Re: AW: [PATCH v2 0/7] 22.03 lantiq: add support for x490 Fritzboxes

2022-10-26 Thread Hauke Mehrtens
Hi, I am also fine if the user has to use image builder. This board is a bit special. Maybe we should allow board specific initram fs root file systems in the future. This would also help in other cases where the user has to bot an initramfs system for initial flashing. We can do this later.

Re: CVEs in OpenWrt 22.03

2022-10-26 Thread Hauke Mehrtens
On 10/25/22 17:21, Dave Taht wrote: On Tue, Oct 25, 2022 at 7:37 AM Peter Naulls wrote: On 10/24/22 18:21, Hauke Mehrtens wrote: Hauke, thanks for replying! As I said on a related thread - if an eu body can be found to care more deeply on these issues, I'm pretty sure 30-50k of funding is

Re: CVEs in OpenWrt 22.03

2022-10-26 Thread Hauke Mehrtens
On 10/25/22 16:29, Peter Naulls wrote: On 10/24/22 18:21, Hauke Mehrtens wrote: Hauke, thanks for replying! I also prefer if the CVE number is named in the patch. If this is missing somewhere you could send a patch or pull request to rename the patch. I'm afraid I don't have any explicit

Re: [PATCH v2 2/2] realtek: use assisted learning on CPU port

2022-10-26 Thread Jan Hoffmann
On 26.10.22 at 00:20, Jan Hoffmann wrote: L2 learning on the CPU port is currently not consistently configured and relies on the default configuration of the device. On RTL83xx, it is disabled for packets transmitted with a TX header, as hardware learning corrupts the forwarding table otherwise.

Re: [PATCH v2 0/2] realtek: fix L2 entry setup and learning on CPU port

2022-10-26 Thread Jan Hoffmann
On 26.10.22 at 10:20, Sander Vanheule wrote: Hi Jan, On Wed, 2022-10-26 at 00:20 +0200, Jan Hoffmann wrote: This is a follow-up to the patch "realtek: don't set L2LEARNING flag in rtl83xx TX header". An undesired effect of that patch is flooding of some packets destined for the switch CPU

Re: Security changes - restricting uhttpd addresses

2022-10-26 Thread Mikael Magnusson
On 2022-10-26 18:55, Etienne Champetier wrote: Le mar. 25 oct. 2022 à 17:47, Michael Richardson a écrit : Peter Naulls wrote: > It might also be better if uhttpd could be configured to bind > to a specific interface rather than knowing its IP upfront, but > that might be

Re: Security changes - restricting uhttpd addresses

2022-10-26 Thread Greg Oliver
On Wed, Oct 26, 2022 at 11:58 AM Etienne Champetier wrote: > > Le mar. 25 oct. 2022 à 17:47, Michael Richardson > a écrit : > > > > > > Peter Naulls wrote: > > > Nevertheless, the security people are looking at this config > > > statically, and not seeing that it's bound to the LAN

[PATCH] build: touch stampfile after subtarget run

2022-10-26 Thread Michael Pratt via openwrt-devel
The sender domain has a DMARC Reject/Quarantine policy which disallows sending mailing list messages using the original "From" header. To mitigate this problem, the original message has been wrapped automatically by the mailing list software.--- Begin Message --- Each individual build directory

Re: Security changes - restricting uhttpd addresses

2022-10-26 Thread Etienne Champetier
Le mar. 25 oct. 2022 à 17:47, Michael Richardson a écrit : > > > Peter Naulls wrote: > > Nevertheless, the security people are looking at this config > > statically, and not seeing that it's bound to the LAN interface IP > > only. > > I don't think they are really security people,

Re: Security changes - restricting uhttpd addresses

2022-10-26 Thread Peter Naulls
On 10/25/22 18:20, openwrt-devel-requ...@lists.openwrt.org wrote: From: Nathan Lutchansky My hands are tied, we gotta do the dance. I mean this as gently as possible, but I think what a lot of us are missing is the benefit to the OpenWrt project to carry an increased maintenance burden in

Re: lua 5.1.5 CVEs / lua 5.3 with luci

2022-10-26 Thread Jo-Philipp Wich
Hi, > Can one be curious and ask what is gonna be used instead of lua, or is > that still not 100% decided yet? you can find more details at https://forum.openwrt.org/t/luci-rewrite-in-ucode-testers-wanted/137250 ~ Jo signature.asc Description: OpenPGP digital signature

Re: lua 5.1.5 CVEs / lua 5.3 with luci

2022-10-26 Thread Luna Jernberg
Ah thanks On Wed, Oct 26, 2022 at 3:57 PM Jo-Philipp Wich wrote: > > Hi, > > > Can one be curious and ask what is gonna be used instead of lua, or is > > that still not 100% decided yet? > > you can find more details at > https://forum.openwrt.org/t/luci-rewrite-in-ucode-testers-wanted/137250 >

Re: lua 5.1.5 CVEs / lua 5.3 with luci

2022-10-26 Thread Luna Jernberg
Can one be curious and ask what is gonna be used instead of lua, or is that still not 100% decided yet? On Wed, Oct 26, 2022 at 3:54 PM Jo-Philipp Wich wrote: > > Hi, > > all errors you quoted are occurring within Lua code. The view rendering etc. > mostly happens in JavaScript on the client

Re: lua 5.1.5 CVEs / lua 5.3 with luci

2022-10-26 Thread Jo-Philipp Wich
Hi, all errors you quoted are occurring within Lua code. The view rendering etc. mostly happens in JavaScript on the client side, this is why things /seem/ to work. Many backend actions are implemented as rpcd plugins in Lua code though, and all those seem to fail (not register with rpcd in the

Re: lua 5.1.5 CVEs / lua 5.3 with luci

2022-10-26 Thread Peter Naulls
On 10/25/22 20:45, Reuben Dowle wrote: My opinion is that openwrt should try and move to a newer version of lua. This old 5.1.5 version appears to be unmaintained, and there does not seem to be the resources within the openwrt community to change that. So I naively adjusted the lua5.3

[PATCH procd] ubus: add state measurement

2022-10-26 Thread Florian Eckert
Procd has different states during booting. When the system is booted, it is in the 'running' state. This state is only exited when the system is shut down cleanly. This state is called 'shutdown'. To find out what state the system is in and how long it will take to complete this, the commit adds a

Re: [PATCH v2 0/2] realtek: fix L2 entry setup and learning on CPU port

2022-10-26 Thread Sander Vanheule
Hi Jan, On Wed, 2022-10-26 at 00:20 +0200, Jan Hoffmann wrote: > This is a follow-up to the patch "realtek: don't set L2LEARNING flag in > rtl83xx TX header". An undesired effect of that patch is flooding of > some packets destined for the switch CPU port, which is addressed by > this additional

[PATCH] libnl-tiny: set SOCK_CLOEXEC if available

2022-10-26 Thread Joerg Vehlow
From: Joerg Vehlow If CLOEXEC is not set on the netlink socket, restarting netifd using ubus fails with "Failed to initialize system control", because the bind call in nl_connect fails with EADDRINUSE, due to the inherited socket handle. Also it does not make sense, to leak the handle to child