aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* gitignore: add .ccache folderKoen Vandeputte2021-06-141-0/+1
| | | | Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.14 to 4.14.236Koen Vandeputte2021-06-141-2/+2
| | | | | | | | | | | | Refreshed all patches. Fixes: - CVE-2021-3564 Compile-tested on: ar71xx, cns3xxx, imx6, x86_64 Runtime-tested on: ar71xx, cns3xxx, imx6 Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* mac80211: Update to backports version 4.19.193-test1Hauke Mehrtens2021-06-0616-58/+58
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* kernel: bump 4.14 to 4.14.235Hauke Mehrtens2021-06-0621-58/+40
| | | | | | | | | | | | Manually rebased ramips/patches-5.4/0048-asoc-add-mt7620-support.patch All others updated automatically. Compile-tested on: ath79/generic, ramips/mt7621 Runtime-tested on: ath79/generic Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* ubox: fix init script validation of log_ip optionJo-Philipp Wich2021-05-282-2/+2
| | | | | | | | | The underlying logread process uses usock() to handle remote connections which is able to handle both hostnames and IP addresses. Ref: https://github.com/openwrt/luci/issues/5077 Signed-off-by: Jo-Philipp Wich <jo@mein.io> (backported from commit ec83fb9ced138b7945135adffb9ff0ba63b695ec)
* tools/mklibs: Fix compile with GCC 11Hauke Mehrtens2021-05-161-0/+1
| | | | | | | | | | | | | GCC 11 defaults to C++17, but mklibs does not compile when using the C++17 standard. This patch switches back to the gnu++98 version like done in master commit 9437012b9ee4 ("tools/mklibs: update to 0.1.44 and convert to Python 3") This fixes the following compile error message: elf.hpp:52:56: error: ISO C++17 does not allow dynamic exception specifications 52 | const section &get_section(unsigned int i) const throw (std::out_of_range) { return *sections.at(i); }; Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* openwrt-keyring: Only copy sign key for 19.07 and 21.02Hauke Mehrtens2021-05-161-2/+5
| | | | | | | | | | | Instead of adding all public signature keys from the openwrt-keyring repository only add the key which is used to sign the OpenWrt 19.07 feeds and the 21.02 feeds to allow checking the next release. If one of the other keys would be compromised this would not affect users of 19.07 release builds. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* openwrt-keyring: add OpenWrt 21.02 GPG/usign keysPetr Štetiar2021-05-161-3/+3
| | | | | | | | 49283916005d usign: add 21.02 release build pubkey bc4d80f064f2 gpg: add OpenWrt 21.02 signing key Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit 1bf6d70e60fdb45d81a8f10b90904cef38c73f70)
* generic: platform/mikrotik: release mtd device after useKoen Vandeputte2021-05-121-1/+4
| | | | | | | | | | | | | | The code uses get_mtd_device_nm() which must be followed by a call to put_mtd_device() once the handle is no longer used. This fixes spurious shutdown console messages such as: [ 83.099037] Removing MTD device #1 (hard_config) with use count 1 Reported-by: Koen Vandeputte <koen.vandeputte@ncentric.com> Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com> Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org> [Backported from master] Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.14 to 4.14.232Koen Vandeputte2021-05-104-7/+7
| | | | | | | | | | | | Refreshed all patches. Fixes: - CVE-2021-23133 Compile-tested on: ar71xx, cns3xxx, imx6, x86_64 Runtime-tested on: ar71xx, cns3xxx, imx6 Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* Extend checks on build prerequisites for building OpenWRT coreBas Mevissen2021-05-081-1/+12
| | | | | | | | | | | | | | OpenWRT requires a number of Perl modules to be installed. It wasn't checking on all of them. This patch adds checks for Perl FindBin, File::Copy, File::Compare and Thread::Queue modules. Failing to install these, will have the build break at some point. By adding these to the prereq-build.mk script, they are checked on forehand. Tested on a Fedora 33 and 34 (beta) that was freshly installed. Fedora appears to break up Perl modules into small packages that need to be installed for the build to succeed. Signed-off-by: Bas Mevissen <abuse@basmevissen.nl> (cherry picked from commit f68c9474acf9a65b5a9538db8e45c173462487e3)
* prereq-build: test for perl's Data::DumperRosen Penev2021-05-081-0/+4
| | | | | | | | | | | | | | | | | | | | | | | Required for installation of autoconf: make[5]: Entering directory `/openwrt/build_dir/host/autoconf-2.69' Making all in bin make[6]: Entering directory `/openwrt/build_dir/host/autoconf-2.69/bin' autom4te_perllibdir='..'/lib AUTOM4TE_CFG='../lib/autom4te.cfg' ../bin/autom4te -B '..'/lib -B '..'/lib --language M4sh --cache '' --melt ./autoconf.as -o autoconf.in Can't locate Data/Dumper.pm in @INC (@INC contains: ../lib /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .) at ../lib/Autom4te/C4che.pm line 33. BEGIN failed--compilation aborted at ../lib/Autom4te/C4che.pm line 33. Compilation failed in require at ../bin/autom4te line 40. BEGIN failed--compilation aborted at ../bin/autom4te line 40. make[6]: *** [autoconf.in] Error 2 Signed-off-by: Rosen Penev <rosenp@gmail.com> (cherry picked from commit dc467eac38f2447b652b6680cf4af75b05fd6cd2)
* tplink-safeloader: fix C7v5 factory flashing from vendor fw > v1.1.xPetr Štetiar2021-05-061-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently it's not possible to flash factory images on devices shipped with vendor firmware versions 1.1.0 Build 20201120 rel. 50406 (published 2020-12-22): (curFw_ver, newFw_ver) == (1.1, 1.0) [NM_Error](nm_checkSoftVer) 00848: Firmwave not supports, check failed. [NM_Error](nm_checkUpdateContent) 01084: software version dismatched [NM_Error](nm_buildUpgradeStruct) 01188: checkUpdateContent failed. They've even following note in release notes: Note: You will be unable to downgrade to the previous firmware version after updating this firmware. This version check in vendor firmware is implemented in /usr/bin/nvrammanager binary likely as following C code[1]: sscanf(buf, "%d.%d.%*s",&upd_fw_major, &upd_fw_minor); ... if (((int)upd_fw_major < (int)cur_fw_major) || ((ret = 1, cur_fw_major == upd_fw_major && (upd_fw_minor < (int)cur_fw_minor)))) { ret = 0; printf("[NM_Error](%s) %05d: Firmwave not supports, check failed.\r\n\r\n","nm_checkSoftVer" ,0x350); } ... return ret; So in order to fix this and make it future proof it should be enough to ship our factory firmware images with major version 7 (lucky number). Tested on latest firmware version 1.1.2 Build 20210125 rel.37999: Firmwave supports, check OK. (curFw_ver, newFw_ver) == (1.1, 7.0) check firmware ok! Flashing back to vendor firmware c7v5_us-up-ver1-1-2-P1[20210125-rel37999]_2021-01-25_10.33.55.bin works as well: U-Boot 1.1.4-gbec22107-dirty (Nov 18 2020 - 18:19:12) ... Firmware downloaded... filesize = 0xeeae77 fileaddr = 0x80060000. Firmware Recovery file length : 15642231 Firmware process id 2. handle_fw_cloud 146 Image verify OK! Firmware file Verify ok! product-info:product_name:Archer C7 product_ver:5.0.0 special_id:55530000 [Error]sysmgr_cfg_checkSupportList(): 1023 @ specialId 45550000 NOT Match. Firmware supports, check OK. Firmware Recovery check ok! 1. https://gist.github.com/ynezz/2e0583647d863386a66c3d231541b6d1 Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit e6d66375cbbb54e0e82a67030e385a5486273766) Signed-off-by: Petr Štetiar <ynezz@true.cz>
* mac80211: Update to backports version 4.19.189-1Hauke Mehrtens2021-05-0444-499/+146
| | | | | | The removed patches were applied upstream. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* dropbear: Fix CVE-2020-36254Hauke Mehrtens2021-05-031-0/+21
| | | | | | | | This backports a fix from dropbear 2020.81. CVE-2020-36254 description: scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* ramips: backport unlocked mdiobus accessorsDavid Bauer2021-05-031-0/+141
| | | | | | | | | | | Commit 718e97c5c843 ("ramips: mt7530 swconfig: fix race condition in register access") backports a fix which depends on unlocked MMD accessors, however these were not yet included in Kernel 4.14 and they were not backported yet. Fixes commit 718e97c5c843 ("ramips: mt7530 swconfig: fix race condition in register access") Signed-off-by: David Bauer <mail@david-bauer.net>
* openvpn: update to 2.4.11Magnus Kroken2021-05-022-3/+3
| | | | | | | | | | | | Fixes two related security vulnerabilities (CVE-2020-15078) which under very specific circumstances allow tricking a server using delayed authentication (plugin or management) into returning a PUSH_REPLY before the AUTH_FAILED message, which can possibly be used to gather information about a VPN setup. This release also includes other bug fixes and improvements. Signed-off-by: Magnus Kroken <mkroken@gmail.com>
* openvpn: update to 2.4.9Magnus Kroken2021-05-023-4/+4
| | | | | | | | | | | | | | | | This is primarily a maintenance release with bugfixes and improvements. This release also fixes a security issue (CVE-2020-11810) which allows disrupting service of a freshly connected client that has not yet negotiated session keys. The vulnerability cannot be used to inject or steal VPN traffic. Release announcement: https://openvpn.net/community-downloads/#heading-13812 Full list of changes: https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24#OpenVPN2.4.9 Signed-off-by: Magnus Kroken <mkroken@gmail.com> (cherry-picked from commit d7e98bd7c5316f95cc11635371a39c6c0e18b9a7)
* openvpn: update to 2.4.8Magnus Kroken2021-05-025-6/+129
| | | | | | | | | | | Backport two upstream commits that allow building openvpn-openssl without OpenSSLs deprecated APIs. Full changelog: https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24#OpenVPN2.4.8 Signed-off-by: Magnus Kroken <mkroken@gmail.com> (cherry-picked from commit bf43e5bbf91ca1a90df8dae3e2cce6bbb61d5cd9)
* ramips: mt7530 swconfig: fix race condition in register accessDENG Qingfang2021-05-021-6/+10
| | | | | | | | | | | | | | | | | | | [ Upstream commit f99c9cd9c4d4c49a676d678327546fd41690fe2a ] The mt7530_{r,w}32 operation over MDIO uses 3 mdiobus operations and does not hold a lock, which causes a race condition when multiple threads try to access a register, they may get unexpected results. To avoid this, handle the MDIO lock manually, and use the unlocked __mdiobus_{read,write} in the critical section. This fixes the "Ghost VLAN" artifact[1] in MT7530/7621 when the VLAN operation and the swconfig LED link status poll race between each other. [1] https://forum.openwrt.org/t/mysterious-vlan-ids-on-mt7621-device/64495 Signed-off-by: DENG Qingfang <dqfext@gmail.com> (cherry picked from commit f99c9cd9c4d4c49a676d678327546fd41690fe2a)
* ppp/pppoe-discovery: fix -W optionMartin Schiller2021-05-021-0/+60
| | | | | | | | | This patch is already included in ppp-2.4.9 which is used in openwrt master. Backport this patch to openwrt-19.07. Signed-off-by: Martin Schiller <ms@dev.tdt.de>
* kernel: bump 4.14 to 4.14.231Koen Vandeputte2021-04-303-10/+10
| | | | | | | | | | | | | | Refreshed all patches. Fixes: - CVE-2020-25672 - CVE-2020-25671 - CVE-2020-25670 Compile-tested on: ar71xx, cns3xxx, imx6, x86_64 Runtime-tested on: ar71xx, cns3xxx, imx6 Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.14 to 4.14.230Koen Vandeputte2021-04-307-83/+33
| | | | | | | | | | | | Refreshed all patches. Remove upstreamed: - 840-can-flexcan-flexcan_chip_freeze-fix-chip-freeze-for-.patch Compile-tested on: ar71xx, cns3xxx, imx6, x86_64 Runtime-tested on: ar71xx, cns3xxx, imx6 Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>
* mac80211: backport upstream fixesKoen Vandeputte2021-04-098-1/+354
| | | | | | | Refreshed all patches. Includes all fixes up to 4.19.184 Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>
* kernel: backport fix for flexcan bugKoen Vandeputte2021-04-091-0/+50
| | | | | | | | This patch fixes a DIV/0 error which was introduced in 4.14.225 This patch was forgotten in upstream <= 4.14 and is now queued for future release. Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>
* kernel: bump 4.14 to 4.14.229Koen Vandeputte2021-04-097-11/+11
| | | | | | | | | Refreshed all patches. Compile-tested on: ar71xx, cns3xxx, imx6, x86_64 Runtime-tested on: ar71xx, cns3xxx, imx6 Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>
* kernel: bump 4.14 to 4.14.228Koen Vandeputte2021-04-094-32/+32
| | | | | | | | | Refreshed all patches. Compile-tested on: ar71xx, cns3xxx, imx6, x86_64 Runtime-tested on: ar71xx, cns3xxx, imx6 Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>
* kernel: bump 4.14 to 4.14.227Koen Vandeputte2021-04-0927-75/+75
| | | | | | | | | | | | Refreshed all patches. Altered patches: - 809-flexcan-support-layerscape.patch Compile-tested on: ar71xx, cns3xxx, imx6, layerscape, x86_64 Runtime-tested on: ar71xx, cns3xxx, imx6 Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>
* openssl: bump to 1.1.1kEneas U de Queiroz2021-03-272-24/+23
| | | | | | | | | | | | | This version fixes 2 security vulnerabilities, among other changes: - CVE-2021-3450: problem with verifying a certificate chain when using the X509_V_FLAG_X509_STRICT flag. - CVE-2021-3449: OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com> (cherry picked from commit 0bd0de7d43b3846ad0d7006294e1daaadfa7b532)
* openssl: sync package download URLs with masterPetr Štetiar2021-03-271-3/+5
| | | | | | | Apparently it fixes some broken URLs and as a bonus it makes cherry-picking of fixes easier. Signed-off-by: Petr Štetiar <ynezz@true.cz>
* mbedtls: update to 2.16.10Magnus Kroken2021-03-272-13/+13
| | | | | | | | | | | | | | | | | | | | This release of Mbed TLS provides bug fixes and minor enhancements. This release includes fixes for security issues. Security fixes: * Fix a buffer overflow in mbedtls_mpi_sub_abs() * Fix an errorneous estimation for an internal buffer in mbedtls_pk_write_key_pem() * Fix a stack buffer overflow with mbedtls_net_poll() and mbedtls_net_recv_timeout() * Guard against strong local side channel attack against base64 tables by making access aceess to them use constant flow code Full release announcement: https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.10 Signed-off-by: Magnus Kroken <mkroken@gmail.com> (cherry picked from commit dbde2bcf60b5d5f54501a4b440f25fe7d02fbe5d)
* mwlwifi: add PKG_FLAGS:=nonsharedDaniel Golle2021-03-241-0/+1
| | | | | | | | | This should fix the problem of mwlwifi-firmware-* not being found when using the ImageBuilder. Signed-off-by: Daniel Golle <daniel@makrotopia.org> (cherry picked from commit 9b3aaf1cdb873cc2a7b2f2ef4e72ddb716afba38) Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* scripts: bundle-libraries.sh: fix broken SDK compilerPetr Štetiar2021-03-201-1/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | Recent versions (> 5.33) of `file` report liblto_plugin.so as executable: $ file liblto_plugin.so liblto_plugin.so.0.0.0: ELF 64-bit LSB pie executable ... Which then leads to improper packaging of the plugin, resulting in the broken compiler: configure: checking whether the C compiler works mips-openwrt-linux-musl/bin/ld: liblto_plugin.so: error loading plugin: liblto_plugin.so: invalid ELF header As the LTO compiler plugin library is incorrectly packaged as SDK executable: $ head -1 ~/staging_dir/toolchain...libexec/gcc/.../liblto_plugin.so #!/usr/bin/env bash Fix this by filtering out shared libraries from the patching. Ref: https://bugzilla.redhat.com/show_bug.cgi?id=1296868 Acked-by: Jo-Philipp Wich <jo@mein.io> Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit 4b7165722cb0e2ba62ab68e8b90d4d4b0909744c)
* build: reduce number of files passed to ipk-removeEneas U de Queiroz2021-03-191-11/+8
| | | | | | | | | | | | | | | | | | | | | Instead of using xargs to pass a huge number of files to script/ipkg-remove, which will usually pick only one, use a more restrictive wildcard so that, currently, at the most 325 files are examined, instead of up to over 2,300. The 325-file package is python, which is picking up python3* ipks. It is about to be removed. Runner-up is ddns-scripts with 7 files. This makes a second run of make package/luci/compile go from real 16.40s; user 17.42s; sys 2.73s to real 10.71s; user 9.51s; sys 1.27s There is a caveat though: if one were to remove the ABI_VERSION of a package that ends in a digit [0-9], then the old package ipk will not be removed from the bin directory by make package/abc2/clean. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com> (cherry picked from commit 11192484fa320cd233849441bd00ddf58964de42)
* build: call ipkg-remove using xargs if #args>=512Eneas U de Queiroz2021-03-191-1/+11
| | | | | | | | | | | | | | The wildcard call to clean up luci package (luci*) can pick up over 2,300 files when the full tree is built. Running make package/luci/clean or a second run of make package/luci/compile would fail with an 'Argument list too long' error. To avoid that, a maybe_use_xargs function was created that runs the command straight as usual if the number of arguments is < 512, or saves the list in a temporary file and feeds it to xargs otherwise. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com> (cherry picked from commit 78d1f3ac61b1740f2a45c40bcde0e83246308a18)
* build: package-ipkg: avoid calling wildcard twiceEneas U de Queiroz2021-03-191-2/+8
| | | | | | | | | Instead of calling $(wildcard) to check if the removal list is empty, then calling it again to actually remove the files, define a function so that the arguments are expanded only once when it gets called. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com> (cherry picked from commit 40acc13ca72ca7d2815dc5d94549d5dc48e16e98)
* kernel: bump 4.14 to 4.14.224Koen Vandeputte2021-03-104-6/+6
| | | | | | | | | Refreshed all patches. Compile-tested on: ar71xx, cns3xxx, imx6, x86_64 Compile-tested on: ar71xx, cns3xxx, imx6 Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: bump 4.14 to 4.14.223Koen Vandeputte2021-03-1019-51/+51
| | | | | | | | | Refreshed all patches. Compile-tested on: ar71xx, cns3xxx, imx6, x86_64 Runtime-tested on: ar71xx, cns3xxx, imx6 Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* wolfssl: bump to v4.7.0-stableEneas U de Queiroz2021-03-065-92/+4
| | | | | | | | | | | | | | | Biggest fix for this version is CVE-2021-3336, which has already been applied here. There are a couple of low severity security bug fixes as well. Three patches are no longer needed, and were removed; the one remaining was refreshed. This tool shows no ABI changes: https://abi-laboratory.pro/index.php?view=objects_report&l=wolfssl&v1=4.6.0&v2=4.7.0 Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com> (cherry picked from commit d1dfb577f1c0d5b1f1fa35000c9ad7abdb7d10ed)
* hostapd: P2P: Fix a corner case in peer addition based on PD RequestStefan Lippers-Hollmann2021-03-062-1/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | p2p_add_device() may remove the oldest entry if there is no room in the peer table for a new peer. This would result in any pointer to that removed entry becoming stale. A corner case with an invalid PD Request frame could result in such a case ending up using (read+write) freed memory. This could only by triggered when the peer table has reached its maximum size and the PD Request frame is received from the P2P Device Address of the oldest remaining entry and the frame has incorrect P2P Device Address in the payload. Fix this by fetching the dev pointer again after having called p2p_add_device() so that the stale pointer cannot be used. This fixes the following security vulnerabilities/bugs: - CVE-2021-27803 - A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision discovery requests. It could result in denial of service or other impact (potentially execution of arbitrary code), for an attacker within radio range. Fixes: 17bef1e97a50 ("P2P: Add peer entry based on Provision Discovery Request") Signed-off-by: Jouni Malinen <jouni@codeaurora.org> Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de> (cherry picked from commit 1ca5de13a153061feae260864d73d96f7c463785)
* build: fix checks for GCC11Petr Štetiar2021-03-061-4/+4
| | | | | | | | Fedora 34 already uses GCC11. Reported-by: Marcin Juszkiewicz <marcin-openwrt@juszkiewicz.com.pl> Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit cae69d558135456976b8fc6cb08530d1358cf6d5)
* Revert "base-files: source functions.sh in /lib/functions/system.sh"Adrian Schmutzler2021-03-012-3/+1
| | | | | | | | | | | | | | | | This reverts commit 86aeac4fc98f42ac0ce7e0dcf1cb240e16b28f8f. The reverted commit introduced a cyclic dependency between /lib/functions.sh and /lib/functions/system.sh. Further details are found in 282e8173509a ("base-files: do not source system.sh in functions.sh"), which was applied to master some time ago and is included in 21.02. With the current age of 19.07 branch, it seems safer to revert this mostly cosmetic feature than investing further time into disentangling the dependencies. Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* kernel: bump 4.14 to 4.14.222Koen Vandeputte2021-02-268-16/+16
| | | | | | | | | Refreshed all patches. Compile-tested on: ar71xx, cns3xxx, imx6, x86_64 Runtime-tested on: ar71xx, cns3xxx, imx6 Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* base-files: source functions.sh in /lib/functions/system.shAdrian Schmutzler2021-02-242-1/+3
| | | | | | | | | The file /lib/functions/system.sh depends on find_mtd_index() and find_mtd_part() located in /lib/function.sh, so let's source that file. Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> (backported from commit ae636effd24a7637cefca58a143063f395c82d05)
* hostapd: backport ignoring 4addr mode enabling errorRaphaël Mélotte2021-02-202-1/+79
| | | | | | | | | | | | | | | | | | | This is a backport of the upstream commit 58bbbb598144 ("nl80211: Ignore 4addr mode enabling error if it was already enabled"). nl80211_set_4addr_mode() could fail when trying to enable 4addr mode on an interface that is in a bridge and has 4addr mode already enabled. This operation would not have been necessary in the first place and this failure results in disconnecting, e.g., when roaming from one backhaul BSS to another BSS with Multi AP. Avoid this issue by ignoring the nl80211 command failure in the case where 4addr mode is being enabled while it has already been enabled. Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be> [bump PKG_RELEASE, more verbose commit description] Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit fb860b4e418c28a0f388f215e5acce103dcee1bf)
* ramips: remove factory image for TP-Link Archer C20 v1Stijn Segers2021-02-191-1/+0
| | | | | | | | | | | | | Similarly to the Archer C2 v1, the Archer C20 v1 will brick when one tries to flash an OpenWrt factory image through the TP-Link web UI. The wiki page contains an explicit warning about this [1]. Disable the factory image altogether since it serves no purpose. [1] https://openwrt.org/toh/tp-link/tp-link_archer_c20_v1#installation Signed-off-by: Stijn Segers <foss@volatilesystems.org> (backported from commit 0265cba40ad4f2b8ff4473ada123c35b53ffd97a)
* lantiq: fritz7320: enable USB power supplyMathias Kresin2021-02-181-0/+46
| | | | | | | | | | | | | The USB ports if a FRIZZ!Box 7320 do not supply power to connected devices. Add the GPIOs enabling USB power as regulator, to enable USB power supply as soon as the USB driver is loaded. Fixes FS#3624 Signed-off-by: Mathias Kresin <dev@kresin.me> (cherry picked from commit 6e4e97b2256327bb380ee2a83da9a1ddf657e395)
* openssl: bump to 1.1.1jEneas U de Queiroz2021-02-171-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes 4 security vulnerabilities/bugs: - CVE-2021-2839 - SSLv2 vulnerability. Openssl 1.1.1 does not support SSLv2, but the affected functions still exist. Considered just a bug. - CVE-2021-2840 - calls EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. - CVE-2021-2841 - The X509_issuer_and_serial_hash() function attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it was failing to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. - Fixed SRP_Calc_client_key so that it runs in constant time. This could be exploited in a side channel attack to recover the password. The 3 CVEs above are currently awaiting analysis. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com> (cherry picked from commit 482c9ff289c65480c8e7340e1740db24c62f91df)
* OpenWrt v19.07.7: revert to branch defaultsHauke Mehrtens2021-02-165-12/+10
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* OpenWrt v19.07.7: adjust config defaultsv19.07.7Hauke Mehrtens2021-02-165-10/+12
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-26 09:13:43 +0000