Merge pull request #2670 from blocktrron/v2022.1.1-rn

[Backport v2022.1.x] ramips-mt7621: add support for ZyXEL NWA50AX

README.md

@@ -30,7 +30,7 @@ the future development of Gluon.
 
 Please refrain from using the `master` branch for anything else but development purposes!
 Use the most recent release instead. You can list all releases by running `git tag`
-and switch to one by running `git checkout v2022.1 && make update`.
+and switch to one by running `git checkout v2022.1.1 && make update`.
 
 If you're using the autoupdater, do not autoupdate nodes with anything but releases.
 If you upgrade using random master commits the nodes *might break* eventually.

docs/conf.py

@@ -24,7 +24,7 @@ copyright = '2015-2022, Project Gluon'
 author = 'Project Gluon'
 
 # The short X.Y version
-version = '2022.1'
+version = '2022.1.1'
 # The full version, including alpha/beta/rc tags
 release = version
 

docs/releases/index.rst

@@ -5,6 +5,7 @@ Release Notes
    :caption: Gluon 2022.1
    :maxdepth: 2
 
+   v2022.1.1
    v2022.1
 
 .. toctree::

docs/releases/v2022.1.1.rst

@@ -0,0 +1,84 @@
+Gluon 2022.1.1
+==============
+
+Important notes
+---------------
+
+This release mitigates multiple flaws in the Linux wireless stack fixing RCE and DoS vulnerabilities.
+
+
+Added hardware support
+----------------------
+
+ipq40xx-generic
+~~~~~~~~~~~~~~~
+
+- GL.iNet
+
+  - GL-AP1300
+
+mpc85xx-p1010
+~~~~~~~~~~~~~
+
+- TP-Link
+
+  - TL-WDR4900 (v1)
+
+ramips-mt7621
+~~~~~~~~~~~~~
+
+- ZyXEL
+
+  - NWA50AX
+
+rockchip-armv8
+~~~~~~~~~~~~~~
+
+-  FriendlyElec
+
+   -  NanoPi R4S (4GB LPDDR4)
+
+Bugfixes
+--------
+
+ * Multiple mitigations for (`critical vulnerabilities <https://seclists.org/oss-sec/2022/q4/20>`_) in the Linux kernel WLAN stack. This only concerns Gluon v2022.1, older Gluon versions are unaffected.
+
+   * CVE-2022-41674
+   * CVE-2022-42719
+   * CVE-2022-42720
+   * CVE-2022-42721
+   * CVE-2022-42722
+ * Fixes `security issues in WolfSSL <https://openwrt.org/releases/22.03/notes-22.03.1#security_fixes>`_. People who have installed additional, non-Gluon packages which rely on WolfSSL's TLS 1.3 implementation might be affected. Firmwares using either gluon-mesh-wireless-sae or gluon-wireless-encryption-wpa3 are unaffected by these issues, since only WPA-Enterprise relies on the affected TLS functionality.
+
+   * CVE-2022-38152
+   * CVE-2022-39173
+
+ * Fixes the update path for GL-AR300M and NanoStation Loco M2/M5 (XW) devices.
+
+Known issues
+------------
+
+* A workaround for Android devices not waking up to their MLD subscriptions was removed,
+  potentially breaking IPv6 connectivity for these devices after extended sleep periods
+
+* Upgrading EdgeRouter-X from versions before v2020.1.x may lead to a soft-bricked state due to bad blocks on the NAND flash which the NAND driver before this release does not handle well.
+  (`#1937 <https://github.com/freifunk-gluon/gluon/issues/1937>`_)
+
+* The integration of the BATMAN_V routing algorithm is incomplete.
+
+  - Mesh neighbors don't appear on the status page. (`#1726 <https://github.com/freifunk-gluon/gluon/issues/1726>`_)
+    Many tools have the BATMAN_IV metric hardcoded, these need to be updated to account for the new throughput
+    metric.
+  - Throughput values are not correctly acquired for different interface types.
+    (`#1728 <https://github.com/freifunk-gluon/gluon/issues/1728>`_)
+    This affects virtual interface types like bridges and VXLAN.
+
+* Default TX power on many Ubiquiti devices is too high, correct offsets are unknown
+  (`#94 <https://github.com/freifunk-gluon/gluon/issues/94>`_)
+
+  Reducing the TX power in the Advanced Settings is recommended.
+
+* In configurations without VXLAN, the MAC address of the WAN interface is modified even when Mesh-on-WAN is disabled
+  (`#496 <https://github.com/freifunk-gluon/gluon/issues/496>`_)
+
+  This may lead to issues in environments where a fixed MAC address is expected (like VMware when promiscuous mode is disallowed).

docs/site-example/site.conf

@@ -1,4 +1,4 @@
--- This is an example site configuration for Gluon v2022.1
+-- This is an example site configuration for Gluon v2022.1.1
 --
 -- Take a look at the documentation located at
 -- https://gluon.readthedocs.io/ for details.

docs/user/getting_started.rst

@@ -8,7 +8,7 @@ Gluon's releases are managed using `Git tags`_. If you are just getting
 started with Gluon we recommend to use the latest stable release of Gluon.
 
 Take a look at the `list of gluon releases`_ and notice the latest release,
-e.g. *v2022.1*. Always get Gluon using git and don't try to download it
+e.g. *v2022.1.1*. Always get Gluon using git and don't try to download it
 as a Zip archive as the archive will be missing version information.
 
 Please keep in mind that there is no "default Gluon" build; a site configuration
@@ -50,7 +50,7 @@ Building the images
 -------------------
 
 To build Gluon, first check out the repository. Replace *RELEASE* with the
-version you'd like to checkout, e.g. *v2022.1*.
+version you'd like to checkout, e.g. *v2022.1.1*.
 
 ::
 

docs/user/supported_devices.rst

@@ -185,6 +185,7 @@ ipq40xx-generic
 
 * GL.iNet
 
+  - GL-AP1300
   - GL-B1300
 
 * Linksys
@@ -269,6 +270,10 @@ mpc85xx-p1010
 
   - RED 15w Rev.1
 
+* TP-Link
+
+  - TL-WDR4900 (v1)
+
 mpc85xx-p1020
 ---------------
 
@@ -360,6 +365,10 @@ ramips-mt7621
   - WG3526-16M
   - WG3526-32M
 
+* ZyXEL
+
+  - NWA50AX
+
 * Xiaomi
 
   - Xiaomi Mi Router 4A (Gigabit Edition)
@@ -416,6 +425,7 @@ rockchip-armv8
 * FriendlyElec
 
   - NanoPi R2S
+  - NanoPi R4S (4GB LPDDR4)
 
 sunxi-cortexa7
 --------------

modules

@@ -2,15 +2,15 @@ GLUON_FEEDS='packages routing gluon'
 
 OPENWRT_REPO=https://github.com/openwrt/openwrt.git
 OPENWRT_BRANCH=openwrt-22.03
-OPENWRT_COMMIT=d1f14d17aaa1866eee1fe2d0d074b2a003c2a210
+OPENWRT_COMMIT=a7fb589e8a9df06bd0e36c91d05806f1e8aeb9e8
 
 PACKAGES_PACKAGES_REPO=https://github.com/openwrt/packages.git
 PACKAGES_PACKAGES_BRANCH=openwrt-22.03
-PACKAGES_PACKAGES_COMMIT=bcafba4320e5942f2ca8c1ad63b3a8a84ca0c3d1
+PACKAGES_PACKAGES_COMMIT=dba8a0102e5965cad58a871335002e9c964b6719
 
 PACKAGES_ROUTING_REPO=https://github.com/openwrt/routing.git
 PACKAGES_ROUTING_BRANCH=openwrt-22.03
-PACKAGES_ROUTING_COMMIT=8872359011eee64981804f7ed42d5d6b54add6d8
+PACKAGES_ROUTING_COMMIT=85028704f688a6768d3f10d5d3c10a799a121e0d
 
 PACKAGES_GLUON_REPO=https://github.com/freifunk-gluon/packages.git
 PACKAGES_GLUON_COMMIT=04d2b6ffbb6ee02012f2733b7752d8db0d12eaff

package/gluon-core/luasrc/lib/gluon/upgrade/010-primary-mac

@@ -102,6 +102,7 @@ local primary_addrs = {
 		}},
 		{'rockchip', 'armv8', {
 			'friendlyarm,nanopi-r2s',
+			'friendlyarm,nanopi-r4s',
 		}},
 		{'x86'},
 	}},

patches/openwrt/0004-ramips-mt7621-make-DSA-images-swconfig-upgradable.patch

@@ -3,10 +3,10 @@ Date: Sun, 5 Jun 2022 23:43:38 +0200
 Subject: ramips-mt7621: make DSA images swconfig upgradable
 
 diff --git a/target/linux/ramips/image/mt7621.mk b/target/linux/ramips/image/mt7621.mk
-index 7f903485aa9e3055ae0bb490bb8e6d5aab565b45..5b502710b7959825bc2e079d0ffcbbe9c1b063ae 100644
+index a3bdacb32a1657c15cba29512466b34a97af2e9a..b5ca3438de9fe20112110e653b016f13cb7f55ea 100644
 --- a/target/linux/ramips/image/mt7621.mk
 +++ b/target/linux/ramips/image/mt7621.mk
-@@ -172,7 +172,6 @@ endef
+@@ -179,7 +179,6 @@ endef
  TARGET_DEVICES += asiarf_ap7621-nv1
  
  define Device/asus_rt-ac57u
@@ -14,7 +14,7 @@ index 7f903485aa9e3055ae0bb490bb8e6d5aab565b45..5b502710b7959825bc2e079d0ffcbbe9
    DEVICE_VENDOR := ASUS
    DEVICE_MODEL := RT-AC57U
    DEVICE_ALT0_VENDOR := ASUS
-@@ -418,7 +417,6 @@ endef
+@@ -425,7 +424,6 @@ endef
  TARGET_DEVICES += dlink_dir-853-r1
  
  define Device/dlink_dir-860l-b1
@@ -22,7 +22,7 @@ index 7f903485aa9e3055ae0bb490bb8e6d5aab565b45..5b502710b7959825bc2e079d0ffcbbe9
    $(Device/seama)
    SEAMA_SIGNATURE := wrgac13_dlink.2013gui_dir860lb
    LOADER_TYPE := bin
-@@ -1226,7 +1224,6 @@ endef
+@@ -1234,7 +1232,6 @@ endef
  TARGET_DEVICES += mts_wg430223
  
  define Device/netgear_ex6150
@@ -30,7 +30,7 @@ index 7f903485aa9e3055ae0bb490bb8e6d5aab565b45..5b502710b7959825bc2e079d0ffcbbe9
    DEVICE_VENDOR := NETGEAR
    DEVICE_MODEL := EX6150
    DEVICE_PACKAGES := kmod-mt76x2
-@@ -1238,7 +1235,6 @@ endef
+@@ -1246,7 +1243,6 @@ endef
  TARGET_DEVICES += netgear_ex6150
  
  define Device/netgear_sercomm_nand
@@ -38,7 +38,7 @@ index 7f903485aa9e3055ae0bb490bb8e6d5aab565b45..5b502710b7959825bc2e079d0ffcbbe9
    $(Device/uimage-lzma-loader)
    BLOCKSIZE := 128k
    PAGESIZE := 2048
-@@ -1421,7 +1417,6 @@ endef
+@@ -1429,7 +1425,6 @@ endef
  TARGET_DEVICES += netgear_wax202
  
  define Device/netgear_wndr3700-v5
@@ -46,7 +46,7 @@ index 7f903485aa9e3055ae0bb490bb8e6d5aab565b45..5b502710b7959825bc2e079d0ffcbbe9
    $(Device/netgear_sercomm_nor)
    $(Device/uimage-lzma-loader)
    IMAGE_SIZE := 15232k
-@@ -1745,7 +1740,6 @@ endef
+@@ -1753,7 +1748,6 @@ endef
  TARGET_DEVICES += tplink_tl-wpa8631p-v3
  
  define Device/ubnt_edgerouter_common
@@ -54,7 +54,7 @@ index 7f903485aa9e3055ae0bb490bb8e6d5aab565b45..5b502710b7959825bc2e079d0ffcbbe9
    $(Device/uimage-lzma-loader)
    DEVICE_VENDOR := Ubiquiti
    IMAGE_SIZE := 256768k
-@@ -2131,7 +2125,6 @@ endef
+@@ -2150,7 +2144,6 @@ endef
  TARGET_DEVICES += zbtlink_zbt-wg2626
  
  define Device/zbtlink_zbt-wg3526-16m
@@ -62,7 +62,7 @@ index 7f903485aa9e3055ae0bb490bb8e6d5aab565b45..5b502710b7959825bc2e079d0ffcbbe9
    $(Device/uimage-lzma-loader)
    IMAGE_SIZE := 16064k
    DEVICE_VENDOR := Zbtlink
-@@ -2144,7 +2137,6 @@ endef
+@@ -2163,7 +2156,6 @@ endef
  TARGET_DEVICES += zbtlink_zbt-wg3526-16m
  
  define Device/zbtlink_zbt-wg3526-32m

targets/ath79-generic

@@ -503,6 +503,7 @@ device('tp-link-wbs510-v1', 'tplink_wbs510-v1', {
 
 device('ubiquiti-nanostation-loco-m-xw', 'ubnt_nanostation-loco-m-xw', {
 	manifest_aliases = {
+		'ubiquiti-loco-m-xw', -- upgrade from OpenWrt 19.07
 		'ubiquiti-nanostation-loco-m2-xw', -- upgrade from OpenWrt 19.07
 		'ubiquiti-nanostation-loco-m5-xw', -- upgrade from OpenWrt 19.07
 	},

targets/ath79-nand

@@ -6,11 +6,16 @@ local ATH10K_PACKAGES_QCA9887 = {
 	'-ath10k-firmware-qca9887-ct',
 }
 
+local ATH10K_PACKAGES_QCA9888 = {}
+
 
 -- GL.iNet
 
 device('gl.inet-gl-ar300m-nor', 'glinet_gl-ar300m-nor', {
 	factory = false,
+	manifest_aliases = {
+		'gl.inet-gl-ar300m', -- Upgrade from OpenWrt 19.07
+	},
 })
 
 device('gl.inet-gl-ar750s-nor', 'glinet_gl-ar750s-nor', {
@@ -27,3 +32,11 @@ device('netgear-wndr3700-v4', 'netgear_wndr3700-v4', {
 		'netgear-wndr3700v4', -- Upgrade from OpenWrt 19.07
 	},
 })
+
+
+-- ZTE
+
+device('zte-mf281', 'zte_mf281', {
+	broken = true,
+	packages = ATH10K_PACKAGES_QCA9888,
+})

targets/ipq40xx-generic

@@ -56,6 +56,13 @@ device('engenius-ens620ext', 'engenius_ens620ext', {
 
 -- GL.iNet
 
+device('gl.inet-gl-ap1300', 'glinet_gl-ap1300', {
+	factory = '-squashfs-nand-factory',
+	factory_ext = '.ubi',
+	sysupgrade = '-squashfs-nand-sysupgrade',
+	sysupgrade_ext = '.bin',
+})
+
 device('gl.inet-gl-b1300', 'glinet_gl-b1300', {
 	factory = false,
 })

targets/mpc85xx-p1010

@@ -5,3 +5,7 @@ device('sophos-red-15w-rev.1', 'sophos_red-15w-rev1', {
 })
 
 
+-- TP-Link
+
+device('tp-link-tl-wdr4900-v1', 'tplink_tl-wdr4900-v1')
+

targets/ramips-mt7621

@@ -90,6 +90,11 @@ device('zbtlink-zbt-wg3526-32m', 'zbtlink_zbt-wg3526-32m', {
 })
 
 
+-- ZyXEL
+
+device('zyxel-nwa50ax', 'zyxel_nwa50ax')
+
+
 -- Devices without WLAN
 
 -- Ubiquiti

targets/rockchip-armv8

@@ -4,3 +4,4 @@ defaults {
 }
 
 device('friendlyelec-nanopi-r2s', 'friendlyarm_nanopi-r2s')
+device('friendlyelec-nanopi-r4s', 'friendlyarm_nanopi-r4s') -- 4GB LPDDR4