12b073c0cc3 wireless: add some comments to functions
b0d090688302 bridge: fix setting pvid for updated vlans
ff3764ce28e0 device: move hotplug handling logic from system-linux.c to device.c
16bff892f415 ubus: add a dummy mode ubus call to simulate hotplug events
7f30b02013f2 examples: make dummy wireless vif names shorter
013a1171e9b0 device: do not treat devices with non-digit characters after . as vlan devices
f037b082923a wireless: handle WDS per-sta devices
db0fa24e1c17 bridge: fix enabling hotplug-added VLANs on the bridge port
4e92ea74273f bridge: bring up pre-existing vlans on hotplug as well
1f283c654aeb bridge: fix hotplug vlan overwrite on big-endian systems

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-07-13 07:58:18 +02:00
Perry Melange
23c3bab920 qos-scripts: add ifbN device before setting the link up
commit 50413e1ec8 replaced ifconfig
with ip.  In order to set a link state to up, the interface needs
to be added first.

Fixes: FS#3754

Signed-off-by: Perry Melange <isprotejesvalkata@gmail.com>
[Add Fixes tag]
Signed-off-by: Baptiste Jonglez <git@bitsofnetworks.org>
2021-06-21 09:18:33 +02:00
Rosen Penev
2e745e9be6 treewide: remove BUILD_PARALLEL from CMake packages
It's already default. The only exception is mt76 which has Ninja
disabled.

Found with:

git grep BUILD_PARALLEL | cut -d ':' -f 1 | sort -u > par
git grep cmake.mk | cut -d ':' -f 1 > cmake
comm -1 -2 par cmake

Signed-off-by: Rosen Penev <rosenp@gmail.com>
2021-06-19 20:44:59 -10:00
Felix Fietkau
55ded1c265 netifd: update to the latest version
61a71e5e49c3 bridge: dynamically create vlans for hotplug members
cb6ee9608e10 bridge: fix dynamic delete of hotplug vlans
7f199050f395 wireless: pass the real network ifname to the setup script
50381d0a2998 bridge: allow adding/removing VLANs to configured member ports via hotplug

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-06-04 20:36:42 +02:00
Rafał Miłecki
5fe549836f netifd: update to the latest master
899c2a4 interface: support "device" attribute and deprecate "ifname"
62e3cb5 scripts/netifd-wireless.sh: add support for specifying the operating band

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
2021-05-26 07:56:27 +02:00
Rafał Miłecki
cea6631cdf netifd: update to the latest master
config: fix ifname->ports compat rename

Fixes: 829b5c2ba3 ("netifd: update to the latest version")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
2021-05-20 12:25:25 +02:00
Felix Fietkau
829b5c2ba3 netifd: update to the latest version
02dd2f2df7cb fix unannotated fall-through warnings
3052f2f67686 extdev: remove unused function
2a97fd006c3b device: add support for configuring devices with external auth handler
87e469be0c08 wireless: fix memory corruption bug when using vlans/station entries in the config
7277764bf817 bridge: rename "ifname" attribute to "ports"

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-05-18 12:56:32 +02:00
Florian Eckert
4407d45d96 ltq-vdsl-app: extent dsl metrics with state_num and power_state_num
With the old ubus dsl API, the numbers for the individual line_states and
power_states were also returned. These were not ported to the new DSL
C-API. This commit adds the missing information.

For this the internal values are mapped to numbers.

* additional JSON output for state_num:
"state_num": <map_state_number>

Since not all values are meaningful only the following values are
implemented, this can be extended if the future.

* LSTATE_MAP_NOT_INITIALIZED
* LSTATE_MAP_EXCEPTION
* LSTATE_MAP_IDLE
* LSTATE_MAP_SILENT
* LSTATE_MAP_HANDSHAKE
* LSTATE_MAP_FULL_INIT
* LSTATE_MAP_SHOWTIME_NO_SYNC
* LSTATE_MAP_SHOWTIME_TC_SYNC
* LSTATE_MAP_RESYNC

* additinal JSON output for power_level:
"power_state_num": <map_power_satte_number>,

Since there are not so many here, all are mapped.

* PSTATE_MAP_NA,
* PSTATE_MAP_L0,
* PSTATE_MAP_L1,
* PSTATE_MAP_L2,
* PSTATE_MAP_L3,

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
v6:
Add state LSTATE_MAP_NOT_INITILIZED at the beginning of the list
Start the list LSTATE_MAP with -1
Reviewed-by: Andre Heider <a.heider@gmail.com>
2021-04-17 21:56:05 +02:00
Leon M. George
467c32600c netifd: read udhcpc user scripts from directory
Placeholder DHCP user scripts were added recently.

These files make package-based installations of such scripts more difficult.
Pull user callbacks from directories instead to allow packages and users to
install co-existing scripts more easily.

References:
130118f7a netifd: add a udhcpc.user placeholder script

Signed-off-by: Leon M. George <leon@georgemail.eu>
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> [PKG_RELEASE increase]
2021-04-17 21:13:37 +02:00
Hauke Mehrtens
b974293efa netifd: update to Git version 2021-04-03
f8899b9 netifd: bridge: set default value for igmp_snoop
327da98 netifd: add possibility to switch off route config

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2021-04-03 19:11:38 +02:00
Jeroen Peelaerts
4f27ea7c33 lantiq: use ActualNetDataRate for speed reporting
Switch to Actual Net Data Rate (ACTNDR) for speed reporting on lantiq VDSL modems

Refer to ITU-T G.997.1 chapter 7.5.2.8

Independent whether retransmission is used or not in a given transmit direction:
-   In L0 state, this parameter reports the Net Data Rate (as specified in G.992.3, G.992.5 or G.993.2) at which the bearer channel is operating.
-   In  L2 state, the parameter contains the Net Data Rate (as specified in G.992.3, G.992.5 or G.993.2) in the previous L0 state.

Signed-off-by: Jeroen Peelaerts <jeroen.peelaerts@gmail.com>
Reviewed-by: Andre Heider <a.heider@gmail.com>
2021-04-03 18:56:02 +02:00
Jeroen Peelaerts
48162e4c0c lantiq: enable G.INP retransmission counters
This commit adds monitoring for a couple of DSL line features that are
present in the lantiq firmware blobs.

* G.INP ON/OFF
* Trellis encoding ON/OFF
* Virtaul Noise ON/OFF
* Bitswap ON/OFF

Difference in size for ltq-vdsl-app = 1k
Difference in size for kmod-ltq-vdsl-vr9 < 1k

Reviewed-by: Andre Heider <a.heider@gmail.com>
Signed-off-by: Jeroen Peelaerts <jeroen.peelaerts@gmail.com>
2021-04-03 18:56:02 +02:00
Jo-Philipp Wich
3a6b187e03 firewall4: update to latest Git HEAD
29fba84 tests: expand testing
6bf82a8 fw4.uc: fix family test functions
25b2c7d fw4.uc: fix parsing boolean "0" values
694d428 rule.uc: fix redundant whitespace in rules without target
7f69fbb ruleset.uc: reduce empty lines in output
8f8e42c fw4.uc: gracefully handle missing defaults section
25287af treewide: remove ucode module preloading
802b685 fw4.uc: remove upvalue caching

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2021-04-01 00:21:55 +02:00
Daniel Golle
e62ace0ecf netifd: update to git HEAD
09632d4 device: remove left-over comment
 b22f83d handler: add mechanism to generate external device handler stubs
 80bf9d7 extdev: add support for external device handlers
 44c0f40 system-linux: reorder sysctl functions
 c84f3b0 system-linux: add device options used by wpad

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2021-03-31 01:32:51 +01:00
Hans Dedecker
9bc6662dea firewall: update to latest git HEAD
a4355a6 firewall3: clean up the flow table detection logic
edd0dc5 firewall3: create a common helper to find strings in files

Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
2021-03-30 20:49:22 +02:00
Tony Ambardar
0d75aa27d4 firewall3: update to latest git HEAD
This includes several improvements and fixes:

  61db17e rules: fix device and chain usage for DSCP/MARK targets
  7b844f4 zone: avoid duplicates in devices list
  c2c72c6 firewall3: remove last remaining sprintf()
  12f6f14 iptables: fix serializing multiple weekdays
  00f27ab firewall3: fix duplicate defaults section detection
  e8f2d8f ipsets: allow blank/commented lines with loadfile
  8c2f9fa fw3: zones: limit zone names to 11 bytes
  78d52a2 options: fix parsing of boolean attributes

Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
2021-03-27 22:24:32 +01:00
Jo-Philipp Wich
f807db006f firewall4: introduce package
This commit introduces firewall4, an nftables based reimplementation of the
UCI iptables firewall.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2021-03-19 20:16:11 +01:00