Commit Graph

5495 Commits (2021.7)
 

Author SHA1 Message Date
AndreDVJ 5681f82cef sqlite: updated to 3.16.2 9 years ago
Jeremy Chadwick 001e3b2688 root's authorized_keys should be perm 0600 (u=rw)
Reference: http://www.linksysinfo.org/index.php?threads/minor-bug-in-toastman-1-28-7510-7-wrong-permissions-on-ssh-authorized_keys.73134/
9 years ago
Jeremy Chadwick 46e307654e Add generation/use of ECDSA keys for SSH/Dropbear 9 years ago
Jeremy Chadwick 22e5a8ff64 Fixup for 25acdf: restore per-VIF adjustment
Removal of a thought-to-be-superfluous trailing </div> in
    advanced-wlanvifs.asp turned out to break per-VIF setting
    adjustment capability.  See reference for details.

    Reference: http://www.linksysinfo.org/index.php?threads/toastman-1-28-0510-8-is-missing-vifs.73116/
9 years ago
kille72 2e74f723f2 OpenVPN: default port for server 2 changed to 1195, so both servers on default settings can be started at the same time 9 years ago
kille72 f7490d91e9 OpenVPN: updated to 2.4.0 9 years ago
Sean Baughn 0a78ae3a13 Confirm dhcpv6 Confirm dhcpv6 IP/prefix address has actually changed before restarting dnsmasq/httpd.
Fix IPv6 IP not being updated in hosts file when a change occurs.

     There have been multiple reports from users experiencing excessive and frequent restarts
     of dnsmasq when IPv6 is enabled and no IP/prefix change has taken place. Dhcp6c frequently
     renewing a lease may result from several factors but a likely source is short timers set
     by ISPs on their dhcpv6 servers. This adds a check of the LAN interfaces current IPv6 IP
     against the IP stored in NVRAM. If they are different, dhcp6c-state is run in its entirety.
     If not, the process of updating NVRAM variables and restarting dnsmasq/httpd is bypassed.
     Updates to dns servers recevied by dhcp6c are performed in either case as dnsmasq actively
     polls for these changes and does not require a restart to implement them.

     Added a call to set_host_domain_name() when an IP change is confirmed so /etc/hosts
     is updated with the new IP.IP/prefix address has actually changed before restarting dnsmasq/httpd.
     Fix IPv6 IP not being updated in hosts file when a change occurs.

     There have been multiple reports from users experiencing excessive and frequent restarts
     of dnsmasq when IPv6 is enabled and no IP/prefix change has taken place. Dhcp6c frequently
     renewing a lease may result from several factors but a likely source is short timers set
     by ISPs on their dhcpv6 servers. This adds a check of the LAN interfaces current IPv6 IP
     against the IP stored in NVRAM. If they are different, dhcp6c-state is run in its entirety.
     If not, the process of updating NVRAM variables and restarting dnsmasq/httpd is bypassed.
     Updates to dns servers recevied by dhcp6c are performed in either case as dnsmasq actively
     polls for these changes and does not require a restart to implement them.

     Added a call to set_host_domain_name() when an IP change is confirmed so /etc/hosts
     is updated with the new IP.
9 years ago
Sean Baughn 884f3f11f5 Remove hard coded rapid-commit option.
Rapid-commit reduces the messages required for dhcpv6 leases from 4 to 2. This requires
     both client AND server(s) to have this option enabled. If only the client is configured
     to use it the server(s) will return a standard advertisement instead of the expected reply
     message. Dhcp6c waits for timer to expire if no valid reply message is received and then
     will process an advertisement or send solicit. This may also be a cause of unnecessary release
     and solicits when an advertisement is received from a different server than originally issued
     the lease in a multi-server network and the servers are not rapid-commit enabled ( dhcp6c returns
     "unexpected_advertise" and generates new XID/reply ).
9 years ago
Jeremy Chadwick 071dc8da10 Fix several ARM nvram utility bugs
These fixes come directly from AsusWRT/Merlin.

nvram save -- would output every NVRAM key/value to stdout
due to #ifdef/#endif conditions being commented out

nvram restore -- depending on what characters were used in
NVRAM variables (keys or values), and the obfuscation method
involving random numbers implemented by Asus, it was possible
that certain values, ranges, or byte sequences of characters
may cause restoration problems.

nvram usage syntax -- restore showing the usage syntax if
there are no matching arguments, i.e. "nvram djdsjqd" should
now show usage syntax rather than nothing.

Reference: https://github.com/RMerl/asuswrt-merlin/blob/master/release/src/router/nvram_arm/main.c
Reference: http://www.linksysinfo.org/index.php?threads/tomato-arm-cfg-file.73093/#post-282981
9 years ago
AndreDVJ 1f0196f705 libcurl: Placed acinclude/configure files from 7.50.1 (+ new things from 7.52.1) to resolve a compilation issue. 9 years ago
AndreDVJ 335080fe1b sqlite: updated to 3.15.2 9 years ago
AndreDVJ 882b885eac libcurl: updated to 7.52.1 9 years ago
AndreDVJ e097b38b9c gmp: updated to 6.1.2 9 years ago
AndreDVJ 64c15f6706 dnscrypt: updated to 1.8.1 9 years ago
AndreDVJ 233489cc1d nano: updated to 2.7.2 9 years ago
AndreDVJ 599e5675e3 tor: updated to 0.2.8.12
There's a new Tor 0.2.9.8 but I guess I should stick with the minor update for now.
9 years ago
kille72 1742d2464f Clean up 9 years ago
kille72 5823c84849 nginx: updated to 1.10.2 9 years ago
kille72 f8189476b3 Simplify handling + enable caching for favicon.ico
- Use the more-common image/x-icon MIME type wasn't applied due to MIME type being NULL
- Remove wo_favicon() function, as we can use do_file directly

Reference: http://stackoverflow.com/questions/13827325/correct-mime-type-for-favicon-ico
Reference: http://www.linksysinfo.org/index.php?threads/advancedtomato-flat-material-designed-web-gui-shibby-base.70254/page-9#post-282149

Thx Koitsu!
9 years ago
kille72 701ba875c4 Heavily increase caching of static assets like CSS, SVG, GIF, PNG, JPG, etc...
Thx Jacky!
9 years ago
kille72 ec42ba78e3 Make browser caching much longer
Previously most assets were cached only for some minutes, now we cache them for hours.
Thx Jacky!
9 years ago
kille72 e2a86d9ebf QoS: Fix inbound QoS problem
This adds "protocol ip" to be generated among the arguments for transmission control (/usr/sbin/tc).

Author: @f00b4r
Discussion: https://bitbucket.org/pl_shibby/tomato-arm/issues/74/inbound-qos-problem
9 years ago
kille72 9f681ae1c8 tor: updated to 0.2.8.11 9 years ago
kille72 46cb8243f6 OpenVPN: updated to 2.3.14 9 years ago
kille72 d43a4a8c5f Fixed invalid redirect after uploading new "Captive Portal" HTML page
Thx Jacky
9 years ago
Jeremy Chadwick e8af4c60f1 Add support for user-defined interfaces for Samba
This adds a new NVRAM variable, smbd_ifnames, a space-delimited list of
interface names to bind to.  It is used by the "interfaces" smb.conf
directive.  The variable defaults to br0 (lan_ifname) in cases where
the user has upgraded the FW without resetting NVRAM to defaults (i.e.
smbd_ifnames is unset), or when leaving the GUI form field empty.

Reference: https://www.samba.org/samba/docs/man/manpages-3/smb.conf.5.html
Reference: https://www.samba.org/~tpot/articles/multiple-interfaces.html
Reference: http://www.linksysinfo.org/index.php?threads/attempt-at-patching-smb-custom-vs-default-config-conflict-for-interfaces-option.73024/
9 years ago
kille72 7f8e1b6e42 tor: updated to 0.2.8.10 9 years ago
AndreDVJ 2f3745663f sqlite: updated to 3.15.1 9 years ago
AndreDVJ e4b3ae75f1 nettle: updated to 3.3 9 years ago
AndreDVJ e86c1865f9 libcurl: updated CA certificate bundle as of 2016-11-02 9 years ago
AndreDVJ 94f4b32b31 libcurl: updated to 7.51.0
Kept previous hacks, they were needed. Refer to aeb58c46c6
9 years ago
AndreDVJ 21035bf911 ipset: updated to 6.30
Clean sources, though re-added ipset "fix" per 4723edf9eb
9 years ago
kille72 c582be1f45 busybox: update to 1.25.1 9 years ago
kille72 886a05eb7c OpenVPN: updated to 2.3.13 9 years ago
kille72 ff127adee1 nano: updated to 2.7.1 9 years ago
kille72 436c123fa8 Makefile: compile nano with -Os flag instead & autoreconf for nano in order to not complain about automake version 9 years ago
kille72 008a111a17 openvpn: Change the "default" sever Encryption cipher from BF-CBC to more secure AES-128-CBC. 9 years ago
kille72 1f96cdcb98 OUI Lookup changed to macvendors.com 9 years ago
kille72 6cce274a7b Advanced-wireless: Transmit Power changed to 0 (hardware default) 9 years ago
kille72 e949879505 tor: updated to 0.2.8.9 9 years ago
kille72 7e7d1f8987 kernel-arm: Patched all 2.6.36 kernel against CVE-2016-5195
7a95789b39
9 years ago
kille72 5a1b23495c dropbear: disable MD5 support, for security reasons
f0229936a6
9 years ago
kille72 c621df3c13 libnfsidmap: updated to 0.26 9 years ago
kille72 bb175d8e4a sqlite: updated to 3.15.0 9 years ago
AndreDVJ cdc6469238 nginx: remove duplicated line
Reported here: https://bitbucket.org/pl_shibby/tomato-arm/issues/97/duplicate-code-in-router-rc-nginxc
9 years ago
AndreDVJ e04ee4f1c5 Removed src-rt-7.x.main directory. This repository and its upstream does not have SDK7 branch. 9 years ago
AndreDVJ f858a4fc65 libcurl: updated CA certificate bundle as of 2016-09-14 9 years ago
AndreDVJ 1d6875a1e9 libcurl: Add CA bundle support
CA bundle source from: https://curl.haxx.se/docs/caextract.html

May be useful to someone. Test case I found worked (Didn't ask to specify a ca-bundle or use -k switch for insecure). Firmware size increases ~250KB.
Tried to follow AsusWRT/RMerlin's code. File name was kept the same as source.

root@R7000:/tmp/home/root# /usr/sbin/curl -vvI https://gnupg.org
* (303) (OUT), TLS Unknown, Certificate Status (22):
* (303) (OUT), TLS handshake, Client hello (1):
* (303) (IN), TLS handshake, Server hello (2):
* (303) (IN), TLS handshake, Certificate (11):
* (303) (IN), TLS handshake, Server key exchange (12):
* (303) (IN), TLS handshake, Server finished (14):
* (303) (OUT), TLS handshake, Client key exchange (16):
* (303) (OUT), TLS change cipher, Client hello (1):
* (303) (OUT), TLS handshake, Finished (20):
* (303) (IN), TLS change cipher, Client hello (1):
* (303) (IN), TLS handshake, Finished (20):
> HEAD / HTTP/1.1
> Host: gnupg.org
> User-Agent: curl/7.50.0
> Accept: */*
>
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
< Date: Wed, 27 Jul 2016 13:37:22 GMT
Date: Wed, 27 Jul 2016 13:37:22 GMT
< Strict-Transport-Security: max-age=31536000
Strict-Transport-Security: max-age=31536000
< Accept-Ranges: bytes
Accept-Ranges: bytes
< Connection: Keep-Alive
Connection: Keep-Alive
< Keep-Alive: timeout=10, max=1000
Keep-Alive: timeout=10, max=1000
< Content-Length: 13556
Content-Length: 13556
< Last-Modified: Wed, 27 Jul 2016 10:36:01 GMT
Last-Modified: Wed, 27 Jul 2016 10:36:01 GMT
< Content-Type: text/html
Content-Type: text/html

<
9 years ago
AndreDVJ e254c636c9 ~/router/Makefile: updates to support pcre 8.39 9 years ago
AndreDVJ 3b4cb582ab pcre: updated to 8.39 9 years ago