54780 Commits

Author SHA1 Message Date
Felix Fietkau
509363ba58
mac80211, mt76: add fixes for recently discovered security issues
Fixes CVE-2022-47522

Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit d54c91bd9ab3c54ee06923eafbd67047816a37e4)
(cherry picked from commit 4ae854d05568bc36a4df2cb6dd8fb023b5ef9944)
2023-04-02 02:07:16 +08:00
Felix Fietkau
cbe73ea33d kernel: remove obsolete netfilter tcp window size check bypass patch
On any currently supported hardware, the performance impact should not
matter anymore.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 75e78bcaab847557ce1782eb2dea9dff9a029171)
2023-03-30 14:18:04 +02:00
Felix Fietkau
32621086c3 mac80211, mt76: add fixes for recently discovered security issues
Fixes CVE-2022-47522

Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit d54c91bd9ab3c54ee06923eafbd67047816a37e4)
2023-03-30 12:24:52 +02:00
Daniel González Cabanelas
2541ca616d ipq40xx: Linksys MR8300: fix the USB port power
The USB port on the MR8300 randomly fails to feed bus-powered devices.

This is caused by a misconfigured pinmux. The GPIO68 should be used to
enable the USB power (active low), but it's inside the NAND pinmux.

This GPIO pin was found in the original firmware at a startup script in
both MR8300 and EA8300. Therefore apply the fix for both boards.

Signed-off-by: Daniel González Cabanelas <dgcbueu@gmail.com>
Reviewed-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit ed64c3323590e3c9fa8b423bf37689023a7a101f)
Signed-off-by: Steffen Scheib <steffen@scheib.me>
2023-03-29 22:19:27 +02:00
Tianling Shen
0e967b37fe
Merge Official Source
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2023-03-30 03:10:42 +08:00
Hauke Mehrtens
5e69c097f7 kernel: bump 5.4 to 5.4.238
Compile-tested: armvirt/64, lantiq/xrx200
Run-tested: armvirt/64, lantiq/xrx200

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2023-03-29 16:31:21 +02:00
Mathias Kresin
8e12360fcf lantiq: ltq-tapi: add kernel 5.10 compatiblity
Due to SCHED_FIFO being a broken scheduler model, all users of
sched_setscheduler() are converted to sched_set_fifo_low() upstream and
sched_setscheduler() is no longer exported.

The callback handling of the tasklet API was redesigned and the macros
using the old syntax renamed to _OLD.

Signed-off-by: Mathias Kresin <dev@kresin.me>
(cherry picked from commit 31f3f797004ad318a1de88ec9cfdece523ee46d9)
[Add DECLARE_TASKLET handling for kernel 5.4.235 too]
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2023-03-29 16:31:21 +02:00
hanwckf
3451ac6453 hnat: show ipv6_en and guest_en status 2023-03-28 18:54:29 +08:00
hanwckf
f2d952d7d7 hnat: enable guest wifi by default 2023-03-28 18:54:16 +08:00
hanwckf
d641a8c6dd defconfig: update 2023-03-28 01:56:00 +08:00
developer
1993b4aa94 [Description]
Fix MT7986 timer inaccurate.
Test: pass

[Release-log]
N/A

Change-Id: I32e5eb1d5ff97e68c1ac00bcf1251a052477b787
Reviewed-on: https://gerrit.mediatek.inc/c/openwrt/feeds/mtk_openwrt_feeds/+/7133509
2023-03-28 01:46:58 +08:00
hanwckf
3520be6447 Merge branch 'openwrt-21.02' of https://github.com/immortalwrt/immortalwrt into openwrt-21.02 2023-03-28 01:37:18 +08:00
Mathias Kresin
3d93d2cea5 ltq-atm/ltq-ptm: add kernel 5.10 compatiblity
The callback handling of the tasklet API was redesigned and the macros
using the old syntax renamed to _OLD.

The stuck queue is now passed to ndo_tx_timeout callback but not used so
far.

Signed-off-by: Mathias Kresin <dev@kresin.me>
(cherry picked from commit 804c541446ab8e3fab11dba5d8fe07807af7fac5)
[Add DECLARE_TASKLET handling for kernel 5.4.235 too]
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2023-03-27 18:42:28 +02:00
John Audia
a4f065a646 kernel: tcindex classifier has been retired
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/net/sched?h=v5.4.235&id=7a6fb69bbcb21e9ce13bdf18c008c268874f0480

Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit fbfec3286e8bfce3a78749b7bcb67e658665f197)
2023-03-27 18:42:28 +02:00
Hauke Mehrtens
122e0c7fed kernel: bump 5.4 to 5.4.234
Compile-tested: armvirt/64, lantiq/xrx200
Run-tested: armvirt/64

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2023-03-27 18:42:03 +02:00
Tianling Shen
7d7e55705c
Merge Official Source
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2023-03-27 20:04:05 +08:00
hanwckf
1838cfca8d hnat: enable ipv6 by default 2023-03-27 17:18:30 +08:00
Rafał Miłecki
c874aa40c2 bcm4908: include usbport trigger
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit cb2661844a5d54d44230ee564d4f17605a794a49)
2023-03-27 09:36:04 +02:00
Rafał Miłecki
13bd05efd7 bcm4908: backport v6.4 pending DTS changes
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit ffaabee9b8d9da7c15a50f52897ae5f70b40b4e7)
2023-03-27 09:36:01 +02:00
Tianling Shen
909f9881fb
kernel: bump to 5.4.238
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2023-03-26 18:35:59 +08:00
Tianling Shen
d1e165884e
ImmortalWrt v21.02.5: revert to branch defaults
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2023-03-25 14:40:33 +08:00
Tianling Shen
7853a2498f
ImmortalWrt v21.02.5: adjust config defaults
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2023-03-25 14:40:33 +08:00
Mathias Kresin
da9ffd2add
lantiq: ltq-tapi: add kernel 5.10 compatiblity
Due to SCHED_FIFO being a broken scheduler model, all users of
sched_setscheduler() are converted to sched_set_fifo_low() upstream and
sched_setscheduler() is no longer exported.

The callback handling of the tasklet API was redesigned and the macros
using the old syntax renamed to _OLD.

Signed-off-by: Mathias Kresin <dev@kresin.me>

ltq tapi

(cherry picked from commit 31f3f797004ad318a1de88ec9cfdece523ee46d9)
2023-03-16 15:58:57 +08:00
Tianling Shen
3b5d11ebc6
lantiq: refresh kernel patches
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2023-03-16 14:54:09 +08:00
Tianling Shen
f167cd2979
ixgbe: fix missing Kconfig
Fixes: #907

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2023-03-16 14:47:08 +08:00
John Audia
25d01b26a1
kernel: tcindex classifier has been retired
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/net/sched?h=linux-5.4.y&id=7a6fb69bbcb21e9ce13bdf18c008c268874f0480

Signed-off-by: John Audia <therealgraysky@proton.me>
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2023-03-16 14:35:04 +08:00
Tianling Shen
714401cbed
ltq-ptm: fix build with kernel 5.4
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2023-03-16 13:06:35 +08:00
Mathias Kresin
17daee647c
ltq-atm/ltq-ptm: add kernel 5.10 compatiblity
The callback handling of the tasklet API was redesigned and the macros
using the old syntax renamed to _OLD.

The stuck queue is now passed to ndo_tx_timeout callback but not used so
far.

Signed-off-by: Mathias Kresin <dev@kresin.me>
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2023-03-15 21:13:52 +08:00
Tianling Shen
0982198339
igb: build for x86 only
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2023-03-15 21:02:57 +08:00
Tianling Shen
9aeea00793
download.pl: update cdn domain
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 3ddf2d6612f08cca008c1881a297bf55753d8901)
2023-03-15 17:44:47 +08:00
Tianling Shen
5c237602f0
iavf: add intel vendor driver
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2023-03-15 15:40:27 +08:00
Tianling Shen
33d2539582
x86: switch to vendor ixgbe driver
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2023-03-15 15:19:09 +08:00
Tianling Shen
34b2606570
ixgbe(vf): add intel vendor driver
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2023-03-15 15:14:56 +08:00
Tianling Shen
181f885645
i40e: download from sourceforge
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2023-03-15 14:49:19 +08:00
Tianling Shen
79e5b24967
x86: switch to vendor igb driver
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2023-03-15 14:37:43 +08:00
Tianling Shen
86d3a78e29
igb: Update to 5.13.16
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2023-03-15 14:37:03 +08:00
Tianling Shen
8e7c12b684
kernel: bump to 5.4.236
Manually rebased:
 - layerscape/patches-5.4/801-audio-0037-MLK-16224-4-ASoC-fsl_sai-support-multi-fifo-and-DSD.patch
 - ramips/patches-5.4/0031-uvc-add-iPassion-iP2970-support.patch

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2023-03-13 23:25:24 +08:00
Tianling Shen
cd7ba71c76
mac80211: refresh vht patch
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit a58903115203f98dd89883294642b4cf27cc3906)
2023-03-11 15:39:00 +08:00
Tianling Shen
cd5e23b104
Merge Official Source
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2023-03-11 12:48:58 +08:00
Felix Fietkau
84451d680c
hostapd: add missing return code for the bss_mgmt_enable ubus method
Fixes bogus errors on ubus calls

Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit cf992ca862f271936f61367236378378f0d91b6d)
2023-03-09 11:00:47 +08:00
Tianling Shen
c35f7f23db
i40e: fix generate compat headers
Fixes: #896

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2023-03-06 13:10:39 +08:00
Leon M. Busch-George
ae4a8f858e
hostapd: always use sae_password for mesh/SAE auth
This patch fixes a corner case when using passwords that are exactly 64
characters in length with mesh mode or passwords longer than 63 characters
with SAE because 'psk' is used instead of 'sae_password'.
SAE is obligatory for 802.11s (mesh point).

The 'psk' option for hostapd is suited for WPA2 and enforces length
restrictions on passwords. Values of 64 characters are treated as PMKs.
With SAE, PMKs are always generated during the handshake and there are no
length restrictions.
The 'sae_password' option is more suited for SAE and should be used
instead.

Before this patch, the 'sae_password' option is only used with mesh mode
passwords that are not 64 characters long.
As a consequence:
- mesh passwords can't be 64 characters in length
- SAE only works with passwords with lengths >8 and <=63 (due to psk
  limitation).

Fix this by always using 'sae_password' with SAE/mesh and applying the PMK
differentiation only when PSK is used.

Fixes: #11324
Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
[ improve commit description ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit ae751535de0cb46978bfcbacab882dd1082e59e3)
2023-03-05 10:49:41 +08:00
Leon M. Busch-George
a0314a2020
hostapd: add quotes in assignments
It's generally advised to use quotes for variable assignments in bash.

Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
(cherry picked from commit 3c10c42ddd4741615b896e1d429ac7d6e91a980f)
2023-03-05 10:49:00 +08:00
Christian Lamparter
23c86d44bc ca-certificates: fix python3-cryptography woes in certdata2pem.py
This patch is a revert of the upstream patch to Debian's ca-certificate
commit 033d52259172 ("mozilla/certdata2pem.py: print a warning for expired certificates.")

The reason is, that this change broke builds with the popular
Ubuntu 20.04 LTS (focal) releases which are shipping with an
older version of the python3-cryptography package that is not
compatible.

|Traceback (most recent call last):
|  File "certdata2pem.py", line 125, in <module>
|    cert = x509.load_der_x509_certificate(obj['CKA_VALUE'])
|TypeError: load_der_x509_certificate() missing 1 required positional argument: 'backend'
|make[5]: *** [Makefile:6: all] Error 1

...or if the python3-cryptography was missing all together:
|Traceback (most recent call last):
|  File "/certdata2pem.py", line 31, in <module>
|    from cryptography import x509
|ModuleNotFoundError: No module named 'cryptography'

More concerns were raised by Jo-Philipp Wich:
"We don't want the build to depend on the local system time anyway.
Right now it seems to be just a warning but I could imagine that
eventually certs are simply omitted of found to be expired at
build time which would break reproducibility."

Link: <https://github.com/openwrt/openwrt/commit/7c99085bd697>
Reported-by: Chen Minqiang <ptpt52@gmail.com>
Reported-by: Shane Synan <digitalcircuit36939@gmail.com>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
(cherry picked from commit 25bc66eb40ea2c062940778fba601032b2579734)
2023-03-04 13:09:12 +01:00
Christian Lamparter
f67f60b809 ca-certicficates: Update to version 20211016
Update the ca-certificates and ca-bundle package from version 20210119 to
version 20211016.

Debian change-log entry [1]:
|[...]
|[ Julien Cristau ]
|* mozilla/{certdata.txt,nssckbi.h}: Update Mozilla certificate authority
|    bundle to version 2.50
|    The following certificate authorities were added (+):
|    + "AC RAIZ FNMT-RCM SERVIDORES SEGUROS"
|    + "GlobalSign Root R46"
|    + "GlobalSign Root E46"
|    + "GLOBALTRUST 2020"
|    + "ANF Secure Server Root CA"
|    + "Certum EC-384 CA"
|    + "Certum Trusted Root CA"
|    The following certificate authorities were removed (-):
|    - "QuoVadis Root CA"
|    - "Sonera Class 2 Root CA"
|    - "GeoTrust Primary Certification Authority - G2"
|    - "VeriSign Universal Root Certification Authority"
|    - "Chambers of Commerce Root - 2008"
|    - "Global Chambersign Root - 2008"
|    - "Trustis FPS Root CA"
|    - "Staat der Nederlanden Root CA - G3"
|  * Blacklist expired root certificate "DST Root CA X3" (closes: #995432)
|[...]

[1] <https://metadata.ftp-master.debian.org/changelogs//main/c/ca-certificates/ca-certificates_20211016_changelog>

Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
(cherry picked from commit 7c99085bd69742f66207d61e9f2da5ec4f8f9d2f)
2023-03-04 13:09:12 +01:00
coolsnowwolf
3c00c15667
x86: disable EEE for Intel I225/I226 network dropout issues
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2023-03-04 10:46:07 +08:00
hanwckf
46bc702394
Merge pull request #55 from qlugcp/openwrt-21.02
add support for gl-mt3000 and basic support for gl-mt7981 series
2023-03-01 20:24:34 +08:00
Rafał Miłecki
f86f8e5684 kernel: support "linux,default-trigger" in leds-bcm63138
This driver is backported from the v6.0 which deals with
"linux,default-trigger" in leds core. For kernel 5.4 we need
leds-bcm63138 to read trigger on its own.

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
2023-03-01 08:54:33 +01:00
Tianling Shen
08281831be
i40e: bump to 2.22.18
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2023-03-01 12:59:11 +08:00
Tianling Shen
cc9a7cea38
ramips: jcg q20: add lzma-loader and pb-boot variants
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2023-03-01 08:28:22 +08:00