staging/chunkeey, branch v18.06.2

OpenWrt v18.06.2: adjust config defaults

2019-01-30T12:34:49Z

Signed-off-by: Jo-Philipp Wich

base-files: config_get: prevent filename globbing

2019-01-30T12:21:02Z

When config_get is called as "config_get section option" the option is unexpectedly globbed by the shell which differs from the way options are read to a variable with "config_get variable section option". Add another layer of double quotes to fix it. Signed-off-by: Günther Kelleter (backported from commit c3389ab135400fba0cb710d9c6c63df2f563d9d9)

dnsmasq: backport missing braces fix

2019-01-30T12:01:24Z

Fold upstream fix d2d4990 ("Fix missing braces in 8eac67c0a15b673c8d27002c248651b308093e4") into the already existing static lease fix patch. Signed-off-by: Jo-Philipp Wich

build: fix umask detection bashism

2019-01-30T11:40:16Z

the leading 0 is optional and not emitted by some shells Signed-off-by: Thorsten Glaser (cherry picked from commit da5bee5345ce8f66eb36b8993b87b684e5cce614)

build: fix STAGING_DIR cleaning for packages

2019-01-30T11:40:16Z

This fixes two issues with cleaning package files from STAGING_DIR: * CleanStaging currently can only remove files and not directories. This changes CleanStaging to use clean-package.sh, which does remove directories. * Because of the way directories are ordered in the staging files list, clean-package.sh currently tries (and fails) to remove parent directories before removing subdirectories. This changes clean-package.sh to process the staging files list in reverse, so that subdirectories are removed first. Signed-off-by: Jeffery To (cherry picked from commit a1170936798e519776de605d6986ccb72f04cb06)

ar71xx: use correct wan mac address for the TP-Link Archer C7 v4

2019-01-30T11:24:32Z

The correct MAC address for this device is lan_mac +1, there is no need to set lan_mac so use base_mac variable instead lan_mac. Based on this PR for ath79: https://github.com/openwrt/openwrt/pull/1726 Signed-off-by: David Santamaría Rogado [fix alphabetical ordering, reword subject] Signed-off-by: Jo-Philipp Wich (cherry picked from commit 4bcf58135210736f2a1603609d2a76b3e188e2ad)

ar71xx: Add usb drivers in Archer C7 v4/v5 images

2019-01-30T11:15:21Z

This commit adds the default usb packages - kmod-usb-core - kmod-usb2 - kmod-usb-ledtrig-usbport for Archer C7 v4 and v5. (The C7 v5 configuration is based on the v4, therefore the change for v4 also applies for v5.) Signed-off-by: Daniel Halmschlager (backported from commit 99e212171abf44d6e0f7e7ba50a229ad7b3f3a34)

openssl: bump to 1.0.2q

2019-01-30T11:00:46Z

This fixes the following security problems: * CVE-2018-5407: Microarchitecture timing vulnerability in ECC scalar multiplication * CVE-2018-0734: Timing vulnerability in DSA signature generation * Resolve a compatibility issue in EC_GROUP handling with the FIPS Object Module Signed-off-by: Sven Roederer (cherry picked from commit 989060478ae270885727d91c25b9b52b0f33743c)

dnsmasq: backport upstream static lease fix

2019-01-30T10:42:27Z

Backport and rebase upstream fix 18eac67 ("Fix entries in /etc/hosts disabling static leases.") Signed-off-by: Jo-Philipp Wich

wireguard: bump to 0.0.20190123

2019-01-30T09:55:22Z

* tools: curve25519: handle unaligned loads/stores safely This should fix sporadic crashes with `wg pubkey` on certain architectures. * netlink: auth socket changes against namespace of socket In WireGuard, the underlying UDP socket lives in the namespace where the interface was created and doesn't move if the interface is moved. This allows one to create the interface in some privileged place that has Internet access, and then move it into a container namespace that only has the WireGuard interface for egress. Consider the following situation: 1. Interface created in namespace A. Socket therefore lives in namespace A. 2. Interface moved to namespace B. Socket remains in namespace A. 3. Namespace B now has access to the interface and changes the listen port and/or fwmark of socket. Change is reflected in namespace A. This behavior is arguably _fine_ and perhaps even expected or acceptable. But there's also an argument to be made that B should have A's cred to do so. So, this patch adds a simple ns_capable check. * ratelimiter: build tests with !IPV6 Should reenable building in debug mode for systems without IPv6. * noise: replace getnstimeofday64 with ktime_get_real_ts64 * ratelimiter: totalram_pages is now a function * qemu: enable FP on MIPS Linux 5.0 support. * keygen-html: bring back pure javascript implementation Benoît Viguier has proofs that values will stay well within 2^53. We also have an improved carry function that's much simpler. Probably more constant time than emscripten's 64-bit integers. * contrib: introduce simple highlighter library This is the highlighter library being used in: - https://twitter.com/EdgeSecurity/status/1085294681003454465 - https://twitter.com/EdgeSecurity/status/1081953278248796165 It's included here as a contrib example, so that others can paste it into their own GUI clients for having the same strictly validating highlighting. * netlink: use __kernel_timespec for handshake time This readies us for Y2038. See https://lwn.net/Articles/776435/ for more info. Signed-off-by: Jason A. Donenfeld (cherry picked from commit bbcd0634f8c9769a336386f8df471231d24a27cc)