Release notes:
https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.4.3-relnotes.txt
```
It includes the following security fix:
* A malicious certificate can cause an infinite loop.
Reported by and fix from Tavis Ormandy and David Benjamin, Google.
(CVE-2022–0778)
```
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 25534d5cc20a807ff776fdb18847344167ce081d)
Changes between 1.1.1o and 1.1.1p [21 Jun 2022]
*) In addition to the c_rehash shell command injection identified in
CVE-2022-1292, further bugs where the c_rehash script does not
properly sanitise shell metacharacters to prevent command injection have been
fixed.
When the CVE-2022-1292 was fixed it was not discovered that there
are other places in the script where the file names of certificates
being hashed were possibly passed to a command executed through the shell.
This script is distributed by some operating systems in a manner where
it is automatically executed. On such operating systems, an attacker
could execute arbitrary commands with the privileges of the script.
Use of the c_rehash script is considered obsolete and should be replaced
by the OpenSSL rehash command line tool.
(CVE-2022-2068)
[Daniel Fiala, Tomáš Mráz]
*) When OpenSSL TLS client is connecting without any supported elliptic
curves and TLS-1.3 protocol is disabled the connection will no longer fail
if a ciphersuite that does not use a key exchange based on elliptic
curves can be negotiated.
[Tomáš Mráz]
Signed-off-by: Andre Heider <a.heider@gmail.com>
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
The empty executable is causing problems with meson builds, due to the
error: OSError: [Errno 8] Exec format error: 'ldconfig'
This patch changes the empty ldconfig stub to symlink to /bin/true to
work around this issue.
Fixes: FS#4117
Fixes: 3bd31cc4d2ff ("tools/meson: update to 0.60.0")
Signed-off-by: Damien Mascord <tusker@tusker.org>
Tested-by: Aleksander Jan Bajkowski <olek2@wp.pl> # Tested on Debian 11
Tested-By: Lucian Cristian <lucian.cristian@gmail.com>
Tested-By: Baptiste Jonglez <git@bitsofnetworks.org>
Cc: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 6a5b4228e30244b44a49f523dea66caf3fbe3307)
Signed-off-by: Baptiste Jonglez <git@bitsofnetworks.org>
[backport to fix prereq check when moving from 22.03 branch to 21.02]
Delete the crypto-lib-blake2s kmod package, as BLAKE2s is now built-in.
Fixes: be0639063a70 ("kernel: bump 5.4 to 5.4.203")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This patch was backported to kernel 5.4.200, but without the wireguard
change, because wireguard is not available in upstream kernel 5.4.
This adds the missing changes for wireguard too.
Fixes: be0639063a70 ("kernel: bump 5.4 to 5.4.203")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Since kernel 5.5-rc1 [1], there are upstreamed DTS files related to ESPRESSObin
variants. Move these to files-5.4.
This helps if you want to use a newer kernel version than used
in OpenWrt 21.02 (= LTS kernel 5.4), you would end up with duplicate files
(one outdated, one up to date from newer Linux versions).
Fixes:
Error: arch/arm64/boot/dts/marvell/armada-3720-espressobin-v7.dts:19.1-7:
Label or path ports not found
FATAL ERROR: Syntax error parsing input tree
[1] 447b878935
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
(cherry picked from commit 7be8ab4f7b582924bca6594103735d888989d804)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
[reword commit subject and commit description]
Flow offload dst can become invalid after the route cache is created.
dst_check() in packet path is necessary to prevent packet drop.
Signed-off-by: Ritaro Takenaka <ritarot634@gmail.com>
This release comes with a security fix related to c_rehash. OpenWrt
does not ship or use it, so it was not affected by the bug.
There is a fix for a possible crash in ERR_load_strings() when
configured with no-err, which OpenWrt does by default.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 7a5ddc0d06895bde7538d78c8dad2c863d70f946)
Major changes are:
4 cleanups & typos fixes.
Add keep_last_dots mount option to allow access to paths
with trailing dots.
Avoid repetitive volume dirty bit set/clear to improve
storage life time.
Fix ->i_blocks truncation issue caused by wrong 32bit mask.
Fix ->i_blocks truncation issue that still exists elsewhere.
Fix missing REQ_SYNC in exfat_update_bhs().
Fix referencing wrong parent directory information during rename.
Fix slab-out-bounds in exat_clear_bitmap() reported from syzbot.
Improve performance while zeroing a cluster with dirsync mount option.
Introduce a sys_tz mount option to use system timezone.
Move super block magic number to magic.h
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
RT-AC2200 is the same device with a different name. The OEM firmwares have the same MD5.
Signed-off-by: Ray Wang <raywang777@foxmail.com>
(cherry picked from commit 3204906569768cabcbedb5eaa3a11e2fcb18cd48)
Assign LED numbers properly by adding function-enumerator property in DTS.
While at it, remove default trigger of LAN LEDs as it will be handled in
01_leds anyway.
Fixes: 51b9aef553a8 ("ipq40xx: add support for ASUS RT-ACRH17/RT-AC42U")
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
(cherry picked from commit 266b5c83c32c13dbd05f0d6f251815cbe6f55621)
SOC: IPQ4019
CPU: Quad-core ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d
DRAM: 256 MB
NAND: 128 MiB Macronix MX30LF1G18AC
ETH: Qualcomm Atheros QCA8075 Gigabit Switch (4x LAN, 1x WAN)
USB: 1x 3.0 (via Synopsys DesignWare DWC3 controller in the SoC)
WLAN1: Qualcomm Atheros QCA4019 2.4GHz 802.11bgn 2x2:2
WLAN2: Qualcomm Atheros QCA9984 5GHz 802.11nac 4x4:4
INPUT: 1x WPS, 1x Reset
LEDS: Status, WIFI1, WIFI2, WAN (red & blue), 4x LAN
This board is very similar to the RT-ACRH13/RT-AC58U. It must be flashed
with an intermediary initramfs image, the jffs2 ubi volume deleted, and
then finally a sysupgrade with the final image performed.
Signed-off-by: Joshua Roys <roysjosh@gmail.com>
(added ALT0)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
(cherry picked from commit 51b9aef553a82cbc80c12e13a4011d4d2e29fde4)
WolfSSL is crashing with an illegal opcode in some x86_64 CPUs that have
AES instructions but lack other extensions that are used by WolfSSL
when AES-NI is enabled.
Disable the option by default for now until the issue is properly fixed.
People can enable them in a custom build if they are sure it will work
for them.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 0bd536723303ccd178e289690d073740c928bb34)
This fixes a well known "LZMA ERROR 1" error, reported previously on
numerous of other devices from 'ramips' target.
Fixes: #9842Fixes: #8964
Reported-by: Juergen Hench <jurgen.hench@gmail.com>
Tested-by: Juergen Hench <jurgen.hench@gmail.com>
Signed-off-by: Demetris Ierokipides <ierokipides.dem@gmail.com>
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
(cherry picked from commit fd72e595c2b2a46bab8cbc7e9415fbfeae7b5b0d)
The MediaTek's Crypto Engine driver has been replaced with the upstream
Inside Secure's SafeXcel cryptographic engine driver, however kconfig
has not been changed accordingly, this commit fixes it.
Fixes: 127ad76 ("mediatek: switch over to extended upstream eip97
driver")
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
The MediaTek's Crypto Engine module is only available for mt7623, in
which case it is built into the kernel.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 3f2d0703b60357e3ff1865783335be9f51528eb8)
Both buttons on the RT-AC57U are active-low. Fix the GPIO flag for the
WPS cutton to fix button behavior.
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 535b0c70b1c466733b009144f81f5207f1ecd311)
This enables armv8 crypto extensions version of AES, GHASH, SHA1, and
CRC T10 algorithms in the kernel.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 9be35180f43a4916f53430d8c93437d33896e860)
Adds the crypto extensions version of the CRC T10 algorithm that is
already built into the kernel.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 1b94e4aab8ddbe5719f1e859e064c1c5dfa4587f)
This enables armv8 crypto extensions version of AES, GHASH, SHA1,
SHA256, and SHA512 algorithms in the kernel.
The choice of algorithms match the 32-bit versions that are enabled in
the target config-5.10 file, but were only used by the cortexa9
subtarget.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 06bb5ac1f2b62c3e10f24d7096e86f6368aaf41d)
This enables armv8 crypto extensions version of AES, GHASH, SHA1,
SHA256, and SHA512 algorithms in the kernel.
The choice of algorithms match the 32-bit versions that are enabled in
the target config-5.10 file, but were only used by the cortexa9
subtarget.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit f5167e11bf7e0a1a3675f0563423254005d0eb2d)
This enables armv8 crypto extensions version of AES, GHASH, SHA256 and
CRC T10 algorithms in the kernel.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit eb33232420ea2537d8302d5ec121eed03db474d1)
This enables armv8 crypto extensions version of AES and GHASH algorithms
in the kernel.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit b2cb87bc98e8d7b5f29899b8b966990e200cfe44)
This enables arm64/neon version of AES, SHA256 and SHA512 algorithms in
the kernel. bcm2711 does not support armv8 crypto extensions, so they
are not included.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 7b6beb7489c750c0613153822ec1d5ba8a9ab388)
This enables arm64/neon version of AES, SHA256 and SHA512 algorithms in
the kernel. bcm2710 does not support armv8 crypto extensions, so they
are not included.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 38ebb210a9f4895cfade3580815d5c9a3eb1b7e4)
This enables AES & SHA CPU instructions for compatible armv8, and x86_64
architectures. Add this to the hardware acceleration choice, since they
can't be enabled at the same time.
The package was marked non-shared, since the arm CPUs may or may not
have crypto extensions enabled based on licensing; bcm27xx does not
enable them. There is no run-time detection of this for arm.
NOTE:
Should this be backported to a release branch, it must be done shortly
before a new minor release, because the change to nonshared will remove
libwolfssl from the shared packages, but the nonshared are only built in
a subsequent release!
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 0a2edc2714dcda10be902c32525723ce2cbcb138)
This packages the wolfssl benchmark utility.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 18fd12edb810f9dfbf8410bb81f639df052134cb)
Enabling different hardware crypto acceleration should not change the
library ABI. Add them to PKG_CONFIG_DEPENDS after the ABI version hash
has been computed.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 677774d445ced1a56e73fe62df47b4eb66441721)
Do not include the dnsmasq and odhcpd-ipv6only package by default any
more. These services are not needed on a switch. If someone needs this
it is still possible to use opkg or image builder to add them.
This decreases the compressed image size by about 165KBytes.
Tested-by: Stijn Segers <foss@volatilesystems.org>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 2acebbdcaafbdfd3f677052c28bc0af04c6b5ab8)
Flow offload dst can become invalid after the route cache is created.
dst_check() in packet path is necessary to prevent packet drop.
Signed-off-by: Ritaro Takenaka <ritarot634@gmail.com>
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Makes sure that Ninja from staging_dir is used and nowhere else.
Reported by reproducible builds project. Builds have been failing ever
since tools/cmake started using Ninja.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 0d25db7f17efbf5ab539508dd0a5d1eb739a1c43)
