[Cerowrt-devel] cerowrt-3.10.36-6 released

Sebastian Moeller moeller0 at gmx.de
Mon Apr 21 17:34:03 EDT 2014 

Hi Dave,


On Apr 21, 2014, at 21:42 , Dave Taht <dave.taht at gmail.com> wrote:

> On Mon, Apr 21, 2014 at 12:18 PM, Sebastian Moeller <moeller0 at gmx.de> wrote:
>> Hi Dave,
>> 
>> On Apr 21, 2014, at 21:09 , Dave Taht <dave.taht at gmail.com> wrote:
>> 
>>> On Sun, Apr 20, 2014 at 1:46 PM, Sebastian Moeller <moeller0 at gmx.de> wrote:
>>>> Hi Dave,
>>>> 
>>>> 
>>>> On Apr 19, 2014, at 22:01 , Dave Taht <dave.taht at gmail.com> wrote:
>>>> 
>>>>> + felix's wifi patch for bug #442 added
>>>>> please break wifi.
>>>>> 
>>>>> + debloat qlens reduced again to 12 for be and bk wifi queues
>>>>> + heartbleed fix from -3 forward
>>>>> 
>>>>> I note that nearly every "secured"-by-openssl network facing daemon has been
>>>>> shown vulnerable to heartbleed. The hole in openvpn bit *me*, in
>>>>> particular. I've updated, rekeyed and re-certified the vpns I have in
>>>>> place, and you should too for any openvpn servers and clients you have
>>>>> too.
>>>>> 
>>>>> It was a real PITA for me, and I only had a few boxes on it.
>>>>> 
>>>>> For more details, see: http://community.openvpn.net/openvpn/wiki/heartbleed
>>>>> 
>>>>> For more details on the daemons potentially affected by heartbleed in
>>>>> cerowrt, openwrt, and others, see the advisory at:
>>>>> 
>>>>> http://www.bufferbloat.net/news/50
>>>>> 
>>>>> + resync with openwrt
>>>>> notably there were updates to netifd, and a fix for a strongswan CVE
>>>>> 
>>>>> + dnscrypt added as an optional package (thx stephen walker and "mailjoe")
>>>>> + snort added as an optional package
>>>>> 
>>>>> +/- full dnssec
>>>>> - upgrade to httping 2.x broke
>>>>> - no sqm auto tuning yet
>>>> 
>>>>       Note, all you need is to put the word "auto" (without the quotes) in the fields named:
>>>> Latency target for ingress, e.g 5ms [units: s, ms, or us]; leave empty for default, or auto for automatic selection.
>>>> and
>>>> Latency target for egress, e.g. 5ms [units: s, ms, or us]; leave empty for default, or auto for automatic selection..
>>>> 
>>>> The bigger caveat is that the current implementation probably is not ideal and could need a bit of data guided optimization…
>>> 
>>> And more eyeballs.
>> 
>>        Oh, sure!
>> 
>>> 
>>>> @Dave: if you think this is ready to be inflicted upon the greater cerowrt community I can see what is required to actually make SQM default to that behavior..
>>> 
>>> Inflict away.
>> 
>>        Great, I just pushed a number of changes reworking the handling of IFB devices (WIP, lightly tested not fully complete but saner than the previous hard coding). I also snuck in the change I believe to me the last missing piece to change the "default" behavior to auto.
>>        How do I build an ilk packet from ceropackages? Then I could go and test a fresh install to see whether the committed changes actually chance the default ;).
> 
> 
> Well, it helps to have a buildable cerowrt of your own…

	;)

> OR, you can
> just bump up the version numbers
> in the makefiles like I just did, and do a new build of the
> "stable"-ish cerowrt (3.10.36-6), push it out, which I just
> did, and ask folk to make sure their /etc/opkg.conf points to the
> right 3.10.36-6 repo, and to then do a
> 
> opkg update
> opkg upgrade luci-app-sqm sqm-scripts
> 
> which should pick up and install those two packages for further testing.

	Great, since I was still on 3.10.36-4 I just started the sysupgrade -n to the new version. I assume it will drag in the new packets automagically and I should be able to see whether it worked...
	So, it seems to work now, unless one re-imports on's old config/sqm. I note that the current implementation is quite gentle, set the rates < 300kbps to actually see a change as reported by "tc -d qdisc". 
	Now I just need to handle the situation that we are out of IFBs and than that is hopefully finished (the sanitize IFB handling part)


> 
> I do look forward to the day where the kernel settles down enough to be able to
> incrementally improve/update/fix various packages and libraries only,
> or we come up with a way to make incremental updates work more often.

	More like a real distribution ;)

> 
> ...
> 
> in other news, making a little headway on the ubnt edgerouter:
> 
> http://community.ubnt.com/t5/EdgeMAX/S-FQ-CoDel-Support-Possible/m-p/800436/highlight/false#M28705

	Mmmh, maybe this can act as a somewhat future proof shaper/outer firewall combination, than the secondary cerowrt router will only have to deal with isolating the radios.  

> 
> 
> ...
> 
>> Oh and I do hope you have/will have a great vacation.
> 
> thx. turned out getting a hotel in SJDS on easter was too hard so I
> didn't jump on a plane this weekend. I went biking in SF instead.

	So far this looked like an excellent weekend!

> Fell and either bruised or broke a rib.

	I hope it is just a bruise...

> Not sure if I'm going anywhere
> after that.

	"Gute Besserung", as we say over here, get well soon!

> 
> It was nice to not think about the internet for a while anyway.

	Ah, exactly my plan for the rest of the moth…

Best Regards
	Sebastian


>> 
>> Best Regards
>>        Sebastian
>> 
>>> 
>>>> Best Regards
>>>>       sebastian
>>>> 
>>>>> - neither snort nor dnscrypt tested
>>>>> 
>>>>> If you are not experiencing problems with wifi or with heartbleed
>>>>> there are few reasons to update to this release.
>>>>> 
>>>>> I wanted to note to those that use sysupgrade without a clean reflash,
>>>>> in that the
>>>>> /etc/opkg.conf file is not re-written in this case, and still points
>>>>> to the old repository.
>>>>> If you wish to install additional packages after an inplace upgrade,
>>>>> you will have
>>>>> to also update /etc/opkg.conf to point to the right place.
>>>>> 
>>>>> --
>>>>> Dave Täht
>>>>> 
>>>>> NSFW: https://w2.eff.org/Censorship/Internet_censorship_bills/russell_0296_indecent.article
>>>>> _______________________________________________
>>>>> Cerowrt-devel mailing list
>>>>> Cerowrt-devel at lists.bufferbloat.net
>>>>> https://lists.bufferbloat.net/listinfo/cerowrt-devel
>>>> 
>>> 
>>> 
>>> 
>>> --
>>> Dave Täht
>>> 
>>> NSFW: https://w2.eff.org/Censorship/Internet_censorship_bills/russell_0296_indecent.article
>> 
> 
> 
> 
> -- 
> Dave Täht
> 
> NSFW: https://w2.eff.org/Censorship/Internet_censorship_bills/russell_0296_indecent.article

More information about the Cerowrt-devel mailing list