On Mon, Apr 21, 2014 at 12:18 PM, Sebastian Moeller <[email protected]> wrote: > Hi Dave, > > On Apr 21, 2014, at 21:09 , Dave Taht <[email protected]> wrote: > >> On Sun, Apr 20, 2014 at 1:46 PM, Sebastian Moeller <[email protected]> wrote: >>> Hi Dave, >>> >>> >>> On Apr 19, 2014, at 22:01 , Dave Taht <[email protected]> wrote: >>> >>>> + felix's wifi patch for bug #442 added >>>> please break wifi. >>>> >>>> + debloat qlens reduced again to 12 for be and bk wifi queues >>>> + heartbleed fix from -3 forward >>>> >>>> I note that nearly every "secured"-by-openssl network facing daemon has >>>> been >>>> shown vulnerable to heartbleed. The hole in openvpn bit *me*, in >>>> particular. I've updated, rekeyed and re-certified the vpns I have in >>>> place, and you should too for any openvpn servers and clients you have >>>> too. >>>> >>>> It was a real PITA for me, and I only had a few boxes on it. >>>> >>>> For more details, see: http://community.openvpn.net/openvpn/wiki/heartbleed >>>> >>>> For more details on the daemons potentially affected by heartbleed in >>>> cerowrt, openwrt, and others, see the advisory at: >>>> >>>> http://www.bufferbloat.net/news/50 >>>> >>>> + resync with openwrt >>>> notably there were updates to netifd, and a fix for a strongswan CVE >>>> >>>> + dnscrypt added as an optional package (thx stephen walker and "mailjoe") >>>> + snort added as an optional package >>>> >>>> +/- full dnssec >>>> - upgrade to httping 2.x broke >>>> - no sqm auto tuning yet >>> >>> Note, all you need is to put the word "auto" (without the quotes) in >>> the fields named: >>> Latency target for ingress, e.g 5ms [units: s, ms, or us]; leave empty for >>> default, or auto for automatic selection. >>> and >>> Latency target for egress, e.g. 5ms [units: s, ms, or us]; leave empty for >>> default, or auto for automatic selection.. >>> >>> The bigger caveat is that the current implementation probably is not ideal >>> and could need a bit of data guided optimization… >> >> And more eyeballs. > > Oh, sure! > >> >>> @Dave: if you think this is ready to be inflicted upon the greater cerowrt >>> community I can see what is required to actually make SQM default to that >>> behavior.. >> >> Inflict away. > > Great, I just pushed a number of changes reworking the handling of > IFB devices (WIP, lightly tested not fully complete but saner than the > previous hard coding). I also snuck in the change I believe to me the last > missing piece to change the "default" behavior to auto. > How do I build an ilk packet from ceropackages? Then I could go and > test a fresh install to see whether the committed changes actually chance the > default ;).
Well, it helps to have a buildable cerowrt of your own... OR, you can just bump up the version numbers in the makefiles like I just did, and do a new build of the "stable"-ish cerowrt (3.10.36-6), push it out, which I just did, and ask folk to make sure their /etc/opkg.conf points to the right 3.10.36-6 repo, and to then do a opkg update opkg upgrade luci-app-sqm sqm-scripts which should pick up and install those two packages for further testing. I do look forward to the day where the kernel settles down enough to be able to incrementally improve/update/fix various packages and libraries only, or we come up with a way to make incremental updates work more often. ... in other news, making a little headway on the ubnt edgerouter: http://community.ubnt.com/t5/EdgeMAX/S-FQ-CoDel-Support-Possible/m-p/800436/highlight/false#M28705 ... >Oh and I do hope you have/will have a great vacation. thx. turned out getting a hotel in SJDS on easter was too hard so I didn't jump on a plane this weekend. I went biking in SF instead. Fell and either bruised or broke a rib. Not sure if I'm going anywhere after that. It was nice to not think about the internet for a while anyway. > > Best Regards > Sebastian > >> >>> Best Regards >>> sebastian >>> >>>> - neither snort nor dnscrypt tested >>>> >>>> If you are not experiencing problems with wifi or with heartbleed >>>> there are few reasons to update to this release. >>>> >>>> I wanted to note to those that use sysupgrade without a clean reflash, >>>> in that the >>>> /etc/opkg.conf file is not re-written in this case, and still points >>>> to the old repository. >>>> If you wish to install additional packages after an inplace upgrade, >>>> you will have >>>> to also update /etc/opkg.conf to point to the right place. >>>> >>>> -- >>>> Dave Täht >>>> >>>> NSFW: >>>> https://w2.eff.org/Censorship/Internet_censorship_bills/russell_0296_indecent.article >>>> _______________________________________________ >>>> Cerowrt-devel mailing list >>>> [email protected] >>>> https://lists.bufferbloat.net/listinfo/cerowrt-devel >>> >> >> >> >> -- >> Dave Täht >> >> NSFW: >> https://w2.eff.org/Censorship/Internet_censorship_bills/russell_0296_indecent.article > -- Dave Täht NSFW: https://w2.eff.org/Censorship/Internet_censorship_bills/russell_0296_indecent.article _______________________________________________ Cerowrt-devel mailing list [email protected] https://lists.bufferbloat.net/listinfo/cerowrt-devel
