summaryrefslogtreecommitdiffstats
path: root/package
Commit message (Collapse)AuthorAgeFilesLines
...
* OpenWrt v18.06.5: revert to branch defaultsJo-Philipp Wich2019-11-081-2/+2
| | | | Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* OpenWrt v18.06.5: adjust config defaultsv18.06.5Jo-Philipp Wich2019-11-081-2/+2
| | | | Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* ustream-ssl: backport fix for CVE-2019-5101, CVE-2019-5102Jo-Philipp Wich2019-11-052-1/+57
| | | | | Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit c5d5cdb759adc890ce6699117b7119acf280ce77)
* kernel: mark kmod-usb-serial-wwan as hiddenYousong Zhou2019-10-301-2/+2
| | | | | | | | | | The kconfig symbol is an invisible one since its introduction. It is not supposed to be enabled on its own. Resolves FS#1821 Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com> (cherry picked from commit 4bf9bec361699e1c033460964158531adf15d7ee)
* iptables: bump PKG_RELEASEYousong Zhou2019-10-241-1/+1
| | | | | | | | | Package content changed with the previous two cherry-picks dff0b2104d kernel: netfilter: Add nf_tproxy_ipv{4,6} and nf_socket_ipv{4,6} a2fe698a40 kernel: Added required dependencies for socket match. Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* kernel: Added required dependencies for socket match.Oldřich Jedlička2019-10-241-0/+2
| | | | | | | | | | | | | | | | | This applies to kernel 4.10 and newer. See https://github.com/torvalds/linux/commit/8db4c5be88f62ffd7a552f70687a10c614dc697b The above commit added to kernel 4.10 added new dependency for building the NETFILTER_XT_MATCH_SOCKET (xt_socket.ko) module. The NF_SOCKET_IPVx options (both of them) need to be enabled in order to build the NETFILTER_XT_MATCH_SOCKET module. Without the change the module is not built. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com> (cherry picked from commit 66e875a07033cdcfd8c4a16940d4acfe63c60202) (required for fixing FS#2531) Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* tcpdump: update to 4.9.3DENG Qingfang2019-10-194-19/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixed CVEs: CVE-2017-16808 CVE-2018-10103 CVE-2018-10105 CVE-2018-14461 CVE-2018-14462 CVE-2018-14463 CVE-2018-14464 CVE-2018-14465 CVE-2018-14466 CVE-2018-14467 CVE-2018-14468 CVE-2018-14469 CVE-2018-14470 CVE-2018-14879 CVE-2018-14880 CVE-2018-14881 CVE-2018-14882 CVE-2018-16227 CVE-2018-16228 CVE-2018-16229 CVE-2018-16230 CVE-2018-16300 CVE-2018-16301 CVE-2018-16451 CVE-2018-16452 CVE-2019-15166 CVE-2019-15167 Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn> (cherry picked from commit 394273c066b8f4317b77f3ede216cfcdd45250c1)
* libpcap: update to 1.9.1DENG Qingfang2019-10-195-15/+18
| | | | | | | | | | | | | Fixed CVEs: CVE-2018-16301 CVE-2019-15161 CVE-2019-15162 CVE-2019-15163 CVE-2019-15164 CVE-2019-15165 Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn> (cherry picked from commit 44f11353de044834a442d3192b66579b99305720)
* libpcap: update to 1.9.0Syrone Wong2019-10-199-306/+50
| | | | | | | | | | | | | 001-Fix-compiler_state_t.ai-usage-when-INET6-is-not-defi.patch dropped due to upstream 002-Add-missing-compiler_state_t-parameter.patch dropped due to upstream 202-protocol_api.patch dropped due to implemented upstream by another way upstream commit: https://github.com/the-tcpdump-group/libpcap/commit/55c690f6f834b4762697d7a134de439c9096c921 and renamed via: https://github.com/the-tcpdump-group/libpcap/commit/697b1f7e9b1d6f5a5be04f821d7c5dc62458bb3b ead is the only user who use the protocol api, we have to use the new api since libpcap 1.9.0 Signed-off-by: Syrone Wong <wong.syrone@gmail.com>
* hostapd: Fix AP mode PMF disconnection protection bypassHauke Mehrtens2019-09-214-6/+72
| | | | | | | | | This fixes * CVE-2019-16275 AP mode PMF disconnection protection bypass https://w1.fi/security/2019-7/ap-mode-pmf-disconnection-protection-bypass.txt Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit a6981604b30bc1ddc1713b368fe853d89c2ba40d)
* hostapd: SAE/EAP-pwd side-channel attack updateHauke Mehrtens2019-09-219-1/+397
| | | | | | | | | Fixes this security problem: * SAE/EAP-pwd side-channel attack update https://w1.fi/security/2019-6/sae-eap-pwd-side-channel-attack-update.txt Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit 7bed9bf10fc8d05df34c7efc66e8b4ade37a1a0c)
* mbedtls: update to 2.16.3Magnus Kroken2019-09-214-62/+35
| | | | | | | | Remove 300-bn_mul.h-Use-optimized-MULADDC-code-only-on-ARM-6.patch, the issue has been fixed upstream. Signed-off-by: Magnus Kroken <mkroken@gmail.com> (cherry picked from commit 49d96ffc5c47e40b7f3d99a91a42ea8a54a38bd9)
* mbedtls: Update to version 2.16.2Josef Schlehofer2019-09-212-4/+4
| | | | | Signed-off-by: Josef Schlehofer <josef.schlehofer@nic.cz> (cherry picked from commit a2f54f6d5d98211e9c58420eed8c67f4fca83665)
* openssl: bump to 1.0.2t, add maintainerEneas U de Queiroz2019-09-202-3/+4
| | | | | | | | | | | | | This version fixes 3 low-severity vulnerabilities: - CVE-2019-1547: ECDSA remote timing attack - CVE-2019-1549: Fork Protection - CVE-2019-1563: Padding Oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey Patches were refreshed, and Eneas U de Queiroz added as maintainer. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
* mac80211: brcmfmac: backport the last 5.4 changesRafał Miłecki2019-09-164-1/+402
| | | | | | | | This makes brcmfmac use the same wiphy after PCIe reset to help user space handle corner cases (e.g. firmware crash). Signed-off-by: Rafał Miłecki <rafal@milecki.pl> (cherry picked from commit f39f4b2f6d4300995270f635261b07197e8cf61e)
* mac80211: brcmfmac: backport more kernel 5.4 changesRafał Miłecki2019-09-098-9/+283
| | | | | | | | Patch getting RAM info got upstreamed. A debugging fs entry for testing reset feature was added. Signed-off-by: Rafał Miłecki <rafal@milecki.pl> (cherry picked from commit 681acdcc54d2e59135bb706c38bed942f74ccf74)
* bzip2: Fix CVE-2019-12900Josef Schlehofer2019-09-032-1/+66
| | | | | | | More details about this CVE: https://nvd.nist.gov/vuln/detail/CVE-2019-12900 Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* ath9k: backport dynack improvementsKoen Vandeputte2019-08-284-0/+300
| | | | | | | | | | | | | | | | | | | | | | | | | | | Close cooperation with Lorenzo Bianconi resulted in these patches which fix all remaining seen issues when using dynack. Fix link losses when: - Late Ack's are not seen or not present - switching from too low static coverage class to dynack on a live link These are fixed by setting the Ack Timeout/Slottime to the max possible value for the currently used channel width when a new station has been discovered. When traffic flows, dynack is able to adjust to optimal values within a few packets received (typically < 1 second) These changes have been thoroughly tested on ~60 offshore devices all interconnected using mesh over IBSS and dynack enabled on all. Distances between devices varied from <100m up to ~35km [move patches to correct folder + renumber] Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> (cherry picked from commit f6e8ba0238fe349b7529357793e2fb18635819ed)
* iptables: patch CVE-2019-11360 (security fix)Jan Pavlinec2019-08-172-1/+14
| | | | Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
* musl: ldso/dlsym: fix mips returning undef dlsymLuiz Angelo Daros de Luca2019-08-171-1/+1
| | | | | | | | | | | | | | | This happens only the second time a library is loaded by dlopen(). After lib1 is loaded, dlsym(lib1,"undef1") correctly resolves the undef symbol from lib1 dependencies. After the second library is loaded, dlsym(lib2,"undef1") was returning the address of "undef1" in lib2 instead of searching lib2 dependencies. Backporting upstream fix which now uses the same logic for relocation time and dlsym. Fixes openwrt/packages#9297 Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
* wolfssl: fixes for CVE-2018-16870 & CVE-2019-13628Eneas U de Queiroz2019-08-174-4/+665
| | | | | | | | | | | | | CVE-2018-16870: medium-severity, new variant of the Bleichenbacher attack to perform downgrade attacks against TLS, which may lead to leakage of sensible data. Backported from 3.15.7. CVE-2019-13628 (currently assigned-only): potential leak of nonce sizes when performing ECDSA signing operations. The leak is considered to be difficult to exploit but it could potentially be used maliciously to perform a lattice based timing attack. Backported from 4.1.0. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
* xfsprogs: Replace valloc with posix_memalignRosen Penev2019-08-142-1/+32
| | | | | | | Fixes compilation under uClibc-ng. Signed-off-by: Rosen Penev <rosenp@gmail.com> (cherry picked from commit e49b6bb61828b8b903db0ef48113b4065a215c63)
* libbsd: Fix compilation under ARCRosen Penev2019-08-142-1/+31
| | | | | | | | | The 8 year old file does not have any ARC definitions. Signed-off-by: Rosen Penev <rosenp@gmail.com> [updated content of the patch with version sent to upstream] Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit 395bef4bbacc0dd1cca72907529539194504be27)
* nftables: Fix compilation with uClibc-ngRosen Penev2019-08-142-1/+29
| | | | | | | | | Missing header for va_list. Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Petr Štetiar <ynezz@true.cz> [updated with upstream version of the patch] (cherry picked from commit 2f977974714468e1a0ee20e4cce233da63d06dd0)
* config: introduce separate CONFIG_SIGNATURE_CHECK optionJo-Philipp Wich2019-08-071-2/+2
| | | | | | | | | | | | | | | | | | | | Introduce a new option CONFIG_SIGNATURE_CHECK which defaults to the value of CONFIG_SIGNED_PACKAGES and thus is enabled by default. This option is needed to support building target opkg with enabled signature verification while having the signed package lists disabled. Our buildbots currently disable package signing globally in the buildroot and SDK to avoid the need to ship private signing keys to the build workers and to prevent the triggering of random key generation on the worker nodes since package signing happens off-line on the master nodes. As unintended side-effect, updated opkg packages will get built with disabled signature verification, hence the need for a new override option. Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit f565f276e2c06ac8f3176e0b16d6f2d40cd653d4)
* packages: apply usign padding workarounds to package indexes if neededJo-Philipp Wich2019-08-071-2/+6
| | | | | | | | | | | | | | | Since usign miscalculates SHA-512 digests for input sizes of exactly 64 + N * 128 + 110 or 64 + N * 128 + 111 bytes, we need to apply some white space padding to avoid triggering the hashing edge case. While usign itself has been fixed already, there is still many firmwares in the wild which use broken usign versions to verify current package indexes so we'll need to carry this workaround in the forseeable future. Ref: https://forum.openwrt.org/t/signature-check-failed/41945 Ref: https://git.openwrt.org/5a52b379902471cef495687547c7b568142f66d2 Signed-off-by: Jo-Philipp Wich <jo@mein.io> (backported from commit e1f588e446c7ceb696b644b37aeab9b3476e2a57)
* usign: update to latest Git HEADJo-Philipp Wich2019-08-061-3/+3
| | | | | | | | | | | | | | | This update fixes usign signature verification on files with certain file sizes triggering a bug in the shipped SHA-512 implementation. 5a52b37 sha512: fix bad hardcoded constant in sha512_final() 3e6648b README: replace unicode character 716c3f2 README: add reference to OpenBSD signify 86d3668 README: provide reference for ed25519 algorithm 939ec35 usign: main.c: describe necessary arguments for -G Ref: https://forum.openwrt.org/t/signature-check-failed/41945 Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit 991dd5a89340367920315a3fd0390a7423e6b34a)
* mac80211: brcm: improve brcmfmac debugging of firmware crashesRafał Miłecki2019-07-282-1/+39
| | | | | | This provides a complete console messages dump. Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* mac80211: brcm: update brcmfmac 5.4 patchesRafał Miłecki2019-07-288-18/+26
| | | | | | Use commits from wireless-drivers-next.git. Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* omcproxy: fix compilation on little-endian CPUsEneas U de Queiroz2019-07-232-1/+36
| | | | | | | | | | | | | | | | | Don't use cpu_to_be32 outside of a function. In file included from /omcproxy-2017-02-14-1fe6f48f/src/omcproxy.h:51:0, from omcproxy-2017-02-14-1fe6f48f/src/mrib.c:39: omcproxy-2017-02-14-1fe6f48f/src/mrib.c:57:34: error: braced-group within expression allowed only inside a function static uint32_t ipv4_rtr_alert = cpu_to_be32(0x94040000); ^ cc1: warning: unrecognized command line option '-Wno-gnu' Ref: https://downloads.openwrt.org/releases/faillogs-18.06/arm_cortex-a9_vfpv3/base/omcproxy/compile.txt Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com> [more verbose commit message] Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit cb4d00d1841ef6269114f2bd3880800dbdfba3b1)
* mac80211: brcmfmac: backport fixes from kernel 5.4Rafał Miłecki2019-07-2211-2/+519
| | | | | | | | | This fixes: 1) Crash during USB disconnect 2) Crash in brcmf_txfinalize() on rmmod with packets queued 3) Some errors in exit path Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* busybox: strip off ALTERNATIVES specYousong Zhou2019-07-121-14/+2
| | | | | | | | Now that busybox is a known alternatives provider by opkg, we remove the ALTERNATIVES spec and add a note to make the implicit situation clear Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com> (cherry-picked from 62be427067ee3883b68bcfb08dfc0c43dce22fa3)
* opkg: bump to version 2019-06-14Yousong Zhou2019-07-121-3/+3
| | | | | | | | | | | | | | | Changelog dcbc142 alternatives: remove duplicate 'const' specifier 21b7bd7 alternatives: special-case busybox as alternatives provider d4ba162 libopkg: only perform size check when information is available cb66403 libopkg: check for file size mismatches Opkg starting from this version special-cases busybox as alternatives provider. There should be no need to add entries to ALTERNATIVES of busybox package Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* base-files: Fix path check in get_mac_binaryAdrian Schmutzler2019-07-091-1/+1
| | | | | | | | | | Logic was inverted when changing from string check to file check. Fix it. Fixes: 8592602d0a88 ("base-files: Really check path in get_mac_binary") Reported-by: Matthias Schiffer <mschiffer@universe-factory.net> Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> (cherry picked from commit 6ed3349308b24a6bac753643970a1f9f56ff6070)
* base-files: Really check path in get_mac_binaryAdrian Schmutzler2019-07-051-1/+1
| | | | | | | | Currently, path argument is only checked for being not empty. This changes behavior to actually check whether path exists. Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* wireguard: bump to 0.0.20190601Jason A. Donenfeld2019-07-011-2/+2
| | | | | | | | | | | | | | | There was an issue with the backport compat layer in yesterday's snapshot, causing issues on certain (mostly Atom) Intel chips on kernels older than 4.2, due to the use of xgetbv without checking cpu flags for xsave support. This manifested itself simply at module load time. Indeed it's somewhat tricky to support 33 different kernel versions (3.10+), plus weird distro frankenkernels. If OpenWRT doesn't support < 4.2, you probably don't need to apply this. But it also can't hurt, and probably best to stay updated. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> (cherry picked from commit 593b487538079f2a22300f3f22ffb21b20da36a0)
* OpenWrt v18.06.4: revert to branch defaultsJo-Philipp Wich2019-06-301-2/+2
| | | | Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* OpenWrt v18.06.4: adjust config defaultsv18.06.4Jo-Philipp Wich2019-06-301-2/+2
| | | | Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* uqmi: bump to latest git HEADKoen Vandeputte2019-06-271-4/+4
| | | | | | | | 1965c7139374 uqmi: add explicit check for message type when expecting a response 01944dd7089b uqmi_add_command: fixed command argument assignment Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com> (cherry picked from commit 47986dc6ea1d643cd348501da09cd2e3ee2f9ee1)
* uqmi: inherit firewall zone membership to virtual sub interfacesJo-Philipp Wich2019-06-272-0/+20
| | | | | | | | | | Fix an issue where subinterfaces were not added to the same firewall zone as their parent. Fixes: FS#2122 Signed-off-by: Jo-Philipp Wich <jo@mein.io> Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com> (cherry picked from commit 64bb88841fbc2d9a9dfee12775a18e5dc89ac16e)
* uqmi: fix PIN_STATUS_FAILED error with MC7455 WCDMA/LTE modemDaniel Golle2019-06-272-2/+2
| | | | | | | | | | | | Apparently this modem replies differently to attempted --get-pin-status which makes the script fail if a pincode is set. Fix this. Manufacturer: Sierra Wireless, Incorporated Model: MC7455 Revision: SWI9X30C_02.24.05.06 r7040 CARMD-EV-FRMWR2 2017/05/19 06:23:09 Signed-off-by: Daniel Golle <daniel@makrotopia.org> (cherry picked from commit 0b373bf4d6a1a7a53e06946972ebb812b4cc2f0f)
* OpenWrt v18.06.3: revert to branch defaultsJo-Philipp Wich2019-06-211-2/+2
| | | | Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* OpenWrt v18.06.3: adjust config defaultsv18.06.3Jo-Philipp Wich2019-06-211-2/+2
| | | | Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* fstools: block-mount: fix restart of fstab serviceKarel Kočí2019-06-212-1/+5
| | | | | | | | | | | | | | | | Restarting service causes file-systems to be unmounted without being mounted back. When this service was obsoleted it should have been implemented in a way that all actions are ignored. Up to this commit default handler was called when restart was requested. This default handler just simply calls stop and start. That means that stop called unmount but start just printed that this service is obsoleted. This instead implements restart that just prints same message like start does. It just calls start in reality. This makes restart unavailable for call. Signed-off-by: Karel Kočí <karel.koci@nic.cz> (cherry picked from commit 3ead9e7b743b1fbd3b07f5a72a16999abbec9347)
* fstools: update to the latest master branchPetr Štetiar2019-06-211-3/+3
| | | | | | | | ff1ded6 libfstools: Fix overflow of F2FS_MINSIZE constant bc2c876 libfstools: Print error in case of loop blkdev failure Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit 1e55171a1213472e180e9320d8b1d08621d2b8d5)
* fstools: media change detection (eg:sdcard) using kernel pollingMatthias Badaire2019-06-212-1/+10
| | | | | | | | | | | | | | | | | | | | | Linux kernel has a polling mechanism that can be activated by changing the parameter /sys/module/block/parameters/events_dfl_poll_msecs which is deactivated by default or the /sys/block/[device]/events_poll_msecs for one device. This patch set the events_poll_msecs when a disk is inserted. Once the media disk change event is sent by the kernel then we force a re-read of the devices using /sbin/block info. With this patch, insertion and ejection of sd card will automatically generate partition devices in /dev. Signed-off-by: Matthias Badaire <mbadaire@gmail.com> [rewrap commit message, fix bashisms, fix non-matching condition, bump pkg release] Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit cf8483cb4ffc99bf3f512bb134860ccc8c099abe)
* hostapd: fix multiple security problemsHauke Mehrtens2019-06-2119-1/+2352
| | | | | | | | | | | | | | | | This fixes the following security problems: * CVE-2019-9494: cache attack against SAE * CVE-2019-9495: cache attack against EAP-pwd * CVE-2019-9496: SAE confirm missing state validation in hostapd/AP * CVE-2019-9497: EAP-pwd server not checking for reflection attack) * CVE-2019-9498: EAP-pwd server missing commit validation for scalar/element * CVE-2019-9499: EAP-pwd peer missing commit validation for scalar/element * CVE-2019-11555: EAP-pwd message reassembly issue with unexpected fragment Most of these problems are not relevant for normal users, SAE is only used in ieee80211s mesh mode and EAP-pwd is normally not activated. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* base-files: fix uci led oneshot/timer triggerRobinson Wu2019-06-201-0/+1
| | | | | | | | | | | | | | | This patch adds a missing type property which prevented the creation of oneshot and timer led triggers when they are specified in the /etc/board.d/01_leds files. i.e.: ucidef_set_led_timer "system" "system" "zhuotk:green:system" "1000" "1000" Fixes: b06a286a4861 ("base-files: cleanup led functions in uci-defaults.sh") Signed-off-by: Robinson Wu <wurobinson@qq.com> Signed-off-by: Christian Lamparter <chunkeey@gmail.com> [also fix oneshot as well]
* mac80211: brcmfmac: backport important fixes from kernel 5.2Rafał Miłecki2019-06-1615-12/+544
| | | | | | | | | | 1) Crash/Oops fixes 2) One-line patch for BCM43456 support 3) Fix communication with some specific FullMAC firmwares 4) Potential fix for "Invalid packet id" errors 5) Important helper for reporting FullMAC firmware crashes Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* uboot-fritz4040: update PKG_MIRROR_HASHChristian Lamparter2019-06-151-1/+1
| | | | | | | the file on http://sources.openwrt.org/ has a different PKG_MIRROR_HASH value. Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-24 13:22:35 +0000