openwrt, branch v22.03.5

OpenWrt v22.03.5: adjust config defaults

2023-04-27T21:05:23Z

Signed-off-by: Hauke Mehrtens

ramips: reduce Archer AX23 / MR70X SPI-frequency

2023-04-27T20:28:15Z

It was brought to attention the Archer AX23 v1 fails to read jffs2 data from time to time. While this is not reproducible on my unit, it is on others. Reducing the SPI frequency does the trick. While it worked with at lest 40 MHz, opt for the cautious side and choose a save frequency of 25 MHz. Apply the same treatment to the Mercusys MR70X which uses a similar design just in case. Signed-off-by: David Bauer (cherry picked from commit 2c530fcb972c112e7a2b10f9c21ac6d276624b5e)

ccache: update to 4.6.3

2023-04-27T19:02:10Z

Release Notes: https://ccache.dev/releasenotes.html#_ccache_4_6_3 Refresh patch: - 100-honour-copts.patch Signed-off-by: Nick Hainke (cherry picked from commit 83ea2e11b4b7872642bc7ac587361ccd783308f2)

tools/ccache: update to 4.6.2

2023-04-27T18:57:58Z

Release notes: https://ccache.dev/releasenotes.html#_ccache_4_6_2 Signed-off-by: Nick Hainke (cherry picked from commit ac61cf596cc4cdfb93981361b093c1d97e4a1b96)

tools/ccache: update to 4.6.1

2023-04-27T18:52:55Z

Release notes: https://ccache.dev/releasenotes.html#_ccache_4_6_1 Signed-off-by: Nick Hainke (cherry picked from commit 2e87e24e43c49565e23643eb6eceef8455434647)

ramips: fix lzma-loader for buffalo_WSR_600DHP

2023-04-23T12:15:54Z

This fixes a well known "LZMA ERROR 1" error, reported previously on numerous of similar devices. Fixes: #11919 Signed-off-by: Haoan Li (cherry picked from commit c7b484f3647c58da2f86395228a9927290a6f6ed)

ath79: create Aruba AP-105 APBoot compatible image

2023-04-18T10:08:45Z

Alter the Aruba AP-105 image generation process so OpenWrt can be loaded with the vendor Aruba APBoot. This works by prepending the OpenWrt LZMA loader to the uImage and jumping directly to the loader. Aruba does not offer bootm on these boards. This approach keeps compatibility to devices which had their U-Boot replaced. Both bootloaders can boot the same image. The same modification is most likely also possible for the Aruba AP-175. With this patch, new installations do not require replacing the bootloader and can be performed from the serial console without opening the case. Installation ------------ 1. Attach to the serial console of the AP-105. Interrupt autoboot and change the U-Boot env. $ setenv apb_rb_openwrt "setenv ipaddr 192.168.1.1; setenv serverip 192.168.1.66; netget 0x84000000 ap105.bin; go 0x84000040" $ setenv apb_fb_openwrt "cp.b 0xbf040000 0x84000000 0x10000; go 0x84000040" $ setenv bootcmd "run apb_fb_openwrt" $ saveenv 2. Load the OpenWrt initramfs image on the device using TFTP. Place the initramfs image as "ap105.bin" in the TFTP server root directory, connect it to the AP and make the server reachable at 192.168.1.66/24. $ run apb_rb_openwrt 3. Once OpenWrt booted, transfer the sysupgrade image to the device using scp and use sysupgrade to install the firmware. Signed-off-by: David Bauer (cherry picked from commit e11d00d44c66b1534fbc399fda55951cd0a2168a)

openssl: fix CVE-2023-464 and CVE-2023-465

2023-04-17T15:05:29Z

Apply two patches fixing low-severity vulnerabilities related to certificate policies validation: - Excessive Resource Usage Verifying X.509 Policy Constraints (CVE-2023-0464) Severity: Low A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. - Invalid certificate policies in leaf certificates are silently ignored (CVE-2023-0465) Severity: Low Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. Note: OpenSSL also released a fix for low-severity security advisory CVE-2023-466. It is not included here because the fix only changes the documentation, which is not built nor included in any OpenWrt package. Due to the low-severity of these issues, there will be not be an immediate new release of OpenSSL. Signed-off-by: Eneas U de Queiroz

kernel: backport fix for recently introduced UBI bug

2023-04-15T02:32:41Z

Import commit "ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size" which did not yet make it to stable upstream Linux trees. Fixes: #12232 Fixes: #12339 Signed-off-by: Daniel Golle (cherry picked from commit aad34818b50029e07ed9221ae46f9770d6e29785)

uclient: update to Git version 2023-04-13

2023-04-13T18:54:06Z

007d94546749 uclient: cancel state change timeout in uclient_disconnect() 644d3c7e13c6 ci: improve wolfSSL test coverage dc54d2b544a1 tests: add certificate check against letsencrypt.org Signed-off-by: Matthias Schiffer (cherry picked from commit 4f1c2e8deef10e9ca34ceff5a096e62aaa668e90)