Re: [Cerowrt-devel] cerowrt-3.10.36-6 released

[Sebastian Moeller <moeller0@gmx.de>]

Hi Dave,

On Apr 21, 2014, at 21:09 , Dave Taht <dave.taht@gmail.com> wrote:

> On Sun, Apr 20, 2014 at 1:46 PM, Sebastian Moeller <moeller0@gmx.de> wrote:
>> Hi Dave,
>> 
>> 
>> On Apr 19, 2014, at 22:01 , Dave Taht <dave.taht@gmail.com> wrote:
>> 
>>> + felix's wifi patch for bug #442 added
>>>  please break wifi.
>>> 
>>> + debloat qlens reduced again to 12 for be and bk wifi queues
>>> + heartbleed fix from -3 forward
>>> 
>>> I note that nearly every "secured"-by-openssl network facing daemon has been
>>> shown vulnerable to heartbleed. The hole in openvpn bit *me*, in
>>> particular. I've updated, rekeyed and re-certified the vpns I have in
>>> place, and you should too for any openvpn servers and clients you have
>>> too.
>>> 
>>> It was a real PITA for me, and I only had a few boxes on it.
>>> 
>>> For more details, see: http://community.openvpn.net/openvpn/wiki/heartbleed
>>> 
>>> For more details on the daemons potentially affected by heartbleed in
>>> cerowrt, openwrt, and others, see the advisory at:
>>> 
>>> http://www.bufferbloat.net/news/50
>>> 
>>> + resync with openwrt
>>>  notably there were updates to netifd, and a fix for a strongswan CVE
>>> 
>>> + dnscrypt added as an optional package (thx stephen walker and "mailjoe")
>>> + snort added as an optional package
>>> 
>>> +/- full dnssec
>>> - upgrade to httping 2.x broke
>>> - no sqm auto tuning yet
>> 
>>        Note, all you need is to put the word "auto" (without the quotes) in the fields named:
>> Latency target for ingress, e.g 5ms [units: s, ms, or us]; leave empty for default, or auto for automatic selection.
>> and
>> Latency target for egress, e.g. 5ms [units: s, ms, or us]; leave empty for default, or auto for automatic selection..
>> 
>> The bigger caveat is that the current implementation probably is not ideal and could need a bit of data guided optimization…
> 
> And more eyeballs.

	Oh, sure!

> 
>> @Dave: if you think this is ready to be inflicted upon the greater cerowrt community I can see what is required to actually make SQM default to that behavior..
> 
> Inflict away.

	Great, I just pushed a number of changes reworking the handling of IFB devices (WIP, lightly tested not fully complete but saner than the previous hard coding). I also snuck in the change I believe to me the last missing piece to change the "default" behavior to auto.
	How do I build an ilk packet from ceropackages? Then I could go and test a fresh install to see whether the committed changes actually chance the default ;). Oh and I do hope you have/will have a great vacation.


Best Regards
	Sebastian

> 
>> Best Regards
>>        sebastian
>> 
>>> - neither snort nor dnscrypt tested
>>> 
>>> If you are not experiencing problems with wifi or with heartbleed
>>> there are few reasons to update to this release.
>>> 
>>> I wanted to note to those that use sysupgrade without a clean reflash,
>>> in that the
>>> /etc/opkg.conf file is not re-written in this case, and still points
>>> to the old repository.
>>> If you wish to install additional packages after an inplace upgrade,
>>> you will have
>>> to also update /etc/opkg.conf to point to the right place.
>>> 
>>> --
>>> Dave Täht
>>> 
>>> NSFW: https://w2.eff.org/Censorship/Internet_censorship_bills/russell_0296_indecent.article
>>> _______________________________________________
>>> Cerowrt-devel mailing list
>>> Cerowrt-devel@lists.bufferbloat.net
>>> https://lists.bufferbloat.net/listinfo/cerowrt-devel
>> 
> 
> 
> 
> -- 
> Dave Täht
> 
> NSFW: https://w2.eff.org/Censorship/Internet_censorship_bills/russell_0296_indecent.article