**** BEGIN LOGGING AT Fri Jun 22 03:00:01 2018 Jun 22 05:37:19 dissent1: ping Jun 22 06:07:26 mangix: pong Jun 22 06:09:28 build #53 of gemini/generic is complete: Failure [failed images] Build details are at http://phase1.builds.lede-project.org/builders/gemini%2Fgeneric/builds/53 blamelist: Hans Dedecker , Chuanhong Guo , Stijn Tintel , Mathias Kresin Jun 22 06:27:25 blogic: can you please take a look at this before I pull request -> https://github.com/TouchStar/openwrt/commit/90e379fabe8dda20576b1745df1d51733cc93181 Jun 22 06:27:53 to save myself embarrassment on pull request ;P Jun 22 06:31:44 landwork: looks good Jun 22 06:54:35 Hi I need openwrt for EA8300? Jun 22 06:54:39 ! Jun 22 07:06:21 landwork: idea''y you send it now and we can backport it to 18.06 Jun 22 07:15:39 landwork: merged and backported, Thanks ! Jun 22 07:20:13 nbd: https://github.com/openwrt/openwrt/pull/1083 Jun 22 07:22:01 blogic:ping Jun 22 07:22:06 dedeckeh: hi Jun 22 07:25:32 dedeckeh: https://bugs.openwrt.org/index.php?do=details&task_id=1426 Jun 22 07:26:15 likely also fixes https://bugs.openwrt.org/index.php?do=details&task_id=1591 Jun 22 07:26:54 can you look into it? The patch suggested in 1426 looks sane to me. Poking you because you're most familiar with our ipv6 userland Jun 22 07:29:26 jow:will have a look Jun 22 07:30:06 also ping KanjiMonster ^ Jun 22 07:35:04 dedeckeh: KanjiMonster: un-ping; this was fixed with "58f7b5b96c kernel: add missing in6_dev_put_clear call to an ipv6 network patch" Jun 22 07:35:36 jow:correct I thought nbd fixed this Jun 22 07:57:04 build #30 of arc770/generic is complete: Failure [failed pkgbuild] Build details are at http://release-builds.openwrt.org/18.06/images/builders/arc770%2Fgeneric/builds/30 blamelist: David Thornley , John Crispin , Ansuel Smith Jun 22 08:04:33 build #38 of malta/be is complete: Failure [failed pkgbuild] Build details are at http://release-builds.openwrt.org/18.06/images/builders/malta%2Fbe/builds/38 blamelist: David Thornley , John Crispin , Ansuel Smith Jun 22 08:06:10 build #39 of apm821xx/nand is complete: Failure [failed pkgbuild] Build details are at http://release-builds.openwrt.org/18.06/images/builders/apm821xx%2Fnand/builds/39 blamelist: David Thornley , John Crispin , Ansuel Smith Jun 22 08:09:23 blogic: ack for pull request 1083 Jun 22 08:09:34 build #39 of ramips/rt3883 is complete: Failure [failed pkgbuild] Build details are at http://release-builds.openwrt.org/18.06/images/builders/ramips%2Frt3883/builds/39 blamelist: David Thornley , John Crispin , Ansuel Smith Jun 22 08:10:06 i have borkage it Jun 22 08:12:37 looks like one of the ath10k patches fails, let me build a tree to fix it Jun 22 08:17:12 mornin' Jun 22 08:17:21 build #37 of ar71xx/mikrotik is complete: Failure [failed pkgbuild] Build details are at http://release-builds.openwrt.org/18.06/images/builders/ar71xx%2Fmikrotik/builds/37 blamelist: David Thornley , John Crispin , Ansuel Smith Jun 22 08:20:07 jow:I reverted the uci config parsing and callback handling patch in openwrt-18.06 and lede-17.01 which broke the qos scripts Jun 22 08:38:41 build #36 of ixp4xx/harddisk is complete: Failure [failed pkgbuild] Build details are at http://release-builds.openwrt.org/18.06/images/builders/ixp4xx%2Fharddisk/builds/36 blamelist: David Thornley , John Crispin , Ansuel Smith Jun 22 08:39:53 build #36 of cns3xxx/generic is complete: Failure [failed pkgbuild] Build details are at http://release-builds.openwrt.org/18.06/images/builders/cns3xxx%2Fgeneric/builds/36 blamelist: David Thornley , John Crispin , Ansuel Smith Jun 22 08:44:46 build #36 of ar71xx/tiny is complete: Failure [failed pkgbuild] Build details are at http://release-builds.openwrt.org/18.06/images/builders/ar71xx%2Ftiny/builds/36 blamelist: David Thornley , John Crispin , Ansuel Smith Jun 22 08:52:37 fixed the ath10k build breakage Jun 22 08:54:54 build #38 of mvebu/cortexa9 is complete: Failure [failed images] Build details are at http://release-builds.openwrt.org/18.06/images/builders/mvebu%2Fcortexa9/builds/38 blamelist: David Thornley , John Crispin , Ansuel Smith Jun 22 08:59:51 morning Jun 22 09:06:31 blogic: btw, there are new releases for the amd64/intel-microcode packages, but i won't bump them before -rc1, only in the next point release, as they're not tested Jun 22 09:07:38 wigyori: yep, saw that Jun 22 09:09:03 ok. i'll do that in trunk in the next few days. Jun 22 09:21:21 Hi is ath79 ready for the c7 yet? Jun 22 09:21:27 c7-v2 Jun 22 09:22:01 I am just flashing snapshots to my router and APs Jun 22 09:22:11 there is a pending PR for it Jun 22 09:22:32 That's why I am asking if I should stick with r71xx for my c7 or ath79 Jun 22 09:25:12 never mind I have my ancer Jun 22 09:47:29 jow: i think i am done Jun 22 10:24:26 has anyone tried to get the hardware crypto support going with the mt7621 ? there's a driver in the 4.14 kernel is there ? Jun 22 10:26:23 no and no Jun 22 10:26:45 wilson2860: the crypto driver is for mt7623 Jun 22 10:26:50 and works very well there Jun 22 10:27:02 but will need a bit of loving care to get going on 7621 Jun 22 10:28:11 ah ok, my bad then Jun 22 10:37:47 blogic: I try to get SFP port working on ubiquity ER-X-SFP. I know that you done a lot on the mt7623. Because I am not a hardcore developer I struggle with link between the code and DTS. Jun 22 10:39:49 i've been trying to get a d-link dir645 working again but something is going wrong somewhere, i've been merging in trees with support for the realtek switch mdio, that might be the problem, but it used to work Jun 22 10:40:09 next think i might try is mkreskin tree and edting the dts file Jun 22 10:46:05 blogic: hi! when you have time, can you please take a look at this kernel bump and merge it if all is ok: https://patchwork.ozlabs.org/patch/932897/ Jun 22 10:47:35 blogic: it fixes an issue with single stream iperf3 throughput on the r7800 Jun 22 10:48:39 blogic: btw, for some reason patchwork lists me as the author of that patch when it's actually Kevin Jun 22 10:54:22 dissent1: what temperature do you get on mwlwofi? /sys/kernel/debug/ieee80211/phy[01]/mwlwifi/temperature or something similar Jun 22 10:54:59 i'm getting 141 on a WRT1900v1 Jun 22 10:56:16 mangix, i'd say that's a reading error Jun 22 10:56:42 oh? Jun 22 10:57:34 cool. ath10k_thermal seems to work on my DAP-2695 Jun 22 10:57:49 stintel, o/ Jun 22 10:57:54 nitroshift: \o Jun 22 10:58:08 driving to Belgium tomorrow Jun 22 10:58:27 yeah, not going through my town, are you? Jun 22 10:58:35 nah that's too big of a detour Jun 22 10:58:42 and need to be at $client on monday Jun 22 10:58:55 heh... petrol ain't cheap :p Jun 22 10:59:07 it isn't. and I'm about to use ~250l Jun 22 10:59:14 in <25h :P Jun 22 10:59:28 petrol head ^ Jun 22 10:59:31 :)) Jun 22 10:59:38 /sys/class/ieee80211/phy0/device/hwmon/hwmon0/temp1_input:57000 Jun 22 10:59:54 belgium hey, had some Hoegaarden White Beer the other day, very nioce Jun 22 11:00:07 I really don't like hoegaarden Jun 22 11:00:15 I'll have a Duvel instead Jun 22 11:00:43 I guess CONFIG_ATH10K_THERMAL is not something we can enable per-device Jun 22 11:00:51 stintel, have a good trip Jun 22 11:00:59 talk whenever we catch up Jun 22 11:01:08 * nitroshift goes on week-end Jun 22 11:08:44 does it make sense to add PKG_BUILD_PARALLEL to every package which consists of scripts (Lua, Shell) only? Jun 22 11:12:28 aparcar: not really as there'd be not much to parallellize Jun 22 11:13:00 unless you have elaborate makefiles doing install commands or something which could be parallelized Jun 22 11:14:34 mangix: i'll chexk when i'm at home Jun 22 11:22:18 jow thanks, I though it tells the make process that it may continue to build other packages in parallel Jun 22 11:27:07 hm, is it expected to still have the URLs with lede-project.org for the package feeds in current master snapshot builds? Jun 22 11:29:05 aparcar: no, the flag you mentioned is about parallelizing the make process within the package build Jun 22 11:29:33 rotanid: no. compare /etc/opkg/distfeeds.conf with /rom/etc/opkg/distfeeds.conf Jun 22 11:30:20 device elsewehre and offline atm. but it was a fresh flash, build date 21.06.2018 from snapshot downloads server, device had no LEDE/OpenWrt before Jun 22 11:30:51 rotanid: then your buildroot is maybe unclean, you have version overrides in .config or overlayed stuff in files/ Jun 22 11:31:01 i didnt build myself Jun 22 11:31:12 "build date 21.06.2018 from snapshot downloads server" Jun 22 11:31:24 lantiq target Jun 22 11:31:55 maybe the buildroot is unclean on the "official" buildservers? Jun 22 11:32:38 build #39 of mediatek/mt7623 is complete: Failure [failed kmods] Build details are at http://phase1.builds.lede-project.org/builders/mediatek%2Fmt7623/builds/39 blamelist: Chen Minqiang , David Thornley , Kristian Evensen , John Crispin , Ansuel Smith Jun 22 11:32:38 Jun 22 11:35:49 maybe Jun 22 11:38:01 is john crispin here? :) Jun 22 11:38:02 i could try another target this weekend Jun 22 11:38:38 but best would be someone having a lantiq device also tests the build from yesterday Jun 22 11:42:51 rotanid: the builders are fine, include/version.mk was never updated Jun 22 11:43:31 blogic: what about https://git.openwrt.org/d0b8ab60 ? Jun 22 11:44:54 jow: oh wow, i really spotted a bug ;) Jun 22 11:45:15 maybe a grep for "lede" over the whole tree... :D Jun 22 11:46:13 jow: if you're changig it, consider using "https" for the bugs and forum and website links maybe Jun 22 11:50:11 yay, I have a working 5GHz LED on my DAP-2695 \o/ Jun 22 11:50:53 5GHz LED? that's lightspeed fast :3 Jun 22 11:50:56 oops, needs some cleanup Jun 22 11:50:59 hahaha Jun 22 11:51:25 it works for c2600 as well :3 Jun 22 11:51:56 stintel: how can i enable ATH10K_THERMAL in 18.06-rc1, i don't see it in the makefile ? Jun 22 11:55:46 movi: you can't, this patch is not backported Jun 22 11:56:13 :< Jun 22 11:56:42 i see it in the backports dir, just not in the openwrt menuconfig Jun 22 11:57:45 backports dir != backported commit from one branch to another Jun 22 12:05:26 morning Jun 22 12:05:40 and congratulate for RC1 Jun 22 12:08:38 stintel: Pffff, I have a working 468THz LED Jun 22 12:08:44 😂 Jun 22 12:11:19 it is still light frequency? Jun 22 12:11:58 It pales in comparison to the 638THz ones. I try not to use those. Jun 22 12:13:07 :-) Jun 22 12:13:50 blogic: updated commit for enabling ath10k LED support -> https://git.openwrt.org/6dcf44e2 Jun 22 12:17:55 what tool is used to compare sizes before and after enabling something? the one with hex, text, something something Jun 22 12:18:38 stintel: That would be, wait for it Jun 22 12:18:40 size. Jun 22 12:19:07 heh Jun 22 12:19:10 TIL ... Jun 22 12:19:25 It's from binutils Jun 22 12:19:26 thanks Jun 22 12:24:40 hmm, no size difference in ath10k_{core,pci}.ko with that LED support enabled, is that even possible? Jun 22 12:26:10 ugh, nvm Jun 22 12:26:47 must be friday Jun 22 12:32:44 684 byte Jun 22 12:32:49 is that too much to enable it by default? Jun 22 12:34:11 I would think most devices with ath10k chips would be new enough that they wouldn't be severely space-constrained. Jun 22 12:46:08 https://git.openwrt.org/f7d3ba75 enabled by default now Jun 22 12:46:29 mkresin: as I'm referring to one of your commits there, what do you think ^ Jun 22 12:49:01 stintel: I'm not entirely happy with ath10k led patch Jun 22 12:49:20 stintel: added my notes at the time it was discussed on linux-wireless Jun 22 12:50:10 mkresin: well it was added to the repo earlier today. I just want to make it useful ;) Jun 22 12:50:29 stintel: the patch should add the ath10k gpio support as well Jun 22 12:51:10 stintel: I would prefer to enable the gpio chip and add a gpio-led instead of using ath10k-phy0 Jun 22 12:52:00 stintel: here an ath9k example: https://git.openwrt.org/?p=openwrt/openwrt.git;a=blob;f=target/linux/lantiq/files-4.14/arch/mips/boot/dts/TDW89X0.dtsi;h=233b7e33342c86f9d84c88de1ef4c37c77f09cc9;hb=HEAD#l228 Jun 22 12:52:27 I see Jun 22 12:54:10 makes sense Jun 22 12:54:22 stintel: thx Jun 22 12:55:09 mkresin: what about keeping it how it is now, and replacing it with GPIO based led once someone takes the time to write proper support? Jun 22 12:56:30 stintel: because 'it works' the incentive to 'do it properly' tends to get lost. Jun 22 12:56:44 cleaned up a bit more (whitespace and some typo in commit msg) -> https://git.openwrt.org/5efd8603 Jun 22 12:57:32 ldir: true. but we accepted the patch already anyway Jun 22 12:57:47 so either we throw it out, or we make it useful Jun 22 12:57:54 revert revert :-) Jun 22 13:06:58 stintel: you commit message should encourage people to do it the right way (tm) Jun 22 13:07:21 stintel: bug i really need to check if ath10 gpio was included in the patch Jun 22 13:08:25 teh led trigger is nice for minipcie and/or usb ath10k devices, as the wireless led will work out of the box Jun 22 13:09:17 well it mentions something about GPIO controls Jun 22 13:09:34 if the leds can be better described, we should use propper led names Jun 22 13:19:02 won't they be a bit device-dependent? Jun 22 13:19:48 since you're getting them from the card and not the board Jun 22 13:31:43 ping dedeckeh Jun 22 13:36:45 jow:pong Jun 22 13:39:04 just reported to debian team that 'apt upgrade' behaves different from 'apt-get upgrade', one upgrades another keeps back, unexpected Jun 22 13:39:27 they should both switch to opkg instead Jun 22 13:40:07 dedeckeh: https://github.com/openwrt/openwrt/pull/1093 Jun 22 13:40:25 dedeckeh: I recall that Axel tried to get feedback on this one a while back already Jun 22 13:40:32 Ola guys, can I do something like this ? https://pastebin.com/BiLg2UFA Install one package from antoher branch feed? Jun 22 13:40:52 that fmr patch of ours apparently breaks some legit IPv6 IP-IP tunnel use cases Jun 22 13:42:08 jow:will have a look; problem is I don't have access to a map-e setup Jun 22 13:43:00 jow:recently there was a japanese guy who logged an issue related to map-e; maybe I can ask him to do some testing Jun 22 13:43:20 dedeckeh: from looking at the change and the surrounding context it looks sane to me though Jun 22 13:43:29 if no FMR stuff is defined, don't enforce any checks Jun 22 13:43:49 (https://github.com/aparcar/openwrt/blob/d39909df8fd004c84e6b516374ea3e7898272359/target/linux/generic/pending-4.4/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch#L276) Jun 22 13:47:43 jow:looks indeed sane Jun 22 13:48:56 jow:will merge the patch Jun 22 13:49:55 Any one know if flow off load is fixt now in 18.6? I had a prob were I would get to menny open tcp connections. Jun 22 13:51:41 Software flow offloading I am talking about Jun 22 13:55:23 nice I still get a B for BufferBloat with flow off loading Jun 22 13:55:34 but mutch faster speeds Jun 22 13:55:54 * ldir swears he saw a patch go by that fixed that. Can't find it. Jun 22 13:56:10 Tapper: yes, the many-open-connections-issue was adressed by felix Jun 22 13:56:12 It's A+ with sqm but I loose about 50 meg of download speed Jun 22 13:56:34 Nice seems to be working good now Jun 22 13:56:39 so thanks to all Jun 22 13:56:59 I will kick it around for a day or to to see if it brakes Jun 22 13:57:29 I have a lot of through put so my house is a good testing ground for some thing like this Jun 22 13:58:48 Guys, is possible to do something like this ? https://pastebin.com/q7xpiWFY Thanks Jun 22 13:58:56 ahhh commits 18f18a2054 and 244fd1aac6 in 18.06 branch Tapper Jun 22 13:59:13 Ok thanks mate Jun 22 13:59:30 muhaha: in principle yes Jun 22 13:59:40 but? Jun 22 13:59:52 muhaha: 1) I recommend to copy feeds.conf.default to feeds.conf (avoids git collissions in the future( Jun 22 14:00:29 I have a friend with a wdr3600 who was using sqm on a slow connection I am going to get him to flash a new build and switch to flow offloding to see how that copes Jun 22 14:00:30 muhaha: 2) use something like ./scripts/feeds update -a; ./scripts/feeds install -a; ./scripts/feeds uninstall luci-app-lxc; ./scripts/feeds install -p customfeed luci-app-lxc Jun 22 14:01:32 because his connection is slow he was loosing about 20 % of his speed Jun 22 14:02:10 for me changing to flow off load is a good trade off for from sqm Jun 22 14:02:30 jow Jun 22 14:02:30 jow: superb. Thank you. I guess its better way instead of patching, right? Jun 22 14:03:44 i always do './scripts/feeds install -a -p myfeed && ./scripts/feeds install -a', in this order my custom feeds will overwrite the official feeds for same packages Jun 22 14:04:31 if you 'uninstall somepkg', what about future 'feeds update', will it be pulled back in? Jun 22 14:05:59 * ausjke is reading dns-rebind-attach, basically disable access luci via WAN port will stop it Jun 22 14:06:12 s/attach/attack/, can never type Jun 22 14:06:42 disable access luci via WAN while from LAN, that is Jun 22 14:07:59 movi: for minipcie they are device dependend and the pseudo led should be used. for soldered ath10k pci chips a fixed cnfig can be added Jun 22 14:09:06 can uhttpd bind to interface instead of IPs Jun 22 14:10:45 ausjke: yes Jun 22 14:10:48 erm no Jun 22 14:10:51 it can't Jun 22 14:10:57 bind(2) has no notion of interfaces Jun 22 14:11:27 SO_BINDTODEVICE? Jun 22 14:12:00 will fail hard if the ifindex changes Jun 22 14:12:24 change something in luci -> restart network -> br-lan gets recreated -> uhttpd unreachable Jun 22 14:12:50 ok then, live with IP-binding while using iptables/https/strong-passwd for rebinding attack Jun 22 14:12:55 could be solved with interface triggers but mehr Jun 22 14:13:01 *meh Jun 22 14:13:11 uhttpd has rebind countermesaures for ipv4 at least Jun 22 14:13:18 Who knows. Can one L2TP connection to bras/server run in multiple threads for internet trafic? I can use search. Jun 22 14:13:54 tried lighttpd, have to bind to br-lan IP directly,seems working Jun 22 14:14:11 ausjke: you can do that with uhttpd too Jun 22 14:14:17 yes. Jun 22 14:14:18 listen_http 192.168.1.1:80 Jun 22 14:14:54 by the way does it make sense to use letsencrypt to get 'official' ssl cert for openwrt by default these days Jun 22 14:15:15 there are letsencyrpt update script in pure bash, should be able to port to ash Jun 22 14:15:36 so when i visit luci i don't see that little red warning Jun 22 14:16:02 probably need ddns or something Jun 22 14:16:11 and a fixed hostname Jun 22 14:16:26 what would work is Jun 22 14:16:36 1) ship with something like mdns by default to register some openwrt.lan Jun 22 14:16:57 2) get some proper trusted cert for openwrt.lan Jun 22 14:17:04 this will however fail due to: Jun 22 14:17:17 1) requires shipping openwrt.lan secret key Jun 22 14:17:21 2) no CA will do that Jun 22 14:17:32 3) increases install base size Jun 22 14:17:59 4) does not work well with multiple openwrt devices in a network Jun 22 14:18:03 jow: ./scripts/feeds update -a; ./scripts/feeds install -a (it means that even all packages from customfeeds are installed, right ? ) ./scripts/feeds uninstall luci-app-lxc; ./scripts/feeds install -p customfeed luci-app-lxc Jun 22 14:18:37 muhaha: oh right, yeah could be Jun 22 14:18:53 didn't check how scripts/feeds reacts to duplicates; you need to play around with it Jun 22 14:19:13 ./scripts/feeds update -a && /scripts/feeds install -a -p customfeed && ./scripts/feeds update -a; will do the same consistenly for future updates/installs too Jun 22 14:19:40 ./scripts/feeds update -a && /scripts/feeds install -a -p customfeed &&./scripts/feeds install -a; Jun 22 14:20:20 at least that's how I let my own pkg overrides upstream pkgs when needed Jun 22 14:20:32 ausjke: thanks Jun 22 14:23:01 jow: on the point 4), if mdns why not working with other openwrt on the LAN, i assume each one will get a different hostname? anyway looks like it's a hassle for letsencrypt Jun 22 14:23:33 you can't have four hosts claiming to be openwrt.lan Jun 22 14:23:42 are you saying mdns giving you a different IP, but all openwrt still have the same openwrt.lan as hostname? Jun 22 14:23:43 the browser needs to conenct by name Jun 22 14:24:04 if you connect to http://192.168.1.5/ and get a cert for "openwrt.lan" the browser will complain Jun 22 14:24:13 you need to use http://openwrt.lan/ Jun 22 14:24:15 yes Jun 22 14:24:23 which only one appliance can claim at a time Jun 22 14:24:56 * ausjke does not know how zeroconf deals with hostnames when there is duplicates in LAN... Jun 22 14:25:50 tls + non-internet-facing-appliances => bad Jun 22 14:26:54 I mean tls itself is fine obviously Jun 22 14:27:02 but the required cert raindance is not Jun 22 14:27:57 either browsers stop treating selfsigned certs like huge big errors and simply offer some kind of "trust & install certificate" dialog on first connect Jun 22 14:28:14 or, have your own CA, import it to your browsers, then no warnings, good for private deployment at scale Jun 22 14:28:19 or they come up with another mechanism to bootstrap tls without internet / signing CA access Jun 22 14:31:45 Who knows. Can one L2TP connection to bras/server run in multiple threads for internet trafic? I can use search. I see an interesting thing. If I am connected to different the IP L2TP tunnel of the provider I receive: with ony IP loading goes on one core, with other IP loading goes also on other cores. core https://ufile.io/lwg7l , cores https://ufile.io/fa22q Lede/PI 2 Jun 22 14:33:45 isp for the l2tp use a domain name, different ip addresses Jun 22 14:35:38 zeroconf will append a number to hostname if it founds duplicates for its addressing needs, it can not change the real hostname, of course Jun 22 14:36:04 l2tp client (i) have CGNAT my ip for l2tp 10.13... Jun 22 14:36:08 best if to make sure hostname will be different at deployment if zeroconf is involved Jun 22 14:36:15 s/if/is/ Jun 22 14:36:25 isp have cgnat Jun 22 14:38:38 https://screenshots.firefox.com/PteZUuczPawW5ZjM/null Jun 22 14:46:50 wan DHCP not CGNAt, DHCP WAN big local network in my town, L2tp have GNAT Jun 22 14:52:04 jow: let's encrypt had an announcement on localhost certificates. Jun 22 15:02:13 mangix: do you have a link? Jun 22 15:02:52 Humour: it is magic Jun 22 15:03:44 Humour: it is magi - not ? Jun 22 15:37:22 jow: ? How will be handled package updates from running wrt/luci? https://pastebin.com/24x0dDhu Will it download always newest version? So it will ignore luci-app-lxc from luci feed and offer a luci-app-lxc from customfeed, right? Jun 22 15:45:49 ausjke? Jun 22 16:37:56 rotanid: https://letsencrypt.org/docs/certificates-for-localhost/ Jun 22 16:38:30 thx Jun 22 16:38:46 openwrt should partner up with let's encrypt Jun 22 17:02:57 muhaha: i used the steps described above and it worked well, same package can co-exist in both customfeed and upstream feed Jun 22 17:09:40 mangix: how? the url is a good reading though it mainly focuses on nativeapp and webapp communications via ssl Jun 22 17:19:10 stintel: could you give the "mac80211: ath10k: use tpt LED trigger by default" commit from my staging tree a try Jun 22 17:19:45 stintel: should work, but due to lack of hardware with leds attached to ath10k I couldn't really test it Jun 22 17:22:44 mangix: I remember there was something bad about Qualcomm IPQ8065. Jun 22 17:23:28 I need to choose between this and Marvell, which has Wi-Fi issues. Jun 22 17:26:01 anyone any thoughts on this panic? https://pastebin.com/raw/Ww2YK6v3 Jun 22 17:27:43 ldir: Did you type kill -9 1 in terminal? Jun 22 17:37:17 koops: i feel there is no perfect oss wifi router, yet, especially with 11ac Jun 22 17:37:45 mostly related to wifi drivers Jun 22 17:37:58 And if I'm ok with disabled wifi? Jun 22 17:38:11 I can plug a AP into a router. Jun 22 17:38:19 Like Ubiquiti ones. Jun 22 17:38:37 that might be better, what are you going to run on dumbAPs Jun 22 17:38:46 or just use them as is Jun 22 17:39:02 I don't want to buy another device for wifi though. Jun 22 17:39:10 Simply use them as is I guess. Jun 22 17:39:32 I need OpenWRT for DNSCrypt and VPN mostly. Jun 22 17:39:37 And for VLANs. Jun 22 17:39:54 And of course for better security than built-in firmware. Jun 22 17:40:17 for wired network security there are a lot options i feel, software and hardware Jun 22 17:41:03 I don't want anything FreeBSD-based to be hones. Jun 22 17:41:06 something like a $250 x86 box running pfsense etc Jun 22 17:41:09 or vyos Jun 22 17:41:36 OpenWRT can run on x86 too. Maybe I will go this route. Jun 22 17:41:37 vyos is decent running debian, which is what ubnt uses on all its mid-range to high-range network gears Jun 22 17:42:16 Can I run Shadowsocks or WireGuard on it? Jun 22 17:42:19 though it 'customizes' it intensively Jun 22 17:42:27 Also, how well-maintained VyOS is? Jun 22 17:42:45 I don't want to use an obscure OS with no security patches for months. Jun 22 17:42:45 not as well as openwrt, one reason why i'm here :) Jun 22 17:43:19 i think debian has shadowsocks packaged but unsure Jun 22 17:43:32 you can easily compile, same for wireguard Jun 22 17:43:51 i built wireguard for ubuntu and it's pretty straightforward Jun 22 17:46:12 Do you think simply installing Debian and setting up iptables is the best way to secure a network? Jun 22 17:47:02 that will be what i do, but i'm not a security expert Jun 22 17:47:46 depends how valuable your network is, normally the network scanner are just trying to find easy targets Jun 22 17:48:20 I'm still not sure about my threat model. Jun 22 17:49:03 i only open 443 port and ssh on my servers, that's it, nothing else Jun 22 17:49:08 I would like to protect against a targeted attack by any ordinary hacker. Jun 22 17:49:23 But not against APTs (impossible with current state of technology). Jun 22 17:49:32 ssh was changed to a non-22 port because port 22 is attacked all the time by bots Jun 22 17:49:56 Simply use fail2ban or whitelist IPs. Jun 22 17:50:09 No point in changing port, security by obscurity basically. Jun 22 17:51:18 yes i use fail2ban and ossec, but can't whiltelist ip as i login from other places Jun 22 17:52:20 Then use OpenVPN to connect to your servers instead of direct connections. With correct configuration, servers won't have any open ports other than HTTP/HTTPS. Jun 22 17:52:37 You will connect through a hardened gateway server. Jun 22 17:53:01 Install grsecurity, PaX and AppArmor on all servers too. Jun 22 17:53:19 i am planning to put openvpn client on openwrt so the whole family lan can benefit Jun 22 17:54:04 but i don't run openvpn on my pc directly, as i am messing up networks topology at lot, vpn makes things complicated sometimes Jun 22 17:57:37 OpenWRT can work as a hypervisor guest too. Jun 22 17:57:56 You can make your PC work as a router in addition to its usual functions. Jun 22 18:23:44 anyone here owns the openwrt docker account? https://hub.docker.com/u/openwrt/ Jun 22 18:57:03 build #54 of gemini/generic is complete: Success [build successful] Build details are at http://phase1.builds.lede-project.org/builders/gemini%2Fgeneric/builds/54 Jun 22 19:19:28 stintel: i "ported" ATH10K_THERMAL to 18.06-rc1. Works just fine on a c2600 :) Jun 22 19:21:29 i ported ldir's 4.14 bump to 18.06, but i won't vouch for it :P Jun 22 19:26:01 koops: yeah. abandoned. Jun 22 19:42:07 mangix: are you sure there will be no development on it? Jun 22 20:59:24 koops: not by qualcomm Jun 22 20:59:51 they've moved on to ipq4 Jun 22 21:02:14 mangix: Isn't it only single-core Jun 22 21:22:25 koops: quad Jun 22 21:26:12 mangix: So Asus RT-AC58U may be a good open-source router? Jun 22 21:26:32 Or GL.iNet GL-B1300 Jun 22 21:26:53 these are the only ones that use it Jun 22 21:30:02 ipq806x is a pretty nice SOC in practice, I wouldn't recommend it for WAN speeds exceeding ~300-400 MBit/s, but it's still solid - and ipq8074 (ARMv8) will become its successor (nor ipq40xx, which is targetted at the lower end of the spectrum) Jun 22 21:33:26 pkgadd: you try qca8k to see if it's faster? Jun 22 21:33:47 mangix: I can't, doesn't work on the nbg6817 yet Jun 22 21:34:03 why's that? Jun 22 21:34:04 I have 100 Mbit/s Jun 22 21:34:27 And I need Shadowsocks/WireGuard Jun 22 21:34:54 I'm not 100% sure, but blogıc mentioned that it still needs some work for the nbg6817, part of it decoding ASCII MAC addresses from ubootenv, but I'm not sure about the details Jun 22 21:35:48 my last attempt (using dıssent1's patch) bricked the router Jun 22 21:41:46 pkgadd: got side tracked Jun 22 21:41:53 its all there just the mac parsing is missing Jun 22 21:42:09 blogic: don't worry, I'm not in a hurry Jun 22 21:42:10 and with rc1 and vacation etc i did not find the time yet to make it work Jun 22 21:42:19 i know, just explaining the situation Jun 22 21:42:27 i'll be real busy next week aswell Jun 22 21:42:40 week after, i might have time, its quite high on my list Jun 22 21:44:53 blogic: qca8k works real well. latency seems low too. Jun 22 21:49:32 we'll figure that out Jun 22 21:51:06 blogic: Is there a DSA driver for the internal switch of ipq40x? From what I remember qca8k don't support it Jun 22 21:59:09 luaraneda[m]: it will soonish Jun 22 21:59:33 its the same switch core but requires mmio mapped registers rather than mdio and a different tag driver Jun 22 22:01:44 Great. Count me as an early tester then :) Jun 22 22:02:33 dont hold your breath Jun 22 22:02:49 i have a rewritten ethernet driver for ipq4019 that i need to clean up first Jun 22 22:06:07 I would like to help with that, but for now it's out of my league (still learning driver Linux and driver development) Jun 22 22:24:22 anyone know the last commit on 17.01 where qos-scripts actually worked? :/ Jun 22 22:25:12 luke-jr flash 18.6 Jun 22 22:25:55 1806 is out? Jun 22 22:26:11