aboutsummaryrefslogtreecommitdiffstats
path: root/package
Commit message (Collapse)AuthorAgeFilesLines
* openssl: bump to 1.1.1qDustin Lundquist2022-07-171-2/+2
| | | | | | | | | | | | | | | | | | Changes between 1.1.1p and 1.1.1q [5 Jul 2022] *) AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation would not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. (CVE-2022-2097) [Alex Chernyakhovsky, David Benjamin, Alejandro Sedeño] Signed-off-by: Dustin Lundquist <dustin@null-ptr.net> (cherry picked from commit 3899f68b54b31de4b4fef4f575f7ea56dc93d965)
* openssl: bump to 1.1.1pAndre Heider2022-07-151-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes between 1.1.1o and 1.1.1p [21 Jun 2022] *) In addition to the c_rehash shell command injection identified in CVE-2022-1292, further bugs where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection have been fixed. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. (CVE-2022-2068) [Daniel Fiala, Tomáš Mráz] *) When OpenSSL TLS client is connecting without any supported elliptic curves and TLS-1.3 protocol is disabled the connection will no longer fail if a ciphersuite that does not use a key exchange based on elliptic curves can be negotiated. [Tomáš Mráz] Signed-off-by: Andre Heider <a.heider@gmail.com> (cherry picked from commit eb7d2abbf06f0a3fe700df5dc6b57ee90016f1f1)
* kernel: Remove kmod-crypto-lib-blake2sHauke Mehrtens2022-07-042-23/+0
| | | | | | | Delete the crypto-lib-blake2s kmod package, as BLAKE2s is now built-in. Fixes: be0639063a70 ("kernel: bump 5.4 to 5.4.203") Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* cryptodev-linux: update to 1.12Rosen Penev2022-07-032-35/+3
| | | | | | | | | Remove upstream backport. Use AUTORELEASE for simplicity. Signed-off-by: Rosen Penev <rosenp@gmail.com> (cherry picked from commit 585cef5f1a9c1c3aecd7d231364618e96d03ab65)
* openssl: bump to 1.1.1oEneas U de Queiroz2022-07-032-6/+6
| | | | | | | | | | | This release comes with a security fix related to c_rehash. OpenWrt does not ship or use it, so it was not affected by the bug. There is a fix for a possible crash in ERR_load_strings() when configured with no-err, which OpenWrt does by default. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com> (cherry picked from commit 7a5ddc0d06895bde7538d78c8dad2c863d70f946)
* exfat: update to 5.19.1Chukun Pan2022-07-011-2/+2
| | | | | | | | | | | | | | | | | | | Major changes are: 4 cleanups & typos fixes. Add keep_last_dots mount option to allow access to paths with trailing dots. Avoid repetitive volume dirty bit set/clear to improve storage life time. Fix ->i_blocks truncation issue caused by wrong 32bit mask. Fix ->i_blocks truncation issue that still exists elsewhere. Fix missing REQ_SYNC in exfat_update_bhs(). Fix referencing wrong parent directory information during rename. Fix slab-out-bounds in exat_clear_bitmap() reported from syzbot. Improve performance while zeroing a cluster with dirsync mount option. Introduce a sys_tz mount option to use system timezone. Move super block magic number to magic.h Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
* firewall: config: remove restictions on DHCPv6 allow ruleTiago Gaspar2022-05-042-4/+2
| | | | | | | | | | | | | | | Remove restrictions on source and destination addresses, which aren't specified on RFC8415, and for some reason in openwrt are configured to allow both link-local and ULA addresses. As cleared out in issue #5066 there are some ISPs that use Gloabal Unicast addresses, so fix this rule to allow them. Fixes: #5066 Signed-off-by: Tiago Gaspar <tiagogaspar8@gmail.com> [rebase onto firewall3, clarify subject, bump PKG_RELEASE] Signed-off-by: Jo-Philipp Wich <jo@mein.io> (backported from commit 65258f5d6093809c541050256646795bc0a460a9)
* iwinfo: drop obsolete patchJo-Philipp Wich2022-04-271-26/+0
| | | | | Fixes: 01cc5e195d ("iwinfo: update to latest Git HEAD") Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* iwinfo: update to latest HEADDavid Bauer2022-04-271-3/+3
| | | | | | | dc6847e iwinfo: nl80211: omit A-hwmode on non-5GHz hardware Signed-off-by: David Bauer <mail@david-bauer.net> (cherry picked from commit f757a8a09885e3c8bb76371e037b8c0731111980)
* hostapd: refresh patchesDavid Bauer2022-04-271-4/+4
| | | | Signed-off-by: David Bauer <mail@david-bauer.net>
* hostapd: add ubus link-measurements notificationsDavid Bauer2022-04-273-0/+43
| | | | | | | Notify external ubus subscribers of received link-measurement reports. Signed-off-by: David Bauer <mail@david-bauer.net> (cherry picked from commit f6445cfa1acb32676723c49da3e3158b64a4b3d2)
* hostapd: add ubus method for requesting link measurementsDavid Bauer2022-04-271-0/+65
| | | | | | | | | | | Add a ubus method to request link-measurements from connected STAs. In addition to the STAs address, the used and maximum transmit power can be provided by the external process for the link-measurement. If they are not provided, 0 is used as the default value. Signed-off-by: David Bauer <mail@david-bauer.net> (cherry picked from commit 965aa33a18c76bb2d5a1eeb0cfa01501b08e784a)
* hostapd: add support for enabling link measurementsDavid Bauer2022-04-271-0/+10
| | | | | | | | Allow external processes to enable advertisement of link-measurement RRM capability. Signed-off-by: David Bauer <mail@david-bauer.net> (cherry picked from commit 2ca5c3da04c3f05a7477ae484768e03d4ca30711)
* iwinfo: update to latest HEADDavid Bauer2022-04-271-3/+3
| | | | | | | | a479b9b devices: remove whitespace 562d015 iwinfo: nl80211: fix hwmode parsing for multi-band NICs Signed-off-by: David Bauer <mail@david-bauer.net> (cherry picked from commit 46980294f66ab07b79f9037758a7ea94072340df)
* iwinfo: update to latest Git headJosef Schlehofer2022-04-271-3/+3
| | | | | | | | | | Changelog: 90bfbb9 devices: Add Cypress CYW43455 234075b devices: fix AMD RZ608 format 0e2a318 devices: add AMD RZ608 device-id Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com> (cherry picked from commit 013b0435641ab12d9a896c29c213d90da64bc623)
* iwinfo: update to latest Git HEADJo-Philipp Wich2022-04-271-4/+4
| | | | | | | a0a0e02 iwinfo: rename hardware.txt to devices.txt Signed-off-by: Jo-Philipp Wich <jo@mein.io> (backported from commit c13d7c82aa4cd2cbf1f61bad857cd01b795318e3)
* iwinfo: update to the latest versionFelix Fietkau2022-04-271-3/+3
| | | | | | | c9b1672f5a83 nl80211: fix path compatibility issue Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit 019eca154557e2e2fefa67b4430cab622035c382)
* iwinfo: update to the latest versionFelix Fietkau2022-04-271-4/+4
| | | | | | | | | | aa0e3c4bbe12 iwinfo: nl80211: add support for printing the device path for a phy dd6d6d2dec35 iwinfo: nl80211: use new path lookup function for nl80211_phy_idx_from_uci_path 268bb26d2e2a iwinfo: nl80211: support looking up phy by path=.. and macaddr=... c0414642fead iwinfo: nl80211: fix typo Signed-off-by: Felix Fietkau <nbd@nbd.name> (backported from commit 6e8475bbd0c841043c1187fb5a42d835071ad502)
* wolfssl: fix compilation with /dev/cryptoEneas U de Queiroz2022-04-201-0/+19
| | | | | | | This is trivial fix of a duplicate definition of 'int ret'. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com> (cherry picked from commit df622768da10f36ceeb20346b4c4ee4eb9a8a9ad)
* mac80211: fix QCA9561 PA biasThibaut VARÈNE2022-04-191-0/+47
| | | | | | | | | | | | | | | This patch fixes an invalid TX PA DC bias level on QCA9561, which results in a very low output power and very low throughput as devices are further away from the AP (compared to other 2.4GHz APs), following a suggestion from nbd[1]. This patch has been submitted upstream[2]. [1] https://lore.kernel.org/all/91c58969-c60e-2f41-00ac-737786d435ae@nbd.name [2] https://lore.kernel.org/linux-wireless/20220417145145.1847-1-hacks+kernel@slashdirt.org/ Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org> (cherry-picked from 7dc52a78ae2c2f748a0c0c4adcb13979260b3498)
* OpenWrt v21.02.3: revert to branch defaultsHauke Mehrtens2022-04-171-2/+2
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* OpenWrt v21.02.3: adjust config defaultsv21.02.3Hauke Mehrtens2022-04-171-2/+2
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* ath79: add support for Yuncore A930Thibaut VARÈNE2022-04-161-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Specification: - QCA9533 (650 MHz), 64 or 128MB RAM, 16MB SPI NOR - 2x 10/100 Mbps Ethernet, with 802.3at PoE support (WAN) - 2T2R 802.11b/g/n 2.4GHz Flash instructions: If your device comes with generic QSDK based firmware, you can login over telnet (login: root, empty password, default IP: 192.168.188.253), issue first (important!) 'fw_setenv' command and then perform regular upgrade, using 'sysupgrade -n -F ...' (you can use 'wget' to download image to the device, SSH server is not available): fw_setenv bootcmd "bootm 0x9f050000 || bootm 0x9fe80000" sysupgrade -n -F openwrt-...-yuncore_...-squashfs-sysupgrade.bin In case your device runs firmware with YunCore custom GUI, you can use U-Boot recovery mode: 1. Set a static IP 192.168.0.141/24 on PC and start TFTP server with 'tftp' image renamed to 'upgrade.bin' 2. Power the device with reset button pressed and release it after 5-7 seconds, recovery mode should start downloading image from server (unfortunately, there is no visible indication that recovery got enabled - in case of problems check TFTP server logs) Signed-off-by: Clemens Hopfer <openwrt@wireloss.net> Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org> (cherry-picked from commit a05dcb07241aa83a4416b56201e31b4af8518981) [switch to mtd-mac-address instead of nvmem-cells]
* ath79: add support for Yuncore XD3200Thibaut VARÈNE2022-04-161-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Specification: - QCA9563 (775MHz), 128MB RAM, 16MB SPI NOR - 2T2R 802.11b/g/n 2.4GHz - 2T2R 802.11n/ac 5GHz - 2x 10/100/1000 Mbps Ethernet, with 802.3at PoE support (WAN port) LED for 5 GHz WLAN is currently not supported as it is connected directly to the QCA9882 radio chip. Flash instructions: If your device comes with generic QSDK based firmware, you can login over telnet (login: root, empty password, default IP: 192.168.188.253), issue first (important!) 'fw_setenv' command and then perform regular upgrade, using 'sysupgrade -n -F ...' (you can use 'wget' to download image to the device, SSH server is not available): fw_setenv bootcmd "bootm 0x9f050000 || bootm 0x9fe80000" sysupgrade -n -F openwrt-...-yuncore_...-squashfs-sysupgrade.bin In case your device runs firmware with YunCore custom GUI, you can use U-Boot recovery mode: 1. Set a static IP 192.168.0.141/24 on PC and start TFTP server with 'tftp' image renamed to 'upgrade.bin' 2. Power the device with reset button pressed and release it after 5-7 seconds, recovery mode should start downloading image from server (unfortunately, there is no visible indication that recovery got enabled - in case of problems check TFTP server logs) Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org> (cherry-picked from commit c91df224f54fdd44c9c0487a8c91876f5d273164)
* wolfssl: bump to 5.2.0Eneas U de Queiroz2022-04-114-9/+7
| | | | | | | | | | | | | | | | | Fixes two high-severity vulnerabilities: - CVE-2022-25640: A TLS v1.3 server who requires mutual authentication can be bypassed. If a malicious client does not send the certificate_verify message a client can connect without presenting a certificate even if the server requires one. - CVE-2022-25638: A TLS v1.3 client attempting to authenticate a TLS v1.3 server can have its certificate heck bypassed. If the sig_algo in the certificate_verify message is different than the certificate message checking may be bypassed. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com> (cherry picked from commit e89f3e85eb1c1d81294e5d430a91b0ba625e2ec0)
* mac80211: Update to version 5.10.110-1Hauke Mehrtens2022-04-1121-224/+73
| | | | | | | | | | | This updates mac80211 to version 5.10.110-1 which is based on kernel 5.10.110. The removed patches were applied upstream. This new release contains many fixes which were merged into the upstream Linux kernel. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* bpftools: fix feature override for masking clangTony Ambardar2022-04-111-1/+1
| | | | | | | | | | Rename feature variable clang-bpf-global-var following upstream changes. This restores the HAVE_CLANG feature override and should avoid rare build errors where a recent host clang and BTF-enabled host kernel are present. Fixes: 23be333401f0 ("bpftools: update to 5.10.10") Signed-off-by: Tony Ambardar <itugrok@yahoo.com> (cherry picked from commit cf20f1bb5f0479c2509dd651d08e235a3b9e8755)
* cypress-firmware: drop several packagesJosef Schlehofer2022-03-261-54/+0
| | | | | | | | | | | | | | | | | | | | | | | | | 1. Drop package: cypress-firmware-4359-pcie This binary is no longer provided and there are not many details what happened. 2. Drop package: cypress-firmware-4359-sdio This binary is no longer provided, but in this case, to compare it with PCIe package mention as first, there was added support in Linux-firmware [1], but no sign of firmware file. 4. Drop package: cypress-firmware-89459-pcie [2] According to Infineon: "CYW89459 is an automotive Wi-Fi chip which is not supported in the broad market community." [1] https://patchwork.kernel.org/project/linux-wireless/patch/20191211235253.2539-6-smoch@web.de/ [2] https://community.infineon.com/t5/Wi-Fi-Bluetooth-for-Linux/the-wifi-driver-for-CYW89459-in-linux4-14-98-2-3-00/m-p/138971 Fixes: 7ca7e0b22de6e629f5df12b8a935a168073bcca3 ("cypress-firmware: update it to version 5.4.18-2021_0812") Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com> (cherry picked from commit 8c66bf89d1e8e67d8a3537e164bb7d9669259c08)
* cypress-firmware: update it to version 5.4.18-2021_0812Josef Schlehofer2022-03-261-38/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Binary files were renamed to cyfmac from brcmfmac, but the files needs to be on the router with the previous naming [ 6.656165] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43455-sdio for chip BCM4345/6 [ 6.665182] brcmfmac mmc1:0001:1: Direct firmware load for brcm/brcmfmac43455-sdio.bin failed with error -2 [ 6.674928] brcmfmac mmc1:0001:1: Falling back to sysfs fallback for: brcm/brcmfmac43455-sdio.bin - Cypress were acquired by Infineon Technologies Thus change the project URL and switch to download files from their GitHub repository. This is much better than the previous solution, which requires finding new threads on their community forum about new driver updates, and it will be necessary to change the URL each time. Unfortunately, it seems that there is not published changelog, but according to this forum thread [1], be careful by opening the link from solution since it contains ending bracket ), it brings fixes for various security vulnerabilities, which were fixed in 7_45_234. Fixes: - FragAttacks - Kr00k Also add LICENSE file Run tested on Seeedstudio router powered by Raspberry Pi 4 CM with package cypress-firmware-43455-sdio. Before: root@OpenWrt:~# dmesg | grep 'Firmware: BCM4345/6' [ 6.895050] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4345/6 wl0: Mar 23 2020 02:20:01 version 7.45.206 (r725000 CY) FWID 01-febaba43 After: root@OpenWrt:~# dmesg | grep 'Firmware: BCM4345/6' [ 6.829805] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4345/6 wl0: Apr 15 2021 03:03:20 version 7.45.234 (4ca95bb CY) FWID 01-996384e2 [1] https://community.infineon.com/t5/Wi-Fi-Bluetooth-for-Linux/Outdated-brcmfmac-firmware-for-Raspberry-Pi-4-in-OpenWrt-21-02-1/m-p/331593#M2269 Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com> (cherry picked from commit 7ca7e0b22de6e629f5df12b8a935a168073bcca3)
* zlib: backport security fix for a reproducible crash in compressorPetr Štetiar2022-03-242-1/+344
| | | | | | | | | | | | | | | | Tavis has just reported, that he was recently trying to track down a reproducible crash in a compressor. Believe it or not, it really was a bug in zlib-1.2.11 when compressing (not decompressing!) certain inputs. Tavis has reported it upstream, but it turns out the issue has been public since 2018, but the patch never made it into a release. As far as he knows, nobody ever assigned it a CVE. Suggested-by: Tavis Ormandy <taviso@gmail.com> References: https://www.openwall.com/lists/oss-security/2022/03/24/1 Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit b3aa2909a79aeff20d594160b207a89dc807c033) (cherry picked from commit 3965dda0fa70dc9408f1a2e55a3ddefde78bd50e)
* hostapd: add STA extended capabilities to get_clientsDavid Bauer2022-03-201-0/+10
| | | | | | | | | | | Add the STAs extended capabilities to the ubus STA information. This way, external daemons can be made aware of a STAs capabilities. This field is of an array type and contains 0 or more bytes of a STAs advertised extended capabilities. Signed-off-by: David Bauer <mail@david-bauer.net> (cherry picked from commit 6f787239771044ed7eeaf22301c543b699f25cb4)
* hostapd: add op-class to get_status outputDavid Bauer2022-03-201-1/+8
| | | | | | | Include the current operation class to hostapd get_status interface. Signed-off-by: David Bauer <mail@david-bauer.net> (cherry picked from commit 2a31e9ca975d99b6216b2979a825f07253c8947e)
* hostapd: add beacon_interval to get_status ubus outputDavid Bauer2022-03-201-0/+1
| | | | | | | | | | | Add the beacon interval to hostapd status output. This allows external services to discover the beacon interval for a specific VAP. This way, external wireless management daemons can correctly calculate fields containing TBTT value from absolute time-values. Signed-off-by: David Bauer <mail@david-bauer.net> (cherry picked from commit 3ba98468424db1f081818982dfa2a07ab85ae136)
* hostapd: remove unused mac_buff allocationMartin Weinelt2022-03-201-1/+0
| | | | | Signed-off-by: Martin Weinelt <hexa@darmstadt.ccc.de> (cherry picked from commit cde154c8712255d13658317b116d4fc341ed89f2)
* hostapd: report bssid, ssid and channel over ubusMartin Weinelt2022-03-201-0/+38
| | | | | | | | | | Imports a function from iw to convert frequencies to channel numbers. Co-authored-by: David Bauer <mail@david-bauer.net> Signed-off-by: Martin Weinelt <hexa@darmstadt.ccc.de> [fix potential out of bounds read] Signed-off-by: David Bauer <mail@david-bauer.net> (cherry picked from commit 398df6275674b637bc950e4f946f84c2bc5e09ff)
* hostapd: ubus: add notification for BSS transition responseDavid Bauer2022-03-203-0/+74
| | | | | | | | | | To allow steering daemons to be aware of the STA-decided transition target, publish WNM transition responses to ubus. This way, steerings daemons can learn about STA-chosen targets and send a better selection of transition candidates. Signed-off-by: David Bauer <mail@david-bauer.net> (cherry picked from commit a3de42e72ce349c14263737c5d6ec7b00397cf14)
* hostapd: ubus: add BSS transtiton request methodDavid Bauer2022-03-201-40/+112
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The existing wnm_disassoc_imminent ubus method only supports issuing a bss transition request with the disassoc imminent flag set. For use-cases, where the client is requested to roam to another BSS without a pending disassoc, this existing method is not suitable. Add a new bss_transition_request ubus method, which provides a more universal way to dispatch a transition request. It takes the following arguments: Required: addr: String - MAC-address of the STA to send the request to (colon-seperated) Optional: abridged - Bool - Indicates if the abridged flag is set disassociation_imminent: Bool - Whether or not the disassoc_imminent flag is set disassociation_timer: I32 - number of TBTTs after which the client will be disassociated validity_period: I32 - number of TBTTs after which the beacon candidate list (if included) will be invalid neighbors: blob-array - Array of strings containing neighbor reports as hex-string Signed-off-by: David Bauer <mail@david-bauer.net> (cherry picked from commit 0eed96ca5d86bdc4158c8ef6814893bc2a3dc467)
* openssl: bump to 1.1.1nMartin Schiller2022-03-161-2/+2
| | | | | | | | | | | | | | This is a bugfix release. Changelog: *) Fixed a bug in the BN_mod_sqrt() function that can cause it to loop forever for non-prime moduli. (CVE-2022-0778) *) Add ciphersuites based on DHE_PSK (RFC 4279) and ECDHE_PSK (RFC 5489) to the list of ciphersuites providing Perfect Forward Secrecy as required by SECLEVEL >= 3. Signed-off-by: Martin Schiller <ms@dev.tdt.de> (cherry picked from commit e17c6ee62770005e398364ee5d955c9a8ab6f016)
* uboot-bcm4908: use "xxd" from staging_dirRafał Miłecki2022-03-151-4/+4
| | | | | | | | | | This fixes: bash: xxd: command not found on hosts without xxd installed. Signed-off-by: Rafał Miłecki <rafal@milecki.pl> (cherry picked from commit 9dbca6bf6e6e088afd18fb532ed9135c21aec1cc) Fixes: 45b3f2aa0f57 ("uboot-bcm4908: add package with BCM4908 U-Boot")
* base-files: call "sync" after initial setupRafał Miłecki2022-03-141-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenWrt uses a lot of (b)ash scripts for initial setup. This isn't the best solution as they almost never consider syncing files / data. Still this is what we have and we need to try living with it. Without proper syncing OpenWrt can easily get into an inconsistent state on power cut. It's because: 1. Actual (flash) inode and data writes are not synchronized 2. Data writeback can take up to 30 seconds (dirty_expire_centisecs) 3. ubifs adds extra 5 seconds (dirty_writeback_centisecs) "delay" Some possible cases (examples) for new files: 1. Power cut during 5 seconds after write() can result in all data loss 2. Power cut happening between 5 and 35 seconds after write() can result in empty file (inode flushed after 5 seconds, data flush queued) Above affects e.g. uci-defaults. After executing some migration script it may get deleted (whited out) without generated data getting actually written. Power cut will result in missing data and deleted file. There are three ways of dealing with that: 1. Rewriting all user-space init to proper C with syncs 2. Trying bash hacks (like creating tmp files & moving them) 3. Adding sync and hoping for no power cut during critical section This change introduces the last solution that is the simplest. It reduces time during which things may go wrong from ~35 seconds to probably less than a second. Of course it applies only to IO operations performed before /etc/init.d/boot . It's probably the stage when the most new files get created. All later changes are usually done using smarter C apps (e.g. busybox or uci) that creates tmp files and uses rename() that is expected to be atomic. Signed-off-by: Rafał Miłecki <rafal@milecki.pl> Acked-by: Hauke Mehrtens <hauke@hauke-m.de> Acked-by: Sergey Ryazanov <ryazanov.s.a@gmail.com> (cherry picked from commit 9851d4b6ce6e89d164a04803817625a9041b060a)
* uboot-bcm4908: add package with BCM4908 U-BootRafał Miłecki2022-03-145-0/+205
| | | | | | | | New BCM4908 devices come with U-Boot instead of CFE. Firmwares for such devices has to include U-Boot. Signed-off-by: Rafał Miłecki <rafal@milecki.pl> (cherry picked from commit 0d45e1ea96ef29649f080c54f99fb1c80482421b)
* uboot-envtools: mvebu: update uci defaults for Turris OmniaMarek Behún2022-03-021-1/+4
| | | | | | | | | | | | | | From version 2021.09 U-Boot will fixup Turris Omnia's DTB before booting, separating U-Boot's environment into separate MTD partition "u-boot-env" [1]. Check if "u-boot-env" MTD partition exists and set the uci defaults accordingly. [1] https://lists.denx.de/pipermail/u-boot/2021-July/455017.html Signed-off-by: Marek Behún <marek.behun@nic.cz> (cherry picked from commit 713be7543909b79fbbccdea297e306cb3d3adb0c)
* hostapd: fix radius problem due to invalid attributesJohn Crispin2022-02-262-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The offending commit caused the configuration file to contain: radius_auth_req_attr= radius_acct_req_attr= which cause hostapd to add an ATTR of type 0 into the messages. hostapd: RADIUS message: code=4 (Accounting-Request) identifier=0 length=93 hostapd: Attribute 40 (Acct-Status-Type) length=6 hostapd: Value: 7 hostapd: Attribute 30 (Called-Station-Id) length=28 hostapd: Value: 'C4-41-1E-F5-2D-55:OpenWifi' hostapd: Attribute 61 (NAS-Port-Type) length=6 hostapd: Value: 19 hostapd: Attribute 0 (?Unknown?) length=3 <---------------- hostapd: Attribute 55 (Event-Timestamp) length=6 hostapd: Value: 1622726457 hostapd: Attribute 41 (Acct-Delay-Time) length=6 hostapd: Value: 0 hostapd: Attribute 44 (Acct-Session-Id) length=18 hostapd: Value: '9B5961E7235AAEC6' Closes: #9315 Fixes: ce7a17041486 ("hostapd: add additional radius options") Signed-off-by: John Crispin <john@phrozen.org> Signed-off-by: Petr Štetiar <ynezz@true.cz> [pkg version bump] (cherry picked from commit 96e9c81aabe9e14d6ec75c3f238c4ca7389b92a8)
* wolfssl: fix API breakage of SSL_get_verify_resultPetr Štetiar2022-02-221-0/+26
| | | | | | | | | | | | | | | | | | | Backport fix for API breakage of SSL_get_verify_result() introduced in v5.1.1-stable. In v4.8.1-stable SSL_get_verify_result() used to return X509_V_OK when used on LE powered sites or other sites utilizing relaxed/alternative cert chain validation feature. After an update to v5.1.1-stable that API calls started returning X509_V_ERR_INVALID_CA error and thus rendered all such connection attempts imposible: $ docker run -it openwrt/rootfs:x86_64-21.02.2 sh -c "wget https://letsencrypt.org" Downloading 'https://letsencrypt.org' Connecting to 18.159.128.50:443 Connection error: Invalid SSL certificate Fixes: #9283 References: https://github.com/wolfSSL/wolfssl/issues/4879 Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit b9251e3b407592f3114e739231088c3d27663c4c)
* rpcd: backport 802.11ax supportŠimon Bořek2022-02-191-3/+3
| | | | | | | | | | | Backport of commit 7a560a1a5769 ("iwinfo: add 802.11ax HE support"). enables 802.11ax capability detection through ubus in OpenWrt 21.02 (e.g. with MT7915E 802.11ax PCI Express Wireless Network Adapter) Signed-off-by: Šimon Bořek <simon.borek@nic.cz> [commit message facelift, use openwrt-21.02 branch] Signed-off-by: Petr Štetiar <ynezz@true.cz>
* OpenWrt v21.02.2: revert to branch defaultsHauke Mehrtens2022-02-171-2/+2
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* OpenWrt v21.02.2: adjust config defaultsv21.02.2Hauke Mehrtens2022-02-171-2/+2
| | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* tcpdump: Fix CVE-2018-16301Hauke Mehrtens2022-02-132-1/+102
| | | | | | | | | | | | This fixes the following security problem: The command-line argument parser in tcpdump before 4.99.0 has a buffer overflow in tcpdump.c:read_infile(). To trigger this vulnerability the attacker needs to create a 4GB file on the local filesystem and to specify the file name as the value of the -F command-line argument of tcpdump. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit 8f5875c4e221453932f217a82f8c3092cacba3e5)
* hostapd: Apply SAE/EAP-pwd side-channel attack update 2Hauke Mehrtens2022-02-134-1/+268
| | | | | | | | | This fixes some recent security problems in hostapd. See here for details: https://w1.fi/security/2022-1 * CVE-2022-23303 * CVE-2022-23304 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* wolfssl: update to 5.1.1-stableSergey V. Lobanov2022-02-135-144/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Bump from 4.8.1-stable to 5.1.1-stable Detailed release notes: https://github.com/wolfSSL/wolfssl/releases Upstreamed patches: 001-Maths-x86-asm-change-asm-snippets-to-get-compiling.patch - https://github.com/wolfSSL/wolfssl/commit/fa8f23284d4689c2a737204b337b58d966dcbd8c 002-Update-macro-guard-on-SHA256-transform-call.patch - https://github.com/wolfSSL/wolfssl/commit/f447e4c1fa4c932c0286fa0331966756e243db81 Refreshed patches: 100-disable-hardening-check.patch 200-ecc-rng.patch CFLAG -DWOLFSSL_ALT_CERT_CHAINS replaced to --enable-altcertchains configure option The size of the ipk changed on aarch64 like this: 491341 libwolfssl4.8.1.31258522_4.8.1-stable-7_aarch64_cortex-a53.ipk 520322 libwolfssl5.1.1.31258522_5.1.1-stable-1_aarch64_cortex-a53.ipk Tested-by: Alozxy <alozxy@users.noreply.github.com> Acked-by: Eneas U de Queiroz <cotequeiroz@gmail.com> Signed-off-by: Sergey V. Lobanov <sergey@lobanov.in> (cherry picked from commit 93d91197b98463277b601ec2653351666a4ca4bd)
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-26 17:09:09 +0000