Hi Dave, On Apr 21, 2014, at 21:09 , Dave Taht <[email protected]> wrote:
> On Sun, Apr 20, 2014 at 1:46 PM, Sebastian Moeller <[email protected]> wrote: >> Hi Dave, >> >> >> On Apr 19, 2014, at 22:01 , Dave Taht <[email protected]> wrote: >> >>> + felix's wifi patch for bug #442 added >>> please break wifi. >>> >>> + debloat qlens reduced again to 12 for be and bk wifi queues >>> + heartbleed fix from -3 forward >>> >>> I note that nearly every "secured"-by-openssl network facing daemon has been >>> shown vulnerable to heartbleed. The hole in openvpn bit *me*, in >>> particular. I've updated, rekeyed and re-certified the vpns I have in >>> place, and you should too for any openvpn servers and clients you have >>> too. >>> >>> It was a real PITA for me, and I only had a few boxes on it. >>> >>> For more details, see: http://community.openvpn.net/openvpn/wiki/heartbleed >>> >>> For more details on the daemons potentially affected by heartbleed in >>> cerowrt, openwrt, and others, see the advisory at: >>> >>> http://www.bufferbloat.net/news/50 >>> >>> + resync with openwrt >>> notably there were updates to netifd, and a fix for a strongswan CVE >>> >>> + dnscrypt added as an optional package (thx stephen walker and "mailjoe") >>> + snort added as an optional package >>> >>> +/- full dnssec >>> - upgrade to httping 2.x broke >>> - no sqm auto tuning yet >> >> Note, all you need is to put the word "auto" (without the quotes) in >> the fields named: >> Latency target for ingress, e.g 5ms [units: s, ms, or us]; leave empty for >> default, or auto for automatic selection. >> and >> Latency target for egress, e.g. 5ms [units: s, ms, or us]; leave empty for >> default, or auto for automatic selection.. >> >> The bigger caveat is that the current implementation probably is not ideal >> and could need a bit of data guided optimization… > > And more eyeballs. Oh, sure! > >> @Dave: if you think this is ready to be inflicted upon the greater cerowrt >> community I can see what is required to actually make SQM default to that >> behavior.. > > Inflict away. Great, I just pushed a number of changes reworking the handling of IFB devices (WIP, lightly tested not fully complete but saner than the previous hard coding). I also snuck in the change I believe to me the last missing piece to change the "default" behavior to auto. How do I build an ilk packet from ceropackages? Then I could go and test a fresh install to see whether the committed changes actually chance the default ;). Oh and I do hope you have/will have a great vacation. Best Regards Sebastian > >> Best Regards >> sebastian >> >>> - neither snort nor dnscrypt tested >>> >>> If you are not experiencing problems with wifi or with heartbleed >>> there are few reasons to update to this release. >>> >>> I wanted to note to those that use sysupgrade without a clean reflash, >>> in that the >>> /etc/opkg.conf file is not re-written in this case, and still points >>> to the old repository. >>> If you wish to install additional packages after an inplace upgrade, >>> you will have >>> to also update /etc/opkg.conf to point to the right place. >>> >>> -- >>> Dave Täht >>> >>> NSFW: >>> https://w2.eff.org/Censorship/Internet_censorship_bills/russell_0296_indecent.article >>> _______________________________________________ >>> Cerowrt-devel mailing list >>> [email protected] >>> https://lists.bufferbloat.net/listinfo/cerowrt-devel >> > > > > -- > Dave Täht > > NSFW: > https://w2.eff.org/Censorship/Internet_censorship_bills/russell_0296_indecent.article _______________________________________________ Cerowrt-devel mailing list [email protected] https://lists.bufferbloat.net/listinfo/cerowrt-devel
