527e700 ustream-ssl: Remove RC4 from ciphersuite in server mode.
39a6ce2 ustream-ssl: Enable ECDHE with OpenSSL.
45ac930 remove polarssl support
Signed-off-by: John Crispin <john@phrozen.org>
Without this patch the extra LDFLAGS of objects were selected based on the
name of the extension being built, which breaks for aggregate so builds.
Signed-off-by: John Crispin <john@phrozen.org>
Switched download from SourceForge to GitHub. It seems the author migrated to that.
Also fixed the website URL as the SourceForge link is dead.
Compile tested on ar71xx and mvebu. Small size decrease on ar71xx: 30444 vs. 30099 bytes.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
When libressl was linked the libpthread was missing, add it in addition.
Fixes: 2c192b6916 ("tools/libressl: update to version 2.7.2")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
When libressl was linked the libpthread was missing, add it in addition.
Also make the mxsimage tool to use the OpenSSL 1.1 API for the recent
libressl version.
Fixes: 2c192b6916 ("tools/libressl: update to version 2.7.2")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
When libressl was linked the libpthread was missing, add it in addition.
Fixes: 2c192b6916 ("tools/libressl: update to version 2.7.2")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
010-fix-rpmatch.patch is upstream, removed from our patchset
The file structure is changed, modify patch accordingly
use CONFIGURE_ARGS to disable tests, xattr and lzo
Compile and run tested on mvebu and x86_64
Signed-off-by: Syrone Wong <wong.syrone@gmail.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
This allows us to link the other tools against our libz and we do not
need the system zlib any more.
Only the static linked library is copied to the staging directory so we
have a statically linked library on all systems and not only on Linux.
This also adds the new dependencies of the packages which are depending
on zlib.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
The sender domain has a DMARC Reject/Quarantine policy which disallows
sending mailing list messages using the original "From" header.
To mitigate this problem, the original message has been wrapped
automatically by the mailing list software.
Choose first running interface, rather than first "up" interface (Redhat #1403025)
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
Added for convenience. These boards can be used as dev boards running
various operating systems from different media, and this simplifies work
with U-Boot environment.
Signed-off-by: Damir Samardzic <damir.samardzic@sartura.hr>
* QCA IPQ4019
* 256 MB of RAM
* 32 MB of SPI NOR flash (s25fl256s1)
- 2x 15 MB available; but one of the 15 MB regions is the recovery image
* 2T2R 2.4 GHz
- QCA4019 hw1.0 (SoC)
- requires special BDF in QCA4019/hw1.0/board-2.bin with
bus=ahb,bmi-chip-id=0,bmi-board-id=20,variant=OM-A62
* 2T2R 5 GHz (channel 36-64)
- QCA9888 hw2.0 (PCI)
- requires special BDF in QCA9888/hw2.0/board-2.bin
bus=pci,bmi-chip-id=0,bmi-board-id=16,variant=OM-A62
* 2T2R 5 GHz (channel 100-165)
- QCA4019 hw1.0 (SoC)
- requires special BDF in QCA4019/hw1.0/board-2.bin with
bus=ahb,bmi-chip-id=0,bmi-board-id=21,variant=OM-A62
* multi-color LED (controlled via red/green/blue GPIOs)
* 1x button (reset; kmod-input-gpio-keys compatible)
* external watchdog
- triggered GPIO
* 1x USB (xHCI)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x gigabit ethernet
- phy@mdio3:
+ Label: Ethernet 1
+ gmac0 (ethaddr) in original firmware
+ 802.3at POE+
- phy@mdio4:
+ Label: Ethernet 2
+ gmac1 (eth1addr) in original firmware
+ 18-24V passive POE (mode B)
* powered only via POE
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the factory image to the u-boot when the device boots up.
The initramfs image can be started using
setenv bootargs 'loglevel=8 earlycon=msm_serial_dm,0x78af000 console=ttyMSM0,115200 mtdparts=spi0.0:256k(0:SBL1),128k(0:MIBIB),384k(0:QSEE),64k(0:CDT),64k(0:DDRPARAMS),64k(0:APPSBLENV),512k(0:APPSBL),64k(0:ART),64k(0:custom),64k(0:KEYS),15552k(inactive),15552k(inactive2)'
tftpboot 0x84000000 openwrt-ipq40xx-openmesh_a62-initramfs-fit-uImage.itb
set fdt_high 0x85000000
bootm 0x84000000
Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
The BDFs for all boards were upstreamed to the ath10k-firmware
repository and are now part of ath10k-firmware 2018-04-19.
We switched to the upstream board-2.bin, hence the files can be removed
here.
Keep the ipq-wifi package in case new boards are added. It might take
some time till board-2.bins send upstream are merged.
Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
4136529 dhcpv6-ia: keep tentative assignments alive for a short time
200cc8f dhcpv6-ia: make assignment lookup more strict
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
This patch was revised upstream before being merged, and OpenWrt's copy
was never updated to reflect the revision.
Signed-off-by: Thomas Hebb <tommyhebb@gmail.com>
[refreshed patches]
Signed-off-by: Mathias Kresin <dev@kresin.me>
7cc2668 version: bump snapshot
860c7c7 poly1305: do not place constants in different sections
5f1e4ca compat: remove unused dev_recursion_level backport
7e4b991 blake2s: remove unused helper
13225fc send: simplify skb_padding with nice macro
a1525bf send: account for route-based MTU
bbb2fde wg-quick: account for specified fwmark in auto routing mode
c452105 qemu: bump default version
dbe5223 version: bump snapshot
1d3ef31 chacha20poly1305: put magic constant behind macro
cdc164c chacha20poly1305: add self tests from wycheproof
1060e54 curve25519: add self tests from wycheproof
0e1e127 wg-quick.8: fix typo
2b06b8e curve25519: precomp const correctness
8102664 curve25519: memzero in batches
1f54c43 curve25519: use cmov instead of xor for cswap
fa5326f curve25519: use precomp implementation instead of sandy2x
9b19328 compat: support OpenSUSE 15
3102d28 compat: silence warning on frankenkernels
8f64c61 compat: stable kernels are now receiving b87b619
62127f9 wg-quick: hide errors on save
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Import two patches from Peter Oh to allow setting channel
bandwidth in the way it already works for managed interfaces.
This fixes mesh interfaces on 802.11ac devices always coming up in
VHT80 mode.
Add a patch to allow HT40 also on 2.4GHz if noscan option is set, which
also skips secondary channel scan just like noscan works in AP mode.
This time also make sure to add all files to the patch before
committing it...
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
When a partition offset is given, it is used in an lseek call, which
affects write, but not erase. Add it to the offset for erase calls as
well
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Import two patches from Peter Oh to allow setting channel
bandwidth in the way it already works for managed interfaces.
This fixes mesh interfaces on 802.11ac devices always coming up in
VHT80 mode.
Add a patch to allow HT40 also on 2.4GHz if noscan option is set, which
also skips secondary channel scan just like noscan works in AP mode.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Before this commit, devices supporting both 2.4GHz and 5GHz would be
configured for 2.4GHz by default - unless they have VHT capabilities.
With this commit, channel 36 is only set when the frequency is supported.
VHT isn't checked unless that is the case.
Signed-off-by: Leon M. George <leon@georgemail.eu>
Pipe uqmi output from qmi_wds_stop function into /dev/null.
This will supress the following output in proto teardown.
netifd: wwan (x): "No effect"
netifd: wwan (x): Command failed: Permission denied
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Several changes has been made:
+ AES support has been removed by
upstream commit c6831c7 (2017-11-14)
[remove patch "200-fw_env_no_aes.patch"]
+ Support for UBI volumes has beed added by
upstream commit 34255b9 (2017-11-15)
[remove patch "300-support-env-in-ubivol-chardev.patch"]
+ A command line argument has beed added ("-c") to manually indicate
the location of the environment configuration file
Also, patch "400-u-boot-2015.10-stdint.patch" is no longer
necessary, and the config option to enable UBI support has
been removed.
Size comparisons:
fw_printenv size:
Target Before After
ar71xx 15,189 bytes 18,133 bytes (+2,944 bytes)
ipq40xx 20,873 bytes 20,987 bytes (+114 bytes)
mvebu 20,881 bytes 20,991 bytes (+110 bytes)
ramips 15,128 bytes 18,072 bytes (+2,944 bytes)
OPKG package size:
Target Before After
ar71xx 11,309 bytes 12,875 bytes (+1,566 bytes)
ipq40xx 11,772 bytes 13,299 bytes (+1,527 bytes)
mvebu 11,609 bytes 13,114 bytes (+1,505 bytes)
ramips 10,975 bytes 12,503 bytes (+1,528 bytes)
Compile tested: ipq40xx (musl, glibc, gcc5-musl), ar71xx, mvebu, ramips
Run tested: ipq40xx (ASUS RT-AC58U)
Signed-off-by: Luis Araneda <luaraneda@gmail.com>
mbedtls changed in version 2.7.0 the soversion of the libmbedcrypto.so
library, all applications using this shared library have to be
recompiled to be able to load the new library.
Some binaries got rebuild to for the 2.7.0 release and are now using
libmbedcrypto.so.1, the older ones are still using libmbedcrypto.so.0.
Fixes: 75c5ab4ca ("mbedtls: update to version 2.7.0")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
bughost.org hasn't existed for 6-8 years, add a couple of current
mirrors to avoid the fallback to http://mirror2.openwrt.org/sources/.
Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
bughost.org hasn't existed for 6-8 years, add a couple of current
mirrors to avoid the fallback to http://mirror2.openwrt.org/sources/.
Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
The missing dependency causes build problems on systems without PCI
support.
The ath10k_pci kernel module depends on PCI support so this dependency
should be added. ath10k now also supported the ahb interface on the
IPQ4019 SoC, but this SoC also has PCI support so this extra dependency
is not as problem.
Fixes: d0f3dd5b9f ("ath10k-ct: update to latest version, enable AHB.")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Merge upstream patch from Sathishkumar Muruganandam
<murugana@codeaurora.org> for OpenWrt's backports package:
https://lkml.kernel.org/r/<1522049641-19521-1-git-send-email-murugana@codeaurora.org>
Commit-ID: 606204bb863fa3b0bb54929d79b4dc46338f9180
* FW has Smart Logging feature enabled by default for detecting failures
* and processing FATAL_CONDITION_EVENTID (36925 - 0x903D) back to host.
*
* Since ath10k doesn't implement the Smart Logging and FATAL CONDITION
* EVENT processing yet, suppressing the unknown event ID warning by moving
* this under ATH10K_DBG_WMI.
*
* Simulated the same issue by having associated STA powered off when
* ping flood was running from AP backbone. This triggerd STA KICKOUT
* in AP followed by FATAL CONDITION event 36925.
*
* Issue was reproduced and verified in below DUT
* ------------------------------------------------
* AP mode of OpenWRT QCA9984 running 6.0.8 with FW ver 10.4-3.5.3-00053
*
* Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
When CONFIG_PM was not set rsi_sdio_reinit_device() was not compiled
into the driver but referenced.
This is a backport form the mainline Linux kernel.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
RedPine RS9113 wireless module requires rsi91x driver to be built
and linux-firmware/rsi/rs9113_wlan_qspi.rps to be installed.
Also we add patch for successful compilation of rsi91x driver.
Signed-off-by: Evgeniy Didin <Evgeniy.Didin@synopsys.com>
Cc: Alexey Brodkin <abrodkin@synopsys.com>
Cc: Hauke Mehrtens <hauke@hauke-m.de>
Cc: John Crispin <john@phrozen.org>
For unencrypted mesh networks our scripts take care of setting
the various mesh_param values. wpa_supplicant changes somes of them
when being used for SAE encrypted mesh and previously didn't allow
configuring any of them. Add support for setting mesh_fwding (which
has to be set to 0 when using other routing protocols on top of
802.11s) and update our script to pass the value to wpa_supplicant.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
This reverts commit 1356a66f94.
The change breaks wpa_supplicant.conf generation, more work is needed
to fix mesh+AP.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Our commands setting accept_ra to 0 on all interfaces got lost in the
transition to procd. This remained unnoticed for a long time, as we also
enable forwarding on all interfaces, which prevents RA handling by default.
Restore the commands, while also fixing a possible race condition in the
old version.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
e243683 libfstools: move mount points when switching to JFFS2
3782b59 libfstools: add "const" to char pointer arguments in mount_move()
79721f0 libfstools: fix foreachdir() to pass dir with a trailing slash
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
513eb27 system-linux: check ioctl return value in system_vlan()
df1625d system-linux: check ioctl return value in system_if_flags()
209c508 system-linux: fix segfault on alloc failure in system_if_check()
4a8e20e system-linux: fix segfault on error in system_add_ip6_tunnel()
36e4700 handler: fix resource leak on error in netifd_init_script_handlers()
86a0e7c system-linux: remove unnecessary open call in system_if_dump_info()
1e2cf67 system-linux: fix memory leak on error in system_add_vxlan()
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
1d23142 mt76: add led active low to debugfs
549f43b mt7603: ensure that the ACK flag is set for A-MPDUs with any acked subframe
df9f9f6 mt7603: always try tx rate1 first
9c52f36 mt7603: pull the final rate index from the status descriptor
f36f308 mt7603: improve validation of rx frames
9a23989 mt7603: remove warning on rx with invalid channel info
7a31731 mt76: check for pending reset before attempting to schedule tx
873a7c9 mt7603: call mt76_txq_schedule_all as a barrier to prevent tx during reset
d9e5da3 mt76: add rcu locking in tid reorder function
a8e8921 mt7603: add more checks to avoid dereferencing invalid pointers in wcid lookup
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Let's use /etc/sysctl.d for package-provided snippets and leave
/etc/sysctl.conf to the admin. Don't backup /etc/sysctl.d on upgrades, so
old defaults get replaced properly.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
We can use /etc/sysctl.d/* for package-supplied sysctl snippets, giving
admins the option to use /etc/sysctl.conf to override settings.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
11_migrate-sysctl has not been updated with new file hashes since 2012.
Let's get rid of it.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
This firmware has only small changes from the last commit, but
it does have an important fix for at least some PTK rekey logic.
The old firmware would have issues if the driver managed to set
a clear key while encryption was 'enabled'. This new firmware for
both wave-1 and wave-2 should not be susceptible to this type of
bug any more.
And remove mesh-bcast IE flag from wave-2, still need more work before
we can enable that flag in ath10k-ct firmware it seems.
Signed-off-by: Ben Greear <greearb@candelatech.com>
Don't select the firmware with the board file, it prevents an easy use
of the -ct ath10k firmware. Select the firmware within the default
packages instead.
Remove the per device selection of the firmware now that it the
firmware is selected by default.
Signed-off-by: Mathias Kresin <dev@kresin.me>
Specifications:
SOC: Qualcomm IPQ4018 (DAKOTA) ARM Quad-Core
RAM: 256 MB Winbond W632GU6KB12J
FLASH: 16 MiB Macronix MX25L12805D
ETH: Qualcomm QCA8072
WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11b/g/n/ac 2x2
WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11n/ac
1x1 (EX6100)
2x2 (EX6150)
INPUT: Power, WPS, reset button
AP / Range-extender toggle
LED: Power, Router, Extender (dual), WPS, Left-/Right-arrow
SERIAL: Header next to QCA8072 chip.
VCC, TX, RX, GND (Square hole is VCC)
WARNING: The serial port needs a TTL/RS-232 v3.3 level converter!
The Serial setting is 115200-8-N-1.
Tested and working:
- Ethernet
- 2.4 GHz WiFi (Correct MAC-address)
- 5 GHz WiFi (Correct MAC-address)
- Factory installation from WebIF
- Factory installation from tftp
- OpenWRT sysupgrade (Preserving and non-preserving)
- LEDs
- Buttons
Not Working:
- AP/Extender toggle-switch
Untested:
- Support on EX6100v2. They share the same GPL-Code and vendor-images.
The 6100v2 seems to lack one 5GHz stream and differs in the 5GHz
board-blob. I only own a EX6150v2, therefore i am only able to verify
functionality on this device.
Install via Web-Interface:
Upload the factory image to the device to the Netgear Web-Interface.
The device might asks you to confirm the update a second time due to
detecting the OpenWRT firmware as older. The device will automatically
reboot after the image is written to flash.
Install via TFTP:
Connect to the devices serial. Hit Enter-Key in bootloader to stop
autobooting. Command "fw_recovery" will start a tftp server, waiting for
a DNI image to be pushed.
Assign your computer the IP-address 192.168.1.10/24. Push image with
tftp -4 -v -m binary 192.168.1.1 -c put <OPENWRT_FACTORY>
Device will erase factory-partition first, then writes the pushed image
to flash and reboots.
Parts of this commit are based on Thomas Hebb's work on the
openwrt-devel mailinglist.
See https://lists.openwrt.org/pipermail/openwrt-devel/2018-January/043418.html
Signed-off-by: David Bauer <mail@david-bauer.net>
Unlike when operating in Ad-Hoc mode, we apparently need to pass the
hostapd control socket interface to wpa_supplicant when using 802.11s
mesh mode.
There also seems to still be something wrong with the logic setting
channel and (v)htmode parameters...
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
And import patchset to allow 802.11s mesh on DFS channels, see also
http://lists.infradead.org/pipermail/hostap/2018-April/038418.html
Fix sae_password for encryption mesh (sent upstream as well).
Also refreshed existing patches and fixed 463-add-mcast_rate-to-11s.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2e783b227766 ebt_ip: add support for matching IGMP type
b5fbb8d786c9 ebt_ip: add support for matching ICMP type and code
c5e5b784fd1a Move ICMP type handling functions from ebt_ip6 to useful_functions.c
11da52177196 include: sync linux/netfilter_bridge/ebt_ip.h with kernel
Note: the new features require at least kernel 4.17 or backported patches.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
The serial was working before, but not when doing copy&pasting longer
commands in a short time.
Fixes: a4def18f29 ("uboot-omap: Update to u-boot v2017.01")
Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
Split physdev match out of ipt-extra to allow installing ipt-extra without
pulling in br-netfilter.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
While ebtables can be combined with br-netfilter, there is no good reason
to make it a dependency.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
kmod-br-netfilter is not only a support module, but can be useful on its
own, using the net.bridge.bridge-nf-call-* sysctls.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
Non-selecting dependencies easily lead to Kconfig failures due to recursive
dependencies. We hit such an issue in Gluon; the easiest fix is to make
the dependency selecting.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
RFC6771 does not exclude the forwarding of the example domain as it
states : "Caching DNS servers SHOULD NOT recognize example names as
special and SHOULD resolve them normally."
Example domains cannot be assigned to any user or person by DNS
registrars as they're registered in perpetuity to IANA meaning
they can be resolved; therefore let's remove the example domains
from the rfc6761.conf file.
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
42a8ecd jshn: fix format string for int64 type
92009b7 utils: ensure that byte-order conversion functions evaluate the argument only once
ace6489 switch from typeof to the more portable __typeof__
Signed-off-by: Felix Fietkau <nbd@nbd.name>
42a8ecd jshn: fix format string for int64 type
92009b7 utils: ensure that byte-order conversion functions evaluate the argument only once
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Bug fix release. 1.28.3 has fixes for
* ash and hush (do not leave stray open file destriptors in children),
* cpio (fix for symlink extraction),
* grep ("grep -Fw a" was matching "aa").
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
74b5a3 script: fix possible negative delay
473f248 dhcpv6: always trigger script update in case of IA updates
ea18935 ra: rework route information option handling
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
Some packages are already using $(1)/var on package install.
On multiuser systems this breaks the build when multiple
users build OpenWrt.
Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
This reverts commit 4fb684a755.
The compile fixes are still required for host systems using GCC 5.x,
such as Ubuntu 16.04 LTS.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
It's intentional that some boards within a target don't have all LEDs
which are tried to be setup in a common script. Don't show a warning in
such cases.
Fixes: 4f4fc993db ("base-files: add more name source to get_dt_led helper function")
Signed-off-by: Mathias Kresin <dev@kresin.me>
It seems both issues (GCC5 and Musl) were fixed at some point. Thus, they can be dropped.
Did not bump version as there is no change in functionality or size.
Compile-tested on ar71xx and mvebu, both with musl.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
flash_erase utility allows to erase MTD partitions on NAND flash.
Useful when you want to clean or write an MTD partition from scratch.
e.g., before using kobs-ng to flashing SPL images it's recommended
to erase the MTD partition to ensure it's empty.
Signed-off-by: Adrià Llaudet <adria.llaudet@gmail.com>
Update busybox to 1.28.2, refresh patches and default config.
* modify 230-add_nslookup_lede.patch as opt_complementary was removed
Also move nslookup_longopts variable declaration to be inside
the same conditional as the function itself.
* modify 250-date-k-flag.patch to match upstream (opt_complementary)
* remove 600-cve-2017-16544.patch that is upstreamed
Notes about config changes:
* Some applet-specific LONG_OPTIONS config options were removed
* Config help text indentation changed, caused lots of
text formatting changes for convert_menuconfig.pl
* convert_defaults.pl moved lots of defaults around, summary of
actual changes below
New applets/features:
---------------------
ARCH
HEXEDIT
MINIPS
NETCAT
NUKE
RESUME
RUN_INIT
SETFATTR
New options:
------------
FEATURE_CATN
FEATURE_CROND_SPECIAL_TIMES
FEATURE_LIBBUSYBOX_STATIC
FEATURE_SETPRIV_CAPABILITIES
FEATURE_SETPRIV_CAPABILITY_NAMES
FEATURE_SETPRIV_DUMP
FEATURE_SH_READ_FRAC
FEATURE_SWAPONOFF_LABEL
FEATURE_VOLUMEID_MINIX
FEATURE_XARGS_SUPPORT_ARGS_FILE
FEATURE_XARGS_SUPPORT_PARALLEL
HUSH_GETOPTS
HUSH_READONLY
HUSH_TIMES
Removed:
--------
FEATURE_HAVE_RPC
MSH
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
This Adds fixes for the following security problems based on debians patches:
CVE-2016-2125: Unconditional privilege delegation to Kerberos servers in trusted realms
CVE-2017-12163: Server memory information leak over SMB1
CVE-2017-12150: SMB1/2/3 connections may not require signing where they should
CVE-2018-1050: Denial of Service Attack on external print server.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
These functions are not declared in any header file and only used in
same compile unit, mark them as static to remove one gcc warning and
make it easier for the compiler to optimize them out.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This fixes some minor security problems.
Old size:
162262 bin/packages/mips_24kc/base/libmbedtls_2.7.0-1_mips_24kc.ipk
New size:
163162 bin/packages/mips_24kc/base/libmbedtls_2.8.0-1_mips_24kc.ipk
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This release brings various improvements to clearfog support, such as distro-boot.
Obsoletes:
0002-clearfog-reset-usom-onboard-1512-phy.patch
0003-clearfog-enable-distro-boot-code.patch
Signed-off-by: Josua Mayer <josua.mayer97@gmail.com>
CONFIG_* variables can easily be set by overriding Build/Configure.
so set NET_RANDOM_ETHADDR=y and CMD_SETEXPR=y here.
This replaces the following patches:
0001-clearfog-generate-random-MAC-address.patch
0004-clearfog-enable-setexpr-command-by-default.patch
Signed-off-by: Josua Mayer <josua.mayer97@gmail.com>
Wave-1 firmware has a fix for 'addba' not finding the peer. Thanks to Hauke
for finding and reporting this.
Wave-2 firmware has a fix for leaking a peer multicast key when a monitor device
is created.
And I re-ordered the '4019' firmware images in the Makefile to match the order
of the others. No functional change for that reorder.
Signed-off-by: Ben Greear <greearb@candelatech.com>
Tested-by: Rosen Penev <rosenp@gmail.com>
This reverts commit 745d0e7f4b.
It looks like upstream don't want the patch so let's revert it here too.
I hope a fix from upstream is forthcoming.
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Fix psidlen becomes negative in case embedded address bit lenght is smaller than
IPv4 suffix length.
While at it improve parameter checking making the code more logical and
easier to read.
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
opkg currently has some issues with Provides and this change makes the
image builder fail because of that. Revert the change for now until opkg
is fixed
This reverts commit 092d75aa3e.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Changes since last version
dfb68f8 service: initialize supplementary group ids
3db4e6d service: add func for string config change check
c3faabe procd: get rid of putenv usage.
The supplementary group id change fixes FS#988
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
The following patches were merged upstream:
000-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch
replaced by commit 0e3bd7ac6
001-Prevent-reinstallation-of-an-already-in-use-group-ke.patch
replaced by commit cb5132bb3
002-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch
replaced by commit 87e2db16b
003-Prevent-installation-of-an-all-zero-TK.patch
replaced by commit 53bb18cc8
004-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch
replaced by commit 0adc9b28b
005-TDLS-Reject-TPK-TK-reconfiguration.patch
replaced by commit ff89af96e
006-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch
replaced by commit adae51f8b
007-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch
replaced by commit 2a9c5217b
008-WPA-Extra-defense-against-PTK-reinstalls-in-4-way-ha.patch
replaced by commit a00e946c1
009-Clear-PMK-length-and-check-for-this-when-deriving-PT.patch
replaced by commit b488a1294
010-Optional-AP-side-workaround-for-key-reinstallation-a.patch
replaced by commit 6f234c1e2
011-Additional-consistentcy-checks-for-PTK-component-len.patch
replaced by commit a6ea66530
012-Clear-BSSID-information-in-supplicant-state-machine-.patch
replaced by commit c0fe5f125
013-WNM-Ignore-WNM-Sleep-Mode-Request-in-wnm_sleep_mode-.patch
replaced by commit 114f2830d
Some patches had to be modified to work with changed upstream source:
380-disable_ctrl_iface_mib.patch (adding more ifdef'ery)
plus some minor knits needed for other patches to apply which are not
worth being explicitely listed here.
For SAE key management in mesh mode, use the newly introduce
sae_password parameter instead of the psk parameter to also support
SAE keys which would fail the checks applied on the psk field (ie.
length and such). This fixes compatibility issues for users migrating
from authsae.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
5d2bf09 uci: fix a potential use-after-free in uci_set()
3b3d63e list: only record ordering deltas if element position changed
4c4d343 cmake: Fix cli shared linking against ubox
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
Improve portability of init script by declaring resolvfile as local
in dnsmasq_stop function.
Fixes resolvfile being set for older busybox versions in dnsmasq_start
in a multi dnsmasq instance config when doing restart; this happens when
the last instance has a resolvfile configured while the first instance
being started has noresolv set to 1.
Base on a patch by "Phil"
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
Cake in kernel space now splits stats structure handling across netlink
messages to reduce stack usage issue flagged by upstream kernel checks.
Update user space (tc) qdisc handling to understand this new regime.
Cake also reports packet overheads & compensation in a different way so
add display code for this. e.g.
'tc -s qdisc show dev eth0' reports this extra detail:
min/max transport layer size: 28 / 1500
min/max overhead-adjusted size: 65 / 1550
average transport hdr offset: 14
Cake also supports output in JSON format.
Patch is bulkier than before because a (slightly out of date - see above
stats) man page is included for reference. Better than nothing!
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Relevant changes:
0afc1be Fixes for kernel 4.16
d2d6780 Reinitialise overhead compensation stats when reconfiguring.
a3bab9d Export overhead compensation stats to userspace.
9cd2fa8 Split tin stats to its own structure to decrease size of tc_cake_xstats
71c7b44 Gather more statistics about packet length transformations.
0517357 Rework overhead compensation to use dynamic transport header offset instead of (inaccurate) static one.
c1a0c8e Refactor length handling code to better centralise overhead calculations
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
PKG_EXTMOD_SUBDIRS should be set to the sub directory where the kernel
module gets build in, for the ath10k-ct driver this changed in commit
3888e77c1c from ath10k to ath10k-4.13. Without this fix the depends
line of the ath10*.ko modules is empty and the kernel module load system
will not automatically load the depended modules like mac80211.
Fixes: 3888e77c1c ("ath10k-ct driver: use dma_alloc_coherent, 4.13 based driver")
Fixes: 23a388fe41 ("ath10k-ct: Force loading mac80211 and ath modules.")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The HTT-MGT variants transport management frames over the
normal HTT tx path, just like data frames. This saves
limitted WMI buffers which can become depleted if lots of
management frames become stuck in TX queues due to peer
that went away.
In addition, at least for the wave-1 firmware, htt-mgt is
required in order for 802.11r (fast roaming) authentication
to function properly.
The htt-mgt firmware requires the use of the ath10k-ct
driver. Normal non-htt-mgt ath10k-ct firmware should work
with stock drivers.
Signed-off-by: Ben Greear <greearb@candelatech.com>
This updates to latest ath10k-ct firmware. Hopefully we are
at the end of the development cycle for this firmware release,
so these should be stable.
wave-1 changes since last release:
Release 20
* Allow flushing peer when deleting. Hopefully this will allow the
peer delete command to happen in a reasonable amount of time even
if the RF environment is busy (or peer has died).
To enable this, set the high flag in the mac-addr second word in the
ath10k driver near end of the ath10k_wmi_op_gen_peer_delete method:
cmd->peer_macaddr.word1 |= __cpu_to_le32(0x80000000);
* Attempt to fix crash seen in resmgr-ocs, appearantly due to list corruption.
Use a temporary list instead of trying to rely on for-each-safe.
* Add flag to tx-descriptor to allow driver to request no-ack on data
frames. This is bit 15 on the flag1 field (previously un-used).
* Add option to support specifying the tx-rate-code and retry count on
a per-packet basis. Only a single series is supported at this time.
Useful mainly for radiotap monitor-tx type testing at this point.
* Fix crash on startup when chip is at -40 deg C and calibration fails. Instead
of asserting, just keep retrying calibration, which appears to start working
after a few minutes (when the chip warms up).
* Allow reporting per-chain rssi for management frames. We pack the values into
empty space in the mgt-frame wmi header. This will only be enabled if the driver
requests it, since otherwise the driver is assumed to not understand the new API.
ath10k-ct drivers that support this feature will automatically enable it.
* A customer reports a case that appears to be the hardware not properly detecting
end of AMPDU, so frames were being mis-delivered to the wrong peer. Attempt to
work around this, and in doing so, clean up a bunch of void* abuse in the block-ack
reordering code (could not ever confirm there was a problem in this area).
* Re-work the rx-mem logic to be less complicated and to use less memory.
* Attempt to fix crash that appearanty happens because the driver can sometimes
delete a vdev in 'up' state.
* Attempt to fix hung scan state machine issues.
* Fix crash in tx path due to un-initialized memory.
wave-2 changes since last release:
Release 10
* Fix an assert related to tx scheduling. This hopefully fixes
what appears to be a regression that I added some time back.
* Enable CSI reporting for 9984, and maybe 9888/9886. Only in
non-trimmed builds.
* Other stability improvements, including regression fixes from
some tricky bugs introduced in earlier releases.
* Allow compiling for IPQ4019 chipset.
* Firmware will now send txbf frames to the host (driver) if the
TXBF (0xF00000001) set-special feature is enabled, or when the radio
is in monitor mode. But, if the frame is consumed by the txbf_cv
logic, then the pkt cannot be delivered to the host in this manner. Instead,
a WMI event will be sent and host can find the txbf_cv data in shared
memory. See ath10k_wmi_event_txbf_cv_mesg() in ath10k-ct driver.
* Support rx-all-mgt option. When enabled, the firmware will deliver all
management frames that it can to the host. No RX filters are changed
when this option is enabled.
* Fix at least some problems with sending tx-beamforming frames to SU-MIMO
peers. Looks like this was a regression in my code.
* Fix a crash in rate-ctrl due to nss mismatch. This was something I introduced
while trying to fix other bugs in rate-ctrl some time back.
* Attempt to fix a sw-peer-key object leak in IBSS mode. The peer key code
is very complex, and shares some pointers as union members. I think I fixed
at least some of the issues, but would not be surprised if more exist.
* Improve ath10k user guide to document CT firmware features:
https://www.candelatech.com/ath10k-ug.php
* Add ct-special option to configure the txbf sounding time. See ath10k-ug.php
* Fix and allow the driver to tell the firmware to send sounding frames. See ath10k-ug.php
In further testing, this seems to fail much of the time, and I am not sure why.
Disabling this in diet (trimmed) builds.
* Fix crashes related to deleting peers while they are in power-save mode. Reported
by LEDE user on r7800 with 9984 NIC.
* Make rate-ctrl txbf probe work better. If enabled, the rate-ctrl logic will periodically
send out probes at an NSS that can to txbf. Previously, txbf probes would not reliably happen
if both AP and peer had the same nss (ie, 2x2 talking to 2x2). To enable this feature, you
need to enable the fwtest-cmdid number 20.
* Report rx-timeout error counters. These were previously un-reported, though the
field existed in the wmi struct already.
* txbf: Ignore frames not destined for us. If NIC is in promisc mode, it
could acquire and process NDPA frames that were not destined for it. Check
the dest-MAC and ignore frames not for us (pass them up the stack for monitor
mode instead of save them in the peer's rate-ctrl logic.)
* Port ping-pong crash handling and othe related features to IPQ4019 target. It should
now act similar to 9984 in this regard.
* Fix a few asserts related to txbf and tx-seq logic.
* Add custom-stats support, for rx-reorder-stats. Similar to what I did for wave-1.
* Disable AMSDU for IBSS. This now matches what I did for peregrine. It seems to
work better this way, though I did not debug it in detail.
* Enable the set-special command to re-enable AMSDU for IBSS if user wants to experiment.
* Fix bug where dbglog did not disable IRQs, so if you made dbglog messages from the IRQ
handler, it could cause corruption that could crash the firmware and/or corrupt the log
message buffers.
* Don't assert if there are no buffer descriptors for RX of non-data frame.
* Retry any stuck block-ack sessions every 20 seconds instead of just disabling BA for
ever when we get too many failures.
* Fix SGI flag when reporting tx-rate info. The flag moved since wave-1 days, and
I did not notice that when I ported my changes forward to wave-2.
* Allow disabling special CCA handling for IBSS txqs. Earlier testing indicated this
might improve throughput in some testing on 9984 chips in IBSS mode, but subsequent
testing looks about the same without it. Since I do not really understand what this
setting exists for, leave it at upstream defaults. A new set-special API command (0x12)
can be used to enable this hack for testing. Setting 0x1 bit disables special CCA handling
for non-beacon IBSS txqs, setting 0x2 bit disables it for beacon queues as well.
* Add MCAST-BCAST feature flag. This tells driver we do not need a monitor interface
to do MESH.
* When calculating the rx-address filter (affects ACK & BLOCK-ACK, among other things),
to not add in monitor interfaces if other interfaces are up. There is no need for
a monitor device to ACK frames.
Signed-off-by: Ben Greear <greearb@candelatech.com>
Among other things, this will check for an htt-mgt variant of
ath10k-ct firmware before loading 'normal' firmware, and it disables
verbose printing of firmware DBGLOG messages by default.
Signed-off-by: Ben Greear <greearb@candelatech.com>
Update DEPENDS and PROVIDES so that ath10k-ct firmware
and drivers can be used to replace stock firmware
and drivers. The -htt firmware variant, which requires
ath10k-ct driver now selects ath10k-ct driver when the
firmware is selected.
Signed-off-by: Ben Greear <greearb@candelatech.com>
Drop providing the virtual package ip by busybox which was added in commit
1cec4d4ef0.
Letting busybox provide the virtual package ip is not optimal for the
following reasons :
- Applications depending on ip expect either the ip-full or
ip-tiny package to be enabled.
- Busybox ip applet cannot be added or removed at runtime
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
The driver updates include:
ath10k driver backport to fix WPA 'pn' related security bugs
(4.13 based driver only currently),
a fix for off-channel TX for CT wave-1 firmware, a likely
fix for napi related crashes, and a backport of the firmware fetch
patch.
AHB is needed for the IPQ4019 platform radios.
Signed-off-by: Ben Greear <greearb@candelatech.com>
[use common subject format]
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
We use the dtc from the kernel and that does not have all the options
which u-boot would like to use now. make these parameters optional.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
[wigyori@uid0.hu: renamed to 221-compatible-old-dtc.patch from 220-]
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
U-Boot now requires GCC > 5
Catch up with upstream and move some configuration options from
the header files to the corresponding defconfig files.
Also move some options of patch 010 affecting the whole platform
to 010's device only.
Signed-off-by: Paul Wassi <p.wassi@gmx.at>
print_int used 'int' type internally, whereas print_uint used 'uint64_t'
These helper functions eventually call vfprintf(fp, fmt, args) which is
a variable argument list function and is dependent upon 'fmt' containing
correct information about the length of the passed arguments.
Unfortunately print_int v print_uint offered no clue to the programmer
that internally passed ints to print_uint were being promoted to 64bits,
thus the format passed in 'fmt' string vs the actual passed integer
could be different lengths. This is even more interesting on big endian
architectures where 'vfprintf' would be looking in the middle of an
int64 type. Symptoms of this included tc qdisc showing bizarre values
for a variety of fields across a variety of qdiscs (e.g. refcnt, flows,
quantum)
print_u/int now stick with native int size.
A similar patch has been sent upstream.
Fixes FS#1425
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
94b6878 Tidy crypto.c of old library compat. Now need libnettle 3.
8b96552 Fix compiler warning.
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
This callback should have one parameter less, this parameter is not used
so this was not a so big problem.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Use the UBOOT_MAKE_FLAGS defined in include/u-boot.mk and do not
overwrite them to compile the host tools against the shipped LibreSSL.
In addition add a patch to fix a compile problem when compiling the
tools against LibreSSL caused by differences in the API between OpenSSL
1.1 and LibreSSL.
This should fix the compile problems seen in build bot from time to time
by not depending on the host libssl-dev package any more but using the
LibreSSL version from OpenWrt.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
