13151 Commits

Author SHA1 Message Date
Zoltan Herpai
e6fbf31baa Merge pull request #580 from wigyori/cc-libpcap
CC: upgrade libpcap to 1.8.1
2017-12-08 11:07:24 +01:00
Zefir Kurtisi
8ed1685652 libpcap: Fix build when PACKAGECONFIG ipv6 is not enabled
Add patches provided upstream [1] by Fabio Berton to fix error:

> ./gencode.c: In function 'pcap_compile':
> ./gencode.c:693:8: error: 'compiler_state_t {aka struct _compiler_state}' has no member named 'ai'
>   cstate.ai = NULL;
>         ^
> ./gencode.c: In function 'gen_gateway':
> ./gencode.c:4914:13: error: 'cstate' undeclared (first use in this function)
>    bpf_error(cstate, "direction applied to 'gateway'");
>              ^

[1] https://github.com/the-tcpdump-group/libpcap/pull/541

Signed-off-by: Fabio Berton <fabio.berton@ossystems.com.br>
Tested-by: Zefir Kurtisi <zefir.kurtisi@neratec.com>
2017-12-07 13:14:18 +01:00
p-wassi
8b2aafcfc0 libs/libpcap: update to 1.8.1
Update libpcap to upstream release 1.8.1
Change the name from libpcap.so.1.3 to libpcap.so.1
Remove parts of patch 201 which moved code among src files.
Import patch 204 from Debian to update the USB path.

Signed-off-by: Paul Wassi <p.wassi@gmx.at>
Signed-off-by: Felix Fietkau <nbd@nbd.name> [fix parallel build bug]
2017-12-07 13:07:11 +01:00
Matthias Schiffer
e5fa97ab9d libpcap: fix dependency of install-shared-so make target
There seems to be a situation in which a rebuild of libpcap.so is triggered
in the install step of the libpcap Makefile. libpcap.so is the wrong
target, leading to the build failure reported in [1].

Fix the dependency of install-shared-so to $(SHAREDLIB) so the build can
succeed in this case.

[1] https://dev.openwrt.org/ticket/19894

Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
2017-12-07 13:07:04 +01:00
Dirk Neukirchen
aad40735b8 libpcap: remove unrecognized configure options
Signed-off-by: Dirk Neukirchen <dirkneukirchen@web.de>
2017-12-07 12:40:47 +01:00
John Crispin
fcee13b8f1 libpcap: USB support by default if usbmon is enabled
If building usbmon support then you'll likely want to have
USB support in libpcap as well.

Signed-off-by: Bjørn Mork <bjorn@mork.no>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@47265 3c298f89-4303-0410-b956-a3cf2f4a3e73
2017-12-07 12:40:32 +01:00
Felix Fietkau
aa7cef756e libpcap: update to version 1.7.4
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@46776 3c298f89-4303-0410-b956-a3cf2f4a3e73
2017-12-07 12:40:03 +01:00
Steven Barth
a0b3bb7c0a libpcap: fixup libtool
Signed-off-by: Steven Barth <steven@midlink.org>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@46074 3c298f89-4303-0410-b956-a3cf2f4a3e73
2017-12-07 12:39:56 +01:00
Nico Maas
78d22a501e CC: brcm2708-gpu-fw: update md5sum in Makefile
Update the MD5 of the firmware for Raspberry Pi to enable build on the Chaos Calmer / 15.05.1 target again. 
The checksum changed due to changes of the Github Tar Handling as described here: raspberrypi/firmware#873
After that change, builds for RPi on 15.05.1 succeed again.
Signed-off-by: Nico Maas <mail@nico-maas.de>
2017-11-20 10:42:22 +01:00
Zoltan HERPAI
bbed69b2db CC: ca-certificates: bump to 20161130+nmu1
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
2017-11-04 23:01:48 +01:00
Christian Schoenebeck
4b010604b4 CC: ca-certificates: update to version 20161130
Signed-off-by: Christian Schoenebeck <christian.schoenebeck@gmail.com>
2017-11-04 23:01:32 +01:00
Stanislav Izmalkov
9c769e3cd0 CC: ca-certificates: bump to 20161102
Signed-off-by: Stanislav Izmalkov <izstas@live.ru>
2017-11-04 23:01:17 +01:00
Daniel Dickinson
aa112f7610 CC: ca-certificages: Add certificate bundle for packages that need it
Some packages don't use /etc/ssl/certs but instead use /etc/ssl/certs/ca-certificates.crt.
For those packages add a ca-bundle package>.

Signed-off-by: Daniel Dickinson <openwrt@daniel.thecshore.com>
2017-11-04 23:00:59 +01:00
Felix Fietkau
3807ba2d10 CC: ca-certificates: update to version 20160104
- update to latest version 20160104
- remove cpu dependency (PKGARCH:=all)
- set myself as package maintainer

Signed-off-by: Christian Schoenebeck <christian.schoenebeck@gmail.com>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@48271 3c298f89-4303-0410-b956-a3cf2f4a3e73
2017-11-04 23:00:11 +01:00
John Crispin
de0adaf4d1 CC: ca-certificates: update to version 20151214
update to version 20151214

Signed-off-by: Christian Schoenebeck <christian.schoenebeck@gmail.com>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@48000 3c298f89-4303-0410-b956-a3cf2f4a3e73
2017-11-04 22:59:53 +01:00
Zoltan HERPAI
63301d89f2 CC: openssl: bump to 1.0.2m
Fixes:
CVE-2017-3735
CVE-2017-3736

Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
2017-11-04 22:04:06 +01:00
Zoltan HERPAI
393af00362 CC: hostapd: bump PKG_VERSION
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
2017-11-04 20:42:43 +01:00
Zoltan HERPAI
b51ff6883b iproute2: use URL alias
Drop hardcoded URL and use the @KERNEL alias.

Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
2017-11-04 20:33:01 +01:00
Zoltan Herpai
216adcfbd0 Merge pull request #559 from wigyori/cc-misc2
CC: upgrade openssl, fix ugps compilation
2017-10-18 09:12:35 +02:00
Jason A. Donenfeld
c31b1d877c wireguard: simple version bump
This is a simple version bump.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-10-17 19:40:03 +02:00
Zoltan HERPAI
9bb8e11e7e CC: openssl: bump to 1.0.2l
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
2017-10-16 22:22:51 +02:00
Zoltan HERPAI
f71dabf4a0 CC: ugps: fix PKG_SOURCE path
Thanks to alex <peterwillcn@gmail.com> for reporting a fix.

Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
2017-10-16 22:22:45 +02:00
Zoltan Herpai
b7ded9ed3f Merge pull request #557 from zx2c4/for-chaos
wireguard: add wireguard to base packages [chaos branch]
2017-10-16 17:44:38 +02:00
Zoltan Herpai
acfb6c2181 Merge pull request #555 from wigyori/cc-hostapd2
CC: upgrade hostapd to 2016-06-15, include KRACK fix
2017-10-16 17:35:00 +02:00
Jason A. Donenfeld
6d3528bf03 wireguard: add wireguard to base packages
Move wireguard from openwrt/packages to openwrt/openwrt. This has already
been done with lede/source and has already been removed from
openwrt/packages, and so this commit brings this to parity here, so that
there isn't a regression for openwrt users. Original message follows below:

This follows the pattern of kmod-cake and openvpn. Cake is a fast-moving
experimental kernel module that many find essential and useful. The
other is a VPN client. Both are inside of core. When you combine the two
characteristics, you get WireGuard. Generally speaking, because of the
extremely lightweight nature and "stateless" configuration of WireGuard,
many view it as a core and essential utility, initiated at boot time
and immediately configured by netifd, much like the use of things like
GRE tunnels.

WireGuard has a backwards and forwards compatible Netlink API, which
means the userspace tools should work with both newer and older kernels
as things change. There should be no versioning requirements, therefore,
between kernel bumps and userspace package bumps.

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-10-16 17:09:56 +02:00
Zoltan Herpai
d3c2257fcd Merge pull request #554 from wigyori/cc-ovpn2
CC: mbedtls fixes
2017-10-16 15:49:25 +02:00
Zoltan HERPAI
f76824fd6e CC: polarssl: fix incorrect md5sum
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
2017-10-16 15:03:27 +02:00
Kevin Darbyshire-Bryant
4cd5e886a0 CC: mbedtls: enable NIST curves optimisation.
luci using ustream-mbedtls is extremely slow vs ustream-polarssl.
polarssl alias mbedtls v1 is configured to use NIST prime speed
optimisation, so no longer disable the default optimisation for
mbedtls v2.

Compile & run tested: Archer C7v2

Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
[Jo-Philipp Wich: refresh patch to use common format]
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2017-10-16 14:40:34 +02:00
Zoltan HERPAI
a1524efd13 CC: hostapd: fix WPA packet number reuse with replayed messages and key reinstallation
Fixes:
- CERT case ID: VU#228519
- CVE-2017-13077
- CVE-2017-13078
- CVE-2017-13079
- CVE-2017-13080
- CVE-2017-13081
- CVE-2017-13082
- CVE-2017-13086
- CVE-2017-13087
- CVE-2017-13088

For more information, please refer to:
https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt

Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
2017-10-16 14:38:45 +02:00
Felix Fietkau
a4f8825e0f CC: hostapd: update to version 2016-06-15
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2017-10-16 14:12:39 +02:00
Michal Hrusecky
bb8a1d3adf CC: hostapd: Update to version 2016-05-05
Fixes CVE-2016-4476 and few possible memory leaks.

Signed-off-by: Michal Hrusecky <Michal.Hrusecky@nic.cz>
2017-10-16 14:07:36 +02:00
Felix Fietkau
d04634f2b7 CC: hostapd: fix mesh interface bridge handling
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 48529
2017-10-16 14:06:29 +02:00
Felix Fietkau
324f95d2a1 CC: hostapd: fix wpad-mesh and wpa-supplicant-mesh configuration issues
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 48528
2017-10-16 14:04:46 +02:00
Felix Fietkau
6b2ab1d36a CC: hostapd: work around unconditional libopenssl build dependency
As the OpenWrt build system only resolves build dependencies per directory,
all hostapd variants were causing libopenssl to be downloaded and built,
not only wpad-mesh. Fix this by applying the same workaround as in
ustream-ssl.

Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>

SVN-Revision: 46851
2017-10-16 14:04:34 +02:00
Felix Fietkau
b0f2c9d602 hostapd: update to version 2016-01-15
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
[Drop 014 - Zoltan HERPAI <wigyori@uid0.hu>]
2017-10-16 13:41:14 +02:00
Felix Fietkau
08a15abe4f CC: hostapd: add default value to eapol_version (#20641)
r46861 introduced a new option eapol_version to hostapd, but did not
provide a default value. When the option value is evaluated,
the non-existing value causes errors to the systen log:
"netifd: radio0: sh: out of range"

Add a no-op default value 0 for eapol_version. Only values 1 or 2 are
actually passed on, so 0 will not change the default action in hostapd.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

SVN-Revision: 47361
2017-10-16 13:38:17 +02:00
Felix Fietkau
416562992f CC: hostapd: Add eapol_version config option
Add eapol_version to the openwrt wireless config ssid section.
Only eapol_version=1 and 2 will get passed to hostapd, the default
in hostapd is 2.

This is only useful for really old client devices that don't
accept eapol_version=2.

Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>

SVN-Revision: 46861
2017-10-16 13:36:56 +02:00
Zoltan Herpai
f6802c747f Merge pull request #550 from wigyori/cc-ovpn2
CC: sec upgrade for openvpn, polarssl, lzo
2017-10-16 09:27:54 +02:00
Hauke Mehrtens
b130306800 CC: polarssl: update to version 1.3.17
This fixes 3 minor security problems.
SSLv3 is deactivated by default now.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2017-10-12 17:14:16 +02:00
Jo-Philipp Wich
ac36e05e86 CC: polarssl: enable AES-GCM and CAMELLIA-GCM ciphersuites
Recent versions of Chrome require this ciphers to successfully handshake with
a TLS enabled uhttpd server using the ustream-polarssl backend.

If `CONFIG_GCM` is disabled, `ssl_ciphersuite_from_id()` will return `NULL`
when cipher `0x9d` is looked up, causing the calling `ssl_ciphersuite_match()`
to fail with `POLARSSL_ERR_SSL_INTERNAL_ERROR`.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2017-10-12 17:13:56 +02:00
Felix Fietkau
7333f9defb CC: polarssl: update to 1.3.16, fixes intermediate certificate validation
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 48257
2017-10-12 17:13:20 +02:00
Hauke Mehrtens
7e043b4824 CC: polarssl: update to version 1.3.15
This is a minor version update which fixes some small bugs. None of
these bugs were exploitable according to the release notes.

Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>

SVN-Revision: 47724
2017-10-12 17:13:07 +02:00
Zoltan HERPAI
3560533f9b CC: lzo: update to 2.10
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
2017-10-12 17:12:05 +02:00
John Crispin
bc23a9bae1 CC: package/libs/lzo: update version to 2.09
Updates lzo to version 2.09 and changes copyright to 2016.

Signed-off-by: Daniel Engberg <daniel.engberg.lists@pyret.net>

SVN-Revision: 49110
2017-10-12 17:08:21 +02:00
Zoltan HERPAI
726667d4f1 CC: openvpn: bump to 2.3.18
Fixes (above various bugs):
CVE-2017-7478
CVE-2017-7479
CVE-2017-7521

Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
2017-10-12 17:07:59 +02:00
Magnus Kroken
f5a98630db CC: openvpn: quote parameters to --push in openvpn config file
OpenVPN requires arguments to --push to be enclosed in double quotes.
One set of quotes is stripped when the UCI config is parsed.
Change append_params() of openvpn.init to enclose push parameters in
double quotes.

Unquoted push parameters do not cause errors in OpenVPN 2.3,
but OpenVPN 2.4 fails to start with unquoted push parameters.

Fixes: FS#290.

Signed-off-by: Magnus Kroken <mkroken@gmail.com>
2017-10-12 16:28:49 +02:00
Magnus Kroken
6f6a00bd57 CC: openvpn: update to 2.3.13
Changelog: https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23#OpenVPN2.3.13

Signed-off-by: Magnus Kroken <mkroken@gmail.com>
2017-10-12 16:28:28 +02:00
John Crispin
7cb5f862e4 CC: openvpn: cacert does not exist
cacert is really called ca and already in the script

Signed-off-by: John Crispin <john@phrozen.org>
2017-10-12 16:28:17 +02:00
John Crispin
267377389e CC: openvpn: add handling for capath and cafile
Signed-off-by: John Crispin <john@phrozen.org>
2017-10-12 16:27:59 +02:00
Magnus Kroken
07f5846221 CC: openvpn: update to 2.3.12
300-upstream-fix-polarssl-mbedtls-builds.patch has been applied upstream.
Replaced 101-remove_polarssl_debug_call.patch with upstream backport.

Changelog: https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23#OpenVPN2.3.12

Signed-off-by: Magnus Kroken <mkroken@gmail.com>
2017-10-12 16:27:32 +02:00