aboutsummaryrefslogtreecommitdiffstats
path: root/package/libs
Commit message (Collapse)AuthorAgeFilesLines
* wolfssl: fix build with make < 4.2Chen Minqiang2023-02-032-28/+28
| | | | | | | | Inline the preinst.arm-ce script. Support for including was added in make 4.2 and is not working with older make versions. Fixes: https://github.com/openwrt/openwrt/issues/11866 Signed-off-by: Chen Minqiang <ptpt52@gmail.com>
* mbedtls: x509 crt verify SAN iPAddressGlenn Strauss2023-02-032-1/+182
| | | | | | | | | | | | | | | | backport from X509 crt verify SAN iPAddress https://github.com/Mbed-TLS/mbedtls/pull/6475 addresses curl built with mbedtls fails on https://1.1.1.1/ (IP address in SubjectAltName) https://github.com/Mbed-TLS/mbedtls/issues/6473 filed for mbedTLS: BADCERT_CN_MISMATCH on https://1.1.1.1 with curl+mbedtls https://github.com/openwrt/packages/issues/19677 Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
* openssl: fix VIA Padlock AES-192 and 256 encryptionValdikSS ValdikSS2023-01-221-0/+52
| | | | | | | | | | | | | | Byte swapping code incorrectly uses the number of AES rounds to swap expanded AES key, while swapping only a single dword in a loop, resulting in swapped key and partially swapped expanded keys, breaking AES encryption and decryption on VIA Padlock hardware. This commit correctly sets the number of swapping loops to be done. Upstream: https://github.com/openssl/openssl/commit/2bcf8e69bd92e33d84c48e7d108d3d46b22f8a6d Acked-by: Eneas U de Queiroz <cotequeiroz@gmail.com> Signed-off-by: ValdikSS ValdikSS <iam@valdikss.org.ru>
* mbedtls: move source modification to patchDavid Bauer2023-01-182-7/+15
| | | | | | | Patch the mbedtls source instead of modifying the compile-targets in the prepare buildstep within OpenWrt. Signed-off-by: David Bauer <mail@david-bauer.net>
* libpcap: update to 1.10.3Nick Hainke2023-01-172-3/+3
| | | | | | | | | | Changelog: https://git.tcpdump.org/libpcap/blob/95691ebe7564afa3faa5c6ba0dbd17e351be455a:/CHANGES Refresh patch: - 300-Add-support-for-B.A.T.M.A.N.-Advanced.patch Signed-off-by: Nick Hainke <vincent@systemli.org>
* libtracefs: update to 1.6.4Nick Hainke2023-01-131-2/+2
| | | | | | Update to latest release. Signed-off-by: Nick Hainke <vincent@systemli.org>
* libtraceevent: update to 1.7.1Nick Hainke2023-01-131-2/+2
| | | | | | Update to latest release. Signed-off-by: Nick Hainke <vincent@systemli.org>
* elfutils: Ignore wrong use-after-free errorHauke Mehrtens2023-01-091-1/+1
| | | | | | | | | | | | | | | | | | | GCC 12.2.0 shows this false positive error message: ```` In function 'bigger_buffer', inlined from '__libdw_gunzip' at gzip.c:374:12: gzip.c:96:9: error: pointer may be used after 'realloc' [-Werror=use-after-free] 96 | b = realloc (state->buffer, more -= 1024); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ gzip.c:94:13: note: call to 'realloc' here 94 | char *b = realloc (state->buffer, more); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors ```` GCC bug report: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104069 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* libpcap: update to 1.20.2Nick Hainke2023-01-065-46/+20
| | | | | | | | | | | | | | | | | | | | | | | | | A huge rewrite in libpcap was introduced by dc14a7babca1 ("rpcap: have the server tell the client its byte order.") [0]. The patch "201-space_optimization.patch" does not apply at all anymore. So remove it. Refresh: - 100-no-openssl.patch - 102-skip-manpages.patch Update the "300-Add-support-for-B.A.T.M.A.N.-Advanced.patch" with latest PR [1]. old ipkg size: 90964 bin/packages/mips_24kc/base/libpcap1_1.10.1-5_mips_24kc.ipk new ipkg size: 93340 bin/packages/mips_24kc/base/libpcap1_1.10.2-1_mips_24kc.ipk [0] - https://github.com/the-tcpdump-group/libpcap/commit/dc14a7babca1471809bee6872539ff836937840e [1] - https://github.com/the-tcpdump-group/libpcap/pull/980 Signed-off-by: Nick Hainke <vincent@systemli.org>
* ncurses: update to 6.4Linhui Liu2023-01-056-21/+21
| | | | | | Update to the latest released version. Signed-off-by: Linhui Liu <liulinhui36@gmail.com>
* treewide: Trigger reinstall of all wolfssl dependenciesHauke Mehrtens2023-01-011-1/+1
| | | | | | | | The ABI of the wolfssl library changed a bit between version 5.5.3 and 5.5.4. This release update will trigger a rebuild of all packages which are using wolfssl to make sure they are adapted to the new ABI. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* wolfssl: update to 5.5.4-stableNick Hainke2023-01-013-36/+3
| | | | | | | | | | | | | Remove upstreamed: - 001-Fix-enable-devcrypto-build-error.patch Refresh patch: - 100-disable-hardening-check.patch Release notes: https://github.com/wolfSSL/wolfssl/releases/tag/v5.5.4-stable Signed-off-by: Nick Hainke <vincent@systemli.org>
* mbedtls: update to version 2.28.2Hauke Mehrtens2022-12-312-6/+6
| | | | | | | | | | | | | | | | | | | Changelog: https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.2 This release of Mbed TLS provides bug fixes and minor enhancements. This release includes fixes for security issues. Fixes the following CVEs: * CVE-2022-46393: Fix potential heap buffer overread and overwrite in DTLS if MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX. * CVE-2022-46392: An adversary with access to precise enough information about memory accesses (typically, an untrusted operating system attacking a secure enclave) could recover an RSA private key after observing the victim performing a single private-key operation if the window size used for the exponentiation was 3 or smaller. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* libbsd: fix libpath to not use host pathXuefer H2022-12-262-0/+14
| | | | | | | | | | libpath.so uses host path in ld script causing other packages fail to cross compile, e.g. perl: "ld: cannot find /usr/lib/libbsd.so.0.11.6: No such file or directory" Fixes: openwrt/packages#19390 Signed-off-by: Xuefer H <xuefer@gmail.com>
* libtracefs: update to 1.6.3Nick Hainke2022-12-171-2/+2
| | | | | | Update to latest release. Signed-off-by: Nick Hainke <vincent@systemli.org>
* libtraceevent: update to 1.7.0Nick Hainke2022-12-171-2/+2
| | | | | | Update to latest release. Signed-off-by: Nick Hainke <vincent@systemli.org>
* libpcap: add support for B.A.T.M.A.N. AdvancedLinus Lüssing2022-12-141-0/+642
| | | | | | | | | | | | | | | | | | | | | | This adds support for the layer 2 mesh routing protocol B.A.T.M.A.N. Advanced. "batadv" can be used to filter on batman-adv packets. It also allows later filters to look at frames inside the tunnel when both "version" and "type" are specified. Documentation for the batman-adv protocol can be found at the following locations: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/networking/batman-adv.rst https://www.open-mesh.org/ -- This is a backport of the following upstream pull request: https://github.com/the-tcpdump-group/libpcap/pull/980 -> "Add support for B.A.T.M.A.N. Advanced #980" Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
* wolfssl: fix build with /dev/cryptoChukun Pan2022-12-111-0/+33
| | | | | | | | | | Backport upstream patch to fix build error when /dev/crypto enabled. https://github.com/wolfSSL/wolfssl/commit/dc9f46a3be00b5e82684a158605189d1278e324c Fixes: #10944 Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
* libtracefs: update to 1.6.2Nick Hainke2022-12-111-2/+2
| | | | | | | | 378a9dd libtracefs: version 1.6.2 e6daa60 libtracefs: Add unit test to test mounting of tracefs_{tracing,debug}_dir() 32acbbf libtracefs: Have tracefs_{tracing,debug}_dir() mount {tracefs,debugfs} if not mounted Signed-off-by: Nick Hainke <vincent@systemli.org>
* ustream-ssl: update to Git version 2022-12-07Hauke Mehrtens2022-12-081-4/+4
| | | | | | | | | 9217ab4 ustream-openssl: Disable renegotiation in TLSv1.2 and earlier 2ce1d48 ci: fix building with i.MX6 SDK 584f1f6 ustream-openssl: wolfSSL: provide detailed information in debug builds aa8c48e cmake: add a possibility to set library version Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* wolfssl: fix Config.in typoTony Butler2022-11-271-1/+1
| | | | | | Fix simple typo `/crytpo/crypto/` in a description string Signed-off-by: Tony Butler <spudz76@gmail.com>
* wolfssl: update to v5.5.3Nick Hainke2022-11-273-53/+3
| | | | | | | | | | | | | | Remove "200-ecc-rng.patch" because it was upstramed by: https://github.com/wolfSSL/wolfssl/commit/e2566bab2122949a6a0bb2276d0a52598794d7d0 Refreshed "100-disable-hardening-check.patch". Fixes CVE 2022-42905. Release Notes: - https://github.com/wolfSSL/wolfssl/releases/tag/v5.5.2-stable - https://github.com/wolfSSL/wolfssl/releases/tag/v5.5.3-stable Signed-off-by: Nick Hainke <vincent@systemli.org>
* libtracefs: update to 1.6.1Nick Hainke2022-11-181-2/+2
| | | | | | Update to latest version. Signed-off-by: Nick Hainke <vincent@systemli.org>
* libmbedtls: use defaults if no build opts selectedGlenn Strauss2022-11-161-2/+3
| | | | | | | use defaults if no build opts selected (allows build with defaults when mbedtls not selected and configured) Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
* libmbedtls: disable older RSA ciphersGlenn Strauss2022-11-131-2/+2
| | | | | | disable older RSA ciphers Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
* libmbedtls: enable crypto algorithms for hostapGlenn Strauss2022-11-131-6/+6
| | | | | | | | | enable additional crypto algorithms for hostap hostap uses local implementations if not provided by crypto library, so might as well enable in the crypto library for shared use by others. Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
* libmbedtls: build option submenuGlenn Strauss2022-11-133-265/+259
| | | | | | menuconfig libmbedtls build option submenu Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
* zlib: update to 1.2.13Nick Hainke2022-11-137-339/+18
| | | | | | | | | | | | | | | | | | | | | | Remove "001-neon-implementation-of-adler32.patch" because upstreamed deleted assembler code optimizations: https://github.com/madler/zlib/commit/d0704a820186481da35d08f4b655881e1d32089f Remove upstreamed patches: - 006-fix-CVE-2022-37434.patch - 007-fix-null-dereference-in-fix-CVE-2022-37434.patch Refresh patches: - 002-arm-specific-optimisations-for-inflate.patch - 003-arm-specific-optimisations-for-inflate.patch - 004-attach-sourcefiles-in-patch-002-to-buildsystem.patch Switch to "https github.com" for downloading source files. Release Announcements: https://github.com/madler/zlib/releases/tag/v1.2.13 Signed-off-by: Nick Hainke <vincent@systemli.org>
* libnftnl: update to 1.2.4Nick Hainke2022-11-121-2/+2
| | | | | | | Release Announcement: https://lore.kernel.org/netfilter-devel/Y20W+LT%2F+sq%2Fi2rz@salvia/T/#u Signed-off-by: Nick Hainke <vincent@systemli.org>
* openssl: bump to 1.1.1sJohn Audia2022-11-0514-168/+2527
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes between 1.1.1r and 1.1.1s [1 Nov 2022] *) Fixed a regression introduced in 1.1.1r version not refreshing the certificate data to be signed before signing the certificate. [Gibeom Gwon] Changes between 1.1.1q and 1.1.1r [11 Oct 2022] *) Fixed the linux-mips64 Configure target which was missing the SIXTY_FOUR_BIT bn_ops flag. This was causing heap corruption on that platform. [Adam Joseph] *) Fixed a strict aliasing problem in bn_nist. Clang-14 optimisation was causing incorrect results in some cases as a result. [Paul Dale] *) Fixed SSL_pending() and SSL_has_pending() with DTLS which were failing to report correct results in some cases [Matt Caswell] *) Fixed a regression introduced in 1.1.1o for re-signing certificates with different key sizes [Todd Short] *) Added the loongarch64 target [Shi Pujin] *) Fixed a DRBG seed propagation thread safety issue [Bernd Edlinger] *) Fixed a memory leak in tls13_generate_secret [Bernd Edlinger] *) Fixed reported performance degradation on aarch64. Restored the implementation prior to commit 2621751 ("aes/asm/aesv8-armx.pl: avoid 32-bit lane assignment in CTR mode") for 64bit targets only, since it is reportedly 2-17% slower and the silicon errata only affects 32bit targets. The new algorithm is still used for 32 bit targets. [Bernd Edlinger] *) Added a missing header for memcmp that caused compilation failure on some platforms [Gregor Jasny] Build system: x86_64 Build-tested: bcm2711/RPi4B Run-tested: bcm2711/RPi4B Signed-off-by: John Audia <therealgraysky@proton.me>
* elfutils: update to 1.88Nick Hainke2022-11-054-8/+8
| | | | | | | | | | | | Release Notes: https://sourceware.org/pipermail/elfutils-devel/2022q4/005561.html Refresh patches: - 003-libintl-compatibility.patch - 100-musl-compat.patch - 101-no-fts.patch Signed-off-by: Nick Hainke <vincent@systemli.org>
* libnl-tiny: update to the latest versionHauke Mehrtens2022-11-011-3/+3
| | | | | | db3b2cd libnl-tiny: set SOCK_CLOEXEC if available Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* readline: update to 8.2Nick Hainke2022-10-231-2/+2
| | | | | | | Release Announcement: https://lists.gnu.org/archive/html/info-gnu/2022-09/msg00013.html Signed-off-by: Nick Hainke <vincent@systemli.org>
* gettext-full: update to 0.21.1Nick Hainke2022-10-223-88/+48
| | | | | | | | | Release Announcement: https://lists.gnu.org/archive/html/info-gnu/2020-07/msg00009.html Further, refresh 001-autotools.patch and manually refresh 010-m4.patch. Signed-off-by: Nick Hainke <vincent@systemli.org>
* libbsd: update to 0.11.7Nick Hainke2022-10-221-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | Changes: 084911c Release libbsd 0.11.7 3538d38 man: Discourage using the library in non-overlay mode 03fccd1 include: Adjust reallocarray() per glibc adoption 6b6e686 include: Adjust arc4random() per glibc adoption da1f45a include: explicit_bzero() requires _DEFAULT_SOURCE 2f9eddc include: Simplify glibc version dependent macro handling 28298ac doc: Switch references from pkg-config to pkgconf ef981f9 doc: Add missing empty line to separate README sections 6928d78 doc: Refer to the main git repository as primary d586575 test: Fix explicit_bzero() test on the Hurd be327c6 fgetwln: Add comment about lack of getwline(3) for recommendation a14612d setmode: Dot not use saveset after free f4baceb man: Rewrite gerprogname(3bsd) from scratch f35c545 man: Lowercase man page title b466b14 man: Document that some arc4random(3) functions are now in glibc 2.36 1f6a48b Sync arc4random(3) implementation from OpenBSD 873639e Fix ELF support for big endian SH c9c78fd man: Use -compact also for alternative functions in libbsd(7) 5f21307 getentropy: Fix function cast for getauxval() Signed-off-by: Nick Hainke <vincent@systemli.org>
* ncurses: add package CPE IDPetr Štetiar2022-10-191-0/+1
| | | | | | | | Common Platform Enumeration (CPE) is a structured naming scheme for information technology systems, software, and packages. Suggested-by: Steffen Pfendtner <s.pfendtner@ads-tec.de> Signed-off-by: Petr Štetiar <ynezz@true.cz>
* libnftnl: add package CPE IDPetr Štetiar2022-10-191-0/+1
| | | | | | | | Common Platform Enumeration (CPE) is a structured naming scheme for information technology systems, software, and packages. Suggested-by: Steffen Pfendtner <s.pfendtner@ads-tec.de> Signed-off-by: Petr Štetiar <ynezz@true.cz>
* libubox: update to the latest versionFelix Fietkau2022-10-141-3/+3
| | | | | | ea56013409d5 jshn.sh: add json_add_fields function for adding multiple fields at once Signed-off-by: Felix Fietkau <nbd@nbd.name>
* libnl-tiny: update to the latest versionChukun Pan2022-10-091-3/+3
| | | | | | | | | | c42d890 build static library 28c44ca genl_family: explicitly null terminate strncpy destination buffer This fixes the compilation with gcc 12. Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
* build: prefer HTTPS if available (for packages)Daniel Cousens2022-10-052-2/+2
| | | | | | | | Changes PKG_SOURCE_URL's for arptables, bsdiff, dnsmasq, fortify-headers, ipset, ipset-dns, libaudit, libpcap, libressl, lua, lua5.3, tcpdump and valgrind, to HTTPS Signed-off-by: Daniel Cousens <github@dcousens.com>
* treewide: fix security issues by bumping all packages using libwolfsslPetr Štetiar2022-10-031-1/+1
| | | | | | | | | | | | | | | | | As wolfSSL is having hard time maintaining ABI compatibility between releases, we need to manually force rebuild of packages depending on libwolfssl and thus force their upgrade. Otherwise due to the ABI handling we would endup with possibly two libwolfssl libraries in the system, including the patched libwolfssl-5.5.1, but still have vulnerable services running using the vulnerable libwolfssl-5.4.0. So in order to propagate update of libwolfssl to latest stable release done in commit ec8fb542ec3e4 ("wolfssl: fix TLSv1.3 RCE in uhttpd by using 5.5.1-stable (CVE-2022-39173)") which fixes several remotely exploitable vulnerabilities, we need to bump PKG_RELEASE of all packages using wolfSSL library. Signed-off-by: Petr Štetiar <ynezz@true.cz>
* libtracefs: update to 1.5.0Nick Hainke2022-10-021-2/+2
| | | | | | | | | | | | | | | | | | | | | | Changes: 93f4d52 libtracefs: version 1.5 bc857db libtracefs: Add tracefs_u{ret}probe_alloc to generic man page db55441 libtracefs: Add tracefs_debug_dir() to generic libtracefs man page d2d5924 libtracefs: Add test instructions for openSUSE 4a7b475 libtracefs: Fix test suite typo ee8c644 libtracefs: Add tracefs_tracer_available() helper 799d88e libtracefs: Add API to set custom tracing directory 1bb00d1 libtracefs: allow pthread inclusion overrideable in Makefile 04651d0 libtracefs sqlhist: Allow pointers to match longs 9de59a0 libtracefs: Remove double free attempt of new_event in tracefs_synth_echo_cmd() 0aaa86a libtracefs: Fix use after free in tracefs_synth_alloc() d2d5340 libtracefs: Add missed_events to record 9aaa8b0 libtracefs: Set the number of CPUs in tracefs_local_events_system() 56a0ba0 libtracefs: Return negative number when tracefs_filter_string_append() fails c5f849f libtracefs: Set the long size of the tep handle in tracefs_local_events_system() 5c8103e revert: 0de961e74f96 ("libtracefs: Set visibility of parser symbols as 'internal'") Signed-off-by: Nick Hainke <vincent@systemli.org>
* libtraceevent: update to 1.6.3Nick Hainke2022-10-021-2/+2
| | | | | | | | | | | | | | | | | | | | | | | Changes: fda4ad9 libtraceevent: version 1.6.3 d02a61e libtraceevent: Add man pages for tep_plugin_kvm_get/put_func() 6643bf9 libtraceevent: Have kvm_exit/enter be able to show guest function a596299 libtraceevent: Add tep_print_field() to check-manpages.sh deprecated 065c9cd libtraceevent: Add man page documentation of tep_get_sub_buffer_size() 6e18ecc libtraceevent: Add man page for tep_plugin_add_option() 6738713 libtraceevent: Add some missing functions to generic libtraceevent man page deefe29 libtraceevent: Include meta data functions in libtraceevent man pages cf6dd2d libtraceevent: Add tep_get_function_count() to libtraceevent man page 5bfc11e libtraceevent: Add printk documentation to libtraceevent man page 65c767b libtraceevent: Update man page to reflect tep_is_pid_registered() rename 7cd173f libtraceevent: Add check-manpages.sh fd6efc9 libtraceevent: Documentation: Correct typo in example 5c375b0 libtraceevent: Fixing linking to C++ code 7839fc2 libtraceevent: Makefile - set LIBS as conditional assignment c5493e7 libtraceevent: Remove double assignment of val in eval_num_arg() efd3289 libtraceevent: Add warnings if fields are outside the event Signed-off-by: Nick Hainke <vincent@systemli.org>
* popt: update to 1.19Nick Hainke2022-10-022-2/+28
| | | | | | | Add patch to fix compilation: - 100-configure.ac-remove-require-gettext-version.patch Signed-off-by: Nick Hainke <vincent@systemli.org>
* libcap: update to 2.66Nick Hainke2022-10-021-2/+2
| | | | | | | | | | | | | | 4f96e67 Up the release version to 2.66 60ff008 Fix typos in the cap_from_text.3 man page. 281b6e4 Add captrace to .gitignore file 09a2c1d Add an example of using BPF kprobing to trace capability use. 26e3a09 Clean up getpcaps code. fc804ac getpcaps: catch PID parsing errors. fc437fd Fix an issue with bash displaying an error. 7db9589 Some more simplifications for building 27e801b Fix for "make clean ; make -j48 test" Signed-off-by: Nick Hainke <vincent@systemli.org>
* wolfssl: fix TLSv1.3 RCE in uhttpd by using 5.5.1-stable (CVE-2022-39173)Petr Štetiar2022-09-291-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | Fixes denial of service attack and buffer overflow against TLS 1.3 servers using session ticket resumption. When built with --enable-session-ticket and making use of TLS 1.3 server code in wolfSSL, there is the possibility of a malicious client to craft a malformed second ClientHello packet that causes the server to crash. This issue is limited to when using both --enable-session-ticket and TLS 1.3 on the server side. Users with TLS 1.3 servers, and having --enable-session-ticket, should update to the latest version of wolfSSL. Thanks to Max at Trail of Bits for the report and "LORIA, INRIA, France" for research on tlspuffin. Complete release notes https://github.com/wolfSSL/wolfssl/releases/tag/v5.5.1-stable Fixes: CVE-2022-39173 Fixes: https://github.com/openwrt/luci/issues/5962 References: https://github.com/wolfSSL/wolfssl/issues/5629 Tested-by: Kien Truong <duckientruong@gmail.com> Reported-by: Kien Truong <duckientruong@gmail.com> Signed-off-by: Petr Štetiar <ynezz@true.cz>
* Revert "wolfssl: fix TLSv1.3 RCE in uhttpd by using latest 5.5.1-stable release"Petr Štetiar2022-09-291-2/+2
| | | | | | | | This reverts commit a596a8396b1ef23cd0eda22d9a628392e70e1e1a as I've just discovered private email, that the issue has CVE-2022-39173 assigned so I'm going to reword the commit and push it again. Signed-off-by: Petr Štetiar <ynezz@true.cz>
* wolfssl: refresh patchesPetr Štetiar2022-09-292-3/+3
| | | | | | So they're tidy and apply cleanly. Signed-off-by: Petr Štetiar <ynezz@true.cz>
* wolfssl: fix TLSv1.3 RCE in uhttpd by using latest 5.5.1-stable releasePetr Štetiar2022-09-291-2/+2
| | | | | | | | | | | | | | | | | | | | | Fixes denial of service attack and buffer overflow against TLS 1.3 servers using session ticket resumption. When built with --enable-session-ticket and making use of TLS 1.3 server code in wolfSSL, there is the possibility of a malicious client to craft a malformed second ClientHello packet that causes the server to crash. This issue is limited to when using both --enable-session-ticket and TLS 1.3 on the server side. Users with TLS 1.3 servers, and having --enable-session-ticket, should update to the latest version of wolfSSL. Thanks to Max at Trail of Bits for the report and "LORIA, INRIA, France" for research on tlspuffin. Complete release notes https://github.com/wolfSSL/wolfssl/releases/tag/v5.5.1-stable Fixes: https://github.com/openwrt/luci/issues/5962 References: https://github.com/wolfSSL/wolfssl/issues/5629 Signed-off-by: Petr Štetiar <ynezz@true.cz>
* sysfsutils: Define START early in fileKevin Darbyshire-Bryant2022-09-262-2/+3
| | | | | | | | | | The luci ucode rewrite exposed the definition of START as being over 1K from start of file. Initial versions limited the search for START & STOP to within the 1st 1K of a file. Whilst the search has been expanded, it doesn't do any harm to define START early in the file like all other init scripts seen so far. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-03 20:49:31 +0000