Hauke Mehrtens staging tree https://git.openwrt.org/openwrt/staging/hauke/atom?h=v21.02.2 2022-02-12T23:23:08Z 2022-02-12T23:23:08Z Sergey V. Lobanov 2022-01-01T19:37:13Z urn:sha1:5b13b0b02c703a3c0c60828abfde01f283a2d821 Bump from 4.8.1-stable to 5.1.1-stable Detailed release notes: https://github.com/wolfSSL/wolfssl/releases Upstreamed patches: 001-Maths-x86-asm-change-asm-snippets-to-get-compiling.patch - https://github.com/wolfSSL/wolfssl/commit/fa8f23284d4689c2a737204b337b58d966dcbd8c 002-Update-macro-guard-on-SHA256-transform-call.patch - https://github.com/wolfSSL/wolfssl/commit/f447e4c1fa4c932c0286fa0331966756e243db81 Refreshed patches: 100-disable-hardening-check.patch 200-ecc-rng.patch CFLAG -DWOLFSSL_ALT_CERT_CHAINS replaced to --enable-altcertchains configure option The size of the ipk changed on aarch64 like this: 491341 libwolfssl4.8.1.31258522_4.8.1-stable-7_aarch64_cortex-a53.ipk 520322 libwolfssl5.1.1.31258522_5.1.1-stable-1_aarch64_cortex-a53.ipk Tested-by: Alozxy <alozxy@users.noreply.github.com> Acked-by: Eneas U de Queiroz <cotequeiroz@gmail.com> Signed-off-by: Sergey V. Lobanov <sergey@lobanov.in> (cherry picked from commit 93d91197b98463277b601ec2653351666a4ca4bd) 2022-02-12T19:27:27Z Sergey V. Lobanov 2021-12-24T23:04:50Z urn:sha1:7d376e6e528f2d34e2f71f99f2f2f545a4dd63f2 x509v3 SAN extension is required to generate a certificate compatible with chromium-based web browsers (version >58) It can be disabled via unsetting CONFIG_WOLFSSL_ALT_NAMES Signed-off-by: Sergey V. Lobanov <sergey@lobanov.in> (cherry picked from commit dfd695f4b9f364a7c7db646d2cada10fdf304f02) 2022-02-12T19:25:48Z Stan Grishin 2021-10-07T20:15:25Z urn:sha1:5ea2e1d5baa9cca7c300132dccc85ae0e2882eb7 * fixes https://github.com/openwrt/packages/issues/16652 see https://github.com/openwrt/packages/issues/16674#issuecomment-934983898 Signed-off-by: Stan Grishin <stangri@melmac.net> (cherry picked from commit 05a7af9ca0dd9c42eafbca5aa988b141e0e06053) 2022-02-12T19:02:21Z Hauke Mehrtens 2022-01-16T20:51:21Z urn:sha1:4108d02a29037cd733acfbd9a68f5dc4d58c3a56 868fd88 ustream-openssl: wolfSSL: Add compatibility for wolfssl >= 5.0 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit e74529552cf8fa16bd40b3db9d5cc82a913a49b4) 2022-02-12T18:42:08Z Hauke Mehrtens 2022-01-29T10:56:27Z urn:sha1:32d50a1281a76fab45d6bce5ea0d1ac6ff74a78d This fixes the following security problems: * Zeroize several intermediate variables used to calculate the expected value when verifying a MAC or AEAD tag. This hardens the library in case the value leaks through a memory disclosure vulnerability. For example, a memory disclosure vulnerability could have allowed a man-in-the-middle to inject fake ciphertext into a DTLS connection. * Fix a double-free that happened after mbedtls_ssl_set_session() or mbedtls_ssl_get_session() failed with MBEDTLS_ERR_SSL_ALLOC_FAILED (out of memory). After that, calling mbedtls_ssl_session_free() and mbedtls_ssl_free() would cause an internal session buffer to be free()'d twice. CVE-2021-44732 The sizes of the ipk changed on MIPS 24Kc like this: 182454 libmbedtls12_2.16.11-2_mips_24kc.ipk 182742 libmbedtls12_2.16.12-1_mips_24kc.ipk Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit 57f38e2c827e3be71d8b1709073e366afe011985) 2022-01-16T15:28:46Z Karel Kočí 2021-06-21T09:42:25Z urn:sha1:cd5ba0cfbbdbefa28ea7734b3a163fa58d509184 This adds conflicts between variants of libustream pacakge. They provide the same file and thus it should not be possible to install them side by side. Signed-off-by: Karel Kočí <karel.koci@nic.cz> (cherry picked from commit 219e17a35088a90eea664fbb4c66549d701a3cb4) 2022-01-03T21:09:45Z Eneas U de Queiroz 2022-01-03T13:52:58Z urn:sha1:5beaa75d94c4a981c580905b84c7ef33caf0c3e2 This is a bugfix release. Changelog: *) Avoid loading of a dynamic engine twice. *) Fixed building on Debian with kfreebsd kernels *) Prioritise DANE TLSA issuer certs over peer certs *) Fixed random API for MacOS prior to 10.12 Patches were refreshed. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com> (cherry picked from commit def9565be632b316c82ffc5a7b28c789e9df75b4) 2021-12-29T22:45:37Z Hauke Mehrtens 2021-12-26T22:38:52Z urn:sha1:4dddb7ca3669e93d4da2b1ca43b8bc22bd007e48 The http://www.us.tcpdump.org mirror will go offline soon, only use the normal download URL. Reported-by: Denis Ovsienko <denis@ovsienko.info> Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit 18bdfc803bef00fad03f90b73b6e65c3c79cb397) Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com> [rebased for OpenWrt 21.02 branch] 2021-11-05T20:24:04Z Stephan Schmidtmer 2021-08-10T20:21:30Z urn:sha1:6ec5dbd2a138d95880953e8e3a67c0e250aabf4c This enables building of rpcapd and adds it as a package. It is a daemon that allows remote packet capturing from another machine. E.g. Wireshark can talk to it using the Remote Capture Protocol (RPCAP). https://www.tcpdump.org/manpages/rpcapd.8.html Compile and run tested: OpenWrt 21.02.0-rc4 r16256-2d5ee43dc6 on x86/64 and mvebu/cortexa9 Signed-off-by: Stephan Schmidtmer <hurz@gmx.org> (cherry picked from commit 891c8676a1602d31adf3ab9f913664ae0d3b4029) 2021-10-23T10:38:01Z Ivan Pavlov 2021-10-15T05:11:10Z urn:sha1:23778f067a5aa8d2fa7e15244521774bf849ae6b fixing linking error when --enable-devcrypto=yes fixes: 7d92bb050961 wolfssl: update to 4.8.1-stable Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com> (cherry picked from commit be3e260f92643a841f4f83b03cbb07b9a26cff66)