openwrt.git, branch stable

OpenWrt v23.05.4: adjust config defaults

2024-07-16T21:51:19+00:00

Signed-off-by: Hauke Mehrtens

build: include tests/Makefile if available

2024-07-15T22:14:18+00:00

Testing OpenWrt is important, and there is a test suite in the making. For maximum convenience and minimal CI over-usage, make it simple to run tests locally. The main Makefile now attempts to include `tests/Makefile` and silently fails if it doesn't. While the test suite[1] is still young, it provides good examples of how to test things around OpenWrt: starting with shell scripts using `bats`[2], followed by QEMU tests, and finally real device tests using LabGrid[3]. This could lead to the creation of the best OpenWrt version yet. Please consult the `openwrt-tests.git` README.md for details on the setup. Once installed you may run commands like the following: * make tests/shell # run shell tests * make tests/x86-64 # run and test x86/64 in QEMU [1]: http://github.com/aparcar/openwrt-tests/ [2]: https://bats-core.readthedocs.io [3]: https://labgrid.readthedocs.io Signed-off-by: Paul Spooren Link: https://github.com/openwrt/openwrt/pull/15647 Signed-off-by: Christian Marangi (cherry picked from commit a8ff0c1b7e5aefb8bcd31e0eeb82d2c11399223f)

wolfssl: Update to version 5.7.2

2024-07-15T22:05:18+00:00

This fixes multiple security problems: * [Medium] CVE-2024-1544 Potential ECDSA nonce side channel attack in versions of wolfSSL before 5.6.6 with wc_ecc_sign_hash calls. * [Medium] CVE-2024-5288 A private key blinding operation, enabled by defining the macro WOLFSSL_BLIND_PRIVATE_KEY, was added to mitigate a potential row hammer attack on ECC operations. * [Low] When parsing a provided maliciously crafted certificate directly using wolfSSL API, outside of a TLS connection, a certificate with an excessively large number of extensions could lead to a potential DoS. * [Low] CVE-2024-5991 In the function MatchDomainName(), input param str is treated as a NULL terminated string despite being user provided and unchecked. * [Medium] CVE-2024-5814 A malicious TLS1.2 server can force a TLS1.3 client with downgrade capability to use a ciphersuite that it did not agree to and achieve a successful connection. * [Medium] OCSP stapling version 2 response verification bypass issue when a crafted response of length 0 is received. * [Medium] OCSP stapling version 2 revocation bypass with a retry of a TLS connection attempt. Unset DISABLE_NLS to prevent setting the unsupported configuration option --disable-nls which breaks the build now. Link: https://github.com/openwrt/openwrt/pull/15948 Signed-off-by: Hauke Mehrtens (cherry picked from commit 3a0232ffd33f2dc894c671d90de6b2766399f4dc)

mediatek: filogic: prevent faulty mac address assignment

2024-07-15T14:13:59+00:00

The vendor U-Boot on the Cudy M3000 and the Yuncore AX835 assign random mac addresses on boot and set the 'local-mac-address' property which prevents Openwrt from assigning the correct address from evmem. This patch removes the alias for ethernet0 so that U-Boot doesn't add the property, removes the workaround from 02_network, and adds back the nvmem definition for the M3000. Signed-off-by: Leon M. Busch-George (cherry picked from commit a55ab9e1343e85021253e9c55f67adf33ad68f09)

mediatek: filogic: add support for Cudy M3000 v1

2024-07-15T14:12:33+00:00

Hardware: SoC: MT7981b RAM: 256 MB Flash: 128 MB SPI NAND Ethernet: 1x 2.5Gbps (rtl8221b) 1x 1Gbps (integrated phy) WiFi: 2x2 MT7981 Buttons: Reset, WPS LED: 1x multicolor Solder on UART: - remove rubber ring on the bottom - remove screws - pull up the cylinder, maybe help by push on an ethernet socket with a screwdriver - remove the (3) screws holding the board in the frame - remove the board from the frame to get to the screws for the silver, flat heat shield - remove the (3) screws holding the heat shield - solder UART pins to the back of the board - make sure to have the pins point out on side with the black, finned heat spread - the markings for the pins are going to be below the silver heat shield - Vcc is not needed If you don't intend on using the UART outside of the installation process, you might not want to solder: - carefully scrape off the thin layer of epoxy on the holes (not the copper) - place your pin header with the UART attached in the holes - the pins, starting with the one closest to the socket: - Vcc (not required) - GND - RX - TX - either wedge the header or hold it with your fingers so that the pins stay in contact with the board Installation (UART): - attach an Ethernet cable to the 1Gbps port (black) on the router - hold the reset button while powering the router - press CTRL-C or wait for the timeout to get to the U-Boot prompt - prepare a TFTP server on the network to supply ..-initramfs-kernel.bin - use 'tftpboot' in the U-Boot shell to pull the image - boot the image using 'bootm' - push the ..-sysupgrade to the router using your preferred method - perform the upgrade with 'sysupgrade -n' There is a recovery mechanism that involves fetching a file called 'recovery.bin' but that is not understood yet. Signed-off-by: Leon M. Busch-George (cherry picked from commit 20e4a18feb3f766b0f6ebec1afc154b345398a7a)

uboot-mediatek: enable rootwait for jdcloud re-cp-03

2024-07-15T14:10:16+00:00

Sometimes the mmc deivce may come up later than kernel attempts to mount rootfs, resulting kernel panic. Enable rootwait to fix it. Signed-off-by: Tianling Shen

uboot-mediatek: fix patch order

2024-07-15T14:10:06+00:00

Make sure patch sequence number is unique by moving patch 440-add-jdcloud_re-cp-03.patch -> 441-add-jdcloud_re-cp-03.patch Signed-off-by: Daniel Golle (cherry picked from commit 2302a7c5ad9c894d0530b7700409b2f4ea4bcc91)

mediatek: fix lan/wan macaddr for jdcloud re-cp-03

2024-07-15T14:07:15+00:00

The MAC address assigned to lan/wan was reversed. Fixes: 6e51ff88b053 ("mediatek: add support for JDCloud RE-CP-03") Signed-off-by: Tianling Shen

ath79: replace "mac-address-ascii" with "mac-base"

2024-07-15T07:59:31+00:00

With upstream accepted "mac-base" binding there is no need for a downstream "mac-address-ascii" workaround anymore. Signed-off-by: Rafał Miłecki (cherry picked from commit daaa0c1b250498acbf91697dfc75c9d3fbac3596) Link: https://github.com/openwrt/openwrt/pull/15917

ucode: update to Git 1a8a0bcf725520820802ad433db22d8f64fbed6c (2024-07-11)

2024-07-13T23:27:28+00:00

96f74b5be829 ubus: make ubus_context first in uc_ubus_connection_t 7e5830edfb38 nl80211: fix datatype of NL80211_BAND_IFTYPE_ATTR_HE_CAP_{MAC,PHY} attrs 5c8fd34bac42 nl80211: fix parsing of NL80211_BAND_ATTR_VHT_MCS_SET attribute e8d4e4fe967d nl80211: fix decoding of NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET attribute 30a3f7ad0433 rtnl: store callback in listener registry only on success 9cbe8294909f rtnl: optimize reception of rtnl events 534417132e18 rtnl: increase event socket rx buffer size limit to 1 MiB 3f9811d2f7b7 compiler: close upvalues on loop control statements ee4af9b55cb4 vm: rework object iteration a275399dd8e2 uci: refactor uci.changes() to match documentation 1220992631d5 ubus: automatically clear error information d6fd94014eea uci: automatically clear error information 99837f280b61 uloop: automatically clear error information ba3855ae3775 lib: fix documentation typo for `pop()` function be767ae197ba vm: rework `in` operator semantics 4ade84e8fb81 ubus: add explicit support for deferring incoming requests cfe137be068a uci: remove incorrectly documentated reorder() parameter e8d78a26da0c lib: introduce socket library a0ad1d127ae6 build: fix symbol and library detection 674f65ee551d jsdoc: disable default module titles a33d16a86493 socket: rework error handling e2b81d869222 uloop: add documentation 953f36c96e8a socket: make socket.send() accept non-string data f211d5ac666f ubus: fix uc_ubus_have_uloop for eloop+uloop combination 0662de64bd1f socket: add AF_PACKET socket type support b594ff8a2841 socket: remove leftover debug code 0d823e702bfe socket: fix addrinfo() with omitted service argument 8cf816d615fd socket: fix potential memory leak in connect() 8f5f231d66cd socket: optimize poll() argument handling 36f106056069 socket: remove wrong documentation fragment 525fca224012 socket: uv_to_sockaddr(): fix length calculation for AF_UNIX addresses 3938645ad9e3 socket: support IPv6 addresses in struct conversion routines 3a586dc7ddbe socket: improve uc_socket_connect() behavior 7b269f1cd3d2 socket: improve uc_socket_listen() behavior fc6f2b89febf socket: handle further socket option value types d6f25797dad1 socket: add IPv6 socket options 7611487b9a05 socket: implement recvmsg(), sendmsg() and cmsg support d2e44bfa8b54 core-lib: improved documentation e0bab40c8578 fs: add truncate() file method 5d305cfb2ab7 fs: add lock() file method 8b0318f7fabe lib: introduce zlib library 73644a036f5a nl80211: move access to tb array out of uc_nl_convert_attr and below 6e3cf83a77a7 nl80211: add support for multi-attribute arrays 6ff24d5488a9 nl80211: update nl80211.h to latest wireless-next abc2aef28641 nl80211: add wiphy multi-radio support Fixes: https://github.com/jow-/ucode/issues/186 Fixes: https://github.com/jow-/ucode/issues/187 Fixes: https://github.com/jow-/ucode/issues/188 Fixes: https://github.com/jow-/ucode/issues/193 Signed-off-by: Jo-Philipp Wich