python3.11 beta is out but fails to run the makefile currently
this supports python versions from 3.6 to 3.99 with the python3 binary
it also checks specifically for 3.11 as it is the latest version out
Signed-off-by: Oscar Molnar <oscar@tymscar.com>
(cherry picked from commit a9e8eec221874e5840d659aed3f68850ff1d9982)
Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz> [rebase for 21.02]
As wolfSSL is having hard time maintaining ABI compatibility between
releases, we need to manually force rebuild of packages depending on
libwolfssl and thus force their upgrade. Otherwise due to the ABI
handling we would endup with possibly two libwolfssl libraries in the
system, including the patched libwolfssl-5.5.1, but still have
vulnerable services running using the vulnerable libwolfssl-5.4.0.
So in order to propagate update of libwolfssl to latest stable release
done in commit ec8fb542ec3e4 ("wolfssl: fix TLSv1.3 RCE in uhttpd by
using 5.5.1-stable (CVE-2022-39173)") which fixes several remotely
exploitable vulnerabilities, we need to bump PKG_RELEASE of all
packages using wolfSSL library.
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit f1b7e1434f66a3cb09cb9e70b40add354a22e458)
(cherry picked from commit 562894b39da381264a34ce31e9334c8a036fa139)
Fixes denial of service attack and buffer overflow against TLS 1.3
servers using session ticket resumption. When built with
--enable-session-ticket and making use of TLS 1.3 server code in
wolfSSL, there is the possibility of a malicious client to craft a
malformed second ClientHello packet that causes the server to crash.
This issue is limited to when using both --enable-session-ticket and TLS
1.3 on the server side. Users with TLS 1.3 servers, and having
--enable-session-ticket, should update to the latest version of wolfSSL.
Thanks to Max at Trail of Bits for the report and "LORIA, INRIA, France"
for research on tlspuffin.
Complete release notes https://github.com/wolfSSL/wolfssl/releases/tag/v5.5.1-stable
Fixes: CVE-2022-39173
Fixes: https://github.com/openwrt/luci/issues/5962
References: https://github.com/wolfSSL/wolfssl/issues/5629
Tested-by: Kien Truong <duckientruong@gmail.com>
Reported-by: Kien Truong <duckientruong@gmail.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit ec8fb542ec3e4f584444a97de5ac05dbc2a9cde5)
(cherry picked from commit ce59843662961049a28033077587cabdc5243b15)
This version fixes two vulnerabilities:
-CVE-2022-34293[high]: Potential for DTLS DoS attack
-[medium]: Ciphertext side channel attack on ECC and DH operations.
The patch fixing x86 aesni build has been merged upstream.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 9710fe70a68e0a004b1906db192d7a6c8f810ac5)
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit ade7c6db1e6c2c0c8d2338948c37cfa7429ebccc)
This is mostly a bug fix release, including two that were already
patched here:
- 300-fix-SSL_get_verify_result-regression.patch
- 400-wolfcrypt-src-port-devcrypto-devcrypto_aes.c-remove-.patch
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 73c1fe2890baa5c0bfa46f53c5387f5e47de1acb)
(cherry picked from commit 6f8db8fee3b7bd5cb8b1b2be59ee710a8f96860b)
Fixes build warnings when using newer versions of grep.
Signed-off-by: Chris Osgood <chris_github@functionalfuture.com>
Tested-by: Georgi Valkov <gvalkov@gmail.com>
(cherry picked from commit c5e167e0d6075c46ca92c30b425c4dcb05fec5ed)
[ fix conflict error ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
We simply grep for "/usr". So no need for "-E" or "\/". Furthermore, in
the new grep versions this creates warnings.
As written in the grep-3.8 announcement:
Regular expressions with stray backslashes now cause warnings, as
their unspecified behavior can lead to unexpected results.
For example, '\a' and 'a' are not always equivalent
<https://bugs.gnu.org/39678>.
Fixes warnings in the form of:
grep: warning: stray \ before /
Signed-off-by: Nick Hainke <vincent@systemli.org>
(cherry picked from commit a29d3bc48c40c6a2a93ae1806bea2ac26455cdbb)
[ fix conflict error ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Fixes following missing kernel config symbol after adding GPIO watchdog:
Software watchdog (SOFT_WATCHDOG) [M/n/y/?] m
Watchdog device controlled through GPIO-line (GPIO_WATCHDOG) [Y/n/m/?] y
Register the watchdog as early as possible (GPIO_WATCHDOG_ARCH_INITCALL) [N/y/?] (NEW)
Fixes: 1a97c03d864e ("rampis: feed zbt-we1026 external watchdog")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit fb2801b82c06878ae2ad20b8f95546c34ed3cdf4)
[adapted to config-5.4]
Signed-off-by: Federico Capoano <f.capoano@openwisp.io>
Without feeding the gpio watchdog, the board will reset after 90 seconds
Signed-off-by: Arvid E. Picciani <aep@exys.org>
(cherry picked from commit 1a97c03d864ee5ab917aff2988c62fce223c041e)
[adapted to config-5.4]
Signed-off-by: Federico Capoano <f.capoano@openwisp.io>
This patch adds support for creation heartbeat led trigger with,
for example, this command:
ucidef_set_led_heartbeat "..." "..." "..."
from /etc/board.d/01_leds.
Signed-off-by: Alexey Smirnov <s.alexey@gmail.com>
(cherry picked from commit 66071729a27919e555752fce25210b1b035eb319)
Several users of wget for downloads (curl is not available in the
system) have reported broken download functionality:
wget --tries=5 --timeout=20 --output-document=- https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.10.142.tar.xz
http://: Invalid host name.
Thats all happening due to '' was passed as an argument, which got later
expanded to http://.
In the context of a list constructor '' is not nothing, it is an empty
string element. So fix it by using () as it will yield "nothing" and
thus not introduce an empty string element.
Fixes: #10692
Fixes: 90c6e3aedf16 ("scripts: always check certificates")
Signed-off-by: Jo-Philipp Wich <jo@mein.io> [shellwords() -> ()]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 50a48faa1b8424e6b4b436b7118fffa2cba14b18)
When running build in verbose mode `make V=s` we can see a lot of
following warnings when curl is not available in the system:
Can't exec "curl": No such file or directory at scripts/download.pl line 77.
So lets fix it by redirecting of the stderr to null hole.
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit c836ca84e8f641e10a8349a8f9b7432b33d6cec1)
Remove flags from wget and curl instructing them to ignore bad server
certificates. Although other mechanisms can protect against malicious
modifications of downloads, other vectors of attack may be available
to an adversary.
TLS certificate verification can be disabled by turning oof the
"Enable TLS certificate verification during package download" option
enabled by default in the "Global build settings" in "make menuconfig"
Signed-off-by: Josh Roys <roysjosh@gmail.com>
[ add additional info on how to disable this option ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz> [backport]
(cherry picked from commit 90c6e3aedf167b0ae1baf376e7800a631681e69a)
It shouldn't be needed anymore as we've now `scripts/xxdi.pl`, which
should be self contained and fully compatible `xxd -i` replacement.
Fixes: #10555
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 88c9056a70901577489ecdc7a25207a9b7576d6e)
Dependency on xxd was added in commit c4dd2441e787 ("tools: add xxd
(from vim)") as U-Boot requires xxd to create the default environment
from an external file.
Later in commit 2b94aac7a128 ("tools: xxd: use more convenient source
tarball"), xxd from another source was used instead, but that source is
currently unavailable, so let's fix it by using simple xxdi.pl Perl
script instead.
Fixes: #10555
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit eae2fb8027cb892e42181e471ba344aa5d26bf7e)
So it can serve as a standalone drop in replacement for xxd utility used
currently mostly in U-Boot packages with `xxd -i` mode which outputs C
include file style, with aim for byte to byte identical output, so the
eventual difference in the generated output is easily spottable.
Fixes: #10555
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Signed-off-by: Jo-Philipp Wich <jo@mein.io> [perl-fu]
(cherry picked from commit 06e01e817ec6643a35beb9e6946689e9cc7d020a)
In order to make it more portable.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 8b278a76d90e3724815a5fde32be59f7796be1d8)
xxdi.pl is a Perl script that implements vim's 'xxd -i' mode so that
packages do not have to use all of vim just to get this functionality.
References: #10555
Source: 97a6bd5cee/xxdi.pl
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 2117d04a3aaad3394c0afec799d9c43f8a09c2cf)
Broadcom's U-Boot contains environment data blocks. They need to be
found (offsets aren't predefined) to access env variables.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 137149847d0f374515f38952ce0986b03a97f2e4)
Backport upstream solution that permits to declare nvmem cells with
dynamic partition defined by special parser.
This provide an OF node for NVMEM and connect it to the defined dynamic
partition.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 1a9ee367343edce263f82cc91a49d796c9d45ea3)
This fixes:
[ 0.292536] ns-pinmux 1800c100.cru:pinctrl: invalid resource
[ 0.298322] ns-pinmux 1800c100.cru:pinctrl: Failed to map pinctrl regs
[ 0.305578] ns-pinmux: probe of 1800c100.cru:pinctrl failed with error -22
Linux 5.4.157 included commit 6d0b30784fcd9 ("Revert "pinctrl: bcm: ns:
support updated DT binding as syscon subnode"") which makes pinctrl
driver expect the old DT syntax.
Drop downstream patch switching pinctrl node to the invalidated syntax.
Fixes: 0b7311300b01d ("kernel: bump 5.4 to 5.4.158")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
It parses U-Boot env data into NVMEM cells.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 34cf31043504473df3174a22d163b71b75e46542)
This is required for non-parser drivers handling MTD devices.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 41e1e838fbbb0308ad7353a3714e04b8c4585e7e)
In theory we could have just 1 bootfs image for all devices as each
device has its own entry in the "configurations" node. It doesn't work
well with default configuration though.
If something goes wrong U-Boot SPL can be interrupted (by pressing A) to
enter its minimalistic menu. It allows ignoring boardid. In such case
bootfs default configuration is used.
For above reason each SoC family (BCM4908, BCM4912) should have its own
bootfs built. It allows each of them to have working default
configuration.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 6ae2f7ff4737ec8dbec026fc6c02f7d1850b521c)
It isn't tested & Linux DT will surely need more work.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 3f2b2fe084c0019221a17e3217a01c41d003f6fd)
This fixes problem of overwriting BCM4908 U-Boot and DTB files by
BCM4912 ones. That bug didn't allow booting BCM4908 devices.
Fixes: f4c2dab544ec2 ("uboot-bcm4908: add BCM4912 build")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit a8e1e30543239e85ff5dc220368164b66cf73fba)
Testing has shown it to be very unreliable in variety of configurations.
It is not mandatory, so let's disable it by default until we have a better
solution.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 2984a0420649733662ff95b0aff720b8c2c19f8a)
The driver needs to check if the format is 802.2 vs 802.3 in order to
set a tx descriptor flag. skb->protocol can't be used, since it may not
be properly initialized for packets coming in from a packet socket. Fix
misdetection by checking the ethertype from the skb data instead.
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
Signed-off-by: Petr Štetiar <ynezz@true.cz> [commit description]
The MikroTik mAP-2nd (sold as mAP) is an indoor 2.4Ghz AP with
802.3af/at PoE input and passive PoE passthrough.
See https://mikrotik.com/product/RBmAP2nD for more details.
Specifications:
- SoC: QCA9533
- RAM: 64MB
- Storage: 16MB NOR
- Wireless: QCA9533 802.11b/g/n 2x2
- Ethernet: 2x 10/100 ports,
802.3af/at PoE in port 1, 500 mA passive PoE out on port 2
- 7 user-controllable LEDs
Note: the device is a tiny AP and does not distinguish between both
ethernet ports roles, so they are both assigned to lan.
With the current setup, ETH1 is connected to eth1 and ETH2 is connected
to eth0 via the embedded switch port 2.
Flashing:
TFTP boot initramfs image and then perform sysupgrade. The "ETH1" port
must be used to upload the TFTP image. Follow common MikroTik procedure
as in https://openwrt.org/toh/mikrotik/common.
Tested-By: Andrew Powers-Holmes <aholmes@omnom.net>
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
(cherry picked from commit e1223dbee332b89caf71850eb909104529595c31)
The MikroTik RB952Ui-5ac2nD (sold as hAP ac lite) is an indoor 2.4Ghz
and 5GHz AP/router with a 2 dBi integrated antenna.
See https://mikrotik.com/product/RB952Ui-5ac2nD for more details.
Specifications:
- SoC: QCA9533
- RAM: 64MB
- Storage: 16MB NOR
- Wireless: QCA9533 802.11b/g/n 2x2 / QCA9887 802.11a/n/ac 2x2
- Ethernet: AR934X switch, 5x 10/100 ports,
10-28 V passive PoE in port 1, 500 mA PoE out on port 5
- 6 user-controllable LEDs:
- 1x user (green)
- 5x port status (green)
Flashing:
TFTP boot initramfs image and then perform sysupgrade. The "Internet"
port (port number 1) must be used to upload the TFTP image, then
connect to any other port to access the OpenWRT system.
Follow common MikroTik procedure as in
https://openwrt.org/toh/mikrotik/common.
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
(cherry picked from commit 2bd33e8626bd04fd7115ee1a42aaf03aae2fffb8)
This makes the WAN interface and port appear in
LuCi -> Network -> Switch on Linksys MR8300.
This allows to configure a VLAN on WAN.
Fixes: FS#4227
Signed-off-by: Julien Cassette <julien.cassette@gmail.com>
(cherry picked from commit 2c1f8a665eb3dce27deb4f9f9b718eb8baf997bd)
This fixes passing a bogus non-null pointer to the ubus handler in case
the transition request is rejected.
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 9b880f09f394049e0629e3c9d4061f431a6b19a8)
Signed-off-by: Nick Hainke <vincent@systemli.org>
Both $(AUTORELEASE) and $(PKG_SRC_VERSION) (from luci.git) use the Git
log to determine releases and package timestamps.
Feeds are shallow cloned by default, resulting in an incomplete Git log
and therefore different local package versions than offered upstream.
This commits sets the default feeds to use `src-git-full` to solve that.
Add fixes from "2b1d92f: scripts/feeds: silence git warning by selecting
pull style" to `src-git-full`
Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit 7fae1e5677e9bb4979c8d4ac99be4de6955b13d0)
There are two versions which are identical apart from the enclosure:
YunCore AX820: indoor ceiling mount AP with integrated antennas
YunCore HWAP-AX820: outdoor enclosure with external (N) connectors
Hardware specs:
SoC: MediaTek MT7621DAT
Flash: 16 MiB SPI NOR
RAM: 128MiB (DDR3, integrated)
WiFi: MT7905DAN+MT7975DN 2.4/5GHz 2T2R 802.11ax
Ethernet: 10/100/1000 Mbps x2 (WAN/PoE+LAN)
LED: Status (green)
Button: Reset
Power: 802.11af/at PoE; DC 12V,1A
Antennas: AX820(indoor): 4dBi internal; HWAP-AX820(outdoor): external
Flash instructions:
The "OpenWRT support" version of the AX820 comes with a LEDE-based
firmware with proprietary MTK drivers and a luci webinterface and
ssh accessible under 192.168.1.1 on LAN; user root, no password.
The sysupgrade.bin can be flashed using luci or sysupgrade via ssh,
you will have to force the upgrade due to a different factory name.
Remember: Do *not* preserve factory configuration!
MAC addresses as used by OEM firmware:
use address source
2g 44:D1:FA:*:0b Factory 0x0004 (label)
5g 46:D1:FA:*:0b LAA of 2g
lan 44:D1:FA:*:0c Factory 0xe000
wan 44:D1:FA:*:0d Factory 0xe000 + 1
The wan MAC can also be found in 0xe006 but is not used by OEM dtb.
Due to different MAC handling in mt76 the LAA derived from lan is used
for 2g to prevent duplicate MACs when creating multiple interfaces.
Signed-off-by: Clemens Hopfer <openwrt@wireloss.net>
(cherry picked from commit 4891b865380e2b7f32acf0893df9c1ca9db8d4ea)
[switch to mtd-mac-address instead of nvmem-cells]
