4 years agowireguard: version bump to 0.0.20171017
Jason A. Donenfeld [Tue, 17 Oct 2017 17:34:20 +0000 (19:34 +0200)]
wireguard: version bump to 0.0.20171017

This is a simple version bump. Changes:

  * noise: handshake constants can be read-only after init
  * noise: no need to take the RCU lock if we're not dereferencing
  * send: improve dead packet control flow
  * receive: improve control flow
  * socket: eliminate dead code
  * device: our use of queues means this check is worthless
  * device: no need to take lock for integer comparison
  * blake2s: modernize API and have faster _final
  * compat: support READ_ONCE
  * compat: just make ro_after_init read_mostly

  Assorted cleanups to the module, including nice things like marking our
  precomputations as const.

  * Makefile: even prettier output
  * Makefile: do not clean before cloc
  * selftest: better test index for rate limiter
  * netns: disable accept_dad for all interfaces

  Fixes in our testing and build infrastructure. Now works on the 4.14 rc

  * qemu: add build-only target
  * qemu: work on ubuntu toolchain
  * qemu: add more debugging options to main makefile
  * qemu: simplify shutdown
  * qemu: open /dev/console if we're started early
  * qemu: phase out bitbanging
  * qemu: always create directory before untarring
  * qemu: newer packages
  * qemu: put hvc directive into configuration

  This is the beginning of working out a cross building test suite, so we do
  several tricks to be less platform independent.

  * tools: encoding: be more paranoid
  * tools: retry resolution except when fatal
  * tools: don't insist on having a private key
  * tools: add pass example to wg-quick man page
  * tools: style
  * tools: newline after warning
  * tools: account for padding being in zero attribute

  Several important tools fixes, one of which suppresses a needless warning.

Signed-off-by: Jason A. Donenfeld <>
(cherry picked from commit f6c4a9c045797d9be12310eebc6341050fd260ce)

4 years agohostapd: add wpa_disable_eapol_key_retries option
Stijn Tintel [Tue, 17 Oct 2017 13:35:03 +0000 (16:35 +0300)]
hostapd: add wpa_disable_eapol_key_retries option

Commit b6c3931ad6554357a108127797c8d7097a93f18f introduced an AP-side
workaround for key reinstallation attacks. This option can be used to
mitigate KRACK on the station side, in case those stations cannot be
updated. Since many devices are out there will not receive an update
anytime soon (if at all), it makes sense to include this workaround.

Unfortunately this can cause interoperability issues and reduced
robustness of key negotiation, so disable the workaround by default, and
add an option to allow the user to enable it if he deems necessary.

Signed-off-by: Stijn Tintel <>
(cherry picked from commit c5f97c9372da3229350184fb263c97d9ea8944c5)

4 years agohostapd: backport extra changes related to KRACK
Stijn Tintel [Tue, 17 Oct 2017 14:54:59 +0000 (17:54 +0300)]
hostapd: backport extra changes related to KRACK

While these changes are not included in the advisory, upstream
encourages users to merge them.

Added 013-Add-hostapd-options-wpa_group_update_count-and-wpa_p.patch so
that 016-Optional-AP-side-workaround-for-key-reinstallation-a.patch
applies without having to rework it.

Signed-off-by: Stijn Tintel <>
4 years agomac80211: backport kernel fix for CVE-2017-13080
Stijn Tintel [Mon, 16 Oct 2017 22:49:58 +0000 (01:49 +0300)]
mac80211: backport kernel fix for CVE-2017-13080

Signed-off-by: Stijn Tintel <>
(cherry picked from commit 2f701194c29da50bfda968a83c6609843f74a7f4)

4 years agox86: partly revert cabf775
Jo-Philipp Wich [Mon, 16 Oct 2017 15:21:43 +0000 (17:21 +0200)]
x86: partly revert cabf775

The subtarget cleanups made in cabf775 "x86: Refresh subtargets kernel config"
removed some important symbol disable statements, so revert the changes to the
subtarget configs for now.

Signed-off-by: Jo-Philipp Wich <>
4 years agomac80211: Update wireless-regdb to master-2017-03-07
Ryan Mounce [Tue, 7 Mar 2017 13:41:42 +0000 (00:11 +1030)]
mac80211: Update wireless-regdb to master-2017-03-07

The short log of changes since the 2016-06-10 release is below.

Jouni Malinen (1):
      wireless-regdb: Remove DFS requirement for India (IN)

Ryan Mounce (1):
      wireless-regdb: Update rules for Australia (AU) and add 60GHz rules

Seth Forshee (2):
      wireless-regdb: Update 5 GHz rules for Canada
      wireless-regdb: update regulatory.bin based on preceding changes

Signed-off-by: Ryan Mounce <>
(cherry picked from commit 8b12e62e9cd6ba2e3bb2e7f2555180df0173c7c6)

4 years agowireguard: add wireguard to base packages
Jason A. Donenfeld [Fri, 13 Oct 2017 15:05:18 +0000 (17:05 +0200)]
wireguard: add wireguard to base packages

Move wireguard from openwrt/packages to base a package.

This follows the pattern of kmod-cake and openvpn. Cake is a fast-moving
experimental kernel module that many find essential and useful. The
other is a VPN client. Both are inside of core. When you combine the two
characteristics, you get WireGuard. Generally speaking, because of the
extremely lightweight nature and "stateless" configuration of WireGuard,
many view it as a core and essential utility, initiated at boot time
and immediately configured by netifd, much like the use of things like
GRE tunnels.

WireGuard has a backwards and forwards compatible Netlink API, which
means the userspace tools should work with both newer and older kernels
as things change. There should be no versioning requirements, therefore,
between kernel bumps and userspace package bumps.

Signed-off-by: Kevin Darbyshire-Bryant <>
Signed-off-by: Jason A. Donenfeld <>
Acked-by: Jo-Philipp Wich <>
Acked-by: Felix Fietkau <>
(cherry picked from commit 699c6fcc314225f79156a26db418e15bbc6bf10f)

4 years agobrcmfmac: backport length check in brcmf_cfg80211_escan_handler()
Felix Fietkau [Mon, 16 Oct 2017 10:46:58 +0000 (12:46 +0200)]
brcmfmac: backport length check in brcmf_cfg80211_escan_handler()

Fixes CVE-2017-0786

Signed-off-by: Felix Fietkau <>
4 years agokernel: bump 4.4 to 4.4.92
Stijn Tintel [Mon, 16 Oct 2017 10:32:51 +0000 (13:32 +0300)]
kernel: bump 4.4 to 4.4.92

Refresh patches.

Fixes the following CVEs:
- CVE-2017-1000252
- CVE-2017-12153
- CVE-2017-12154

Signed-off-by: Stijn Tintel <>
4 years agoramips: fix compile warning in MT7621 NAND driver
Felix Fietkau [Mon, 16 Oct 2017 10:07:31 +0000 (12:07 +0200)]
ramips: fix compile warning in MT7621 NAND driver

Signed-off-by: Felix Fietkau <>
4 years agoramips: fix typo in MT7621 NAND driver
Felix Fietkau [Mon, 16 Oct 2017 10:15:08 +0000 (12:15 +0200)]
ramips: fix typo in MT7621 NAND driver

Signed-off-by: Felix Fietkau <>
4 years agohostapd: merge fixes for WPA packet number reuse with replayed messages and key reins...
Felix Fietkau [Mon, 16 Oct 2017 10:05:09 +0000 (12:05 +0200)]
hostapd: merge fixes for WPA packet number reuse with replayed messages and key reinstallation

- CERT case ID: VU#228519
- CVE-2017-13077
- CVE-2017-13078
- CVE-2017-13079
- CVE-2017-13080
- CVE-2017-13081
- CVE-2017-13082
- CVE-2017-13086
- CVE-2017-13087
- CVE-2017-13088

For more information see:

Backport of bbda81ce3077dfade2a43a39f772cfec2e82a9a5

Signed-off-by: Felix Fietkau <>
4 years agox86/64: add xen DomU support
Baptiste Jonglez [Sat, 15 Jul 2017 20:57:56 +0000 (22:57 +0200)]
x86/64: add xen DomU support

Xen support for x86/generic was added in 296772f9.  This commit also
enables it for x86/64.

This was successfully tested with Xen 4.5.

Signed-off-by: Baptiste Jonglez <>
4 years agox86: Refresh subtargets kernel config
Baptiste Jonglez [Sat, 15 Jul 2017 20:57:55 +0000 (22:57 +0200)]
x86: Refresh subtargets kernel config

This was done by simply running `make kernel_menuconfig CONFIG_TARGET=subtarget`
and then saving without changing any option.

Having consistent kernel config is important to avoid surprises, such
as the issue fixed with 6f0367c9 (where Xen support was silently
disabled when building the kernel, although it was present in the
initial config)

As far as I understand the build system, this shouldn't have any
user-visible impact, because the build system already merges the
various kernel configs during build.

Signed-off-by: Baptiste Jonglez <>
4 years agox86: Fix xen serial console by removing conflicting PATA driver
Baptiste Jonglez [Sat, 15 Jul 2017 20:57:54 +0000 (22:57 +0200)]
x86: Fix xen serial console by removing conflicting PATA driver

The Xen serial console has been broken since the xen_domu subtarget
was merged in the generic x86 subtarget (commits 296772f9 and b36e24f3).

The reason for the broken serial console seems to be an IRQ conflict
between the serial console driver and the PATA_LEGACY driver:

[    1.330125] genirq: Flags mismatch irq 8. 00000000 (hvc_console) vs. 00000000 (platform[pata_legacy.4])
[    1.330134] hvc_open: request_irq failed with rc -16.
[    1.330148] Warning: unable to open an initial console.

Just drop the PATA_LEGACY driver from the x86/generic and x86_64
subtargets, since this driver is marked experimental and only supports
very old ISA devices anyway.  It is still included in the x86/legacy
subtarget where it rightfully belongs.

Fixes: FS#787
Signed-off-by: Baptiste Jonglez <>
4 years agox86/generic: use HIGHMEM64G instead of HIGHMEM4G to fix PAE and Xen
Baptiste Jonglez [Sat, 15 Jul 2017 20:57:53 +0000 (22:57 +0200)]
x86/generic: use HIGHMEM64G instead of HIGHMEM4G to fix PAE and Xen

This is a backport of 641a65fd062987a456216cc4fa91ff2910528261 in master.

This change re-enables PAE for the 32-bit x86 subtarget, which is
interesting in its own right but also necessary for Xen support.

Commit af1d1ebd ("x86: enable 4G high memory support for generic (32bit)
subtarget") inadvertently disabled both PAE and Xen support.

Fixes: FS#908
Cc: Daniel Golle <>
Cc: Jo-Philipp Wich <>
Signed-off-by: Baptiste Jonglez <>
4 years agokernel: add fix for bgmac with B50212E B1 PHY
Rafał Miłecki [Fri, 13 Oct 2017 12:06:18 +0000 (14:06 +0200)]
kernel: add fix for bgmac with B50212E B1 PHY

This PHY requires some extra programming to work reliably with all
devices. Backport upstream fix for it.

Signed-off-by: Rafał Miłecki <>
4 years agomt76: sync with version 878456caf60d from master
Felix Fietkau [Thu, 12 Oct 2017 09:49:00 +0000 (11:49 +0200)]
mt76: sync with version 878456caf60d from master

Backport required DT changes from commit dabdd123c90c.
Significantly improves stability and performance for MT76x2 and MT7603

Signed-off-by: Felix Fietkau <>
4 years agobcm53xx: backport DTS changes up to the first 4.15 queued commits
Rafał Miłecki [Tue, 10 Oct 2017 07:19:10 +0000 (09:19 +0200)]
bcm53xx: backport DTS changes up to the first 4.15 queued commits

Signed-off-by: Rafał Miłecki <>
4 years agoar71xx: add rssileds to WA850RE v1 image
Mathias Kresin [Sat, 7 Oct 2017 14:54:19 +0000 (16:54 +0200)]
ar71xx: add rssileds to WA850RE v1 image

A default rssileds config exists for the TP-Link WA850RE v1 but the
rssiled package is not included by default.

The compressed 17.01.3 image size increases by 3302 bytes which should
be tolerable even for a 4MB flash board.

Fixes: FS#1043
Signed-off-by: Mathias Kresin <>
4 years agotoolchain/gdb: update to version 8.0.1
Ryan Mounce [Sun, 6 Aug 2017 04:52:18 +0000 (14:22 +0930)]
toolchain/gdb: update to version 8.0.1

Fixes CVE-2017-9778.

Signed-off-by: Ryan Mounce <>
[reference fixed CVE]
Signed-off-by: Stijn Tintel <>
4 years agocmake: fix build error with Xcode 9 on macOS 12
Felix Fietkau [Thu, 5 Oct 2017 18:44:52 +0000 (20:44 +0200)]
cmake: fix build error with Xcode 9 on macOS 12

Signed-off-by: Felix Fietkau <>
4 years agogcc: fix build error with macOS + Xcode 9
Felix Fietkau [Thu, 5 Oct 2017 17:46:48 +0000 (19:46 +0200)]
gcc: fix build error with macOS + Xcode 9

Signed-off-by: Felix Fietkau <>
4 years agobuild: add a darwin sitefile to deal with macOS 10.12 + Xcode 9 build errors
Felix Fietkau [Thu, 5 Oct 2017 17:45:44 +0000 (19:45 +0200)]
build: add a darwin sitefile to deal with macOS 10.12 + Xcode 9 build errors

Certain functions are available in system headers, but only work on
macOS 10.13

Signed-off-by: Felix Fietkau <>
4 years agoramips: mt7620: do not pad sysupgrade Archer images
Thibaut VARENE [Wed, 2 Aug 2017 14:28:16 +0000 (16:28 +0200)]
ramips: mt7620: do not pad sysupgrade Archer images

The current makefile unnecessarily pads sysupgrade image for Archer devices.

This has three implications:
1. higher risk of OOM when uploading the binary image to the device
2. much slower upgrade due to time wasted erasing and writing padding
3. grows image beyond available flash size if metadata are appended

This is already fixed in master, albeit in a completely different way (the
whole target have been reworked)

Fixes: FS#1025, FS#1039
Signed-off-by: Thibaut VARENE <>
4 years agoLEDE v17.01.3: revert to branch defaults
Stijn Tintel [Tue, 3 Oct 2017 12:10:55 +0000 (15:10 +0300)]
LEDE v17.01.3: revert to branch defaults

Signed-off-by: Stijn Tintel <>
4 years agoLEDE v17.01.3: adjust config defaults v17.01.3
Stijn Tintel [Tue, 3 Oct 2017 12:10:53 +0000 (15:10 +0300)]
LEDE v17.01.3: adjust config defaults

Signed-off-by: Stijn Tintel <>
4 years agouhttp: update to latest version
Adrian Panella [Tue, 12 Sep 2017 18:29:09 +0000 (13:29 -0500)]
uhttp: update to latest version

3fd58e9 2017-08-19 uhttpd: add manifest support
88c0b4b 2017-07-09 file: fix basic auth regression
99957f6 2017-07-02 file: remove unused "auth" member from struct
c0a569d 2017-07-02 proc: expose HTTP_AUTH_USER and HTTP_AUTH_PASS
ad93be7 2017-07-02 auth: store parsed username and password
fa51d7f 2017-07-02 proc: do not declare empty process variables
a8bf9c0 2017-01-26 uhttpd: Add TCP_FASTOPEN support
e6cfc91 2016-10-25 lua: ensure that PATH_INFO starts with a slash

Signed-off-by: Adrian Panella <>
4 years agoodhcpd: don't enable server mode on non-static lan port
Karl Palsson [Fri, 1 Sep 2017 11:22:11 +0000 (11:22 +0000)]
odhcpd: don't enable server mode on non-static lan port

Instead of blindly enabling the odhcpd v6 server and RA server on the
lan port, only do that if the lan port protocol is "static"

This prevents the unhelpful case of a device being a dhcpv4 client and
v6 server on the same ethernet port.

Signed-off-by: Karl Palsson <>
[PKG_SOURCE_DATE increase; odhcpd.defaults script cleanup]
Signed-off-by: Hans Dedecker <>
4 years agoodhcpd: backport fixes from master branch (FS#402, FS#524)
Hans Dedecker [Mon, 2 Oct 2017 16:41:34 +0000 (18:41 +0200)]
odhcpd: backport fixes from master branch (FS#402, FS#524)

336212c config: fix dhcpv4 server being started
336212c dhcpv6: assign all viable DHCPv6 addresses by default (FS#402, FS#524)

Signed-off-by: Hans Dedecker <>
4 years agodnsmasq: bump to v2.78
Kevin Darbyshire-Bryant [Mon, 2 Oct 2017 14:28:32 +0000 (15:28 +0100)]
dnsmasq: bump to v2.78

Fixes CVE-2017-14491, CVE-2017-14492, CVE-2017-14493, CVE-2017-14494, 2017-CVE-14495, 2017-CVE-14496

Signed-off-by: Kevin Darbyshire-Bryant <>
4 years agobase-files: create /etc/config/ directory
Hauke Mehrtens [Sat, 30 Sep 2017 11:50:44 +0000 (13:50 +0200)]
base-files: create /etc/config/ directory

The /bin/config_generate script and some other scripts are assuming the
/etc/config directory exists in the image. This is true in case for
example the package firewall, dropbear or dnsmasq are included, which
are adding the files under /etc/config/. Without any of these package
the system will not boot up fully because the /etc/config/ directory is
missing and some init scripts just fail.

Make sure all images with the base-files contain a /etc/config/

Signed-off-by: Hauke Mehrtens <>
Acked-by: John Crispin <>
4 years agosunxi: clean up modules definitions
Matthias Schiffer [Thu, 4 May 2017 05:00:06 +0000 (07:00 +0200)]
sunxi: clean up modules definitions

Module definitions for kmod-wdt-sunxi and kmod-eeprom-sunxi are removed
(wdt-sunxi was builtin anyways; nvmem-sunxi, which is the new name of
eeprom-sunxi is changed to builtin). As kmod-eeprom-sunxi was specified
in DEFAULT_PACKAGES, but not available on kernel 4.4, it was breaking the
image builder.

Support for kmod-sunxi-ir is added for kernel 4.4 (it is unclear why it
was disable before, it builds fine with with kernel 4.4).

Condtionals only relevant for pre-4.4 kernels are removed from,
as sunxi does't support older kernels anymore.

Fixes FS#755.

Signed-off-by: Matthias Schiffer <>
4 years agoltq-vdsl-mei: revert disable optimized firmware download
Mathias Kresin [Fri, 29 Sep 2017 06:45:13 +0000 (08:45 +0200)]
ltq-vdsl-mei: revert disable optimized firmware download

This reverts commit b428f45c062dc8ca8c2f35f491fa467dc5b85519.

If the optimized firmware download is disabled, the xdsl subsystem
hangs in the "idle request" state after physically disconnecting and
reconnecting the xdsl modem from the line.

It might fix the failing line init on boot as well.

Signed-off-by: Mathias Kresin <>
4 years agocurl: fix security problems
Hauke Mehrtens [Sat, 30 Sep 2017 13:23:07 +0000 (15:23 +0200)]
curl: fix security problems

This fixes the following security problems:
 * CVE-2017-1000100 TFTP sends more than buffer size
 * CVE-2017-1000101 URL globbing out of bounds read

Signed-off-by: Hauke Mehrtens <>
4 years agombedtls: update to 2.6.0 CVE-2017-14032
Kevin Darbyshire-Bryant [Fri, 1 Sep 2017 18:04:29 +0000 (19:04 +0100)]
mbedtls: update to 2.6.0 CVE-2017-14032

Fixed an authentication bypass issue in SSL/TLS. When the TLS
authentication mode was set to 'optional',
mbedtls_ssl_get_verify_result() would incorrectly return 0 when the
peer's X.509 certificate chain had more than
MBEDTLS_X509_MAX_INTERMEDIATE_CA intermediates (default: 8), even when
it was not trusted. This could be triggered remotely on both the client
and server side. (Note, with the authentication mode set by
mbedtls_ssl_conf_authmode()to be 'required' (the default), the handshake
was correctly aborted).

Signed-off-by: Kevin Darbyshire-Bryant <>
Tested-by: Magnus Kroken <>
4 years agogeneric: drop 704-phy-no-genphy-soft-reset.patch
Florian Fainelli [Sat, 16 Sep 2017 22:16:09 +0000 (15:16 -0700)]
generic: drop 704-phy-no-genphy-soft-reset.patch

4.4.80+ contains 71a165f6397df07a06ce643de5c2dbae29bd3cfb, 4.9.41+ contains
6c78197e4a69c19e61dfe904fdc661b2aee8ec20 which are all backports of upstream
commit 0878fff1f42c18e448ab5b8b4f6a3eb32365b5b6 ("net: phy: Do not perform
software reset for Generic PHY").

Our local patch is no longer needed, all this patch was doing was utilizing
gen10g_soft_reset which does nothing either, so just keep the code unchanged.

Signed-off-by: Florian Fainelli <>
4 years agokernel: update 4.4 to 4.4.89
Hauke Mehrtens [Sat, 30 Sep 2017 11:38:39 +0000 (13:38 +0200)]
kernel: update 4.4 to 4.4.89

Signed-off-by: Hauke Mehrtens <>
4 years agoltq-vdsl-mei: disable optimized firmware download
Mathias Kresin [Wed, 27 Sep 2017 04:52:43 +0000 (06:52 +0200)]
ltq-vdsl-mei: disable optimized firmware download

With ltq-vdsl-mei an optimized firmware download was added and
enabled by default. As soon as the optimized firmware download is
enabled, a watchdog based reboot is trigger between 24h to 48h of
uptime if the board isn't connected to a xdsl line.

Signed-off-by: Mathias Kresin <>
4 years agoltq-vdsl: fix PM thread suspend and resume handling
Martin Schiller [Tue, 26 Sep 2017 05:56:55 +0000 (07:56 +0200)]
ltq-vdsl: fix PM thread suspend and resume handling

This is a backport form drv_dsl_cpe_api-4.18.10 and fixes some PM
thread handling issues which lead to high system load and watchdog
trigger within 1h of uptime for boards not connected to a xdsl line.

Signed-off-by: Martin Schiller <>
4 years agoopenvpn: add "extra-certs" option
Sven Roederer [Tue, 5 Sep 2017 16:27:02 +0000 (18:27 +0200)]
openvpn: add "extra-certs" option

This option is used to specify a file containing PEM certs, to complete the
local certificate chain. Which is quite usefull for "split-CA" setups.

Signed-off-by: Sven Roederer <>
Signed-off-by: Yousong Zhou <>
4 years agolantiq: fix missing otg_cap on danube platform
Daniel Gonzalez Cabanelas [Sat, 29 Jul 2017 12:54:15 +0000 (14:54 +0200)]
lantiq: fix missing otg_cap on danube platform

USB doesn't work in some danube boards because otg_cap
is missing since previous changes made on the USB-dwc2
lantiq driver. Fix it.

Tested on the ARV7518PW router.

Signed-off-by: Daniel Gonzalez Cabanelas <>
4 years agotcpdump: noop commit to refer CVEs fixed in 4.9.2
Stijn Tintel [Sun, 17 Sep 2017 22:26:44 +0000 (01:26 +0300)]
tcpdump: noop commit to refer CVEs fixed in 4.9.2

When bumping tcpdump from 4.9.1 to 4.9.2, I did not include the fixed
CVEs in the commit message. As the list of fixed CVEs is quite long,
we should probably mention them in the changelogs of the releases to
come. This commit will make sure this happens.

The following CVEs were fixed in 21014d9708d586becbd62da571effadb488da9fc:


Signed-off-by: Stijn Tintel <>
(cherry picked from commit 2375e279a7cb462d62fd6028cb3fbd56217222de)

4 years agotcpdump: bump to 4.9.2
Stijn Tintel [Sun, 10 Sep 2017 19:27:26 +0000 (21:27 +0200)]
tcpdump: bump to 4.9.2

Signed-off-by: Stijn Tintel <>
(cherry picked from commit 21014d9708d586becbd62da571effadb488da9fc)

4 years agoutils/tcpdump: Rework URLs
Daniel Engberg [Wed, 22 Mar 2017 07:01:04 +0000 (08:01 +0100)]
utils/tcpdump: Rework URLs

Add actual mirror and use main site as last resport

Signed-off-by: Daniel Engberg <>
(cherry picked from commit fd95397ee33a34704771de2ab26a5910b1a88c6f)
Signed-off-by: Stijn Tintel <>

4 years agobase-files: fix wan6 interface config generation for pppoe
Hans Dedecker [Mon, 18 Sep 2017 07:18:36 +0000 (09:18 +0200)]
base-files: fix wan6 interface config generation for pppoe

Setting ipv6 to auto in case of a pppoe interface will trigger the
creation of a dynamic wan_6 interface meaning two IPv6 interfaces
(wan6 and wan_6) will be active on top of the pppoe interface.
This leads to unpredictable behavior in the network; therefore set
ipv6 to 1 which will prevent the dynamic creation of the wan_6
Further alias the wan6 interface on top of the wan interface for pppoe
as the wan6 interface can only be started when the link local address is
ready. In case of pppoe the link local address is negotiated during the
Internet Protocol Control Protocol when the PPP link is setup meaning
all the IP address info is only available when the wan interface is up.

Signed-off-by: Hans Dedecker <>
4 years agoipq806x: Archer C2600: fix switch ports numbering
Baptiste Jonglez [Wed, 23 Aug 2017 21:44:52 +0000 (23:44 +0200)]
ipq806x: Archer C2600: fix switch ports numbering

The order of LAN ports shown in Luci is reversed compared to what is
written on the case of the device.  Fix the order so that they match.

Signed-off-by: Baptiste Jonglez <>
4 years agotreewide: fix shellscript syntax errors/typos
Lorenzo Santina [Mon, 11 Sep 2017 13:27:53 +0000 (15:27 +0200)]
treewide: fix shellscript syntax errors/typos

Fix multiple syntax errors in shelscripts (of packages only)
These errors were causing many conditions to not working properly

Signed-off-by: Lorenzo Santina <>
[increase PKG_RELEASE, drop command substitution from]
Signed-off-by: Mathias Kresin <dev@kresin.em>
4 years agoramips: fix hg255d LED status support
David Yang [Sat, 9 Sep 2017 13:16:11 +0000 (21:16 +0800)]
ramips: fix hg255d LED status support

Use the green power LED for boot status indication.

Source: Para 3

Signed-off-by: David Yang <>
4 years agoar71xx: fix MAC addresses on TP-Link TL-WR1043ND v4
Matthias Schiffer [Mon, 11 Sep 2017 17:41:41 +0000 (19:41 +0200)]
ar71xx: fix MAC addresses on TP-Link TL-WR1043ND v4

The addresses were read from the 'config' partition, which would not always
contain the addresses at the same offsets, depending on the stock firmware
version used before flashing LEDE. Change this to get the addresses from
the 'product-info' partition, which is read-only.

Reported-and-tested-by: Andreas Ziegler <>
Signed-off-by: Matthias Schiffer <>
4 years agohostapd: fix iapp_interface option
Lorenzo Santina [Sat, 9 Sep 2017 14:40:57 +0000 (16:40 +0200)]
hostapd: fix iapp_interface option

ifname variable were not assigned due to syntax error
causing the hostapd config file to have an empty iapp_interface= option

Signed-off-by: Lorenzo Santina <>
4 years agokernel: update 4.4 to 4.4.87
Kevin Darbyshire-Bryant [Thu, 7 Sep 2017 14:47:21 +0000 (15:47 +0100)]
kernel: update 4.4 to 4.4.87

Fixes CVE-2017-11600

No patch refresh required

Compile & run tested: ar71xx - Archer C7 v2

Signed-off-by: Kevin Darbyshire-Bryant <>
4 years agodnsmasq: backport arcount edns0 fix
Kevin Darbyshire-Bryant [Fri, 8 Sep 2017 07:56:34 +0000 (08:56 +0100)]
dnsmasq: backport arcount edns0 fix

Don't return arcount=1 if EDNS0 RR won't fit in the packet.

Omitting the EDNS0 RR but setting arcount gives a malformed packet.
Also, don't accept UDP packet size less than 512 in received EDNS0.

Signed-off-by: Kevin Darbyshire-Bryant <>
4 years agodnsmasq: backport official fix for CVE-2017-13704
Kevin Darbyshire-Bryant [Thu, 7 Sep 2017 02:58:23 +0000 (03:58 +0100)]
dnsmasq: backport official fix for CVE-2017-13704

Remove LEDE partial fix for CVE-2017-13704.

Backport official fix from upstream.

Signed-off-by: Kevin Darbyshire-Bryant <>
Signed-off-by: Hans Dedecker <> (PKG_RELEASE increase)
4 years agouclient: update to 2017-09-06
Matthias Schiffer [Wed, 6 Sep 2017 13:44:14 +0000 (15:44 +0200)]
uclient: update to 2017-09-06

24d6eded73de uclient-http: fix Host: header for literal IPv6 addresses
83ce236dab86 uclient-fetch: read_data_cb: fix a potential buffer overflow

Signed-off-by: Matthias Schiffer <>
4 years agokernel: update 4.4 to 4.4.86
Kevin Darbyshire-Bryant [Mon, 4 Sep 2017 11:50:01 +0000 (12:50 +0100)]
kernel: update 4.4 to 4.4.86

Refresh patches

Signed-off-by: Kevin Darbyshire-Bryant <>
4 years agobrcm47xx: refresh Linux 4.4 config
Rafał Miłecki [Mon, 4 Sep 2017 06:07:10 +0000 (08:07 +0200)]
brcm47xx: refresh Linux 4.4 config

Signed-off-by: Rafał Miłecki <>
4 years agof2fs-tools: fix mkfs.f2fs on big-endian systems
Stijn Tintel [Thu, 24 Aug 2017 07:04:15 +0000 (10:04 +0300)]
f2fs-tools: fix mkfs.f2fs on big-endian systems

Fixes: FS#749
Signed-off-by: Stijn Tintel <>
(cherry picked from commit cdb494fdc2d3399e698893ff0cfd06d3c802364f)

4 years agof2fs-tools: drop musl compat patch
Stijn Tintel [Thu, 24 Aug 2017 06:56:49 +0000 (09:56 +0300)]
f2fs-tools: drop musl compat patch

It is no longer needed since version 1.4.1.

Signed-off-by: Stijn Tintel <>
(cherry picked from commit 252c8ddf146f196faaa34cf7af9b3eacb79e6add)

4 years agof2fs-tools: drop patch in favour of CONFIGURE_VARS
Stijn Tintel [Thu, 24 Aug 2017 06:23:32 +0000 (09:23 +0300)]
f2fs-tools: drop patch in favour of CONFIGURE_VARS

Override the failing check in configure with CONFIGURE_VARS instead of
carrying a patch that's unlikely to be accepted by upstream.

Signed-off-by: Stijn Tintel <>
Acked-by: John Crispin <>
(cherry picked from commit d87f27af54e7c122c8f320f7266dd5061bb47a8b)

4 years agof2fs-tools: Switch to gz tarball
Daniel Engberg [Wed, 10 May 2017 09:04:26 +0000 (11:04 +0200)]
f2fs-tools: Switch to gz tarball

At some point decided to drop xz generated tarballs, switch to gz which they still provide.

Signed-off-by: Daniel Engberg <>
4 years agodnsmasq: forward.c: fix CVE-2017-13704
Kevin Darbyshire-Bryant [Tue, 29 Aug 2017 13:29:18 +0000 (14:29 +0100)]
dnsmasq: forward.c: fix CVE-2017-13704

Fix SIGSEGV in rfc1035.c answer_request() line 1228 where memset()
is called with header & limit pointing at the same address and thus
tries to clear memory from before the buffer begins.

answer_request() is called with an invalid edns packet size provided by
the client.  Ensure the udp_size provided by the client is bounded by
512 and configured maximum as per RFC 6891 6.2.3 "Values lower than 512
MUST be treated as equal to 512"

The client that exposed the problem provided a payload udp size of 0.

Signed-off-by: Kevin Darbyshire-Bryant <>
Acked-by: Hans Dedecker <>
4 years agokernel: backport usbport LED trigger driver support for DT
Rafał Miłecki [Wed, 28 Jun 2017 09:31:14 +0000 (11:31 +0200)]
kernel: backport usbport LED trigger driver support for DT

Signed-off-by: Rafał Miłecki <>
4 years agokernel: fix of_node handling in LEDs core code
Rafał Miłecki [Wed, 8 Mar 2017 11:38:43 +0000 (12:38 +0100)]
kernel: fix of_node handling in LEDs core code

This backports fixes for setting of_node and making it possible to read
extra info from DT. This was partially fixed by:
[PATCH] leds: leds-gpio: Set of_node for created LED devices
but it didn't work during initialization.

Signed-off-by: Rafał Miłecki <>
4 years agokernel: update 4.4 to 4.4.83
Kevin Darbyshire-Bryant [Thu, 17 Aug 2017 16:58:24 +0000 (17:58 +0100)]
kernel: update 4.4 to 4.4.83

Refresh patches.
Minor update 704-phy-no-genphy-soft-reset.patch which was partially
accepted upstream.
Compile-tested on ar71xx.
Runtime-tested on ar71xx.

Fixes the following vulnerabilities:
- CVE-2017-7533 (4.4.80)
- CVE-2017-1000111 (4.4.82)
- CVE-2017-1000112 (4.4.82)

Signed-off-by: Kevin Darbyshire-Bryant <>
4 years agobcm53xx: backport DTS commits that setup USB LEDs
Rafał Miłecki [Thu, 17 Aug 2017 07:43:37 +0000 (09:43 +0200)]
bcm53xx: backport DTS commits that setup USB LEDs

Signed-off-by: Rafał Miłecki <>
4 years agotcpdump: Update to 4.9.1
Daniel Engberg [Mon, 24 Jul 2017 22:10:58 +0000 (00:10 +0200)]
tcpdump: Update to 4.9.1

 * CVE-2017-11108: Fix bounds checking for STP.

Signed-off-by: Daniel Engberg <>
5 years agombedtls: Re-allow SHA1-signed certificates
Baptiste Jonglez [Sun, 30 Jul 2017 15:57:37 +0000 (17:57 +0200)]
mbedtls: Re-allow SHA1-signed certificates

Since mbedtls 2.5.1, SHA1 has been disallowed in TLS certificates.
This breaks openvpn clients that try to connect to servers that
present a TLS certificate signed with SHA1, which is fairly common.

Run-tested with openvpn-mbedtls 2.4.3, LEDE 17.01.2, on ar71xx.

Fixes: FS#942
Signed-off-by: Baptiste Jonglez <>
5 years agoramips: fix WHR-1166D WAN port
Mathias Kresin [Wed, 9 Aug 2017 18:17:43 +0000 (20:17 +0200)]
ramips: fix WHR-1166D WAN port

By adding the ICPlus IP1001 phy driver an already set RGMII delay mode
is reset during driver load.

Set the rgmii rx delay to fix corrupt/no packages in case the WAN port
negotiates to 1000MBit.

Fixes: FS#670
Signed-off-by: Mathias Kresin <>
5 years agobase-files: don't setup network in preinit if failsafe is disabled
Rafał Miłecki [Mon, 7 Aug 2017 09:09:33 +0000 (11:09 +0200)]
base-files: don't setup network in preinit if failsafe is disabled

With failsafe disabled there is no point in early network setup. We
don't send announcement over UDP and there is no way to ssh to the

A side effect of this is avoiding a possibly incorrect network config
(only with failsafe disabled). This problem is related to possible
changes made by user in /etc/config/network.

Signed-off-by: Rafał Miłecki <>
5 years agodnsmasq: backport remove ping check of configured dhcp address
Hans Dedecker [Tue, 18 Jul 2017 20:55:29 +0000 (22:55 +0200)]
dnsmasq: backport remove ping check of configured dhcp address

Remove ping check in DHCPDISCOVER case as too many buggy clients leave
an interface in configured state causing the ping check to fail.

Signed-off-by: Hans Dedecker <>
5 years agoprocd: update to the latest git HEAD
Hans Dedecker [Tue, 8 Aug 2017 12:40:21 +0000 (14:40 +0200)]
procd: update to the latest git HEAD

66be6a2 watchdog: fix inline watchdog_get_magicclose function prototype

Signed-off-by: Hans Dedecker <>
5 years agoramips: ArcherC50v1: fix wlan2g MAC address
Thibaut VARENE [Fri, 4 Aug 2017 15:22:03 +0000 (17:22 +0200)]
ramips: ArcherC50v1: fix wlan2g MAC address

By default the wlan eprom contains the generic ralink MAC which is not
the vendor (TP-Link) one. Based on OFW bootlog, it appears that addresses
are decremented from the ethernet MAC.

This patch fixes the MAC address for wlan2g in line with OFW.

Signed-off-by: Thibaut VARENE <>
5 years agoramips: fix Omnima MiniEMBWiFi image
Mathias Kresin [Mon, 31 Jul 2017 18:21:12 +0000 (20:21 +0200)]
ramips: fix Omnima MiniEMBWiFi image

Reference the Omnima MiniEMBWiFi device tree source file in the image
build code. Otherwise the dts of the image processed before is used.

Signed-off-by: Mathias Kresin <>
5 years agoramips: build HuaWei HG255D image
Mathias Kresin [Mon, 31 Jul 2017 18:19:14 +0000 (20:19 +0200)]
ramips: build HuaWei HG255D image

The code to build an image was disabled some time ago for unknown
reasons albeit the image looks fine.

Signed-off-by: Mathias Kresin <>
5 years agoramips: add missing partitions
Mathias Kresin [Mon, 31 Jul 2017 16:00:35 +0000 (18:00 +0200)]
ramips: add missing partitions

The partitions were lost during migration to device tree.

Signed-off-by: Mathias Kresin <>
5 years agoprocd: update to latest git HEAD
John Crispin [Tue, 1 Aug 2017 05:02:26 +0000 (07:02 +0200)]
procd: update to latest git HEAD

3e68cdf procd: Do not leak pipe file descriptors to children

Signed-off-by: John Crispin <>
5 years agoralink: fix rcu_sched stalls on mt7621
John Crispin [Tue, 1 Aug 2017 04:53:38 +0000 (06:53 +0200)]
ralink: fix rcu_sched stalls on mt7621

there were 2 bugs
*) core1 came up with a bad bogo mips, looks like the clock needed time to stabilize
*) HPT frequency was not set making r4k timers not come up properly

Backport of 9551d91b1d6 "ralink: fix rcu_sched stalls on mt7621".

Signed-off-by: John Crispin <>
5 years agoramips: Archer C50v1: fix power led
Thibaut VARENE [Sat, 29 Jul 2017 09:32:44 +0000 (11:32 +0200)]
ramips: Archer C50v1: fix power led

01_leds had a workaround for the power led to compensate for the
inverted GPIO state. This patch was missing from my previous commit.

Signed-off-by: Thibaut VARENE <>
[add the power led default-state which was omitted in the last commit
by me]
Signed-off-by: Mathias Kresin <>
5 years agoramips: Archer C50v1: fix switch port numbering
Thibaut VARENE [Fri, 28 Jul 2017 20:36:52 +0000 (22:36 +0200)]
ramips: Archer C50v1: fix switch port numbering

Luci shows switch ports in wrong order on that device.
This patch fixes switch port numbering and matches them to the device

Signed-off-by: Thibaut VARENE <>
5 years agoramips: Archer C50v1: fix LEDs active levels
Thibaut VARENE [Fri, 28 Jul 2017 21:26:40 +0000 (23:26 +0200)]
ramips: Archer C50v1: fix LEDs active levels

All LEDs GPIOs are active low on this device.

WAN and POWER states were inverted. Add default state for power.

Tested on Archer C50v1.

Signed-off-by: Thibaut VARENE <>
5 years agoramips: fix Mercury MAC1200R v2.0 board name
Mathias Kresin [Fri, 28 Jul 2017 17:22:55 +0000 (19:22 +0200)]
ramips: fix Mercury MAC1200R v2.0 board name

With d2b6bf141662 ("ramips: fix image validation errors") the board
name was changed to fix an image validation error. But this change
wasn't applied to all other files using the board name, which broke

Revert this change and use the former board name in the metadata

Signed-off-by: Mathias Kresin <>
5 years agobrcm63xx: add NULL clock fix send upstream
Mathias Kresin [Fri, 28 Jul 2017 18:09:53 +0000 (20:09 +0200)]
brcm63xx: add NULL clock fix send upstream

Make the behaviour of clk_get_rate consistent with common clk's
clk_get_rate by accepting NULL clocks as parameter. Some device
drivers rely on this, and will cause an OOPS otherwise.

Fixes: FS#735
Signed-off-by: Mathias Kresin <>
5 years agoramips: add NULL clock fix send upstream
Mathias Kresin [Fri, 28 Jul 2017 17:38:04 +0000 (19:38 +0200)]
ramips: add NULL clock fix send upstream

Make the behaviour of clk_get_rate consistent with common clk's
clk_get_rate by accepting NULL clocks as parameter. Some device
drivers rely on this, and will cause an OOPS otherwise.

Fixes: FS#735
Signed-off-by: Mathias Kresin <>
5 years agoar7: add NULL clock fix send upstream
Mathias Kresin [Fri, 28 Jul 2017 17:05:33 +0000 (19:05 +0200)]
ar7: add NULL clock fix send upstream

Make the behaviour of clk_get_rate consistent with common clk's
clk_get_rate by accepting NULL clocks as parameter. Some device
drivers rely on this, and will cause an OOPS otherwise.

Signed-off-by: Mathias Kresin <>
5 years agocurl: fix CVE-2017-7407 and CVE-2017-7468
Hauke Mehrtens [Sun, 23 Jul 2017 14:08:47 +0000 (16:08 +0200)]
curl: fix CVE-2017-7407 and CVE-2017-7468

This fixes the following security problems:
* CVE-2017-7407:
* CVE-2017-7468:

Signed-off-by: Hauke Mehrtens <>
5 years agokernel: update kernel 4.4 to version 4.4.79
Hauke Mehrtens [Sun, 23 Jul 2017 13:00:22 +0000 (15:00 +0200)]
kernel: update kernel 4.4 to version 4.4.79

Signed-off-by: Hauke Mehrtens <>
5 years agoramips: DIR-860L-B1 fix switch port numbering
Thibaut VARENE [Tue, 25 Jul 2017 10:29:14 +0000 (12:29 +0200)]
ramips: DIR-860L-B1 fix switch port numbering

Luci shows switch ports in inverted order on that device.
This patch fixes switch port numbering and matches them to the device

Signed-off-by: Thibaut VARENE <>
5 years agokernel: netfilter: fix nf-nathelper(-extra) description
Uwe Arnold [Thu, 20 Jul 2017 18:04:26 +0000 (20:04 +0200)]
kernel: netfilter: fix nf-nathelper(-extra) description

The tftp and irc netfilter modules are provided by nf-nathelper-extra
and not by nf-nathelper.

Signed-off-by: Uwe Arnold <>
[move the irc module as well]
Signed-off-by: Mathias Kresin <>
5 years agoramips: fix wps button gpio for DWR-512
Giuseppe Lippolis [Tue, 18 Jul 2017 20:55:53 +0000 (22:55 +0200)]
ramips: fix wps button gpio for DWR-512

The WPS button is at GPIO#7.

Signed-off-by: Giuseppe Lippolis <>
5 years agoramips: DTS: VoCore2 improvements/fixes
Paul Wassi [Sat, 22 Jul 2017 09:15:55 +0000 (11:15 +0200)]
ramips: DTS: VoCore2 improvements/fixes

The VoCore2 features 128MB of RAM, therefore set
memory in DTS to 128*1024*1024 = 0x8000000
The board's LED is connected to GND, set it to
Make serial console working again on kernel 4.9 by
change of pinmux configuration.

Signed-off-by: Paul Wassi <>
5 years agoar71xx: fix switch port mapping for TP-Link TL-WR74xN/D series
Piotr Dymacz [Fri, 14 Jul 2017 13:14:29 +0000 (15:14 +0200)]
ar71xx: fix switch port mapping for TP-Link TL-WR74xN/D series

Backport of ad8c315: "ar71xx: fix switch port mapping for TP-Link
TL-WR74xN/D series".

Fixes FS#843

Signed-off-by: Piotr Dymacz <>
5 years agouboot-envtools: add support for ALFA Network AP121F
Piotr Dymacz [Fri, 31 Mar 2017 11:43:06 +0000 (13:43 +0200)]
uboot-envtools: add support for ALFA Network AP121F

Signed-off-by: Piotr Dymacz <>
5 years agoar71xx: add support for ALFA Network AP121F
Piotr Dymacz [Fri, 31 Mar 2017 11:37:31 +0000 (13:37 +0200)]
ar71xx: add support for ALFA Network AP121F

ALFA Network AP121F is a pocket-size router dedicated for VPN/TOR users.
Device is based on Atheros AR9331 WiSoC and is running a custom version
(updated from OpenWrt CC to LEDE 17.01 release) of NetAidKit firmware.


- 400/400/200 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR1)
- 16 MB of FLASH (SPI NOR)
- 1x 10/100 Mbps Ethernet
- 1T1R 2.4 GHz
- 1x microSD (optional, on separate PCB)
- 3x LED, 1x button, 1x switch
- UART header on PCB

Flash instruction (under U-Boot web recovery mode):

1. Configure PC with static IP
2. Connect PC with RJ45 port, press the reset button, power up device,
   wait for first blink of all LEDs (indicates network setup), then keep
   button for 3 following blinks and release it.
3. Open address in your browser and upload sysupgrade image.

Signed-off-by: Piotr Dymacz <>
5 years agoimage: fix ar71xx legacy images
Mathias Kresin [Fri, 14 Jul 2017 17:35:02 +0000 (19:35 +0200)]
image: fix ar71xx legacy images

legacy images:

- an already jffs2 padded squashfs rootfs is overwritten
  with an unpadded/raw one.

- the squashfs-raw and squashfs-64k rootfs are not replaced by the
  ones including the DEVICE_PACKAGES

Call Image/Build/squashfs after the DEVICE_PACKAGES are added to the
base squashfs rootfs to fix the issues.

Fixes: FS#904
Signed-off-by: Mathias Kresin <>
5 years agoimx6: fix DualLite/Solo GW551X board detection
Mathias Kresin [Mon, 15 May 2017 16:21:39 +0000 (18:21 +0200)]
imx6: fix DualLite/Solo GW551X board detection

The model name is a different one in the device tree source file.

Signed-off-by: Mathias Kresin <>
5 years agoprocd: backport kernel watchdog start/stop support
Hans Dedecker [Thu, 13 Jul 2017 19:54:59 +0000 (21:54 +0200)]
procd: backport kernel watchdog start/stop support

4dbf57a watchdog: add support for starting/stopping kernel watchdog

Signed-off-by: Hans Dedecker <>
5 years agox86: add missing kernel config symbols to Geode target
Jo-Philipp Wich [Wed, 12 Jul 2017 23:25:10 +0000 (01:25 +0200)]
x86: add missing kernel config symbols to Geode target

Signed-off-by: Jo-Philipp Wich <>
5 years agox86: enable ACPI support for the Geode subtarget
Jo-Philipp Wich [Wed, 12 Jul 2017 20:38:39 +0000 (22:38 +0200)]
x86: enable ACPI support for the Geode subtarget

Backport of 9b940fe "x86: enable ACPI support for the Geode subtarget".

Fixes FS#577.

Signed-off-by: Jo-Philipp Wich <>
5 years agodnsmasq: backport patch fixing DNS failover (FS#841)
Hans Dedecker [Wed, 28 Jun 2017 08:15:38 +0000 (10:15 +0200)]
dnsmasq: backport patch fixing DNS failover (FS#841)

Backport upstream dnsmasq patch fixing DNS failover when first servers
returns REFUSED in strict mode; fixes issue FS#841.

Signed-off-by: Hans Dedecker <>