staging/hauke/package, branch v21.02.7

OpenWrt v21.02.7: adjust config defaults

2023-04-27T21:08:10Z

Signed-off-by: Hauke Mehrtens

openssl: fix CVE-2023-464 and CVE-2023-465

2023-04-17T13:15:36Z

Apply two patches fixing low-severity vulnerabilities related to certificate policies validation: - Excessive Resource Usage Verifying X.509 Policy Constraints (CVE-2023-0464) Severity: Low A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. - Invalid certificate policies in leaf certificates are silently ignored (CVE-2023-0465) Severity: Low Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. Note: OpenSSL also released a fix for low-severity security advisory CVE-2023-466. It is not included here because the fix only changes the documentation, which is not built nor included in any OpenWrt package. Due to the low-severity of these issues, there will be not be an immediate new release of OpenSSL. Signed-off-by: Eneas U de Queiroz

uclient: update to Git version 2023-04-13

2023-04-13T18:55:09Z

007d94546749 uclient: cancel state change timeout in uclient_disconnect() 644d3c7e13c6 ci: improve wolfSSL test coverage dc54d2b544a1 tests: add certificate check against letsencrypt.org Signed-off-by: Matthias Schiffer (cherry picked from commit 4f1c2e8deef10e9ca34ceff5a096e62aaa668e90)

OpenWrt v21.02.6: revert to branch defaults

2023-04-09T22:38:42Z

Signed-off-by: Daniel Golle

OpenWrt v21.02.6: adjust config defaults

2023-04-09T22:38:36Z

Signed-off-by: Daniel Golle

mac80211, mt76: add fixes for recently discovered security issues

2023-03-30T10:24:52Z

Fixes CVE-2022-47522 Signed-off-by: Felix Fietkau (cherry picked from commit d54c91bd9ab3c54ee06923eafbd67047816a37e4)

lantiq: ltq-tapi: add kernel 5.10 compatiblity

2023-03-29T14:31:21Z

Due to SCHED_FIFO being a broken scheduler model, all users of sched_setscheduler() are converted to sched_set_fifo_low() upstream and sched_setscheduler() is no longer exported. The callback handling of the tasklet API was redesigned and the macros using the old syntax renamed to _OLD. Signed-off-by: Mathias Kresin (cherry picked from commit 31f3f797004ad318a1de88ec9cfdece523ee46d9) [Add DECLARE_TASKLET handling for kernel 5.4.235 too] Signed-off-by: Hauke Mehrtens

ltq-atm/ltq-ptm: add kernel 5.10 compatiblity

2023-03-27T16:42:28Z

The callback handling of the tasklet API was redesigned and the macros using the old syntax renamed to _OLD. The stuck queue is now passed to ndo_tx_timeout callback but not used so far. Signed-off-by: Mathias Kresin (cherry picked from commit 804c541446ab8e3fab11dba5d8fe07807af7fac5) [Add DECLARE_TASKLET handling for kernel 5.4.235 too] Signed-off-by: Hauke Mehrtens

kernel: tcindex classifier has been retired

2023-03-27T16:42:28Z

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/net/sched?h=v5.4.235&id=7a6fb69bbcb21e9ce13bdf18c008c268874f0480 Signed-off-by: John Audia (cherry picked from commit fbfec3286e8bfce3a78749b7bcb67e658665f197)

ca-certificates: fix python3-cryptography woes in certdata2pem.py

2023-03-04T12:09:12Z

This patch is a revert of the upstream patch to Debian's ca-certificate commit 033d52259172 ("mozilla/certdata2pem.py: print a warning for expired certificates.") The reason is, that this change broke builds with the popular Ubuntu 20.04 LTS (focal) releases which are shipping with an older version of the python3-cryptography package that is not compatible. |Traceback (most recent call last): | File "certdata2pem.py", line 125, in | cert = x509.load_der_x509_certificate(obj['CKA_VALUE']) |TypeError: load_der_x509_certificate() missing 1 required positional argument: 'backend' |make[5]: *** [Makefile:6: all] Error 1 ...or if the python3-cryptography was missing all together: |Traceback (most recent call last): | File "/certdata2pem.py", line 31, in | from cryptography import x509 |ModuleNotFoundError: No module named 'cryptography' More concerns were raised by Jo-Philipp Wich: "We don't want the build to depend on the local system time anyway. Right now it seems to be just a warning but I could imagine that eventually certs are simply omitted of found to be expired at build time which would break reproducibility." Link: Reported-by: Chen Minqiang Reported-by: Shane Synan Signed-off-by: Christian Lamparter (cherry picked from commit 25bc66eb40ea2c062940778fba601032b2579734)