aboutsummaryrefslogtreecommitdiffstats
path: root/package
Commit message (Collapse)AuthorAgeFilesLines
* ath79: support Ruckus ZoneFlex 7372Lech Perczak2022-10-231-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ruckus ZoneFlex 7372 is a dual-band, dual-radio 802.11n 2x2 MIMO enterprise access point. Ruckus ZoneFlex 7352 is also supported, lacking the 5GHz radio part. Hardware highligts: - CPU: Atheros AR9344 SoC at 560 MHz - RAM: 128MB DDR2 - Flash: 32MB SPI-NOR - Wi-Fi 2.4GHz: AR9344 built-in 2x2 MIMO radio - Wi-Fi 5Ghz: AR9582 2x2 MIMO radio (Only in ZF7372) - Antennas: - Separate internal active antennas with beamforming support on both bands with 7 elements per band, each controlled by 74LV164 GPIO expanders, attached to GPIOs of each radio. - Two dual-band external RP-SMA antenna connections on "7372-E" variant. - Ethernet 1: single Gigabit Ethernet port through AR8035 gigabit PHY - Ethernet 2: single Fast Ethernet port through AR9344 built-in switch - PoE: input through Gigabit port - Standalone 12V/1A power input - USB: optional single USB 2.0 host port on "-U" variants. The same image should support: - ZoneFlex 7372E (variant with external antennas, without beamforming capability) - ZoneFlex 7352 (single-band, 2.4GHz-only variant). which are based on same baseboard (codename St. Bernard), with different populated components. Serial console: 115200-8-N-1 on internal H1 header. Pinout: H1 --- |5| --- |4| --- |3| --- |x| --- |1| --- Pin 5 is near the "H1" marking. 1 - RX x - no pin 3 - VCC (3.3V) 4 - GND 5 - TX JTAG: Connector H2, similar to MIPS eJTAG, standard, but without the key in pin 12 and not every pin routed: ------- H2 |1 |2 | ------- |3 |4 | ------- |5 |6 | ------- |7 |8 | ------- |9 |10| ------- |11|12| ------- |13|14| ------- 3 - TDI 5 - TDO 7 - TMS 9 - TCK 2,4,6,8,10 - GND 14 - Vref 1,11,12,13 - Not connected Installation: There are two methods of installation: - Using serial console [1] - requires some disassembly, 3.3V USB-Serial adapter, TFTP server, and removing a single T10 screw, but with much less manual steps, and is generally recommended, being safer. - Using stock firmware root shell exploit, SSH and TFTP [2]. Does not work on some rare versions of stock firmware. A more involved, and requires installing `mkenvimage` from u-boot-tools package if you choose to rebuild your own environment, but can be used without disassembly or removal from installation point, if you have the credentials. If for some reason, size of your sysupgrade image exceeds 13312kB, proceed with method [1]. For official images this is not likely to happen ever. [1] Using serial console: 0. Connect serial console to H1 header. Ensure the serial converter does not back-power the board, otherwise it will fail to boot. 1. Power-on the board. Then quickly connect serial converter to PC and hit Ctrl+C in the terminal to break boot sequence. If you're lucky, you'll enter U-boot shell. Then skip to point 3. Connection parameters are 115200-8-N-1. 2. Allow the board to boot. Press the reset button, so the board reboots into U-boot again and go back to point 1. 3. Set the "bootcmd" variable to disable the dual-boot feature of the system and ensure that uImage is loaded. This is critical step, and needs to be done only on initial installation. > setenv bootcmd "bootm 0x9f040000" > saveenv 4. Boot the OpenWrt initramfs using TFTP. Replace IP addresses as needed: > setenv serverip 192.168.1.2 > setenv ipaddr 192.168.1.1 > tftpboot 0x81000000 openwrt-ath79-generic-ruckus_zf7372-initramfs-kernel.bin > bootm 0x81000000 5. Optional, but highly recommended: back up contents of "firmware" partition: $ ssh root@192.168.1.1 cat /dev/mtd1 > ruckus_zf7372_fw1_backup.bin $ ssh root@192.168.1.1 cat /dev/mtd5 > ruckus_zf7372_fw2_backup.bin 6. Copy over sysupgrade image, and perform actual installation. OpenWrt shall boot from flash afterwards: $ ssh root@192.168.1.1 # sysupgrade -n openwrt-ath79-generic-ruckus_zf7372-squashfs-sysupgrade.bin [2] Using stock root shell: 0. Reset the device to factory defaullts. Power-on the device and after it boots, hold the reset button near Ethernet connectors for 5 seconds. 1. Connect the device to the network. It will acquire address over DHCP, so either find its address using list of DHCP leases by looking for label MAC address, or try finding it by scanning for SSH port: $ nmap 10.42.0.0/24 -p22 From now on, we assume your computer has address 10.42.0.1 and the device has address 10.42.0.254. 2. Set up a TFTP server on your computer. We assume that TFTP server root is at /srv/tftp. 3. Obtain root shell. Connect to the device over SSH. The SSHD ond the frmware is pretty ancient and requires enabling HMAC-MD5. $ ssh 10.42.0.254 \ -o UserKnownHostsFile=/dev/null \ -o StrictHostKeyCheking=no \ -o MACs=hmac-md5 Login. User is "super", password is "sp-admin". Now execute a hidden command: Ruckus It is case-sensitive. Copy and paste the following string, including quotes. There will be no output on the console for that. ";/bin/sh;" Hit "enter". The AP will respond with: grrrr OK Now execute another hidden command: !v54! At "What's your chow?" prompt just hit "enter". Congratulations, you should now be dropped to Busybox shell with root permissions. 4. Optional, but highly recommended: backup the flash contents before installation. At your PC ensure the device can write the firmware over TFTP: $ sudo touch /srv/tftp/ruckus_zf7372_firmware{1,2}.bin $ sudo chmod 666 /srv/tftp/ruckus_zf7372_firmware{1,2}.bin Locate partitions for primary and secondary firmware image. NEVER blindly copy over MTD nodes, because MTD indices change depending on the currently active firmware, and all partitions are writable! # grep rcks_wlan /proc/mtd Copy over both images using TFTP, this will be useful in case you'd like to return to stock FW in future. Make sure to backup both, as OpenWrt uses bot firmwre partitions for storage! # tftp -l /dev/<rcks_wlan.main_mtd> -r ruckus_zf7372_firmware1.bin -p 10.42.0.1 # tftp -l /dev/<rcks_wlan.bkup_mtd> -r ruckus_zf7372_firmware2.bin -p 10.42.0.1 When the command finishes, copy over the dump to a safe place for storage. $ cp /srv/tftp/ruckus_zf7372_firmware{1,2}.bin ~/ 5. Ensure the system is running from the BACKUP image, i.e. from rcks_wlan.bkup partition or "image 2". Otherwise the installation WILL fail, and you will need to access mtd0 device to write image which risks overwriting the bootloader, and so is not covered here and not supported. Switching to backup firmware can be achieved by executing a few consecutive reboots of the device, or by updating the stock firmware. The system will boot from the image it was not running from previously. Stock firmware available to update was conveniently dumped in point 4 :-) 6. Prepare U-boot environment image. Install u-boot-tools package. Alternatively, if you build your own images, OpenWrt provides mkenvimage in host staging directory as well. It is recommended to extract environment from the device, and modify it, rather then relying on defaults: $ sudo touch /srv/tftp/u-boot-env.bin $ sudo chmod 666 /srv/tftp/u-boot-env.bin On the device, find the MTD partition on which environment resides. Beware, it may change depending on currently active firmware image! # grep u-boot-env /proc/mtd Now, copy over the partition # tftp -l /dev/mtd<N> -r u-boot-env.bin -p 10.42.0.1 Store the stock environment in a safe place: $ cp /srv/tftp/u-boot-env.bin ~/ Extract the values from the dump: $ strings u-boot-env.bin | tee u-boot-env.txt Now clean up the debris at the end of output, you should end up with each variable defined once. After that, set the bootcmd variable like this: bootcmd=bootm 0x9f040000 You should end up with something like this: bootcmd=bootm 0x9f040000 bootargs=console=ttyS0,115200 rootfstype=squashfs init=/sbin/init baudrate=115200 ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee bootdelay=2 mtdids=nor0=ar7100-nor0 mtdparts=mtdparts=ar7100-nor0:256k(u-boot),13312k(rcks_wlan.main),2048k(datafs),256k(u-boot-env),512k(Board Data),13312k(rcks_wlan.bkup) ethact=eth0 filesize=1000000 fileaddr=81000000 ipaddr=192.168.0.7 serverip=192.168.0.51 partition=nor0,0 mtddevnum=0 mtddevname=u-boot stdin=serial stdout=serial stderr=serial These are the defaults, you can use most likely just this as input to mkenvimage. Now, create environment image and copy it over to TFTP root: $ mkenvimage -s 0x40000 -b -o u-boot-env.bin u-boot-env.txt $ sudo cp u-boot-env.bin /srv/tftp This is the same image, gzipped and base64-encoded: H4sIAAAAAAAAA+3QTW7TQBQAYB+AQ2TZSGk6Tpv+SbNBrNhyADSJHWolsYPtlJaDcAWOCXaqQhdIXOD7 Fm/ee+MZ+/nHu58fV03Tr/dFHNf9JDzdbcJVGGRjI7Vfurhu6q7ZlbHvnz+FWZ4vFyFM2mF30/XPhzJ2 X4+pe9h0k6qu+njRrar6YkyzVToWberL+HImK/uHVBRtDE8h3IenlIawWg1hvR5CUQyhLE/vLcpdeo6L bN8XVdHFumlDTO1NHsL5mI/9Q2r7Lv5J3uzeL5bX27Pj+XjRdJZfXuaL7Vm73nafv+1SPd+nqp7OFuHq dntWpD5tuqH6e+K8rB+ns+V45n2T2mLyYXjmH9estsfD9DTSuo/DErJNtSu76vswbjg5NU4D3752qsOp zu8W8/z6dh7mN1lXto9lWx3eNJd5Ng5V9VVTn2afnSYuysf6uI9/8rQv48s3Z93wn+o4XFWl3Vg0x/5N Vbbta5X9AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAID/+Q2Z/B7cAAAEAA== 7. Perform actual installation. Copy over OpenWrt sysupgrade image to TFTP root: $ sudo cp openwrt-ath79-generic-ruckus_zf7372-squashfs-sysupgrade.bin /srv/tftp Now load both to the device over TFTP: # tftp -l /tmp/u-boot-env.bin -r u-boot-env.bin -g 10.42.0.1 # tftp -l /tmp/openwrt.bin -r openwrt-ath79-generic-ruckus_zf7372-squashfs-sysupgrade.bin -g 10.42.0.1 Verify checksums of both images to ensure the transfer over TFTP was completed: # sha256sum /tmp/u-boot-env.bin /tmp/openwrt.bin And compare it against source images: $ sha256sum /srv/tftp/u-boot-env.bin /srv/tftp/openwrt-ath79-generic-ruckus_zf7372-squashfs-sysupgrade.bin Locate MTD partition of the primary image: # grep rcks_wlan.main /proc/mtd Now, write the images in place. Write U-boot environment last, so unit still can boot from backup image, should power failure occur during this. Replace MTD placeholders with real MTD nodes: # flashcp /tmp/openwrt.bin /dev/<rcks_wlan.main_mtd> # flashcp /tmp/u-boot-env.bin /dev/<u-boot-env_mtd> Finally, reboot the device. The device should directly boot into OpenWrt. Look for the characteristic power LED blinking pattern. # reboot -f After unit boots, it should be available at the usual 192.168.1.1/24. Return to factory firmware: 1. Boot into OpenWrt initramfs as for initial installation. To do that without disassembly, you can write an initramfs image to the device using 'sysupgrade -F' first. 2. Unset the "bootcmd" variable: fw_setenv bootcmd "" 3. Write factory images downloaded from manufacturer website into fwconcat0 and fwconcat1 MTD partitions, or restore backup you took before installation: mtd write ruckus_zf7372_fw1_backup.bin /dev/mtd1 mtd write ruckus_zf7372_fw2_backup.bin /dev/mtd5 4. Reboot the system, it should load into factory firmware again. Quirks and known issues: - This is first device in ath79 target to support link state reporting on FE port attached trough the built-in switch. - Flash layout is changed from the factory, to use both firmware image partitions for storage using mtd-concat, and uImage format is used to actually boot the system, which rules out the dual-boot capability. The 5GHz radio has its own EEPROM on board, not connected to CPU. - The stock firmware has dual-boot capability, which is not supported in OpenWrt by choice. It is controlled by data in the top 64kB of RAM which is unmapped, to avoid the interference in the boot process and accidental switch to the inactive image, although boot script presence in form of "bootcmd" variable should prevent this entirely. - U-boot disables JTAG when starting. To re-enable it, you need to execute the following command before booting: mw.l 1804006c 40 And also you need to disable the reset button in device tree if you intend to debug Linux, because reset button on GPIO0 shares the TCK pin. - On some versions of stock firmware, it is possible to obtain root shell, however not much is available in terms of debugging facitilies. 1. Login to the rkscli 2. Execute hidden command "Ruckus" 3. Copy and paste ";/bin/sh;" including quotes. This is required only once, the payload will be stored in writable filesystem. 4. Execute hidden command "!v54!". Press Enter leaving empty reply for "What's your chow?" prompt. 5. Busybox shell shall open. Source: https://alephsecurity.com/vulns/aleph-2019014 - Stock firmware has beamforming functionality, known as BeamFlex, using active multi-segment antennas on both bands - controlled by RF analog switches, driven by a pair of 74LV164 shift registers. Shift registers used for each radio are connected to GPIO14 (clock) and GPIO15 of the respective chip. They are mapped as generic GPIOs in OpenWrt - in stock firmware, they were most likely handled directly by radio firmware, given the real-time nature of their control. Lack of this support in OpenWrt causes the antennas to behave as ordinary omnidirectional antennas, and does not affect throughput in normal conditions, but GPIOs are available to tinker with nonetheless. Signed-off-by: Lech Perczak <lech.perczak@gmail.com> (cherry picked from commit 59cb4dc91d500edc2e6b462e223e367806557cc5)
* kernel: add kmod-nvme packageDaniel Golle2022-10-231-0/+23
| | | | | | | | | | | | | | | | | Add driver for NVM Express block devices, ie. PCIe connected SSDs. Targets which allow booting from NVMe (x86, maybe some mvebu boards come to mind) should have it built-in, so rootfs can be mounted from there. For targets without NVMe support in bootloader or BIOS/firmware it's sufficient to provide the kernel module package. On targets having the NVMe driver built-in the resulting kmod package is an empty dummy. In any case, depending on or installing kmod-nvme results in driver support being available (either because it was already built-in or because the relevant kernel modules are added and loaded). Signed-off-by: Daniel Golle <daniel@makrotopia.org> (cherry picked from commit dbe53352e38d20bb5245158b19d4ff810c209548)
* ucode: update to latest Git HEADJo-Philipp Wich2022-10-181-3/+3
| | | | | | | | 00af065 fs: expose `getdelim()` functionality through `fd.read()` 21ace5e lexer: fixes for regex literal parsing Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit 1b90c7441b81aee7b1212e8918e3ec7144375d96)
* firewall4: update to latest Git HEADJo-Philipp Wich2022-10-181-3/+3
| | | | | | | 7ae5e14 fw4: gracefully handle `null` return values from `fd.read("line")` Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit 5e2e048c0e7c16d7967ec7a0cd8a9c01aa0f12b1)
* OpenWrt v22.03.2: revert to branch defaultsHauke Mehrtens2022-10-151-2/+2
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* OpenWrt v22.03.2: adjust config defaultsv22.03.2Hauke Mehrtens2022-10-151-2/+2
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* firewall4: update to latest Git HEADJo-Philipp Wich2022-10-151-3/+3
| | | | | | | | | | | | | | | | 4fbf6d7 ruleset.uc: log forwarded traffic not matched by zone policies c7201a3 main.uc: reintroduce set reload restriction 756f1e2 ruleset: fix emitting set_mark/set_xmark rules with masks 3db4741 ruleset: properly handle zone names starting with a digit 43d8ef5 fw4: fix formatting of default log prefix 592ba45 main.uc: remove uneeded/wrong set reload restrictions b0a6bff tests: fix testcases 145e159 fw4: recognize `option log` and `option counter` in `config nat` sections ce050a8 fw4: fall back to device if l3_device is not available in ifstatus Fixes: #10639, #10965 Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit fdfa9d8f7469626d2dc8e4b46a6ad56a3b27c16b)
* ucode: update to latest Git HEADJo-Philipp Wich2022-10-151-3/+3
| | | | | | | | | | | | | | | | | | | | | | | 4ae7072 fs: use `getline()` for line wise read operations 21ace5e lexer: fixes for regex literal parsing 00965fa lib: implement slice() function 76d396d main: implement print mode 7bbba78 compiler: optimize function return opcode generation a45f2a3 lexer: improve regex literal handling d64d5d6 vm: maintain export symbol tables per program f4b4ded uloop: task: gracefully handle absent output callback a58fe47 ubus: hold reference to underlying connection until deferred is concluded e23b58a lib: uc_system(): retry waitpid() on EINTR cc4eb79 ubus: support obtaining numeric error code 01c412c ubus: add toplevel constants for ubus status codes 8e240fa ubus: allow object method call handlers to return a numeric status code 5cdddd3 lib: add limit support to split() and replace() 0ba9c3e fs: add optional third permission argument to fs.open() c1f7b3b lib: remove fixed capture group limit in match() and regex replace() Signed-off-by: Jo-Philipp Wich <jo@mein.io> (backported from commits 639754e36d849553e288f8e34f51f793761c07db and 5110dcb1fa44fc1aac737c63b31474daa471de89)
* rpcd: update to latest Git HEADJo-Philipp Wich2022-10-151-3/+3
| | | | | | | | | | 8c852b6 ucode: write ucode runtime exceptions to stderr e80d0b2 ucode: pass-through `ubus_rpc_session` argument 0d02243 ucode: initialize module search path early Signed-off-by: Jo-Philipp Wich <jo@mein.io> (backported from commits 94129cbefb6027cdfe2b7801a6e27a36d4ec58b8 and db17c7527107c1dae190608a1313a3977fe4f23f)
* ramips: add support for ZyXEL NWA50AX / NWA55AXEDavid Bauer2022-10-144-0/+392
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Hardware -------- CPU: Mediatek MT7621 RAM: 256M DDR3 FLASH: 128M NAND ETH: 1x Gigabit Ethernet WiFi: Mediatek MT7915 (2.4/5GHz 802.11ax 2x2 DBDC) BTN: 1x Reset (NWA50AX only) LED: 1x Multi-Color (NWA50AX only) UART Console ------------ NWA50AX: Available below the rubber cover next to the ethernet port. NWA55AXE: Available on the board when disassembling the device. Settings: 115200 8N1 Layout: <12V> <LAN> GND-RX-TX-VCC Logic-Level is 3V3. Don't connect VCC to your UART adapter! Installation Web-UI ------------------- Upload the Factory image using the devices Web-Interface. As the device uses a dual-image partition layout, OpenWrt can only installed on Slot A. This requires the current active image prior flashing the device to be on Slot B. If the currently installed image is started from Slot A, the device will flash OpenWrt to Slot B. OpenWrt will panic upon first boot in this case and the device will return to the ZyXEL firmware upon next boot. If this happens, first install a ZyXEL firmware upgrade of any version and install OpenWrt after that. Installation TFTP ----------------- This installation routine is especially useful in case * unknown device password (NWA55AXE lacks reset button) * bricked device Attach to the UART console header of the device. Interrupt the boot procedure by pressing Enter. The bootloader has a reduced command-set available from CLI, but more commands can be executed by abusing the atns command. Boot a OpenWrt initramfs image available on a TFTP server at 192.168.1.66. Rename the image to owrt.bin $ atnf owrt.bin $ atna 192.168.1.88 $ atns "192.168.1.66; tftpboot; bootm" Upon booting, set the booted image to the correct slot: $ zyxel-bootconfig /dev/mtd10 get-status $ zyxel-bootconfig /dev/mtd10 set-image-status 0 valid $ zyxel-bootconfig /dev/mtd10 set-active-image 0 Copy the OpenWrt ramboot-factory image to the device using scp. Write the factory image to NAND and reboot the device. $ mtd write ramboot-factory.bin firmware $ reboot Signed-off-by: David Bauer <mail@david-bauer.net> (cherry picked from commit a0b7fef0ffe4cd9cca39a652a37e4f3ce8f0a681)
* busybox: nslookup: ensure unique transaction IDs for the DNS queriesUwe Kleine-König2022-10-141-0/+42
| | | | | | | | | | | | | On machines with a coarse monotonic clock (here: TP-Link RE200 powered by a MediaTek MT7620A) it can happen that the two DNS requests (for A and AAAA) share the same transaction ID. If this happens the second reply is wrongly dropped and nslookup reports "No answer". Fix this by ensuring that the transaction IDs are unique. Signed-off-by: Uwe Kleine-König <uwe@kleine-koenig.org> (cherry picked from commit 63e5ba8e69f03a584b707520db0a0821eda3024f) Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* mac80211: backport security fixesFelix Fietkau2022-10-1315-1/+2057
| | | | | | | | | | | | This mainly affects scanning and beacon parsing, especially with MBSSID enabled Fixes: CVE-2022-41674 Fixes: CVE-2022-42719 Fixes: CVE-2022-42720 Fixes: CVE-2022-42721 Fixes: CVE-2022-42722 Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry-picked from commit 26f400210d6b3780fcc0deb89b9741837df9c8b8)
* mac80211: merge upstream fixesKoen Vandeputte2022-10-133-0/+179
| | | | | | | fetched from upstream kernel v5.15.67 Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com> (cherry-picked from commit aa9be386d40f3a5e559c0f2183c772175a45cf0d)
* OpenWrt v22.03.1: revert to branch defaultsHauke Mehrtens2022-10-091-2/+2
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* OpenWrt v22.03.1: adjust config defaultsv22.03.1Hauke Mehrtens2022-10-091-2/+2
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* treewide: fix security issues by bumping all packages using libwolfsslPetr Štetiar2022-10-044-4/+4
| | | | | | | | | | | | | | | | | | As wolfSSL is having hard time maintaining ABI compatibility between releases, we need to manually force rebuild of packages depending on libwolfssl and thus force their upgrade. Otherwise due to the ABI handling we would endup with possibly two libwolfssl libraries in the system, including the patched libwolfssl-5.5.1, but still have vulnerable services running using the vulnerable libwolfssl-5.4.0. So in order to propagate update of libwolfssl to latest stable release done in commit ec8fb542ec3e4 ("wolfssl: fix TLSv1.3 RCE in uhttpd by using 5.5.1-stable (CVE-2022-39173)") which fixes several remotely exploitable vulnerabilities, we need to bump PKG_RELEASE of all packages using wolfSSL library. Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit f1b7e1434f66a3cb09cb9e70b40add354a22e458)
* wolfssl: fix TLSv1.3 RCE in uhttpd by using 5.5.1-stable (CVE-2022-39173)Petr Štetiar2022-10-041-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | Fixes denial of service attack and buffer overflow against TLS 1.3 servers using session ticket resumption. When built with --enable-session-ticket and making use of TLS 1.3 server code in wolfSSL, there is the possibility of a malicious client to craft a malformed second ClientHello packet that causes the server to crash. This issue is limited to when using both --enable-session-ticket and TLS 1.3 on the server side. Users with TLS 1.3 servers, and having --enable-session-ticket, should update to the latest version of wolfSSL. Thanks to Max at Trail of Bits for the report and "LORIA, INRIA, France" for research on tlspuffin. Complete release notes https://github.com/wolfSSL/wolfssl/releases/tag/v5.5.1-stable Fixes: CVE-2022-39173 Fixes: https://github.com/openwrt/luci/issues/5962 References: https://github.com/wolfSSL/wolfssl/issues/5629 Tested-by: Kien Truong <duckientruong@gmail.com> Reported-by: Kien Truong <duckientruong@gmail.com> Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit ec8fb542ec3e4f584444a97de5ac05dbc2a9cde5)
* wolfssl: refresh patchesPetr Štetiar2022-10-042-3/+3
| | | | | | | So they're tidy and apply cleanly. Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit 8ad9a72cbed07643c7a8e4febbea71c7122b29a4)
* wolfssl: bump to 5.5.0Ivan Pavlov2022-10-044-28/+5
| | | | | | | | | | | Remove upstreamed: 101-update-sp_rand_prime-s-preprocessor-gating-to-match.patch Some low severity vulnerabilities fixed OpenVPN compatibility fixed (broken in 5.4.0) Other fixes && improvements Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com> (cherry picked from commit 3d88f26d74f7771b808082cef541ed8286c40491)
* uboot-mvebu: backport LibreSSL patches for older version of LibreSSLJosef Schlehofer2022-10-032-0/+55
| | | | | | | | | | | | | | If you would like to compile the newest version of U-boot together with the stable OpenWrt version, which does not have LibreSSL >= 3.5, which was updated in the master branch by commit 5451b03b7ceb2315445c683fe174e28bbdd49c2f ("tools/libressl: bump to v3.5.3"), then you need these two patches to fix it. They are backported from U-boot repository. This should be backported to stable OpenWrt versions. Reported-by: Michal Vasilek <michal.vasilek@nic.cz> Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com> (cherry picked from commit 185541f50ff59c0a5e0663ad612f0f5eb31926cf)
* uboot-mvebu: backport patch to fix compilation on non glibc systemJosef Schlehofer2022-10-031-0/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This issue was reported by @paper42, who is using Void Linux with musl to compile OpenWrt and its packages and found out it is not possible to compile U-boot for Turris Omnia (neither any other). It fixes following output: ``` HOSTCC tools/kwboot tools/kwboot.c: In function 'kwboot_tty_change_baudrate': tools/kwboot.c:662:6: error: 'struct termios' has no member named 'c_ospeed' 662 | tio.c_ospeed = tio.c_ispeed = baudrate; | ^ tools/kwboot.c:662:21: error: 'struct termios' has no member named 'c_ispeed' 662 | tio.c_ospeed = tio.c_ispeed = baudrate; | ^ tools/kwboot.c:690:31: error: 'struct termios' has no member named 'c_ospeed' 690 | if (!_is_within_tolerance(tio.c_ospeed, baudrate, 3)) | ^ tools/kwboot.c:693:31: error: 'struct termios' has no member named 'c_ispeed' 693 | if (!_is_within_tolerance(tio.c_ispeed, baudrate, 3)) | ``` Tested-by: Michal Vasilek <michal.vasilek@nic.cz> Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com> (cherry picked from commit 9c7472950b01c5b3a461f4e29b3b62bac9e35b46)
* firmware: intel-microcode: update to 20220809Christian Lamparter2022-10-031-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Debian's changelog by Henrique de Moraes Holschuh <hmh@debian.org>: * New upstream microcode datafile 20220809 * Fixes INTEL-SA-00657, CVE-2022-21233 Stale data from APIC leaks SGX memory (AEPIC leak) * Fixes unspecified errata (functional issues) on Xeon Scalable * Updated Microcodes: sig 0x00050653, pf_mask 0x97, 2022-03-14, rev 0x100015e, size 34816 sig 0x00050654, pf_mask 0xb7, 2022-03-08, rev 0x2006e05, size 44032 sig 0x000606a6, pf_mask 0x87, 2022-04-07, rev 0xd000375, size 293888 sig 0x000706a1, pf_mask 0x01, 2022-03-23, rev 0x003c, size 75776 sig 0x000706a8, pf_mask 0x01, 2022-03-23, rev 0x0020, size 75776 sig 0x000706e5, pf_mask 0x80, 2022-03-17, rev 0x00b2, size 112640 sig 0x000806c2, pf_mask 0xc2, 2022-03-19, rev 0x0028, size 97280 sig 0x000806d1, pf_mask 0xc2, 2022-03-28, rev 0x0040, size 102400 sig 0x00090672, pf_mask 0x03, 2022-06-07, rev 0x0022, size 216064 sig 0x00090675, pf_mask 0x03, 2022-06-07, rev 0x0022, size 216064 sig 0x000906a3, pf_mask 0x80, 2022-06-15, rev 0x0421, size 216064 sig 0x000906a4, pf_mask 0x80, 2022-06-15, rev 0x0421, size 216064 sig 0x000a0671, pf_mask 0x02, 2022-03-17, rev 0x0054, size 103424 sig 0x000b06f2, pf_mask 0x03, 2022-06-07, rev 0x0022, size 216064 sig 0x000b06f5, pf_mask 0x03, 2022-06-07, rev 0x0022, size 216064 Signed-off-by: Christian Lamparter <chunkeey@gmail.com> (cherry picked from commit bb73828b89def128f26ae1cdff0d08569d261f1b)
* build: fix issues with targets installed via feedsFelix Fietkau2022-09-271-3/+4
| | | | | | | | - fix including modules.mk when a target is being replaced - fix calling make targets from target/linux Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry-picked from commit 3a8825ad6acbf18b2b472ace56be58868af78be7)
* build: fix including modules.mk for targets pulled in from feedsFelix Fietkau2022-09-271-1/+2
| | | | | | Fixes: ebc36ebb2349 ("scripts/feeds: install targets to target/linux/feeds and support overriding") Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry-picked from commit 00094efec33f07c9dc16cce23be492430c40b3cc)
* ramips: fix fw_setsysWenli Looi2022-09-231-1/+1
| | | | | | | | | | This change was included in the original pull request but later omitted for some reason: https://github.com/openwrt/openwrt/pull/4936 Signed-off-by: Wenli Looi <wlooi@ucalgary.ca> (cherry picked from commit 4cccea02a60aee0dd77c4db35672c92e2fe384a1)
* mac80211: rt2x00: experimental improvements for MT7620 wifiDaniel Golle2022-09-1924-483/+1411
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Serge Vasilugin reports: To improve mt7620 built-in wifi performance some changes: 1. Correct BW20/BW40 switching (see comments with mark (1)) 2. Correct TX_SW_CFG1 MAC reg from v3 of vendor driver see https://gitlab.com/dm38/padavan-ng/-/blob/master/trunk/proprietary/rt_wifi/rtpci/3.0.X.X/mt76x2/chips/rt6352.c#L531 3. Set bbp66 for all chains. 4. US_CYC_CNT init based on Programming guide, default value was 33 (pci), set chipset bus clock with fallback to cpu clock/3. 5. Don't overwrite default values for mt7620. 6. Correct some typos. 7. Add support for external LNA: a) RF and BBP regs never be corrected for this mode b) eLNA is driven the same way as ePA with mt7620's pin PA but vendor driver explicitly pin PA to gpio mode (for forrect calibration?) so I'm not sure that request for pa_pin in dts-file will be enough First 5 changes (really 2) improve performance for boards w/o eLNA/ePA. Changes 7 add support for eLNA Configuration w/o eLAN/ePA and with eLNA show results tx/rx (from router point of view) for each stream: 35-40/30-35 Mbps for HT20 65-70/60-65 Mbps for HT40 Yes. Max results for 2T2R client is 140-145/135-140 with peaks 160/150, It correspond to mediatek driver results. Boards with ePA untested. Reported-by: Serge Vasilugin <vasilugin@yandex.ru> Signed-off-by: Daniel Golle <daniel@makrotopia.org> [directly include v3 of the patchset submitted upstream] (cherry picked from commit 31a6605de04218e1c04bd5c2436c24d7d1c07506) (cherry picked from commit e785ca05e9f0502894772f5df92192b816ba5d7c) (cherry picked from commit 412fcf3d4400f84551f3ead0514834c62d94a251)
* mac80211: rt2x00: fix typoSungbo Eo2022-09-192-5/+3
| | | | | | | Add missing semicolon and refresh patches. Signed-off-by: Sungbo Eo <mans0n@gorani.run> (cherry picked from commit d826c91704d2baa5e389c225791740e4c61d62c4)
* mac80211: add patch descriptions to rt2x00 patchesDaniel Golle2022-09-186-1/+76
| | | | | | | | Prepare patches for sending upstream by adding patch descriptions generated from the original OpenWrt commits adding each patch. Signed-off-by: Daniel Golle <daniel@makrotopia.org> (cherry picked from commit d4feb66048f6a8f387eedfb162a1184cdae9d756)
* kernel: modules: package kmod-crypto-essivDaniel Golle2022-09-181-0/+12
| | | | | | | Package kernel module providing ESSIV support for block encryption. Signed-off-by: Daniel Golle <daniel@makrotopia.org> (cherry picked from commit 4133102898502c9bb453e8603b6c891aa103bce4)
* wireless-regdb: update to 2022-08-12Nick Hainke2022-09-171-2/+2
| | | | | | | | | | Changes: 9dc9c89 wireless-regdb: update regulatory database based on preceding changes 442bc25 wireless-regdb: update 5 GHz rules for PK and add 60 GHz rule daee7f3 wireless-regdb: add 5 GHz rules for GY Signed-off-by: Nick Hainke <vincent@systemli.org> (cherry picked from commit 1d2d69c810261308652a577fc136e7327e0e1358)
* kernel: build crypto md5/sha1/sha256 modules for powerpcJosef Schlehofer2022-09-171-1/+19
| | | | | | | | | | | | | | | | | This builds and enables kernel optimized modules for mpc85xx target: - CONFIG_CRYPTO_MD5_PPC [1] - CONFIG_CRYPTO_SHA1_PPC_SPE [2] - CONFIG_CRYPTO_SHA256_PPC_SPE [3] Where it was possible, then use Signal Processing Engine, because CONFIG_SPE is already enabled in mpc85xx config. [1] https://cateee.net/lkddb/web-lkddb/CRYPTO_MD5_PPC.html [2] https://cateee.net/lkddb/web-lkddb/CRYPTO_SHA1_PPC.html [3] https://cateee.net/lkddb/web-lkddb/CRYPTO_SHA256_PPC_SPE.html Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com> (cherry picked from commit 3a702f8733ff371f30e9e3ba1e1aed5f4686b6b4)
* mac80211: backport tx queueing bugfixes add a bug fix for a rare crashFelix Fietkau2022-09-154-0/+171
| | | | | | | | | | Re-introduce the queue wake fix that was reverted due to a regression, but this time with the follow-up fixes that take care of the regression. Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit 9a93b62f315ad4c9f021c414ed80ba337ab4a01e) (cherry-picked from commit 8b804cae5e039142bc63896a75f15146eca3bebc) (cherry-picked from commit 8b06e06832ebe757246582b65306ad2a2537741f)
* mt76: update to the latest versionFelix Fietkau2022-09-061-3/+3
| | | | | | | d70546462b7b mt76: fix 5 GHz connection regression on mt76x0/mt76x2 Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry-picked from commit 33c11442b2fc60313a2d3196c9b01cf9b0931305)
* hostapd: rename hostapd multicast_to_unicast option to multicast_to_unicast_allFelix Fietkau2022-09-061-5/+5
| | | | | | | | | | | | | | | | | | | | | There are two feature currently altered by the multicast_to_unicast option. 1. bridge level multicast_to_unicast via IGMP snooping 2. hostapd/mac80211 config multicast_to_unicast setting The hostapd/mac80211 setting has the side effect of converting *all* multicast or broadcast traffic into per-station duplicated unicast traffic, which can in some cases break expectations of various protocols. It also has been observed to cause ARP lookup failure between stations connected to the same interface. The bridge level feature is much more useful, since it only covers actual multicast traffic managed by IGMP, and it implicitly defaults to 1 already. Renaming the hostapd/mac80211 option to multicast_to_unicast_all should avoid unintentionally enabling this feature Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry-picked from commit 09ea1db93b53d2c1e4a081f20fbbddd4bffd451d)
* OpenWrt v22.03.0: revert to branch defaultsHauke Mehrtens2022-09-031-2/+2
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* OpenWrt v22.03.0: adjust config defaultsv22.03.0Hauke Mehrtens2022-09-031-2/+2
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* uboot-mediatek: mt7622: suppress unwanted pinctrl warningDaniel Golle2022-09-033-6/+47
| | | | | | | Import patch which removes the default pinctrl of uart0 to suppress the unwanted warning. Apply also to downstream boards. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* uboot-mediatek: backport fix for unstable UART on MT7622Daniel Golle2022-09-031-0/+26
| | | | | | | | | | | | | Import pending patch "arm: dts: mt7622: force high-speed mode for uart" from Weijie Gao <weijie.gao@mediatek.com> fixing the UART problems on MT7622 which made it hard to use the U-Boot menu on devices with this SoC. This patch is also contained in commit c09eb08dad ("uboot-mediatek: add support for MT798x platforms") in the development branch. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* uboot-mediatek: no compression means IH_COMP_NONEDaniel Golle2022-09-034-4/+121
| | | | | | | | | | | Treat missing compression node in FIT image as IH_COMP_NONE. This is implicentely already happening in most places, but for now was still triggering an annoying warning about initramfs compression being obsolete despite compression note being absent. Fix this. Signed-off-by: Daniel Golle <daniel@makrotopia.org> (cherry picked from commit 0a18456ffc25d6a26911fca6f9079090243c2284)
* uboot-mediatek: fix factory reset on UBIDaniel Golle2022-09-032-2/+2
| | | | | | | | Truncating a UBI volume using `ubi write 0x0 volname 0x0` results in segfault on newer U-Boot. Write 1MB of 0s instead. Signed-off-by: Daniel Golle <daniel@makrotopia.org> (cherry picked from commit d118cbdfece181994a96d1bcb1868bd807d481bf)
* uboot-envtools: mt7622: use 4k sectors for UniFi 6 LR (ubootmod)Daniel Golle2022-09-031-1/+1
| | | | | | | | | Use 4k sectors when accessing the U-Boot environment on the 64MiB SPI-NOR flash chip found in the UniFi 6 LR. The speeds up environment write access as only 4kB instead of 64kB have to be written. Signed-off-by: Daniel Golle <daniel@makrotopia.org> (cherry picked from commit f0adf253fdcf78ce005dad9652b405a4ad2726e6)
* uboot-mediatek: fix Ubiquiti UniFi 6 LR U-Boot modDaniel Golle2022-09-031-20/+8
| | | | | | | | Image names as well as the calculation of the padded image size did not work as intended. Fix that. Signed-off-by: Daniel Golle <daniel@makrotopia.org> (cherry picked from commit 0bc8889e7b4f19d7e33a9be6c3db918fed051501)
* at91bootstrap: use sdmmc0 as booting media for sama5d27_som1_ekClaudiu Beznea2022-09-021-7/+1
| | | | | | | | | | | Commit 0b7c66c ("at91bootstrap: add sama5d27_som1_eksd1_uboot as default defconfig") changed default booting media for sama5d27_som1_ek board w/o any reason. Changed it back to sdmmc0 as it is for all the other Microchip supported distributions for this board (Buildroot, Yocto Project). The initial commit cannot be cleanly reverted. Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com> (cherry picked from commit e9f12931e60ee291cd7d2c8fd19a14682dae0197)
* uboot-at91: use sdmmc0 as booting media for sama5d27_som1_ekClaudiu Beznea2022-09-021-3/+3
| | | | | | | | | | | | Commit adc69fe (""uboot-at91: changed som1 ek default defconfigs") changed the booting media to sdmmc1 as default booting w/o any reason. The Microchip releases for the rest of supported distributions (Buildroot, Yocto Project) uses sdmmc0 as default booting media for this board. Thus change it back to sdmmc0. With this remove references to sdmmc1 config. The initial commit cannot be cleanly reverted. Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com> (cherry picked from commit 9a49788008c18fd4fe6fefe9697962c102fb14c6)
* firewall4: update to latest Git HEADJo-Philipp Wich2022-09-011-3/+3
| | | | | | | | | f5fcdcf cli: introduce test mode and refuse firewall restart on errors a540f6d fw4: fix cosmetic issue with per-ruleset and per-table include paths 695e821 doc: fix swapped include positions in nftables.d README Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit ab31ffc425b59afc102f8a3275791c153f39c8f4)
* ucode: update to latest Git HEADJo-Philipp Wich2022-08-311-3/+3
| | | | | | | | | 344fa9e lib: extend render() to support function values 89452b2 lib: improve getenv() and split() implementations Signed-off-by: Jo-Philipp Wich <jo@mein.io> [fix commit subject] (cherry picked from commit c6d6306827e9296faad26981996825ce3e90259d)
* mac80211: disable ft-over-ds by defaultFelix Fietkau2022-08-301-1/+1
| | | | | | | | | Testing has shown it to be very unreliable in variety of configurations. It is not mandatory, so let's disable it by default until we have a better solution. Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry-picked from commit 2984a0420649733662ff95b0aff720b8c2c19f8a)
* mbedtls: update to version 2.28.1Hauke Mehrtens2022-08-283-24/+46
| | | | | | | | | | | | Changelog: https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.1 This release of Mbed TLS provides bug fixes and minor enhancements. This release includes fixes for security issues. The build problem was reported upstream: https://github.com/Mbed-TLS/mbedtls/issues/6243 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit f3870546a544c39c6fde2e7e014394aa085d8057)
* iptables: default to ip(6)tables-nft when using buildrootEtienne Champetier2022-08-281-2/+2
| | | | | | | | | 35fec487e30f05c81bd135326a993dad7f861812 fixed opkg usage, but when using buildroot we were still defaulting to ip(6)tables-legacy Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com> (cherry picked from commit 0c8d7e34ab35f6b41f034fd94fec740970e0125b)
* hostapd: fix WPA3 enterprise keys and ciphersJoerg Werner2022-08-261-3/+10
| | | | | | | | | WPA3 enterprise requires group_mgmt_cipher=BIP-GMAC-256 and if 802.11r is active also wpa_key_mgmt FT-EAP-SHA384. This commit also requires corresponding changes in netifd. Signed-off-by: Joerg Werner <schreibubi@gmail.com> (cherry picked from commit 9fbb76c0470fd54f1f34909b1098d0f76078878f)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-07 17:55:09 +0000