aboutsummaryrefslogtreecommitdiffstats
path: root/package
Commit message (Collapse)AuthorAgeFilesLines
* OpenWrt v21.02.6: adjust config defaultsv21.02.6Daniel Golle2023-04-091-2/+2
| | | | Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* mac80211, mt76: add fixes for recently discovered security issuesFelix Fietkau2023-03-309-9/+676
| | | | | | | Fixes CVE-2022-47522 Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit d54c91bd9ab3c54ee06923eafbd67047816a37e4)
* lantiq: ltq-tapi: add kernel 5.10 compatiblityMathias Kresin2023-03-291-0/+51
| | | | | | | | | | | | | | Due to SCHED_FIFO being a broken scheduler model, all users of sched_setscheduler() are converted to sched_set_fifo_low() upstream and sched_setscheduler() is no longer exported. The callback handling of the tasklet API was redesigned and the macros using the old syntax renamed to _OLD. Signed-off-by: Mathias Kresin <dev@kresin.me> (cherry picked from commit 31f3f797004ad318a1de88ec9cfdece523ee46d9) [Add DECLARE_TASKLET handling for kernel 5.4.235 too] Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* ltq-atm/ltq-ptm: add kernel 5.10 compatiblityMathias Kresin2023-03-273-0/+27
| | | | | | | | | | | | | The callback handling of the tasklet API was redesigned and the macros using the old syntax renamed to _OLD. The stuck queue is now passed to ndo_tx_timeout callback but not used so far. Signed-off-by: Mathias Kresin <dev@kresin.me> (cherry picked from commit 804c541446ab8e3fab11dba5d8fe07807af7fac5) [Add DECLARE_TASKLET handling for kernel 5.4.235 too] Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* kernel: tcindex classifier has been retiredJohn Audia2023-03-271-2/+1
| | | | | | | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/net/sched?h=v5.4.235&id=7a6fb69bbcb21e9ce13bdf18c008c268874f0480 Signed-off-by: John Audia <therealgraysky@proton.me> (cherry picked from commit fbfec3286e8bfce3a78749b7bcb67e658665f197)
* ca-certificates: fix python3-cryptography woes in certdata2pem.pyChristian Lamparter2023-03-041-0/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch is a revert of the upstream patch to Debian's ca-certificate commit 033d52259172 ("mozilla/certdata2pem.py: print a warning for expired certificates.") The reason is, that this change broke builds with the popular Ubuntu 20.04 LTS (focal) releases which are shipping with an older version of the python3-cryptography package that is not compatible. |Traceback (most recent call last): | File "certdata2pem.py", line 125, in <module> | cert = x509.load_der_x509_certificate(obj['CKA_VALUE']) |TypeError: load_der_x509_certificate() missing 1 required positional argument: 'backend' |make[5]: *** [Makefile:6: all] Error 1 ...or if the python3-cryptography was missing all together: |Traceback (most recent call last): | File "/certdata2pem.py", line 31, in <module> | from cryptography import x509 |ModuleNotFoundError: No module named 'cryptography' More concerns were raised by Jo-Philipp Wich: "We don't want the build to depend on the local system time anyway. Right now it seems to be just a warning but I could imagine that eventually certs are simply omitted of found to be expired at build time which would break reproducibility." Link: <https://github.com/openwrt/openwrt/commit/7c99085bd697> Reported-by: Chen Minqiang <ptpt52@gmail.com> Reported-by: Shane Synan <digitalcircuit36939@gmail.com> Signed-off-by: Christian Lamparter <chunkeey@gmail.com> (cherry picked from commit 25bc66eb40ea2c062940778fba601032b2579734)
* ca-certicficates: Update to version 20211016Christian Lamparter2023-03-041-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Update the ca-certificates and ca-bundle package from version 20210119 to version 20211016. Debian change-log entry [1]: |[...] |[ Julien Cristau ] |* mozilla/{certdata.txt,nssckbi.h}: Update Mozilla certificate authority | bundle to version 2.50 | The following certificate authorities were added (+): | + "AC RAIZ FNMT-RCM SERVIDORES SEGUROS" | + "GlobalSign Root R46" | + "GlobalSign Root E46" | + "GLOBALTRUST 2020" | + "ANF Secure Server Root CA" | + "Certum EC-384 CA" | + "Certum Trusted Root CA" | The following certificate authorities were removed (-): | - "QuoVadis Root CA" | - "Sonera Class 2 Root CA" | - "GeoTrust Primary Certification Authority - G2" | - "VeriSign Universal Root Certification Authority" | - "Chambers of Commerce Root - 2008" | - "Global Chambersign Root - 2008" | - "Trustis FPS Root CA" | - "Staat der Nederlanden Root CA - G3" | * Blacklist expired root certificate "DST Root CA X3" (closes: #995432) |[...] [1] <https://metadata.ftp-master.debian.org/changelogs//main/c/ca-certificates/ca-certificates_20211016_changelog> Signed-off-by: Christian Lamparter <chunkeey@gmail.com> (cherry picked from commit 7c99085bd69742f66207d61e9f2da5ec4f8f9d2f)
* mac80211: Update to version 5.10.168-1Hauke Mehrtens2023-02-185-16/+16
| | | | | | | This update mac80211 to version 5.10.168-1. This includes multiple bugfixes. Some of these bugfixes are fixing security relevant bugs. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* openssl: bump to 1.1.1tJohn Audia2023-02-181-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes between 1.1.1s and 1.1.1t [7 Feb 2023] *) Fixed X.400 address type confusion in X.509 GeneralName. There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but subsequently interpreted by GENERAL_NAME_cmp as an ASN1_TYPE. This vulnerability may allow an attacker who can provide a certificate chain and CRL (neither of which need have a valid signature) to pass arbitrary pointers to a memcmp call, creating a possible read primitive, subject to some constraints. Refer to the advisory for more information. Thanks to David Benjamin for discovering this issue. (CVE-2023-0286) This issue has been fixed by changing the public header file definition of GENERAL_NAME so that x400Address reflects the implementation. It was not possible for any existing application to successfully use the existing definition; however, if any application references the x400Address field (e.g. in dead code), note that the type of this field has changed. There is no ABI change. [Hugo Landau] *) Fixed Use-after-free following BIO_new_NDEF. The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. (CVE-2023-0215) [Viktor Dukhovni, Matt Caswell] *) Fixed Double free after calling PEM_read_bio_ex. The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. (CVE-2022-4450) [Kurt Roeckx, Matt Caswell] *) Fixed Timing Oracle in RSA Decryption. A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. (CVE-2022-4304) [Dmitry Belyavsky, Hubert Kario] Signed-off-by: John Audia <therealgraysky@proton.me> (cherry picked from commit 4ae86b3358a149a17411657b12103ccebfbdb11b) The original commit removed the upstreamed patch 010-padlock.patch, but it's not on OpenWrt 21.02, so it doesn't have to be removed. Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
* opkg: add patch to avoid remove package repeatly with forceJosef Schlehofer2023-01-062-1/+37
| | | | | | | | | | | | | | | | This patch was taken from the OpenWrt-devel mailing list: https://www.mail-archive.com/openwrt-devel@lists.openwrt.org/msg59794.html It is included already in OpenWrt master branch and OpenWrt 22.03 release as it was included in opkg-lede repository: https://git.openwrt.org/?p=project/opkg-lede.git;a=commit;h=9c44557a776da993c2ab80cfac4dbd8d59807d01 However, it is not included in OpenWrt 21.02, where the same issue is happening. Fixes: CI for https://github.com/openwrt/packages/pull/20074 Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* kernel: add kmod-nvme packageDaniel Golle2023-01-061-0/+23
| | | | | | | | | | | | | | | | | Add driver for NVM Express block devices, ie. PCIe connected SSDs. Targets which allow booting from NVMe (x86, maybe some mvebu boards come to mind) should have it built-in, so rootfs can be mounted from there. For targets without NVMe support in bootloader or BIOS/firmware it's sufficient to provide the kernel module package. On targets having the NVMe driver built-in the resulting kmod package is an empty dummy. In any case, depending on or installing kmod-nvme results in driver support being available (either because it was already built-in or because the relevant kernel modules are added and loaded). Signed-off-by: Daniel Golle <daniel@makrotopia.org> (cherry picked from commit dbe53352e38d20bb5245158b19d4ff810c209548)
* kernel: kmod-isdn4linux: Remove packageHauke Mehrtens2023-01-061-32/+0
| | | | | | | | The isdn4linux drivers and subsystem was removed in kernel 5.3, remove the kernel package also from OpenWrt. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit db55dea5fc047190af188f07018e99b0c7a4bdde)
* kernel: kmod-ipt-ulog: Remove packageHauke Mehrtens2023-01-062-31/+0
| | | | | | | | The ulog iptables target was removed with kernel 3.17, remove the kernel and also the iptables package in OpenWrt too. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit 2a0284fb0325f07e79b9b4c58a7d280ba9999a39)
* kernel: kmod-w1-slave-ds2760: Remove packageHauke Mehrtens2023-01-061-17/+0
| | | | | | | | | | | The w1_ds2760.ko driver was merged into the ds2760_battery.ko driver. The driver was removed and this package was never build any more. This happened with kernel 4.19. Remove this unused package. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit 5808973d141f488e06efe4749dbf651565fd5510)
* kenrel: kmod-rtc-pt7c4338: Remove packageHauke Mehrtens2023-01-061-16/+0
| | | | | | | | | | The rtc-pt7c4338.ko was never upstream under this name, the driver was removed from OpenWrt some years ago, remove the kmod-rtc-pt7c4338 package too. Fixes: 74d00a8c3849 ("kernel: split patches folder up into backport, pending and hack folders") Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit 5ccf4dcf8864c1d940b65067d8c6f7c4e5858ae2)
* kernel: build crypto md5/sha1/sha256 modules for powerpcJosef Schlehofer2023-01-061-1/+19
| | | | | | | | | | | | | | | | | This builds and enables kernel optimized modules for mpc85xx target: - CONFIG_CRYPTO_MD5_PPC [1] - CONFIG_CRYPTO_SHA1_PPC_SPE [2] - CONFIG_CRYPTO_SHA256_PPC_SPE [3] Where it was possible, then use Signal Processing Engine, because CONFIG_SPE is already enabled in mpc85xx config. [1] https://cateee.net/lkddb/web-lkddb/CRYPTO_MD5_PPC.html [2] https://cateee.net/lkddb/web-lkddb/CRYPTO_SHA1_PPC.html [3] https://cateee.net/lkddb/web-lkddb/CRYPTO_SHA256_PPC_SPE.html Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com> (cherry picked from commit 3a702f8733ff371f30e9e3ba1e1aed5f4686b6b4)
* kernel: fix typo for tegra crypto-sha1 moduleJosef Schlehofer2023-01-061-1/+1
| | | | | | | | Fixes: e889489bedfd2830411bd0cf6564b8272aa9c254 ("kernel: build arm/neon-optimized sha1/512 modules") Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com> (cherry picked from commit f8f9d6901c6a7c85e6b18fba665175646fb53ec7)
* dnsmasq: Backport DHCPv6 server fix (CVE-2022-0934)Hauke Mehrtens2022-12-211-0/+179
| | | | | | | | | | | | This backports a commit from upstream dnsmasq to fix CVE-2022-0934. CVE-2022-0934 description: A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an attacker who sends a crafted packet processed by dnsmasq, potentially causing a denial of service. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit 002a99eccd75fb653163bae0a1132bd4f494e7ad)
* procd: add patch to fix compilation errorChristian Marangi2022-12-041-0/+36
| | | | | | | | | | | procd complain for an unused verbose variable causing compilation error. Fix this by setting the variable static following upstream procd changes. This is a variant of 0ee73b2c86a853ae3274c7080e2dcd36b81aa1fa that introduced major change and fixed the verbose variable to static. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* mac80211: Update to version 5.10.157Hauke Mehrtens2022-12-0324-61/+61
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* kernel: improve description of NTFS kernel packagesRafał Miłecki2022-12-011-2/+3
| | | | | | | This helps choosing the right NTFS driver from two available options. Signed-off-by: Rafał Miłecki <rafal@milecki.pl> (cherry picked from commit b066ad7d9aa5221bfd334a3017abe9bcd171b33f)
* base-files: support "metric" in board.jsonRafał Miłecki2022-12-011-1/+2
| | | | | | | | It allows prepopulating /etc/config/network interface-s with predefined metric. It may be useful for devices with multiple WAN ports. Signed-off-by: Rafał Miłecki <rafal@milecki.pl> (cherry picked from commit 7f443d2d9aa1170d6b68f0dc6d5b5552882ee327)
* wolfssl: update to v5.5.3Nick Hainke2022-11-274-56/+4
| | | | | | | | | | | | | | | Remove "200-ecc-rng.patch" because it was upstramed by: https://github.com/wolfSSL/wolfssl/commit/e2566bab2122949a6a0bb2276d0a52598794d7d0 Refreshed "100-disable-hardening-check.patch". Fixes CVE 2022-42905. Release Notes: - https://github.com/wolfSSL/wolfssl/releases/tag/v5.5.2-stable - https://github.com/wolfSSL/wolfssl/releases/tag/v5.5.3-stable Signed-off-by: Nick Hainke <vincent@systemli.org> (cherry picked from commit 745f1ca9767716c43864a2b7a43ed60b16c25560)
* openssl: bump to 1.1.1sJohn Audia2022-11-2712-180/+2527
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes between 1.1.1r and 1.1.1s [1 Nov 2022] *) Fixed a regression introduced in 1.1.1r version not refreshing the certificate data to be signed before signing the certificate. [Gibeom Gwon] Changes between 1.1.1q and 1.1.1r [11 Oct 2022] *) Fixed the linux-mips64 Configure target which was missing the SIXTY_FOUR_BIT bn_ops flag. This was causing heap corruption on that platform. [Adam Joseph] *) Fixed a strict aliasing problem in bn_nist. Clang-14 optimisation was causing incorrect results in some cases as a result. [Paul Dale] *) Fixed SSL_pending() and SSL_has_pending() with DTLS which were failing to report correct results in some cases [Matt Caswell] *) Fixed a regression introduced in 1.1.1o for re-signing certificates with different key sizes [Todd Short] *) Added the loongarch64 target [Shi Pujin] *) Fixed a DRBG seed propagation thread safety issue [Bernd Edlinger] *) Fixed a memory leak in tls13_generate_secret [Bernd Edlinger] *) Fixed reported performance degradation on aarch64. Restored the implementation prior to commit 2621751 ("aes/asm/aesv8-armx.pl: avoid 32-bit lane assignment in CTR mode") for 64bit targets only, since it is reportedly 2-17% slower and the silicon errata only affects 32bit targets. The new algorithm is still used for 32 bit targets. [Bernd Edlinger] *) Added a missing header for memcmp that caused compilation failure on some platforms [Gregor Jasny] Build system: x86_64 Build-tested: bcm2711/RPi4B Run-tested: bcm2711/RPi4B Signed-off-by: John Audia <therealgraysky@proton.me> (cherry picked from commit a0814f04ed955eb10b25df0ce6666ed91f11ca1b)
* iwinfo: update to latest HEADHauke Mehrtens2022-11-121-3/+3
| | | | | | | 0dad3e6 Add support for CCMP-256 and GCMP-256 ciphers Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit cc6a323e2328176b732b13f1f09745354270cd39)
* iwinfo: update to latest HEADHauke Mehrtens2022-11-121-3/+3
| | | | | | | 705d3b5 iwinfo: Add missing auth_suites mappings for WPA3 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit cc2dfc5e4dc2e480203b826749186c73021795df)
* uboot-layerscape: adjust LS1012A-IOT config and envPawel Dembicki2022-11-122-1/+46
| | | | | | | | | | | | | | | | In a254279a6c30 LS1012A-IOT kernel image was switched to FIT. But u-boot config is lack of FIT and ext4 support. This patch enables it. It also fix envs, because for some reason this board need to use "loadaddr" variable in brackets. Fixes: #9894 Fixes: a254279a6c30 ("layerscape: Change to combined rootfs on sd images") Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com> (cherry picked from commit d75ed3726d994fd050730e9ab5923d6232913054)
* mac80211: Update to version 5.10.149-1Hauke Mehrtens2022-10-2322-179/+80
| | | | | | | | This updates mac80211 to version 5.10.149-1 which is based on kernel 5.10.149. The removed patches were applied upstream. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* OpenWrt v21.02.5: revert to branch defaultsHauke Mehrtens2022-10-151-2/+2
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* OpenWrt v21.02.5: adjust config defaultsv21.02.5Hauke Mehrtens2022-10-151-2/+2
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* mac80211: backport security fix and disable MBSSID supportFelix Fietkau2022-10-132-0/+96
| | | | | | | | | Fixes: CVE-2022-41674 Fixes: CVE-2022-42719 Fixes: CVE-2022-42720 Fixes: CVE-2022-42721 Fixes: CVE-2022-42722 Signed-off-by: Felix Fietkau <nbd@nbd.name>
* OpenWrt v21.02.4: revert to branch defaultsHauke Mehrtens2022-10-091-2/+2
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* OpenWrt v21.02.4: adjust config defaultsv21.02.4Hauke Mehrtens2022-10-091-2/+2
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* firmware: intel-microcode: update to 20220809Christian Lamparter2022-10-091-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Debian's changelog by Henrique de Moraes Holschuh <hmh@debian.org>: * New upstream microcode datafile 20220809 * Fixes INTEL-SA-00657, CVE-2022-21233 Stale data from APIC leaks SGX memory (AEPIC leak) * Fixes unspecified errata (functional issues) on Xeon Scalable * Updated Microcodes: sig 0x00050653, pf_mask 0x97, 2022-03-14, rev 0x100015e, size 34816 sig 0x00050654, pf_mask 0xb7, 2022-03-08, rev 0x2006e05, size 44032 sig 0x000606a6, pf_mask 0x87, 2022-04-07, rev 0xd000375, size 293888 sig 0x000706a1, pf_mask 0x01, 2022-03-23, rev 0x003c, size 75776 sig 0x000706a8, pf_mask 0x01, 2022-03-23, rev 0x0020, size 75776 sig 0x000706e5, pf_mask 0x80, 2022-03-17, rev 0x00b2, size 112640 sig 0x000806c2, pf_mask 0xc2, 2022-03-19, rev 0x0028, size 97280 sig 0x000806d1, pf_mask 0xc2, 2022-03-28, rev 0x0040, size 102400 sig 0x00090672, pf_mask 0x03, 2022-06-07, rev 0x0022, size 216064 sig 0x00090675, pf_mask 0x03, 2022-06-07, rev 0x0022, size 216064 sig 0x000906a3, pf_mask 0x80, 2022-06-15, rev 0x0421, size 216064 sig 0x000906a4, pf_mask 0x80, 2022-06-15, rev 0x0421, size 216064 sig 0x000a0671, pf_mask 0x02, 2022-03-17, rev 0x0054, size 103424 sig 0x000b06f2, pf_mask 0x03, 2022-06-07, rev 0x0022, size 216064 sig 0x000b06f5, pf_mask 0x03, 2022-06-07, rev 0x0022, size 216064 Signed-off-by: Christian Lamparter <chunkeey@gmail.com> (cherry picked from commit bb73828b89def128f26ae1cdff0d08569d261f1b)
* wireless-regdb: update to 2022-08-12Nick Hainke2022-10-091-2/+2
| | | | | | | | | | Changes: 9dc9c89 wireless-regdb: update regulatory database based on preceding changes 442bc25 wireless-regdb: update 5 GHz rules for PK and add 60 GHz rule daee7f3 wireless-regdb: add 5 GHz rules for GY Signed-off-by: Nick Hainke <vincent@systemli.org> (cherry picked from commit 1d2d69c810261308652a577fc136e7327e0e1358)
* wireless-regdb: bump to 2022.06.06Stijn Tintel2022-10-092-3/+3
| | | | | | | | | | | | | | | | | | 902b321 wireless-regdb: Update regulatory rules for Israel (IL) 20f6f34 wireless-regdb: add missing spaces for US S1G rules 25652b6 wireless-regdb: Update regulatory rules for Australia (AU) 081873f wireless-regdb: update regulatory database based on preceding changes 166fbdd wireless-regdb: add db files missing from previous commit e3f03f9 Regulatory update for 6 GHz operation in Canada (CA) 888da5f Regulatory update for 6 GHz operation in United States (US) 647bcaa Regulatory update for 6 GHz operation in FI c6b079d wireless-regdb: update regulatory rules for Bulgaria (BG) on 6GHz 2ed39be wireless-regdb: Remove AUTO-BW from 6 GHz rules 7a6ad1a wireless-regdb: Unify 6 GHz rules for EU contries 68a8f2f wireless-regdb: update regulatory database based on preceding changes Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> (cherry picked from commit e3e9eb31a281643737142e8e80c6f49204b5ba18)
* wireless-regdb: update to version 2022.02.18Sungbo Eo2022-10-091-2/+2
| | | | | | | | | | | | | | | | | | e061299 wireless-regdb: Raise DFS TX power limit to 250 mW (24 dBm) for the US 2ce78ed wireless-regdb: Update regulatory rules for Croatia (HR) on 6GHz 0d39f4c wireless-regdb: Update regulatory rules for South Korea (KR) acad231 wireless-regdb: Update regulatory rules for France (FR) on 6 and 60 GHz ea83a82 wireless-regdb: add support for US S1G channels 4408149 wireless-regdb: add 802.11ah bands to world regulatory domain 5f3cadc wireless-regdb: Update regulatory rules for Spain (ES) on 6GHz e0ac69b Revert "wireless-regdb: Update regulatory rules for South Korea (KR)" 40e5e80 wireless-regdb: Update regulatory rules for South Korea (KR) e427ff2 wireless-regdb: Update regulatory rules for China (CN) 0970116 wireless-regdb: Update regulatory rules for the Netherlands (NL) on 6GHz 4dac44b wireless-regdb: update regulatory database based on preceding changes Signed-off-by: Sungbo Eo <mans0n@gorani.run> (cherry picked from commit 19a90262df89f8419b058cf9a00dc9e8d465088b)
* treewide: fix security issues by bumping all packages using libwolfsslPetr Štetiar2022-10-053-3/+3
| | | | | | | | | | | | | | | | | | | As wolfSSL is having hard time maintaining ABI compatibility between releases, we need to manually force rebuild of packages depending on libwolfssl and thus force their upgrade. Otherwise due to the ABI handling we would endup with possibly two libwolfssl libraries in the system, including the patched libwolfssl-5.5.1, but still have vulnerable services running using the vulnerable libwolfssl-5.4.0. So in order to propagate update of libwolfssl to latest stable release done in commit ec8fb542ec3e4 ("wolfssl: fix TLSv1.3 RCE in uhttpd by using 5.5.1-stable (CVE-2022-39173)") which fixes several remotely exploitable vulnerabilities, we need to bump PKG_RELEASE of all packages using wolfSSL library. Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit f1b7e1434f66a3cb09cb9e70b40add354a22e458) (cherry picked from commit 562894b39da381264a34ce31e9334c8a036fa139)
* wolfssl: fix TLSv1.3 RCE in uhttpd by using 5.5.1-stable (CVE-2022-39173)Petr Štetiar2022-10-051-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | Fixes denial of service attack and buffer overflow against TLS 1.3 servers using session ticket resumption. When built with --enable-session-ticket and making use of TLS 1.3 server code in wolfSSL, there is the possibility of a malicious client to craft a malformed second ClientHello packet that causes the server to crash. This issue is limited to when using both --enable-session-ticket and TLS 1.3 on the server side. Users with TLS 1.3 servers, and having --enable-session-ticket, should update to the latest version of wolfSSL. Thanks to Max at Trail of Bits for the report and "LORIA, INRIA, France" for research on tlspuffin. Complete release notes https://github.com/wolfSSL/wolfssl/releases/tag/v5.5.1-stable Fixes: CVE-2022-39173 Fixes: https://github.com/openwrt/luci/issues/5962 References: https://github.com/wolfSSL/wolfssl/issues/5629 Tested-by: Kien Truong <duckientruong@gmail.com> Reported-by: Kien Truong <duckientruong@gmail.com> Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit ec8fb542ec3e4f584444a97de5ac05dbc2a9cde5) (cherry picked from commit ce59843662961049a28033077587cabdc5243b15)
* wolfssl: bump to 5.5.0Ivan Pavlov2022-10-053-5/+5
| | | | | | | | | | | | Remove upstreamed: 101-update-sp_rand_prime-s-preprocessor-gating-to-match.patch Some low severity vulnerabilities fixed OpenVPN compatibility fixed (broken in 5.4.0) Other fixes && improvements Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com> (cherry picked from commit 3d88f26d74f7771b808082cef541ed8286c40491) (cherry picked from commit 0c8425bf11590afb0c6f1545b328ecb6ed4aee87)
* wolfssl: bump to 5.4.0Eneas U de Queiroz2022-10-053-4/+4
| | | | | | | | | | | | | This version fixes two vulnerabilities: -CVE-2022-34293[high]: Potential for DTLS DoS attack -[medium]: Ciphertext side channel attack on ECC and DH operations. The patch fixing x86 aesni build has been merged upstream. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com> (cherry picked from commit 9710fe70a68e0a004b1906db192d7a6c8f810ac5) Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> (cherry picked from commit ade7c6db1e6c2c0c8d2338948c37cfa7429ebccc)
* wolfssl: bump to v5.3.0-stableEneas U de Queiroz2022-10-053-45/+2
| | | | | | | | | | | This is mostly a bug fix release, including two that were already patched here: - 300-fix-SSL_get_verify_result-regression.patch - 400-wolfcrypt-src-port-devcrypto-devcrypto_aes.c-remove-.patch Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com> (cherry picked from commit 73c1fe2890baa5c0bfa46f53c5387f5e47de1acb) (cherry picked from commit 6f8db8fee3b7bd5cb8b1b2be59ee710a8f96860b)
* base-files: add support for heartbeat led triggerAlexey Smirnov2022-09-241-0/+9
| | | | | | | | | | | | This patch adds support for creation heartbeat led trigger with, for example, this command: ucidef_set_led_heartbeat "..." "..." "..." from /etc/board.d/01_leds. Signed-off-by: Alexey Smirnov <s.alexey@gmail.com> (cherry picked from commit 66071729a27919e555752fce25210b1b035eb319)
* uboot-bcm4908: include SoC in output filesRafał Miłecki2022-09-011-2/+4
| | | | | | | | | This fixes problem of overwriting BCM4908 U-Boot and DTB files by BCM4912 ones. That bug didn't allow booting BCM4908 devices. Fixes: f4c2dab544ec2 ("uboot-bcm4908: add BCM4912 build") Signed-off-by: Rafał Miłecki <rafal@milecki.pl> (cherry picked from commit a8e1e30543239e85ff5dc220368164b66cf73fba)
* uboot-bcm4908: add BCM4912 buildRafał Miłecki2022-09-013-3/+33
| | | | | Signed-off-by: Rafał Miłecki <rafal@milecki.pl> (cherry picked from commit f4c2dab544ec22fac6ab2de32aa5bb361c7566f7)
* uboot-bcm4908: update to the latest genericRafał Miłecki2022-09-011-3/+3
| | | | | | | | 0625aad74d arm: dts: add ASUS GT-AX6000 6fb1cb624d arm: dts: add Netgear RAXE450 / RAXE550 Signed-off-by: Rafał Miłecki <rafal@milecki.pl> (cherry picked from commit 3592aa85664040a118654555afb78659af756a4e)
* mac80211: disable ft-over-ds by defaultFelix Fietkau2022-08-301-1/+1
| | | | | | | | | Testing has shown it to be very unreliable in variety of configurations. It is not mandatory, so let's disable it by default until we have a better solution. Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry-picked from commit 2984a0420649733662ff95b0aff720b8c2c19f8a)
* mt76: backport fix encap offload ethernet type checkThibaut VARÈNE2022-08-281-0/+63
| | | | | | | | | | The driver needs to check if the format is 802.2 vs 802.3 in order to set a tx descriptor flag. skb->protocol can't be used, since it may not be properly initialized for packets coming in from a packet socket. Fix misdetection by checking the ethertype from the skb data instead. Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org> Signed-off-by: Petr Štetiar <ynezz@true.cz> [commit description]
* hostapd: ubus: fix uninitialized pointerDavid Bauer2022-08-281-1/+1
| | | | | | | | | This fixes passing a bogus non-null pointer to the ubus handler in case the transition request is rejected. Signed-off-by: David Bauer <mail@david-bauer.net> (cherry picked from commit 9b880f09f394049e0629e3c9d4061f431a6b19a8) Signed-off-by: Nick Hainke <vincent@systemli.org>
* ramips: add support for YunCore AX820/HWAP-AX820Clemens Hopfer2022-08-281-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are two versions which are identical apart from the enclosure: YunCore AX820: indoor ceiling mount AP with integrated antennas YunCore HWAP-AX820: outdoor enclosure with external (N) connectors Hardware specs: SoC: MediaTek MT7621DAT Flash: 16 MiB SPI NOR RAM: 128MiB (DDR3, integrated) WiFi: MT7905DAN+MT7975DN 2.4/5GHz 2T2R 802.11ax Ethernet: 10/100/1000 Mbps x2 (WAN/PoE+LAN) LED: Status (green) Button: Reset Power: 802.11af/at PoE; DC 12V,1A Antennas: AX820(indoor): 4dBi internal; HWAP-AX820(outdoor): external Flash instructions: The "OpenWRT support" version of the AX820 comes with a LEDE-based firmware with proprietary MTK drivers and a luci webinterface and ssh accessible under 192.168.1.1 on LAN; user root, no password. The sysupgrade.bin can be flashed using luci or sysupgrade via ssh, you will have to force the upgrade due to a different factory name. Remember: Do *not* preserve factory configuration! MAC addresses as used by OEM firmware: use address source 2g 44:D1:FA:*:0b Factory 0x0004 (label) 5g 46:D1:FA:*:0b LAA of 2g lan 44:D1:FA:*:0c Factory 0xe000 wan 44:D1:FA:*:0d Factory 0xe000 + 1 The wan MAC can also be found in 0xe006 but is not used by OEM dtb. Due to different MAC handling in mt76 the LAA derived from lan is used for 2g to prevent duplicate MACs when creating multiple interfaces. Signed-off-by: Clemens Hopfer <openwrt@wireloss.net> (cherry picked from commit 4891b865380e2b7f32acf0893df9c1ca9db8d4ea) [switch to mtd-mac-address instead of nvmem-cells]
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-25 20:46:13 +0000