aboutsummaryrefslogtreecommitdiffstats
path: root/package
Commit message (Collapse)AuthorAgeFilesLines
* procd: add patch to fix compilation errorChristian Marangi2022-12-041-0/+36
| | | | | | | | | | | procd complain for an unused verbose variable causing compilation error. Fix this by setting the variable static following upstream procd changes. This is a variant of 0ee73b2c86a853ae3274c7080e2dcd36b81aa1fa that introduced major change and fixed the verbose variable to static. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* mac80211: Update to version 5.10.157Hauke Mehrtens2022-12-0324-61/+61
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* kernel: improve description of NTFS kernel packagesRafał Miłecki2022-12-011-2/+3
| | | | | | | This helps choosing the right NTFS driver from two available options. Signed-off-by: Rafał Miłecki <rafal@milecki.pl> (cherry picked from commit b066ad7d9aa5221bfd334a3017abe9bcd171b33f)
* base-files: support "metric" in board.jsonRafał Miłecki2022-12-011-1/+2
| | | | | | | | It allows prepopulating /etc/config/network interface-s with predefined metric. It may be useful for devices with multiple WAN ports. Signed-off-by: Rafał Miłecki <rafal@milecki.pl> (cherry picked from commit 7f443d2d9aa1170d6b68f0dc6d5b5552882ee327)
* wolfssl: update to v5.5.3Nick Hainke2022-11-274-56/+4
| | | | | | | | | | | | | | | Remove "200-ecc-rng.patch" because it was upstramed by: https://github.com/wolfSSL/wolfssl/commit/e2566bab2122949a6a0bb2276d0a52598794d7d0 Refreshed "100-disable-hardening-check.patch". Fixes CVE 2022-42905. Release Notes: - https://github.com/wolfSSL/wolfssl/releases/tag/v5.5.2-stable - https://github.com/wolfSSL/wolfssl/releases/tag/v5.5.3-stable Signed-off-by: Nick Hainke <vincent@systemli.org> (cherry picked from commit 745f1ca9767716c43864a2b7a43ed60b16c25560)
* openssl: bump to 1.1.1sJohn Audia2022-11-2712-180/+2527
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes between 1.1.1r and 1.1.1s [1 Nov 2022] *) Fixed a regression introduced in 1.1.1r version not refreshing the certificate data to be signed before signing the certificate. [Gibeom Gwon] Changes between 1.1.1q and 1.1.1r [11 Oct 2022] *) Fixed the linux-mips64 Configure target which was missing the SIXTY_FOUR_BIT bn_ops flag. This was causing heap corruption on that platform. [Adam Joseph] *) Fixed a strict aliasing problem in bn_nist. Clang-14 optimisation was causing incorrect results in some cases as a result. [Paul Dale] *) Fixed SSL_pending() and SSL_has_pending() with DTLS which were failing to report correct results in some cases [Matt Caswell] *) Fixed a regression introduced in 1.1.1o for re-signing certificates with different key sizes [Todd Short] *) Added the loongarch64 target [Shi Pujin] *) Fixed a DRBG seed propagation thread safety issue [Bernd Edlinger] *) Fixed a memory leak in tls13_generate_secret [Bernd Edlinger] *) Fixed reported performance degradation on aarch64. Restored the implementation prior to commit 2621751 ("aes/asm/aesv8-armx.pl: avoid 32-bit lane assignment in CTR mode") for 64bit targets only, since it is reportedly 2-17% slower and the silicon errata only affects 32bit targets. The new algorithm is still used for 32 bit targets. [Bernd Edlinger] *) Added a missing header for memcmp that caused compilation failure on some platforms [Gregor Jasny] Build system: x86_64 Build-tested: bcm2711/RPi4B Run-tested: bcm2711/RPi4B Signed-off-by: John Audia <therealgraysky@proton.me> (cherry picked from commit a0814f04ed955eb10b25df0ce6666ed91f11ca1b)
* iwinfo: update to latest HEADHauke Mehrtens2022-11-121-3/+3
| | | | | | | 0dad3e6 Add support for CCMP-256 and GCMP-256 ciphers Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit cc6a323e2328176b732b13f1f09745354270cd39)
* iwinfo: update to latest HEADHauke Mehrtens2022-11-121-3/+3
| | | | | | | 705d3b5 iwinfo: Add missing auth_suites mappings for WPA3 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit cc2dfc5e4dc2e480203b826749186c73021795df)
* uboot-layerscape: adjust LS1012A-IOT config and envPawel Dembicki2022-11-122-1/+46
| | | | | | | | | | | | | | | | In a254279a6c30 LS1012A-IOT kernel image was switched to FIT. But u-boot config is lack of FIT and ext4 support. This patch enables it. It also fix envs, because for some reason this board need to use "loadaddr" variable in brackets. Fixes: #9894 Fixes: a254279a6c30 ("layerscape: Change to combined rootfs on sd images") Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com> (cherry picked from commit d75ed3726d994fd050730e9ab5923d6232913054)
* mac80211: Update to version 5.10.149-1Hauke Mehrtens2022-10-2322-179/+80
| | | | | | | | This updates mac80211 to version 5.10.149-1 which is based on kernel 5.10.149. The removed patches were applied upstream. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* OpenWrt v21.02.5: revert to branch defaultsHauke Mehrtens2022-10-151-2/+2
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* OpenWrt v21.02.5: adjust config defaultsv21.02.5Hauke Mehrtens2022-10-151-2/+2
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* mac80211: backport security fix and disable MBSSID supportFelix Fietkau2022-10-132-0/+96
| | | | | | | | | Fixes: CVE-2022-41674 Fixes: CVE-2022-42719 Fixes: CVE-2022-42720 Fixes: CVE-2022-42721 Fixes: CVE-2022-42722 Signed-off-by: Felix Fietkau <nbd@nbd.name>
* OpenWrt v21.02.4: revert to branch defaultsHauke Mehrtens2022-10-091-2/+2
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* OpenWrt v21.02.4: adjust config defaultsv21.02.4Hauke Mehrtens2022-10-091-2/+2
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* firmware: intel-microcode: update to 20220809Christian Lamparter2022-10-091-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Debian's changelog by Henrique de Moraes Holschuh <hmh@debian.org>: * New upstream microcode datafile 20220809 * Fixes INTEL-SA-00657, CVE-2022-21233 Stale data from APIC leaks SGX memory (AEPIC leak) * Fixes unspecified errata (functional issues) on Xeon Scalable * Updated Microcodes: sig 0x00050653, pf_mask 0x97, 2022-03-14, rev 0x100015e, size 34816 sig 0x00050654, pf_mask 0xb7, 2022-03-08, rev 0x2006e05, size 44032 sig 0x000606a6, pf_mask 0x87, 2022-04-07, rev 0xd000375, size 293888 sig 0x000706a1, pf_mask 0x01, 2022-03-23, rev 0x003c, size 75776 sig 0x000706a8, pf_mask 0x01, 2022-03-23, rev 0x0020, size 75776 sig 0x000706e5, pf_mask 0x80, 2022-03-17, rev 0x00b2, size 112640 sig 0x000806c2, pf_mask 0xc2, 2022-03-19, rev 0x0028, size 97280 sig 0x000806d1, pf_mask 0xc2, 2022-03-28, rev 0x0040, size 102400 sig 0x00090672, pf_mask 0x03, 2022-06-07, rev 0x0022, size 216064 sig 0x00090675, pf_mask 0x03, 2022-06-07, rev 0x0022, size 216064 sig 0x000906a3, pf_mask 0x80, 2022-06-15, rev 0x0421, size 216064 sig 0x000906a4, pf_mask 0x80, 2022-06-15, rev 0x0421, size 216064 sig 0x000a0671, pf_mask 0x02, 2022-03-17, rev 0x0054, size 103424 sig 0x000b06f2, pf_mask 0x03, 2022-06-07, rev 0x0022, size 216064 sig 0x000b06f5, pf_mask 0x03, 2022-06-07, rev 0x0022, size 216064 Signed-off-by: Christian Lamparter <chunkeey@gmail.com> (cherry picked from commit bb73828b89def128f26ae1cdff0d08569d261f1b)
* wireless-regdb: update to 2022-08-12Nick Hainke2022-10-091-2/+2
| | | | | | | | | | Changes: 9dc9c89 wireless-regdb: update regulatory database based on preceding changes 442bc25 wireless-regdb: update 5 GHz rules for PK and add 60 GHz rule daee7f3 wireless-regdb: add 5 GHz rules for GY Signed-off-by: Nick Hainke <vincent@systemli.org> (cherry picked from commit 1d2d69c810261308652a577fc136e7327e0e1358)
* wireless-regdb: bump to 2022.06.06Stijn Tintel2022-10-092-3/+3
| | | | | | | | | | | | | | | | | | 902b321 wireless-regdb: Update regulatory rules for Israel (IL) 20f6f34 wireless-regdb: add missing spaces for US S1G rules 25652b6 wireless-regdb: Update regulatory rules for Australia (AU) 081873f wireless-regdb: update regulatory database based on preceding changes 166fbdd wireless-regdb: add db files missing from previous commit e3f03f9 Regulatory update for 6 GHz operation in Canada (CA) 888da5f Regulatory update for 6 GHz operation in United States (US) 647bcaa Regulatory update for 6 GHz operation in FI c6b079d wireless-regdb: update regulatory rules for Bulgaria (BG) on 6GHz 2ed39be wireless-regdb: Remove AUTO-BW from 6 GHz rules 7a6ad1a wireless-regdb: Unify 6 GHz rules for EU contries 68a8f2f wireless-regdb: update regulatory database based on preceding changes Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> (cherry picked from commit e3e9eb31a281643737142e8e80c6f49204b5ba18)
* wireless-regdb: update to version 2022.02.18Sungbo Eo2022-10-091-2/+2
| | | | | | | | | | | | | | | | | | e061299 wireless-regdb: Raise DFS TX power limit to 250 mW (24 dBm) for the US 2ce78ed wireless-regdb: Update regulatory rules for Croatia (HR) on 6GHz 0d39f4c wireless-regdb: Update regulatory rules for South Korea (KR) acad231 wireless-regdb: Update regulatory rules for France (FR) on 6 and 60 GHz ea83a82 wireless-regdb: add support for US S1G channels 4408149 wireless-regdb: add 802.11ah bands to world regulatory domain 5f3cadc wireless-regdb: Update regulatory rules for Spain (ES) on 6GHz e0ac69b Revert "wireless-regdb: Update regulatory rules for South Korea (KR)" 40e5e80 wireless-regdb: Update regulatory rules for South Korea (KR) e427ff2 wireless-regdb: Update regulatory rules for China (CN) 0970116 wireless-regdb: Update regulatory rules for the Netherlands (NL) on 6GHz 4dac44b wireless-regdb: update regulatory database based on preceding changes Signed-off-by: Sungbo Eo <mans0n@gorani.run> (cherry picked from commit 19a90262df89f8419b058cf9a00dc9e8d465088b)
* treewide: fix security issues by bumping all packages using libwolfsslPetr Štetiar2022-10-053-3/+3
| | | | | | | | | | | | | | | | | | | As wolfSSL is having hard time maintaining ABI compatibility between releases, we need to manually force rebuild of packages depending on libwolfssl and thus force their upgrade. Otherwise due to the ABI handling we would endup with possibly two libwolfssl libraries in the system, including the patched libwolfssl-5.5.1, but still have vulnerable services running using the vulnerable libwolfssl-5.4.0. So in order to propagate update of libwolfssl to latest stable release done in commit ec8fb542ec3e4 ("wolfssl: fix TLSv1.3 RCE in uhttpd by using 5.5.1-stable (CVE-2022-39173)") which fixes several remotely exploitable vulnerabilities, we need to bump PKG_RELEASE of all packages using wolfSSL library. Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit f1b7e1434f66a3cb09cb9e70b40add354a22e458) (cherry picked from commit 562894b39da381264a34ce31e9334c8a036fa139)
* wolfssl: fix TLSv1.3 RCE in uhttpd by using 5.5.1-stable (CVE-2022-39173)Petr Štetiar2022-10-051-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | Fixes denial of service attack and buffer overflow against TLS 1.3 servers using session ticket resumption. When built with --enable-session-ticket and making use of TLS 1.3 server code in wolfSSL, there is the possibility of a malicious client to craft a malformed second ClientHello packet that causes the server to crash. This issue is limited to when using both --enable-session-ticket and TLS 1.3 on the server side. Users with TLS 1.3 servers, and having --enable-session-ticket, should update to the latest version of wolfSSL. Thanks to Max at Trail of Bits for the report and "LORIA, INRIA, France" for research on tlspuffin. Complete release notes https://github.com/wolfSSL/wolfssl/releases/tag/v5.5.1-stable Fixes: CVE-2022-39173 Fixes: https://github.com/openwrt/luci/issues/5962 References: https://github.com/wolfSSL/wolfssl/issues/5629 Tested-by: Kien Truong <duckientruong@gmail.com> Reported-by: Kien Truong <duckientruong@gmail.com> Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit ec8fb542ec3e4f584444a97de5ac05dbc2a9cde5) (cherry picked from commit ce59843662961049a28033077587cabdc5243b15)
* wolfssl: bump to 5.5.0Ivan Pavlov2022-10-053-5/+5
| | | | | | | | | | | | Remove upstreamed: 101-update-sp_rand_prime-s-preprocessor-gating-to-match.patch Some low severity vulnerabilities fixed OpenVPN compatibility fixed (broken in 5.4.0) Other fixes && improvements Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com> (cherry picked from commit 3d88f26d74f7771b808082cef541ed8286c40491) (cherry picked from commit 0c8425bf11590afb0c6f1545b328ecb6ed4aee87)
* wolfssl: bump to 5.4.0Eneas U de Queiroz2022-10-053-4/+4
| | | | | | | | | | | | | This version fixes two vulnerabilities: -CVE-2022-34293[high]: Potential for DTLS DoS attack -[medium]: Ciphertext side channel attack on ECC and DH operations. The patch fixing x86 aesni build has been merged upstream. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com> (cherry picked from commit 9710fe70a68e0a004b1906db192d7a6c8f810ac5) Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> (cherry picked from commit ade7c6db1e6c2c0c8d2338948c37cfa7429ebccc)
* wolfssl: bump to v5.3.0-stableEneas U de Queiroz2022-10-053-45/+2
| | | | | | | | | | | This is mostly a bug fix release, including two that were already patched here: - 300-fix-SSL_get_verify_result-regression.patch - 400-wolfcrypt-src-port-devcrypto-devcrypto_aes.c-remove-.patch Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com> (cherry picked from commit 73c1fe2890baa5c0bfa46f53c5387f5e47de1acb) (cherry picked from commit 6f8db8fee3b7bd5cb8b1b2be59ee710a8f96860b)
* base-files: add support for heartbeat led triggerAlexey Smirnov2022-09-241-0/+9
| | | | | | | | | | | | This patch adds support for creation heartbeat led trigger with, for example, this command: ucidef_set_led_heartbeat "..." "..." "..." from /etc/board.d/01_leds. Signed-off-by: Alexey Smirnov <s.alexey@gmail.com> (cherry picked from commit 66071729a27919e555752fce25210b1b035eb319)
* uboot-bcm4908: include SoC in output filesRafał Miłecki2022-09-011-2/+4
| | | | | | | | | This fixes problem of overwriting BCM4908 U-Boot and DTB files by BCM4912 ones. That bug didn't allow booting BCM4908 devices. Fixes: f4c2dab544ec2 ("uboot-bcm4908: add BCM4912 build") Signed-off-by: Rafał Miłecki <rafal@milecki.pl> (cherry picked from commit a8e1e30543239e85ff5dc220368164b66cf73fba)
* uboot-bcm4908: add BCM4912 buildRafał Miłecki2022-09-013-3/+33
| | | | | Signed-off-by: Rafał Miłecki <rafal@milecki.pl> (cherry picked from commit f4c2dab544ec22fac6ab2de32aa5bb361c7566f7)
* uboot-bcm4908: update to the latest genericRafał Miłecki2022-09-011-3/+3
| | | | | | | | 0625aad74d arm: dts: add ASUS GT-AX6000 6fb1cb624d arm: dts: add Netgear RAXE450 / RAXE550 Signed-off-by: Rafał Miłecki <rafal@milecki.pl> (cherry picked from commit 3592aa85664040a118654555afb78659af756a4e)
* mac80211: disable ft-over-ds by defaultFelix Fietkau2022-08-301-1/+1
| | | | | | | | | Testing has shown it to be very unreliable in variety of configurations. It is not mandatory, so let's disable it by default until we have a better solution. Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry-picked from commit 2984a0420649733662ff95b0aff720b8c2c19f8a)
* mt76: backport fix encap offload ethernet type checkThibaut VARÈNE2022-08-281-0/+63
| | | | | | | | | | The driver needs to check if the format is 802.2 vs 802.3 in order to set a tx descriptor flag. skb->protocol can't be used, since it may not be properly initialized for packets coming in from a packet socket. Fix misdetection by checking the ethertype from the skb data instead. Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org> Signed-off-by: Petr Štetiar <ynezz@true.cz> [commit description]
* hostapd: ubus: fix uninitialized pointerDavid Bauer2022-08-281-1/+1
| | | | | | | | | This fixes passing a bogus non-null pointer to the ubus handler in case the transition request is rejected. Signed-off-by: David Bauer <mail@david-bauer.net> (cherry picked from commit 9b880f09f394049e0629e3c9d4061f431a6b19a8) Signed-off-by: Nick Hainke <vincent@systemli.org>
* ramips: add support for YunCore AX820/HWAP-AX820Clemens Hopfer2022-08-281-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are two versions which are identical apart from the enclosure: YunCore AX820: indoor ceiling mount AP with integrated antennas YunCore HWAP-AX820: outdoor enclosure with external (N) connectors Hardware specs: SoC: MediaTek MT7621DAT Flash: 16 MiB SPI NOR RAM: 128MiB (DDR3, integrated) WiFi: MT7905DAN+MT7975DN 2.4/5GHz 2T2R 802.11ax Ethernet: 10/100/1000 Mbps x2 (WAN/PoE+LAN) LED: Status (green) Button: Reset Power: 802.11af/at PoE; DC 12V,1A Antennas: AX820(indoor): 4dBi internal; HWAP-AX820(outdoor): external Flash instructions: The "OpenWRT support" version of the AX820 comes with a LEDE-based firmware with proprietary MTK drivers and a luci webinterface and ssh accessible under 192.168.1.1 on LAN; user root, no password. The sysupgrade.bin can be flashed using luci or sysupgrade via ssh, you will have to force the upgrade due to a different factory name. Remember: Do *not* preserve factory configuration! MAC addresses as used by OEM firmware: use address source 2g 44:D1:FA:*:0b Factory 0x0004 (label) 5g 46:D1:FA:*:0b LAA of 2g lan 44:D1:FA:*:0c Factory 0xe000 wan 44:D1:FA:*:0d Factory 0xe000 + 1 The wan MAC can also be found in 0xe006 but is not used by OEM dtb. Due to different MAC handling in mt76 the LAA derived from lan is used for 2g to prevent duplicate MACs when creating multiple interfaces. Signed-off-by: Clemens Hopfer <openwrt@wireloss.net> (cherry picked from commit 4891b865380e2b7f32acf0893df9c1ca9db8d4ea) [switch to mtd-mac-address instead of nvmem-cells]
* sunxi: add support for Banana Pi M2 BerryZoltan HERPAI2022-08-281-0/+7
| | | | | | | | | | | | | | | | | | | CPU: Allwinner V40 quad-core Cortex A7 @ 1.2GHz Memory: 1GB DDR3 Storage: SDcard, native SATA Network: 10/100/1000M ethernet, Ampak AP6212 wifi + BT USB: 4x USB 2.0 Installation: Use the standard sunxi installation to an SD-card. While the board is very similar to the M2 Ultra board (the V40 is the automotive version of the R40), as both the u-boot and kernel supports them separately, and some pins are different, let's add a separate device spec. Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu> (cherry picked from commit 9aa66b8ce730aebff76d353392151708a897a3a0)
* ramips: add support for Sitecom WLR-4100 v1 002Andrea Poletti2022-08-281-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Sitecom WLR-4100 v1 002 (marked as X4 N300) is a wireless router Specification: SoC: MT7620A RAM: 64 MB DDR2 Flash: MX25L6405D SPI NOR 8 MB WIFI: 2.4 GHz integrated Ethernet: 5x 10/100/1000 Mbps QCA8337 USB: 1x 2.0 LEDS: 2x GPIO controlled, 5x switch Buttons: 1x GPIO controlled UART: row of 4 unpopulated holes near USB port, starting count from white triangle on PCB: VCC 3.3V GND TX RX baud: 115200, parity: none, flow control: none Installation Connect to one of LAN (yellow) ethernet ports, Open router configuration interface, Go to Toolbox > Firmware, Browse for OpenWrt factory image with dlf extension and hit Apply, Wait few minutes, after the Power LED will stop blinking, the router is ready for configuration. Known issues Some USB 2.0 devices work at full speed mode 1.1 only MAC addresses factory partition only contains one (binary) MAC address in 0x4. u-boot-env contains four (ascii) MAC addresses, of which two appear to be valid. factory 0x4 **:**:**:**:b9:84 binary u-boot-env ethaddr **:**:**:**:b9:84 ascii u-boot-env wanaddr **:**:**:**:b9:85 ascii u-boot-env wlanaddr 00:AA:BB:CC:DD:12 ascii u-boot-env iNICaddr 00:AA:BB:CC:DD:22 ascii The factory firmware only assigns ethaddr. Thus, we take the binary value which we can use directly in DTS. Additional information OEM firmware shell password is: SitecomSenao useful for creating backup of original firmware. There is also another revision of this device (v1 001), based on RT3352 SoC The nvmem feature (commit 06bb4a5) was introduced in master after the splitting of the 21.02 branch. It need to be reverted in 21.02.. Signed-off-by: Andrea Poletti <polex73@yahoo.it> [remove config DT label, convert to nvmem, remove MAC address setup from u-boot-env, add MAC address info to commit message] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> (cherry picked from commit de0c380a5f8289839ab970e794a45f0e04a466a3) Signed-off-by: Petr Štetiar <ynezz@true.cz>
* uclibc++: fix compilation with long file pathsAlois Klink2022-08-281-0/+86
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, uClic++ 0.2.5 fails to compile when using a long filepath. For example, if the openwrt directory is in the path: /tmp/this_directory_name_is_very_long/more_long_paths/.../openwrt, then uclibc++ will cause a very obtuse error. Although the uclibc++ makefiles do print a "File name too long" error, it's not the final error that's printed, so it's a bit confusing: > /bin/sh: 1: > cannot create src/abi/libsupc/<SNIP>_libsupc++.a.dep: File name too long > <SNIP: some other makefile output here> > array_type_info.o: No such file or directory Although OpenWRT 22.03 and current master branch have removed uClib++, I thought I'd make a PR for OpenWRT 21.02, since I encountered it and there seems to be quite a few other people experiencing the same issue. It especially happens when using the SDK, (or when using an encrypted fs) since the pre-packaged SDKs have very long filenames. This patch is already in upstream [1], but has not yet been released. [1]: https://git.busybox.net/uClibc++/commit/?id=6687fc9276fa52defaf8592f2001c19b826aec93 Signed-off-by: Alois Klink <alois@aloisklink.com>
* zlib: backport null dereference fixPetr Štetiar2022-08-092-1/+30
| | | | | | | | | | | | | | The curl developers found test case that crashed in their testing when using zlib patched against CVE-2022-37434, same patch we've backported in commit 7df6795d4c25 ("zlib: backport fix for heap-based buffer over-read (CVE-2022-37434)"). So we need to backport following patch in order to fix issue introduced in that previous CVE-2022-37434 fix. References: https://github.com/curl/curl/issues/9271 Fixes: 7df6795d4c25 ("zlib: backport fix for heap-based buffer over-read (CVE-2022-37434)") Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit f443e9de7003c00a935b9ea12f168e09e83b48cd) (cherry picked from commit 707ec48ab3db6d08bd022df1bc720aee68b3b99d)
* zlib: backport fix for heap-based buffer over-read (CVE-2022-37434)Petr Štetiar2022-08-082-1/+33
| | | | | | | | | | | | | zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader. Fixes: CVE-2022-37434 References: https://github.com/ivd38/zlib_overflow Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit 7df6795d4c25447683fd4b4a4813bebcddaea547)
* firmware: intel-microcode: update to 20220510Christian Lamparter2022-07-231-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Debian's changelog by Henrique de Moraes Holschuh <hmh@debian.org>: * New upstream microcode datafile 20220419 * Fixes errata APLI-11 in Atom E3900 series processors * Updated Microcodes: sig 0x000506ca, pf_mask 0x03, 2021-11-16, rev 0x0028, size 16384 * New upstream microcode datafile 20220510 * Fixes INTEL-SA-000617, CVE-2022-21151: Processor optimization removal or modification of security-critical code may allow an authenticated user to potentially enable information disclosure via local access (closes: #1010947) * Fixes several errata (functional issues) on Xeon Scalable, Atom C3000, Atom E3900 * New Microcodes: sig 0x00090672, pf_mask 0x03, 2022-03-03, rev 0x001f, size 212992 sig 0x00090675, pf_mask 0x03, 2022-03-03, rev 0x001f, size 212992 sig 0x000906a3, pf_mask 0x80, 2022-03-24, rev 0x041c, size 212992 sig 0x000906a4, pf_mask 0x80, 2022-03-24, rev 0x041c, size 212992 sig 0x000b06f2, pf_mask 0x03, 2022-03-03, rev 0x001f, size 212992 sig 0x000b06f5, pf_mask 0x03, 2022-03-03, rev 0x001f, size 212992 * Updated Microcodes: sig 0x00030679, pf_mask 0x0f, 2019-07-10, rev 0x090d, size 52224 sig 0x000406e3, pf_mask 0xc0, 2021-11-12, rev 0x00f0, size 106496 sig 0x00050653, pf_mask 0x97, 2021-11-13, rev 0x100015d, size 34816 sig 0x00050654, pf_mask 0xb7, 2021-11-13, rev 0x2006d05, size 43008 sig 0x00050656, pf_mask 0xbf, 2021-12-10, rev 0x4003302, size 37888 sig 0x00050657, pf_mask 0xbf, 2021-12-10, rev 0x5003302, size 37888 sig 0x0005065b, pf_mask 0xbf, 2021-11-19, rev 0x7002501, size 29696 sig 0x000506c9, pf_mask 0x03, 2021-11-16, rev 0x0048, size 17408 sig 0x000506e3, pf_mask 0x36, 2021-11-12, rev 0x00f0, size 109568 sig 0x000506f1, pf_mask 0x01, 2021-12-02, rev 0x0038, size 11264 sig 0x000606a6, pf_mask 0x87, 2022-03-30, rev 0xd000363, size 294912 sig 0x000706a1, pf_mask 0x01, 2021-11-22, rev 0x003a, size 75776 sig 0x000706a8, pf_mask 0x01, 2021-11-22, rev 0x001e, size 75776 sig 0x000706e5, pf_mask 0x80, 2022-03-09, rev 0x00b0, size 112640 sig 0x000806a1, pf_mask 0x10, 2022-03-26, rev 0x0031, size 34816 sig 0x000806c1, pf_mask 0x80, 2022-02-01, rev 0x00a4, size 109568 sig 0x000806c2, pf_mask 0xc2, 2021-12-07, rev 0x0026, size 97280 sig 0x000806d1, pf_mask 0xc2, 2021-12-07, rev 0x003e, size 102400 sig 0x000806e9, pf_mask 0x10, 2021-11-12, rev 0x00f0, size 105472 sig 0x000806e9, pf_mask 0xc0, 2021-11-12, rev 0x00f0, size 105472 sig 0x000806ea, pf_mask 0xc0, 2021-11-12, rev 0x00f0, size 105472 sig 0x000806eb, pf_mask 0xd0, 2021-11-15, rev 0x00f0, size 105472 sig 0x000806ec, pf_mask 0x94, 2021-11-17, rev 0x00f0, size 105472 sig 0x00090661, pf_mask 0x01, 2022-02-03, rev 0x0016, size 20480 sig 0x000906c0, pf_mask 0x01, 2022-02-19, rev 0x24000023, size 20480 sig 0x000906e9, pf_mask 0x2a, 2021-11-12, rev 0x00f0, size 108544 sig 0x000906ea, pf_mask 0x22, 2021-11-15, rev 0x00f0, size 104448 sig 0x000906eb, pf_mask 0x02, 2021-11-12, rev 0x00f0, size 105472 sig 0x000906ec, pf_mask 0x22, 2021-11-15, rev 0x00f0, size 104448 sig 0x000906ed, pf_mask 0x22, 2021-11-16, rev 0x00f0, size 104448 sig 0x000a0652, pf_mask 0x20, 2021-11-16, rev 0x00f0, size 96256 sig 0x000a0653, pf_mask 0x22, 2021-11-15, rev 0x00f0, size 97280 sig 0x000a0655, pf_mask 0x22, 2021-11-16, rev 0x00f0, size 96256 sig 0x000a0660, pf_mask 0x80, 2021-11-15, rev 0x00f0, size 96256 sig 0x000a0661, pf_mask 0x80, 2021-11-16, rev 0x00f0, size 96256 sig 0x000a0671, pf_mask 0x02, 2022-03-09, rev 0x0053, size 103424 Signed-off-by: Christian Lamparter <chunkeey@gmail.com> (cherry picked from commit 2747a94f0977b36c4c29cc4596879b9127cfaf5f)
* firmware: intel-microcode: update to 20220207Christian Lamparter2022-07-231-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Debian's changelog by Henrique de Moraes Holschuh <hmh@debian.org>: * upstream changelog: new upstream datafile 20220207 * Mitigates (*only* when loaded from UEFI firmware through the FIT) CVE-2021-0146, INTEL-SA-00528: VT-d privilege escalation through debug port, on Pentium, Celeron and Atom processors with signatures 0x506c9, 0x506ca, 0x506f1, 0x706a1, 0x706a8 https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/issues/57#issuecomment-1036363145 * Mitigates CVE-2021-0127, INTEL-SA-00532: an unexpected code breakpoint may cause a system hang, on many processors. * Mitigates CVE-2021-0145, INTEL-SA-00561: information disclosure due to improper sanitization of shared resources (fast-store forward predictor), on many processors. * Mitigates CVE-2021-33120, INTEL-SA-00589: out-of-bounds read on some Atom Processors may allow information disclosure or denial of service via network access. * Fixes critical errata (functional issues) on many processors * Adds a MSR switch to enable RAPL filtering (default off, once enabled it can only be disabled by poweroff or reboot). Useful to protect SGX and other threads from side-channel info leak. Improves the mitigation for CVE-2020-8694, CVE-2020-8695, INTEL-SA-00389 on many processors. * Disables TSX in more processor models. * Fixes issue with WBINDV on multi-socket (server) systems which could cause resets and unpredictable system behavior. * Adds a MSR switch to 10th and 11th-gen (Ice Lake, Tiger Lake, Rocket Lake) processors, to control a fix for (hopefully rare) unpredictable processor behavior when HyperThreading is enabled. This MSR switch is enabled by default on *server* processors. On other processors, it needs to be explicitly enabled by an updated UEFI/BIOS (with added configuration logic). An updated operating system kernel might also be able to enable it. When enabled, this fix can impact performance. * Updated Microcodes: sig 0x000306f2, pf_mask 0x6f, 2021-08-11, rev 0x0049, size 38912 sig 0x000306f4, pf_mask 0x80, 2021-05-24, rev 0x001a, size 23552 sig 0x000406e3, pf_mask 0xc0, 2021-04-28, rev 0x00ec, size 105472 sig 0x00050653, pf_mask 0x97, 2021-05-26, rev 0x100015c, size 34816 sig 0x00050654, pf_mask 0xb7, 2021-06-16, rev 0x2006c0a, size 43008 sig 0x00050656, pf_mask 0xbf, 2021-08-13, rev 0x400320a, size 35840 sig 0x00050657, pf_mask 0xbf, 2021-08-13, rev 0x500320a, size 36864 sig 0x0005065b, pf_mask 0xbf, 2021-06-04, rev 0x7002402, size 28672 sig 0x00050663, pf_mask 0x10, 2021-06-12, rev 0x700001c, size 28672 sig 0x00050664, pf_mask 0x10, 2021-06-12, rev 0xf00001a, size 27648 sig 0x00050665, pf_mask 0x10, 2021-09-18, rev 0xe000014, size 23552 sig 0x000506c9, pf_mask 0x03, 2021-05-10, rev 0x0046, size 17408 sig 0x000506ca, pf_mask 0x03, 2021-05-10, rev 0x0024, size 16384 sig 0x000506e3, pf_mask 0x36, 2021-04-29, rev 0x00ec, size 108544 sig 0x000506f1, pf_mask 0x01, 2021-05-10, rev 0x0036, size 11264 sig 0x000606a6, pf_mask 0x87, 2021-12-03, rev 0xd000331, size 291840 sig 0x000706a1, pf_mask 0x01, 2021-05-10, rev 0x0038, size 74752 sig 0x000706a8, pf_mask 0x01, 2021-05-10, rev 0x001c, size 75776 sig 0x000706e5, pf_mask 0x80, 2021-05-26, rev 0x00a8, size 110592 sig 0x000806a1, pf_mask 0x10, 2021-09-02, rev 0x002d, size 34816 sig 0x000806c1, pf_mask 0x80, 2021-08-06, rev 0x009a, size 109568 sig 0x000806c2, pf_mask 0xc2, 2021-07-16, rev 0x0022, size 96256 sig 0x000806d1, pf_mask 0xc2, 2021-07-16, rev 0x003c, size 101376 sig 0x000806e9, pf_mask 0x10, 2021-04-28, rev 0x00ec, size 104448 sig 0x000806e9, pf_mask 0xc0, 2021-04-28, rev 0x00ec, size 104448 sig 0x000806ea, pf_mask 0xc0, 2021-04-28, rev 0x00ec, size 103424 sig 0x000806eb, pf_mask 0xd0, 2021-04-28, rev 0x00ec, size 104448 sig 0x000806ec, pf_mask 0x94, 2021-04-28, rev 0x00ec, size 104448 sig 0x00090661, pf_mask 0x01, 2021-09-21, rev 0x0015, size 20480 sig 0x000906c0, pf_mask 0x01, 2021-08-09, rev 0x2400001f, size 20480 sig 0x000906e9, pf_mask 0x2a, 2021-04-29, rev 0x00ec, size 106496 sig 0x000906ea, pf_mask 0x22, 2021-04-28, rev 0x00ec, size 102400 sig 0x000906eb, pf_mask 0x02, 2021-04-28, rev 0x00ec, size 104448 sig 0x000906ec, pf_mask 0x22, 2021-04-28, rev 0x00ec, size 103424 sig 0x000906ed, pf_mask 0x22, 2021-04-28, rev 0x00ec, size 103424 sig 0x000a0652, pf_mask 0x20, 2021-04-28, rev 0x00ec, size 93184 sig 0x000a0653, pf_mask 0x22, 2021-04-28, rev 0x00ec, size 94208 sig 0x000a0655, pf_mask 0x22, 2021-04-28, rev 0x00ee, size 94208 sig 0x000a0660, pf_mask 0x80, 2021-04-28, rev 0x00ea, size 94208 sig 0x000a0661, pf_mask 0x80, 2021-04-29, rev 0x00ec, size 93184 sig 0x000a0671, pf_mask 0x02, 2021-08-29, rev 0x0050, size 102400 * Removed Microcodes: sig 0x00080664, pf_mask 0x01, 2021-02-17, rev 0xb00000f, size 130048 sig 0x00080665, pf_mask 0x01, 2021-02-17, rev 0xb00000f, size 130048 * update .gitignore and debian/.gitignore. Add some missing items from .gitignore and debian/.gitignore. * ucode-blacklist: do not late-load 0x406e3 and 0x506e3. When the BIOS microcode is older than revision 0x7f (and perhaps in some other cases as well), the latest microcode updates for 0x406e3 and 0x506e3 must be applied using the early update method. Otherwise, the system might hang. Also: there must not be any other intermediate microcode update attempts [other than the one done by the BIOS itself], either. It must go from the BIOS microcode update directly to the latest microcode update. * source: update symlinks to reflect id of the latest release, 20220207 Signed-off-by: Christian Lamparter <chunkeey@gmail.com> (cherry picked from commit 1753f8c14bc09183492d62bccb8d8e42b5f24e19)
* sdk: add spidev-test to the bundle of userspace sourcesChristian Lamparter2022-07-191-2/+3
| | | | | | | | | | | | | | | moves and extends the current facilities, which have been added some time ago for the the usbip utility, to support more utilites that are shipped with the Linux kernel tree to the SDK. this allows to drop all the hand-waving and code for failed previous attempts to mitigate the SDK build failures. Fixes: bdaaf66e28bd ("utils/spidev_test: build package directly from Linux") Signed-off-by: Christian Lamparter <chunkeey@gmail.com> (cherry picked from commit b479db9062b721776be44b976961a1031c1344ea) (cherry picked from commit eb8d0da88a0dcf7f10f05ad10c48e3a691f5a8d1)
* openssl: bump to 1.1.1qDustin Lundquist2022-07-171-2/+2
| | | | | | | | | | | | | | | | | | Changes between 1.1.1p and 1.1.1q [5 Jul 2022] *) AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation would not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. (CVE-2022-2097) [Alex Chernyakhovsky, David Benjamin, Alejandro Sedeño] Signed-off-by: Dustin Lundquist <dustin@null-ptr.net> (cherry picked from commit 3899f68b54b31de4b4fef4f575f7ea56dc93d965)
* openssl: bump to 1.1.1pAndre Heider2022-07-151-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes between 1.1.1o and 1.1.1p [21 Jun 2022] *) In addition to the c_rehash shell command injection identified in CVE-2022-1292, further bugs where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection have been fixed. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. (CVE-2022-2068) [Daniel Fiala, Tomáš Mráz] *) When OpenSSL TLS client is connecting without any supported elliptic curves and TLS-1.3 protocol is disabled the connection will no longer fail if a ciphersuite that does not use a key exchange based on elliptic curves can be negotiated. [Tomáš Mráz] Signed-off-by: Andre Heider <a.heider@gmail.com> (cherry picked from commit eb7d2abbf06f0a3fe700df5dc6b57ee90016f1f1)
* kernel: Remove kmod-crypto-lib-blake2sHauke Mehrtens2022-07-042-23/+0
| | | | | | | Delete the crypto-lib-blake2s kmod package, as BLAKE2s is now built-in. Fixes: be0639063a70 ("kernel: bump 5.4 to 5.4.203") Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* cryptodev-linux: update to 1.12Rosen Penev2022-07-032-35/+3
| | | | | | | | | Remove upstream backport. Use AUTORELEASE for simplicity. Signed-off-by: Rosen Penev <rosenp@gmail.com> (cherry picked from commit 585cef5f1a9c1c3aecd7d231364618e96d03ab65)
* openssl: bump to 1.1.1oEneas U de Queiroz2022-07-032-6/+6
| | | | | | | | | | | This release comes with a security fix related to c_rehash. OpenWrt does not ship or use it, so it was not affected by the bug. There is a fix for a possible crash in ERR_load_strings() when configured with no-err, which OpenWrt does by default. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com> (cherry picked from commit 7a5ddc0d06895bde7538d78c8dad2c863d70f946)
* exfat: update to 5.19.1Chukun Pan2022-07-011-2/+2
| | | | | | | | | | | | | | | | | | | Major changes are: 4 cleanups & typos fixes. Add keep_last_dots mount option to allow access to paths with trailing dots. Avoid repetitive volume dirty bit set/clear to improve storage life time. Fix ->i_blocks truncation issue caused by wrong 32bit mask. Fix ->i_blocks truncation issue that still exists elsewhere. Fix missing REQ_SYNC in exfat_update_bhs(). Fix referencing wrong parent directory information during rename. Fix slab-out-bounds in exat_clear_bitmap() reported from syzbot. Improve performance while zeroing a cluster with dirsync mount option. Introduce a sys_tz mount option to use system timezone. Move super block magic number to magic.h Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
* firewall: config: remove restictions on DHCPv6 allow ruleTiago Gaspar2022-05-042-4/+2
| | | | | | | | | | | | | | | Remove restrictions on source and destination addresses, which aren't specified on RFC8415, and for some reason in openwrt are configured to allow both link-local and ULA addresses. As cleared out in issue #5066 there are some ISPs that use Gloabal Unicast addresses, so fix this rule to allow them. Fixes: #5066 Signed-off-by: Tiago Gaspar <tiagogaspar8@gmail.com> [rebase onto firewall3, clarify subject, bump PKG_RELEASE] Signed-off-by: Jo-Philipp Wich <jo@mein.io> (backported from commit 65258f5d6093809c541050256646795bc0a460a9)
* iwinfo: drop obsolete patchJo-Philipp Wich2022-04-271-26/+0
| | | | | Fixes: 01cc5e195d ("iwinfo: update to latest Git HEAD") Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* iwinfo: update to latest HEADDavid Bauer2022-04-271-3/+3
| | | | | | | dc6847e iwinfo: nl80211: omit A-hwmode on non-5GHz hardware Signed-off-by: David Bauer <mail@david-bauer.net> (cherry picked from commit f757a8a09885e3c8bb76371e037b8c0731111980)
* hostapd: refresh patchesDavid Bauer2022-04-271-4/+4
| | | | Signed-off-by: David Bauer <mail@david-bauer.net>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-18 17:29:12 +0000