staging/pepe2k/package, branch v18.06.2

OpenWrt v18.06.2: adjust config defaults

2019-01-30T12:34:49Z

Signed-off-by: Jo-Philipp Wich

base-files: config_get: prevent filename globbing

2019-01-30T12:21:02Z

When config_get is called as "config_get section option" the option is unexpectedly globbed by the shell which differs from the way options are read to a variable with "config_get variable section option". Add another layer of double quotes to fix it. Signed-off-by: Günther Kelleter (backported from commit c3389ab135400fba0cb710d9c6c63df2f563d9d9)

dnsmasq: backport missing braces fix

2019-01-30T12:01:24Z

Fold upstream fix d2d4990 ("Fix missing braces in 8eac67c0a15b673c8d27002c248651b308093e4") into the already existing static lease fix patch. Signed-off-by: Jo-Philipp Wich

openssl: bump to 1.0.2q

2019-01-30T11:00:46Z

This fixes the following security problems: * CVE-2018-5407: Microarchitecture timing vulnerability in ECC scalar multiplication * CVE-2018-0734: Timing vulnerability in DSA signature generation * Resolve a compatibility issue in EC_GROUP handling with the FIPS Object Module Signed-off-by: Sven Roederer (cherry picked from commit 989060478ae270885727d91c25b9b52b0f33743c)

dnsmasq: backport upstream static lease fix

2019-01-30T10:42:27Z

Backport and rebase upstream fix 18eac67 ("Fix entries in /etc/hosts disabling static leases.") Signed-off-by: Jo-Philipp Wich

wireguard: bump to 0.0.20190123

2019-01-30T09:55:22Z

* tools: curve25519: handle unaligned loads/stores safely This should fix sporadic crashes with `wg pubkey` on certain architectures. * netlink: auth socket changes against namespace of socket In WireGuard, the underlying UDP socket lives in the namespace where the interface was created and doesn't move if the interface is moved. This allows one to create the interface in some privileged place that has Internet access, and then move it into a container namespace that only has the WireGuard interface for egress. Consider the following situation: 1. Interface created in namespace A. Socket therefore lives in namespace A. 2. Interface moved to namespace B. Socket remains in namespace A. 3. Namespace B now has access to the interface and changes the listen port and/or fwmark of socket. Change is reflected in namespace A. This behavior is arguably _fine_ and perhaps even expected or acceptable. But there's also an argument to be made that B should have A's cred to do so. So, this patch adds a simple ns_capable check. * ratelimiter: build tests with !IPV6 Should reenable building in debug mode for systems without IPv6. * noise: replace getnstimeofday64 with ktime_get_real_ts64 * ratelimiter: totalram_pages is now a function * qemu: enable FP on MIPS Linux 5.0 support. * keygen-html: bring back pure javascript implementation Benoît Viguier has proofs that values will stay well within 2^53. We also have an improved carry function that's much simpler. Probably more constant time than emscripten's 64-bit integers. * contrib: introduce simple highlighter library This is the highlighter library being used in: - https://twitter.com/EdgeSecurity/status/1085294681003454465 - https://twitter.com/EdgeSecurity/status/1081953278248796165 It's included here as a contrib example, so that others can paste it into their own GUI clients for having the same strictly validating highlighting. * netlink: use __kernel_timespec for handshake time This readies us for Y2038. See https://lwn.net/Articles/776435/ for more info. Signed-off-by: Jason A. Donenfeld (cherry picked from commit bbcd0634f8c9769a336386f8df471231d24a27cc)

wireguard: Update to snapshot 0.0.20181218

2019-01-30T09:55:18Z

Update WireGuard to 0.0.20181218 Signed-off-by: Daniel Engberg (cherry picked from commit 9a37c95431b5401c309b7731920daa964842bdee)

mbedtls: update to 2.14.1 for 18.06

2019-01-30T09:16:19Z

Updates mbedtls to 2.14.1. This builds on the previous master commit 7849f74117ce83e4cfcd1448a22cc05dbf9b3486. Fixes in 2.13.0: * Fixed a security issue in the X.509 module which could lead to a buffer overread during certificate extensions parsing. * Several bugfixes. * Improvements for better support for DTLS on low-bandwidth, high latency networks with high packet loss. Fixes in 2.14.1: * CVE-2018-19608: Local timing attack on RSA decryption Includes master commit 9e7c4702a1f4e49113d10bc736f50e8a06bdb8ba 'mbedtls: fix compilation on ARM < 6'. Signed-off-by: Daniel Engberg [Update to 2.14.1] Signed-off-by: Hauke Mehrtens [Adapted and squashed for 18.06.1+] Signed-off-by: Stijn Segers Acked-by: Hauke Mehrtens

uhttpd: disable concurrent requests by default

2019-01-30T09:13:30Z

In order to avoid straining CPU and memory resources on lower end devices, avoid running multiple CGI requests in parallel. Ref: https://forum.openwrt.org/t/high-load-fix-on-openwrt-luci/29006 Signed-off-by: Jo-Philipp Wich (cherry picked from commit c6aa9ff38870a30dbe6da17e4edad6039fe10ddf)

uboot-fritz4040: fix crash caused by interaction with gcc 7.1+

2019-01-26T18:40:23Z

David Bauer reported a u-boot crash (data abort) at a odd place (byteswap) when he ran ping/tftp on his 7530. |(FRITZ7530) # ping 192.168.1.70 |eth0 PHY0 up Speed :1000 Full duplex |eth0 PHY1 Down Speed :10 Half duplex |eth0 PHY2 Down Speed :10 Half duplex |eth0 PHY3 Down Speed :10 Half duplex |eth0 PHY4 Down Speed :10 Half duplex |Using eth0 device |data abort |pc : [<84234774>] lr : [<842351a4>] |sp : 8412fdb0 ip : 0000009b fp : 00000000 |r10: 00000000 r9 : 00000001 r8 : 8412ff68 |r7 : 00000000 r6 : 0000002a r5 : 84244e90 r4 : 8425e28e |r3 : 84244e90 r2 : 14000045 r1 : 8412fdb0 r0 : 8425e28e |Flags: nZCv IRQs off FIQs off Mode SVC_32 |Resetting CPU ... | |resetting ... This issue is caused by switch from gcc 5.5 to 7.1+ as explained in the upstream patch: |From a768e513b07b5999a8e7d7740ac8d9da04ee7e51 Mon Sep 17 00:00:00 2001 |From: Denis Pynkin |Date: Fri, 21 Jul 2017 19:28:42 +0300 |Subject: [PATCH] net: Use packed structures for networking | |PXE boot is broken with GCC 7.1 due option '-fstore-merging' enabled |by default for '-O2': | |BOOTP broadcast 1 |data abort |pc : [<8ff8bb30>] lr : [<00004f1f>] |reloc pc : [<17832b30>] lr : [<878abf1f>] |sp : 8f558bc0 ip : 00000000 fp : 8ffef5a4 |r10: 8ffed248 r9 : 8f558ee0 r8 : 8ffef594 |r7 : 0000000e r6 : 8ffed700 r5 : 00000000 r4 : 8ffed74e |r3 : 00060101 r2 : 8ffed230 r1 : 8ffed706 r0 : 00000ddd |Flags: nzcv IRQs off FIQs off Mode S | |Core reason is usage of structures for network headers without packed |attribute. This patch just backports the upstream change to the uboot-fritz4040 package. Reported-by: David Bauer Signed-off-by: Christian Lamparter