From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wi0-x233.google.com (mail-wi0-x233.google.com [IPv6:2a00:1450:400c:c05::233]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by huchra.bufferbloat.net (Postfix) with ESMTPS id 34A0621F1CB for ; Sun, 20 Oct 2013 18:22:33 -0700 (PDT) Received: by mail-wi0-f179.google.com with SMTP id hm4so3247009wib.0 for ; Sun, 20 Oct 2013 18:22:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; bh=3T5aECEAXC0WOoqTsrBURCG54/boOWRgkD8Pb3ryv50=; b=y41c0NSoO9Y5lwjb6bbCagfUchgfCtpIoWnw6i6JpiYsb1d+Zyj0qoWNIFluQ6sNAd lfTHdbB5LXnZ7NnbvaUFVhfZ6pHnXyQ2RHMzaDsR61ewv2cJmxpk1rjcdUJHn0E43WDQ En7nMFUpuQIzPOHI65rmRGLxyIcWZTZEtnNaLo32ToJQvfBMHbtQ5EjMvr4k6TD2RT33 9dIHV2ZewYAZdf1seaEbPJMq+W5tT9ACQSnVgSCksywqF8hFxjKevSHc2khz19DFK4WY NCCm31qjkLw9TgH1lm2OnqYxqc4JPu+IcjN9nd/KBGyRS8xmF8LIuGjWUncgzTTPxFoQ Gg5w== MIME-Version: 1.0 X-Received: by 10.194.176.163 with SMTP id cj3mr11319350wjc.8.1382318550714; Sun, 20 Oct 2013 18:22:30 -0700 (PDT) Received: by 10.217.67.202 with HTTP; Sun, 20 Oct 2013 18:22:30 -0700 (PDT) In-Reply-To: References: <5263D6D0.6090800@imap.cc> Date: Sun, 20 Oct 2013 18:22:30 -0700 Message-ID: From: Dave Taht To: David Personette Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Cc: "cerowrt-devel@lists.bufferbloat.net" Subject: Re: [Cerowrt-devel] development build 3.10.17-1 released X-BeenThere: cerowrt-devel@lists.bufferbloat.net X-Mailman-Version: 2.1.13 Precedence: list List-Id: Development issues regarding the cerowrt test router project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Oct 2013 01:22:34 -0000 On Sun, Oct 20, 2013 at 6:17 AM, David Personette wrote= : > I have a laptop running 10.8.5 that's working. I had to remove the > /overlay/etc/rc.local file and reboot before Dave's /etc/fixdaemons would > show up. My saved configuration was stopping it from working. I usually backup /overlay and restore it carefully after doing a diff. As for using rc.local here rather than creating a package, Sorry! it was a "simple expedient"... I'd rather have it work right on boot. But: There are a few other things that I'd like to start or restart after the device has gathered some entropy. Notably cero is now generating certs for the web interface but not apparently in a form lighttpd can parse. (make_certs.sh) So anyway it seems sane to have a new package deferred_start? to fire off stuff like that, too, and not do anything in rc.local as part of the distro. > -- > David P. > > > On Sun, Oct 20, 2013 at 9:12 AM, Fred Stratton wro= te: >> >> Spoke too soon . Machine running OS X 10.8.5 cannot obtain wireless DHCP >> lease. Machine running 10.7.5 has no problem. >> >> >> On 20/10/13 06:41, Dave Taht wrote: >>> >>> + sync with openwrt >>> + dnsmasq 2.67rc4 >>> + get_cycles() and /dev/random fixes >>> + mild firewall changes >>> + actually sort of tested >>> - sysupgrade still busted >>> - didn't package the jitter rng >>> >>> The simple expedient of putting a script in /etc/rc.local to restart >>> pimd, minissdpd, and dnsmasq 60 seconds after boot appears to get us a >>> working dhcp/dns on the wifi interfaces once again. >>> >>> dnsmasq wasn't busted, it was how it interfaces to netifd. the march >>> down to something deployable resumes with rc4. >>> >>> This is the first test that I know of, of some of the RNG fixes >>> upstream, notably the mips code does the right thing with a highly >>> optimized "get_cycles()". >>> >>> There are two changes to the firewall code >>> >>> 1) There has been a long-standing error in not blocking port 161 >>> (snmp) from the outside world. It is now blocked by default. >>> >>> Although I am not aware of any exploits of this (besides the >>> information leakage) I would recommend blocking this port by default >>> on your existing builds, also, or disabling the snmp daemon entirely >>> if you do not use it. >>> >>> 2) Usage of the "pattern matching syntax" on various firewall rules. >>> >>> Instead of 3 rules for se00,sw00,sw10, and 4 for gw00,gw10,gw01,gw11 >>> there are now 1 rule for s+ and one rule for gw+ >>> >>> This does not show up in the web interface correctly. I'd also like to >>> get to a more efficient rule set for the blocked ports, perhaps with >>> ipset... >>> >>> ... >>> >>> It's sort of my hope that with these fixes that the march towards a >>> stable release can resume, and we get some fresh shiny new bugs out of >>> this. >>> >>> Upcoming next are a revised version of pie, more random number fixes, >>> and I forget what else. >>> >>> >>> 3) >>> >> >> _______________________________________________ >> Cerowrt-devel mailing list >> Cerowrt-devel@lists.bufferbloat.net >> https://lists.bufferbloat.net/listinfo/cerowrt-devel > > > > _______________________________________________ > Cerowrt-devel mailing list > Cerowrt-devel@lists.bufferbloat.net > https://lists.bufferbloat.net/listinfo/cerowrt-devel > --=20 Dave T=E4ht Fixing bufferbloat with cerowrt: http://www.teklibre.com/cerowrt/subscribe.= html