While running `make menuconfig`, it was discovered then there is a
recursive dependency like this:
tmp/.config-package.in:59138:error: recursive dependency detected!
tmp/.config-package.in:59138: symbol PACKAGE_libwebsockets-openssl is selected by PACKAGE_libwebsockets-mbedtls
tmp/.config-package.in:59122: symbol PACKAGE_libwebsockets-mbedtls depends on PACKAGE_libwebsockets-openssl
It is not possible with the recently added conflicts that two packages
(OpenSSL and full variant, which uses OpenSSL as well), which are almost the same
provides the same named package libwebsockets as their conflict - Mbed
TLS.
Fixes: 676c5c72b5 ("libwebsockets: OpenSSL
and mbedTLS variants should conflict")
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit a4e8cbb89a)
They provide the same files, but they don't conflict to each other, this
means that users can install them side by side.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 676c5c72b5)
For some time, it is not possible to install ttyd and mosquitto-ssl at the
same time, so let's solve it that libwebsockets-full provides
libwebsockets-openssl. This allows to install ttyd and mosquitto at
the same time.
Also, we need to add conflict, because we should not have installed
libwebsockets-openssl and libwebsockets-full at the same time as they
provides the same files.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 77e682a11c)
This is similar to commit f303e87a1e
("nss: update to 3.67") as there is something wrong with NSS build
system and otherwise this package fails to compile. Let's compile it
single threaded.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
- Release notes:
https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-3.38.1
- Update the configuration file to use version 4.0 as mentioned in the
release notes to try the latest changes
Fixes: CVE-2022-38725
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 34b7af9e08)
This adds conflicts between the variants,
because they provide the same files, and it should not be
possible to install them side by side. Otherwise, it might happen that
half files would be from one variant and the other half from the
other.
Also, adds provides as if you request to install ``vim`` and
``vim-full``, then the request could be satisfied even they collide,
because ``vim-full`` provides ``vim`` package.
Signed-off-by: Karel Kočí <cynerd@email.cz>
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
[add commit message]
(cherry picked from commit 46c058468a)
makes LuaJit builds for mpc85xx targets with SPE ISA extension
enabled possible
Quoting inner commit message:
This allows building LuaJit for systems with Power ISA SPE
extension[^1] support by using soft float on LuaJit side.
While e500 CPU cores support SPE instruction set extension
allowing them to perform floating point arithmetic natively,
this isn't required. They can function with software floating
point to integer arithmetic translation as well,
just like FPU-less PowerPC CPUs without SPE support.
Therefore I see no need to prevent them from running LuaJit
explicitly.
[^1]: https://www.nxp.com/docs/en/reference-manual/SPEPEM.pdf
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Šimon Bořek <simon.borek@nic.cz>
(cherry picked from commit a4a484fbca)
Installing the .pc files helps other programs to detect
the presence of libsasl2.
While at, reduce the glob pattern a little bit to not
include unneeded symlinks.
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit c9ce769b1a)
cdn.postfix.johnriley.me serves a certificate for a different domain
name.
Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit d4feef97e6)
libarchive looks for ext2fs headers during configure, and if it finds
them it will expect to find them during compile, or on the rare occasion
when they aren't it will fail:
libarchive/archive_entry.c:59:55: fatal error: ext2fs/ext2_fs.h: No such file or directory
As we just need headers for some type constants, let's re-use headers
from tools/e2fsprogs package which are always available.
Reported-by: Adam Dov <adov@maxlinear.com>
Suggested-by: Paul Eggleton <paul.eggleton@linux.intel.com>
References: https://git.yoctoproject.org/poky/commit/?id=f0b9a7cf9f80be1917e45266fa201f464a28c1e5
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 797945dfaa)
The postinst script is sourced during image build, which causes the
follow failure:
/home/stijn/Development/OpenWrt/openwrt/build_dir/target-x86_64_musl/root-x86/etc/init.d/lxc-auto: line 3: /lib/functions.sh: No such file or directory
postinst script ./usr/lib/opkg/info/lxc-auto.postinst has failed with exit code 1
Sourcing /lib/functions.sh is not needed, as /etc/rc.common does so
already. Unfortunately removing that line from the init script is not
enough to fix the problem. The postinst script should also check
IPKG_INSTROOT. As these two changes are unrelated, they should go in
separate commits, and the solution to the image build problem is to
revert the commit that introduced the breakage.
This reverts commit 2cde10b950.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
otherwise, a user would have to either manually run /etc/init.d/lxc-auto
boot or reboot the system to start using lxc.
originally committed in 2cde10b950
reverted in 039912dec5
Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit 7da7356539)
fix ldconfig build issue. This patch is a backport from upstream:
18c9cf7d37
Signed-off-by: Sergey V. Lobanov <sergey@lobanov.in>
(cherry picked from commit 42c4d25455)
Commit 9bcea2de2c causes a dependency
problem with some out-of-tree packages which expect "DEPENDS:=+kmod-pcspkr".
To fix this problem, this commit restores a dependency definition to
the previous one on x86 target.
Signed-off-by: Yanase Yuki <dev@zpc.sakura.ne.jp>
(cherry picked from commit 8b1216fb49)
Beep is a target-independent software that can handle buzzers controlled by kmod-gpio-beeper.
This change is useful for some non-x86 enterprise APs and development boards
that have a buzzer connected to GPIO.
Compile-tested: ath79, ELECOM WAB-I1750-PS, 3fab4ac + device support patch
Run-tested: ath79, ELECOM WAB-I1750-PS, 3fab4ac + device support patch
Signed-off-by: Yanase Yuki <dev@zpc.sakura.ne.jp>
(cherry picked from commit 9bcea2de2c)
This can be finally re-reverted, so we can use version 3.1.13, which
fixes multiple security vulnerabilities, but it segfaults almost
immediately. There is currently pending pull request, which fixes this,
and multiple users confirmed that it works on different GNU/Linux distributions.
This reverts commit bfe255064e.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
This fixes CVE-2022-23308.
Also switch to GNOME as download source and xz tarball.
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 81fd836f97)
Signed-off-by: Šimon Bořek <simon.borek@nic.cz>
libxml2 seems to be required only during build, hence no need to
depend on it in run-time.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 1f3585a387)
Since muninlite 2.0 the unpatched upstream also uses
/proc/sys/kernel/hostname. Thus the patch is not necessary anymore.
Signed-off-by: Lars Kruse <devel@sumpfralle.de>
* follow upstream ressources to github
* rename /usr/sbin/munin-node to /usr/sbin/muninlite
(following the chane of upstream)
* change plugin directory from /usr/sbin/munin-node-plugin.d/
to /etc/munin/plugins (compatible to upstream / munin-node)
* all patches (except one OpenWrt-specific patch) were merged
upstream
Signed-off-by: Lars Kruse <devel@sumpfralle.de>
We received a report from Turris user on Turris support department that
netatalk version 3.1.13 does not work properly.
Process afpd says: INTERNAL ERROR Signal 11
because of that Apple Time Machine does not work as it should
This was already reported to netatalk by different people on various
GNU/Linux distributions like CentOS, AlmaLinux [1] [2]
netatalk developer states [3]:
```
Generally, at this point I can only advice to stop using Netatalk. There
are more pending CVEs that I currently don't have the bandwidth to work on.
```
[1] https://sourceforge.net/p/netatalk/bugs/669/
[2] https://sourceforge.net/p/netatalk/bugs/670/
[3] https://sourceforge.net/p/netatalk/mailman/message/37638871/
This reverts commit 165c5625a3.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
otherwise, a user would have to either manually run /etc/init.d/lxc-auto
boot or reboot the system to start using lxc.
Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit 2cde10b950)
This fixes CVE-2022-24884.
Also update the package URL to match the source repository.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
(cherry picked from commit de5671e582)
Fixes from 2.6.9:
- CVE-2021-41817: Regular Expression Denial of Service Vulnerability of
Date Parsing Methods
- CVE-2021-41819: Cookie Prefix Spoofing in CGI::Cookie.parse
Fixes from 2.6.10:
- CVE-2022-28739: Buffer overrun in String-to-Float conversion
After this release, Ruby 2.6 reaches EOL.
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
- Fixes CVE-2020-15803, CVE-2021-27927
- SourceForge does not provide tarball for version 4.0.37 and it was
necessary to use Zabbix CDN to download it.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Provide a new variant, nano-full, that enables almost
all functionality of nano. Only libmagic file type detection
has been left out.
Ship with a minimal /etc/nanorc that the user can modify.
nanorc documentation at
https://www.nano-editor.org/dist/latest/nanorc.5.html
Provide color highlighting for the uci config files.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 6a51794638)
Please update to this latest release as soon as possible as this
releases fixes the following major security issues: CVE-2021-31439,
CVE-2022-23121, CVE-2022-23122, CVE-2022-23123, CVE-2022-23124,
CVE-2022-23125 and CVE-2022-0194.
For a summary of news and a detailed list of changes see the
ReleaseNotes[1].
[1]: https://netatalk.sourceforge.io/3.1/ReleaseNotes3.1.13.html
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 951ef67479)
If miniportal option is enabled, some haserl scripts are provided which
present a simple login web page. To make it functional haserl is required.
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
(cherry picked from commit 532088818a)
- add missing configs to PKG_CONFIG_DEPENDS and sort it
- remove redundant INSTALL_DIR
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
(cherry picked from commit 2c71fb2065)
Includes fixes for:
* Windows builds updated to bzip2 1.0.8 to mitigate CVE-2016-3189 and
CVE-2019-12900
* CVE-2022-26488: Escalation of privilege via Windows Installer
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
Fixes security issues:
* CVE-2022-0396 -- A synchronous call to closehandle_cb() caused
isc__nm_process_sock_buffer() to be called recursively,
which in turn left TCP connections hanging in the
CLOSE_WAIT state blocking indefinitely when
out-of-order processing was disabled.
* CVE-2021-25220 -- The rules for acceptance of records into the cache
have been tightened to prevent the possibility of
poisoning if forwarders send records outside
the configured bailiwick.
Signed-off-by: Noah Meyerhans <frodo@morgul.net>
The FreeBSD project stopped publishing HTTP date headers and seeks to
limit further resource taxing by distributed htpdate clients using the
www.freebsd.org host as default time source.
Fixes: #17924
Reported-by: Allan Jude <allanjude@freebsd.org>
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit e871318002)
Update nano to 6.2.
Remove inactive second maintainer.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit a3f14c5114)
[removed AUTORELEASE]
The runtime testing always ran on master branch aka snapshots since the
branch wasn't passed over to the container execution!
Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit f535d77090)
Nano is by default built as "tiny" with most features disabled.
That is suitable for basic tasks in routers with small flash.
Add a new nano-plus variant that enables selected additional
features in the build config:
* multiple files (multibuffer)
* Unicode/utf8
* justify
* .nanorc support
* help
* also some key bindings get enabled as "tiny" configure option
is removed.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 85cb71d8d8)
Remove paxctl stuff. pax is not packaged in OpenWrt.
Add reload support.
Install lua cfg file as 644. It's needed to be readable as prosody user
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit eb46e231cd)
The previous one was wrong, and it did not work. It could be checked
inside compiled package in control.tar.gz that there was missing
``conffiles`` file with content `/etc/config/tvheadend`
It is also possible to verify that the config is not overwritten on the router
by running ``opkg install tvheadend --force-reinstall``
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 752d1ffc28)
The current init script is using the deprecated -nd flag. This updates netdata to be started with -D.
Signed-off-by: James White <james@jmwhite.co.uk>
(cherry picked from commit cf9d5a8870)
The postrm script was missing shebang. Postrm scripts are packaged and
executed directly and not sourced by default script (as in case of prerm
and postinst).
Also move some indents around to not confuse reader. The section in
postinst was indented to same level as grep "condition" but is on same
level as initial grep (not part of that "condition").
Signed-off-by: Karel Kočí <karel.koci@nic.cz>
(cherry picked from commit d2d193d818)
Update nano editor to version 6.0
Version 6.0 enable toggling the display of the line numbers with
the shortcut key M-N (Alt-n). Also the cmdline option "-l" works.
Remove earlier patch regarding that.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(backported from commits 0571f5400, 9023845d5 and ae7f62d63)
Missing input validation of host names returned by Domain Name Servers
in the c-ares library can lead to output of wrong hostnames (leading to
Domain Hijacking).
I've just taken patch from the advisory[1] and rebased it onto 1.15.0
version.
1. 809d5e8..44c009b.patch
Fixes: CVE-2021-3672
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Also bump the version in syslog-ng config file.
Removes this warning:
Nov 16 14:19:41 turris syslog-ng[15159]: WARNING: Configuration file format is too old, syslog-ng is running in compatibility mode. Please update it to use the syslog-ng 3.35 format at your time of convenience. To upgrade the configuration, please review the warnings about incompatible changes printed by syslog-ng, and once completed change the @version header at the top of the configuration file; config-version='3.33'
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 2d2fd36e28)
Details:
- Cleaned up whitespace and removed comments (refer to official PHP documentation for that)
- Removed directives that no longer exist as of PHP 7.2.34
- Added '~E_DEPRECATED' to 'error_reporting'
Directives removed that no longer exist as of PHP 7.2.34:
- zend.ze1_compatibility_mode
- y2k_compliance
- register_globals
- register_long_arrays
- magic_quotes_gpc
- magic_quotes_runtime
- magic_quotes_sybase
- always_populate_raw_post_data
Signed-off-by: Giovanni Giacobbi <giovanni@giacobbi.net>
The following CVEs are addressed:
* CVE-2021-25219: The "lame-ttl" option is now forcibly set to 0. This
effectively disables the lame server cache, as it could previously
be abused by an attacker to significantly degrade resolver performance.
Signed-off-by: Noah Meyerhans <frodo@morgul.net>
Recently, silicondust (developers of hdhomerun) did some cleanup and
removed old versions for hdhomerun library.
```
WGET http://download.silicondust.com/hdhomerun/libhdhomerun_20150826.tgzhttp://download.silicondust.com/hdhomerun/libhdhomerun_20150826.tgz:
2021-10-26 05:15:14 ERROR 404: Not Found.
```
And because of that, it is not possible to compile tvheadend, it ends
with following error:
```
In file included from src/input/mpegts/tvhdhomerun/tvhdhomerun.c:25:0:
src/input/mpegts/tvhdhomerun/tvhdhomerun_private.h:27:10: fatal error: libhdhomerun/hdhomerun.h: No such file or directory
#include <libhdhomerun/hdhomerun.h>
^~~~~~~~~~~~~~~~~~~~~~~~~~
compilation terminated.
```
Let's fix it by updating libdhdhomerun to newer version.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* there are reports that newer versions don't work on 19.07.x
* revert to older README to describe this older version
Signed-off-by: Stan Grishin <stangri@melmac.net>
(cherry picked from commit 7bb2ccd4e1)
While a pinned/working version of setuptools-scm is installed (by
python-zipp) by the time this package is compiled, pinning the version
in this package is still the correct thing to do.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* update to [2021-09-27](da2501f542)
* fixes https://github.com/aarond10/https_dns_proxy/issues/125
* restart instead of reload on interface hotplug
* fixes https://github.com/openwrt/packages/issues/16794
* produce output and log entries on service start/stop
* prevent unnecessary dnsmasq restarts if service has previously updated dnsmasq settings
* allow both named and typed dnsmasq instance settings to be updated
* update 010-fix-cmakelists patch file
Signed-off-by: Stan Grishin <stangri@melmac.net>
(cherry picked from commit f8d16338da)
* 0.4.4 is not an LTS series, people running tor relays with 0.4.4 will
be evicted from the tor network. 0.4.5 is an LTS series
* fix building without OpenSSL engine support (from e30f0480c8)
* refresh patches
Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
The recent version of setuptools-scm depends on tomli, which has some build issues.
Older one works.
Suggested-by: Jeffery To <jeffery.to@gmail.com>
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Avoid parallel relinking and usage of the host perl binary by wrapping
its usage around flock calls.
Sometimes, two packages will try to relink the static host perl binary
at the same time. Neither of them will have the other's module linked
in, and one of them will unavoidably clobber the other one's binary.
This will lead to errors when a package will not be able to find a
module that was supposed to be installed.
To fix that, an exclusive flock is used when relinking, with a 900
seconds timeout to avoid locking up the build process forever.
This is not enough because the binary may be concurrently used to build
another module package; perl is used in Configure, Compile, and Install
procedures. If timing is right, a package will fail with a "permission
denied" error.
So a shared flock call is added in Configure, Compile, and Install
definitions for host and target, with a shorter, 300 seconds timeout.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 1e18c4324f)
Update nano editor to version 5.9.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 38143e6f8b)
(cherry picked from commit e155b3d293)
On hosts that have pcapnav-config installed, there is host lib leakage.
From config.log:
LNAVLIB='-L/usr/lib64 -lpcapnav -lpcap'
LNAV_CFLAGS='-I/usr/include'
Fix this by disabling pcapnav-config, which isn't available anyway.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
(cherry picked from commit e4b8fec79c)
On Arch Linux, tcpreplay is picking up the host dnet-config and adding
OS paths, thereby breaking compilation. The easiest solution is to add
libdnet support as the previous commit fixes dnet-config on OpenWrt.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit f9f216a066)
It tries to link to host libraries for some reason. Add autoreconf to
fix. Also remove redundant prefixes.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 87177eef75)
Contains following list of changes:
ab4c3471b261 tests: add cram based unit tests
7b4e3241e1bd tests: add cgi-io built with clang sanitizers
21831f45d16d Disable session ACLs during unit testing
2f525417b5df Add initial GitLab CI support
57f1c4f18cb6 Add .gitignore
09f9ac5066ee Fix off-by-one in postdecode_fields
ed8ce0d5d28b Add fuzzing of utility functions
a61581819800 Add fuzzing of multipart_parser
6b0615b728ed Refactor utility functions into static library
a0ed2c9a7a72 Fix clang compiler errors
232659da19a4 Fix possible NULL dereference
8e5719b37a67 Fix warnings reported by clang-10 static analyzer
b99aa8a64cca Remove Makefile
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 351e4e01c5)
No functional changes, just moved the sources into out of tree
project[1] so it's going to be easier to do CI with unit testing,
fuzzing etc.
1. https://git.openwrt.org/?p=project/cgi-io.git;a=shortlog
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 08be327942)
- Change URL of the website and for PKG_SOURCE_URL
- Change TITLE and description
- Remove PKG_BUILD_DEPENDS, PKG_UNPACK as they are not necessary
- Add src package
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 25e8b2cda2)
This is cosmetic only, since openssl is the first one being defined, but
it avoids a warning in scripts/config, after upgrading to kconfig-v5.6:
tmp/.config-package.in:102839:warning: choice default symbol
'DNSDIST_OPENSSSL' is not contained in the choice
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit dbe11776ed)
The "-s -w" flags in GO_PKG_LDFLAGS tells the Go compiler to strip the
binaries it produces. Since the default Go package build process will
strip binaries when CONFIG_USE_STRIP or CONFIG_USE_SSTRIP are selected,
these flags are unnecessary.
When CONFIG_NO_STRIP is selected, these flags override the user's
intention of building unstripped packages.
This removes these flags for all relevant packages.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
with PIC enabled, build fails with
ld: access/gist/gistproc.o: in function `rtree_internal_consistent':
gistproc.c:(.text+0x188): relocation truncated to fit: R_AARCH64_LD64_GOTPAGE_LO15 against symbol `DirectFunctionCall2Coll' defined in .text section in utils/fmgr/fmgr.o
ld: gistproc.c:(.text+0x188): warning: too many GOT entries for -fpic, please recompile with -fPIC
ld: final link failed: symbol needs debug section which does not exist
collect2: error: ld returned 1 exit status
Related-to: 8e9ad7bb51
Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
This fixes compilation issues with ASLR PIE enabled
We were compiling with '-g -DDEBUG'
https-dns-proxy_2021-07-29-*_arm_cortex-a9_vfpv3-d16.ipk
shrink from 19514 to 19095
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit 374e1dd56e)
'cp' fails with a text file busy error if it tries to overwrite an
executable file that is running. 'install' unlinks the file first, so
it will not cause the problem.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 47f98d7030)
When installing a host perl module, the host perl binary in the staging
dir is replaced by using 'cp'. However, if the binary is running in a
parallel job, cp will fail with a text file busy error. Use
$(INSTALL_BIN), which unliks the file first to avoid the error.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 19c7496648)
* update binary to the latest commit (2021-07-29) to fix#16222 and #16239
* add hotplug.d/iface file and update Makefile to install it
* use Cloudflare's and Google's bootstrap DNS if bootstrap DNS is missing
* minor improvements in append_bool function
* add append_counter function for verbosity setting
* add append_bootstrap function (and supporting functions) to parse/sanitize bootstrap setting
* move firewall array from 'main' instance to the first proxy instance
* delete useless 'main' instace
Signed-off-by: Stan Grishin <stangri@melmac.net>
Include default configuration files to have something to start from.
Also include snort2lua to help convert snort2 rules to snort3 to also
help with bootstrapping the configuration.
Signed-off-by: Michal Hrusecky <michal.hrusecky@turris.com>
- Bump yggdrasil-go version to v0.4.0
- Update ygguci tool for compatibility with the new yggdrasil-go version
- Yggdrasil's config file is now generated in a separate command before running the daemon
Signed-off-by: George Iv <zhoreeq@users.noreply.github.com>
(cherry picked from commit e135c4c867)
bugfix: domain names bypass
rename config file
update Makefile
updated README link
updated shellcheck compatibility
support for 21.02.0-rc2 and later
updated code for interface triggers
add newline to test.sh
Signed-off-by: Stan Grishin <stangri@melmac.net>
This release includes security fixes like:
CVE-2021-31810: Trusting FTP PASV responses vulnerability in Net::FTP
CVE-2021-32066: A StartTLS stripping vulnerability in Net::IMAP
CVE-2021-31799: A command injection vulnerability in RDoc
We ordinally do not fix Ruby 2.6 except security fixes, but this release
also includes some regressed bugs and build problem fixes.
Ruby 2.6 is now under the state of the security maintenance phase, until
the end of March of 2022. After that date, maintenance of Ruby 2.6 will
be ended.
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
Makefile changes include:
* Include syslog output module
* Move main binary (back) to /usr/sbin, as it is system administration
related and requires superuser privileges
New patches:
* 003-add-space-for-null-byte.patch - from
374cfd2cab
* 004-more-specific-library-linking.patch - from
27b57d9da3
* 005-use-c99-format-macro-constants.patch - from
https://github.com/fln/addrwatch/pull/28
Init script changes include:
* Fix command-line option names and format (from
https://forum.openwrt.org/t/cant-start-addrwatch-service/60499/3)
* Always use the --quiet command-line option, as the procd instance is
not configured to capture stdout/stderr
* Change the syslog config option to start the syslog output module
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
Switch to standard tarball to avoid autoreconfig.
Fix license information.
Add PKG_BUILD_PARALLEL for faster compilation.
Add PKG_INSTALL for consistency with other packages.
Removed upstreamed patches. Refresh remaining one.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit f1a7d509b5)
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
- rename the section instance to yggdrasil (feat. request)
- allow zone to cover both ip4 and ip6 fam
Signed-off-by: William Fleurant <meshnet@protonmail.com>
(cherry picked from commit 2baab77b77)
For now, disable mqtt as it was automatically enabled as the build
system finds compiled libpaho-mqtt-c and requires dependency.
---
Here is the output:
Package syslog-ng is missing dependencies for the following libraries:
libpaho-mqtt3c.so.1
---
This is a new feature since syslog-ng 3.33.1 and if anyone is interested
in it, it can be enabled.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit e319e89fde)
- Release notes:
https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-3.33.1
- Bump version in config
It fixes:
WARNING: Configuration file format is too old, syslog-ng is running in compatibility mode. Please update it to use the syslog-ng 3.33 format at your time of convenience. To upgrade the configuration, please review the warnings about incompatible changes printed by syslog-ng, and once completed change the @version header at the top of the configuration file; config-version='3.31'
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 2b4be08a8c)
While bumping czmq to version 4.2.1 from master branch into OpenWrt
19.07, it automatically detects nss when compiled before czmq.
These steps can verify this:
make package/nss/compile V=s
make package/czmq/compile V=s
Then czmq requires many dependencies:
Package czmq is missing dependencies for the following libraries:
libnspr4.so
libnss3.so
libnssutil3.so
libplc4.so
libplds4.so
libsmime3.so
libsoftokn3.so
libssl3.so
And this fails. If you are using SDK and wants to have just a few
packages then czmq gets compiled if any of those packages are not
present in build system.
This was also mentioned in the release notes for czmq 4.2.1:
https://github.com/zeromq/czmq/releases/tag/v4.2.1
> Note for packagers: NSS can now be used and linked against to avoid using
an internal embedded reimplementation of SHA. It is enabled by default if
present.
NSS was disabled before, so let's disable it.
This is required only for OpenWrt 19.07 as this is done differently in OpenWrt 21.02 and OpenWrt
master and czmq is compiled there.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Fixes:
CVE-2019-17567
CVE-2020-13938
CVE-2020-13950
CVE-2020-35452
CVE-2021-26690
CVE-2021-26691
CVE-2021-30641
CVE-2021-31618
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(partially cherry picked from commit 6dfd07097d)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
[removed patch, which is not in OpenWrt 19.07 branch, used integer in
PKG_RELEASE instead of autorelease]
By default, there was used sks-keyservers.net pool, which has invalid
SSL certificate and they also announced that their service is deprecate
and no longer maintained.
Use the same GPG server as LXC is using by default in the newer
releases.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Backport from 21.02 in order to satisfy dependencies of snort3 to allow
upgrade to stable version of snort3 from beta available now.
Signed-off-by: Michal Hrusecky <michal.hrusecky@turris.com>
The luci app scan the script and search for params in the form of
$required_params.
This script use the form "${required_params}" and cause confusion
with the luci app by hiding needed values. Fix this by using the
standard way to declare required params following other ddns scripts.
Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
This reverts commit 29da5d65b6.
That fix doesn't work fully correct as the egg directory has version 0.0.0.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
Fixes https://github.com/openwrt/packages/issues/15988
It seems that the newer setuptools-scm package (6.0.1) has some
Python3-only syntax.
For the 19.07 release, where Python2 is still around this causes the
python-dateutil package to fail to build.
See https://github.com/pypa/setuptools_scm/issues/541
However, removing 'setuptools-scm' from the build also works.
This change does that.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
Building the xr_usb_serial module fails for recent 4.14 kernel with
CONFIG_PM enabled:
xr_usb_serial_common.c:1574:15: error: 'ASYNCB_INITIALIZED' undeclared
(first use in this function); did you mean 'RCU_INITIALIZER'?
Use tty_port_initialized in order to determine the status of the TTY
port.
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 69cf7836df)
Fixes the following security issues:
* CVE-2021-25216 - A specially crafted GSS-TSIG query could cause a buffer
overflow in the ISC implementation of SPNEGO.
* CVE-2021-25215 - named crashed when a DNAME record placed in the ANSWER
section during DNAME chasing turned out to be the final
answer to a client query.
* CVE-2021-25214 - Insufficient IXFR checks could result in named serving a
zone without an SOA record at the apex, leading to a
RUNTIME_CHECK assertion failure when the zone was
subsequently refreshed. This has been fixed by adding an
owner name check for all SOA records which are included
in a zone transfer.
Signed-off-by: Noah Meyerhans <frodo@morgul.net>
Maintainer: @neheb / @BKPepe / @zhanhb
Compile tested: ipq806x, generic, netgear_r7800, master
Run tested: ipq806x, generic, netgear_r7800, openwrt-19.07
Description:
Squid now only support HTTPS proxy in TCP tunnel mode (e.g. `ssl_bump splice all`):
https_port 3128 ssl-bump tls-cert=/etc/squid/squid.pem generate-host-certificates=on
ssl_bump splice all
In order to operate in SSL Bump mode, we need to compile with `--enable-ssl-crtd` for following configuration:
https_port 3128 ssl-bump tls-cert=/etc/squid/squid.pem generate-host-certificates=on
sslcrtd_program /usr/lib/squid/security_file_certgen -s /car/cache/squid/ssl_db -M 4MB
ssl_bump stare all
ssl_bump bump all
This PR switch the `SQUID_enable-ssl-crtd` into `default y`, therefore default enable SSL Bump mode.
Signed-off-by: Wong Hoi Sing Edison <hswong3i@pantarei-design.com>
(cherry picked from commit dbda77686d)
With openwrt/openwrt@8dcc108760, the ARM
FPU compiler options are no longer part of CONFIG_TARGET_OPTIMIZATION.
This updates various packages that look for NEON/VFP support to search
CONFIG_CPU_TYPE instead.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
Unfortunately, meson's check is totally broken.
Fortunately, it's fairly easy to workaround.
Fixes compilation with all ARM platforms that don't support NEON.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 91e80e5442)
Turns out, packages like mpd that use pkgconfig to find pulseaudio
end up using host paths.
Fixes compilation with at least mpd.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 21f67bf599)
Converted to use meson for compilation speed.
Removed libwrap dependency. Upstream no longer supports it.
Removed intltool and glib2 host dependencies. They seem to be no
longer needed.
Removed upstream patch.
Minor cleanups.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 78d84d4c9c)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
[rebased on commit from master branch]
Fixes two CVEs:
CVE-2020-25613: Potential HTTP Request Smuggling Vulnerability in WEBrick
CVE-2021-28965: XML round-trip vulnerability in REXML
After this release, ruby 2.6 is now in security maintenance phase.
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
Fix log spam:
daemon.err netdata[2090]: PROCFILE: Cannot open file '/proc/sysvipc/shm'
This is caused by a non existant /proc/sysvipc/shm because of the
CONFIG_PROC_STRIPPED option that is enabled by default in the kernel
generic target config
Signed-off-by: Tiago Gaspar <tiagogaspar8@gmail.com>
(cherry picked from commit 5f65d87bb7)
This is dependency of luci-app-lxc and when users install that package
it is no way clear that they have to reload rpcd to get it working
correctly. Without it container listing does not work.
In general this reload should be in this package simply because other
rpcd-mod-* packages reload rpcd as well.
Signed-off-by: Karel Kočí <karel.koci@nic.cz>
(cherry picked from commit 54b6116d7d)
MacOS ignores Bonjour services for which TXT records are not returned. This changes forces umdns service to return a TXT record (`daemon=ksmbd`) for the ksmbd service. The exact content is unimportant and to the best of my knowledge nothing reads the `daemon` tag.
Symptoms of the problem (which are also debugging steps):
* Finder refuses to open the OpenWRT "computer" in the Network list.
* Discovery.app (Bonjour Browser) lists the _ssh._tcp service, but the submenu for it doesn't unfold and no address is shown.
* `dns-sd -L OpenWrt _smb._tcp` doesn't return any address.
Signed-off-by: Kirill Nikolaev <cyril7@gmail.com>
(cherry picked from commit 272b0a5c18)
Major change are:
Fix an issue that directories appear as files when using windows
backup.
Fix xfstests generic/241 failure on life test.
Update ksmbd shutdown and debug print on/off using ksmbd.control in
cifsd.rst.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 851b9b252f)
Major changes are:
Fix kernel oops from fuse+ntfs driver.
Fix the issue of change the directory to the file using Nautilus
client.
Fix ksmbd build break with the latest linux-5.12-rc1.
Fix potential memleak and use after free.
Fix use after free from KASAN(racy issue)
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 8e3a4adea3)
Major changes for version 3.3.5 are:
- Add support for version 4 dos attribute structure of samba.
- Implement maximal allowed desired access.
- Fix several error handling.
- Fix a few smbtorture failures.
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
(cherry picked from commit 71aef26ecb)
Major change are:
ksmbd.control -s terminate ksmbd.mountd as well as kernel server.
Update configuration.txt and README.
Turn off smb2 leases by default again.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 7a1a8f3659)
Major changes for version 3.3.5 are:
- Rename "streams" parameter to "vfs objects = streams_xattr".
- Enable smb2 leases by default.
- Ignore ksmbd.subauth creation failure.
- Fix bugs that related to guest ok = yes.
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
(cherry picked from commit 58f91090f5)
Even it's only cosmetic and should not affect the function of regular system,
fix the name of the IPKG_INSTROOT variable.
Typo was added long ago with 8400c9a6ec.
Signed-off-by: Sven Roederer <devel-sven@geroedel.de>
(cherry picked from commit f25f49a8b7)
The library embeds the result of "git describe" inside the source code, making the binary result dependent of the particular commit being used in the build root when building inside a git working copy.
As this is unnecessary information, remove this option and fallback to the default "unknown", which is also the value compiled by tools that do not clone but export the openwrt base tree.
Signed-off-by: Giovanni Giacobbi <giovanni@giacobbi.net>
Recently, I updated icu for issues with node feed, but it broke
compiling of php7.
Error:
/foo/target-aarch64_cortex-a53_musl/php-7.2.34/ext/intl/collator/collator_sort.c:349:26: error: 'TRUE' undeclared (first use in this function)
collator_sort_internal( TRUE, INTERNAL_FUNCTION_PARAM_PASSTHRU );
^~~~
/foo/target-aarch64_cortex-a53_musl/php-7.2.34/ext/intl/collator/collator_sort.c:349:26: note: each undeclared identifier is reported only once for each function it appears in
/foo/target-aarch64_cortex-a53_musl/php-7.2.34/ext/intl/collator/collator_sort.c: In function 'zif_collator_asort':
/foo/target-aarch64_cortex-a53_musl/php-7.2.34/ext/intl/collator/collator_sort.c:543:26: error: 'FALSE' undeclared (first use in this function); did you mean 'FILE'?
collator_sort_internal( FALSE, INTERNAL_FUNCTION_PARAM_PASSTHRU );
^~~~~
FILE
make[3]: *** [Makefile:1031: ext/intl/collator/collator_sort.lo] Error 1
More details:
https://github.com/php/php-src/commit/8eaaabd
Backport of patch from PHP7.3 didn't work for me, but this one was suggested that
Homebrew is using it and it works for me. However, PHP7.2 is EoL.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Maintainer: me
Compile tested: head r15324-920b692, aarch64, x86_64
Run tested: (qemu-5.2.0) aarch64
Description:
Update to 68.2
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry picked from commit d6317132dd)
It updates to CLDR 38. New features including locale-dependent smart unit preferences (road distance, temperature, etc.) and locale ID canonicalization conformant with CLDR.
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry picked from commit 4f3a8c1535)
CentOS 7's GCC is quite old and does not put max_align_t under std.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 6255a77128)
Unicode 13 & CLDR 37. Bug fixes for date and number formatting, enhanced support for user preferences in the locale identifier. LocaleMatcher code and data improved. Number skeletons have a new “concise” form that can be used in MessageFormat strings.
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry picked from commit e3be3aadc1)
Tmate is a fork of tmux. It provides an instant pairing solution.
For more details, see https://tmate.io.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit ccfe1bfa50)
Fixes two CVEs relating to UPnP.
Removed libuuid dependency. It is not used.
Remove clock_gettime hack. It seems to have been fixed.
Removed upstream patches.
Refreshed the other ones.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit f568979648)
With this change, the interface status is no longer read from the mwan3 ubus.
The status of the interface is read directly from the status directory.
This was already implemented in the master with the
commit c07f5230be.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Fix installed paths. After e52d0487e88c3c8c57e1310d1a02b18eae0d142e
upstream, this bug was exposed.
Instead of working around it, fix the patch.
After this, everything consistently gets installed to ipkg-install/usr.
Minor Makefile reorganization.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit b75f250f3b)
Remove upstreamed patch and add a new one to fix compilation.
Add some more configure options.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit a05db1acfe)
CMake supports Ninja for faster compilation and less bugginess when it
comes to parallel compilation. That is, some CMake packages currently
have PKG_BUILD_PARALLEL set where it is not needed with ninja.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 54449e9c66)
Docs say it also supports MQTT 5.0.
Added to description.
Updated title as on pypi.org
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
(cherry picked from commit ee0e11c1ab)
definition of PSELECT_COMPAT could be removed many years ago, is no longer needed
Signed-off-by: Jan Hak <jan.hak@nic.cz>
(cherry picked from commit 4069bb1e72)
Fixes CVEs:
- CVE-2020-35498
- In DPDK: CVE-2015-8011 and CVE-2020-27827
- In LLDP: CVE-2019-14818, CVE-2020-10722, CVE-2020-10723 and CVE-2020-10724
Removed patches:
- 0001-compat-Include-confirm_neigh-parameter-if-needed.patch because they
are included in this release as it was backported
- 0010-acinclude-Fix-build-with-kernels-with-prandom-moved-.patch
included in this release as it was backported
Other patches were refreshed.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Includes fixes for:
* CVE-2021-3177 - ctypes: Buffer overflow in PyCArg_repr
* CVE-2021-23336 - urllib parse_qsl(): Web cache poisoning - semicolon
as a query args separator
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
Includes fix for security issues:
* CVE-2020-8625: BIND servers are vulnerable if they are running an
affected version and are configured to use GSS-TSIG features.
Disable backtrace functionality, as it is unreliable across
architectures and generally only supported by upstream on amd64
Remove a patch that has been incorporated upstream
Signed-off-by: Noah Meyerhans <frodo@morgul.net>
This kernel module is already set for target/linux/generic/config-4.14
in OpenWrt 19.07 branch. This solves a problem that this package can not
be installed on the router:
* satisfy_dependencies_for: Cannot satisfy the following dependencies for kmod-fs-ksmbd:
* kmod-crypto-arc4
* opkg_install_cmd: Cannot install package kmod-fs-ksmbd.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Try to fix license according to SPDX.
Add PKG_LICENSE_FILES.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit f8e36f9fd6)
[use pypi.mk for Python package]
Currently, we called `/usr/libexec/login.sh` as login command, but unfortunately the auth
is disabled by default in it[1], and this is really serious as it could be a free "backdoor"
for any spoiler who has conntectd to the router via LAN or wireless.
In my option, it shouldn't be exposed to anyone without auth, so I set the default login
command to `/bin/login`. And for those who really want that, they can do it themselves.
1. `login.sh` adjusts whether use authentication or not from system config named ttylogin,
which is set to disabled by default. See package/base-files/files/bin/config_generate#L243.
Signed-off-by: Tianling Shen <cnsztl@project-openwrt.eu.org>
Backported from f45bb2981d
Openwrt is a single user system. So keepalived is runnig as root.
If we add the config options `script_user root` and
`enabled_script_security' the following warnings are gone.
> local1.info Keepalived_vrrp[5382]: SECURITY VIOLATION - scripts are
being executed but script_security not enabled.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 1b1ba71063)
This fixes a runtime startup error on system which does not have a
toplevel runtime directory for the pid file. On openwrt the pid is
located at /var/run and not on /run. To fix that add a configure option to
move the pid location to /var/run.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit bc98aaa3f7)
* Patch adapted for the branch so that it can be applied correctly
* fix for possible exploit #13758
* sanetize all external template/config inputs
* fix some shellcheck warnings
Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
This reverts commit d8f0ebaa3d.
Versions 1.7.2 and above mandate CMake 3.1.7, making this unsuitable
for backporting.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
musl doesn't support fts. But with the extra package musl-fts installed,
libzip picks up the fts header and fails at the linking stage:
zipcmp.c:(.text.startup+0x130): undefined reference to `fts_open'
/home/sk/tmp/openwrt/staging_dir/toolchain-mips_24kc_gcc-8.3.0_musl/lib/gcc/mips-openwrt-linux-musl/8.3.0/../../../../mips-openwrt-linux-musl/bin/ld: zipcmp.c:(.text.startup+0x172): undefined reference to `fts_read'
So with musl-fts we need to link in libfts. To address that this commits
patches the cmake setup to check if fts is available in libc itself or
in any external libfts.
So when musl-fts is installed on the system the setup will be the
following:
musl: use libfts
uclibc: use fts from libc
glibc: like uclibc
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
(cherry picked from commit 0c381f7c7a)
This introduces libzip which is e.g. a dependency for upcoming upgrade
of PHP to version 7.4.
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit a4a98d5efe)
Switched to upstream tarballs as they are now available
Removed autoreconf as a result.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 18f3410ac4)
Removed autoreconf as a result.
Unfortunately, the two versions are not identical. Bumped PKG_RELEASE
to deal with it.
Disable static libraries as they're fairly useless.
Adjusted filepaths.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 4e203a1949)
The hash was correct but not the source version. No idea how this happened
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 7c7a922cb0)
Switched to upstream tarballs as they are now available.
Removed autoreconf as a result.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit e480fa8b33)
This is needed as the options loop is totally broken and doesn't accept
both -f and -z together.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 7ae3bac516)
usbmuxd must be ran for many of the idevice tools. Added an init
script to make this easier.
Added myself as maintainer.
Fix PKG_CVE_ID.
Added config directory.
Placed in a submenu for easier readability.
Add extra tool
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit fb7ed3d996)
Fixes compilation with libimobiledevice.
Small cleanups for consistency.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 9b21f69404)
Upstream created proper tarballs. Switch to those.
Removed autoreconf as a result.
Adjusted filepaths.
Removed upstreamed patch.
Disabled static libraries as they're not useful.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 4831939255)
Upstream created proper tarballs. Switched to those.
Removed autoreconf as a result.
Adjusted filenames.
Got rid of static compiles as they're pretty useless.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 38ea3e84f8)
The release of checkra1n necessitated a new release.
Removed inactive maintainer.
Fixed license info.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 062cf276a2)
Upstream finally got a proper tarball. Switched to that.
Remove autoreconf as it's no longer needed.
Adjusted new filepaths.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit d082258c3e)
Add myself as maintainer.
Add PKG_CPE_ID.
Switch to submenu for easier readability.
Change libplist-utils name to the utility.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 130b770a8b)
The release of checkra1n necessitated a new release.
Removed inactive maintainer.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit a856d6604b)
Also added the capability to use uclibcxx instead of libstdcpp.
Several size optimizations.
Fixed up Makefile to be up to standards.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 5049588c46)
Now that tunnels have been fixed with openwrt commit
c9c7b4b3945c01c2aadf3ef5d9a77c8200db80f1 for stable branch 19.07
ping with src ip is no longer needed.
fixes#13655
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* Update commit message
Signed-off-by: Aaron Goodman <aaronjg@stanford.edu>
Since this package has been abandoned, I don't mind taking it over.
If there are issues with it, I can also investigate, and be a point-man.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
(cherry picked from commit 2a5fb656f2)
Unlike ipv4, this option is supposed to be an IP address, otherwise, an
error occurs on startup:
can't parse "br-lan" as valid IPv6 listening address
Signed-off-by: Jitao Lu <dianlujitao@gmail.com>
(cherry picked from commit 7077fd8c79)
This add an option to ignore ext_ip reserved
Enable this option in config by default.
Fixes: #13773
Signed-off-by: Chen Minqiang <ptpt52@gmail.com>
(cherry picked from commit b76aa99194)
It seems even modern stuff doesn't support v2 correctly. The miniupnp
suite does but other stacks seem to lack support. Default to v1 to
avoid the headache.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 7891124d6c)
* prevents the creation of an invalid json structure
* add more space to the domain column on cli
* removed test.sh script from package
Signed-off-by: Dirk Brenken <dev@brenken.org>
1.clang ld not supports symvers
2.macos has not mutex_lock, use pthread_mutex_lock instead
3.macos not define SO_PEERCRED, use LOCAL_PEERCRED instead
Signed-off-by: Liangbin Lian <jjm2473@gmail.com>
(cherry picked from commit 1a9323064c)
Aside from updating the package, this modifies the Makefile to pull the
sources from GitHub rather than SourceForge. The exif project recently
moved to GitHub.
Signed-off-by: W. Michael Petullo <mike@flyn.org>
(cherry picked from commit 818f2d9dff)
Fixes:
CVE-2018-20030, CVE-2020-13114, CVE-2020-13113, CVE-2020-13112, CVE-2020-0093, CVE-2019-9278, CVE-2020-12767, CVE-2016-6328, CVE-2017-7544
Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
Instead, let sed do the work since it's already being used.
Signed-off-by: Brian J. Murrell <brian@interlinx.bc.ca>
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
[ update PKG_VERSION ]
- DNS Flag Day 2020
(default EDNS buffer size changed from 4096 to 1232 bytes)
-- Added patch, which should be part of the next release
It fixes an issue while cross-compilation (I linked it in the commit
message with issue link)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit d442033941)
This fixes the following build failure:
[ 66%] Generating ../doc/xml/ftdi_8c.xml
warning: Tag 'PERL_PATH' at line 2083 of file 'Doxyfile' has become obsolete.
To avoid this warning please remove this line from your configuration file or upgrade it using "doxygen -u"
warning: Tag 'MSCGEN_PATH' at line 2105 of file 'Doxyfile' has become obsolete.
To avoid this warning please remove this line from your configuration file or upgrade it using "doxygen -u"
[ 72%] Generating ftdi1_doc.i
Traceback (most recent call last):
File "/home/stijn/Development/LEDE/source/build_dir/target-x86_64_musl/libftdi1-1.4/python/doxy2swig.py", line 457, in <module>
main()
File "/home/stijn/Development/LEDE/source/build_dir/target-x86_64_musl/libftdi1-1.4/python/doxy2swig.py", line 453, in main
convert(args[0], args[1], not options.func_def, options.quiet)
File "/home/stijn/Development/LEDE/source/build_dir/target-x86_64_musl/libftdi1-1.4/python/doxy2swig.py", line 430, in convert
p = Doxy2SWIG(input, include_function_definition, quiet)
File "/home/stijn/Development/LEDE/source/build_dir/target-x86_64_musl/libftdi1-1.4/python/doxy2swig.py", line 72, in __init__
f = my_open_read(src)
File "/home/stijn/Development/LEDE/source/build_dir/target-x86_64_musl/libftdi1-1.4/python/doxy2swig.py", line 44, in my_open_read
return open(source)
FileNotFoundError: [Errno 2] No such file or directory: '/home/stijn/Development/LEDE/source/build_dir/target-x86_64_musl/libftdi1-1.4/doc/xml/ftdi_8c.xml'
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Acked-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit c131843663)
The path changed since 274506803a
Fixed.
Also took the time to convert to procd.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit c14ba8bd77)
openconnect v8.10 supports 4 VPN protocols
--protocol=anyconnect Compatible with Cisco AnyConnect SSL VPN, as well as ocserv (default)
--protocol=nc Compatible with Juniper Network Connect
--protocol=gp Compatible with Palo Alto Networks (PAN) GlobalProtect SSL VPN
--protocol=pulse Compatible with Pulse Connect Secure SSL VPN
This patch allows user to specify protocol use the new "vpn_protocol"
option and deprecate the old option "juniper" which seems to be missing in
the current openconnect client.
Signed-off-by: Mengyang Li <mayli.he@gmail.com>
* switch all safesearch providers to dynamic ips (derived from cname)
* made the new safesearch approach compatible with bind-nslookup
* removed 3.x config compatibility code
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 4b0d029bb5)
Also updated compability options to build in supported by musl format
Signed-off-by: Vladimir Ulrich <admin@evl.su>
(cherry picked from commit 4315b0e4f2)
Disable ebpf plugin as in OpenWrt there is no package libbpf.
- With that, I need to introduce patch, which is not merged into netdata,
yet. Without it, I still got during cross-compilation this error:
checking for externaldeps/libbpf/libbpf.a... configure: error: cannot check for file existence when cross compiling
- And yes, the flag was there.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 5ba339b49a)
The substring "release_" does not reflect the version number.
In addition, package names will be shorter.
(backported from commit 11aa0b9)
Signed-off-by: Alexey Dobrovolsky <dobrovolskiy.alexey@gmail.com>
This meta-package contains only dependencies for modules needed in
FreeRADIUS default configuration.
This commit adds missing description and install sections.
(backported from commit 7737abf)
Signed-off-by: Alexey Dobrovolsky <dobrovolskiy.alexey@gmail.com>
Conffile was set for OpenWrt master, but it is not present in OpenWrt
19.07. When /etc/config/nextdns is not set as conffile, it gets
overwritten by each update of nextdns and the user needs to set up it again.
This can be simply reproduced by these steps:
opkg update
opkg install nextdns
edit or add smth to /etc/config/nextdns, save it
then do: opkg install nextdns --force-reinstall
And /etc/config/nextdns gets overwritten by default values
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
This fixes issues:
syslog-ng[3895]: WARNING: Configuration file format is too old, syslog-ng is running in compatibility mode. Please update it to use the syslog-ng 3.29 format at your time of convenience. To upgrade the configuration, please review the warnings about incompatible changes printed by syslog-ng, and once completed change the @version header at the top of the configuration file; config-version='3.26'
Fixes: 06f3ac21b4 ("syslog-ng: update to
version 3.29.1")
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 1607774df4)
- Remove PKG_BUILD_DEPENDS as it is no longer necessary.
- The Python3 is already included in DEPENDS.
- Remove PKG_BUILD_DIR and PKG_UNPACK was for dual Python version.
- Change TITLE and description
- Add source package
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 267796c316)
- Change TITLE and URL to better one
- Add source package
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 19e12971b8)
Commit eee7ce2b changed gstreamer1's build options, and this broke
some applications.
First, -Doption-parsing=false is intended for very specific embedded
applications rather general packages. Please see:
https://github.com/openwrt/packages/pull/8847https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/388
Second, -Dregistry=false seems to break plugin discovery. Symptoms of
this include broken applications and gst-inspect-1.0 listing zero plugins.
Fixes#13531.
Signed-off-by: W. Michael Petullo <mike@flyn.org>
(cherry picked from commit 10aa094d7f)
Update collectd to version 5.12.0.
* Refresh patches
* Remove upstreamed patch 920-fix-ubi-data-source-type.patch
* Backport a patch from upstream to fix a missing define
(920-backport-netlink-reg-noerror.patch)
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 28747825df)
Currently the init script generates a config file from uci, that has the
include line before the interval line. This means, that anything happening
in the include directory does not yet see the changed Interval.
Moving the include line before the uci generation process fix this issue.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 50f56c2ede)
Currently the values are stored in the ubi plugin as data source type
`counter`. But this makes no sense, because the values change very slowly
and I don't want to know the rate of change. It is better to store the
value as data source type `gauge`. Then I can see the current value.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit e7054e7e79)
This fixes an error in the previous package when building against recent
OpenWrt releases:
In file included from /builder/shared-workdir/build/sdk/staging_dir/target-x86_64_musl/usr/include/dovecot/lib.h:50,
from ext-variables-common.c:4:
ext-variables-common.c: In function 'ext_variables_load':
ext-variables-common.c:91:14: error: expected ')' before 'PRIuSIZE_T'
"(>= %"PRIuSIZE_T" bytes)",
Signed-off-by: W. Michael Petullo <mike@flyn.org>
(cherry picked from commit c502f261d3)
It seems upstream broke it. This in turn broke depending packages.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 5bb13435b7)
Remove upstreamed patches.
Add uClibc++ patch for those that need it.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit e169e2f9c8)
Drops pid files, no longer needed with procd management.
Now properly reloads on reload_config after UCI changes.
Signed-off-by: Karl Palsson <karlp@etactica.com>
[ Fixed two shellcheck warnings and bump PKG_RELEASE ]
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
Canonical radtest start results in an error:
$ radtest bob hello localhost 0 testing123
/usr/bin/radtest: line 1: hostname: not found
(0) Error parsing "stdin": Failed to get value
hostname command is not present in OpenWrt.
Instead, hostname can be obtained from file /proc/sys/kernel/hostname.
added: 005-get-hostname-from-proc-in-radtest.patch
(backported from commit 8b2792a)
Signed-off-by: Alexey Dobrovolsky <dobrovolskiy.alexey@gmail.com>
radtest utility is used in many manuals to check the operation of
radius server.
At the moment all parameters must be specified at startup, for example:
$ radtest bob hello localhost 0 testing123 0 localhost
(backported from commit 6480acd)
Signed-off-by: Alexey Dobrovolsky <dobrovolskiy.alexey@gmail.com>
* update to 4.11.12
* fix optional modules not included on module build (vfs_btrfs, vfs_linux_xfs_sgid)
Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
new upstream, new release taken from ChangeLog[1]:
New maintainers - after a prolonged period of inactivity from Hisham,
the creator and original maintainer, a team of community maintainers
have volunteered to take over a fork at https://htop.dev and
https://github.com/htop-dev to keep the project going.
1. https://github.com/htop-dev/htop/blob/master/ChangeLog
Signed-off-by: John Audia <graysky@archlinux.us>
(cherry picked from commit acbdaf863f)
Several security issures are addressed:
- CVE-2020-8620 It was possible to trigger an assertion failure by sending
a specially crafted large TCP DNS message.
- CVE-2020-8621 named could crash after failing an assertion check in
certain query resolution scenarios where QNAME minimization and
forwarding were both enabled. To prevent such crashes, QNAME minimization is
now always disabled for a given query resolution process, if forwarders are
used at any point.
- CVE-2020-8622 It was possible to trigger an assertion failure when
verifying the response to a TSIG-signed request.
- CVE-2020-8623 When BIND 9 was compiled with native PKCS#11 support, it
was possible to trigger an assertion failure in code determining the
number of bits in the PKCS#11 RSA public key with a specially crafted
packet.
- CVE-2020-8624 update-policy rules of type subdomain were incorrectly
treated as zonesub rules, which allowed keys used in subdomain rules to
update names outside of the specified subdomains. The problem was fixed by
making sure subdomain rules are again processed as described in the ARM.
Full release notes are available at
https://ftp.isc.org/isc/bind9/9.16.6/doc/arm/html/notes.html#notes-for-bind-9-16-6
Signed-off-by: Noah Meyerhans <frodo@morgul.net>
(cherry picked from commit cf61f7f8ef)
it seems that it can lead to segfault in libfreebl3.so
Signed-off-by: Lucian Cristian <lucian.cristian@gmail.com>
(cherry picked from commit 630c19f648)
This is an upstream backport.
Currently on the buildbots, having libffi unavailable leads to long
range build failures.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 0dcde0115e)
Security release. From the changelog:
- In some circumstances, Mosquitto could leak memory when handling PUBLISH
messages. This is limited to incoming QoS 2 messages, and is related
to the combination of the broker having persistence enabled, a clean
session=false client, which was connected prior to the broker restarting,
then has reconnected and has now sent messages at a sufficiently high rate
that the incoming queue at the broker has filled up and hence messages are
being dropped. This is more likely to have an effect where
max_queued_messages is a small value. This has now been fixed. Closes
https://github.com/eclipse/mosquitto/issues/1793
Changelog: https://mosquitto.org/blog/2020/08/version-1-6-12-released/
Signed-off-by: Karl Palsson <karlp@etactica.com>
command-count.h generated by makefile was wrong
when using default shell in mac,
set shell to bash to fix it.
Signed-off-by: Liangbin Lian <jjm2473@gmail.com>
(cherry picked from commit 9bb0962d6e)
* remove 'dshield' and 'sysctl' (discontinued)
* switch 'malwaredomains', 'shallalist' and 'winhelp' to https
* add a second regional list for poland (provided by matx1002)
* update readme
Signed-off-by: Dirk Brenken <dev@brenken.org>
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 5ba498f7c8)
This includes a fix for CVE-2020-16845 (encoding/binary: ReadUvarint and
ReadVarint can read an unlimited number of bytes from invalid inputs).
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
Add a hotplug script to reload nlbwmon's config after interface
ifup actions.
That should improve the detection of the IPv6 LAN address
that can get enabled a bit later in the boot process.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 25dfa20780)
Signed-off-by: Huangbin Zhan <zhanhb88@gmail.com>
Adapted from treewide commit 0ec746ccb6 for just nlbwmon.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Config files
/etc/freeradius3/policy.d/accounting
/etc/freeradius3/policy.d/filter
/etc/freeradius3/proxy.conf
/etc/freeradius3/sites-available/default
and link
/etc/freeradius3/sites-enabled/default
are in the freeradius3 package and are mentioned in the main config file
/etc/freeradius3/radiusd.conf
Thus, they must be explicitly specified in the Makefile.
File
/etc/freeradius3/sites/default
is not included in the package, is not created during installation,
is not mentioned in the main config file and should therefore be excluded
from the Makefile.
Signed-off-by: Alexey Dobrovolsky <dobrovolskiy.alexey@gmail.com>
(cherry picked from commit f6974b8f3c)
From CHANGES_2.4:
SECURITY: CVE-2020-11984 (cve.mitre.org)
mod_proxy_uwsgi: Malicious request may result in information disclosure
or RCE of existing file on the server running under a malicious process
environment. [Yann Ylavic]
SECURITY: CVE-2020-11993 (cve.mitre.org)
mod_http2: when throttling connection requests, log statements
where possibly made that result in concurrent, unsafe use of
a memory pool. [Stefan Eissing]
SECURITY:
mod_http2: a specially crafted value for the 'Cache-Digest' header
request would result in a crash when the server actually tries
to HTTP/2 PUSH a resource afterwards.
[Stefan Eissing, Eric Covener, Christophe Jaillet]
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
When adding suEXEC to the apache package, Alpine's package [1] served as
a template. Not enough attention was paid to the details.
Alpine uses a different layout. So for OpenWrt to use /var/www as
DocumentRoot does not make sense. /var is also volatile on OpenWrt. This
commit removes the configure argument. The default is htdocsdir.
This also does away with uidmin/gidmin 99. The default is 100, which is
fine.
Finally, the suexec binary is moved from /usr/sbin to
/usr/lib/apache2/suexec_dir. Upstream recommends installing suexec with
"4750" (see [2]) and the group set to the user's group. While that would
be possible, it would cause a few headaches on OpenWrt. The group would
need to be changed first in a post-install script and a call to chmod
would need to be made afterward, to make the binary SUID again.
It's easier to hide the SUID binary away from others in a directory.
This way we don't need to use chmod in the post-install script.
[1] https://github.com/alpinelinux/aports/tree/master/main/apache2
[2] https://httpd.apache.org/docs/2.4/suexec.html
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
- prevent rapid overlap in DHCP script updates
- check and allow localhost forwards with specific applications
- add option for rate limiting inbound queries
- change UCI list to table format with Unbound conf references
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
Patches require a bit of rework:
- dropped 010-missing-header.patch
- add 010-do-not-run-test-progs.patch
- re-updated 020-filterh-use-host-built-version.patch
- Makefile.in gets regenerated from PKG_FIXUP:=autoreconf
- added PKG_FIXUP:=autoreconf ; it's easier to patch automake stuff that
big configure scripts
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
(cherry picked from commit dcdceb526e)
Removed most patches. The last was upstreamed and the others can be worked
around using Makefile.
Removed inactive maintainer.
Added PKG_BUILD_PARALLEL for faster compilation.
Fixed license information.
Massive reorganization of Makefile for consistency between packages.
Removed --with-sql options. These are totally broken when cross compiling.
Leaving them out works just as well.
Added cpp patch as the test needs a header.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 496ee7f91b)
Fixed license information.
Update argp dependency to be for non glibc.
Added PKG_BUILD_PARALLEL for faster compilation.
Added --as-needed linker flag for slightly smaller size.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 0cd1a9b537)
The last patch used a macro unavailable with older kernel headers.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 13278007f9)
This is using the input_event struct directly, instead of using the proper
defines.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit ffb7da67a3)
This fixes misleading errors in the status file, and increases buffer
sizes to match the python implementation.
Signed-off-by: Karl Palsson <karlp@etactica.com>
In OpenWrt master branch, there is just /etc/config/gerbera.
It was reported to me that if there is an update of gerbera in OpenWrt
19.07, it overwrites /etc/gerbera/config. So, I removed file extension.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
This reverts commit cde2a77ed3.
Applying this change has shown that it is even quicker to provoke the
race condtition on simultan mwan3 commands execution.
By reversing the change we have the same behaviour as before.
But the race condition on mwan3 execute at the same time still exists.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit b5bd6d757b)
This adjustment of the locks fixes the race condition when a mwan3
hotplug script and a mwan3 command are running at the same time.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 2dac1bcdc9)
The latter requires BUILD_PATENTED, as in master.
Backported linking patches for libebml and libmatroska.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Add also online time value and uptime time value from netifd to the
detail output view.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit b0acbf057e)
If the uci option family is not set in the interface section, then there
is no default value set as in the `config_load / config_get` API.
The problem here is that if the family is not set, the default value ipv4
is normaly assumed. But the comparison fails here because the value is empty
and therefore the dedicated routing table for this interface is not compared
with the other routes from the main table and so not updated.
To fix this set the default value for this config option which is`false`
for enabled and `ipv4` for family.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit bcd13ba95c)
This fixes routing handling. Introduced with the last version update.
The following message disappears on the shell
when mwan3 is called with 'mwna3 restart`.
`Error: Invalid gateway address.`
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
[aaronjg@stanford.edu: fully unset variable and handle ipv4 as well]
Signed-off-by: Aaron Goodman <aaronjg@stanford.edu>
(cherry picked from commit 8e3e6f8dde)
default rule only applied to ipv4 with dest_ip 0.0.0.0/0
and error was hidden when trying to apply it in ip6table
Signed-off-by: Aaron Goodman <aaronjg@stanford.edu>
(cherry picked from commit 2a5e9be83e)
Add double quote to prevent globbing and word splitting where there is
no regression.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit feae9e5742)
This suppress the following output on `mwan3 restart`:
> Dump terminated
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit facf8ea299)
Update netdata to 1.22.1
Disable cloud functionality
Shoehorn patches from FreeBSD's ports repo
Remove cloud notifications and netdata's self-update feature
json-c is no longer optional
Signed-off-by: Daniel Engberg <daniel.engberg.lists@pyret.net>
(cherry picked from commit 626c304d67)
- Add libuv dependency which is now required. Otherwise during
compiling, I have received this error:
configure: error: libuv required but not found. Try installing 'libuv1-dev' or 'libuv-devel'.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 8aa816c816)
The recent update to ffmpeg broke this.
Instead, use the relevant libraries separately.
Added AAC support. AAC is very common and was recently fixed to be
compatible with BUILD_PATENTED.
Explicitly pass all configure arguments, to avoid future breakage.
Remove autoreconf. autotools files are not being patched.
Add PKG_BUILD_PARALLEL for speed.
Other minor cleanups.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit dd77091337)
pulseaudio-daemon depends on alsa-lib, which depends on @AUDIO_SUPPORT.
Enables -full on platforms lacking AUDIO_SUPPORT.
Simplified LDFLAGS slighly.
Removed pointless ICU dependency. I managed to patch meson.build to fix
iconv compilation. The original error was that without the header, it
was prefixing the iconv check with __buildin_ , which does not work
with uClibc-ng.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
The package Makefile contains a PKG_BUILD_DEPENDS=libiconv
line, which apart from being incorrect if libiconv-full is
specified in the build configuration, is also unnecessary,
since the package Makefile already includes nls.mk which
sets PKG_BUILD_DEPENDS appropriately.
Signed-off-by: Ian Cooper <iancooper@hotmail.com>
(cherry picked from commit 645bea6d88)
Switch to zst archives for smaller size.
Removed patches in favor of a better solution for uClibc-ng.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 8c23fef9da)
(changed to gz since 19.07 has no zstd support)
The former can be implemented as a meson argument.
The latter is already default.
No compiled difference, therefore no PKG_RELEASE bump.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 3c9dbc1429)
All the computationally expensive stuff is in the libraries, not the
package itself.
Saves several kilobytes.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit a5e7d0a904)
Switched to CMake for the faster compilation and the simpler Makefile.
Minor Makefile cleanups.
Before:
time make package/libvorbis/compile -j 12
Executed in 24.40 secs fish external
usr time 21.17 secs 0.00 micros 21.17 secs
sys time 3.05 secs 426.00 micros 3.05 secs
After:
time make package/libvorbis/compile -j 12
Executed in 9.19 secs fish external
usr time 11.29 secs 0.00 micros 11.29 secs
sys time 1.43 secs 421.00 micros 1.43 secs
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 0ef247cf5d)
- Fixes CVEs:
CVE-2019-12519
CVE-2019-12520
CVE-2019-12521
CVE-2019-12523
CVE-2019-12524
CVE-2019-12525
CVE-2019-12526
CVE-2019-12527
CVE-2019-12528
CVE-2019-12529
CVE-2019-12824
CVE-2019-12854
CVE-2019-13345
CVE-2019-18676
CVE-2019-18677
CVE-2019-18678
CVE-2019-18679
CVE-2020-8449
CVE-2020-8450
CVE-2020-11945
CVE-2020-14058
CVE-2020-15049
- Remove patch for cross-compilation
The patch should not be included in the OpenWrt at all without any
commit message/description.
Is not needed and there should be used HOST variables instead of BUILD variables (e.g.
HOSTCXX)
However, the BUILDCXX is set in Makefile to HOSTCXX
- Renumber glibc patch and refresh it
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 3401e29aa7)
Added nls.mk as this is now required.
Fixed license information.
Several small fixes and cleanups.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 4426e4c69b)
Converted to CMake for simplicity.
Added upstream patch to use sleep_for instead of deprecated usleep.
Added patch to fix compilation with musl.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit a9abe60ef4)
This backports fixes for security issues, including:
* CVE-2020-14422: Hash collisions in IPv4Interface and IPv6Interface
* CVE-2019-20907: Infinite loop in the tarfile module
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
Fixes CVE-2018-5147
- Change PKG_SOURCE_URL
fatal: unable to access 'https://git.xiph.org/tremor.git/': Failed to connect to git.xiph.org port 443: Connection refused
because they changed the URL of the repository
- Removes PKG_SOURCE_SUBDIR and PKG_SOURCE
Those are already defaults
- Fix indentation in description
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 406d0d9f3f)
Two patches were backported to fix issue openwrt/packages#12737
0002-compat-Fix-ipv6_dst_lookup-build-error.patch
0003-compat-Backport-ipv6_stub-change.patch
One was deleted as it is now part of 2.11.3
0005-datapath-conntrack-fix-include-for-IP6_DEFRAG_CONNTR.patch
Other patches refreshed
Reported-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
Since DSA is enabled, dsa.h is needed. Normally this header is included
implicitly with engine.h but with OPENSSL_API_COMPAT >= 0x10100000L ,
this is not so.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
This package fails to build with newer setuptools, because setuptools
removed the (deprecated) Features feature in v46.0.0[1].
This adapts a commit[2] to remove the use of this feature. (Changes to
code formatting prevent the original commit/patch to be used.)
[1]: aff64ae89e/CHANGES.rst (v4600)
[2]: 3aac426e35
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
This lets the Python build process set _PYTHON_HOST_PLATFORM instead of
forcing an explicit value.
Also:
* Save the target _PYTHON_HOST_PLATFORM value during Build/InstallDev
for use when building target Python packages (in python3-package.mk).
* Use the (mostly) default PYTHON_FOR_BUILD value, instead patch
configure to remove the platform triplet from the sysconfigdata file
name.
* Remove the "CROSS_COMPILE=yes" make variable (there is no indication
that this variable is necessary).
* Force host pip to build packages from source instead of downloading
binary wheels.
Previously, host pip can download universal (platform-independent)
wheels but not platform-specific wheels, because of the custom
_PYTHON_HOST_PLATFORM value. (Packages that do not have universal
wheels would be compiled from source.)
With a correct _PYTHON_HOST_PLATFORM, host pip can install
platform-specific wheels as well. However, the pre-built shared object
(.so) files in these wheels will have the host's platform triplet in
their file names. When target Python packages are built (using the
target's _PYTHON_HOST_PLATFORM), Python will not use these shared
object files.
By forcing host pip to build packages from source, the built shared
object files will not have the platform triplet in their file names.
(Host Python has been patched to remove the platform triplet from file
names.) This allows these packages to be used when building target
Python packages.
(The net effect of this complete change is that platform-dependent
packages will continue to be compiled from source, while
platform-independent packages will now also be compiled from source.)
Fixes https://github.com/openwrt/packages/issues/12680.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
If the status file is not found then set then return the value unknown.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit e30f16beef)
Add an option for adding rules based on source interface.
The default 0.0.0.0/0 src and destination ip addresses has been removed. It is unclear
how the 'any' family of rules would have worked, as it appears each rule always required an
ipv4 or ipv6 address src and destination address. With this change, the any family will work
again.
I also cleaned up a bunch of repeated code around adding the iptables rules for
ipv4/ipv6/any in making the change.
Signed-off-by: Aaron Goodman <aaronjg@stanford.edu>
(cherry picked from commit 5147dfc73a)
An interface can have both a /64 and a /128 from a provider.
In such a case, use the address from the /64 to do the ping check, not
the /128.
Signed-off-by: Brian J. Murrell <brian@interlinx.bc.ca>
(cherry picked from commit 49cf5eac5c)
This update also:
- enables parallel builds
- moves to the CMake build system
- removes the redundant InstallDev stanza
Signed-off-by: Jonathan G. Underwood <jonathan.underwood@gmail.com>
Build config validation showed up 1 warning, 1 info
- deprecated sudo
- missing os
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 651b9f9bf1)
Target ar71xx is deprecated and removed in the master branch and makes SDK
not available anymore. Travis fails because of that.
It was superseded by target ath79. These devices have 4 MB flash and/or 32 MB RAM.
However, ath79 is being used by CircleCI if you have it configured for
your repository and if you are contributing to this repository. It
is not good to have two CI for the same target. Let's use powerpc.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 4526fb3eae)
Add alternative to busybox nslookup. Busybox throws an error when
the host does not have an AAAA record.
Signed-off-by: Ian Cooper <iancooper@hotmail.com>
(cherry picked from commit 4cb5aa57fd)
Binding in default to IPv6 is preferable but it can be disabled in
kernel and that prevents syslog-ng to start. This setup should not be
that common but syslog is very important service and should survive
that.
This introduces new plugin defining source generator
`network_localhost`. This is used instead of original network source.
Signed-off-by: Karel Kočí <cynerd@email.cz>
(cherry picked from commit 43a8f7072e)
As miniupnpd is running as root, libcap can be used to limit its
capabilities.
libcap is very small, so this isn't a problem.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit ba49c96808)
(switched to use libcap as -ng is not available)
Use the newly introduced configure script.
Use PKG_INSTALL for consistency between packages.
Use PKG_BUILD_PARALLEL for faster compilation.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 2b5028458e)
If miniupnpd is installed but disabled or not running, the hotplug
script will query uci for keys that don't exist and grep a temporary
config file that doesn't exist, resulting in the following errors:
uci: Entry not found
grep: /var/etc/miniupnd.conf: No such file or directory
These would arise when an interface is brought up or down, and are
more confusing than helpful, especially when miniupnpd is disabled.
Suppress these errors.
Signed-off-by: David Ehrmann <ehrmann@gmail.com>
(cherry picked from commit 6ef2b5400b)
The existing interface selection/detection code was incomprehensible at
worst and convoluted at best. The uci config file suggested it
understood an external ipv6 interface but in reality the init script
took no notice. Re-work it so it is at least comprehendible and takes
notice of ipv6 interface details if specified.
Update the hotplug script to use the same interface selection/detection
code as the init script and take note of ipv6 interface selection, only
restarting miniupnpd on interface up events and only if that interface
isn't already known (for that ip class) by miniupnpd.
For me this has solved numerous 'flaky' startup problems, especially
with regard to ipv6.
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
(cherry picked from commit 295d77943c)
Error was:
The domain 'example.com' seems to have a ECC cert already, please add '--ecc' parameter if you want to use that cert.
Signed-off-by: David Yang <mmyangfl@gmail.com>
Irqbalance defines /run/irqbalance dir for its socket
communication between irqbalance and its UI. /run does not exist
in OpenWrt (although it is defined by the Linux FHS), so the
socket creation fails. Although we do not compile UI and thus
the issue is not critical to us, fix the directory location.
Additionally, the creation is originally handled by a systemd
init script that we do not use.
* patch source to define dir as /var/run/irqbalance
* create the dir in the procd init script.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry-picked from 4f0c847828)
The package Makefile was not taking into consideration that the build
may be using BUILD_NLS with libintl-full and libiconv-full and was
trying to link the wrong versions of these libraries in this case.
The necessary flags are added by nls.mk to TARGET_LDFLAGS and can be
passed to irqbalance's configure script for setting the GLIB2_LIBS
variable instead of the explicit static link to the libiconv stub.
The PKG_BUILD_DEPENDS line should be modified so as to add to and not
override the definition set by nls.mk, which will ensure the right
version of libiconv and libintl is built beforehand.
A DEPENDS:= line should be added to the package definition using the
variables defined in nls.mk, which will add the appropriate version
of libintl and libiconv (vanilla or -full versions)
If USE_GLIBC is true, then libpthread needs to be explicitly passed
to the configure script in the GLIB2_LIBS variable for linking.
Signed-off-by: Ian Cooper <iancooper@hotmail.com>
(cherry-picked from 88c25e87a1)
The perl Configure file was matching GCC 10 against "1*" and treating it
as GCC 1, causing ABI breakage and segfaults.
Cherry-pick the upstream patch which fixes it to check against (e.g)
"1.*" instead, which will make it work for hundreds more GCC versions
to come.
https://github.com/Perl/perl5/commit/6bd6308fcea3541
"Adapt Configure to GCC version 10"
Also includes the previous commit just adding GCC 8 and 9 to one case:
https://github.com/Perl/perl5/commit/ae195500577d707
"Add gcc-8 and gcc-9 for FORTIFY_SOURCE"
Signed-off-by: Ken Wong <xinxijishuwyq@gmail.com>
(cherry picked from commit 65578a43f0)
* update to git 2020-05-06
* run init script through shellcheck
* fix infinite loop when BI_PARM is never set
* Fix '-b' option parsing
Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
Unbound has a quirk and may reply on a different device address.
When Unbound answers with from-address different than it
received queries on, it may cause trouble for select VPN and
firewall configurations. Ensure Unbound replies with the same
address by changing this default.
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* add anti_ad blocklist source
* made SafeSearch provider configurable, you can limit
SafeSearch to certain providers
* update readme
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit e5ab2de1ff)
* add regional list source for czech/slovak
* add regional list source for korea
* adapt oisd_nl changes, switch to adb-syntax domains
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 0a5e61ecb6)
Increase the range of characters that get substituted by '_' so the
shell doesn't complain about illegal variable names.
Primarily done to catch '.' and '-' but who knows what funnies will
appear in i/f names.
It's a shame that busybox ash doesn't understand :alnum:
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
(cherry picked from commit c8640d1f68)
Add a script that can collect data from mq (multi queue) and cake
qdiscs.
Script is reliant on collectd's 'exec' module.
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
(cherry picked from commit 38235de9c3)
The y-axis graph labels in logarithmic mode display in 'scientific'
notation eg: '1e+00' for 0, '1e+01' for 10, '1e+02' for 100 and so on.
This IMO is a pain in the backside for non scientific humans to read.
Modified output to display numbers up to 99,999 in conventional decimal
format and to revert to scientific notation for larger, thus the same
display space is taken.
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
(cherry picked from commit edc41b26ab)
Removed patch
`03-configure-allow-to-manually-disable-POSIX-capabiliti.patch` that has been backported into release.
Signed-off-by: Jan Hak <jan.hak@nic.cz>
(cherry picked from commit 9d81b6e4ca)
Recently, there was added libcap-ng to OpenWrt packages feed,
which is optional for Knot DNS. It enables POSIX 1003.1e capabilities.
This can restrict root (by default it runs as root) permissions and
might harm and as there isn't systemd on OpenWrt it can interfere.
There is an added patch, which introduced an option to disable libcap-ng.
This will be part of the next release.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 41957d6967)
Build is failing because HWTSTAMP_TX_ONESTEP_P2P is defined anymore on
linux net_tstamp.h.
Moreover, the usual way of linuxptp build is looking for system includes
unless user defines differently. That also was tried to fix.
PKG_RELEASE bumped to 3.
Signed-off-by: Paulo Machado <pffmachado@yahoo.com>
(cherry picked from commit 5f64b2d1e4)
Upstream will drop support for the ssl option in the next future version.
Signed-off-by: Gabor Seljan <sgabe@users.noreply.github.com>
(cherry picked from commit 46c253dfca)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
[package bump]
2cedae0aa9 enabled mp3 support for mini,
while keeping id3tag for full. This makes no sense as id3tag is used
specifically for mp3 files.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 4ed61c1f68)
This exposes the interface-auto option to UCI.
By default, interface-auto is disabled.
This leads to the DNS reply possibly originating from
a different address then the request was sent to.
Devices with a packet filter might not receive the reply in this case.
Enabling interface-auto ensures the reply is sent with the
source-address the request was sent to.
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit da76aeb24c)
Switched to meson.
Fixed license information.
Several Makefile cleanups for consistency between packages.
Enabled and added packages for a bunch of plugins.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit ae5ef832d1)
Switch to meson.
No more static libraries as meson makes you choose.
Enabled speex and shout2 as the libraries are available.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 077536f00f)
Switched to meson.
Fixed license information.
No more static libraries as meson makes you choose.
Added several CONFIG_DEPENDS entries.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 9cbde8ad8b)
Switched to meson.
Fixed license information.
Rearranged some stuff for consistency between packages.
Removed static libraries. It seems meson only supports either one or the
other.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit cb058bf961)
Dovecot was updated but not pigeonhole. This is important as the API broke
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit de66ac26f6)
It's normally set to auto. When nettle is missing, it tries to use the
other libraries.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 49b5de830e)
The configure script confusingly sets CXXFLAGS to gnu++11 but does
not use that to check the important stuff. Fix that.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 8f7687833e)
* remove dumb list cache
* start adblock processing after adding/removing
list sources via CLI
* add regional list source for france
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit ab44d8146a)
Refactor the package so init script is installed from the binary instead
of an init script embedded in the package.
Signed-off-by: Olivier Poitrey <rs@nextdns.io>
This updates the include paths for python(3)-package.mk to be relative
to the package Makefile. If not, in certain cases this will print errors
like the following one:
ERROR: please fix feeds/openwrt/net/freeradius3/Makefile
- see logs/feeds/openwrt/net/freeradius3/dump.txt for details
In the dump.txt there is the following:
Makefile:42: /mylocalpath/feeds/packages/lang/python/python3-package.mk: No such file or directory
make[1]: *** No rule to make target '/mylocalpath/feeds/packages/lang/python/python3-package.mk'. Stop.
The relative path is used already in 19.07 for most of the packages, and
has been updated for the packages at hand in master as well:
302f4d17e3 ("libmraa,libupm: Disable default Python package build recipe")
1bc2f4f3c6 ("treewide: Remove Python variants for non-Python packages")
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
prereq-build.mk says that GCC 4.8 and above is supported. GCC 4.8
defaults to std=gnu89, breaking the build. GCC5 defaults to gnu99.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 6d100823e9)
OpenSSL is already built as part of tools (LibreSSL actually) and can be
used instead for the host build.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit c037c8d988)
Remove boost-python3 dependency and reduce file size of the compiled
kea-libs
Signed-off-by: Tiago Gaspar <tiagogaspar8@gmail.com>
(cherry picked from commit 74603fe5ea)
Fix kea-admin dependency where if procps-ng-ps wasn't available busybox
would output an error casuse it does't support showing a processe's PID
Signed-off-by: Tiago Gaspar <tiagogaspar8@gmail.com>
(cherry picked from commit 9314a96765)
Fix an issue where the Makefile wouldn't allow kea to show up in the
menuconfig Also added some description to the packages
Signed-off-by: Tiago Gaspar <tiagogaspar8@gmail.com>
(cherry picked from commit 95307f2a4b)
STAGING_DIR_HOST is for packages under tools/ , not host packages.
Reorganized Makefile for consistency between packages.
Added PKG/HOST_BUILD_PARALLEL for faster compilation.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit d93fd61d62)
The host build is not used by anything.
Added PKG_INSTALL for consistency between packages.
Added PKG_BUILD_PARALLEL for faster compilation.
Added missing protobuf/host build dependency. This was previously
specified as a host dependency, which is wrong.
Removed pointless std parameter. It's only useful for old G++ versions.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 63107fa8c0)
Needed for the new protobuf update.
Cleaned up Makefile.
Got rid of HOST_BUILD_DEPENDS. This package does not have a host build.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 4c42eb0b45)
* limit domain name length to max. 63 chars
to fix issues with energized sources
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 0b6ea12560)
rundir needs to be accessible for clients, hence o= is not the proper
permission for rundir. This commit breaks out rundir from the awk script
and sets it up with default umask.
This also removes chmod call and instead tells mkdir to create the
directories with the proper permissions directly.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
Helps applications restart safely.
Disabled optssdp. Not used by anything.
Disabled scriptsupport. Not used by anything.
Made all configure options explicit.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 8e065c147f)
Added some extra stuff from master.
It seems 1.11.1 is old and has CVEs.
Removed boost hack since upstream removed boost support.
Removed outdated InstallDev hacks.
Added PKG_CPE_ID.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from b0dc454c0e)
When a Python package is installed from source (i.e. using setup.py)
into a custom location (with --home), setuptools may want to create a
site.py file in the custom location. This file is created based on the
source code of site-patch.py, a file bundled with setuptools.
Because the normal OpenWrt setuptools package does not contain Python
source code, this file is missing and the installation will end with an
error.
This copies site-patch.py to site-patch.py.txt so that it will be
included in python3-setuptools, and patches setuptools to look for this
file.
See https://github.com/openwrt/packages/issues/12223
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
When a Python package is installed from source (i.e. using setup.py)
into a custom location (with --home), setuptools may want to create a
site.py file in the custom location. This file is created based on the
source code of site-patch.py, a file bundled with setuptools.
Because the normal OpenWrt setuptools package does not contain Python
source code, this file is missing and the installation will end with an
error.
This copies site-patch.py to site-patch.py.txt so that it will be
included in python3-setuptools, and patches setuptools to look for this
file.
See https://github.com/openwrt/packages/issues/12223
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 70a7f736c5)
Commit 44a16ca broke syslog-ng such that it no longer works with
logrotate, for example. Yes, you can manually stop and start the
service, but (1) you shouldn't have to and (2) it creates a window
where you potentially lose messages if the syslog UDP socket
overruns.
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
(cherry picked from commit c27f4ca53b)
Initially we included user-specific settings last, so that they
could turn off or replace system settings... otherwise we only get
to change what's NOT explicitly set by the system. This is overly
constraining.
Restore the original functionality of allowing the user to
override settings defined by the distribution's configuration.
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
(cherry picked from commit f8443ae829)
The ssl module assumes OpenSSL can load the default trust anchors (root
CA certificates).
From https://github.com/openwrt/packages/issues/12209
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
Backport from master.
Until now $(INSTALL_CONF) is used for configuration files that go into
/etc/mysql. This commit replaces that with $(INSTALL_DATA). The
configuration files are not only parsed by the server, but also by the
clients (which can be anybody).
This also removes a comment about a cron job from one of the
configuration files. There is no cron job.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
Backport from master.
It's really a client. It connects to the running server as a client, to
upgrade the DBs. And it depends on both mysql and mysqlcheck.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
Fixes:
CVE-2020-2752
CVE-2020-2812
CVE-2020-2814
CVE-2020-2760
Upstream added support files for auth_pam plugin. This commit adds them
to the package.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
Because the first stage for building target Go is actually a host build,
the default platform options (GO386, GOARM, etc.) are detected from the
host. These values are written to a source file and kept when building
the second stage.
This modifies this source file to set the appropriate values for the
target platform, and reset values for other platforms to their
cross-compiling / most compatible defaults.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit da3fb97b9c)
For speexdsp, support for NEON on aarch64 was added in 1.2.0[1].
[1]: https://github.com/xiph/speexdsp/pull/8
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit dec17eb36c)
With openwrt/openwrt@8dcc108760, the ARM
FPU compiler options are no longer part of CONFIG_TARGET_OPTIMIZATION.
This updates various packages that look for NEON/VFP support to search
CONFIG_CPU_TYPE instead.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 2d99ee3004)
[adapted patch for pulseaudio using autotools build]
To use eap tls, 'tmpdir' must be created before server starts.
This 'tmpdir' is used to store and verify client certificate,
and therefore radiusd do 'chmod go-rwx'.
If 'tmpdir' does NOT exists, server failed to start and default
'tmpdir' is '/tmp/radiusd'. So init script MUST create default
'tmpdir' like other directories.
Signed-off-by: Eiji MATSUMOTO <toudaiman@gmail.com>
hotplug scripts are sourced not exec'd so #!/bin/sh /etc/rc.common
doesn't pull in the functions defined in /etc/rc.common thus since
'enabled' isn't defined the following sequence always fails:
enabled miniupnpd || exit 0
Unfortunately sourcing /etc/rc.common doesn't appear to work so come up
with some alternatives.
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
As wifidog-ng builds a kernel module, it must use a PKG_BUILD_DIR in
KERNEL_BUILD_DIR instead of BUILD_DIR, otherwise old build artifacts may
be incorrectly reused when switching between different targets of same
architecture without a full clean.
Instead of fixing up the override, just remove it and instead move the
kernel.mk include above package.mk, so PKG_BUILD_DIR is set up correctly
by default.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
(cherry picked from commit 25babf817f)
Related commit: 0080bb4b
Use `\s*` instead of ` \?` to match 0 or multiple spaces.
Signed-off-by: Zheng Luo <cherrotluo@gmail.com>
(cherry picked from commit 88b03577c4)
JSON response now has spaces between parameters. Accept this new format and the old one.
Signed-off-by: Michael Gray <michael.gray@lantisproject.com>
(cherry picked from commit 0080bb4bba)
Fixes issue #11282, this patch was provided by PaulFertser on the #openwrt
IRC.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit bf68826897)
HTTPS support is not provided by default.
Also fixed a mistakenly added ].
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit fdfe5a7607)
This is a proper replacement for MiniDLNA with none of its problems.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit a62bc1cd6a)
Pinging IPv6 hosts using an interface as a source specifier seems
troublesome. See https://bugs.openwrt.org/index.php?do=details&task_id=2897
for more detail.
Use the desired source interface's IP address instead.
Signed-off-by: Brian J. Murrell <brian@interlinx.bc.ca>
(cherry picked from commit 6721587e8b)
Till now we could only ping http targets on port 80. With this change by
adding the config boolean config option httping_ssl we could also ping
https ping targets on port 443.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit a689e168aa)
The variable IPT is not valid at this point. Set the variable usage to IPT4
fixes this issue.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 581d7df844)
Python will record the values of CC, CXX, AR, and RANLIB (and other
configure options) used during compilation. pip will use these programs
when asked to compile extension modules on the target device.
* If ccache is used during build, CC and CXX will be ccache_cc and
ccache_cxx, respectively, which are not available on-device (#11912).
* If an external toolchain is used during build, the values of these
variables will contain the external toolchain prefix, which may not be
available on target.
* If the normal toolchain is used during build, AR and RANLIB will
contain the toolchain prefix, but the names of ar and ranlib on-device
do not contain the prefix; they are named "ar" and "ranlib".
This changes the values of these variables in Python's files to match
the names available on-device, and without any toolchain prefix.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
Python will record the values of CC, CXX, AR, and READELF (and other
configure options) used during compilation. pip will use these programs
when asked to compile extension modules on the target device.
* If ccache is used during build, CC and CXX will be ccache_cc and
ccache_cxx, respectively, which are not available on-device (#11912).
* If an external toolchain is used during build, the values of these
variables will contain the external toolchain prefix, which may not be
available on target.
* If the normal toolchain is used during build, AR and READELF will
contain the toolchain prefix, but the names of ar and readelf
on-device do not contain the prefix; they are named "ar" and
"readelf".
This changes the values of these variables in Python's files to match
the names available on-device, and without any toolchain prefix.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 9f81ab895e)
- Update to version with longer interface names.
- Add /etc/pingcheck/(on|off)line.d/ directories with an example
script. Closes#11263
Signed-off-by: Bruno Randolf <br1@einfach.org>
When during the build the openssl extension is also selected, then
the mysqlnd extension depends on it, too.
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 50b1cd3757)
This package can not be installed if you have installed less from
busybox.
Collected errors:
* check_data_file_clashes: Package less wants to install file /bin/less
But that file is already provided by package * busybox
* opkg_install_cmd: Cannot install package less.
To avoid this error, I moved it from /bin/less to /usr/bin/less.
If you install it now, it changes symlink from busybox to /usr/bin/less
/bin/less -> busybox*
/bin/less -> /usr/bin/less*
When you remove it, it changes symlink back to busybox.
That's why postint and postrm scripts are no longer needed.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 0ae161ecb6)
* add 'status_service' as workaround to init for 19.07
* fix 'wifionice' auto-login script
* fix autologin script matching
* change wifi scanning to logical interface name,
no longer use the radio device
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 59cca01a23)
This is to address the need for specifying dependency on a wget
implementation with ssl support.
Now we have a game of names for opkg
1. uclient-fetch: minimal version by openwrt project
2. wget-nossl: gnu wget w/o ssl support
3. wget-ssl: for the moment since this commit, gnu wget w/ ssl support
4. wget: uclient-fetch, wget-nossl, or wget-ssl
5. gnu-wget: wget-nossl or wget-ssl
By the time we provide some dummy package like uclient-fetch-ssl and
make it also provide wget-ssl, I guess by then we will also need
gnu-wget-ssl...
Ref: https://github.com/openwrt/packages/issues/11534
Ref: https://github.com/openwrt/packages/pull/9941
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry picked from commit 585e4a38fe)
The package wget should not say that it provides itself.
This also make gnu-wget provide general so it is not written in Makefile
twice.
Signed-off-by: Karel Kočí <karel.koci@nic.cz>
(cherry picked from commit 75f2be7d50)
* prevent processing of spurious line endings
that confuses (g)awk
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit e291d68055)
Fixes all known CVEs.
Various Makefile cleanups for consistency between packages.
Added PIC explicitly (was implicit). Removed two extra features.
Removed autoreconf and added PKG_BUILD_PARALLEL for faster compilation.
Roughly matched host configure args with target ones.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit b289809735)
Add "use_stun" default to prevent sh: out of range error introduced by
c61614a84
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
(cherry picked from commit 0f1e7d32af)
It seems upstream abandoned sourceforge.
Add license information.
Fix CVE tag. It seems the mass CVE patch placed many wrong CVEs.
Add PKG_BUILD_PARALLEL for faster compilation.
Do not build patented functionality when BUILD_PATENTED is missing.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit ff62511ab2)
This update fixes#11452 since LFS detection support was added upstream.
While at, update SPDX license tag to latest standard.
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 2600255ecb)
Transmission should stop early on system shutdown to avoid
for example fstab unmount disks when transmission is writing.
Signed-off-by: Francesco G <gfrancesco@users.noreply.github.com>
(cherry picked from commit 4fcc44bc89)
Syscalls observered when running on arm32. Add them to seccomp rule.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 3724ed3d68)
add missing 'peer_id_ttl_hours' and remove 'scrape_paused_torrents'
which is not exist in transmission wiki.
Signed-off-by: Richard Yu <yurichard3839@gmail.com>
(cherry picked from commit 53fd02d62c)
Required for meson to find this library in a sane way.
- In OpenWrt 19.07, there were recently updated mpd to its the latest
version available (current 0.21.22) with transition to meson.
Because of that mpd fails to build due to:
Run-time dependency id3tag found: NO (tried pkgconfig)
This commit fixes it
Signed-off-by: Andre Heider <a.heider@gmail.com>
(cherry picked from commit 1b37a1d2a8)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
[added commit message for OpenWrt 19.07]
* add a final sort step, this fixes dns reporting with
multiple pcap files as input
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 1d8d456a55)
This is possible as libfaad no longer has patented functionality based on
BUILD_PATENTED.
AAC is a very popular format, so it makes sense to have some kind of
version included.
The ffmpeg package does not provide and cannot provide AAC decoding
without BUILD_PATENTED, therefore enabled FAAD for all variants.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit c7d98c3626)
Updated patches to latest patchset and removed upstreamed ones.
Ran init script through shellcheck. Restart using SIGHUP.
Added logging from stderr as any kind of logging is missing in --no-daemon
mode.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 3be4778840)
libmad is almost half the size of libmpg123. The docoding is done with
integers instead of floats.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 5bd4ef4035)
With mpd's build system, it requires either an iconv built into the libc
or icu. Since uClibc-ng as configured by OpenWrt currently has no iconv,
use icu for it to work around the problem. This is the simplest solution.
Added a patch to use boost's rounding functions. They are more appropriate
and work with uClibc-ng.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit c00f83241b)
One patch was dropped (probably not required anymore).
Old options have been dropped and new ones added. The order is as found
in meson_options.txt. mpd-mini and mpd-full retained their feature sets.
Signed-off-by: Andre Heider <a.heider@gmail.com>
(cherry picked from commit 5aaa1e7da4)
This removes lines that set PKG_BUILD_DIR when the set value is no
different from the default value.
Specifically, the line is removed if the assigned value is:
* $(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION)
The default PKG_BUILD_DIR was updated[1] to incorporate BUILD_VARIANT
if it is set, so now this is identical to the default value.
* $(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_SOURCE_SUBDIR)
if PKG_SOURCE_SUBDIR is set to $(PKG_NAME)-$(PKG_VERSION), making it
the same as the previous case
* $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
This is the same as the default PKG_BUILD_DIR when there is no
BUILD_VARIANT.
* $(BUILD_DIR)/[name]-$(PKG_VERSION)
where [name] is a string that is identical to PKG_NAME
[1]: https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=e545fac8d968864a965edb9e50c6f90940b0a6c9
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 53e1692ae9)
Small Makefile reorganization.
Switch BUILD_PARALLEL to 1. Seems to work now.
Added nanosleep patch that replaces usleep usage.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 473356a562)
Remove SSL patch that has been made obsolete by upstream updates.
Update monit package to the latest release: v5.26.0. This release
supports TLSv1.3 and fixes a few bugs and vulnerabilities.
Signed-off-by: Val Kulkov <val.kulkov@gmail.com>
(cherry picked from commit 9980d766ac)
* add 'ca-bundle' dependency
* fix a sort bug in report engine
* fix potential bugs in the f_extconf function
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit d6634b611a)
e921ca0a Add further commonly used protocols to the protocol file.
Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
(cherry picked from commit 5e140462e4)
MIPS16 is not needed here.
Removed configure patch and replaced with a configure var.
Removed autoreconf as configure is no longer being patched.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 1ead64489b)
Maintainer: Jakub Tymejczyk <jakub@tymejczyk.pl>
Compile tested: ramips, Xiaomi Router 3G, fc54256
Run tested: ramips, Xiaomi Router 3G, 0f54d96
Description:
Mosh is "Remote terminal application that allows roaming, supports
intermittent connectivity, and provides intelligent local echo and line
editing of user keystrokes".
Project's site: https://mosh.org
Makefile and patch taken from: https://github.com/mchwalisz/mosh-openwrt
updated by me
Signed-off-by: Jakub Tymejczyk <jakub@tymejczyk.pl>
(Makefile cleanup and size optimizations)
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 5ac5cf0b98)
* new package dependencies: coreultis-sort and
a download util with SSL support
* focus on speed (multicore-support) to handle quite big lists
* include more than 40 pre-configured blocklist sources in a compressed
json file (/etc/adblock/adblock.sources.gz)
* dynamic SafeSearch support for google, bing, duckduckgo,
yandex, youtube and pixabay (CNAME (bind) & IP (dnsmaq, unbound))
* DNS backend autodetection
* Download Utility autodetection
* Report Interface autodetection
* Easy cron wrapper to set an adblock related auto-timer for
automatic blocklist updates
* raw domain/blocklist support (e.g. for dnscrypt support)
* re-add restrictive Jaillist support
* rework online doc
* Complete LuCI rewrite (migrated to client side JS)
Signed-off-by: Dirk Brenken <dev@brenken.org>
With CONFIG_CCACHE, $HOSTCC is 'ccache gcc' while $TARGET_CC points to a
single wrapper script. Compiling target binaries with ccache works, but
doesn't for host binaries, because we need to supply an argv array for
argc > 1 in the meson cross file.
Always pass an array for the c and c++ compiler, and while at it, do it
for the target as well - just to be on the safe side if that ever
changes.
Fixes#10982.
Signed-off-by: Andre Heider <a.heider@gmail.com>
(cherry picked from commit f5c8565d1b)
Package python-idna was updated 2 weeks ago in OpenWrt 19.07.
It causes an issue:
pkg_resources.ContextualVersionConflict: (idna 2.9 (/usr/lib/python3.7/site-packages), Requirement.parse('idna<2.9,>=2.5'), {'requests'})
This is fixed in 2.23.0.
Signed-off-by: Javier Marcet <javier@marcet.info>
(cherry picked from commit d62e8b9f3c)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
[add commit message]
This minor version bump fixes:
CVE-2020-1934
CVE-2020-1927
Upstream added cross-compile compatibility to apxs, so we can drop a sed
script. Upstream also added the OpenWrt layout, so we can drop our local
copy.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
Update nano editor to version 4.9.1
2020.03.31 - GNU nano 4.9.1 "Sapperdeflap"
Two bugs introduced in version 4.9 are fixed: the cursor
getting misplaced when undoing line cuts, and filtering
of the whole buffer to a new buffer not working.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit f5c47a2606)
Clean up Makefile slightly.
Update configure options for the new version.
Remove first patch and update the other one.
Use a different solution for the stack protector on certain platforms.
Run script through shellcheck. Small quote fix.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 9290d41077)
Some adjustments to the configure flags.
Removed upstreamed patches.
Added PKG_BUILD_PARALLEL for faster compilation.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit b82bdd3f0e)
Explicitly disable the new dpdk_telemetry module to fix
compilation in buildbot.
(other dpdk modules are aleady disabled)
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit b936fc4e0d)
This backports the following bug-fix commits from the master branch:
c6b4d7f367 ("acme: Include empty 'dns' config option by default")
983cc995a3 ("acme: Correctly handle domain state dir for ECC certificates")
Fixes#11675.
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
This is a workaround to prevent the whole build from failing because of
the intree kmods are not supported yet by upstream project.
Root cause is that kernel version should not play a part when making
DEPENDS as the generated kconfig was for all targets that may have
different kernel versions.
One less than ideal effect of this change is that for an unsupported
kernel version, people can still select the intree kmod but it won't be
built. This may contradict expectation if the warning was not noticed
by them
Resolvesopenwrt/packages#9274
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry picked from commit a6ec885522)
cxxabi.h is a useless header that libcxx does not include.
Remove indent on postint script. It should be on the same as the above
section.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit a135cbb9f1)
CMake is faster and allows to simplify the Makefile slightly. It also
creates a slightly smaller package for some reason.
Fixed license information.
Ran postinst through shellcheck. It was using bashisms.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from faa8962178)
Run the service under an unprivileged
user account
The following parameters are now configurable
niceness
max concurrency (defaults to number of CPUs)
user
Added flags "-no-browser"
Disabled in-place upgrades (disabled in the
build already)
Redirected stderr/stdout to syslog
Added support for "reload_config"
Increased "term_timeout" to 15s to give it
plenty of time to shut down gracefully
Properly handled non-existing directories
Removed a softlink that assumes a specific naming
convention in syncthing
Added a comment that using external storage is a
recommend configration
Signed-off-by: Marc Benoit <marcb62185@gmail.com>
[increased package release]
Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit a9443eb0eb)
Tested-by: Marc Benoit <marcb62185@gmail.com>
Since upstream commit dc92994 the LDFLAGS used for settings the version
(and build host and user) changed resulting in "unknown" versions in
syncthing.
Correct version detection is important for syncthing to assure
compatibility with other running instances. The "unknown" version fails
to communicate and sync with correctly compiled instances.
This patch updates the syncthing Makefile to inject the correct
variables and thereby fixes the version detection in syncthing.
Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit b85e387cc2)
Tested-by: Marc Benoit <marcb62185@gmail.com>
Add a conffiles-section for the /etc/swanctl folder, which is used by the swanctl util. This will keep the configfiles during an sysupgrade.
Signed-off-by: Sven Roederer <S.Roederer@colvistec.de>
(cherry picked from commit 49f298eb74)
Newer versions of the kconfig generator require quotes. Prepare the
package for an eventual update.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 404c113bc2)
This backports a patch[1] to fix several request smuggling attacks.
This includes fixes for:
* CVE-2020-10108
* CVE-2020-10109
[1]: 4a7d22e490
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
ICU 66 updates to Unicode 13, including new characters, scripts, emoji, and corresponding API constants. It also updates to CLDR 36.1 with Unicode 13 updates and bug fixes.
Create symbolic link to current version.
FIX CVE-2020-10531
An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
This is intended as a match with standard urngd. They serve same purpose
and urngd starts as first with 00. Starting haveged later can create
issues if you replace urngd with it. The example problem is if
uci-defaults script decides to generate certificate. Haveged can supply
entropy but it is started later and to mitigate this urngd would still
have to be installed. This means that haveget can't serve as replacement
without moving it to match start order of urngd.
Signed-off-by: Karel Kočí <karel.koci@nic.cz>
(cherry picked from commit 1ef38f45d9)
Switch to normal tarballs. Remove autoreconf as a result.
Several Makefile cleanups for consistency.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit c22dd1bf74)
This package uses ld for linking and therefor does not support the
-specs option.
Signed-off-by: Martin Schiller <ms@dev.tdt.de>
(cherry picked from commit 3804006e60)
Compilation is broken on AArch64.
Reordered some things for consistency between packages.
Fixed license information.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit b8b4e7e269)
Fixes compilation without OpenSSL deprecated APIs as well as
-Werror=implicit-function-declaration.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit b80b614f8f)
Reordered Makefile according to
https://github.com/openwrt/packages/pull/9399#issuecomment-508727872 .
Added PKG_BUILD_PARALLEL for faster compilation.
Remove duplicated conffiles section.
Install /etc/config/stubby using INSTALL_CONF, as is done elsewhere
Run init script through shellcheck and clean it up.
Added chmod for the stubby config file, to fix a LuCI issue.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit eaf5225323)
The previous implementation always succeeded so no scan was performed.
This now fixes that and it correctly scans for BTRFS devices if BTRFS
support is in kernel.
Signed-off-by: Karel Kočí <karel.koci@nic.cz>
- Bump version also in the config file
- Move logread to /sbin location instead of /usr/sbin
Because package logd in OpenWrt's ubox Makefile uses /sbin folder and LuCI has
the same path hardcoded in
modules/luci-base/root/usr/share/rpcd/acl.d/luci-base.json and using
different location results that LuCI is not able to load log data as it
is not found.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit fe165eeb94)
Now that libaio compiles on arc targets we need to add the dependency to
libaio on these targets as well.
resolves#9298
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
Create an anonymous inode in /tmp using O_TMPFILE and attempt to link the
file in place using linkat(). Only fall back to the old file copy when
linking the tempfile fails.
Avoids double memory use if both the temporary upload file and the
destination file are located in /tmp.
Ref: https://github.com/openwrt/luci/issues/3654
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 4f4a7e9532)
Allocate dynamic buffer memory for decoding post data and allow post
requsts up to 128KB compared to the previos 1KB limit.
Also support downloading /proc and /sys files by falling back to
chunked transfer encoding when the file size cannot be determined.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 39087eba18)
Added support for reload_config
This service does not need to start so early (even
before the netwrok is up). Start it after
the device is mostly up and operational.
Compile-tested on: ipq806x
Runtime-tested on: ipq806x
Signed-off-by: Marc Benoit <marcb62185@gmail.com>
(cherry picked from commit b6078559cd)
Added the ability to change sampling interval
and provide a list of IRQ's to ignore
via /etc/config/irqbalance
Signed-off-by: Marc Benoit <marcb62185@gmail.com>
(cherry picked from commit b7a99b2334)
Upgraded from 1.2.0 to 1.6.0 to pick up
all the latest fixes and improvements
irqbalance made glib2 mandatory since 1.3.0, but is
using very little of it. glib2 linked statically
to minimize the impact.
1.2.0 size: 33,619
1.6.0 size: 99,539
~# irqbalance --version
irqbalance version 1.6.0
~# ldd /usr/sbin/irqbalance
/lib/ld-musl-armhf.so.1 (0xb6f5f000)
libgcc_s.so.1 => /lib/libgcc_s.so.1 (0xb6f43000)
libc.so => /lib/ld-musl-armhf.so.1 (0xb6f5f000)
~# opkg info irqbalance
Package: irqbalance
Version: 1.6.0-6
Depends: libc
Status: install user installed
Architecture: arm_cortex-a7_neon-vfpv4
Installed-Time: 1582839249
Compile-tested: ipq806x/R7800 & ipq40xx/GL-B1300
Run-tested: ipq806x/R7800 & ipq40xx/GL-B1300
Signed-off-by: Marc Benoit <marcb62185@gmail.com>
(cherry picked from commit bdcb872a40)
Added the ability to enable/disable via a config file;
the default is enabled for backwards compatibility.
This is an additional service, so running it the
same priority as dnsmasq, etc does not make sense.
Added USE_PROCD=1
"done" starts at "START=95", so this should start earlier
Added STOP=10 to stop syncthing early
Compile-tested on: ipq806x, ipq40xx
Runtime-tested on: ipq806x, ipq40xx
Signed-off-by: Marc Benoit <marcb62185@gmail.com>
(cherry picked from commit 6f6877460a)
Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit 7c1d6571ca)
Tested-By: Marc Benoit <marcb62185@gmail.com> [19.07: R7800/GL-B1300]
Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit 373d3b2420)
Tested-By: Marc Benoit <marcb62185@gmail.com> [19.07: R7800/GL-B1300]
zip has 12 year old source code that would require work to make
the binary actually work.
> root@router1:/# zip
> zip error: Not supported (uzoff_t not same size as zoff_t)
As the binary does not work, lets remove the package to
avoid confusion for the end-users.
Reference to #10985 and #11089 as well as
https://github.com/openwrt/openwrt/commit/ad8c2d6099a7da5192ee6e2c52a8303642271
Adapted from: c1201a999b
(note: The package was renamed in master from zip to infozip
a few weeks ago due to buildbot's relutance to compile zip in
master and 19.07 ever since host zip was added as a build tool.)
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
The patch created patch files in the ffmpeg build directory, which did
absolutely nothing. Properly backported them.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 9af78c5498)
Signed-off-by: Michal Hrušecký <michal.hrusecky@nic.cz>
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry-picked from commit 18ccf174d6)
* ksmbd: update to 3.1.3
* ksmbd-tools: update to 3.2.1
* add new package build option "KSMBD_SMB_INSECURE_SERVER"
* enable smb1 support to kmod by default
* add new UCI option "allow_legacy_protocols" to section [globals]
* add avahi support package "ksmbd-avahi-service"
* ksmbd: release 3.1.3 version
* ksmbd: lock SMB2_QUERY_INFO_HE request with read lock
* ksmbd: fix potential racy between query_dir and ksmbd_vfs_empty_dir
* ksmbd: fix racy issue between deleting file and checking empty directory
* ksmbd: don't register interface which are member of bridge
* ksmbd: SO_REUSEADDR is no property of tcp_setsockopt
* ksmbd: release 3.1.2 version
* ksmbd: fix read caching buffer size as max_read_size
* ksmbd: fix the infinite loop of handling FSCTL_QUERY_ALLOCATED_RANGES
* ksmbd: use compounding for smb2 flush
* ksmbd: downgrade error message to debug in get_file_all_info
* ksmbd: rename usmbd to ksmbd.mountd in trvis-ci
* ksmbd: release 3.1.1 version
* ksmbd: does not work if ipv6 module is not loaded or compiled in
* ksmbd: capsule ifdef CONFIG_SMB_INSECURE_SERVER with smb1 codes
* ksmbd: capsule ifdef CONFIG_SMB_INSECURE_SERVER with smb1 codes
* ksmbd: update README file
* ksmbd-tools: release 3.2.1 version
* ksmbd-tools: revert "remove glib2.0 dependancy" patch
* ksmbd-tools: release 3.2.0 version
* ksmbd-tools: update how to restart ksmbd in README file
* Revert "ksmbd-tools: disable tbuf and rbuf caching by default"
* ksmbd-tools: disable tbuf and rbuf caching by default
* ksmbd-tools: replace usmbd prefix with ksmbd prefix
* ksmbd-tools: update README file
* ksmbd-tools: fix warning ignoring return value of 'fread'
* ksmbd-tools: downgrade unsupported command print to debug
* ksmbd-tools: remove GLIB_LIBS in Makefiles
* ksmbd-tools: rename usmbd, smbuseradd, smbshareadd to ksmbd.mountd, ksmbd.adduser and ksmbd.addshare
* ksmbd-tools: fix null pointer dereference in _list_remove
* ksmbd-tools: fix the sanity check fails depending on the password length
* ksmbd-tools: fix build error(not found glib.h)
* ksmbd-tools: remove glib-2.0 dependancy
* ksmbd-tools: update README to add libglib2.0-dev for Ubuntu preprequisite packages
Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
$(FPIC) evaluates to -fpic on ARM64, breaking compilation:
The dnsdist build system handles it properly anyway. Added --with-pic to
make it explicit.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 7ddb2ddc45158669990374968da87a62a2e9e2e2)
This script notifies users about the changes that recently went into the
package, to prevent surprises.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
Since commit a62c0e5 apu-1-config is no longer being stipped down with
regards to being called with "--link-libtool". Example:
$ ./staging_dir/target-mips_24kc_musl/usr/bin/apu-1-config --link-libtool
-L/home/sk/tmp/openwrt/staging_dir/target-mips_24kc_musl/usr/lib -R/home/sk/tmp/openwrt/staging_dir/target-mips_24kc_musl/usr/lib -laprutil-1
$
Before the mentioned commit the "-R" argument was stripped off. And when the
Makefile adds this to TARGET_LDFLAGS this then ends up in the compiler test, as
an argument for the compiler, causing build failure:
checking whether the C compiler works... no
configure: error: in `/builder/shared-workdir/build/sdk/build_dir/target-arm_mpcore+vfp_musl_eabi/subversion-1.13.0':
configure: error: C compiler cannot create executables
config.log shows what's wrong:
configure:3140: x86_64-openwrt-linux-musl-gcc -Os -pipe ... <snip> ... -R/home/sk/tmp/sdk/master-x86-64/staging_dir/target-x86_64_musl/usr/lib -laprutil-1 conftest.c >&5
x86_64-openwrt-linux-musl-gcc: error: unrecognized command line option '-R'
This commit does away with these flags, they're not needed anyway. FPIC
is also removed, because it's detrimental to the applications [1] and
unnecessary as well.
Fixes: #11139
[1] https://wiki.gentoo.org/wiki/Project:Hardened/Position_Independent_Code_internals
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
apr-util was updated. It doesn't provide the depend on libsqlite3
anymore, so this needs to be added to the subversion package now.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
This is a squash of the following cherry-picked commits:
14f4f0bef04e6bdd8a49c8aba5113b2d188fd37f31e0d618e539e68309e8a1472254dbd6476f30bb258967b0d2e94a08298e6bd63d24f066bb68a7b6d44ad09fcd
Short summary:
- version is bumped to 2.4.41
- httpd is renamed to apache2 to avoid overwriting of other servers (for
instance busybox's httpd)
- the name apache2 is now also used for directories, for instance
/etc/apache2 instead of /etc/apache
- a simple init script it added (/etc/init.d/apache2)
- a user "apache" is added upon package installation and used by default
- adds the Apache modules (in the main package as well as in additional
packages)
- Makefile and patches are updated and cleaned
- adds myself as maintainer
- improves the cross-compile setup (via configure variables, patches &
sed scripts)
- apxs is fixed up so that external modules can be added easily
For more details please check the individual commits provided above.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
This is a squash of the following cherry-picked commits:
27c472393603124bf4b4141bd5531640c7e952101d25dcde24ea5b746e58a62c0e599ba16b294805c24f5d258bf6c218e74d
Short summary:
- adds external modules (crypto-openssl dbd-mysql dbd-odbc dbd-pgsql
dbd-sqlite3 dbm-gdbm ldap)
- Makefile and patches are updated and cleaned
- adds myself as maintainer
- improves the cross-compile setup (via configure variables sed scripts)
For more details please check the individual commits provided above.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
This is a squash of the following cherry-picked commits:
40a29bf05540c7e95210893a804c9512037b3f29193c3913b6430ab5f9b30c6d461cc986396c6a49
Short summary:
- version is bumped to 1.7.0
- Makefile and patches are updated and cleaned
- adds myself as maintainer
- improves the cross-compile setup (via configure variables, patches &
sed scripts)
For more details please check the individual commits provided above.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
It was provided by both the freeradius3 and freeradius3-mod-realm packages.
Now provided by the freeradius3 package only.
Signed-off-by: Robby K <robbyke@gmail.com>
Beside that, listen not only on IPv4 but also on IPv6 = Dual Stack.
Signed-off-by: Alexander Traud <pabstraud@compuserve.com>
(cherry picked from commit a4553b2efe)
Fixed license information.
Removed patch requiring autoreconf and replaced with a configure variable.
Removed faulty patch that broke systems without a disabled crypt size hack.
Replaced with using a SED command as well as bcrypt, which works in musl.
Removed su patch and converted it to a SED command in the Makefile.
Added new shadow utilities.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 87e5ded04c)
* Set GOENV=off when building Go compiler and packages, to ignore user's
environment configuration file
* Set GOCACHE when building host Go
* Unset GOTMPDIR, to use the buildroot temp directory instead of temp
directories in build_dir
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from 3b5f1c73fb)
* remove 'reg_cz' list (abandoned)
* add 'notracking' list (provided by @rcarmo)
* 19.07-only: fix/bring back status message
Signed-off-by: Dirk Brenken <dev@brenken.org>
Currently only xml2-config is installed, for both the normal libxml2
package as well as the host package. The problem with that is that due
to multilib considerations the build host may have xml2-config installed
with a host triplet prefix, like x86_64-pc-linux-gnu-xml2-config (and
xml2-config as a symbolic link to it). Gentoo for instance sets it up
like this.
Packages may actually search for a prefixed xml2-config before searching
for xml2-config. An example would be Asterisk:
checking for x86_64-pc-linux-gnu-xml2-config... /usr/bin/x86_64-pc-linux-gnu-xml2-config
This then introduces wrong information into the build, for instance
bad includes:
~/tmp/openwrt $ /usr/bin/x86_64-pc-linux-gnu-xml2-config --cflags
-I/usr/include/libxml2
When the intention is to use OpenWrt's own (host) libxml2 one would like
to see this output used instead:
~/tmp/openwrt $ ./staging_dir/hostpkg/bin/xml2-config --cflags
-I/home/sk/tmp/openwrt/staging_dir/hostpkg/include/libxml2
This commit addresses this by installing xml2-config with a suitable
prefix and creating a symbolic link xml2-config. This is done for both
the host package and the normal package. The latter also needs this fix
because the target may use the same triplet as the host system (for
instance x86_64 cross-compiling for x86_64).
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
Commit 218f0229a4594b32d9db6ad0678cdce7e2663e27 added a workaround for a
problem. The host compile overwrote xml2-config in
"$(STAGING_DIR)/host/bin". The workaround fixed the issue for regular
target packages. But it didn't leave a proper xml2-config script for
host packages.
Times have changed. Host packages are now installed in
"$(STAGING_DIR_HOSTPKG). So there is no longer any danger of the host
package overwriting the xml2-config script for target packages. So
revert the mentioned commit, leaving us with two proper xml2-config
scripts, one for target package builds and one for host package builds.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
Changelog:
* Fix OpenWRT with existing forwarder + fix dnsmasq restore issue
* Refactor service execution to better report errors
* Refactor merlin tz setup so it does not need to curl on boot
* Improve upgrade command for install.sh
* Do not mask curl error on install
* Fix timezone logging issue with Merlin
* Add support for Merlin John's fork
* Add raspbian support to installer
* Fix upgrade not reinstalling service
* Limit the aarch64 fix to merlin
* Reset DHCP DNS to self on Merlin router setup
* Fix memory issue with aarch64 based router
* Update Go version
* Allow override of detected env
* Setup timezone correctly on Merlin init script
* Don't ignore curl error on install
* Fix Asus Merlin John’s fork trust store issue
* Fix synology auto setup
* Fix report client info not enabled with setup-router option
* Add support for edgeos DHCP lease file locations
* Fix signal handling when running as a service
* Fix exit menu keyboard shortcut
* Do not fail on upgrade if uninstall failed
* Fix exit menu in installer
* Remove failing upx (for now)
* Make sure nextdns keeps running once ssh session is closed
* Add auto setup of Synology with DHCP server enabled
* Use router's DNS to discover more names
* Get A/AAAA from both answer and addition sections
* Ignore certain invalid names during discovery
* Fix activate with setup-router
* Fix serveral install issues
* Add exponential backoff to mdns probe retry
* Correctly end dhcp lease probing when discovery is cancelled
* Store DHCP/MDNS discovered addrs separately to avoid ping/pong
discovery
* Add DHCP lease support to client discovery
* Do not report mdns listen unreachable error as start will retry
* Reimplement mdns client discovery
* Fix installer GOARCH detection with arm6+
* Fix bin install on platforms needing sudo
* Correctly detect edgeos and ddwrt as routers
* Fix install.sh sudo
* Disable upx as it break many platforms
* Fix installer regression with merlin
* Fix mips64 detection
* Fix OpenWRT detection
* Fix UPX post build script
* Fix install with John's Asuswrt-Merlin fork
* Fix more DDWRT
* Fix DDWRT support
* Fix merlin service add/remove
* Use UPX to compress binaries typicially used on routers
* Revert "Remove direct dep on reflect"
* Use letters for installer menus
* Fix install script for upgrades not working if binary is running
* Do not return an error on mdns listen if at least one interface worked
* Fix installer for synology
* Fix pfSense support
* Remove the logs for each server on each connect
* Move install instructions to wiki
* Fix install.sh uid detection with merlin
* Fix install.sh for arm6+
* Add Synology init system support
* Fix install.sh
* Add a generic router setup that just changes the listen to public
* Update README
* Add auto setup support for EdgeOS
* Restore per OS install instruction in readme during installer beta
* Refactor install.sh
* Remove dep on golang.org/x/net/ipv[4|6]
* Remove direct dep on reflect
* Rewrite the zeroconf code to use dnsmessage instead miekg/dns
* Add auto setup support for DD-WRT
* Improve arch detection
* Add auto setup support for OpenWRT
* Add automatic router setup support
* Fix service
* Remove dep en seq on sysv style init scripts
* Add Entware init system support
* Report init system used on install and in UA
* Add EdgeOS support
* Reads /etc/hosts before forwarding queries to the upstream
* Fix localhost resolution with Linux arch empty /etc/hosts
* Use /etc/hosts file to resolve listen address and list on all IPs
listed
* Add support for multiple router firmware
* Fix hardened privacy disabling dual stack
* Add a config set sub command and refactor commands handling
* Add support for activate on freebsd
* Fix inverted MAC matching
* Add unit test for conf prefix match #35
* Activate uses listen address instead of static 127.0.0.1
* Improve FreeBSD integration
* Add FreeBSD support
* Fix a typo
* Use zip for windows archive
Signed-off-by: Olivier Poitrey <rs@nextdns.io>
Edited PKG_RELEASE to 1
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit a3b028b357)
Currently luci is broken in 19.07.
Changes done to fix this problem didn't merge in the
19.07 release.
Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
This backports patches from bpo-34585[1] to fix byte order detection of
floats.
Fixing byte order detection allows the repr() of floats to be shorter (a
feature backported to Python 2.7 from Python 3.1[2]).
sys.float_repr_style should be 'short' instead of 'legacy' on supported
platforms.
See #11134.
[1]: https://bugs.python.org/issue34585
[2]: https://docs.python.org/2.7/whatsnew/2.7.html#python-3-1-features
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from a0da5aec7f)
Omitted PKG_RELEASE change
Optionally fixes compilation with uClibc-ng.
Based on the surrounding code, this looks like an oversight.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from 608df65a62)
Adjusted PKG_RELEASE
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
The host build requires libxml2-dev. This commit adds the dependency for
libxml2/host, as the host system may not have it installed. This also
avoids using the host's xml2-config (in /usr/bin for instance) while
linking to libraries in staging_dir/hostpkg.
ldd staging_dir/hostpkg/bin/xsltproc | grep xml2
libxml2.so.2 => /home/sk/tmp/openwrt/staging_dir/hostpkg/lib/libxml2.so.2 (0x00007fcc0644c000)
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
(cherry-picked from 05f0beb6a8)
* allows building as mips16 (fixes broken mips16/32 mixed static linking)
* add some static link related flags to reduce target binary size
Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
(cherry-picked from a558b20944)
On GCC9, it throws a Wformat-nonliteral error. Unfortunately, there's no
easy was to fix it as it is fortify-headers where the warning ultimately
comes from.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from abdec8939e)
* rename smbd->ksmbd (upstream name change)
* ksmbd-tools: build with static glib2 (usmbd = ~90kb, smbuseradd = ~40kb)
* new etc folder location = /etc/ksmbd/smb.conf
* new database name = /etc/ksmbd/ksmbdpwd.db
* fixes "map to guest = Bad User" while userdb is also used
* fixes missing ipv6 support
* update/rename to "luci-app-ksmbd"
* remove UCI samba compatibility code for section names (ksmbd uses [share] + [globals] not [sambashare] + [global])
* ksmbd: release 3.1.1 version
* ksmbd: does not work if ipv6 module is not loaded or compiled in
* ksmbd: capsule ifdef CONFIG_SMB_INSECURE_SERVER with smb1 codes
* ksmbd: release 3.1.0 version
* ksmbd: fix over 80 character warnings
* ksmbd: rename smbd-tools to ksmbd-tools in travis.yml
* ksmbd: fix password db file location in travis.yml
* ksmbd: rename smbd prefix function to ksmbd
* ksmbd: rename smbd prefix source files to ksmbd
* Revert "smbd: set connection status with SMBD_SESS_EXITING instead of direct destory"
* ksmbd: rename smbd to ksmbd in .travis.yml
* smbd: rename module name to ksmbd.ko
* smbd: set connection status with SMBD_SESS_EXITING instead of direct destory
* smbd: previous session with same user and same password should be deleted
* smbd: only use global session table in smb2 session
* smbd: add support for ipv6
* smbd: fix empty macro issue from smbd_debug
* cifsd: fix printing of file names in find_next
Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
Latest stable release, contains security fixes for EAP-PWD (side-channel leak), logrotate settings (CVE-2019-10143) and a DoS issue due to multithreaded BN_CTX access (CVE-2019-17185).
Also refreshed patches/002-disable-session-cache-CVE-2017-9148.patch due to the following changes/commits in freeradius:
bf1a1eda23a3c46544b3
Signed-off-by: Robby K <robbyke@gmail.com>
This allows custom config parameters to be added to the generated config
files, enabling the original intended functionality per
https://openwrt.org/docs/guide-user/services/ups/software.nut.
Example usage from /etc/config/nut_server:
config driver 'apc'
option driver 'snmp-ups'
option snmp_version 'v3'
option port '172.16.100.5'
list other 'secLevel'
list other 'secName'
list other 'authPassword'
list otherflag 'notransferoids'
config other 'other_secLevel'
option value 'authNoPriv'
config other 'other_secName'
option value 'some_username'
config other 'other_authPassword'
option value 'some_password'
config other 'otherflag_notransferoids'
option value '1'
Signed-off-by: Matt Merhar <mattmerhar@protonmail.com>
(cherry-picked from 0b04dd34a0)
Replaces OpenWrt patch with upstream patch. Also removes
0002-Fix-check-for-empty-string.patch as this is included in upstream
OpenSSL 1.1.0 patch.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
(cherry-picked from 7d4f1b8589)
This commit makes
- the libgd dependency (as well as specifying libs and includes)
- the configure argument "--with-cgi"
dependant on whether the package nut-web-cgi is selected.
nut-web-cgi is also added to PKG_CONFIG_DEPENDS.
Resolves: #10641
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
(cherry-picked from cdd660a41d)
This version is up to 20% faster than 1.0.1.
Build without cryptouser information, which is not available in 19.07.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
Use a fixed ENGINES_DIR location, instead of trying to read it from the
openssl Makefile.
It also fixes the zero-copy config option not being passed down to the
cmake options.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry-picked from 6a5f7920e9)
This is an alternate AF_ALG engine for openssl, based on the devcrypto
engine, but using the AF_ALG interface instead of /dev/crypto.
It is different than the AF_ALG engine that ships with OpenSSL:
- it uses sync calls, instead of async
- it suports more algorithms
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 0e0bd6da4b)
This version adds a new RegSet API, and fixes the following:
- CVE-2019-19012
- CVE-2019-19203
- CVE-2019-19204
- CVE-2019-19246
- some problems (found by libFuzzer test)
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry-picked from 94895ec818)
This fixes how GOARM is selected for arm platforms, based on support for
VFP/VFPv3 rather than CPU version.
Fixes#10967.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
This package is required by other packages to run some binaries via
`load_entry_point`.
So, this splits this package away from setuptools.
setuptools is pretty big, akd pkg-resources is also big, but not as big.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
(cherry picked from commit ed0e77f3c3)
Reference to discussion at
c61579b564 (commitcomment-36665837)
Adjusted python PKG_RELEASE items to current situation
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Fixes:
when using HTTP/2 a client might cause excessive memory
consumption and CPU usage (CVE-2019-9511, CVE-2019-9513,
CVE-2019-9516).
Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
(cherry picked from commit 5ffc744018)
Note:
In some cases when tor daemon starts before
than the router is connected to the Internet.
Tor will exit and you have to run it manually.
This should fix this case.
Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit 5bce9c3e1d)
go invokes the external linker by calling gcc, so -zxxx options in
TARGET_LDFLAGS (in golang-package.mk) need to be formatted as -Wl,z,xxx.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from dbd6f224c3)
PKG_RELEASE not bumped because this only affects package description.
We document that passlib and bcrypt are needed if one wishes to use
bcrypt encryption of passwords. These have not been added as dependencies
as Radicale2 can have a frontend webserver authenticate users rather than
radicale itself.
Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>
Makefile always checks the existence of host's NAT-PMP header,
which results in internal NAT-PMP code being used if it's missing.
Add a patch to make it check targets' header instead.
Use aligned_alloc() instead of valloc() in case of uclibc.
Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
Relevant bits of upstream changelog
New Features
argon2: Support more hashes
scrypt: Now uses python 3.6 stdlib’s hashlib.scrypt() as backend, if present (issue 86).
Bugfixes
Python 3.8 compatibility fixes
passlib.apache.HtpasswdFile: improve compatibility with Apache 2.4's htpasswd
passlib.totp: fix some compatibility issues with older TOTP clients (issue 92)
Fixed error in argon2.parsehash() (issue 97)
Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>
go build/install supports multiple -ldflags arguments, but they are not
combined; for each package, the latest match on the command line is
used.[1]
Previously, the main executable would not be affected by the default
ldflags if GO_PKG_LDFLAGS or GO_PKG_LDFLAGS_X were set. (The default
ldflags instructs go to use the external linker.)
This fixes golang-package.mk so that the default ldflags take effect in
all cases.
[1]: https://golang.org/cmd/go/#hdr-Compile_packages_and_dependencies
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from 4827bc7509)
[openwrt-19.07] libuv: update to 1.32.0
update to 1.32.0
Update is required to build the latest node.js v12.x.
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
Repository was renamed to github.com/DNSCrypt/dnscrypt-proxy
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit cddf39cbd1)
Busybox in default uses SHA512 as well.
On big ditribution this default is sourced from PAM. That means that
shadow reads pam settings and uses that. OpenWrt in most cases does not
have PAM installed and in such case shadow fallbacks to its own default
which is DES. This just changes that default to SHA512 which is
consistent with rest of the system.
Signed-off-by: Karel Kočí <karel.koci@nic.cz>
(cherry picked from commit f27ce05a58)
usleep is deprecated and is optionally not available with uClibc-ng.
Added PKG_LICENSE_FILES.
Added PKG_CPE_ID for proper CVE tracking.
Other minor cleanups.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 1f1cec28b7)
In the command read side, close the superfluous write end of the pipe
early to ensure that EOF is reliably detected. Without that change, splice
calls to read from the pipe will occasionally hang until the CGI process
is eventually killed due to timeout.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit dde503da13)
Implement a new "cgi-exec" applet which allows to invoke remote commands
and stream their stdandard output back to the client via HTTP. This is
needed in cases where large amounts of data or binary encoded contents
such as tar archives need to be transferred, which are unsuitable to be
transported via ubus directly.
The exec call is guarded by the same ACL semantics as rpcd's file plugin,
means in order to be able to execute a command remotely, the ubus session
identified by the given session ID must have read access to the "exec"
function of the "cgi-io" scope and an explicit "exec" permission rule for
the invoked command in the "file" scope.
In order to initiate a transfer, a POST request in x-www-form-urlencoded
format must be sent to the applet, with one field "sessionid" holding
the login session and another field "command" specifiying the commandline
to invoke.
Further optional fields are "filename" which - if present - will cause
the download applet to set a Content-Dispostition header and "mimetype"
which allows to let the applet respond with a specific type instead of
the default "application/octet-stream".
Below is an example for the required ACL rules to grant exec access to
both the "date" and "iptables" commands. The "date" rule specifies the
base name of the executable and thus allows invocation with arbitrary
parameters while the latter "iptables" rule merely allows one specific
set of arguments which must appear exactly in the given order.
ubus call session grant '{
"ubus_rpc_session": "...",
"scope": "cgi-io",
"objects": [
[ "exec", "read" ]
]
}'
ubus call session grant '{
"ubus_rpc_session": "...",
"scope": "file",
"objects": [
[ "/bin/date", "exec" ],
[ "/usr/sbin/iptables -n -v -L", "exec" ]
]
}'
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit b2a890f6ad)
I am upstream for msmtp-scripts and have decided to abandon the project. Therefore
remove msmtp-scripts from OpenWrt -- there is already msmtp-queue which is 'good enough'
for the use cases where msmtp-scripts had any relevance.
This backports to 19.07 so that it doesn't become something folks are depending on.
Due to changes in lock behaviour it never worked in 18.04.x, so ditching it now
keeps it from being picked up again by the userbase.
Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>
Also fix the license information: in older versions the test programs
were GPL 3 licensed, but meanwhile it changed to BSD license.
But since this package only packages the library itself, we can
safely focus only on the LGPL here which covers the library itself.
While at, fix a minor nitpick during library symlink installation.
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
- IPv6 support
- Fix HTTP/2 negociation
- Improve endpoint fallback
- Add support for unencrypted DNS
- Many other fixes and features
Signed-off-by: Olivier Poitrey <rs@nextdns.io>
While outwardly a major update, this mainly pulls in fixes related to
openssl verson changes that ensure this continues running on OpenWrt
Signed-off-by: Karl Palsson <karlp@etactica.com>
* remove 'ransomware' blocklist by abbuse.ch (discontinued)
from default adblock config
* fix/switch 'someonewhocares' config to https only
* fix curl download parameters to follow redirects and
suppress needless output
* made the tmp directory of sort operations configurable,
set 'adb_sorttmp' accordingly (only supported by 'coreutils-sort')
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 21a85fef22)
This adds a host as well as a target package.
meson.mk is provided to build packages using meson.
Signed-off-by: Andre Heider <a.heider@gmail.com>
(cherry picked from commit d83cba79c1)
This adds a host as well as a target package.
ninja.mk is provided to execute ninja.
The two patches have been taken from upstream to fix compile issues.
Signed-off-by: Andre Heider <a.heider@gmail.com>
(cherry picked from commit 5ead78be5a)
Removed findutils-xargs dependency due to added busybox support in version 2.8
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 2c22dcd3dc)
Disable the init script by default to avoid log pollution; motion is
very verbose when it cannot open the configured camera.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
(cherry-picked from eaa1d5aa18)
This is a bugfix release.
Full changelog available at:
https://mosquitto.org/blog/2019/11/version-1-6-8-released/
Many smaller fixes in various areas, nothing particularly standout as of
special interest to OpenWrt.
Signed-off-by: Karl Palsson <karlp@etactica.com>
Update collectd to 5.10.0
* leave new plugins as disabled for now (procevent, sysevent)
* refresh patches. Remove unenecessary version fix
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry-picked for 19.07. PKG_RELEASE=2 as cpufreq was already backported)
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Adjust the reaction to a polling interval timestamp that references
to a past time.
Past timestamps can happen when ntpd adjusts router's time after network
connectivity is obtained after boot. Collectd shows warnings for each plugin
as it tries to enter new values with the same timestamp as the previous one.
This patch adjusts the next polling time to be now+2 seconds for the main
loop and for the plugin-specific read loops. That avoids the warnings, but
does not overreact in case there are shorter polling intervals or the time
gets adjusted for other reasons.
Additionally some debug statements are aded, but they are visible only
when --enable-debug configure option is used in Makefile.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry-picked for 19.07)
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Update collectd to 5.9.2
Mainly bug fixes:
dfb9dd09fe/ChangeLog
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry-picked for 19.07)
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Collectd without log type plugin loaded will write log lines to stderr.
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry-picked for 19.07)
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
The only action the Threshold plugin takes itself is to generate and
dispatch a notification. Other plugins can register to receive
notifications and perform appropriate further actions.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry-picked for 19.07, line numbers adjusted)
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Redmine-patch-id: 3680
If I build an image with the imagebuilder I get the following output
during image building:
../root-x86/etc/init.d/collectd: line 4: /usr/share/libubox/jshn.sh:
No such file or directory
To remove this messsage move include to the needed postion, so that the
message does not occur during image building on the host system anymore.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry-picked, modified to match 19.07)
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
As some ipq40xx CPUs support frequency scaling, enable building
collectd-mod-cpufreq for ipq40xx (for private builds) and
its package architecture brcm2708_bcm2709 (for buildbot)
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 5e0d5c9c7f)
We use luasrcdiet in Gluon as well. Move it from the luci feed to packages.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
(cherry picked from commit 46d68b8699)
* 5.01.9672 release
* Cedar: handle UDP acceleration and R-UDP versions
* Mayaqua: implement R-UDP version 2, powered by ChaCha20-Poly1305
* Cedar: implement UDP acceleration version 2, powered by ChaCha20-Poly1305
* Cedar: serve new web management interface
* Cedar: implement detailed protocol info
* Mayaqua: add Windows Server 2019 to the supported operating systems list
* Cedar: various fixes
* Cedar: add "DisableIPsecAggressiveMode" option
* Make install dir for unit files configurable
* Protocol.c: adapt ClientConnectGetSocket() for new proxy functions
* Wpc.c: adapt WpcSockConnectEx() for new proxy functions
* Protocol: add ProxyCodeToCedar()
* Move generic proxy stuff from Cedar to Mayaqua
* Proto_OpenVPN.c: improve OvsProcessData(), fix out-of-bounds access found by Coverity
* Proto_OpenVPN.c: fix segmentation fault in OvsProceccRecvPacket()
* Addressing the UDP reflection amplification attack: https://github.com/SoftEtherVPN/SoftEtherVPN/issues/1001
* Mayaqua.h: include <stdarg.h> for "va_list" on Illumos
* Protocol.c: fix bug in ClientConnectGetSocket() causing custom HTTP header not to work
* Mayaqua: move HTTP functions from "Network" to "HTTP"
* Move GetMimeTypeFromFileName() and related structure to Mayaqua
* Mayaqua.h: include <stdio.h> for "FILE"
* Mayaqua.h: include <stddef.h>, for "wchar_t"
* Bump mixin-deep in /src/bin/hamcore/wwwroot/admin/default
* - Fixed the problem occurs when RPC messages between Cluster Members exceed 64Kbytes. - Fixed the RADIUS PEAP client to use the standard TLS versioning. - Implementation of a function to fix the MAC address of L3 VPN protocol by entering e.g. "MAC: 112233445566" in the "Notes" field of the user information. - Implementation of a function to fix the virtual MAC address to be assigned to the L3 VPN client as a string attribute from RADIUS server when authentication.
* Updating built-in Win32 libraries - OpenSSL 1.1.1 -> 1.1.1d - zlib 1.2.3 -> 1.2.11
* Update strtable_cn.stb
* Avoid using hardcoded paths in log file enumeration
* Fix buffer overflow during NETBIOS name resolution
* Update SEVPN.sln
* Create strtable_pt_br.stb
* ci: display error if vpntest failed
* Fix several compile warnings on MS VC++ 2008.
* Enables crash minidump for Win32 vpntest. Minidump files will be saved to the 'C:\Users\<username>\AppData\Local\Temp\vpn_debug' (for normal user) or 'src\bin\vpn_debug\' (for administrator user).
* OpenVPN: use new protocol interface
* Add interface for easy protocol implementation
* add "no-deprecated" to openssl builds "no-deprecated" is widely used in openwrt devices
* Fix LibreSSL support
* Switch to OpenSSL THREADID API
* travis-ci: update openssl, libressl
* enable sonar-scan in travis-ci builds
* Virtual: fix race condition in DHCP server which resulted in multiple clients receiving the same IP
* Mayaqua: Fix compilation without deprecated OpenSSL APIs
* Mayaqua: Replace GNU specific sys/poll.h header with POSIX poll.h
* systemd: replace deprecated CAP_SYS_ADMIN with CAP_SYSLOG
Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
* cifsd-tools: fix Assignment of a signed value which has type 'long'
* init: convert hide_dot_files to yes/no option
* 'read only = no' seems bugged for cifsd/smb.conf, so fix via 'writeable = yes'
Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
* fix possible dns restart issue with DNS File Reset (race condition)
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 219abdc5a1)
Some firewalls mandate a minimum size of 4k for SYN packets, which
transmission does not do by default. Upstream issue here:
https://github.com/transmission/transmission/issues/964
Cleanup:
Fixed license info.
Removed two unnecessary patches.
Ran shell script through shellcheck.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 730a1697fe)
PHP7 fails to load xmlreader.so (php7-mod-xmlreader) module without
dom.so (php7-mod-dom) module loaded:
-snip-
PHP Warning: PHP Startup: Unable to load dynamic library 'xmlreader.so'
(tried: /usr/lib/php/xmlreader.so (Error relocating /usr/lib/php/xmlreader.so:
dom_node_class_entry: symbol not found), /usr/lib/php/xmlreader.so.so (Error
loading shared library /usr/lib/php/xmlreader.so.so: No such file or
directory)) in Unknown on line 0
^C
-snap-
However, this dependency only exists when during build also php7-mod-dom
is selected.
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit b8c22fc1ec)
cifsd: fix uninitialized fp could be freed
cifsd: fix potential uninitialized spnego_blob could be freed
cifsd: smbd: replace spinlock_irqsave with spinlock
cifsd: smbd: avoid the lack of client's send credits
Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
* Update nextdns to version 1.1.5 which adds IPv6 dual stack support.
* Add the ability to configure per host configuration id from uci.
Signed-off-by: Olivier Poitrey <rs@nextdns.io>
* some init tweaks
* use the usual wifi wrapper for reloads
* compatibility fix for latest wifi-related changes
in master (dynamic wireless radio reconfiguration)
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 05c3153bb7)
Drop the config knob 'listen_address' and introduce 'listen_interface'
and 'listen_ipv6' instead.
'listen_interface' takes an openwrt interface name ('loopback', 'lan',
'wan' etc, or "*" for all), from which the primary IP is used to listen
on. If 'listen_ipv6' is set to '1', the IPv6 adress will be used, IPv4
elsewise.
procd interface triggers are now combined with this, so if the listen
interface is not yet configured when the init script is executed, the
process start is defered, and the trigger takes care of that once
the interface is ready.
Fixes#7670
Signed-off-by: Andre Heider <a.heider@gmail.com>
(cherry picked from commit 48568ad9f9)
Upstream release message:
"Letsencrypt CA recent changed the CDN provider, which resulted in hanging issues.
Any downstream package should update.
This is important."
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Fix license info to use SPDX name.
Switched to wget instead of curl to avoid having a dependency on 2 SSL
libraries.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
So that packages like acme requiring features from it can depend on it
explicitly, not the more basic "wget" which is also provided by
"uclient-fetch"
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
The issue was that the pause instruction was emitted through an asm
directive which was not correct for some mips platforms.
Simplified boost-fiber-exclude as a result.
Removed uClibc-ng math patch. It was not correct as it broke float and
long double support (std variants use function overloads). A different
solution was applied upstream. As it's quite annoying to backport, just
wait until a new release comes with that change. ARC as a platform is
barely supported anyways.
Swapped asio patch for the upstream submission, which is unfortunately, in
limbo.
Refreshed remaining patch.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from f795779c0a)
The facebook people have been working on removing Boost dependencies from
their projects. This is the current state.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from ddd4109c1c)
thread is only used when the C++ mutex header is missing. AFAIK, this is
the case on Windows and not on Linux. Certainly not in OpenWrt.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 260d4a346a)
* add missing logd dependency
* check if logd is enabled during runtime
* some more init tweaks
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit de149441a4)
Since the merge of the luci master branch into the luci openwrt.19.07 branch,
the ubus API was not in sync anymore. So all commits from the master
branch where backported into the openwrt-19.07 branch. But this could
not be done linear. There were already some fixes cherry-picked from the
master and the version does not match anymore. This commit syncronized
the PKG_VERSION and the PKG_RELEASE again to make clear that the
version in master and openwrt-19.07 are even again and have so the
same software version until to this commit.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Maintainer: Florian Eckert @feckert
Compile tested: not needed
Run tested: x86_64
Description:
Only two of the four IPs defined for wan are found in wanb, adding it so it is the same.
Signed-off-by: Daniel A. Maierhofer <git@damadmai.at>
(cherry picked from commit 1e97156adc)
Upstream project's behaviour of reporting this data source in range 0-1
is used by at least CentOS 7 collectd 5.8.1, very likely the same
behaviour is also in widely use by other distributions.
The change is important for providing consistent experience across
collectd deployments on different environments
Ref: https://github.com/collectd/collectd/pull/3244
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry picked from commit 2f66fa5c23)
Ref: https://github.com/openwrt/luci/issues/3308
Sometimes the return value of `ubus -S call network.interface.wan status`
cause `json_load` to return `Failed to parse message data` error.
To avoid this, the JSON data always should be quoted with double quotes.
Signed-off-by: Evren Yurtesen <eyurtese@abo.fi>
Removed quoatation marks from commit heading
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Update the version string from 2.8.1 (master) to 2.7.15 (openwrt-19.07)
(cherry picked from commit 94e0c78826)
Add the OpenWrt TARGET_LDFLAGS to the compile command to activate PIE support
for the io tool when it is activated globally in OpenWrt.
Signed-off-by: Hauke Mehrtens <hauke.mehrtens@intel.com>
(cherry-picked from b46d21a54e)
On 64 bit Linux systems long is 8 bytes long, on 32 bit Linux systems it
is 4 bytes long. Here we want to print 4 bytes and not 8 bytes, use int
instead of long.
This fixes printing 4 bytes on 64 bit systems.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry-picked from 9936e16b72)
Only when /dev/mem is opened with O_SYNC the write and *read* is done
uncached. We saw wrong values read out from the hardware without setting
O_SYNC, the busybox devmem tool showed different values, when O_SYNC is
also set for the io tool, it reads out the same values as devmem.
When looking at the drivers/char/mem.c file in the kernel it is behaving
differently based on the O_DSYNC flag.
Signed-off-by: Hauke Mehrtens <hauke.mehrtens@intel.com>
(cherry-picked from 90df0f3e24)
Add libpcrecpp to PKG_CONFIG_DEPENDS to properly trigger
reconfiguration, avoiding unnecessary dependency.
This reverts commit 17090fecf1.
This reverts commit ec138f51ab.
Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
(cherry-picked from 41814de0fc)
Add required libevent2-pthreads dependency for all ntpd
subpackages.
Remove keygen-specific libevent2-core support as it is
automatically selected by the libevent2-pthreads dependency.
nptd: Bump PKG_RELEASE
Fixes: openwrt/packages#10307
Signed-off-by: Kenneth J. Miller <ken@miller.ec>
(cherry picked from commit ded6468744)
This is required as curl 7.66.0 was cherry-picked to openwrt-19.07 3
days ago. Otherwise, compilation of perl-www-curl fails.
This reverts commit ec6cd9b9c3.
* limit firewall hotplug trigger to certain wan 'INTERFACE' as well,
to prevent possible race conditions during boot
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 0dee2a92de)
All symbols on MacOS are prefixed with an underscore which
interfered with the filtering mechanism (added in perl 5.28)
for extension libraries to be linked into static perl.
Signed-off-by: Jakub Piotr Cłapa <jpc@loee.pl>
(cherry-picked from commit 3954356)
Change deprecated options to a new one:
DetectBrokenExecutables to AlertBrokenExecutables
ArchiveBlockEncrypted to AlertEncrypted
Fixes: CVE-2019-12900 and CVE-2019-12625
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
- Migrated init-script to procd.
- Removed the old hotplug script as it is unnecessary and
caused long boot-times for r7800 and possibly others.
Signed-off-by: Christian Lachner <gladiac@gmail.com>
* fix a logical glitch in the hotplug event handler
* properly handle fatal iptables errors - even in subshells
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 49b43b81e8)
* more startup tweaks
* re-use f_log function in helper scripts
* small fixes / polish up for forthcoming 19.07 release
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 72fba3a17b)
* fix race condition in download utility detection during boot
* fix multiple possible bugs in ipset creation
* prevent parallel service starts
* refine service trigger handling
* add ssh daemon auto detection
* print to stdout if 'logger' is not available
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit fcea2f75c3)
* print to stdout if 'logger' is not available
* add support to set the service nice level (default is 0)
* small fixes / polish up for forthcoming 19.07 release
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 0d406b2a42)
* more startup tweaks
* re-use f_log function in helper scripts
* small fixes / polish up for forthcoming 19.07 release
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 2c3cb6f1d1)
E.g. some packages are target, or arch specific, skip compiling them if
they cannot be enabled for current sdk. This should reduce false
positives for packages like docker-ce etc.
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry picked from commit 4f3244db40)
Installing all packages via ./scripts/feeds install -a produces a lot of
error messages, it is also possible to only install the packages which
were touched by the PR.
Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit b8931afc94)
This looks like something was not cherry-picked, or was cherry-picked
incorrectly. Those packages don't exist.
Warnings are:
```
WARNING: Makefile 'package/feeds/packages/seafile-seahub/Makefile' has a dependency on 'django-simple-captcha', which does not exist
WARNING: Makefile 'package/feeds/packages/seafile-seahub/Makefile' has a dependency on 'django-statici18n', which does not exist
WARNING: Makefile 'package/feeds/packages/seafile-seahub/Makefile' has a dependency on 'django-webpack-loader', which does not exist
```
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
Indeterminably vim/host fails on the build bots:
objects/fileio.o: In function `readfile':
fileio.c:(.text+0x5b3f): undefined reference to `libiconv_close'
fileio.c:(.text+0x61ad): undefined reference to `libiconv_close'
fileio.c:(.text+0x62f6): undefined reference to `libiconv'
fileio.c:(.text+0x6794): undefined reference to `libiconv_close'
objects/fileio.o: In function `buf_write_bytes':
fileio.c:(.text+0xa1fe): undefined reference to `libiconv'
fileio.c:(.text+0xa54a): undefined reference to `libiconv'
objects/fileio.o: In function `buf_write':
fileio.c:(.text+0xaf48): undefined reference to `libiconv_close'
objects/mbyte.o: In function `my_iconv_open.part.18':
mbyte.c:(.text+0x2ced): undefined reference to `libiconv_open'
mbyte.c:(.text+0x2d3a): undefined reference to `libiconv'
mbyte.c:(.text+0x2d5f): undefined reference to `libiconv_close'
objects/mbyte.o: In function `convert_setup_ext':
mbyte.c:(.text+0x33bf): undefined reference to `libiconv_close'
objects/mbyte.o: In function `string_convert_ext':
mbyte.c:(.text+0x363c): undefined reference to `libiconv'
collect2: error: ld returned 1 exit status
link.sh: Linking failed
Makefile:1949: recipe for target 'vim' failed
This is addressed by pulling in libiconv/host. Also configure switches
are added that keep external dependencies to a minimum, for instance
avoiding to link to X11 or gettext.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
(cherry-picked from dc727a2430)
- The old hotplug script caused long boot-times for r7800 and
possibly others. The new script is now only triggered by iface
changes for wan and lan interfaces.
Signed-off-by: Christian Lachner <gladiac@gmail.com>
This adds a new (optional) variable, PYPI_SOURCE_NAME, to pypi.mk.
For some PyPi packages (e.g. aiohttp_cors, click, django-compressor),
the name of the package and the source tarball name are slightly
different (usually by capitalisation or hyphen/underscore change).
This new variable is to make this difference explicit. PYPI_NAME is
meant for the "official" package name, whereas PYPI_SOURCE_NAME is meant
for the source tarball name.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry-picked from commit 1bacdd52f7)
This adds pypi.mk, which can be included in Python packages that
download their sources from PyPI, to auto-fill various PKG_* variables
based on the value of PYPI_NAME.
This makefile should be included after $(TOPDIR)/rules.mk but before
$(INCLUDE_DIR)/package.mk (and $(INCLUDE_DIR)/host-build.mk).
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry-picked from commit add4c42191)
This also updates the user id comments for GPG keys and untrusted
comments for usign keys.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from 89d6f51c98978bbdb61c6ada9d2264cf7dca854c)
This change also updates the maintainer email to cotequeiroz@gmail.com, as
requested on a different change.
Not updating deps here, since that will be done in the next changeset that
will convert packages to the Python[3] packaging format.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
(cherry-picked from commit 70ebc7a2f4)
This changes the python[3]-django dependencies in packages to be
non-selecting, and adds an MDEPENDS line so that the *-src packages get
placed inside the django menu as well.
Added MENU:= to the src-package definitions in python[3]-package.mk,
so it does not import that setting from the binary package.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry-picked from commit 90527d75af)
This change also updates the maintainer email to cotequeiroz@gmail.com, as
requested on a different change.
Also, changing here is the download URL to github's codeload, since that
one offers .tar.gz archives.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
(cherry-picked from commit 545cff8b63)
The email change was part of a previous request from a different PR series.
In this series, the change is the only thing left to do (from what the
original changeset intended to do).
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
(cherry-picked from commit f5eb040e6b)
The pillow package has been updated to the Python[3] packaging format, and
now the package names are `python-pillow` & `python3-pillow`.
This change updates seafile-seahub to use it.
Not updating other packages as they will be converted to Python[3]
packaging format.
And not bumping PKG_RELEASE here as it will be done in the last commit that
updates deps for seafile-seahub.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
(cherry-picked from commit cc33edc138)
This also updates all dependencies to use the new `python-django` package.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
(cherry-picked from commit f026dba26e)
seafile-seahub's build is a mess.
It hijacks some OpenWrt mk files into the build.
This can be avoided by provided some of the required parameters via
env-vars and patching the env-vars into the build.
Which is what this patch does.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
(cherry-picked from commit cf99755444)
The change is mostly organizational.
More packages will be moved to have python- or python3- prefixes.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
(cherry-picked from commit 1c5f5b61d3)
This allows collectd to get data of Mikrotik devices in a improved way than via SNMP.
closes#10327
Signed-off-by: Sven Roederer <devel-sven@geroedel.de>
cherry-pick does not apply cleanly changed PKG_RELEASE number.
(cherry picked from commit 4261f45734)
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
This is not a C++ project.
Added PKG_BUILD_PARALLEL for faster compilation.
Cleaned up Makefile to modern standards.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from b288514308)
librouteros is a library to communicate with RouterOS, the operating system of MikroTik's
RouterBoards. It uses the API port provided by those systems to connect and talk to the
devices.
API connections must be explicitly enabled. To do so, issue the following command:
> /ip service enable api
Signed-off-by: Sven Roederer <devel-sven@geroedel.de>
(cherry-picked from commit abaca50b57)
setuptools: Updated to version 41.2.0
pip: Updated to version 19.2.3
Removed patches:
- 017: code was refactored
- 02{5,6,7,8}: those patches were backported from upstream and they are
included in 3.7.5
Refreshed patches
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Removed PKG_FIXUP. It has no meaning with CMake.
Replaced PKG_INSTALL with CMAKE_INSTALL. Consequentially, removed
InstallDev section.
Added ABI_VERSION to force package rebuilds when it increases.
Added PKG_BUILD_PARALLEL for faster compilation.
Fixed license tag.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from commit 6a1cd83265)
Changes:
Fix CVE-2019-13115
Remove old patches
Switch to cmake
Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry-picked from commit 9c1a23d977)
rtorrent is the only user of libtorrent. Statically link to save space.
Added usleep patch.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 358495f118)
libtorrent is only used by rtorrent. Switch to a static library to save
space.
Removed libsigc++ dependency. It seems it's not needed.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from e56fada5a8)
Added patches sent upstream to fix usage with uClibc++.
Cleaned up license information.
Added several size optimizations.
Several other Makefile cleanups.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
argp-standalone is only needed for non GLIBC targets.
Added PKG_BUILD_PARALLEL for faster compilation.
Removed unnecessary C/LDFLAGS.
Remove libstdcpp depends. It's included with libfmt.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 5a7ac1d83b)
Several Makefile cleanups.
Added PKG_BUILD_PARALLEL for faster compilation.
Several size optimizations applied.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 21e195f657)
libzmq is used by fbzmq, which absolutely requires libstdcpp since it's a
C++14 project. There's no point in using two libc++.
Cleaned up Makefile for consistency between packages.
Added nanosleep patch for platforms that are missing usleep.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from ad11587c40)
This package adds support for /etc/shinit and ~/.shinit files, which
contain commands to be run at the start of all interactive shells.
(/etc/profile and ~/.profile are read for login shells only.)
This is useful for those who regularly open non-login, interactive
shells, for example users of GNU Screen or tmux.
(This is based on a patch[1] I submitted for OpenWrt master, but there
does not appear to be much interest in merging the change.)
(This package uses the ENV shell variable, of which the POSIX standard
has a brief description[2]. The dash manpage[3] also describes how the
ENV variable is handled. (dash is the basis for busybox ash.))
[1]: https://patchwork.ozlabs.org/patch/1094493/
[2]: https://pubs.opengroup.org/onlinepubs/9699919799//utilities/V3_chap02.html#tag_18_05_03
[3]: https://manpages.debian.org/buster/dash/dash.1.en.html#Invocation
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from c04dff7965)
Fixes following errors:
main.c:458:37: error: comparison of integer expressions of different signedness: ‘int’ and ‘size_t’ {aka ‘long unsigned int’} [-Werror=sign-compare]
main.c:463:17: error: comparison of integer expressions of different signedness: ‘int’ and ‘long unsigned int’ [-Werror=sign-compare]
main.c:518:35: error: comparison of integer expressions of different signedness: ‘ssize_t’ {aka ‘long int’} and ‘size_t’ {aka ‘long unsigned int’} [-Werror=sign-compare]
main.c:157:3: error: ignoring return value of ‘read’, declared with attribute warn_unused_result [-Werror=unused-result]
main.c:763:3: error: ignoring return value of ‘chdir’, declared with attribute warn_unused_result [-Werror=unused-result]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit bb6cdb804c)
Currently cgi-io try to read data after the data ended.
- Adds "-" to whitelist char
- In main_upload is tried to consume the buffer while it's already readed by the while loop before
Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
(cherry picked from commit 535b2b6bd8)
Instead of always replying with a generic 500 internal server error code,
use more appropriate codes such as 403 to indicate denied permissions.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 8c22db6531)
Add a new `cgi-download` applet which allows to retrieve the contents
of regular files or block devices.
In order to initiate a transfer, a POST request in x-www-form-urlencoded
format must be sent to the applet, with one field "sessionid" holding
the login session and another field "path" containing the file path to
download.
Further optional fields are "filename" which - if present - will cause
the download applet to set a Content-Dispostition header and "mimetype"
which allows to let the applet respond with a specific type instead of
the default "application/octet-stream".
Below is an example for the required acl rules to grant download access
to files or block devices:
ubus call session grant '{
"ubus_rpc_session": "...",
"scope": "cgi-io",
"objects": [
[ "download", "read" ]
]
}'
ubus call session grant '{
"ubus_rpc_session": "...",
"scope": "file",
"objects": [
[ "/etc/config/*", "read" ],
[ "/dev/mtdblock*", "read" ]
]
}'
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit ab2a2b080d)
Use the `cgi-io` scope to check for permission to execute the requested
command (`upload`, `backup`) and the `file` scope to check path
permissions.
The reasoning of this change is that `cgi-io` is usually used in
conjunction with `rpcd-mod-file` to transfer large file data out
of band and `rpcd-mod-file` already uses the `file` scope to manage
file path access permissions. After this change, both `rpc-mod-file`
and `cgi-io` can share the same path acl rules.
Write access to a path can be granted by using an ubus call in the
following form:
ubus call session grant '{
"ubus_rpc_session": "...",
"scope": "file",
"objects": [
[ "/var/lib/uploads/*", "write" ]
]
}'
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit c8a86c8c8e)
Introduce further ACL checks to verify that the request-supplied
upload location may be written to. This prevents overwriting things
like /bin/busybox and allows to confine uploads to specific directories.
To setup the required ACLs, the following ubus command may be used
on the command line:
ubus call session grant '{
"ubus_rpc_session": "d41d8cd98f00b204e9800998ecf8427e",
"scope": "cgi-io",
"objects": [
[ "/etc/certificates/*", "write" ],
[ "/var/uploads/*", "write" ]
]
}'
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 22be9a1c01)
* the WAN auto detection now supports multiple interfaces, too
* no longer filter out possible LAN devices
* add a new DoH (DNS over HTTPS) blocklist source with public
DoH DNS server addresses, to effectively block client side DoH
communication, e.g. via Firefox or Chrome
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 70ab67649b)
* new 'ca-bundle' dependency as all https connections
are now validated by default
* automatically select the download utility: 'aria2', 'curl',
'uclient-fetch' with libustream-* or wget are supported
* track & ban failed LuCI login attempts as well
* add a small log/banIP background monitor to block
SSH/LuCI brute force attacks in realtime (disabled by default)
* add a config version check (please update your default config!)
* made the automatic wan detection more stable
* fix the IPv6 logfile parser
* fix the service status message
* update readme
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit ff8b853a6d)
These patches address issues:
CVE-2019-16056: email.utils.parseaddr mistakenly parse an email
CVE-2019-16935: A reflected XSS in python/Lib/DocXMLRPCServer.py (for
Python 2.7)
CVE-2019-16935 was fixed for python3 in #10109
Links to Python issues:
https://bugs.python.org/issue34155https://bugs.python.org/issue38243
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
This release incorporates fixes for CVE-2019-13224 and CVE-2019-13225,
and "fixed many problems (found by libfuzzer programs)."
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit b7d0a82a7f)
Add code blocks for easier reading and change "dns" to "DNS".
Signed-off-by: Claudius Ellsel <claudius.ellsel@live.de>
(cherry picked from commit 088a14e5ce)
This can be helpful for example in hotels where you need to
enter a new user/password combination every week.
Signed-off-by: Johannes Rothe <mail@johannes-rothe.de>
(cherry picked from commit a7f87f939d)
Go 1.13 added a new -trimpath option to the "go build" command[1] that
removes system paths from compiled executables. This replaces the
previous -trimpath flags.
There are still system paths in the compiled executable (for crti.o and
crtn.o, when cross-compiling); these appear to be stripped during the
packaging process.
[1]: https://golang.org/doc/go1.13#trimpath
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry-picked from commit 22ee6e86a0)
Patch 002 - Force Python3 is no longer applying, let's try to throw it
away to see if it is still necessary
Patch 003 - Was backported from the master branch and it was included in
Netdata version 1.17.0
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry-picked from commit 5e89816)
Repository was moved.
Also cleaned up Makefile slightly.
Ran init script through shellcheck.
Added PKG_BUILD_PARALLEL for faster compilation.
Added several CFLAGS and LDFLAGS for smaller size.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from f3245e6c7d)
When passing -Wimplicit-function-declaration
Also got rid of std=gnu89. It's easy to patch out.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 1b5e4883a4)
Cleaned up Makefile for consistency between packages.
Switched to CMAKE_INSTALL to get rid of the InstallDev section.
Refreshed patches.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 2e2929366b)
The libyajl cleanup commit revealed that it was not being installed
correctly. Now that it is, mpd picks it up properly.
Enabled SoundCloud support for the full variant. Disabled for the mini.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 835bc1df03)
Replaced git:// link with https:// which gets through firewalls easier.
Replaced archive with .xz. The one currently in the mirrors has the wrong
hash. .xz is also smaller than .gz.
Eliminated already default CMake option.
Eliminated Build/InstallDev with CMAKE_INSTALL.
Added PKG_BUILD_PARALLEL for faster compilation.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 2abbc83c9d)
Update Makefile to modern standards.
Switched to local tarballs..xz archives are smaller. The .gz archive that
codeload comes with is 85MB.
Replaced PKG_INSTALL with CMAKE_INSTALL to get rid of Build/InstallDev.
Added PKG_BUILD_PARALLEL for faster compilation.
Removed inactive maintainer.
Added uClibc-ng patches to fix compilation.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from f8cd4f094a)
It seems newer versions of fbthrift require more libraries.
Also added AR7, RB532, and Lantiq ASE to fiber exclusion.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 1f77459ace)
This commit updates Boost to version 1.71.0 and disables Boost.Context
for arc and mips64 architectures, since either jump_fcontext or
getcontext are undefined for those architectures.
It also fixes a bug were Boost.Fiber was not properly disabled for
mips32 and mips64 architectures.
Boost.Coroutine2 option was removed since it was redundant. By selecting
the Coroutine package, Coroutine2 is also installed.
Boost.Fiber has been disabled for target brcm47xx_generic and brcm47xx_legacy
due to misssing opcode support from instruction set.
Boost 1.71.0 brings a new header-only library
- Boost.Variant2 [1]
-> A never-valueless, strong guarantee implementation of
std::variant, from Peter Dimov.
More info about Boost 1.71.0 can be found at the usual place [2].
[1]: https://www.boost.org/doc/libs/1_71_0/libs/variant2/doc/html/variant2.html
[2]: https://www.boost.org/users/history/version_1_71_0.html
Signed-off-by: Carlos Miguel Ferreira <carlosmf.pt@gmail.com>
(cherry-picked from 0cd9824623)
HAVE_ICONV and HAVE_ICONV_H are two different headers that both need to
evaluate to false. Added the extra CONFIGURE_VARS.
This can be verified by passing -Werror=implicit-function-declaration
Added PKG_LICENSE_FILES
Updated homepage URL.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from bf2f1a0263)
The double quote thells the shell that the list returned from `pidof` is a
single argument, therefore, `renice` will cry about a malformed input.
With this commit, `renice` will be applied correctly to all the returned PIDs
from `pidof`.
The output of `renice` for the quoted list is as follows:
`renice: invalid number '6592 6587 6586 6574'`
`renice` does not show and does apply the nice value if the list is unquoted.
Signed-off-by: Oever González <notengobattery@gmail.com>
Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry-picked from c45974d0a3)
* revert to 4.9.x series (4.10 needs too many unofficial patches and has weird waf bugs)
* cleanup patches
* enable AD_DC build option again
Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
(cherry-picked from 2f2a4bccd9)
The CONTRIBUTING.md requests an (or multiple) SPDX identifier for GPL
licenses. But a lot of packages did use a different, non-SPDX style with a
"+" at the end instead of "-or-later".
Signed-off-by: Sven Eckelmann <sven@narfation.org>
(cherry-picked from bbb1ea7345)
Needed for classpath. GCJ is also needed but that can be dealt with
separately.
Fix compilation with musl by defining _GNU_SOURCE. What's funny here is
that if __USE_GNU gets replaced, the host build fails. The man page says
_GNU_SOURCE for pthread_getattr_np but glibc violates that statement.
Removed classpath dependency. classpaths must select jamvm, not the other
way around.
Removed target whitelist. Switched to blacklist.
Fixed License information.
Various other cleanups.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 2972cc98eb)
This is needed for compilation. A Java compiler is also needed but that
must be handled elsewhere.
Fixed up license information.
URLs to HTTPS.
Other Makefile cleanups.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 1862f908eb)
Removed inactive maintainer.
Rearranged Makefile for consistency between packages.
Added --without-pic to avoid both -fPIC and -fpic.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 9bacdfa9a2)
GNU patch through 2.7.6 is vulnerable to OS shell command injection that
can be exploited by opening a crafted patch file that contains an ed style
diff payload with shell metacharacters. The ed editor does not need to be
present on the vulnerable system. This is different from CVE-2018-1000156.
https://nvd.nist.gov/vuln/detail/CVE-2019-13638
Signed-off-by: Russell Senior <russell@personaltelco.net>
(cherry-picked from b82198ff47)
In GNU patch through 2.7.6, the following of symlinks is mishandled in
certain cases other than input files. This affects inp.c and util.c.
https://nvd.nist.gov/vuln/detail/CVE-2019-13636
Signed-off-by: Russell Senior <russell@personaltelco.net>
(cherry-picked from c8142f1ac1)
CFLAGS were not being passed. This was breaking builds with ASLR.
Pass proper PIC command to gcc with $(fPIC).
Don't install static libraries. Keep those for InstallDev only.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from fbcf61d9d3)
Technically the same version, but this uses the normal tarball instead of
a random GitHub repository.
Cleaned up Makefile as a result.
Removed Python dependency. rbgen is not used for the package.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 6e8cb556e4)
Needed for compilation with PKG_ASLR_PIE.
Replaced Build/Compile with PKG_INSTALL.
Adjusted install paths for consistency.
Added license information.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from ccc3b6d44a)
This was breaking ASLR builds.
Fixed license tag.
Added PKG_BUILD_PARALLEL for faster compilation.
Small Makefile cleanups.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 43f811ad5b)
CFLAGS were not being passed, breaking ASLR builds.
Switched to using PKG_SOURCE_DATE for the version.
Added PKG_BUILD_PARALLEL for faster compilation.
Added license information.
Small Makefile cleanups.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 35a258a55c)
CFLAGS were not being passed which was breaking ASLR builds.
Fixed license header.
Added PKG_BUILD_PARALLEL for faster compilation.
Added PKG_INSTALL for consistency.
Passed proper $(FPIC) value.
Several other Makefile cleanups.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 76c0bea36b)
Fixes issue where CFLAGS were not being passed. This was breaking ASLR
builds.
Added PKG_BUILD_PARALLEL for faster compilation.
Added PKG_INSTALL. Changed install paths based on PKG_INSTALL paths.
Added --disable-debug to make sure debug code is disabled.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 946dfed856)
Updated live555 to 2019.08.28
Add TARGET_CFLAGS to LIVE555 CFLAGS to fix compilation with ASLR.
Several other Makefile cleanups and optimizations.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 523eeaed54)
This is Python library to parse, generate and in general handle files
in Intel HEX format.
Signed-off-by: Karel Kočí <cynerd@email.cz>
(cherry-picked from commit 306e276a3b)
This release updates: bcf create --from
There are no dependencies changes introduced by upstream and changes are
of limited character.
Signed-off-by: Karel Kočí <karel.koci@nic.cz>
(cherry-picked from commit 7741e5db4b)
This version introduces new option -d that makes service not to exit on
error. This is brutal solution but is required to protect against
service failure when remote resource is down.
bigclown-mqtt2influxdb is service moving data from MQTT to InfluxDB and
both of those services can and potentially are remote. The original
implementation where it failed when service goes down is not ideal
because network outage or target server outage can later require this
service restart.
Signed-off-by: Karel Kočí <karel.koci@nic.cz>
(cherry-picked from commti 508e2b865a)
On a Debian system without python3-distutils install, uwsgi-cgi was
failing to build because it couldn't import sysconfig from distutils.
OpenWrt packages should be using the OpenWrt python not the system
python. In addition we need to use python3 not python2, even when
both are available.
(cherry-pick c387d0923c from master)
Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>
We add the necessary Makefile, hotplug, config, and init bits
so that p910nd daemon runs as user:group p910nd:lp by default.
This eliminates an unnecessary root daemon.
The hotplug script sets the permissions of the USB lp
device(s) to read-write owner and group and no access to
anyone else, and sets owner root, group lp.
This is allows sufficient privileges to p910nd
to do it's job.
(cherry-pick 932c76fa74)
Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>
This commit syncs msmtp-scripts with master as current
openwrt-19.07 is broken.
Cherry-picks and squashes the following commits from
master.
6d8cff9a msmtp-scripts: Fix LICENSE information
d163eaea msmtp-scripts: Overhaul and update like upstream
3c15d410 msmtp-scripts: Make conn_test default nc
b9cc3cf2 msmtp-scripts: Fix spool/lock dir permissions
f76408af msmtp-scripts: Add msmtprc permission docs
Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>
Backports needed change from master for the next commit (a
combined cherry-pick and squash of required fixes to msmtp-scripts,
due to msmtp-scripts being broken on openwrt-19.07).
Use the PROVIDES mechanism so that msmtp and msmtp-nossl can be be
+depended-on and avoid generating a file level conflict. Also use
alternatives for msmtp-mta and msmtpq-ng-mta with msmtp-mta since
we can only have one sendmail at a time.
(cherry-pick f76408af48)
Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>
Fixed up license information. Only the library is packaged.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: W. Michael Petullo <mike@flyn.org>
While at, update the SPDX license id to most recent format.
Compile and run tested on mxs platform.
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 5805da860e)
- Move PKG_MAINTAINER above PKG_LICENSE
- PKG_HASH and PKG_BUILD_DIR should be together in one section
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* remove 'http-only' mode, all sources are now fetched from https sites
* the backup mode is now mandatory ('/tmp' is the default backup
directory), always create and re-use backups if available.
To force a re-download take the 'reload' action.
* support 'sshd' in addition to 'dropbear' for logfile parsing
to detect break-in events
* always update the black-/whitelist with logfile parsing results
in 'refresh' mode (no new downloads)
* rework the return code handling
* tweak procd trigger
* various small fixes
* (s)hellsheck cosmetics
* Change .*GPL.*+ licenses to SPDX compatible identifier
Signed-off-by: Dirk Brenken <dev@brenken.org>
* use raw procd interface trigger as last resort, if the
adblock config is not available during startup
* fix selective subdomain whitelisting for dnsmasq
* fix a kresd restart issue with 'DNS File Reset'
* fix a suspend/resume cornercase
* disable the tld compression, if the number of blocked domains
is greater than 'adb_maxtld' (default: 100000)
* made the fw portlist configurable (default '53 853 5353')
* preliminary support for inotify-like autoload features
of dns backends like kresd in future Turris OS. If 'adb_dnsinotify'
is set to 'true', all adblock related restarts and the
'DNS File Reset' will be disabled
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 45cb0e1023)
Since commit 2e490e7e46a4f6fbf66fa930a25c2991e24c0f83 tools/libelf
installs a pkgconfig file, which in turn is picked up during the glib2
host build. On the build bots the same occurs, although it so happens
that (sometimes?) libelf.h is not found and the host build fails. This
may be a timing issue specific to the build bots, as the header is in
fact installed by tools/libelf and I can't reproduce this here on my own
computer.
In any case, libelf (if detected) is only used by gresource. gresource
can be used without it. gresource is not used by OpenWrt's build system
(also not in openwrt/packages). So adding "--disable-libelf" to the host
configure args is not detrimental in any way and works around the issue
described above.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
- Correct SPDX License Identifier
- Move MAINTAINER, SUBMENU to more appropriate place
- Use HTTPS in URL
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry-picked from commit e06086c4c)
nextafter is not included in std with uClibc-ng. Don't use the std version
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from e613acffad)
Since OpenWrt commit e82a4d9cfb ("config: regenerate *_shipped sources")
a few recursive dependencies have been discovered that were not visible
before.
$ make menuconfig
tmp/.config-package.in:103098:error: recursive dependency detected!
For a resolution refer to Documentation/kbuild/kconfig-language.txt
subsection "Kconfig recursive dependency limitations"
tmp/.config-package.in:103098: symbol PACKAGE_baresip-mod-pulse depends on PACKAGE_baresip-mod-pulse
tmp/.config-package.in:121863:error: recursive dependency detected!
For a resolution refer to Documentation/kbuild/kconfig-language.txt
subsection "Kconfig recursive dependency limitations"
tmp/.config-package.in:121863: symbol PACKAGE_pulseaudio-profiles depends on PACKAGE_pulseaudio-profiles
tmp/.config-package.in:121878:error: recursive dependency detected!
For a resolution refer to Documentation/kbuild/kconfig-language.txt
subsection "Kconfig recursive dependency limitations"
qtmp/.config-package.in:121878: symbol PACKAGE_pulseaudio-tools depends on PACKAGE_pulseaudio-tools
This commit addresses the pulseaudio package's own recursive
dependencies and partially resolves#9300 (baresip will be handled in
telephony repository).
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
cherry picked from commit ec3d077287
to correct the errors related to backported config parsing changes.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
cherry picked from commit af4cacd108
to correct the errors related to kernel config parsing.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Corrected License according to SPDX in PKG_LICENSE
Added PKG_LICENSE_FILES
HTTPS in their website
Reordered some stuff
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
cherry picked from commit 79831ee0ab
to correct the errors related to kernel config parsing.
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Change indentation in dependencies and as well in description
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry-picked from commit d3c2ff35b5)
* automatically add open uplinks to your wireless config,
e.g. hotel captive portals (disabled by default)
* shift net status check in a separate function
* (s)hellcheck cosmetics
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 1d90509b03)
* fix the 'adb_sysver' output
* pass the adblock version information to the helper scripts correctly
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 161597f2fa)
* fix a dns restart issue if 'flush dns cache' is set
* fix a suspend/resume issue, the status wasn't properly updated
* fix a long standing query issue
* rework return code handling, mostly for debugging
* various cleanups & cosmetics
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 95189994e7)
Host and target architectures need to have the same pointer size.
When building on x86_64, do not force 32-bit host binaries if the target
architecture is also 64-bit.
See http://luajit.org/install.html#cross
Add 64-bit arm (aarch64) to the list of architectures.
Signed-off-by: Eric Kinzie <ekinzie@labn.net>
(cherry-picked from commit 5b0ef0e1b9)
- Add dovenull user, otherwise, dovecot doesn't start
- Build docs to have configuration files for dovecot
- Remove init script as conffile
- Move build options from Makefile to Config.in
- Install section to be more readable
- Refresh patches
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry-picked from commit e27438f140)
Move PKG_MAINTAINER above PKG_LICENSE to be sync with other packages
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry-picked from commit fcbc1cad2c)
This is a feature release including improvement to OIDC and security
enhancements, as well as bugfixes.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry-picked from commit ab990af307)
Netdata adds optional libraries if found, add patch (PR#6658) to avoid pulling in unnecessary libraries.
Signed-off-by: Daniel Engberg <daniel.engberg.lists@pyret.net>
(cherry-picked from commit 35a7f8721a)
- Bump version in the config and improve a link for documentation
- Disable snmp destination for now
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry-picked from commit e07cc32)
* background service: no longer miss "signal" events for the
dns backend (to trigger adblock)
* fix a dns backend reload issue during switch between
different blocking modes
* domain query: report found domains only once in
"null" blocking mode with IPv4 & IPv6 list entries
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 806f5ca9d8)
* fix a possible race condition during DNS file reset on slow hardware
* optimize DNS restart behaviour in 'null' blocking mode
* mute useless warnings
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 866878aa78)
* add support for 'DNS File Reset', where the final DNS blockfile
will be purged after DNS backend loading (save storage space).
A small background service will be started to trace/handle
dns backend reloads/restarts
* add support for the 'null' blocking variant in dnsmasq
(via addn-hosts), which may provide better response times
in dnsmasq
* enhance the report & search engine to support
the new blocking variants. Search now includes
backups & black-/whitelist as well
* compressed source list backups are now mandatory (default to '/tmp')
* speed up TLD compression
* E-Mail notification setup is now integrated in UCI/LuCI
* update the LuCI frontend to reflect all changes (separate PR)
* drop preliminary dnscrypt-proxy-support (use dnsmasq instead)
* drop additional 'dnsjail' blocklist support (not used by anyone)
* procd cleanups in init
* various shellcheck cleanups
* update readme
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 504412ccdb)
Updated to 4.0.11 LTS version.
Deleted 003-change-user-and-foreground.patch in according to [ZBX-10611] fixed changing process user owner on startup in foreground when AllowRoot disabled.
Compile tested: Yes, lantiq
Run tested: Yes, lantiq
Signed-off-by: Krystian Kozak <krystian.kozak20@gmail.com>
This avoids copying /usr/include, unversioned *.so files, pkgconfig,
/usr/lib/*.la, and the build-time libs/cflags configuration utility
clamav-config.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry-picked from 815e05e38e)
If libxml2 is installed in the host, then the host library is used and
compilation fails.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry-picked from 199ccc9475)
The inclusion of <sys/sysmacros.h> by <sys/types.h> was deprecated and
removed. This is causing major, minor, and makedev to be undefined.
The patch is an upstream commit fixing it.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
* Remove $$$$(pkg-config --static --libs libcrypto libssl) from
HOST_LDFLAGS
Having this leads to an "unknown type name 'u_int'" error on Mac.
Removing it doesn't appear to affect Python's ability to find
buildroot LibreSSL.
* Change -Wl,-rpath=... to -Wl,-rpath,... in HOST_LDFLAGS
The equals sign version is not supported by the Mac linker (appears to
be an GNU extension). The comma version is supported; -rpath and its
argument will be separated by a space when passed to the linker.
* Add ac_cv_header_libintl_h=no to HOST_CONFIGURE_VARS for Mac
Python on Mac doesn't expect to use libintl, but if gettext-full is
compiled for host, it will try, leading to undefined symbol errors
during compilation. This prevents configure from finding libintl.h.
Fixes#7171.
Fixes#9621.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
Parallel building is causing a failure because it executes some
commands, such as patch, more than once.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
* add missing dnsmasq dependency
* add a captive portal auto-login hook (configurable via uci/LuCI),
you could reference an external auto-login script - see readme
* provide an auto-login script for german ICE hotspots
(/etc/travelmate/wifionice.login), requires 'curl'
* small fixes
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 5a2a4fa20a)
Commit 200f2666fb1c ("sdk: fix GCC and Python dangling symlinks") in
master tree has forced prereq build step, which is now failing on the CI
as the Docker CI images are missing Python3 support, so now every build
fails with the following error:
make: *** [staging_dir/host/.prereq-build] Error 1
which is not helpful due to the silenced output of `make defconfig >
/dev/null`, so let's add `make prereq` build step in order to get
something usable next time.
Reported-by: Karl Palsson <karlp@etactica.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Due to concurrent build, it's currently not that easy to find the proper
reason for the package build failure, so let's just build the failing
package with -j1 in order to provide more human readable build log
failures.
Ref: https://github.com/openwrt/packages/pull/9584#issuecomment-518038631
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Full changelog here: https://mosquitto.org/blog/2019/08/version-1-6-4-released/
Fixes a regression in persistent session handling, and various other
regressions related to the mqtt5 support.
Signed-off-by: Karl Palsson <karlp@etactica.com>
It turns out, this breaks only when compiling with both uClibc-ng and
uClibc++. If the libc or libc++ gets swapped out, it compiles fine.
libstdcpp is fine because it already undefs these macros. The actual
bug is probably in uClibc-ng but this is a fine workaround.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from d6af6a4d75)
The maintainer is inactive, in addition to this package being woefully out
of date. It probably does not work properly.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 196976cdf0)
kcptun is a stable & secure tunnel based on kcp with N:M multiplexing.
https://github.com/xtaci/kcptun
Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>
If we're going to have a list of ntp servers, we should at least respect
them. Fallback to the original static list if no configured servers are
found.
Signed-off-by: Karl Palsson <karlp@etactica.com>
Update to the latest maintenance release, fixing CVE-2018-11782 and
CVE-2019-0203 among other things.
Signed-off-by: Val Kulkov <val.kulkov@gmail.com>
(cherry-picked from commit 53f33e5e74)
There is no gain to do device scan in init. Commonly we want to always
scan BTRFS devices to ensure that after boot raids are correctly linked.
It should be done before any init script tries to mount any raid FS.
Comparing init scripts and preinit scripts there are I think two primary
considerations. First is if user is expected to restart/reload/stop
given service on will. I think that there is no such reason for this as
user can easily enough just call btrfs utility it self. Second
consideration is if it makes sense to have it optional. This means if we
want to have ability to enable and disable given service. I think that
there is no such need in this case. It is pretty much doing nothing if
you don't have BTRFS FS connected and when you have you probably want to
scan it.
Signed-off-by: Karel Kočí <karel.koci@nic.cz>
This instead of building every tool separately builds one btrfs binary
and additional tools are links to this binary. This is same approach as
busybox is using.
This splits list of tools to two. boxprogs are tools that are boxed to
code btrfs binary and progs are tools that are not.
This also overload default all make target of Build/Compile and instead
builds (unified) btrfs.progs and separate progs.
Signed-off-by: Karel Kočí <karel.koci@nic.cz>
- Move Depends under URL
- Fix PKG_LICENSE to use correct SPDX License Identifier instead of
deprecated one
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Optionally unavailable with uClibc-ng.
Switched to local tarballs. .xz is smaller.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from b134eb3800)
New version of musl no longer includes this header internally.
Removed several unnecessary variables in Makefile.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 4cda68c72b)
Bash is not needed here. These scripts are POSIX compliant.
This was originally added as the configure script looks for /bin/bash
locally. Passing gl_cv_posix_shell overrides this.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from d0e3aa7493)
mariadb: security bump to 10.2.26
New upstream release. Addresses:
CVE-2019-2805
CVE-2019-2740
CVE-2019-2739
CVE-2019-2737
CVE-2019-2758
Package updates:
- includes "THIRDPARTY" in PKG_LICENSE_FILES
- drops client_ed25519 as a dynamic plugin and install it with the lib
as per upstream decision
- refreshes patches
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
It was requested in #9065 .
Cleaned up Makefile slightly.
Removed inactive maintainer.
Added PKG_BUILD_PARALLEL for faster compilation.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 23a36b00e2)
When compiled with musl >1.1.20, fastd will crash in case it can't
resolve a peers hostname. This is due to a changed implementation of
freeaddrinfo in musl 1.1.21 onwards.
This segfault is fixed by not calling freeaddrinfo in case the supplied
pointer is null.
Signed-off-by: David Bauer <mail@david-bauer.net>
This absolutely needs symbols from libresolv, which uClibc-ng does not
support.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 0a3ebb32a1)
res_nsend and res_send are both not available in uClibc-ng as configured
in OpenWrt. Having this function return an error is the only sensible way
to fix.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from b5b776fc9a)
Prometheus uses an older version of fsnotify, which uses a system call
(unix.InotifyInit) that is not implemented for mips64/mips64el.
This patches Prometheus to use a newer version of fsnotify that uses a
different system call (unix.InotifyInit1) that should be available on
all Linux systems.
Fixes#9494.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* use '$ddns_rundir' in 'get_service_data' for pipe creation, fix#8971
* add missing local variables in 'get_service_data'
* change DNS server verification with drill in 'verify_host_port',
fix/supersed #8935
* remove needless cat calls in 'verify_host_port'
* set cloudfare TTL to min. 120 seconds, fix#7745
* bump/align package version number
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 2e06c4ec93)
the latest update url format for deSEC is
http(s)://update.dedyn.io/update?username=[USERNAME]&password=[PWD]
Signed-off-by: James Qian <sotux82@gmail.com>
(cherry picked from commit e4951651e2)
* update to 5.01.9671
* switch to release tar's
* add cmake iconv and musl patches
Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
(cherry-pick from 46c320f18f)
softethervpn overrides nls.mk by defining its iconv functions. This only
works if the libc has iconv. In addition, it does not allow external
libiconv usage. TARGET_LDFLAGS is also the wrong place to add -liconv.
Removed SSL3 patch. It was needed for OpenSSL 1.0.2 but not anymore.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from fb480e297c)
Added -Wno-error to fix.
Also added patch to fix compilation without deprecated OpenSSL APIs.
Added PKG_BUILD_PARALLEL for faster compilation.
Switched libcyassl to libwolfssl.
Reorganized makefile for consistency between packages.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 266b0ba9d9)
libiconv-full requires a const char for its second parameter. Otherwise
-fpermissive error is thrown.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from ee94a1e912)
This applies to uClibc-ng and libiconv-full
Switched to building with uClibc++.
Fixed license information.
Fixed BUILD_DEPENDS.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from fec9257655)
Add patch that checks for libiconv instead of iconv. nls.mk handles this.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 50719a639a)
From the developer:
It seems that uClibc-ng is defining fgetc, fputc, feof, and ferror as
macros and not including them in std.
IMO this is a bug in uClibc-ng (maybe caused by lack of clarity in the
C++ standard), because even the C functions that are alowed to be
defined as macros (putc, getc) should be included in std for
consistency. Just imagine the chaos if std::getc were defined or
undefined depending on how it is implemented.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(9172e2828f)
Mainly endian definitions are needed.
Removed sys/io.h patch. It's a GNU header unsupported by uClibc-ng.
Cleaned up Makefile slightly.
Added HTTPS everywhere.
Added PKG_BUILD_PARALLEL for faster compilation.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 12378cd4d3)
It applies the single patch here as well as adding some fixes.
The upstream project is dead.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from d2af82a6f5)
This project seems abandoned. Updated to latest version.
Also cleaned up the Makefile quite a bit.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from dff6d2639e)
Added -faligned-new to fix compilation.
As fbzmq is passing -Werror, fixed compilation with newer GCC versions.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 50f8657141)
It appears snapshot target builds have switched from GPG signatures
(sha256sums.asc) to usign signatures (sha256sums.sig).
This adds support for verifying these usign signatures. (GPG signatures
will also be verified if found.)
This also restores the alphabetical ordering of packages to be installed
by apt-get.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
Patch taken from upstream fixes an Invalid argument error while trying
to get the IP address of an interface.
Makefile was updated to current style.
(cherry-picked from 5ab9f3e357)
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
- Reorder alphabetically dependencies
- Add python3-logging as a dependency
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry-picked from commit cd13d5d4de)
This allows compilation when libcurl is build with wolfssl as its SSL
backend.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry-picked from 3e78945eaf)
Shorter TITLE
- The longer one was not shown in make menuconfig.
Reodered stuff in Makefile
Removed PKG_UNPACK and change PKG_BUILD_DIR
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry-picked from 0a3e4d8)
- Update setuptools to 40.8.0
- Update pip to 19.0.3
- Refreshed patches
- Removed 4 patches (2 of them was included in 3.7.3 and other two are
included in this release)
Makefile python3:
- Move PKG_MAINTAINER above PKG_LICENSE
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry-picked from ce769db007)
This patch, taken from buildroot, avoids the use of host paths when
compiling third-party extensions.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry-picked from 523c52f6f2)
* fix a corner case issue with auto expiry of the
'Faulty Station' list (the last run information was not updated)
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 59a69ee059)
for coping libc.a, libpthread.a and libstdc++ to target.
Add config option to eliminate need for -lstdc++ and -lgcc_pic
switches when linking statically
Signed-off-by: Noble Pepper <noblepepper@gmail.com>
Signed-off-by: Karel Kočí <karel.koci@nic.cz>
[Add me as maintainer]
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry-picked from 6cdcfd9)
Reorder one thing in Makefile and add two spaces in description
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry-pick from bec7011401 )
Upstream backport. It seems the holdup is on python-twisted.
Without this, it fails with
SSL_get0_next_proto_negotiated: symbol not found
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from commit 0859931)
Version 11.3 is the current stable relase.
Changes between 9.3 and 11.3:
- pg_receivexlog, pg_resetxlog and pg_xlogdump have been replaced with pg_resetwal
- ZIC config variable must be set when cross compiling
- disable systemd support
- ecpg is no longer needed for building
- MAKELEVEL must be set to 0 when called from another makefile
- Setting AC_CONFIG_AUX_DIR([config]) is no longer requried
- Decrease build time by removing unnecessary configure checks
Signed-off-by: Daniel Danzberger <daniel@dd-wrt.com>
(cherry-picked from d9bd0c19e4)
Backported upstream patches that fix this.
Removed local patch that fixes libp11 with version 0.4.7, which is not
used anymore. Upstream has a different solution.
License fixes and Makefile cleanups.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 6dbbc17b1f)
* optimize the main scan/iwinfo call (performance & system load):
- remove a needless f_trim function call
- remove a redundant awk call
- reduce the scan buffer size and
make it configurable (trm_scanbuffer, default 1024 bytes)
* cosmetics
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 8335e6e76c)
Change log for v3.11.1716:
[IMP] Replaced libhttpd with libevent, therefore commented thread
related parameters in wifidogx conf file
[IMP] Added REQUEST_TYPE_COUNTERS_V2 to wifidog protocol
[IMP] Sent online and offline client's counter info to auth server
[FIX] Fixed missing setting online_time parameter bug
Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>
- Update haproxy download URL and hash
- Add new patches
- Add several CFLAGS (derived from haproxy Makefile) to make the build work with v1.9+
- Update default configuration
- Add check-command (for config) to init-script
- Add prometheus-service from contribs by default
- Add support for uclibc to haproxy with libcrypt disabled
- Minor cleanups
I have been running v2.0 for some time now and it feels as stable as v1.8. v2.0 is the new LTS release.
Signed-off-by: Christian Lachner <gladiac@gmail.com>
Update collectd to version 5.9.0
* remove backported upstream patches (sensors, modbus)
* remove lua patch that has been been implemented upstream
(See collectd PR 3144)
* refresh patches and accommodate into upstream path changes
* place the 'stations' datatype for iwinfo in alpbetically
correct place in types.db
* add libmnl dependency to 'processes' plugin required for the
new Linux process Delay Accounting capability.
(Alternatively the capability & requirement might be patched away
in Makefile.am, HAVE_LIBTASKSTATS from collectd_4ea7a572)
* new plugins (disabled): ampq1, gpu_nvidia, pcie_errors,
write_stackdriver, write_syslog
compile-tested: ar71xx/WNDR3700 (all plugins)
run-tested: ar71xx/WNDR3700 (selected plugins)
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 08d759f14a)
This change is inspired by commit openwrt/openwrt@38b22b1e ("nghttp2:
deduplicate files in libnghttp2")
The packages in this commit are identified with the following command
grep -rin -E 'INSTALL_(DATA|BIN)' | grep -F '.so' | grep -F '*'
Some of them do not have symlinks and are not affected, but the change
is still applied for consideration of best practices just in case
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry-picked from 9ac5ac81ab)
Fixes: https://github.com/openwrt/packages/issues/9255
This seems to fail the build for this package only.
So, this change patches the build, to add `-lssp` to the LDFLAGS of this
package, in case the build uses GCC's libssp.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
As part of the boost change. Also get rid of various CMake options as
CMake can find everything properly now.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
After talking to @jow on IRC, we found two problems. STAGING_DIR_HOST is
designed for tools, not host packages. Changing this to HOSTPKG allows
CMake and pkgconfig to work properly with fbthrift.
The host-libraries should not be modular like this for host packages.
Changed to eliminate them and to only build the needed ones. This can be
changed as conditions change.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
fbzmq provides a framework for writing services in C++ while leveraging
the features of libzmq (message passing semantics).
Compile tested: nbg6817, master
Maintainer: me
Signed-off-by: Amol Bhave <ambhave@fb.com>
Fixes compilation when ChaCha20 is missing from OpenSSL 1.1
Added Maintainer.
Rearranged Makefile for consistency.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Partially restore uclibc patch. Some parts were upstreamed while others
were not.
Fixes compilation without ChaCha20 support in OpenSSL 1.1 and above.
Depend on libunwind conditionally. libunwind is not supported on all
targets. Depending on it unconditionally makes libfolly and dependent
packages unavailable on those targets.
Added missing Maintainer.
Several Makefile rearrangements for consistency.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Simplifies the Makefile.
Remove build hacks and use CMake
Use PKG_BUILD_PARALLEL for faster compilation.
Switch to the Compression submenu to group this with the others.
Added lz4 binaries to be installable.
Add Optimization option.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Update nano to 4.3
Release notes at https://nano-editor.org/news.php
2019.06.18 - GNU nano 4.3
* The ability to read from and write to a FIFO has been regained.
* Startup time is reduced by fully parsing a syntax only when needed.
* Asking for help (^G) when using --operatingdir does not crash.
* The reading of a huge or slow file can be stopped with ^C.
* Cut, zap, and copy operations are undone separately when intermixed.
* M-D reports the correct number of lines (zero for an empty buffer).
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 2bdd3856fd)
* refine 'refresh' mode, add normal processing/download as fallback
* remove needless reload trigger
* fix various ipset warnings
* fix timer in 'refresh' mode
* adapt ssbl regex to new source list format
Signed-off-by: Dirk Brenken <dev@brenken.org>
- treat RFC6762 'local.' as nxdomain because avahi and other services
will disable if SOA or NS records appear in central DNS.
- allow two threads to be enabled with the 'heavy traffic' variant of
Unbound packages.
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
This is the OpenWrt "packages"-feed containing community-maintained build scripts, options and patches for applications, modules and libraries used within OpenWrt.
Installation of pre-built packages is handled directly by the **opkg** utility within your running OpenWrt system or by using the [OpenWrt SDK](https://openwrt.org/docs/guide-developer/obtain.firmware.sdk) on a build system.
Installation of pre-built packages is handled directly by the **opkg** utility within your running OpenWrt system or by using the [OpenWrt SDK](https://openwrt.org/docs/guide-developer/using_the_sdk) on a build system.
<li title="check for netdata updates<br/>you should keep your netdata updated" data-toggle="tooltip" data-placement="bottom" class="hidden-sm" id="updateButton"><a href="#" class="btn" data-toggle="modal" data-target="#updateModal"><i class="fas fa-cloud-download-alt"></i> <span class="hidden-sm hidden-md">Update </span><span id="update_badge" class="badge"></span></a></li>
+ -->
+ <!--
<li title="the netdata wiki home at github<br/>remember to <b>give netdata a <i class="fas fa-star"></i></b> !" data-toggle="tooltip" data-placement="bottom" class="hidden-xs hidden-sm hidden-md"><a href="https://github.com/netdata/netdata" class="btn" target="_blank"><i class="fab fa-github"></i></a></li>