Updates libnetfilter-conntrack to version 1.1.0.
Removes patches which should no longer be needed according to changelog for
libnetfilter-conntrack 1.1.0
Signed-off-by: Ian Ladd <ianwladd@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/19282
Signed-off-by: Robert Marko <robimarko@gmail.com>
Automatically rebased: 100-Configure-afalg-support.patch
Changes between 3.5.0 and 3.5.1:
Fix x509 application adds trusted use instead of rejected use.
Issue summary: Use of -addreject option with the openssl x509 application
adds a trusted use instead of a rejected use for a certificate.
Impact summary: If a user intends to make a trusted certificate rejected
for a particular use it will be instead marked as trusted for that use.
(CVE-2025-4575)
Aligned the behaviour of TLS and DTLS in the event of a no_renegotiation
alert being received. Older versions of OpenSSL failed with DTLS if a
no_renegotiation alert was received. All versions of OpenSSL do this for TLS.
From 3.2 a bug was exposed that meant that DTLS ignored no_rengotiation.
We have now restored the original behaviour and brought DTLS back into line
with TLS.
Signed-off-by: John Audia <therealgraysky@proton.me>
Link: https://github.com/openwrt/openwrt/pull/19283
Signed-off-by: Robert Marko <robimarko@gmail.com>
glibc 2.39 has removed libcrypt completely.
solution: build libxcrypt with glibc compatibility.
Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/19160
Signed-off-by: Robert Marko <robimarko@gmail.com>
Apply same patches to gmp on the host side to fix GCC 15 build errors.
31800db91d
Signed-off-by: John Audia <therealgraysky@proton.me>
Link: https://github.com/openwrt/openwrt/pull/18992
Signed-off-by: Robert Marko <robimarko@gmail.com>
Disable -Wunterminated-string-initialization for now.
Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/18600
Signed-off-by: Robert Marko <robimarko@gmail.com>
This release includes several fixes, most notable are
"-Wunterminated-string-initialization" fixes for upcoming GCC 15.x
Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/19011
Signed-off-by: Robert Marko <robimarko@gmail.com>
Import libxcrypt from the packages feed to the main OpenWrt repo,
as glibc 2.41 doesn't provide libcrypt (since 2.39 release).
Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/19011
Signed-off-by: Robert Marko <robimarko@gmail.com>
There is no practical value in keeping GCC11 around, as even OpenWrt 23.05
uses GCC12 as the default one, so drop it.
Signed-off-by: Robert Marko <robimarko@gmail.com>
Changelog:
0379096 libtracefs: version 1.8.2
e2e0b4d sqlhist: Add bash completion for the sqlhist utility
78dd6d5 libtracefs: Add trace_sql.bash for tracefs_sql() bash completions
4f66bca libtracefs: Fix trace_sql() to handle buckets cast
6680dae libtracefs: Have tracefs_sql() cast handle stacktrace
4668195 libtracefs: Handle synthetic events with dynamic strings as fields
48a7752 libtracefs: Fix COMM for use as a field for tracefs_sqlhist()
a8d57d2 libtracefs: Fix mistaken update to TRACEFS_STACKTRACE macro
6e913f7 libtracefs: utest: Do not fail if uprobes are not supported by kernel
5db5cf5 libtracefs: Rerun bison and flex via make sqlhist_remake
1514530 libtracefs: Add make sqlhist_remake to run bison and flex
d49b6fa libtrace: Fix memory leak in tracefs_cpu
07cff64 libtracefs: Fix the read file failure code checking
457f02f trace-cmd: Unit test for tracefs_instance_file_append() API
a2bfb49 libtracefs: utest: Rename private functions to fix static building
65f629e libtracefs utest: Do not test more events than what the ring buffer can hold
05a5dc4 libtracefs utest: Fix min percent test
0a46992 libtracefs utest: Add test to check handling multiple dynamic events
bd47435 libtracefs: Destroy synthetic and eprobes before other events
78d8d2e libtracefs: Have tracefs_dynevent_get_all() find kprobes and uprobes properly
ef70c00 libtracefs .gitignore: Ignore utest/trace-utest in git
ff20336 libtracefs utest: Do not test kprobe interface if there's no kprobes
93d9049 libtracefs: Have tracefs_instance_tracers() return instance tracers
4cbebed libtracefs: Documentation: Add missing documentation to meson.build
Link: https://github.com/openwrt/openwrt/pull/18783
Signed-off-by: Nick Hainke <vincent@systemli.org>
libiconv 1.17 fails to compile with GCC15 when doing the host build,
luckily version 1.18 already contains the fixes required so update to it.
New in 1.18:
* Many more transliterations, in particular also of Emoji characters.
* The iconv_open function is now POSIX:2024 compliant: it recognizes a
suffix //NON_IDENTICAL_DISCARD in the 'tocode' argument, with the effect
that characters that cannot be represented in the target character set
will be silently discarded. Whereas the suffix //IGNORE in the 'tocode'
argument has the effect of discarding not only characters that cannot be
represented in the target character set, but also invalid multibyte
sequences in the input.
Accordingly, the iconvctl function accepts requests
ICONV_GET_DISCARD_INVALID, ICONV_SET_DISCARD_INVALID,
ICONV_GET_DISCARD_NON_IDENTICAL, ICONV_SET_DISCARD_NON_IDENTICAL.
* The iconv_open function and the iconv program now support multiple suffixes,
such as //TRANSLIT//IGNORE, not only one.
* GB18030 is now an alias for GB18030:2005. A new converter for GB18030:2022
is added. Since this encoding merely cleans up a few private-use-area
mappings, you can continue to use the GB18030 converter, for backward
compatibility. Its Unicode to GB18030 conversion direction has been
enhanced, to help transitioning away from PUA code points.
* When converting from/to an EBCDIC encoding, a non-standard way of
converting newlines can be requested
- at the C level, by calling iconvctl with argument ICONV_SET_FROM_SURFACE
or ICONV_SET_TO_SURFACE, or
- from the iconv program, by setting the environment variable
ICONV_EBCDIC_ZOS_UNIX to a non-empty value.
* Special support for z/OS: The iconv program adds a charset metadata tag to
its output file. (Contributed by Mike Fulton.)
* For conversions from UCS-2, UCS-4, UTF-16, UTF-32, invoking
iconv(cd,NULL,NULL,...) now preserves the byte order state.
Link: https://github.com/openwrt/openwrt/pull/18698
Signed-off-by: Robert Marko <robimarko@gmail.com>
It seems that this was required many years ago (It was added in 2012),
probably due to relying on outdated or broken libtool versions, but 1.17
uses libtool 2.4.7.
After trying building both host and target libiconv versions on Fedora and
MacOS I cannot seem to find what patch-libtool is supposed to fixup.
So, I can only presume that it is completely uneeded these days and can
be dropped.
Link: https://github.com/openwrt/openwrt/pull/18698
Signed-off-by: Robert Marko <robimarko@gmail.com>
Update libsemanage to latest 3.8.1 release and add an upstream backport[1]
that fixes compilation with GCC14 due to basename.
[1] a339594da6
Link: https://github.com/openwrt/openwrt/pull/18674
Signed-off-by: Robert Marko <robimarko@gmail.com>
ChangeLog
417c2e3 libtracefs: version 1.8.1
41efd9e libtracefs: Add meson build targets to Makefile
310b796 libtracefs utest: Add better logic to cause missed events
b589e32 libtracefs: Add cpu-map sample to trace mapped buffer
4ede86e libtracefs: Enable mmapped ring buffer
e6737d4 libtracefs: Initialize val in build_filter()
590e452 libtracefs: Close dir in the error path in tracefs_event_systems()
0309a87 libtracefs: Close dir in the error path in tracefs_system_events()
f34fb1f libtracefs: Prevent memory leak in tracefs_dynevent_get_all()
48e906b libtracefs: my_yyinput() should return 0 when no data can be read
5e5b2a7 libtracefs: Prevent memory leak in tracefs_instance_create()
8f2593f libtracefs: Prevent a memory leak in open_cpu_files()
7d77b83 libtracefs: Prevent a memory leak in tracefs_system_events()
7fcd8d2 libtracefs: Prevent a memory leak in add_func_str()
a01d0ba libtracefs: Don't leak socket file descriptor in open_vsock()
efdf7f7 libtracefs: Prevent memory leak in tracefs_event_systems()
2342293 libtracefs: Prevent a memory leak in tracefs_synth_add_end_field()
1c95394 libtracefs: Prevent a memory leak in update_fields()
6b35665 libtracefs: Prevent memory leak in append_filer()
aecc0b7 libtracefs: Call va_end() before exiting tracefs_hist_set_sort_key()
a5e37f7 libtracefs: Add trace-mmap.c to meson build
8f62e96 libtracefs meson: Use SemVer in the build description
e04fa01 meson: Add utest option
fb213a4 libtracefs: Update trace_buffer_meta
04505a0 libtracefs utest: Include libgen.h for basename()
7b4a9c9 libtracefs utest: Define _LARGEFILE64_SOURCE for lseek64() with musl
ba75081 libtracefs utest: Add PATH_MAX if it is not already defined
5f27b7f libtracefs: Update the kbuf for previous read in trace_mmap_load_subbuf()
73ac9c1 libtracefs: Fix tracefs_instance_reset() of triggers
7d15d77 libtracefs meson: build tracefs-mmap by default
Link: https://github.com/openwrt/openwrt/pull/18349
Signed-off-by: Nick Hainke <vincent@systemli.org>
ChangeLog:
bd47bd5 libtraceevent: 1.8.4
fe0bc49 libtraceevent: Print function pointer address when TEP_EVENT_FL_PRINTRAW is specified
f2224d5 libtraceevent: Have sizeof() parsing handle u8/s8 through u64/s64
5f570de libtraceevent: Print arrays like Linux does
645a883 libtraceevent: 1.8.3
d4c1fb4 libtraceevent: Add meson build targets to Makefile
c3dc220 libtraceevent: Fix a double free in process_op()
021da90 libtraceevent: Do not return a local stack pointer in get_field_str()
340e2e6 libtraceevent: Have unit test fail when any tests fail
c84155f libtraceevent: prevent a memory leak in tep_plugin_add_option()
03551eb libtraceevent: Prevent a memory leak in process_fields()
34ece90 libtraceevent: Close shared object in the error path of load_plugin()
8802f0f libtraceevent: Avoid a simple asprintf case
76a0eb8 libtraceevent: Fix event-parse memory leak in process_cond
5bc98bd libtraceevent: Have single quotes represent characters
ec8e0cc libtraceevent: Fix tests running on big endian arch
60ed6c3 libtraceevent: build: Various fixes for the Meson build of libtraceevent
0351241 libtraceevent utest: Include libgen.h for basename() with musl
Link: https://github.com/openwrt/openwrt/pull/18349
Signed-off-by: Nick Hainke <vincent@systemli.org>
Changes:
c7edc38f libnl-3.11.0 release
b75e27de lib/route: add support for bridge msti
8a73b245 lib/route: add support for bridge info boolopts
3b284a11 lib/route: extend bridge info support
a43a41cd lib/route: add missing bridge info getter functions
756d5161 lib/route: add missing entry in libnl-route-3.sym file
014c33a6 lib/route: add rtnl_neigh ext flags support
acf572b5 route: add support for getting permanent mac address of link
afafe78a lib/route: extend bridge flags
11597b73 xfrm: remove redundant check in xfrm_sa_update_cache()
2abfb089 xfrm: use the new _nl_auto_nl_object helper
831e9868 cache: use the new _nl_auto_nl_object helper
4b9daa6d add _nl_auto_nl_object helper
379a1405 black: fix "target-version" in "pyproject.toml"
8460c9b7 link/bonding: implement parsing link type
d60535c9 link/bonding: implement comparing bond links
22b6cf5c link/bonding: implement io_clone()
e1c75bff link/bonding: add getters for attributes
ee4612ca link/bonding: rename bn_mask to ce_mask
81c40cbb tests: optimize _nltst_assert_route_list_permutate() to short cut search through permutations
9f5fac78 tests: in _nltst_assert_route_list() accept arbitrary order
01f06b57 base: add _nl_swap() helper macro
5b570259 tests: ensure that there are all expected routes in _nltst_assert_route_list()
1aa16ea9 tests: print route list before failure in _nltst_assert_route_list()
7f099cf0 tests: add _nltst_objects_to_string() helper
e76d5697 tests: add _nltst_malloc0() and _nltst_sprintf() helpers
d94a3e81 tests: move definition of asserts in "tests/nl-test-util.h"
798278ea tests: use _nl_ptrarray_len() helper in _nltst_assert_route_list()
def89a2c base: add _nl_ptrarray_len() helper
64fad14b link: link_msg_parser(): keep link info instead of release and reacquire
b8d3cfb2 lib/attr: add nla functions for variable-length integers
2ae88c48 lib/attr: add NLA_{SINT|UINT} attribute types
Link: https://github.com/openwrt/openwrt/pull/18193
Signed-off-by: Nick Hainke <vincent@systemli.org>
Trying to tcpdump DSA conduits results in errors such as
"unsupported DSA tag: mtk".
Backport two commits adding support for various DSA tags to libpcap.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Currently, enabling USB, BT or Netfilter support after initial compilation
will not trigger a rebuild, so add the missing PKG_CONFIG_DEPENDS so
that rebuild gets triggered.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Changes between 3.0.15 and 3.0.16 [11 Feb 2025]
CVE-2024-13176[1] - Fixed timing side-channel in ECDSA signature
computation.
There is a timing signal of around 300 nanoseconds when the top word of
the inverted ECDSA nonce value is zero. This can happen with significant
probability only for some of the supported elliptic curves. In
particular the NIST P-521 curve is affected. To be able to measure this
leak, the attacker process must either be located in the same physical
computer or must have a very fast network connection with low latency.
CVE-2024-9143[2] - Fixed possible OOB memory access with invalid
low-level GF(2^m) elliptic curve parameters.
Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit
values for the field polynomial can lead to out-of-bounds memory reads
or writes. Applications working with "exotic" explicit binary (GF(2^m))
curve parameters, that make it possible to represent invalid field
polynomials with a zero constant term, via the above or similar APIs,
may terminate abruptly as a result of reading or writing outside of
array bounds. Remote code execution cannot easily be ruled out.
1. https://www.openssl.org/news/vulnerabilities.html#CVE-2024-13176
2. https://www.openssl.org/news/vulnerabilities.html#CVE-2024-9143
Build system: x86/64
Build-tested: bcm27xx/bcm2712
Run-tested: bcm27xx/bcm2712
Signed-off-by: John Audia <therealgraysky@proton.me>
Link: https://github.com/openwrt/openwrt/pull/17947
Signed-off-by: Robert Marko <robimarko@gmail.com>
The three packages base-files, libc and kernel are special, the former
can't be upgraded in place since it's content are modified on startup,
the latter two are virtual packages only used as constraints for the
package manager.
Historically base-files was "locked" via a special OPKG function, the
latter two were hidden from the package index and thereby never picked
as possible upgrade.
Time moved forward and we now have APK and tools like OWUT. The latter
compares available packages with installed packages and generates user
readable output, requiring versions for libc and kernel, too. At the
same time, APK uses a different looking mechanism, which is set during
installation instead of part of the package metadata.
In short, this patch adds version constraints to the three packages,
allowing them to be part of the package index.
Fixes: #17774Fixes: #17775Fixes: efahl/owut#31
Signed-off-by: Paul Spooren <mail@aparcar.org>
The ARIA block cipher is pretty uncommon in TLS, deactivate it for now.
This saves some space and reduces the possible variations and attack
vectors of mbedtls.
ARIA support was deactivated in OpenWrt 23.05 by default.
Link: https://github.com/openwrt/openwrt/pull/17342
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
tools/gmp was using the .tar.xz while package/libs/gmp was using the
.tar.gz archive of the GMP release. Use the .tar.gz for both of them.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
On aarch64 musl gcc 14.x compiler, trying compiling elfutils 0.192 with
lto option enabled will cause null-dereference error.
Example error message:
...
elf_compress.c: In function 'elf_compress':
elf_compress.c:675:26: error: potential null pointer dereference [-Werror=null-dereference]
675 | shdr->sh_flags |= SHF_COMPRESSED;
| ^
elf_compress_gnu.c: In function 'elf_compress_gnu':
elf_compress_gnu.c:127:25: error: potential null pointer dereference [-Werror=null-dereference]
127 | shdr->sh_size = new_size;
| ^ ^
...
This is a false postive warning but will abort compilation if gcc has
`-Werror` flag. This commit add a patch for this, see the bugzilla
report below.
This commit backports a series of patches to fix some errors.
Add patch:
- 007-add-libeu-symbols-to-libelf.patch
- 008-fix-autoconf-ENABLE_IMA_VERIFICATION.patch
- 009-fix-null-dereference-with-lto.patch
Link: https://sourceware.org/bugzilla/show_bug.cgi?id=32311
Signed-off-by: Ryan Keane <the.ra2.ifv@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16886
Signed-off-by: Robert Marko <robimarko@gmail.com>
Currently, libreadline only installs
```
/usr/lib/libhistory.so.8 -> libhistory.so.8.2
/usr/lib/libhistory.so.8.2
/usr/lib/libreadline.so.8 -> libreadline.so.8.2
/usr/lib/libreadline.so.8.2
```
But there is no `libreadline.so` or `libhistory.so` available.
So this happens:
```
root@OpenWRT:~# cat a.c
int main() {
}
root@OpenWRT:~# gcc a.c -lreadline
/usr/bin/ld: cannot find -lreadline: No such file or directory
collect2: error: ld returned 1 exit status
```
Unless, of course, one uses `-l:libreadline.so.8`... But that
doesn't help with binaries that try to dynamically open
`libreadline.so`. I have one of those here (the STklos Scheme
compiler -- I didn't make a PR for it because it's far from
being ready, but one issue is that it does use dlopen to use
readline...)
With the symlink, it works:
```
root@OpenWRT:~# ln -s /usr/lib/libreadline.so.8 /usr/lib/libreadline.so
root@OpenWRT:~#
root@OpenWRT:~# gcc a.c -lreadline
root@OpenWRT:~#
```
Another example: when trying to package rlwrap, the build failed
complaining it could not find readline (using `-lreadline`).
It would then be necessary to change rlwrap's `configure.ac`
(and also in all packages that use readline), but it seems
simpler to add the symlinks...
This PR changes the Makefile so it will include the links.
Signed-off-by: Jeronimo Pellegrini <j_p@aleph0.info>
Link: https://github.com/openwrt/openwrt/pull/16445
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Adjust wolfssl version for apk by removing the "-stable"
from the OpenWrt version, although it is still needed for
upstream download archive name.
Define PKG_BUILD_DIR accordingly.
Utilize new short version to simplify ABI_VERSION calculation.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Link: https://github.com/openwrt/openwrt/pull/16906
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Fixes the following security problem:
* CVE-2024-49195: Fix a buffer underrun in mbedtls_pk_write_key_der()
when called on an opaque key, MBEDTLS_USE_PSA_CRYPTO is enabled, and
the output buffer is smaller than the actual output. Fix a related
buffer underrun in mbedtls_pk_write_key_pem() when called on an opaque
RSA key, MBEDTLS_USE_PSA_CRYPTO is enabled and MBEDTLS_MPI_MAX_SIZE is
smaller than needed for a 4096-bit RSA key.
Link: https://github.com/openwrt/openwrt/pull/16768
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Changes:
fa05d58e (tag: libnl3_10_0) libnl-3.10.0 release
490ffa07 python: fix flake8 warnings
6fc66dd8 doc: workaround LINK_DOC with empty libnl.dict
914812a9 lib: avoid overflow in computation of s_seq_next
5248e1a4 all: fix and enable "-Wsign-compare" warning
9451842e build: use AC_USE_SYSTEM_EXTENSIONS instead of defining _GNU_SOURCE
20664e1e build: move "-DPGKLIBDIR" and rename
81cab7da build: cleanup defining SYSCONFDIR on command line
cf47571c build: drop unnecessary "-Wno-missing-field-initializers" from default CFLAGS
131008f7 build: add "-Wvla" and "-Wdeclaration-after-statement" to default CFLAGS
7e05b622 lib: add internal _nla_len() helper
32688201 route: treat routes with via nexthops as universe scoped as well
c36c7faa format: reformat "include/base/nl-base-utils.h"
49f78229 tests: add a very basic test for route cache
2ebbc034 tests: add NLTstSelectRoute test helper
d784f2cb tests: set NLTST_IN_CI for not skipping tests accidentally
dcb9e2ef route: add missing priority to route_keygen() debug print
d44505ed tests: add helper to detect availablility of iproute2
774863b4 tests: add helper functions for tests
45a10f96 route: move "struct rtnl_nexthop" to "nl-priv-dynamic-route"
153f213b build: fix "check-progs" target in "Makefile.am"
a1e0b8b2 github: print test-suite.log in case of test failure
3e080631 route: expose nexthop id attribute
401c2488 tests: fix _nltst_object_to_string() to print one line only
529c2ab8 route: drop unused fields from "struct rtnl_route"
71e59e14 build: separate build tests from unit tests
8539b7d3 format: reformat "tests/nl-test-util.h" file
6db85366 route: merge branch 'bisdn:jogo_route_nh_cmp'
861fb809 route: use the new helper function for comparing nexthops
8cf29d7b nexthop: add a identical helper function
7cc72d19 utils: reserve the nl_has_capabiliy numbers for releases 3.10 - 3.12
30da5107 github,clang-format: update fedora version for clang-format
2301992b route: fix IPv6 ecmp route deleted nexthop matching
72e4d73f cache: merge branch 'ievenbach:aurora/cache-mgr-cb'
3381acef cache: use cleanup attribute in nl_cache_mngr_alloc_ex()
32cb9f39 cache: cleanup nl_cache_mngr_alloc_ex()
1dbdc30a cache: allow to allocate cache manager with custom refill socket
18b74e08 tests: test compiling all public headers with C++ compiler
691202bf tests: don't use $COMPILE for building header tests
15d90cbf include: add _NL_NO_WARN_DEPRECATED_HEADER for suppressing warning about deprecated headers
8a5f671a tests: avoid "-Wunused-parameter" warning in build headers test
db1a9d7d route: avoid compiler warning about calloc() arguments in rtnl_netem_set_delay_distribution()
3a43faa1 cache: fix new object in callback v2 on updated objects
46cae1bf socket: fix ubsan complaint about incorrect left-shift in generate_local_port()
96ddcd99 all: merge branch 'th/nl-debug'
13ab0122 github: test with --enable-debug=no configure option
264b244e utils: always define nl_debug_dp
dbe21b8d core: always define statements for NL_DBG()
e592dd89 build: always define NL_DEBUG
58734974 all: use defines for attributes
0c16c9cb route/bison: include "nl-default.h" in lex/yacc files
19d48b0f route: add support for layer 3 filtering on bridges
3646398d route: merge branch 'Cordell-O:main'
e21278ed tests: add test for bridge vlan attributes.
4f324f73 route: add support for vlan filtering on bridge ports.
bf071f2b route: Add support to set ageing time for dynamic bridge table entries
b76c3a5d tests: add unit test for `nl_addr_parse("default", AF_INET6, &addr6)`
8693347f lib/xfrm: add missing #include <time.h>
Small size increase:
955 bin/packages/mips_24kc-old/base/libnl200_3.9.0-r1_mips_24kc.ipk
11157 bin/packages/mips_24kc-old/base/libnl-cli200_3.9.0-r1_mips_24kc.ipk
34896 bin/packages/mips_24kc-old/base/libnl-core200_3.9.0-r1_mips_24kc.ipk
7698 bin/packages/mips_24kc-old/base/libnl-genl200_3.9.0-r1_mips_24kc.ipk
25400 bin/packages/mips_24kc-old/base/libnl-nf200_3.9.0-r1_mips_24kc.ipk
148366 bin/packages/mips_24kc-old/base/libnl-route200_3.9.0-r1_mips_24kc.ipk
956 bin/packages/mips_24kc-new/base/libnl200_3.10.0-r1_mips_24kc.ipk
11154 bin/packages/mips_24kc-new/base/libnl-cli200_3.10.0-r1_mips_24kc.ipk
34965 bin/packages/mips_24kc-new/base/libnl-core200_3.10.0-r1_mips_24kc.ipk
7699 bin/packages/mips_24kc-new/base/libnl-genl200_3.10.0-r1_mips_24kc.ipk
25385 bin/packages/mips_24kc-new/base/libnl-nf200_3.10.0-r1_mips_24kc.ipk
149852 bin/packages/mips_24kc-new/base/libnl-route200_3.10.0-r1_mips_24kc.ipk
Link: https://github.com/openwrt/openwrt/pull/16592
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
New releases of openssl are only published on GitHub, and official
downloads are also redirected to GitHub. So remove the old download
mirrors (file 404), and replace the current address with https.
Link: https://openssl-library.org/source/
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Link: https://github.com/openwrt/openwrt/pull/16470
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
OpenSSL 3.0.15 is a security patch release. The most severe CVE fixed in this release is Moderate.
This release incorporates the following bug fixes and mitigations:
* Fixed possible denial of service in X.509 name checks (CVE-2024-6119)
* Fixed possible buffer overread in SSL_select_next_proto() (CVE-2024-5535)
Added github releases url as source mirror
Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16332
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The file contains the the /usr/lib path from the toolchain directory and
not from the target directory. The /usr/lib directory for the toolchain
is empty and the shared library is not in the specified paths. On RISCV
the linker of util-linux was finding the libncursesw.so in my host
system, tried to link against it and failed. Fix the .pc file.
Fixes: #15942
Co-authored-by: Thomas Weißschuh <thomas@t-8ch.de>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Link: https://github.com/openwrt/openwrt/pull/16018
Signed-off-by: Robert Marko <robimarko@gmail.com>
This fixes multiple security problems:
* [Medium] CVE-2024-1544
Potential ECDSA nonce side channel attack in versions of wolfSSL before 5.6.6 with wc_ecc_sign_hash calls.
* [Medium] CVE-2024-5288
A private key blinding operation, enabled by defining the macro WOLFSSL_BLIND_PRIVATE_KEY, was added to mitigate a potential row hammer attack on ECC operations.
* [Low] When parsing a provided maliciously crafted certificate directly using wolfSSL API, outside of a TLS connection, a certificate with an excessively large number of extensions could lead to a potential DoS.
* [Low] CVE-2024-5991
In the function MatchDomainName(), input param str is treated as a NULL terminated string despite being user provided and unchecked.
* [Medium] CVE-2024-5814
A malicious TLS1.2 server can force a TLS1.3 client with downgrade capability to use a ciphersuite that it did not agree to and achieve a successful connection.
* [Medium] OCSP stapling version 2 response verification bypass issue when a crafted response of length 0 is received.
* [Medium] OCSP stapling version 2 revocation bypass with a retry of a TLS connection attempt.
Unset DISABLE_NLS to prevent setting the unsupported configuration
option --disable-nls which breaks the build now.
Link: https://github.com/openwrt/openwrt/pull/15948
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
For some reason, it's not working right locally. Override as is done
with the target build.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/15916
Signed-off-by: Robert Marko <robimarko@gmail.com>
ncurses is built with wide support enabled, which enables libncursesw.
The problem is, the ncurses build system only supplies ncursesw or
ncurses.pc but not both. The other problem is, the readline build tests
for libncurses before the w variant, making its pc file unusable as
there is no ncurses.pc file to satisfy the Required: ncurses section.
Just override the library.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/15864
Signed-off-by: Robert Marko <robimarko@gmail.com>
Needed for things such as readline that depend on ncurses.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/15864
Signed-off-by: Robert Marko <robimarko@gmail.com>
Currently, the build option to enable/disable engine support isn't
reflected in the final '/etc/ssl/openssl.cnf' config. It assumes `engines`
is always enabled, producing an error whenever running any
commands in openssl util or programs that explicitly use settings
from '/etc/ssl/openssl.cnf'.
```
➤ openssl version
FATAL: Startup failure (dev note: apps_startup()) for openssl
307D1EA97F000000:error:12800067:lib(37):dlfcn_load:reason(103):crypto/dso/dso_dlfcn.c:118:filename(libengines.so):
Error loading shared library libengines.so: No such file or directory
307D1EA97F000000:error:12800067:lib(37):DSO_load:reason(103):crypto/dso/dso_lib.c:152:
307D1EA97F000000:error:0700006E:lib(14):module_load_dso:reason(110):crypto/conf/conf_mod.c:321:module=engines, path=engines
307D1EA97F000000:error:07000071:lib(14):module_run:reason(113):crypto/conf/conf_mod.c:266:module=engines
```
Build should check for the `CONFIG_OPENSSL_ENGINE` option, and comment out `engines`
if not explicitly enabled.
Example:
```
[openssl_init]
providers = provider_sect
```
After this change, openssl util works correctly.
```
➤ openssl version
OpenSSL 3.0.14 4 Jun 2024 (Library: OpenSSL 3.0.14 4 Jun 2024)
```
Signed-off-by: Sean Khan <datapronix@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/15661
Signed-off-by: Robert Marko <robimarko@gmail.com>
This commit makes the libquadmath library available to the GCC
toolchain. This library is important for libraries such as
Boost.charconv
Signed-off-by: Carlos Miguel Ferreira <carlosmf.pt@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/15637
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Major changes between OpenSSL 3.0.13 and OpenSSL 3.0.14 [04-Jun-2024]
* Fixed potential use after free after SSL_free_buffers() is called.
[CVE-2024-4741]
* Fixed checking excessively long DSA keys or parameters may be very slow.
[CVE-2024-4603]
* Fixed an issue where some non-default TLS server configurations can cause
unbounded memory growth when processing TLSv1.3 sessions. An attacker may
exploit certain server configurations to trigger unbounded memory growth that
would lead to a Denial of Service. [CVE-2024-2511]
* New atexit configuration switch, which controls whether the OPENSSL_cleanup
is registered when libcrypto is unloaded. This can be used on platforms
where using atexit() from shared libraries causes crashes on exit
Signed-off-by: John Audia <therealgraysky@proton.me>
Build system: x86/64
Build-tested: x86/64/AMD Cezanne
Update to the latest upstream release to include recent improvements and
bugfixes, and simplify use of PKG_SOURCE_VERSION.
Link: https://github.com/libbpf/libbpf/releases/tag/v1.4.3
Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
Without this patch, GCC 14 incorrectly complains about the following error:
In file included from /home/user/workspace/mbedtls/library/ctr_drbg.c:13:
In function ‘mbedtls_xor’,
inlined from ‘ctr_drbg_update_internal’ at /home/user/workspace/mbedtls/library/ctr_drbg.c:372:5:
/home/user/workspace/mbedtls/library/common.h:235:17: error: array subscript 48 is outside array bounds of ‘unsigned char[48]’ [-Werror=array-bounds=]
235 | r[i] = a[i] ^ b[i];
| ~^~~
/home/user/workspace/mbedtls/library/ctr_drbg.c: In function ‘ctr_drbg_update_internal’:
/home/user/workspace/mbedtls/library/ctr_drbg.c:335:19: note: at offset 48 into object ‘tmp’ of size 48
335 | unsigned char tmp[MBEDTLS_CTR_DRBG_SEEDLEN];
| ^~~
In function ‘mbedtls_xor’,
inlined from ‘ctr_drbg_update_internal’ at /home/user/workspace/mbedtls/library/ctr_drbg.c:372:5:
/home/user/workspace/mbedtls/library/common.h:235:24: error: array subscript 48 is outside array bounds of ‘const unsigned char[48]’ [-Werror=array-bounds=]
235 | r[i] = a[i] ^ b[i];
| ~^~~
/home/user/workspace/mbedtls/library/ctr_drbg.c: In function ‘ctr_drbg_update_internal’:
/home/user/workspace/mbedtls/library/ctr_drbg.c:333:57: note: at offset 48 into object ‘data’ of size [0, 48]
333 | const unsigned char data[MBEDTLS_CTR_DRBG_SEEDLEN])
| ~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In function ‘mbedtls_xor’,
inlined from ‘ctr_drbg_update_internal’ at /home/user/workspace/mbedtls/library/ctr_drbg.c:372:5:
/home/user/workspace/mbedtls/library/common.h:235:14: error: array subscript 48 is outside array bounds of ‘unsigned char[48]’ [-Werror=array-bounds=]
235 | r[i] = a[i] ^ b[i];
| ~~~~~^~~~~~~~~~~~~
/home/user/workspace/mbedtls/library/ctr_drbg.c: In function ‘ctr_drbg_update_internal’:
/home/user/workspace/mbedtls/library/ctr_drbg.c:335:19: note: at offset 48 into object ‘tmp’ of size 48
335 | unsigned char tmp[MBEDTLS_CTR_DRBG_SEEDLEN];
| ^~~
This change adds a basic check to silence the warning until a solution is worked on upstream.
As this check is already used by another compiler, it shouldn't cause any issues for us.
Signed-off-by: Rany Hany <rany_hany@riseup.net>
Add "linux64-loongarch64-openwrt" into openssl configurations to enable
building on loongarch64 machines.
Signed-off-by: Weijie Gao <hackpascal@gmail.com>
These options are not available in mbedtls 3.6.0 and selecting them
causes an error.
MBEDTLS_CERTS_C was removed in:
1aec64642c
MBEDTLS_XTEA_C was removed in:
10e8cf5fef
MBEDTLS_SSL_TRUNCATED_HMAC was removed in:
4a7010d1aa
Fixes: 0e06642643 ("mbedtls: Update to version 3.6.0")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Changes:
- new URL for sources (old address is dead)
- daemon and utils from packages feed are merged in here
- only build once
- no need to update at the same time in both places
- update to v3.1.4
- removed unneeded patches
- added audisp-syslog
- removed audispd (no longer exists)
- rename and move to package/utils/audit
- update new path in one dependent package
Signed-off-by: Marius Dinu <m95d+git@psihoexpert.ro>
This adds support for mbedtls 3.6.0.
The 3.6 version is the next LTS version of mbedtls.
This version supports TLS 1.3.
This switches to download using git. The codeload tar file misses some
git submodules.
Add some extra options added in mbedtls 3.6.0.
The size of the compressed ipkg increases:
230933 bin/packages/mips_24kc/base/libmbedtls13_2.28.7-r2_mips_24kc.ipk
300154 bin/packages/mips_24kc/base/libmbedtls14_3.6.0-r1_mips_24kc.ipk
The removed patch was integrated upstream.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This fixes multiple security problems:
* [High] CVE-2024-0901 Potential denial of service and out of bounds
read. Affects TLS 1.3 on the server side when accepting a connection
from a malicious TLS 1.3 client. If using TLS 1.3 on the server side
it is recommended to update the version of wolfSSL used.
* [Med] CVE-2024-1545 Fault Injection vulnerability in
RsaPrivateDecryption function that potentially allows an attacker
that has access to the same system with a victims process to perform
a Rowhammer fault injection. Thanks to Junkai Liang, Zhi Zhang, Xin
Zhang, Qingni Shen for the report (Peking University, The University
of Western Australia)."
* [Med] Fault injection attack with EdDSA signature operations. This
affects ed25519 sign operations where the system could be susceptible
to Rowhammer attacks. Thanks to Junkai Liang, Zhi Zhang, Xin Zhang,
Qingni Shen for the report (Peking University, The University of
Western Australia).
Size increased a little:
wolfssl 5.6.6:
516880 bin/packages/mips_24kc/base/libwolfssl5.6.6.e624513f_5.6.6-stable-r1_mips_24kc.ipk
wolfssl: 5.7.0:
519429 bin/packages/mips_24kc/base/libwolfssl5.7.0.e624513f_5.7.0-stable-r1_mips_24kc.ipk
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This contains a fix for:
CVE-2024-28960: An issue was discovered in Mbed TLS 2.18.0 through 2.28.x
before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. The PSA Crypto
API mishandles shared memory.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
f9a28a9ce864 ustream-ssl: poll connection on incomplete reads
3c49e70c4622 ustream-ssl: increase number of read buffers
Signed-off-by: Felix Fietkau <nbd@nbd.name>
This reverts commit a9e22ffa50.
After doing a clean rebuild, it turns out that this change is not necessary
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Update to the latest upstream release to include recent improvements and
bugfixes, and update copyright. Remove MAKE_VARS usage in Makefile and drop
001-cflags.patch which are no longer needed. Also add flags to disable LTO,
mistakenly dropped earlier.
Link: https://github.com/libbpf/libbpf/releases/tag/v1.4.0
Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
e209a4ced1d8 add strdupa macro for compatibility
af1962b9a609 uclient: add helper function for getting ustream-ssl context/ops
488f1d52cfd2 http: add helper function for checking redirect status
b6e5548a3ecc uclient: defer read notifications to uloop timer
352fb3eeb408 http: call ustream_poll if not enough read data is available
e611e6d0ff0b add ucode binding
ddb18d265757 uclient: add function for getting the amount of pending read/write data
980220ad1762 ucode: fix a few ucode binding issues
6c16331e4bf5 ucode: add support for using a prototype for cb, pass it to callbacks
Signed-off-by: Felix Fietkau <nbd@nbd.name>
When using zst instead of xz, the hash changes. This commit fixes the
hash for packages and tools in core.
Signed-off-by: Paul Spooren <mail@aparcar.org>
On Fedora 40 system, some compile error happens when
building iconv-ostream.c. Linking to libiconv-full
fixes this.
Signed-off-by: Yanase Yuki <dev@zpc.st>
The PKG_MIRROR_HASH was wrong (again), likely due to an old set of tools
which did not contain the downgrade of xz.
Ref 2070049 unetd: fix PKG_MIRROR_HASH
Fix 89c594e libubox: update to Git HEAD (2024-03-29)"
Signed-off-by: Paul Spooren <mail@aparcar.org>
