[Cerowrt-devel] cerowrt-3.10.36-6 released

[Dave Taht]

On Mon, Apr 21, 2014 at 12:18 PM, Sebastian Moeller <moeller0 at gmx.de> wrote:
> Hi Dave,
>
> On Apr 21, 2014, at 21:09 , Dave Taht <dave.taht at gmail.com> wrote:
>
>> On Sun, Apr 20, 2014 at 1:46 PM, Sebastian Moeller <moeller0 at gmx.de> wrote:
>>> Hi Dave,
>>>
>>>
>>> On Apr 19, 2014, at 22:01 , Dave Taht <dave.taht at gmail.com> wrote:
>>>
>>>> + felix's wifi patch for bug #442 added
>>>>  please break wifi.
>>>>
>>>> + debloat qlens reduced again to 12 for be and bk wifi queues
>>>> + heartbleed fix from -3 forward
>>>>
>>>> I note that nearly every "secured"-by-openssl network facing daemon has been
>>>> shown vulnerable to heartbleed. The hole in openvpn bit *me*, in
>>>> particular. I've updated, rekeyed and re-certified the vpns I have in
>>>> place, and you should too for any openvpn servers and clients you have
>>>> too.
>>>>
>>>> It was a real PITA for me, and I only had a few boxes on it.
>>>>
>>>> For more details, see: http://community.openvpn.net/openvpn/wiki/heartbleed
>>>>
>>>> For more details on the daemons potentially affected by heartbleed in
>>>> cerowrt, openwrt, and others, see the advisory at:
>>>>
>>>> http://www.bufferbloat.net/news/50
>>>>
>>>> + resync with openwrt
>>>>  notably there were updates to netifd, and a fix for a strongswan CVE
>>>>
>>>> + dnscrypt added as an optional package (thx stephen walker and "mailjoe")
>>>> + snort added as an optional package
>>>>
>>>> +/- full dnssec
>>>> - upgrade to httping 2.x broke
>>>> - no sqm auto tuning yet
>>>
>>>        Note, all you need is to put the word "auto" (without the quotes) in the fields named:
>>> Latency target for ingress, e.g 5ms [units: s, ms, or us]; leave empty for default, or auto for automatic selection.
>>> and
>>> Latency target for egress, e.g. 5ms [units: s, ms, or us]; leave empty for default, or auto for automatic selection..
>>>
>>> The bigger caveat is that the current implementation probably is not ideal and could need a bit of data guided optimization…
>>
>> And more eyeballs.
>
>         Oh, sure!
>
>>
>>> @Dave: if you think this is ready to be inflicted upon the greater cerowrt community I can see what is required to actually make SQM default to that behavior..
>>
>> Inflict away.
>
>         Great, I just pushed a number of changes reworking the handling of IFB devices (WIP, lightly tested not fully complete but saner than the previous hard coding). I also snuck in the change I believe to me the last missing piece to change the "default" behavior to auto.
>         How do I build an ilk packet from ceropackages? Then I could go and test a fresh install to see whether the committed changes actually chance the default ;).


Well, it helps to have a buildable cerowrt of your own... OR, you can
just bump up the version numbers
in the makefiles like I just did, and do a new build of the
"stable"-ish cerowrt (3.10.36-6), push it out, which I just
did, and ask folk to make sure their /etc/opkg.conf points to the
right 3.10.36-6 repo, and to then do a

opkg update
opkg upgrade luci-app-sqm sqm-scripts

which should pick up and install those two packages for further testing.

I do look forward to the day where the kernel settles down enough to be able to
incrementally improve/update/fix various packages and libraries only,
or we come up with a way to make incremental updates work more often.

...

in other news, making a little headway on the ubnt edgerouter:

http://community.ubnt.com/t5/EdgeMAX/S-FQ-CoDel-Support-Possible/m-p/800436/highlight/false#M28705


...

>Oh and I do hope you have/will have a great vacation.

thx. turned out getting a hotel in SJDS on easter was too hard so I
didn't jump on a plane this weekend. I went biking in SF instead. Fell
and either bruised or broke a rib. Not sure if I'm going anywhere
after that.

It was nice to not think about the internet for a while anyway.
>
> Best Regards
>         Sebastian
>
>>
>>> Best Regards
>>>        sebastian
>>>
>>>> - neither snort nor dnscrypt tested
>>>>
>>>> If you are not experiencing problems with wifi or with heartbleed
>>>> there are few reasons to update to this release.
>>>>
>>>> I wanted to note to those that use sysupgrade without a clean reflash,
>>>> in that the
>>>> /etc/opkg.conf file is not re-written in this case, and still points
>>>> to the old repository.
>>>> If you wish to install additional packages after an inplace upgrade,
>>>> you will have
>>>> to also update /etc/opkg.conf to point to the right place.
>>>>
>>>> --
>>>> Dave Täht
>>>>
>>>> NSFW: https://w2.eff.org/Censorship/Internet_censorship_bills/russell_0296_indecent.article
>>>> _______________________________________________
>>>> Cerowrt-devel mailing list
>>>> Cerowrt-devel at lists.bufferbloat.net
>>>> https://lists.bufferbloat.net/listinfo/cerowrt-devel
>>>
>>
>>
>>
>> --
>> Dave Täht
>>
>> NSFW: https://w2.eff.org/Censorship/Internet_censorship_bills/russell_0296_indecent.article
>



-- 
Dave Täht

NSFW: https://w2.eff.org/Censorship/Internet_censorship_bills/russell_0296_indecent.article