- Fix multiple security issues. See http://freeradius.org/security/fuzzer-2017.html Thanks to Guido Vranken for working with us to discover the issues and test the fixes.
- FR-GV-207 Avoid zero-length malloc() in data2vp().
- FR-GV-206 correct decoding of option 60.
- FR-GV-205 check for "too long" WiMAX options.
- FR-GV-204 free VP if decoding fails, so we don't leak memory.
- FR-GV-203 fix memory leak when using decode_tlv().
- FR-GV-202 check for "too long" attributes.
- FR-GV-201 check input/output length in make_secret().
- FR-AD-001 Use strncmp() instead of memcmp() for bounded data.
- Disable in-memory TLS session caches due to OpenSSL API issues.
- Allow issuer_cert to be empty.
- Look for extensions using correct index.
- Fix types.
- Work around OpenSSL 1.0.2 problems, which cause failures in TLS-based EAP methods.
- Revert RedHat contributed bug which removes run-time checks for OpenSSL consistency.
- Allow OCSP responder URL to be later in the packet Fix by Ean Pasternak.
- Catch empty subject and non-existent issuer cert in OCSP Fix by Ean Pasternak.
- Allow non-FIPS for MD5 Fix by Ean Pasternak.
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
- Bumps version to 4.0.9. Otherwise about two dozen packages would need
to be backported. There were no ABI/API changes between 4.0.3 and
4.0.9, so this is OK.
- Adds a patch from Jow that addresses a macro issue (already in
master/lede-17.01)
- Adds patches copied from Debian for CVE-2017-18013 and CVE-2017-9935
on top.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
- Add patches copied from Debian to address open CVEs
- Update mail address of maintainer
- Fix a typo
- Add --disable-silent-rules for verbose build output
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
New upstream release includes fixes for the following security issues:
* CVE-2017-3140: With certain RPZ configurations, a response with TTL 0 could
cause named to go into an infinite query loop
* CVE-2017-3142: An error in TSIG handling could permit unauthorized zone
transfers or zone updates.
* CVE-2017-3143: An error in TSIG handling could permit unauthorized zone
transfers or zone updates.
Signed-off-by: Noah Meyerhans <frodo@morgul.net>
This change includes fixes for several security issues:
* CVE-2017-3138: rndc "" could trigger an assertion failure in named.
* CVE-2017-3137: Some chaining (i.e., type CNAME or DNAME) responses to
upstream queries could trigger assertion failures.
* CVE-2017-3136: dns64 with break-dnssec yes; can result in an assertion
failure.
* CVE-2017-3135: If a server is configured with a response policy zone
(RPZ) that rewrites an answer with local data, and is also configured
for DNS64 address mapping, a NULL pointer can be read triggering a
server crash.
* CVE-2016-9444: named could mishandle authority sections with missing
RRSIGs, triggering an assertion failure.
* CVE-2016-9131: named mishandled some responses where covering RRSIG
records were returned without the requested data, resulting in an
assertion failure.
* CVE-2016-9131: named incorrectly tried to cache TKEY records which could
trigger an assertion failure when there was a class mismatch.
* CVE-2016-8864: It was possible to trigger assertions when processing
responses containing answers of type DNAME.
* CVE-2016-6170: Added the ability to specify the maximum number of
records permitted in a zone (max-records #;). This provides a mechanism
to block overly large zone transfers, which is a potential risk with
slave zones from other parties.
* CVE-2016-2776: It was possible to trigger an assertion when rendering a
message using a specially crafted request.
* CVE-2016-2775: Calling getrrsetbyname() with a non absolute name could
trigger an infinite recursion bug in lwresd or named with lwres
configured if, when combined with a search list entry from resolv.conf,
the resulting name is too long.
Signed-off-by: Noah Meyerhans <frodo@morgul.net>
This change fixes multiple denial-of-service vulnerabilities:
* CVE-2016-9131: A malformed response to an ANY query can cause an
assertion failure during recursion
* CVE-2016-9147: An error handling a query response containing
inconsistent DNSSEC information could cause an assertion failure
* CVE-2016-9444: An unusually-formed DS record response could cause
an assertion failure
* CVE-2016-9778: An error handling certain queries using the
nxdomain-redirect feature could cause a REQUIRE assertion failure
in db.c
Signed-off-by: Noah Meyerhans <frodo@morgul.net>
If libjson-c is detected during bind-libs configure phase, bind-libs
will be built with libjson support. This results in a missing dependency
error during install phase. Solve this by disabling libjson support.
- Adds bcm43xx-3wire variant.
- Resets UART speed after firmware download.
- Prints chip name when firmware isn't found for bcm43xx.
- Increases timeout for bcm43xx.
- Moves bcm43xx firmware to lib.
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
Move bluetoothd and related programs and files from bluez-utils into
bluez-daemon package. The main motivation for this is to remove the dependency
to DBus from bluez-utils. The utilities like "hcitool" are useful without it.
Also add kmod-bluetooth dependency to bluez-utils, as the utils don't make much
sense without bluetooth support in the kernel.
Signed-off-by: Bruno Randolf <br1@einfach.org>
Copy mime.conf to temporary directory so squid process can properly read the file. Without it squid cannot access mime.conf and throws a warning during startup.
Signed-off by: Adam Gensler <openwrt@a.gnslr.us>
Update nginx to version 1.10.3.
Add new configuration options to enable the following optional
modules (disabled by default):
- http_auth_request_module
- http_v2_module
- http_realip_module
- http_secure_link_module
Signed-off-by: Val Kulkov <val.kulkov@gmail.com>
In this bump as agreed with Thomas we are dropping out all the nginx 3rd party
addons. In case you would like to see your 3rd party addon included please send
a pull request and make sure it works with newest version.
Signed-off-by: Luka Perkov <luka@openwrt.org>
This fixes the following CVEs:
- in intl: CVE-2016-7416
- in mysqlnd: CVE-2016-7412
- in phar: CVE-2016-7414
- in spl: CVE-2016-7417
- in standard: CVS-2016-7411
- in wddx: CVE-2016-7413, CVE-2016-7418
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
This fixes the following CVEs:
- in GD: CVE-2015-8874, CVE-2016-5766, CVE-2016-5767
- in mbstring: CVE-2016-5768
- in mcrypt: CVE-2016-5769
- in SPL: CVE-2016-5770, CVE-2016-5771
- in WDDX: CVE-2016-5772
- in zip: CVE-2016-5773
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
This fixes the following CVEs:
- in BCMath: CVE-2016-4537, CVE-2016-4538
- in EXIF: CVE-2016-4542, CVE-2016-4543, CVE-2016-4544
- in GD: CVE-2016-3074
- in Intl: CVE-2016-4540, CVE-2016-4541
- in XML: CVE-2016-4539
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
* Updates wifidog to latest upstream release.
* Removes patches/100-musl-compat.patch as that's included in 1.3.0
Signed-off-by: Michael Haas <haas@computerlinguist.org>
gitorious archive became available, so I could import the project
history from there into the new repo on github. Rebasing the changes
made since 2014 on top of the original git tree obviously caused
the commit hashes to differ.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Mark the directories containing the keys for hidden services as
conffiles to preserve them over sysupgrade.
Fixes: #2247
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
In addition update some configure options and use EXTRA_CFLAGS.
Setting RunAsDaemon to 1 will be overwritten by the init script option
"--runasdaemon 0" anyway and we want it in foreground for procd.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The "internal pure-C" tor-fw-helper was removed in 0.2.7.5. This removes
the tor-fw-helper package and references to its dependencies.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* 010_fix_getnameinfo.patch is no longer needed
* 011-cron-without-pthread-fix.patch added, fixes incorrect
ifdef when building without pthreads
Signed-off-by: Michael Haas <haas@computerlinguist.org>
- fix build error reported by buildbot by disabling krb5
- libcom_err from krb5 is used - configure output:
configure: WARNING: library 'com_err' is required for Heimdal Kerberos
- krb5 has its own libcom_err (see krb5 package) with its own symbols
- linking with wrong libcom_err from libext2fs produces errors during
libgssapi_krb5.so: undefined reference to `error_message@com_err_3_MIT'
libgssapi_krb5.so: undefined reference to `remove_error_table@com_err_3_MIT'
libgssapi_krb5.so: undefined reference to `add_error_table@com_err_3_MIT'
-> remove libext2fs dependency (wasnt working anyway - no PKG_BUILD_DEP)
Signed-off-by: Dirk Neukirchen <dirkneukirchen@web.de>
The contents of the file "db.root" is very old (12 years).
Here's a new version downloaded from ftp://ftp.internic.net/domain/
Signed-off-by: DonkZZ <donk@evhr.net>
The original Google Code repository is not available anymore, use the
equivalent Github repository instead.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
upmpdcli 0.11 mainly improves on the Songcast support, in
complement with the changes in sc2mpd. Especially, it now
includes an utility (scctl) and web interface to set up
multi-room Songcast.
Signed-off-by: Petko Bordjukov <bordjukov@gmail.com>
When using IPv6 and http://, the site redirects to https://nodejs.org
which doesn't have the dist sources. IPv4 does not have this problem.
Use https directly.
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
- Switch download to the Github clone of crtmpserver
- Rebase patches against latest version
- Pregenerate version.h file
- Disable applestreamingclient as it is broken
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
This fixes upstream regression introduced in 1.4.40. It was reported &
debugged in https://redmine.lighttpd.net/issues/2793
This fix is queued for 1.4.46 in the personal/gstrauss/master upstream
branch.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Update to 1.4.42 introduced a problem with starting lighttpd as
OpenWrt/LEDE service. It was stopping whole init process at sth like:
783 root 1124 S {S50lighttpd} /bin/sh /etc/rc.common /etc/rc.d/S50lighttpd boot
799 root 1164 S /usr/sbin/lighttpd -f /etc/lighttpd/lighttpd.conf
It was hanging until getting random pool:
[ 176.340007] random: nonblocking pool is initialized
and then immediately the rest of init process followed:
[ 176.423475] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[ 176.430754] jffs2_build_filesystem(): unlocking the mtd device... done.
[ 176.437615] jffs2_build_filesystem(): erasing all blocks after the end marker... done.
This was fixed in 1.4.44, but bump directly to 1.4.45 while at it.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
- new update url for service "duiadns.net" #3969
- updated public_suffix_list.dat
Signed-off-by: Christian Schoenebeck <christian.schoenebeck@gmail.com>
this installs the default MIBS-files under /usr/share/snmp/mibs .
Also aligns the defines to the same sorting-scheme.
backport of daeb5fd506
Signed-off-by: Sven Roederer <devel-sven@geroedel.de>
This release includes new SSL certificates for RubyGems. And, this also
includes about 80 bug fixes after the previous release. See the
http://svn.ruby-lang.org/repos/ruby/tags/v2_2_6/ChangeLog for details.
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
Apply adblock updates 1.4.10-1.5.1
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Original commit messages:
adblock: update 1.4.10
- add 'enabled' check to iface hotplug event handler
- decrease startup priority from 99 to 90
- fix tab indentation in config
adblock: update 1.5.0
* add new 'envchk'function to check adblock environment only,
i.e. check volatile firewall rules or uhttpd instances
without list updates
* add new optional parm 'adb_loglevel',
set it to "0" to mute output (print only errors)
* set hotplug priority to '90' as well (missed in the last commit)
* documentation update
* cosmetics
adblock: bugfix 1.5.1
* fix uhttpd detection in tcp 4+6 configurations
Apply adblock updates 1.4.8-1.4.9
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Original commit messages:
adblock: update 1.4.8
* enhance the new query function:
change the regex to find only the relevant blocklist entries
add a recursive tld search to quickly identify domains for
whitelisting (see documentation)
better result preparation
* add securemecca as new blocklist source
* documentation update
adblock: update 1.4.9
* refine query function (see online doc)
Only applies to the 15.05 branch!
Apply a patch to correct usage with the (rather old) version of
libwebsockets in CC. Has been submitted upstream.
Fixes github issue #3127
Signed-off-by: Karl Palsson <karlp@etactica.com>
Apply adblock update 1.4.5-1.4.7
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Original commit messages:
adblock: update 1.4.5
* change the default hphosts list source to ad and tracking servers
only, the overall list includes to many false positives
* new optional config parm 'adb_hotplugif' to restrict hotplug support
to a certain wan interface or to disable it at all
* documentation update
* cosmetics
adblock: update 1.4.6
* added a 'window.close()' to adblock landing page to automatically
close any pop-ups that might get loaded with a blocked ad
* simplified dnsmasq check in ap mode
adblock: update 1.4.7
* add a query function to search the active blocklists for a specific
domain (/etc/init.d/adblock query <DOMAIN>)
* fix bug in ap mode/uhttpd port detection
* check general firewall and dnsmasq package dependencies and remove
redundant checks in ap mode
Update for-15.05 adblock from 1.2.1 to 1.4.4
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Original commit messages of 1.2.5-1.4.4 commits:
adblock: update 1.2.5
* restructured sources
* fix logical glitches in config handling
* many corner case fixes & cosmetics
* show runtime errors in LuCI (in lastrun section)
adbock: update 1.2.6
* small addition in case of a failed list download
adblock: update 1.2.7
* provide adblock statistics as a separate function
(/etc/init.d/adblock stats)
adblock: update 1.2.8
* fw rule changes:
force_dns now supports multiple lan devices
disable needless force_dns- & forward/output-rules in 'ap mode'
check return codes during adblock chain creation
* simplified the test for a running firewall
* documentation update
adblock: release 1.3.0
* revised hotplug script
* remove wget package dependency
* support uclient-fetch or wget with ssl support
* documentation update
adblock: update 1.3.1
* fix uclient-fetch detection
* cosmetics
adblock: update 1.3.2
* only a few more fixes
adblock: update 1.3.3
* enable automatic restore on empty source downloads
adblock: release 1.4.0
* rework/speed up overall sort
* simplified dns error handling
adblock: update 1.4.1
* fix two possible overflows in adblock statistics
adblock: update 1.4.2
* ad broad blocklist source 'hphosts' https://hosts-file.net
adblock: update 1.4.3
* fix race condition in restricted mode
* cosmetics
adblock: update 1.4.4
* filter non-printable characters/binary data in input stream
* fix IPv4 adblock statistics in CC
* small optimizations & cosmetics
adblock: release 1.2.0
* rework download/backup/restore handling
* rework firewall handling
* refine whitelist parsing
* changed default null-ip to 198.18.0.1 to prevent conflicts with bcp38
* spread traffic from ad servers (port 80/443) on two uhttpd instances,
this fixes timeouts on sites with many ssl ad server connections, i.e.
youtube.com
* provide statistics & last runtime for LuCI interface
* documentation update
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 8ab3d8bdc2)
(cherry picked from commit 672dd10b10)
* change winspy url again
* various cosmetics left out in former release
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit d0eceb6b25)
adblock: update 1.1.16, release 2
* workaround for LuCI search path issue
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 26fa1c5df0)
adblock: update 1.1.16
* new config option 'adb_restricted' to disable updates of the adblock
config during runtime (no flash writes, disabled by default)
* new update function, to apply latest configuration changes if needed
(/etc/init.d/adblock cfgup)
* fix dns redirect rule
* various optimizations
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 41b05a5532)
If the liblz4 library exists within the build environment, the openconnect
configure will pick it up and start depending on it, leading to the following
build error:
Package openconnect is missing dependencies for the following libraries:
liblz4.so.1
Disable LZ4 support in configure in order to avoid this implicit,
nondeterministic dependency.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* support more router modes, as long as the firewall and the DNS server
are enabled
* new source sites can be added & changed via awk ruleset in uci config
* source domain count, last update time & overall count will be stored
in uci config
* added 3 new source sites:
ransomware tracker
rolist/easylist
winspy
* switch to minimal inline base64 encoded 1×1 GIF for pixel server
(separate png image no longer needed)
* simplified uci parser
* source download & domain sort optimization
* add whitelist parser with wildcard support
* reduced code size & various cleanups
* updated documentation
Signed-off-by: Dirk Brenken <openwrt@brenken.org>
(cherry picked from commit b9aeb82c95)
A typo in the init file was causing a certain setting to be overwritten on every daemon start.
Signed-off-by: Jonathan Bennett <JBennett@incomsystems.biz>
[RELEASE] Released version 1.5.16
Released version 1.5.16 with the following main changes :
- BUG/BUILD: replace haproxy-systemd-wrapper with $(EXTRA) in install-bin.
- BUG/MINOR: acl: don't use record layer in req_ssl_ver
- BUG: http: do not abort keep-alive connections on server timeout
- BUG/MEDIUM: http: switch the request channel to no-delay once done.
- MINOR: config: extend the default max hostname length to 64 and beyond
- BUG/MEDIUM: http: don't enable auto-close on the response side
- BUG/MEDIUM: stream: fix half-closed timeout handling
- BUG/MEDIUM: cli: changing compression rate-limiting must require admin level
- BUILD: freebsd: double declaration
- BUG/MEDIUM: sample: urlp can't match an empty value
- BUG/MEDIUM: peers: table entries learned from a remote are pushed to others after a random delay.
- BUG/MEDIUM: peers: old stick table updates could be repushed.
- CLEANUP: haproxy: using _GNU_SOURCE instead of __USE_GNU macro.
- BUG/MINOR: chunk: make chunk_dup() always check and set dst->size
- MINOR: chunks: ensure that chunk_strcpy() adds a trailing zero
- MINOR: chunks: add chunk_strcat() and chunk_newstr()
- MINOR: chunk: make chunk_initstr() take a const string
- BUG/MEDIUM: config: Adding validation to stick-table expire value.
- BUG/MEDIUM: sample: http_date() doesn't provide the right day of the week
- BUG/MEDIUM: channel: fix miscalculation of available buffer space.
- BUG/MINOR: stream: don't force retries if the server is DOWN
- MINOR: unix: don't mention free ports on EAGAIN
- BUG/CLEANUP: CLI: report the proper field states in "show sess"
- MINOR: stats: send content-length with the redirect to allow keep-alive
- BUG: stream_interface: Reuse connection even if the output channel is empty
- DOC: remove old tunnel mode assumptions
- DOC: add server name at rate-limit sessions example
- BUG/MEDIUM: ssl: fix off-by-one in ALPN list allocation
- BUG/MEDIUM: ssl: fix off-by-one in NPN list allocation
- BUG/MEDIUM: stats: stats bind-process doesn't propagate the process mask correctly
- BUG/MINOR: http: Be sure to process all the data received from a server
- BUG/MEDIUM: chunks: always reject negative-length chunks
- BUG/MINOR: systemd: ensure we don't miss signals
- BUG/MINOR: systemd: report the correct signal in debug message output
- BUG/MINOR: systemd: propagate the correct signal to haproxy
- MINOR: systemd: ensure a reload doesn't mask a stop
- CLEANUP: stats: Avoid computation with uninitialized bits.
- CLEANUP: pattern: Ignore unknown samples in pat_match_ip().
- CLEANUP: map: Avoid memory leak in out-of-memory condition.
- BUG/MINOR: tcpcheck: conf parsing error when no port configured on server and last rule is a CONNECT with no port
- BUG/MINOR: tcpcheck: fix incorrect list usage resulting in failure to load certain configs
- MINOR: cfgparse: warn when uid parameter is not a number
- MINOR: cfgparse: warn when gid parameter is not a number
- BUG/MINOR: standard: Avoid free of non-allocated pointer
- BUG/MINOR: pattern: Avoid memory leak on out-of-memory condition
- CLEANUP: http: fix a build warning introduced by a recent fix
- BUG/MINOR: log: GMT offset not updated when entering/leaving DST
Signed-off-by: heil <heil@terminal-consulting.de>
- Fix auto-callout
(http://vcs.pcre.org/viewvc?view=rev&revision=1611)
- Fix negated POSIX class within negated overall class UCP
(git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1612 2f5784b3-3f2a-0410-8824-cb99058d5e15)
- Fix bug for isolated \E between an item and its qualifier when auto callout is set.
(git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1613 2f5784b3-3f2a-0410-8824-cb99058d5e15)
- Give error for regexec with pmatch=NULL and REG_STARTEND set
(git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1614 2f5784b3-3f2a-0410-8824-cb99058d5e15)
- Fix \Q\E before qualifier bug when auto callouts are
(git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1616 2f5784b3-3f2a-0410-8824-cb99058d5e15)
- Fix /x bug when pattern starts with white space and (?-x)
(git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1617 2f5784b3-3f2a-0410-8824-cb99058d5e15)
- Fix copy named substring bug.
(git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1618 2f5784b3-3f2a-0410-8824-cb99058d5e15)
- Fix (by hacking) another length computation issue.
(git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1619 2f5784b3-3f2a-0410-8824-cb99058d5e15
- Fix get_substring_list() bug when \K is used in an assertion.
(git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1620 2f5784b3-3f2a-0410-8824-cb99058d5e15
- Fix pcretest bad behaviour for callout in lookbehind.
(git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1625 2f5784b3-3f2a-0410-8824-cb99058d5e15
- Fix workspace overflow for (*ACCEPT) with deeply nested
(git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1631 2f5784b3-3f2a-0410-8824-cb99058d5e15
fixes CVE-2016-3191
- Fix Yet another duplicate name bugfix by overestimating the memory needed (i.e. another hack - PCRE2 has this "properly" fixed).
(git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1636 2f5784b3-3f2a-0410-8824-cb99058d5e15
- Fix pcretest loop for global matching with an ovector size
(git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1637 2f5784b3-3f2a-0410-8824-cb99058d5e15
Signed-off-by: heil <heil@terminal-consulting.de>
* upstream to Privoxy 3.0.24
- incl. fix for CVE-2016-1982 and CVE-2016-1983
* add facility to set compile options
* add file list to be saved on sysupgrade
* fixed PKG_MAINTAINER string
* add port 8118 used by privoxy to /etc/services
* new "boot_delay" option (default 10 seconds) to wait for interfaces to come up before hotplug restarts are enabled
Signed-off-by: Christian Schoenebeck <christian.schoenebeck@gmail.com>
- [PATCH 11/13] BUG/MEDIUM: peers: table entries learned from a remote
- [PATCH 12/13] BUG/MEDIUM: peers: old stick table updates could be
- [PATCH 13/13] CLEANUP: haproxy: using _GNU_SOURCE instead of
Signed-off-by: heil <heil@terminal-consulting.de>
fixes:
* path traversal vulnerability in mod_http_files (CVE-2016-1231)
* use of weak PRNG in generation of dialback secrets (CVE-2016-1232)
Signed-off-by: heil <heil@terminal-consulting.de>
Building both variants improperly tried to include the passwd utility
for the non-ssl variant, as the variable was set for the ssl variant.
Use properly separated install tasks to install additional files, rather
than hacking around inside the single target.
Signed-off-by: Karl Palsson <karlp@remake.is>
Many users of the SSL build of mosquitto need the passwd utility for
managing keys.
Fixes github issue #1909
Signed-off-by: Karl Palsson <karlp@remake.is>
sane-xxx backend packages are hidden packages with custom
config and CONFIG_ALL does not select them alone. Now
sane-backends depends on +ALL:sane-backends-all.
No existing ipk is affected as the changed package/sane-backends
does not exist as an ipk.
030-musl.patch was updated to be submitted upstream. However,
the added preprocessor #if are always true for OpenWRT and will
not change the resulting code.
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
Changes since oldpackages:
- updated to 1.0.25
* most of openwrt patches are upstreamed now
- cups dependency was completely removed
- small musl patch
- small uclibc patch
- removed link to extra libraries in libsane (used only
for preload backends)
- sane-libs and sane-backends merged and exploded into
individual packages for each backend:
* libsane for sane library (which backends should dep on)
* sane-daemon for saned daemon
* sane-xxx for sane backend for xxx
** each backend has its own custom dep libraries
* sane-backends-all (with no files) that deps on all backends
* sane-qcam is only available for x86/x86_64
** other archs does not implement inb/outb (at least in musl)
Now it is possible to use SANE with much less FS space (KB
instead of MB).
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
- Add patch to get WEXITSTATUS and WIFEXITED defined
The issue is fixed in upstream's development repo, so the patch won't be
needed with ncdu's next release.
- Depend on more commonly used libncurses instead of libncursesw
- Enable parallel build
- Update copyright
Signed-off-by: Charles Lehner <cel@celehner.com>
This release includes a security fix for Fiddle extension.
* CVE-2015-7551: Unsafe tainted string usage in Fiddle and DL
There are also some bugfixes.
In package, now LD_FLAGS is copied to DLD_FLAGS (used by ruby for libraries).
The missing values from LD_FLAGS cause build error when gcc does not implicitly
include staging/usr/lib.
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
This is necessary when there are multiple records for the same domain,
otherwise the script will overwrite the first one returned by the API.
It has the secondary benefit of allowing faster updates by performing
only one API call instead of two.
In case 'rec_id' is not set the script behaves exactly as before.
Signed-off-by: Leonardo Brondani Schenkel <leonardo@schenkel.net>
(grafted from 019ba13d01e93c18d0ed35b0aeb3399f28108e0e)
Whenever we ship fixed libopenssl binaries in CC, the Freeradius daemon fails
at startup because it detects a mismatch of the build time and runtime OpenSSL
version.
Since our OpenSSL updates for CC are ABI compatible we do not need or even want
this superflous check. Removing it saves us the effort to rebuild Freeradius
after every OpenSSL version bump.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
This fixes the following CVEs:
- in PCRE: CVE-2015-2325, CVE-2015-2326
- in sqlite3: CVE-2015-3414, CVE-2015-3415, CVE-2015-3416
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
This fixes CVE-2006-7243, a multipart/form-data remote dos vulnerability,
a heap buffer overflow in unpack and a integer overflow in ftp_genlist,
which also results in a heap overflow.
For more details, see http://php.net/ChangeLog-5.php#5.6.9
Also sync the timezone patch with latest version from Debian and
adopt this patch for the changes in this php release.
Refresh 950-Fix-dl-cross-compiling-issue.patch.
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
This patch adds build infrastructure for PHP's OPcache extension.
Compared with the other extension, this is a Zend module and it
need a little workaround during cross-compiling.
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
Fix for #2116 - $INTERNAL_IP{4,6}_DNS variables are not word-split correctly when containing more than one DNS server.
Signed-off-by: Aleksandar Radovanovic <biblbroks@sezampro.rs>
Since 94f87dc1, host build of Python depends on expat installed in host
staging directory. However, pyexpat extension fails to build if expat
was not built and installed to staging dir before - adding host build
dependency should fix this.
Signed-off-by: Jan Čermák <jan.cermak@nic.cz>
Patch removing multiarch paths from build should be applied only when
Python is built for target, but not for host. When the paths are removed
during host build, host python throws some ugly errors when importing
some hashlib modules. Also it reports that modules crypt and nis failed
to build (tested on Ubuntu 14.04 host).
Signed-off-by: Jan Čermák <jan.cermak@nic.cz>
Addition of the bandwithd package variant from the oldpackage
Addition of the bandwidthd-pgsql package variant that can save also
in a postgres database.
Compile tested on CC and trunk (ar71xx and mvebu in both cases)
run tested on CC (ar71xx) and trunk (r47397 on mvebu)
Signed-off-by: Jean-Michel Lacroix <lacroix@lepine-lacroix.info>
Build depends must refer to the source package name, not the binary one,
therefore we need to use `bzip2` in order to enforce a build of libbz2.so.
Also make the host python build depend on the bzip2 host build in order to
ensure that host python is built with bzip2 support. We don't need a build
dependency for the target python as this already depends on +libbz2 through
python-light. That package dependency in turn implies a build dependency.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
reported in forum:
https://forum.openwrt.org/viewtopic.php?id=59137
issue was discovered and fixed already in buildroot
git commit id: f5e4ca10220e2325d3a34c0a423388e40b27dbdf
Signed-off-by: Dirk Neukirchen <dirkneukirchen@web.de>
to make the bridge work we need to run an askfirst instance on the ttyS.
additionally add the lua scripts needed to make REST work. this is really ugly
code but it works. i already cleaned up to the original code, but there are still
issues such as a new luci session being created for each request.
Signed-off-by: John Crispin <blogic@openwrt.org>
upm is a sensor library that sits ontop of libmraa. it has support for a large
number of sensors and exports bindings for node, python, ...
Signed-off-by: John Crispin <blogic@openwrt.org>
mraa is a lowlevel io bus abstraction layer. it allows us to export bindings for
various linux io busses for node, python, ...
Signed-off-by: John Crispin <blogic@openwrt.org>
The update is mainly for addressing some memory corruption and segementation
faults issues observed when running xl2tpd in OpenWrt. The relevant upstream
pull request was at link [1]
[1] Devel fix valgrind #77, https://github.com/xelerance/xl2tpd/pull/77
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
Makes kmod-ipsec6 requirement dependent on IPv6 support for packages.
This allows to disable unnecessary IPv6 kernel modules, saving
considerable amount of space.
Signed-off-by: Marcin Jurkowski <marcin1j@gmail.com>
When only strongswan-minimal is selected, libtls.so will not be built
yet package strongswan will still try to copy the file causing build
failure.
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
- [PATCH 05/13] BUG/MINOR: http/sample: gmtime/localtime can fail
- [PATCH 06/13] DOC: typo in 'redirect', 302 code meaning
- [PATCH 07/13] DOC: mention that %ms is left-padded with zeroes.
- [PATCH 08/13] CLEANUP: .gitignore: ignore more test files
- [PATCH 09/13] CLEANUP: .gitignore: finally ignore everything but what
- [PATCH 10/13] MEDIUM: config: emit a warning on a frontend without
- [PATCH 11/13] BUG/MEDIUM: counters: ensure that src_{inc,clr}_gpc0
- [PATCH 12/13] DOC: ssl: missing LF
- [PATCH 13/13] DOC: fix example of http-request using
Signed-off-by: heil <heil@terminal-consulting.de>
The config file shipped with collectd dates from 2010 and
leads to error messages if luci-statistics & collectd are installed,
as it references several plugins not usually installed, or such ones
that have been renamed since then.
For most users, this file is just a placeholder during collectd installation,
as /usr/bin/stat-genconfig from /etc/init.d/luci_statistics will overwrite it.
Sanitize and shorten the placeholder config file:
* Reference actively only the default plugins installed by luci statistics.
* Match the placeholder config with the genuine config from luci statistics.
If somebody uses collectd separately from luci statistics, he will need to
edit these settings anyway.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
- Add missing `sys/ttydefaults.h` include to `config.c`
- Restrict usage of `error.h` to glibc and uclibc only
- Avoid including `linux/if_tun.h` on non-glibc/uclibc to prevent
musl kernel/libc header conflicts
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
This update fixes CVE-2014-6272. Change of source URL was needed,
because the older location does not contain the latest version.
Signed-off-by: Jan Čermák <jan.cermak@nic.cz>
This is a bug and security fix release, including:
- CVE-2015-3900 Request hijacking vulnerability in RubyGems 2.4.6 and earlier
http://svn.ruby-lang.org/repos/ruby/tags/v2_2_3/ChangeLog
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
Unspecified vulnerability in vsftp 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown vectors, related to deny_file parsing.
simple.qos had accidentally set up the egress shaper twice, once
with the true egress parameters and a second time using the ingress
parameters, effectively misconfiguring both directions. This bub
only affected situations where 3-tier ingress classification was
used.
Signed-off-by: Sebastian Moeller <moeller0@gmx.de>
sqm_logger tried tro wait indefinitely if passed an empty string.
This in turn makes sqm-scripts hang. Quoting the input argument in sqm_logger
seems to fix the problem.
Signed-off-by: Sebastian Moeller <moeller0@gmx.de>
The last batch of changes tried to teach the GUI to pass link layer
options to cake but forgot to actually call the function that parses
the GUI variables and used it as a string insteead. So this fixes that
it also tries to allow the use of the tc_stab link layer adjustment
method with cake so the implementations can be validated against each other
easily. Needs testing...
Signed-off-by: Sebastian Moeller <moeller0@gmx.de>
The cake traffic-shaper qdisc omne stop solution knows how to handle
link layer adjustments for ATM and can account for per packet overhead.
This commit adds cake as link layer adjustment mechanism in the GUI and
passes numerically specified overhead as well as the ATM linklayer
keywords on to cake. This change also passes the "advanced option strings"
from the Queue Discipline tab to cake. But as before no error checking.
This needs testing, as I have no working cake qdisc available so
caveat emptor...
Signed-off-by: Sebastian Moeller <moeller0@gmx.de>
Make clear that configuration options guarded by checkboxes are only
effective as long as those boxes are checked.
The sqm gui has giarded some advanced configuration options behind exposing
checkboxes, meaning these optiopn's values were only used as long
as those boxes were checked. This commit just improves the description of
the checkboxes to included this useage instruction...
Signed-off-by: Sebastian Moeller <moeller0@gmx.de>
The SQM gui has confused its users with an enable button, that only served to
selecively activate/de-activate sqm instances instead of controlling sqm's
initscript (which needs to be enabled so the sqm properly starts up after a reboot
and also for hotplug to work properly). luci-app-sqm will now enable sqm's
initscript when a single sqm instance get enabled. It also informs the user about
this fact in the top margin of the sqm page. Note sqm will not disable the
initscript behind the user's back if sqm instances get disabled.
While I would have prefered this notice to be more prominent an attentive user
should notice, and most users should not care anyway. This also increases the
package release number.
Signed-off-by: Sebastian Moeller <moeller0@gmx.de>
this will allow us to switch to procd and use jailing ...
this patch come from https://support.zabbix.com/browse/ZBXNEXT-611
big thanks to Boris Manojlovic
Signed-off-by: Etienne CHAMPETIER <champetier.etienne@gmail.com>
Fixed two issues in Chaos Calmer and trunk:
-troubleshooting page not displaying
-UCI arguments out of order because of switch to musl c library from uclibc
Signed-off-by: Aedan "arfett" Renner <chipdankly@gmail.com>
- BUILD/MINOR: tools: rename popcount to my_popcountl
- BUG/MAJOR: buffers: make the buffer_slow_realign() function respect output data
Signed-off-by: heil <heil@terminal-consulting.de>
fixed sed when filtering IP address from nslookup output
because "Server:" block might have multiple address lines.
Thanks to Arjen de Korte
Signed-off-by: Christian Schoenebeck <christian.schoenebeck@gmail.com>
Released version 1.5.13 with the following main changes :
- BUG/MINOR: check: fix tcpcheck error message
- CLEANUP: deinit: remove codes for cleaning p->block_rules
- DOC: Update doc about weight, act and bck fields in the statistics
- MINOR: ssl: add a destructor to free allocated SSL ressources
- BUG/MEDIUM: ssl: fix tune.ssl.default-dh-param value being overwritten
- MEDIUM: ssl: replace standards DH groups with custom ones
- BUG/MINOR: debug: display (null) in place of "meth"
- BUG/MINOR: cfgparse: fix typo in 'option httplog' error message
- BUG/MEDIUM: cfgparse: segfault when userlist is misused
- BUG/MEDIUM: stats: properly initialize the scope before dumping stats
- BUG/MEDIUM: http: don't forward client shutdown without NOLINGER except for tunnels
- CLEANUP: checks: fix double usage of cur / current_step in tcp-checks
- BUG/MEDIUM: checks: do not dereference head of a tcp-check at the end
- CLEANUP: checks: simplify the loop processing of tcp-checks
- BUG/MAJOR: checks: always check for end of list before proceeding
- BUG/MEDIUM: checks: do not dereference a list as a tcpcheck struct
- BUG/MEDIUM: peers: apply a random reconnection timeout
- BUG/MINOR: ssl: fix smp_fetch_ssl_fc_session_id
- MEDIUM: init: don't stop proxies in parent process when exiting
- MINOR: peers: store the pointer to the signal handler
- MEDIUM: peers: unregister peers that were never started
- MEDIUM: config: propagate the table's process list to the peers sections
- MEDIUM: init: stop any peers section not bound to the correct process
- MEDIUM: config: validate that peers sections are bound to exactly one process
- MAJOR: peers: allow peers section to be used with nbproc > 1
- DOC: relax the peers restriction to single-process
- CLEANUP: config: fix misleading information in error message.
- MINOR: config: report the number of processes using a peers section in the error case
- BUG/MEDIUM: config: properly compute the default number of processes for a proxy
Signed-off-by: heil <heil@terminal-consulting.de>
That allows to restart transmission when it crashes, to limit
the memory used by it, as well as be jailed in the directories
it is supposed to access.
Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
sqm-scripts for a long time interprets a "Down- or Upload speed" of zero as
an indication that the shaper should be disabled. Note that really shaping
an individual direction down o zero will make the link effectively dead
for tcp (think reverse ACK traffic). Son instead of allowing the user to
configure something broken, 0 was "over-loaded" to denote no shaping
since several years, but that information has not been documented visibly
to the users. This commit aims at fixing that oversight.
Signed-off-by: Sebastian Moeller <moeller0@gmx.de>
- [PATCH 1/2] BUG/MEDIUM: stats: properly initialize the scope before
- [PATCH 2/2] BUG/MEDIUM: http: don't forward client shutdown without
- [PATCH 3/8] BUG/MINOR: check: fix tcpcheck error message
- [PATCH 4/8] CLEANUP: checks: fix double usage of cur / current_step
- [PATCH 5/8] BUG/MEDIUM: checks: do not dereference head of a
- [PATCH 6/8] CLEANUP: checks: simplify the loop processing of
- [PATCH 7/8] BUG/MAJOR: checks: always check for end of list before
- [PATCH 8/8] BUG/MEDIUM: checks: do not dereference a list as a
- [PATCH 09/10] BUG/MEDIUM: peers: apply a random reconnection timeout
- [PATCH 10/10] DOC: Update doc about weight, act and bck fields in the
- [PATCH 11/14] MINOR: ssl: add a destructor to free allocated SSL
- [PATCH 12/14] BUG/MEDIUM: ssl: fix tune.ssl.default-dh-param value
- [PATCH 13/14] BUG/MINOR: cfgparse: fix typo in 'option httplog' error
- [PATCH 14/14] BUG/MEDIUM: cfgparse: segfault when userlist is misused
Signed-off-by: heil <heil@terminal-consulting.de>
Imports the latest version from the management feed, and fixes the
install paths. All example code, and desktop linux expects and installs
libev's headers to /usr/include/<ev.h> not under a subdirectory.
Signed-off-by: Karl Palsson <karlp@tweak.net.au>
Update to latest release
add qrencode package which contains the qrencode binary
Remove libpng dependancy
Signed-off-by: Jonathan Bennett <jbennett@incomsystems.biz>
- Unbroke MIPS support which got entirely lost since the upgrade from 2.4.1:
now all ISAs should work (MIPS1 would need kernel emulation though, untested)
- Fixed host installation which was broken on all targets
- Updated source origin to github and related variables
- Kept mipseb patch exception and MIPS16:=0 exclusion (needed for BB and CC compilation)
Only tested on a ZyXEL NBG6716 router which is MIPS32 (MIPS74Kc), ar71xx target.
Signed-off-by: Guillaume Déflache <guillaume.deflache@ibwag.com>
* fix Makefile to force compression of tld_names.dat reported in OpenWrt Ticket 19597
* change default of retry_count to "0" (retry endless) suggested by Henning Schild
* updated tld_names.dat include changes until 07.05.2015
Signed-off-by: Christian Schoenebeck <christian.schoenebeck@gmail.com>
It used to require 1+ IPv4 addresses to start on Linux. Now it starts
up with 0 addresses (of any type), as netlink can provide us more
later. This way, no stupid restart loop with procd if it is racing
with netifd at startup.
Signed-off-by: Steven Barth <steven@midlink.org>
(See <http://wiki.openwrt.org/doc/devel/packages> for overall format and construction)
All packages you commit or submit by pull-request should follow these simple guidelines:
### Basic guidelines
All packages you commit or submit by pull-request should follow these simple guidelines:
* Package a version which is still maintained by the upstream author.
* Will be updated regularly to maintained and supported versions.
* Have no dependencies outside the OpenWrt core packages or this repository feed.
@ -11,7 +12,7 @@ All packages you commit or submit by pull-request should follow these simple gui
* Do NOT use a rolling source file (e.g. foo-latest.tar.gz) or the head of a branch as source for the package since that would create unpredictable builds which change over time.
* Best of all -- it works as expected!
Makefile contents should contain:
#### Makefile contents should contain:
* An up-to-date copyright notice. Use OpenWrt if no other present or supply your own.
* A (PKG_)MAINTAINER definition listing either yourself or another person in the field.
@ -22,27 +23,47 @@ Makefile contents should contain:
(E.g.: PKG_LICENSE_FILES:=COPYING)
* PKG_RELEASE should be initially set to 1 or reset to 1 if the software version is changed. You should increment it if the package itself has changed. For example, modifying a support script, changing configure options like --disable* or --enable* switches, or if you changed something in the package which causes the resulting binaries to be different. Changes like correcting md5sums, changing mirror URLs, adding a maintainer field or updating a comment or copyright year in a Makefile do not require a change to PKG_RELEASE.
Commits in your pull-requests should:
#### Commits in your pull-requests should:
* Have a useful description prefixed with the package name
(E.g.: "foopkg: Add libzot dependency")
* Include Signed-off-by in the comment
(See <https://dev.openwrt.org/wiki/SubmittingPatches#a10.Signyourwork>)
If you have commit access:
### Advice on pull requests:
Pull requests are the easiest way to contribute changes to git repos at Github. They are the preferred contribution method, as they offer a nice way for commenting and amending the proposed changes.
* You need a local "fork" of the Github repo.
* Use a "feature branch" for your changes. That separates the changes in the pull request from your other changes and makes it easy to edit/amend commits in the pull request. Workflow using "feature_x" as the example:
- Update your local git fork to the tip (of the master, usually)
- Create the feature branch with `git checkout -b feature_x`
- Edit changes and commit them locally
- Push them to your Github fork by `git push -u origin feature_x`. That creates the "feature_x" branch at your Github fork and sets it as the remote of this branch
- When you now visit Github, you should see a proposal to create a pull request
* If you later need to add new commits to the pull request, you can simply commit the changes to the local branch and then use `git push` to automatically update the pull request.
* If you need to change something in the existing pull request (e.g. to add a missing signed-off-by line to the commit message), you can use `git push -f` to overwrite the original commits. That is easy and safe when using a feature branch. Example workflow:
- Checkout the feature branch by `git checkout feature_x`
- Edit changes and commit them locally. If you are just updating the commit message in the last commit, you can use `git commit --amend` to do that
- If you added several new commits or made other changes that require cleaning up, you can use `git rebase -i HEAD~X` (X = number of commits to edit) to possibly squash some commits
- Push the changed commits to Github with `git push -f` to overwrite the original commits in the "feature_x" branch with the new ones. The pull request gets automatically updated
### If you have commit access:
* Do NOT use git push --force.
* Do NOT commit to other maintainer's packages without their consent.
* Use Pull Requests if you are unsure and to suggest changes to other maintainers.
Gaining commit access:
#### Gaining commit access:
* We will gladly grant commit access to responsible contributors who have made
useful pull requests and / or feedback or patches to this repository or
OpenWrt in general. Please include your request for commit access in your
next pull request or ticket.
Release Branches:
### Release Branches:
* Branches named "for-XX.YY" (e.g. for-14.07) are release branches.
* These branches are built with the respective OpenWrt release and are created
@ -51,9 +72,8 @@ Release Branches:
* Do NOT add new packages and do NOT do major upgrades of packages here.
* If you are unsure if your change is suitable, please use a pull request.
####Common LICENSE tags (short list)
###Common LICENSE tags (short list)
(Complete list can be found at: <http://spdx.org/licenses>)
io_init_wait=this.isOldArduinoDevice()?(debug("old arduino device found "+this.serialport_name),3000):(debug("new arduino device found "+this.serialport_name),100);