aboutsummaryrefslogtreecommitdiffstats
path: root/package
Commit message (Collapse)AuthorAgeFilesLines
* OpenWrt v18.06.8: revert to branch defaultsJo-Philipp Wich2020-02-271-2/+2
| | | | Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* OpenWrt v18.06.8: adjust config defaultsv18.06.8Jo-Philipp Wich2020-02-271-2/+2
| | | | Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* libubox: backport blobmsg_check_array() fixJo-Philipp Wich2020-02-272-1/+34
| | | | | | Fixes: FS#2833 Signed-off-by: Jo-Philipp Wich <jo@mein.io> (backported from commit 955634b473284847e3c8281a6ac85655329d8b06)
* ppp: backport security fixesPetr Štetiar2020-02-264-1/+129
| | | | | | | | | | | 8d45443bb5c9 pppd: Ignore received EAP messages when not doing EAP 8d7970b8f3db pppd: Fix bounds check in EAP code 858976b1fc31 radius: Prevent buffer overflow in rc_mksid() Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit 215598fd03899c19a9cd26266221269dd5ec8cee) Fixes: CVE-2020-8597 Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* Revert "ppp: backport security fixes"Jo-Philipp Wich2020-02-264-129/+1
| | | | | | | | This reverts commit cc78f934a9466a0ef404bb169cc42680c7501d02 since it didn't contain a reference to the CVE it addresses. The next commit will re-add the commit including a CVE reference in its commit message. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* uhttpd: update to latest Git HEADJo-Philipp Wich2020-02-261-3/+3
| | | | | | | 2ee323c file: poke ustream after starting deferred program Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit 04069fde19e86af7728111814afadf780bf08018)
* ppp: backport security fixesPetr Štetiar2020-02-204-1/+129
| | | | | | | | | 8d45443bb5c9 pppd: Ignore received EAP messages when not doing EAP 8d7970b8f3db pppd: Fix bounds check in EAP code 858976b1fc31 radius: Prevent buffer overflow in rc_mksid() Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit 215598fd03899c19a9cd26266221269dd5ec8cee)
* hostapd: remove erroneous $(space) redefinitionJo-Philipp Wich2020-02-081-3/+0
| | | | | | | | | | | | | | | | | The $(space) definition in the hostapd Makefile ceased to work with GNU Make 4.3 and later, leading to syntax errors in the generated Kconfig files. Drop the superfluous redefinition and reuse the working $(space) declaration from rules.mk to fix this issue. Fixes: GH#2713 Ref: https://github.com/openwrt/openwrt/pull/2713#issuecomment-583722469 Reported-by: Karel Kočí <cynerd@email.cz> Suggested-by: Jonas Gorski <jonas.gorski@gmail.com> Tested-by: Shaleen Jain <shaleen@jain.sh> Signed-off-by: Jo-Philipp Wich <jo@mein.io> (backported from commit 766e778226f5d4c6ec49ce22b101a5dbd4306644)
* OpenWrt v18.06.7: revert to branch defaultsJo-Philipp Wich2020-01-291-2/+2
| | | | Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* OpenWrt v18.06.7: adjust config defaultsv18.06.7Jo-Philipp Wich2020-01-291-2/+2
| | | | Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* opkg: update to latest Git HEADJo-Philipp Wich2020-01-291-3/+3
| | | | | | | | | 80d161e opkg: Fix -Wformat-overflow warning c09fe20 libopkg: fix skipping of leading whitespace when parsing checksums Fixes: CVE-2020-7982 Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit c69c20c6670081d1eaab000734d89de57eb64148)
* libubox: backport security patchesHauke Mehrtens2020-01-2717-1/+1097
| | | | | | | | | | | | | | This backports some security relevant patches from libubox master. These patches should not change the existing API and ABI so that old applications still work like before without any recompilation. Application can now also use more secure APIs. The new more secure interfaces are also available, but not used. OpenWrt master and 19.07 already have these patches by using a more recent libubox version. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* lantiq: ltq-ptm: vr9: fix skb handling in ptm_hard_start_xmit()Martin Schiller2020-01-262-1/+4
| | | | | | | | | | | Call skb_orphan(skb) to call the owner's destructor function and make the skb unowned. This is necessary to prevent sk_wmem_alloc of a socket from overflowing, which leads to ENOBUFS errors on application level. Signed-off-by: Martin Schiller <ms@dev.tdt.de> (cherry picked from commit 996f02e5bafad2815e72821c19d41fb5297e4dad)
* mbedtls: update to 2.16.4Magnus Kroken2020-01-262-31/+31
| | | | | | | | | | | | | | | | Fixes side channel vulnerabilities in mbed TLS' implementation of ECDSA. Release announcement: https://tls.mbed.org/tech-updates/releases/mbedtls-2.16.4-and-2.7.13-released Security advisory: https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-12 Fixes: * CVE-2019-18222: Side channel attack on ECDSA Signed-off-by: Magnus Kroken <mkroken@gmail.com> (cherry picked from commit 6e96fd90471a49185bcfe9dcb4844d444674ecab)
* ethtool: fix PKG_CONFIG_DEPENDSMatthias Schiffer2020-01-071-1/+1
| | | | | | | Add missing CONFIG_ prefix. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net> (cherry picked from commit 41c19dd542973dbc1336ecceaa32777506933cdf)
* OpenWrt v18.06.6: revert to branch defaultsHauke Mehrtens2020-01-061-2/+2
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* OpenWrt v18.06.6: adjust config defaultsv18.06.6Hauke Mehrtens2020-01-061-2/+2
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* e2fsprogs: Fix CVE-2019-5094 in libsupportHauke Mehrtens2020-01-012-1/+204
| | | | | | | | | This adds the following patch from debian: https://git.kernel.org/pub/scm/fs/ext2/e2fsprogs.git/commit/?h=debian/stable&id=09fe1fd2a1f9efc3091b4fc61f1876d0785956a8 libsupport: add checks to prevent buffer overrun bugs in quota code Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit 0062aad8ecc9bbe36c55895fd78fcaf9a406b006)
* openssl: update to version 1.0.2uJosef Schlehofer2020-01-011-2/+2
| | | | | | Fixes CVE-2019-1551 (rsaz_512_sqr overflow bug) on x86_x64 Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* kernel: fix *-gpio-custom module unloadingSungbo Eo2019-12-234-6/+6
| | | | | | | | | | | | | | | | | | | | | | Unloading and reloading the modules fails, as platform_device_put() does not release resources fully. root@OpenWrt:/# insmod i2c-gpio-custom bus0=0,18,0,5 [ 196.860620] Custom GPIO-based I2C driver version 0.1.1 [ 196.871162] ------------[ cut here ]------------ [ 196.880517] WARNING: CPU: 0 PID: 1365 at fs/sysfs/dir.c:31 0x80112158 [ 196.893431] sysfs: cannot create duplicate filename '/devices/platform/i2c-gpio.0' ... [ 197.513200] kobject_add_internal failed for i2c-gpio.0 with -EEXIST, don't try to register things with the same name in the same directory. This patch fixes it by replacing platform_device_put() to platform_device_unregister(). Fixes: da7740853715 ("i2c-gpio-custom: minor bugfix") Fixes: 3bc81edc70e8 ("package: fix w1-gpio-custom package (closes #6770)") Signed-off-by: Sungbo Eo <mans0n@gorani.run> (cherry picked from commit a22b7a60d98836343c4f7b9ec0fcae68d9131522)
* uhttpd: update to latest Git HEADJo-Philipp Wich2019-12-221-4/+4
| | | | | | | | | 5f9ae57 client: fix invalid data access through invalid content-length values 6b03f96 ubus: increase maximum ubus request size to 64KB 91fcac3 uhttpd: Fix multiple format string problems Signed-off-by: Jo-Philipp Wich <jo@mein.io> (backported from commit f34f9a414dd32311bda950776eb77e63c0c772cb)
* netifd: add support for suppressing the DHCP request hostname by setting it to *Felix Fietkau2019-12-221-0/+2
| | | | | | | | | | dnsmasq (and probably other DHCP servers as well) does not like to hand out leases with duplicate host names. Adding support for skipping the hostname makes it easier to deploy setups where it is not guaranteed to be unique Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit fd8ca8deb3197a2867d85fc3513f5aa70912ee40)
* mac80211: Adapt to changes to skb_get_hash_perturb()Hauke Mehrtens2019-12-071-0/+68
| | | | | | | | | | | The skb_get_hash_perturb() function now takes a siphash_key_t instead of an u32. This was changed in commit 55667441c84f ("net/flow_dissector: switch to siphash"). Use the correct type in the fq header file depending on the kernel version. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de> (cherry picked from commit eaa047179ad30d156d0c3da7ec225acfae7a9f00)
* base-files: config_generate: split macaddr with multiple ifacesSungbo Eo2019-11-262-7/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | netifd does not handle network.@device[x].name properly if it contains multiple ifaces separated by spaces. Due to this, board.d lan_mac setup does not work if multiple ifaces are set to LAN by ucidef_set_interface_lan. To fix this, create a device node for each member iface when running config_generate instead. Those are named based on the member ifname: ucidef_set_interface_lan "eth0 eth1.1" ucidef_set_interface_macaddr "lan" "yy:yy:yy:yy:yy:01" will return config device 'lan_eth0_dev' option name 'eth0' option macaddr 'yy:yy:yy:yy:yy:01' config device 'lan_eth1_1_dev' option name 'eth1.1' option macaddr 'yy:yy:yy:yy:yy:01' ref: https://github.com/openwrt/openwrt/pull/2542 Signed-off-by: Sungbo Eo <mans0n@gorani.run> [always use new scheme, extend description, change commit title] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> (cherry picked from commit 298814e6be7640d89328de9e7c90d4349e30683f)
* mac80211: brcmfmac: fix PCIe reset crash and WARNINGRafał Miłecki2019-11-183-1/+85
| | | | | Signed-off-by: Rafał Miłecki <rafal@milecki.pl> (cherry picked from commit cde8c2f2fba019c4cd3b9f6ad463ff86cc783061)
* ar71xx: update uboot-envtools for Netgear WNR routersMichal Cieslakiewicz2019-11-121-1/+10
| | | | | | | | Boards added: WNR1000v2, WNR2000v3, WNR2200, WNR612v2, WNDR4300. Boards changed: WNDR3700 (u-boot env size is 2 sectors not 1). Signed-off-by: Michal Cieslakiewicz <michal.cieslakiewicz@wp.pl> (cherry picked from commit 11052900494ec8216b9b39ba0b24d5e036f4d323)
* OpenWrt v18.06.5: revert to branch defaultsJo-Philipp Wich2019-11-081-2/+2
| | | | Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* OpenWrt v18.06.5: adjust config defaultsv18.06.5Jo-Philipp Wich2019-11-081-2/+2
| | | | Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* ustream-ssl: backport fix for CVE-2019-5101, CVE-2019-5102Jo-Philipp Wich2019-11-052-1/+57
| | | | | Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit c5d5cdb759adc890ce6699117b7119acf280ce77)
* kernel: mark kmod-usb-serial-wwan as hiddenYousong Zhou2019-10-301-2/+2
| | | | | | | | | | The kconfig symbol is an invisible one since its introduction. It is not supposed to be enabled on its own. Resolves FS#1821 Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com> (cherry picked from commit 4bf9bec361699e1c033460964158531adf15d7ee)
* iptables: bump PKG_RELEASEYousong Zhou2019-10-241-1/+1
| | | | | | | | | Package content changed with the previous two cherry-picks dff0b2104d kernel: netfilter: Add nf_tproxy_ipv{4,6} and nf_socket_ipv{4,6} a2fe698a40 kernel: Added required dependencies for socket match. Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* kernel: Added required dependencies for socket match.Oldřich Jedlička2019-10-241-0/+2
| | | | | | | | | | | | | | | | | This applies to kernel 4.10 and newer. See https://github.com/torvalds/linux/commit/8db4c5be88f62ffd7a552f70687a10c614dc697b The above commit added to kernel 4.10 added new dependency for building the NETFILTER_XT_MATCH_SOCKET (xt_socket.ko) module. The NF_SOCKET_IPVx options (both of them) need to be enabled in order to build the NETFILTER_XT_MATCH_SOCKET module. Without the change the module is not built. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com> (cherry picked from commit 66e875a07033cdcfd8c4a16940d4acfe63c60202) (required for fixing FS#2531) Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* tcpdump: update to 4.9.3DENG Qingfang2019-10-194-19/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixed CVEs: CVE-2017-16808 CVE-2018-10103 CVE-2018-10105 CVE-2018-14461 CVE-2018-14462 CVE-2018-14463 CVE-2018-14464 CVE-2018-14465 CVE-2018-14466 CVE-2018-14467 CVE-2018-14468 CVE-2018-14469 CVE-2018-14470 CVE-2018-14879 CVE-2018-14880 CVE-2018-14881 CVE-2018-14882 CVE-2018-16227 CVE-2018-16228 CVE-2018-16229 CVE-2018-16230 CVE-2018-16300 CVE-2018-16301 CVE-2018-16451 CVE-2018-16452 CVE-2019-15166 CVE-2019-15167 Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn> (cherry picked from commit 394273c066b8f4317b77f3ede216cfcdd45250c1)
* libpcap: update to 1.9.1DENG Qingfang2019-10-195-15/+18
| | | | | | | | | | | | | Fixed CVEs: CVE-2018-16301 CVE-2019-15161 CVE-2019-15162 CVE-2019-15163 CVE-2019-15164 CVE-2019-15165 Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn> (cherry picked from commit 44f11353de044834a442d3192b66579b99305720)
* libpcap: update to 1.9.0Syrone Wong2019-10-199-306/+50
| | | | | | | | | | | | | 001-Fix-compiler_state_t.ai-usage-when-INET6-is-not-defi.patch dropped due to upstream 002-Add-missing-compiler_state_t-parameter.patch dropped due to upstream 202-protocol_api.patch dropped due to implemented upstream by another way upstream commit: https://github.com/the-tcpdump-group/libpcap/commit/55c690f6f834b4762697d7a134de439c9096c921 and renamed via: https://github.com/the-tcpdump-group/libpcap/commit/697b1f7e9b1d6f5a5be04f821d7c5dc62458bb3b ead is the only user who use the protocol api, we have to use the new api since libpcap 1.9.0 Signed-off-by: Syrone Wong <wong.syrone@gmail.com>
* hostapd: Fix AP mode PMF disconnection protection bypassHauke Mehrtens2019-09-214-6/+72
| | | | | | | | | This fixes * CVE-2019-16275 AP mode PMF disconnection protection bypass https://w1.fi/security/2019-7/ap-mode-pmf-disconnection-protection-bypass.txt Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit a6981604b30bc1ddc1713b368fe853d89c2ba40d)
* hostapd: SAE/EAP-pwd side-channel attack updateHauke Mehrtens2019-09-219-1/+397
| | | | | | | | | Fixes this security problem: * SAE/EAP-pwd side-channel attack update https://w1.fi/security/2019-6/sae-eap-pwd-side-channel-attack-update.txt Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit 7bed9bf10fc8d05df34c7efc66e8b4ade37a1a0c)
* mbedtls: update to 2.16.3Magnus Kroken2019-09-214-62/+35
| | | | | | | | Remove 300-bn_mul.h-Use-optimized-MULADDC-code-only-on-ARM-6.patch, the issue has been fixed upstream. Signed-off-by: Magnus Kroken <mkroken@gmail.com> (cherry picked from commit 49d96ffc5c47e40b7f3d99a91a42ea8a54a38bd9)
* mbedtls: Update to version 2.16.2Josef Schlehofer2019-09-212-4/+4
| | | | | Signed-off-by: Josef Schlehofer <josef.schlehofer@nic.cz> (cherry picked from commit a2f54f6d5d98211e9c58420eed8c67f4fca83665)
* openssl: bump to 1.0.2t, add maintainerEneas U de Queiroz2019-09-202-3/+4
| | | | | | | | | | | | | This version fixes 3 low-severity vulnerabilities: - CVE-2019-1547: ECDSA remote timing attack - CVE-2019-1549: Fork Protection - CVE-2019-1563: Padding Oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey Patches were refreshed, and Eneas U de Queiroz added as maintainer. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
* mac80211: brcmfmac: backport the last 5.4 changesRafał Miłecki2019-09-164-1/+402
| | | | | | | | This makes brcmfmac use the same wiphy after PCIe reset to help user space handle corner cases (e.g. firmware crash). Signed-off-by: Rafał Miłecki <rafal@milecki.pl> (cherry picked from commit f39f4b2f6d4300995270f635261b07197e8cf61e)
* mac80211: brcmfmac: backport more kernel 5.4 changesRafał Miłecki2019-09-098-9/+283
| | | | | | | | Patch getting RAM info got upstreamed. A debugging fs entry for testing reset feature was added. Signed-off-by: Rafał Miłecki <rafal@milecki.pl> (cherry picked from commit 681acdcc54d2e59135bb706c38bed942f74ccf74)
* bzip2: Fix CVE-2019-12900Josef Schlehofer2019-09-032-1/+66
| | | | | | | More details about this CVE: https://nvd.nist.gov/vuln/detail/CVE-2019-12900 Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* ath9k: backport dynack improvementsKoen Vandeputte2019-08-284-0/+300
| | | | | | | | | | | | | | | | | | | | | | | | | | | Close cooperation with Lorenzo Bianconi resulted in these patches which fix all remaining seen issues when using dynack. Fix link losses when: - Late Ack's are not seen or not present - switching from too low static coverage class to dynack on a live link These are fixed by setting the Ack Timeout/Slottime to the max possible value for the currently used channel width when a new station has been discovered. When traffic flows, dynack is able to adjust to optimal values within a few packets received (typically < 1 second) These changes have been thoroughly tested on ~60 offshore devices all interconnected using mesh over IBSS and dynack enabled on all. Distances between devices varied from <100m up to ~35km [move patches to correct folder + renumber] Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> (cherry picked from commit f6e8ba0238fe349b7529357793e2fb18635819ed)
* iptables: patch CVE-2019-11360 (security fix)Jan Pavlinec2019-08-172-1/+14
| | | | Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
* musl: ldso/dlsym: fix mips returning undef dlsymLuiz Angelo Daros de Luca2019-08-171-1/+1
| | | | | | | | | | | | | | | This happens only the second time a library is loaded by dlopen(). After lib1 is loaded, dlsym(lib1,"undef1") correctly resolves the undef symbol from lib1 dependencies. After the second library is loaded, dlsym(lib2,"undef1") was returning the address of "undef1" in lib2 instead of searching lib2 dependencies. Backporting upstream fix which now uses the same logic for relocation time and dlsym. Fixes openwrt/packages#9297 Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
* wolfssl: fixes for CVE-2018-16870 & CVE-2019-13628Eneas U de Queiroz2019-08-174-4/+665
| | | | | | | | | | | | | CVE-2018-16870: medium-severity, new variant of the Bleichenbacher attack to perform downgrade attacks against TLS, which may lead to leakage of sensible data. Backported from 3.15.7. CVE-2019-13628 (currently assigned-only): potential leak of nonce sizes when performing ECDSA signing operations. The leak is considered to be difficult to exploit but it could potentially be used maliciously to perform a lattice based timing attack. Backported from 4.1.0. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
* xfsprogs: Replace valloc with posix_memalignRosen Penev2019-08-142-1/+32
| | | | | | | Fixes compilation under uClibc-ng. Signed-off-by: Rosen Penev <rosenp@gmail.com> (cherry picked from commit e49b6bb61828b8b903db0ef48113b4065a215c63)
* libbsd: Fix compilation under ARCRosen Penev2019-08-142-1/+31
| | | | | | | | | The 8 year old file does not have any ARC definitions. Signed-off-by: Rosen Penev <rosenp@gmail.com> [updated content of the patch with version sent to upstream] Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit 395bef4bbacc0dd1cca72907529539194504be27)
* nftables: Fix compilation with uClibc-ngRosen Penev2019-08-142-1/+29
| | | | | | | | | Missing header for va_list. Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Petr Štetiar <ynezz@true.cz> [updated with upstream version of the patch] (cherry picked from commit 2f977974714468e1a0ee20e4cce233da63d06dd0)
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-01 18:20:36 +0000