aboutsummaryrefslogtreecommitdiffstats
path: root/package
Commit message (Collapse)AuthorAgeFilesLines
* mwlwifi: upgrade to 10.3.0.18-20160804Imre Kaloz2016-09-293-113/+2
| | | | | | adds support for the Linksys WRT1900ACSv2 and WRT1200ACv2 Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
* mac80211: brcmfmac: backport patch simplifying brcmf_alloc_vifRafał Miłecki2016-09-295-9/+112
| | | | | | This is quite trivial and will be required for VIF fixes in the future. Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
* mac80211: brcmfmac: fix stopping netdev queue when bus clogs upRafał Miłecki2016-09-291-0/+53
| | | | Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
* mac80211: brcmfmac: support hidden SSIDRafał Miłecki2016-09-291-0/+43
| | | | Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
* mac80211: brcmfmac: fix interfaces managementRafał Miłecki2016-09-296-0/+357
| | | | | | | | | | | | | | | To work correctly hostapd requires wireless driver to allow interfaces removal. It was working with brcmfmac only partially. Firmware for BCM43602 got some special hack (feature?) that allowed removing all interfaces by disabling mbss mode. It wasn't working with BCM4366 firmware and remaining interfaces were preventing hostapd from starting again. Those patches add support for "interface_remove" firmware method which works with BCM4366 firmware and they make it finally possible to use BCM4366 & brcmfmac & multiple interfaces. Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
* rpcd: iwinfo plugin fixesRafał Miłecki2016-09-291-2/+2
| | | | | | | | - Expose supported HT rate information in info call - Zero out ccode buffer when listing countries Signed-off-by: Jo-Philipp Wich <jo@mein.io> Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
* mac80211: brcmfmac: fix lockup related to P2P interfaceRafał Miłecki2016-09-294-1/+300
| | | | Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
* CC: openssl: update to 1.0.2jZoltan HERPAI2016-09-291-2/+2
| | | | | | | | | | | | | | Security fixes: * (Severity: High) OCSP Status Request extension unbounded memory growth (CVE-2016-6304) * (Severity: Moderate) SSL_peek() hang on empty record (CVE-2016-6305) * (Severity: Moderate) Missing CRL sanity check (CVE-2016-7052) * 10 Low severity issues Security advisories: https://www.openssl.org/news/secadv/20160922.txt https://www.openssl.org/news/secadv/20160926.txt Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
* iw: backport support for "channels" commandRafał Miłecki2016-06-191-0/+234
| | | | | | | | Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Backport of r49388 git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@49389 3c298f89-4303-0410-b956-a3cf2f4a3e73
* mac80211: brcmfmac: fix support for BCM4366Rafał Miłecki2016-06-193-0/+233
| | | | | | | | | | | | 1) Fix setting AP channel 2) Improve BSS management to avoid: [ 3602.929199] brcmfmac: brcmf_ap_add_vif: timeout occurred Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Backport of r49383 git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@49386 3c298f89-4303-0410-b956-a3cf2f4a3e73
* mac80211: brcmfmac: add support for get_channelRafał Miłecki2016-06-192-0/+338
| | | | | | | | | | | It's very useful for debugging problems with brcmfmac setting requested channel. Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Backport of r49382 git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@49385 3c298f89-4303-0410-b956-a3cf2f4a3e73
* mac80211: brcmfmac: fix support for up to 4 AP interfacesRafał Miłecki2016-06-193-2/+121
| | | | | | | | Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Backport of r49381 git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@49384 3c298f89-4303-0410-b956-a3cf2f4a3e73
* mac80211: brcmfmac: return -ENFILE if interface existsRafał Miłecki2016-06-191-1/+1
| | | | | | | | | This makes brcmfmac compatible with mac80211 which uses dev_alloc_name (and so returns -ENFILE on error). Signed-off-by: Rafał Miłecki <zajec5@gmail.com> git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@49378 3c298f89-4303-0410-b956-a3cf2f4a3e73
* openssl: Update to version 1.0.2hLuka Perkov2016-06-191-2/+2
| | | | | | | | | | | | openssl: Update to version 1.0.2h Bump to the latest version, fixes several security issues: * CVE-2016-2107, CVE-2016-2105, CVE-2016-2106, CVE-2016-2109, CVE-2016-2176 More details at https://www.openssl.org/news/openssl-1.0.2-notes.html Signed-off-by: Mohammed Berdai <mohammed.berdai@gmail.com> git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@49363 3c298f89-4303-0410-b956-a3cf2f4a3e73
* mtd: seama: exit with error if Seama header wasn't foundRafał Miłecki2016-06-191-1/+1
| | | | | | | | Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Backport of r49314 git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@49315 3c298f89-4303-0410-b956-a3cf2f4a3e73
* mtd: seama: fix image data handlingRafał Miłecki2016-06-191-28/+18
| | | | | | | | | | | | | | | | 1) Put sanity checks in one place 2) Respect provided offset 3) Read only as much data as needed for MD5 calculation Thanks to the last change this is a great speedup and memory saver. On devices with NAND flash we were allocating & reading about 128 MiB while something about 8 MiB is enough. Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Backport of r49309 git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@49313 3c298f89-4303-0410-b956-a3cf2f4a3e73
* mtd: seama: move buf allocation to the MD5 functionRafał Miłecki2016-06-191-16/+22
| | | | | | | | | | This buf is only used in this function now, so lets move it there. Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Backport of r49308 git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@49312 3c298f89-4303-0410-b956-a3cf2f4a3e73
* mtd: seama: update MD5 using header in the first block bufferRafał Miłecki2016-06-191-4/+3
| | | | | | | | | | | This will allow separating first block buffer from a buffer used for MD5 calculation. Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Backport of r49307 git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@49311 3c298f89-4303-0410-b956-a3cf2f4a3e73
* mtd: seama: add md5 to header structRafał Miłecki2016-06-192-12/+11
| | | | | | | | | | | This allows us to drop some extra offset calculations and simplifies code a bit. Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Backport of r49306 git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@49310 3c298f89-4303-0410-b956-a3cf2f4a3e73
* mtd: check for Seama magic early when fixing MD5Rafał Miłecki2016-06-191-7/+21
| | | | | | | | | | | This avoid long (and unneeded) process of reading all data in case of running on MTD not containig Seama entity. Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Backport of r49304 git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@49305 3c298f89-4303-0410-b956-a3cf2f4a3e73
* mtd: add missing breaks in a switchRafał Miłecki2016-06-191-0/+2
| | | | | | | | | | | On platforms supporting both: TRX and Seama calling "fixtrx" was resulting in trying to fix Seama as well. Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Backport of r49301 git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@49303 3c298f89-4303-0410-b956-a3cf2f4a3e73
* mtd: use tabs for indentsRafał Miłecki2016-06-191-7/+7
| | | | | | | | | | This makes code style consistent across the whole file. Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Backport of r49300 git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@49302 3c298f89-4303-0410-b956-a3cf2f4a3e73
* hostapd: backport fix for AP SME drivers with monitor mode supportRafał Miłecki2016-06-191-0/+48
| | | | | | Signed-off-by: Rafał Miłecki <zajec5@gmail.com> git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@49299 3c298f89-4303-0410-b956-a3cf2f4a3e73
* CC: ubox: turn logd into a separate packageLuka Perkov2016-06-191-3/+17
| | | | | | | | | Currently system log is always included as a part of ubox. Add logd as a seperate package and add it to default packages list. Signed-off-by: Andrej Vlasic <andrej.vlasic@sartura.hr> git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@49294 3c298f89-4303-0410-b956-a3cf2f4a3e73
* mac80211: add support for BCM4366C0 in brcmfmacRafał Miłecki2016-04-272-0/+92
| | | | | | Signed-off-by: Rafał Miłecki <zajec5@gmail.com> git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@49261 3c298f89-4303-0410-b956-a3cf2f4a3e73
* CC: samba: fix some security problemsHauke Mehrtens2016-04-1721-46/+20105
| | | | | | | | | | | | | | | | | | Backport of r49175. This fixes the following security problems: * CVE-2015-7560 * CVE-2015-5370 * CVE-2016-2110 * CVE-2016-2111 * CVE-2016-2112 * CVE-2016-2115 * CVE-2016-2118 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@49177 3c298f89-4303-0410-b956-a3cf2f4a3e73
* mac80211: backport brcmfmac workaround for missing boardrevRafał Miłecki2016-04-162-7/+121
| | | | | | Signed-off-by: Rafał Miłecki <zajec5@gmail.com> git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@49173 3c298f89-4303-0410-b956-a3cf2f4a3e73
* mtd: enable "fixseama" on bcm53xxRafał Miłecki2016-04-151-1/+1
| | | | | | | | | | There are D-Link bcm53xx devices using Seama format. Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Backport of r48521 git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@49169 3c298f89-4303-0410-b956-a3cf2f4a3e73
* rpcd: update to latest versionLuka Perkov2016-04-131-4/+4
| | | | | | Signed-off-by: Luka Perkov <luka@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@49163 3c298f89-4303-0410-b956-a3cf2f4a3e73
* uboot-envtools: add support for ap120cLuka Perkov2016-03-231-0/+1
| | | | | | Signed-off-by: Luka Perkov <luka@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@49085 3c298f89-4303-0410-b956-a3cf2f4a3e73
* CC: version.mk and image-config.in: adjust to 15.05.1John Crispin2016-03-201-1/+1
| | | | | | | | | | | | | | | | | | * Adjust the default version number in include/version.mk to 15.05.1 * Copy the correct download repo location from include/version.mk to base-files/image-config.in After the change to version.mk, new builds made from CC sources will have opkg config that downloads from the recent 15.05.1 packages repo instead of the ancient 15.05 packages repo. The change to image-config.in ensures that if somebody uses VERSIONOPT config options in .config, he will get the correct download repo address (instead of trunk snapshots). Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi> git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@49053 3c298f89-4303-0410-b956-a3cf2f4a3e73
* CC: linux-firmware: fix rt73-usb-firmware packageHauke Mehrtens2016-03-191-2/+2
| | | | | | | | | | | | | | | | Backport of r49037 Some parts of this package were named rt73-pci-firmware before which looks like a copy and past error. This renames all parts to rt73-usb- firmware and then the firmware gets build and the dependencies from the package with the kernel module are also working correctly. This fixes #22069 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@49038 3c298f89-4303-0410-b956-a3cf2f4a3e73
* mac80211: backport brcmfmac fixes for WARNING and BCM4360 initRafał Miłecki2016-03-112-0/+103
| | | | | | Signed-off-by: Rafał Miłecki <zajec5@gmail.com> git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@49004 3c298f89-4303-0410-b956-a3cf2f4a3e73
* CC: curl: detect the library as renamed wolfsslHauke Mehrtens2016-03-032-1/+102
| | | | | | | | | | Without this patch curl does not detect the new cyassl/wolfssl version and would be build without ssl support instead when cyassl was selected. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@48900 3c298f89-4303-0410-b956-a3cf2f4a3e73
* mac80211: improve rate control performanceFelix Fietkau2016-03-031-0/+77
| | | | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> Backport of r48897 git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@48899 3c298f89-4303-0410-b956-a3cf2f4a3e73
* mt76: update to the latest version, adds stability fixesFelix Fietkau2016-03-031-2/+2
| | | | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> Backport of r48895 git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@48898 3c298f89-4303-0410-b956-a3cf2f4a3e73
* mac80211: add a number of pending fixesFelix Fietkau2016-03-025-0/+180
| | | | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> Backport of r48883 git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@48884 3c298f89-4303-0410-b956-a3cf2f4a3e73
* mac80211/hostapd: rework 802.11w driver support selection, do not hardcode ↵Felix Fietkau2016-03-022-1/+5
| | | | | | | | | | drivers in hostapd makefile Signed-off-by: Felix Fietkau <nbd@openwrt.org> Backport of r46903 git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@48878 3c298f89-4303-0410-b956-a3cf2f4a3e73
* CC: cyassl: disable Intel ASM for nowJo-Philipp Wich2016-03-021-8/+8
| | | | | | | | | | With ASM support enabled, CyaSSL fails to build on all x86 subtargets. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> Backport of r48876 git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@48877 3c298f89-4303-0410-b956-a3cf2f4a3e73
* curl: bump pkg revisionJo-Philipp Wich2016-03-021-2/+2
| | | | | | Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@48875 3c298f89-4303-0410-b956-a3cf2f4a3e73
* CC: cyassl: update to wolfssl version 3.8.0 to fix security problemsHauke Mehrtens2016-03-015-39/+47
| | | | | | | | | | | | | | | | | Backport of: r46167: cyassl: version bump to 3.4.6 r46168: cyassl: update to wolfssl 3.6.0 r46551: cyassl: the upstream package in version 4.6.0 changed r47791: cyassl: update to wolfSSL version 3.7.0 This version and version 3.6.8 are fixing the following security problems: * CVE-2015-7744 * CVE-2015-6925 r48616: cyassl: update to wolfssl version 3.8.0 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@48873 3c298f89-4303-0410-b956-a3cf2f4a3e73
* CC: curl: fix CVE-2016-0755Hauke Mehrtens2016-03-011-0/+126
| | | | | | | | | | | | | This fixes the following security problem: CVE-2016-0755: NTLM credentials not-checked for proxy connection re-use http://curl.haxx.se/docs/adv_20160127B.html backport of r48614. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@48872 3c298f89-4303-0410-b956-a3cf2f4a3e73
* iw: update to version 4.3, sync with trunk r47782Felix Fietkau2016-03-018-672/+603
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@48870 3c298f89-4303-0410-b956-a3cf2f4a3e73
* CC: openssl: update to 1.0.2g (8 CVEs)Jo-Philipp Wich2016-03-014-15/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CVE-2016-0704 s2_srvr.c overwrite the wrong bytes in the master-key when applying Bleichenbacher protection for export cipher suites. This provides a Bleichenbacher oracle, and could potentially allow more efficient variants of the DROWN attack. CVE-2016-0703 s2_srvr.c did not enforce that clear-key-length is 0 for non-export ciphers. If clear-key bytes are present for these ciphers, they *displace* encrypted-key bytes. This leads to an efficient divide-and-conquer key recovery attack: if an eavesdropper has intercepted an SSLv2 handshake, they can use the server as an oracle to determine the SSLv2 master-key, using only 16 connections to the server and negligible computation. More importantly, this leads to a more efficient version of DROWN that is effective against non-export ciphersuites, and requires no significant computation. CVE-2016-0702 A side-channel attack was found which makes use of cache-bank conflicts on the Intel Sandy-Bridge microarchitecture which could lead to the recovery of RSA keys. The ability to exploit this issue is limited as it relies on an attacker who has control of code in a thread running on the same hyper- threaded core as the victim thread which is performing decryptions. CVE-2016-0799 The internal |fmtstr| function used in processing a "%s" format string in the BIO_*printf functions could overflow while calculating the length of a string and cause an OOB read when printing very long strings. Additionally the internal |doapr_outch| function can attempt to write to an OOB memory location (at an offset from the NULL pointer) in the event of a memory allocation failure. In 1.0.2 and below this could be caused where the size of a buffer to be allocated is greater than INT_MAX. E.g. this could be in processing a very long "%s" format string. Memory leaks can also occur. The first issue may mask the second issue dependent on compiler behaviour. These problems could enable attacks where large amounts of untrusted data is passed to the BIO_*printf functions. If applications use these functions in this way then they could be vulnerable. OpenSSL itself uses these functions when printing out human-readable dumps of ASN.1 data. Therefore applications that print this data could be vulnerable if the data is from untrusted sources. OpenSSL command line applications could also be vulnerable where they print out ASN.1 data, or if untrusted data is passed as command line arguments. Libssl is not considered directly vulnerable. Additionally certificates etc received via remote connections via libssl are also unlikely to be able to trigger these issues because of message size limits enforced within libssl. CVE-2016-0797 In the BN_hex2bn function the number of hex digits is calculated using an int value |i|. Later |bn_expand| is called with a value of |i * 4|. For large values of |i| this can result in |bn_expand| not allocating any memory because |i * 4| is negative. This can leave the internal BIGNUM data field as NULL leading to a subsequent NULL ptr deref. For very large values of |i|, the calculation |i * 4| could be a positive value smaller than |i|. In this case memory is allocated to the internal BIGNUM data field, but it is insufficiently sized leading to heap corruption. A similar issue exists in BN_dec2bn. This could have security consequences if BN_hex2bn/BN_dec2bn is ever called by user applications with very large untrusted hex/dec data. This is anticipated to be a rare occurrence. All OpenSSL internal usage of these functions use data that is not expected to be untrusted, e.g. config file data or application command line arguments. If user developed applications generate config file data based on untrusted data then it is possible that this could also lead to security consequences. This is also anticipated to be rare. CVE-2016-0798 The SRP user database lookup method SRP_VBASE_get_by_user had confusing memory management semantics; the returned pointer was sometimes newly allocated, and sometimes owned by the callee. The calling code has no way of distinguishing these two cases. Specifically, SRP servers that configure a secret seed to hide valid login information are vulnerable to a memory leak: an attacker connecting with an invalid username can cause a memory leak of around 300 bytes per connection. Servers that do not configure SRP, or configure SRP but do not configure a seed are not vulnerable. In Apache, the seed directive is known as SSLSRPUnknownUserSeed. To mitigate the memory leak, the seed handling in SRP_VBASE_get_by_user is now disabled even if the user has configured a seed. Applications are advised to migrate to SRP_VBASE_get1_by_user. However, note that OpenSSL makes no strong guarantees about the indistinguishability of valid and invalid logins. In particular, computations are currently not carried out in constant time. CVE-2016-0705 A double free bug was discovered when OpenSSL parses malformed DSA private keys and could lead to a DoS attack or memory corruption for applications that receive DSA private keys from untrusted sources. This scenario is considered rare. CVE-2016-0800 A cross-protocol attack was discovered that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. Note that traffic between clients and non- vulnerable servers can be decrypted provided another server supporting SSLv2 and EXPORT ciphers (even with a different protocol such as SMTP, IMAP or POP) shares the RSA keys of the non-vulnerable server. This vulnerability is known as DROWN (CVE-2016-0800). Recovering one session key requires the attacker to perform approximately 2^50 computation, as well as thousands of connections to the affected server. A more efficient variant of the DROWN attack exists against unpatched OpenSSL servers using versions that predate 1.0.2a, 1.0.1m, 1.0.0r and 0.9.8zf released on 19/Mar/2015 (see CVE-2016-0703 below). Users can avoid this issue by disabling the SSLv2 protocol in all their SSL/TLS servers, if they've not done so already. Disabling all SSLv2 ciphers is also sufficient, provided the patches for CVE-2015-3197 (fixed in OpenSSL 1.0.1r and 1.0.2f) have been deployed. Servers that have not disabled the SSLv2 protocol, and are not patched for CVE-2015-3197 are vulnerable to DROWN even if all SSLv2 ciphers are nominally disabled, because malicious clients can force the use of SSLv2 with EXPORT ciphers. OpenSSL 1.0.2g and 1.0.1s deploy the following mitigation against DROWN: SSLv2 is now by default disabled at build-time. Builds that are not configured with "enable-ssl2" will not support SSLv2. Even if "enable-ssl2" is used, users who want to negotiate SSLv2 via the version-flexible SSLv23_method() will need to explicitly call either of: SSL_CTX_clear_options(ctx, SSL_OP_NO_SSLv2); or SSL_clear_options(ssl, SSL_OP_NO_SSLv2); as appropriate. Even if either of those is used, or the application explicitly uses the version-specific SSLv2_method() or its client or server variants, SSLv2 ciphers vulnerable to exhaustive search key recovery have been removed. Specifically, the SSLv2 40-bit EXPORT ciphers, and SSLv2 56-bit DES are no longer available. In addition, weak ciphers in SSLv3 and up are now disabled in default builds of OpenSSL. Builds that are not configured with "enable-weak-ssl-ciphers" will not provide any "EXPORT" or "LOW" strength ciphers. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> Backport of r48868. git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@48869 3c298f89-4303-0410-b956-a3cf2f4a3e73
* kernel: add Realtek USB to Ethernet modulesJohn Crispin2016-03-011-0/+30
| | | | | | | | | | https://forum.openwrt.org/viewtopic.php?pid=279394 Signed-off-by: Dirk Neukirchen <dirkneukirchen@web.de> Backport of r46031 git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@48863 3c298f89-4303-0410-b956-a3cf2f4a3e73
* base-files: add /etc/profile.d supportJohn Crispin2016-03-011-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | OpenWrt should support an optional /etc/profile.d directory like most other Linux distributions. This allows packages to install their own scripts into /etc/profile.d/ directory. The file suffix should make clear, that these scripts are (sourced) shell-snippets. If the user needs e.g. php or lua, one must make sure that the interpreter is called. The reverse failsafe test makes sure, that the effective returncode is 0. A typcal usecase is the inclusion of private helpers, special variables or aliases, which at the moment needs patching the sourcecode and is not well maintainable. Now the builder can simply add there files. v1 initial work of Hendrik Lüth <hendrik@linux-nerds.de> v2 changes regarding RFC (e.g. thomas.langer@lantiq.com) v3 changes regarding RFC (e.g. mschiffer@universe-factory.net) v4 keep it simple and mimic OpenWrt style Signed-off-by: Bastian Bittorf <bittorf@bluebottle.com> Backport of r46965 git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@48862 3c298f89-4303-0410-b956-a3cf2f4a3e73
* mac80211: set mcast-rate for mesh point interfacesJohn Crispin2016-03-011-6/+8
| | | | | | | | | | | | | | | | | In order to set the multicast rate for mesh point interfaces the "mesh join" was made explicit and moved to mac80211_setup_vif(), similar to how it is done for IBSS interfaces. Previously, the mesh join was made implicit in case authentication (i.e. $key) was not used when creating the interface in mac80211_prepare_vif(), while using authentication would create the interface first, then join later in mac80211_setup_vif() by starting authsae. Signed-off-by: Nils Schneider <nils@nilsschneider.net> Backport of r47408 git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@48858 3c298f89-4303-0410-b956-a3cf2f4a3e73
* kernel/gpio_keys: load module on pre-initJohn Crispin2016-03-011-1/+1
| | | | | | | | | | fix rescue mode on wdr4900 Signed-off-by: Alexander Couzens <lynxis@fe80.eu> Backport of r48793 git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@48851 3c298f89-4303-0410-b956-a3cf2f4a3e73
* brcm2708-gpu-fw: move pkg build dir to kernel build dir to fix rebuild bugs ↵John Crispin2016-03-011-1/+1
| | | | | | | | | | after cleaning the kernel tree Signed-off-by: Felix Fietkau <nbd@openwrt.org> Backport of r48732 git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@48850 3c298f89-4303-0410-b956-a3cf2f4a3e73
* OpenSSL: Added source/old to PKG_SOURCE_URLJohn Crispin2016-03-011-1/+4
| | | | | | | | | | | | | | | | | | | OpenSSL moves old versions of the library from http://www.openssl.org/source/ to http://www.openssl.org/source/old/$version/ breaking the old links. That behavior breaks the OpenWRT-build every time OpenSSL releases a new version. This patch adds http://www.openssl.org/source/old/$version/ to the PKG_SOURCE_URL of OpenSSL to avoid breaking the build whenever OpenSSL releases a new version. Signed-off-by: Kevin Kirsch <ranlvor@starletp9.de> Reviewed-by: Alexander Dahl <post@lespocky.de> Backport of r47860 git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@48845 3c298f89-4303-0410-b956-a3cf2f4a3e73
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-05 16:56:51 +0000