From 21eeb45420cf12c6df9b39b619f6579b3ec32bb4 Mon Sep 17 00:00:00 2001 From: Arayuki Mago Date: Tue, 13 Feb 2024 19:08:50 +0900 Subject: [PATCH 1/5] ds-lite: Add support for IPIP6(RFC2473) tunnel Add Generic Packet Tunneling in IPv6 Specification (RFC 2473) support. Signed-off-by: Arayuki Mago Signed-off-by: Chuanhong Guo --- package/network/ipv6/ds-lite/Makefile | 6 +- package/network/ipv6/ds-lite/files/dslite.sh | 69 +++++++++++++++----- 2 files changed, 54 insertions(+), 21 deletions(-) diff --git a/package/network/ipv6/ds-lite/Makefile b/package/network/ipv6/ds-lite/Makefile index 502da366a9..37c3449ab2 100644 --- a/package/network/ipv6/ds-lite/Makefile +++ b/package/network/ipv6/ds-lite/Makefile @@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=ds-lite -PKG_RELEASE:=8 +PKG_RELEASE:=9 PKG_LICENSE:=GPL-2.0 include $(INCLUDE_DIR)/package.mk @@ -17,13 +17,13 @@ define Package/ds-lite SECTION:=net CATEGORY:=Network DEPENDS:=@IPV6 +kmod-ip6-tunnel +resolveip - TITLE:=Dual-Stack Lite (DS-Lite) configuration support + TITLE:=IPv4 over IPv6 (RFC2473 and DS-Lite) configuration support MAINTAINER:=Steven Barth PKGARCH:=all endef define Package/ds-lite/description -Provides support for Dual-Stack Lite in /etc/config/network. +Provides support for IPv4 over IPv6 (RFC2473 and DS-Lite) in /etc/config/network. Refer to http://wiki.openwrt.org/doc/uci/network for configuration details. endef diff --git a/package/network/ipv6/ds-lite/files/dslite.sh b/package/network/ipv6/ds-lite/files/dslite.sh index 017963926d..325401b98b 100644 --- a/package/network/ipv6/ds-lite/files/dslite.sh +++ b/package/network/ipv6/ds-lite/files/dslite.sh @@ -1,6 +1,9 @@ #!/bin/sh -# dslite.sh - IPv4-in-IPv6 tunnel backend +# dslite.sh - IPv4-in-IPv6 tunnel backend for ipip6 and ds-lite # Copyright (c) 2013 OpenWrt.org +# Copyright (c) 2013 Steven Barth +# Copyright (c) 2021 Kenji Uno +# Copyright (c) 2024 Arayuki Mago [ -n "$INCLUDE_ONLY" ] || { . /lib/functions.sh @@ -9,10 +12,13 @@ init_proto "$@" } -proto_dslite_setup() { +tnl_setup() { local cfg="$1" local iface="$2" - local link="ds-$cfg" + local tnl_type="$3" + local ip4addr="$4" + local ip4gateway="$5" + local link="$tnl_type-$cfg" local remoteip6 local mtu ttl peeraddr ip6addr tunlink zone weakif encaplimit @@ -59,7 +65,7 @@ proto_dslite_setup() { proto_init_update "$link" 1 proto_add_ipv4_route "0.0.0.0" 0 - proto_add_ipv4_address "192.0.0.2" "" "" "192.0.0.1" + proto_add_ipv4_address "$ip4addr" "" "" "$ip4gateway" proto_add_tunnel json_add_string mode ipip6 @@ -76,23 +82,22 @@ proto_dslite_setup() { proto_add_data [ -n "$zone" ] && json_add_string zone "$zone" - json_add_array firewall - json_add_object "" - json_add_string type nat - json_add_string target ACCEPT - json_close_object - json_close_array + if [ "$tnl_type" = "ds" ]; then + json_add_array firewall + json_add_object "" + json_add_string type nat + json_add_string target ACCEPT + json_close_object + json_close_array + fi + proto_close_data proto_send_update "$cfg" } -proto_dslite_teardown() { - local cfg="$1" -} - -proto_dslite_init_config() { - no_device=1 +init_config() { + no_device=1 available=1 proto_config_add_string "ip6addr" @@ -105,6 +110,34 @@ proto_dslite_init_config() { proto_config_add_string "weakif" } -[ -n "$INCLUDE_ONLY" ] || { - add_protocol dslite +proto_ipip6_init_config() { + init_config + proto_config_add_string "ip4ifaddr" +} + +proto_ipip6_setup() { + local ip4ifaddr + json_get_vars ip4ifaddr + tnl_setup "$1" "$2" "ipip6" "$ip4ifaddr" "0.0.0.0" +} + +proto_ipip6_teardown() { + local cfg="$1" +} + +proto_dslite_init_config() { + init_config +} + +proto_dslite_setup() { + tnl_setup "$1" "$2" "ds" "192.0.0.2" "192.0.0.1" +} + +proto_dslite_teardown() { + local cfg="$1" +} + +[ -n "$INCLUDE_ONLY" ] || { + add_protocol ipip6 + add_protocol dslite } From 7d1145ecb97b9c7f852714c7938771d80b2df4e8 Mon Sep 17 00:00:00 2001 From: Weijie Gao Date: Fri, 15 Mar 2024 23:13:55 +0800 Subject: [PATCH 2/5] mediatek: fix build failure of mt7623/mt7629 using kernel 6.6 In kernel 6.6, dts files for mediatek arm target are moved into arch/arm/boot/dts/mediatek instead of legacy path arch/arm/boot/dts. To avoid dts compile failure, change DTS_DIR to the mediatek subfolder for kernel 6.6. Signed-off-by: Weijie Gao --- target/linux/mediatek/image/mt7623.mk | 4 ++++ target/linux/mediatek/image/mt7629.mk | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/target/linux/mediatek/image/mt7623.mk b/target/linux/mediatek/image/mt7623.mk index 24663551e0..93625c405b 100644 --- a/target/linux/mediatek/image/mt7623.mk +++ b/target/linux/mediatek/image/mt7623.mk @@ -1,3 +1,7 @@ +ifneq ($(KERNEL),6.1) +DTS_DIR := $(DTS_DIR)/mediatek +endif + DEVICE_VARS += UBOOT_TARGET UBOOT_OFFSET UBOOT_IMAGE # The bootrom of MT7623 expects legacy MediaTek headers present in diff --git a/target/linux/mediatek/image/mt7629.mk b/target/linux/mediatek/image/mt7629.mk index 9374228808..9f0ea98950 100644 --- a/target/linux/mediatek/image/mt7629.mk +++ b/target/linux/mediatek/image/mt7629.mk @@ -1,3 +1,7 @@ +ifneq ($(KERNEL),6.1) +DTS_DIR := $(DTS_DIR)/mediatek +endif + define Device/mediatek_mt7629-rfb DEVICE_VENDOR := MediaTek DEVICE_MODEL := MT7629 rfb AP From fc9bde82f34eb81f9f639f9da8dd7369651d871b Mon Sep 17 00:00:00 2001 From: Chukun Pan Date: Tue, 16 Jan 2024 23:19:02 +0800 Subject: [PATCH 3/5] mediatek: mt7622: simplify 02_network Most mt7622 devices use the mt7531 switch, which have been switched to dsa driver for a long time. So use dsa as the default configuration and configure these rtl8367s devices separately. This reduces the amount of code. Signed-off-by: Chukun Pan --- .../mt7622/base-files/etc/board.d/02_network | 21 ++++++------------- 1 file changed, 6 insertions(+), 15 deletions(-) diff --git a/target/linux/mediatek/mt7622/base-files/etc/board.d/02_network b/target/linux/mediatek/mt7622/base-files/etc/board.d/02_network index 6c43e46222..6bda6e11f3 100644 --- a/target/linux/mediatek/mt7622/base-files/etc/board.d/02_network +++ b/target/linux/mediatek/mt7622/base-files/etc/board.d/02_network @@ -8,19 +8,6 @@ mediatek_setup_interfaces() local board="$1" case $board in - bananapi,bpi-r64|\ - buffalo,wsr-3200ax4s|\ - dlink,eagle-pro-ai-r32-a1|\ - elecom,wrc-x3200gst3|\ - linksys,e8450|\ - linksys,e8450-ubi|\ - mediatek,mt7622-rfb1|\ - mediatek,mt7622-rfb1-ubi|\ - netgear,wax206|\ - reyee,ax3200-e5|\ - ruijie,rg-ew3200gx-pro) - ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" wan - ;; buffalo,wsr-2533dhp2) ucidef_add_switch "switch0" \ "0:lan" "1:lan" "2:lan" "3:lan" "4:wan" "6@eth0" @@ -28,6 +15,11 @@ mediatek_setup_interfaces() dlink,eagle-pro-ai-m32-a1) ucidef_set_interfaces_lan_wan "lan1 lan2" wan ;; + elecom,wrc-2533gent|\ + totolink,a8000ru) + ucidef_add_switch "switch0" \ + "0:lan" "1:lan" "2:lan" "3:lan" "4:wan" "6u@eth0" "5u@eth1" + ;; ubnt,unifi-6-lr*) ucidef_set_interface_lan "eth0" ;; @@ -35,8 +27,7 @@ mediatek_setup_interfaces() ucidef_set_interfaces_lan_wan "lan1 lan2 lan3" wan ;; *) - ucidef_add_switch "switch0" \ - "0:lan" "1:lan" "2:lan" "3:lan" "4:wan" "6u@eth0" "5u@eth1" + ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" wan ;; esac } From 503d26fb24cf980ed6d28cb080b0f81e8ba4e72d Mon Sep 17 00:00:00 2001 From: Qingfang Deng Date: Wed, 13 Mar 2024 11:48:44 +0800 Subject: [PATCH 4/5] kernel: xt_FLOWOFFLOAD: fix use of uninitialized dir variable The dir variable has been used uninitialized since the port to 5.10, and somehow this remains undetected by GCC. Fixes: b10d6044599d ("kernel: add linux 5.10 support") Signed-off-by: Qingfang Deng --- .../hack-5.15/650-netfilter-add-xt_FLOWOFFLOAD-target.patch | 4 ++-- .../hack-6.1/650-netfilter-add-xt_FLOWOFFLOAD-target.patch | 4 ++-- .../hack-6.6/650-netfilter-add-xt_FLOWOFFLOAD-target.patch | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/target/linux/generic/hack-5.15/650-netfilter-add-xt_FLOWOFFLOAD-target.patch b/target/linux/generic/hack-5.15/650-netfilter-add-xt_FLOWOFFLOAD-target.patch index da60334498..ec887539d5 100644 --- a/target/linux/generic/hack-5.15/650-netfilter-add-xt_FLOWOFFLOAD-target.patch +++ b/target/linux/generic/hack-5.15/650-netfilter-add-xt_FLOWOFFLOAD-target.patch @@ -609,6 +609,8 @@ Signed-off-by: Felix Fietkau + if (!nf_ct_is_confirmed(ct)) + return XT_CONTINUE; + ++ dir = CTINFO2DIR(ctinfo); ++ + devs[dir] = xt_out(par); + devs[!dir] = xt_in(par); + @@ -618,8 +620,6 @@ Signed-off-by: Felix Fietkau + if (test_and_set_bit(IPS_OFFLOAD_BIT, &ct->status)) + return XT_CONTINUE; + -+ dir = CTINFO2DIR(ctinfo); -+ + if (xt_flowoffload_route(skb, ct, par, &route, dir, devs) < 0) + goto err_flow_route; + diff --git a/target/linux/generic/hack-6.1/650-netfilter-add-xt_FLOWOFFLOAD-target.patch b/target/linux/generic/hack-6.1/650-netfilter-add-xt_FLOWOFFLOAD-target.patch index 59a5fb4d91..1dfd556ce8 100644 --- a/target/linux/generic/hack-6.1/650-netfilter-add-xt_FLOWOFFLOAD-target.patch +++ b/target/linux/generic/hack-6.1/650-netfilter-add-xt_FLOWOFFLOAD-target.patch @@ -547,6 +547,8 @@ Signed-off-by: Felix Fietkau + if (!nf_ct_is_confirmed(ct)) + return XT_CONTINUE; + ++ dir = CTINFO2DIR(ctinfo); ++ + devs[dir] = xt_out(par); + devs[!dir] = xt_in(par); + @@ -556,8 +558,6 @@ Signed-off-by: Felix Fietkau + if (test_and_set_bit(IPS_OFFLOAD_BIT, &ct->status)) + return XT_CONTINUE; + -+ dir = CTINFO2DIR(ctinfo); -+ + if (xt_flowoffload_route(skb, ct, par, &route, dir, devs) < 0) + goto err_flow_route; + diff --git a/target/linux/generic/hack-6.6/650-netfilter-add-xt_FLOWOFFLOAD-target.patch b/target/linux/generic/hack-6.6/650-netfilter-add-xt_FLOWOFFLOAD-target.patch index cb7ac007b1..1c75a2cf3d 100644 --- a/target/linux/generic/hack-6.6/650-netfilter-add-xt_FLOWOFFLOAD-target.patch +++ b/target/linux/generic/hack-6.6/650-netfilter-add-xt_FLOWOFFLOAD-target.patch @@ -547,6 +547,8 @@ Signed-off-by: Felix Fietkau + if (!nf_ct_is_confirmed(ct)) + return XT_CONTINUE; + ++ dir = CTINFO2DIR(ctinfo); ++ + devs[dir] = xt_out(par); + devs[!dir] = xt_in(par); + @@ -556,8 +558,6 @@ Signed-off-by: Felix Fietkau + if (test_and_set_bit(IPS_OFFLOAD_BIT, &ct->status)) + return XT_CONTINUE; + -+ dir = CTINFO2DIR(ctinfo); -+ + if (xt_flowoffload_route(skb, ct, par, &route, dir, devs) < 0) + goto err_flow_route; + From dea42f67ab06a8f2c1e6338f9829d31a28642317 Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Sat, 16 Mar 2024 08:50:05 +0100 Subject: [PATCH 5/5] mac80211: fix a crash triggered by sta disconnect with per-sta VLANs Reported-by: ranygh@riseup.net Signed-off-by: Felix Fietkau --- ...eck-clear-fast-rx-for-non-4addr-sta-.patch | 35 +++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 package/kernel/mac80211/patches/subsys/332-wifi-mac80211-check-clear-fast-rx-for-non-4addr-sta-.patch diff --git a/package/kernel/mac80211/patches/subsys/332-wifi-mac80211-check-clear-fast-rx-for-non-4addr-sta-.patch b/package/kernel/mac80211/patches/subsys/332-wifi-mac80211-check-clear-fast-rx-for-non-4addr-sta-.patch new file mode 100644 index 0000000000..02b4345f21 --- /dev/null +++ b/package/kernel/mac80211/patches/subsys/332-wifi-mac80211-check-clear-fast-rx-for-non-4addr-sta-.patch @@ -0,0 +1,35 @@ +From: Felix Fietkau +Date: Sat, 16 Mar 2024 08:37:21 +0100 +Subject: [PATCH] wifi: mac80211: check/clear fast rx for non-4addr sta VLAN + changes + +When moving a station out of a VLAN and deleting the VLAN afterwards, the +fast_rx entry still holds a pointer to the VLAN's netdev, which can cause +use-after-free bugs. Fix this by immediately calling ieee80211_check_fast_rx +after the VLAN change. + +Cc: stable@vger.kernel.org +Reported-by: ranygh@riseup.net +Signed-off-by: Felix Fietkau +--- + +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -2184,15 +2184,14 @@ static int ieee80211_change_station(stru + } + + if (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && +- sta->sdata->u.vlan.sta) { +- ieee80211_clear_fast_rx(sta); ++ sta->sdata->u.vlan.sta) + RCU_INIT_POINTER(sta->sdata->u.vlan.sta, NULL); +- } + + if (test_sta_flag(sta, WLAN_STA_AUTHORIZED)) + ieee80211_vif_dec_num_mcast(sta->sdata); + + sta->sdata = vlansdata; ++ ieee80211_check_fast_rx(sta); + ieee80211_check_fast_xmit(sta); + + if (test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {