Commit Graph

2779 Commits

Author SHA1 Message Date
Josef Schlehofer e6ecebbfcc
libwebsockets: fix recursive dependency
While running `make menuconfig`, it was discovered then there is a
recursive dependency like this:
tmp/.config-package.in:59138:error: recursive dependency detected!
tmp/.config-package.in:59138:	symbol PACKAGE_libwebsockets-openssl is selected by PACKAGE_libwebsockets-mbedtls
tmp/.config-package.in:59122:	symbol PACKAGE_libwebsockets-mbedtls depends on PACKAGE_libwebsockets-openssl

It is not possible with the recently added conflicts that two packages
(OpenSSL and full variant, which uses OpenSSL as well), which are almost the same
provides the same named package libwebsockets as their conflict - Mbed
TLS.

Fixes: 676c5c72b5 ("libwebsockets: OpenSSL
and mbedTLS variants should conflict")

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit a4e8cbb89a)
2022-10-27 14:48:20 +02:00
Josef Schlehofer 7b1b79c505
libwebsockets: OpenSSL and mbedTLS variants should conflict
They provide the same files, but they don't conflict to each other, this
means that users can install them side by side.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 676c5c72b5)
2022-10-25 14:29:47 +02:00
Josef Schlehofer 13a3a415a9
libwebsockets: full variant provides OpenSSL
For some time, it is not possible to install ttyd and mosquitto-ssl at the
same time, so let's solve it that libwebsockets-full provides
libwebsockets-openssl. This allows to install ttyd and mosquitto at
the same time.

Also, we need to add conflict, because we should not have installed
libwebsockets-openssl and libwebsockets-full at the same time as they
provides the same files.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 77e682a11c)
2022-10-25 14:29:44 +02:00
Josef Schlehofer 1eeac014ad
nss: disable PKG_BUILD_PARALLEL
This is similar to commit f303e87a1e
("nss: update to 3.67") as there is something wrong with NSS build
system and otherwise this package fails to compile. Let's compile it
single threaded.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2022-09-26 20:39:07 +02:00
Jan Hak b4016afdd2
libedit: update to version 20210522-3.1
Signed-off-by: Jan Hak <jan.hak@nic.cz>
(cherry picked from commit 0b8f3ea81a)
2022-09-07 14:23:27 +02:00
Jan Hak 5ad19e5a40
libedit: update to version 20210419-3.1
Signed-off-by: Jan Hak <jan.hak@nic.cz>
(cherry picked from commit b0870d792b)
2022-09-07 14:23:22 +02:00
Michael Heimpold 5a399f1448 cyrus-sasl: install pkg-config file and fine-tune installed files
Installing the .pc files helps other programs to detect
the presence of libsasl2.

While at, reduce the glob pattern a little bit to not
include unneeded symlinks.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit c9ce769b1a)
2022-07-18 14:41:32 +02:00
Petr Štetiar 0bab8ae2a7 libarchive: fix ext2fs build race error condition
libarchive looks for ext2fs headers during configure, and if it finds
them it will expect to find them during compile, or on the rare occasion
when they aren't it will fail:

 libarchive/archive_entry.c:59:55: fatal error: ext2fs/ext2_fs.h: No such file or directory

As we just need headers for some type constants, let's re-use headers
from tools/e2fsprogs package which are always available.

Reported-by: Adam Dov <adov@maxlinear.com>
Suggested-by: Paul Eggleton <paul.eggleton@linux.intel.com>
References: https://git.yoctoproject.org/poky/commit/?id=f0b9a7cf9f80be1917e45266fa201f464a28c1e5
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 797945dfaa)
2022-07-13 08:47:54 +02:00
Michal Vasilek 90ff2ed162 libgd: install pkgconfig file
Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
2022-06-23 12:35:30 -06:00
W. Michael Petullo f08dae84f8
openldap: drop use of HTTP in favor of HTTPS
Signed-off-by: W. Michael Petullo <mike@flyn.org>
(cherry picked from commit bab2f020ee)
2022-06-10 13:56:56 +02:00
Michael Heimpold 1ad2e67d4c
libxml2: update to 2.9.14
This fixes CVE-2022-29824.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit c12e1cfcab)
Signed-off-by: Šimon Bořek <simon.borek@nic.cz>
2022-06-02 15:27:28 +02:00
Michael Heimpold 0da04ff0b7
libxml2: update to 2.9.13
This fixes CVE-2022-23308.

Also switch to GNOME as download source and xz tarball.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 81fd836f97)
Signed-off-by: Šimon Bořek <simon.borek@nic.cz>
2022-06-02 15:27:22 +02:00
Michael Heimpold a3557e5362
libxml2: update to 2.9.12
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 6b932d3ff7)
Signed-off-by: Šimon Bořek <simon.borek@nic.cz>
2022-06-02 15:26:05 +02:00
Michael Heimpold a23bfc9774
libxml2: update to 2.9.10
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 10e867d026)
[remove no longer needed CVE-2019-19956 patch (fixed in libxml2 2.9.10)]
Signed-off-by: Šimon Bořek <simon.borek@nic.cz>
2022-06-02 15:12:45 +02:00
Daniel Golle 6dbc752fdd
db47: don't depend on libxml2 at run-time
libxml2 seems to be required only during build, hence no need to
depend on it in run-time.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 1f3585a387)
2022-06-02 14:44:29 +02:00
Michal Vasilek 58a5dd8fd7 postgresql: security update to 11.16
* fixes CVE-2022-1552

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
2022-05-14 21:34:11 -07:00
Michal Vasilek 79db9a8e24
expat: import patches for CVEs
* import patches for CVEs from alpine 3.13

CVE-2021-45960, CVE-2021-46143, CVE-2022-22822, CVE-2022-23852, CVE-2022-23990
CVE-2022-25235, CVE-2022-25236, CVE-2022-25313, CVE-2022-25314, CVE-2022-25315

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit 584c0c4378)
2022-02-24 15:09:35 +01:00
Rosen Penev 448eb6e4b9
expat: update to 2.2.10
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit c69160e6ae)
2022-02-24 15:09:18 +01:00
Josef Schlehofer b61f1d4850
Merge pull request #17756 from BKPepe/nss-cve-2021-43527
nss: backport patch for CVE-2021-43527
2022-02-02 18:23:45 +01:00
Josef Schlehofer 864ffb6ca1
nss: backport patch for CVE-2021-43527
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2022-01-31 11:50:25 +01:00
Josef Schlehofer 0e3869c2ad
Merge pull request #17476 from BKPepe/buildonly
treewide: add missing BUILDONLY
2022-01-03 19:58:33 +01:00
Rosen Penev f299c29a45
treewide: add missing BUILDONLY
Fixes Makefile warnings:

WARNING: skipping X -- package has no install section

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 5a7148d112)
2022-01-02 10:02:23 +01:00
Petr Štetiar 7db6f87334
Merge pull request #17250 from ynezz/ynezz/cares-fix-CVE-2021-3672
[19.07] libs/c-ares: fix domain hijacking CVE-2021-3672
2021-12-12 12:11:24 +01:00
Daniel Golle a135aedaf1
Merge pull request #17267 from BKPepe/postgresql-update
[19.07] postgresql: security update to version 11.14
2021-12-12 11:06:51 +00:00
Josef Schlehofer 535f4804b6
postgresql: security update to version 11.14
Patch 001-configure_fixes does not apply anymore.
Other patches were refreshed.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2021-12-04 01:04:48 +01:00
Petr Štetiar e93fc5a20f libs/c-ares: fix domain hijacking CVE-2021-3672
Missing input validation of host names returned by Domain Name Servers
in the c-ares library can lead to output of wrong hostnames (leading to
Domain Hijacking).

I've just taken patch from the advisory[1] and rebased it onto 1.15.0
version.

1. 809d5e8..44c009b.patch

Fixes: CVE-2021-3672
Signed-off-by: Petr Štetiar <ynezz@true.cz>
2021-12-02 13:54:42 +01:00
Hirokazu MORIKAWA 1d5b64958b icu: Fix memory bug w/ baseName
CVE-2021-30535 : Double free in ICU
https://nvd.nist.gov/vuln/detail/CVE-2021-30535
https://security-tracker.debian.org/tracker/CVE-2021-30535

ICU-21587 : Fix memory bug w/ baseName
https://github.com/unicode-org/icu/pull/1698

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
2021-11-29 01:42:37 -08:00
Michal Vasilek af8fe2363d
cyrus-sasl: patch CVE-2019-19906
Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit f7717bd382)
2021-11-13 16:11:23 +01:00
Michal Vasilek 72d806d181
apr: patch CVE-2021-35940
Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit 0777e40b74)
2021-08-25 06:06:48 +02:00
Rosen Penev 844cde96b8
Merge pull request #16444 from paper42/postgresql-fix-hardening
[19.07] postgresql: disable PIC
2021-08-24 19:04:13 -07:00
Michal Vasilek 4b091361ef
postgresql: disable PIC
with PIC enabled, build fails with
ld: access/gist/gistproc.o: in function `rtree_internal_consistent':
gistproc.c:(.text+0x188): relocation truncated to fit: R_AARCH64_LD64_GOTPAGE_LO15 against symbol `DirectFunctionCall2Coll' defined in .text section in utils/fmgr/fmgr.o
ld: gistproc.c:(.text+0x188): warning: too many GOT entries for -fpic, please recompile with -fPIC
ld: final link failed: symbol needs debug section which does not exist
collect2: error: ld returned 1 exit status

Related-to: 8e9ad7bb51
Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
2021-08-24 12:48:19 +02:00
Michal Vasilek 0573fb59ab
file: update to 5.38
* fixes CVE-2019-18218

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
2021-08-23 12:25:13 +02:00
Eneas U de Queiroz 865ae46492 unixodbc: use 'install' when copying host binaries
'cp' fails with a text file busy error if it tries to overwrite an
executable file that is running.  'install' unlinks the file first, so
it will not cause the problem.

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 47f98d7030)
2021-08-14 13:45:53 -07:00
Rosen Penev 0872827d2d librouteros: don't build docs
Fixes compilation without host pod2man.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit e41fd1794b)
2021-07-25 22:19:29 +03:00
Rosen Penev d617e7b143
Merge pull request #16062 from miska/snort3
snort3: Backport update to the stable version
2021-07-14 19:23:31 -07:00
Hirokazu MORIKAWA c0e93ddff3 libuv: fix CVE-2021-22918
idna: fix OOB read in punycode decoder

libuv was vulnerable to out-of-bounds reads in the uv__idna_toascii()
function which is used to convert strings to ASCII. This is called by
the DNS resolution function and can lead to information disclosures or
crashes.

libuv/libuv@b7466e3
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=990561
https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
2021-07-12 15:13:13 +09:00
Josef Schlehofer dd32c2cbee
czmq: disable nss
While bumping czmq to version 4.2.1 from master branch into OpenWrt
19.07, it automatically detects nss when compiled before czmq.

These steps can verify this:

make package/nss/compile V=s
make package/czmq/compile V=s

Then czmq requires many dependencies:
Package czmq is missing dependencies for the following libraries:
libnspr4.so
libnss3.so
libnssutil3.so
libplc4.so
libplds4.so
libsmime3.so
libsoftokn3.so
libssl3.so

And this fails. If you are using SDK and wants to have just a few
packages then czmq gets compiled if any of those packages are not
present in build system.

This was also mentioned in the release notes for czmq 4.2.1:
https://github.com/zeromq/czmq/releases/tag/v4.2.1

> Note for packagers: NSS can now be used and linked against to avoid using
an internal embedded reimplementation of SHA. It is enabled by default if
present.

NSS was disabled before, so let's disable it.

This is required only for OpenWrt 19.07 as this is done differently in OpenWrt 21.02 and OpenWrt
master and czmq is compiled there.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2021-07-11 19:48:56 +02:00
Jan Pavlinec a16402770c
czmq: update to version 4.2.1
Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit 39b4c64545)
2021-07-10 23:08:20 +02:00
Michal Hrusecky 5d189c1013
libdaq3: New package, dependency of snort3
Backport from 21.02 in order to satisfy dependencies of snort3 to allow
upgrade to stable version of snort3 from beta available now.

Signed-off-by: Michal Hrusecky <michal.hrusecky@turris.com>
2021-07-07 12:36:20 +02:00
David Bauer 73c0984779 xr_usb_serial_common: add PKG_MIRROR_HASH
The CI complained about a missing PKG_MIRROR_HASH.

Signed-off-by: David Bauer <mail@david-bauer.net>
2021-06-08 17:18:02 +02:00
David Bauer 7100f40063 xr_usb_serial_common: fix build
Building the xr_usb_serial module fails for recent 4.14 kernel with
CONFIG_PM enabled:

xr_usb_serial_common.c:1574:15: error: 'ASYNCB_INITIALIZED' undeclared
(first use in this function); did you mean 'RCU_INITIALIZER'?

Use tty_port_initialized in order to determine the status of the TTY
port.

Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 69cf7836df)
2021-06-08 17:11:41 +02:00
Dylan Corrales bdbf33f697 libnet: Export `libnet-config` in development enviornments
Affects `libnet-1.2.x`

Signed-off-by: Dylan Corrales <deathcamel58@gmail.com>
2021-06-03 15:20:44 -04:00
Nikos Mavrogiannopoulos 7436ea3fb1
Merge pull request #15252 from ja-pa/gnutls-security-fix-19.07
[OpenWrt 19.07] gnutls: patch security issue
2021-03-26 21:55:20 +01:00
Giovanni Giacobbi 7af60cc3e2
libftdi1: Improve build binary reproducibility
The library embeds the result of "git describe" inside the source code, making the binary result dependent of the particular commit being used in the build root when building inside a git working copy.

As this is unnecessary information, remove this option and fallback to the default "unknown", which is also the value compiled by tools that do not clone but export the openwrt base tree.

Signed-off-by: Giovanni Giacobbi <giovanni@giacobbi.net>
2021-03-26 10:48:39 +00:00
Jan Pavlinec cb6509e882
gnutls: patch security issue
Fixes
CVE-2021-20231
CVE-2021-20232

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
2021-03-25 10:34:58 +01:00
Hirokazu MORIKAWA 13ab7af3f0
icu: update to 68.2
Maintainer: me
Compile tested: head r15324-920b692, aarch64, x86_64
Run tested: (qemu-5.2.0) aarch64

Description:
Update to 68.2

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry picked from commit d6317132dd)
2021-03-22 00:31:59 +01:00
Hirokazu MORIKAWA 2120a3cf51
icu: update to 68.1
It updates to CLDR 38. New features including locale-dependent smart unit preferences (road distance, temperature, etc.) and locale ID canonicalization conformant with CLDR.

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry picked from commit 4f3a8c1535)
2021-03-22 00:31:51 +01:00
Rosen Penev 10712797f0
icu: fix compilation under CentOS 7
CentOS 7's GCC is quite old and does not put max_align_t under std.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 6255a77128)
2021-03-22 00:31:43 +01:00
Hirokazu MORIKAWA 79ddd03288
icu: update to 67.1
Unicode 13 & CLDR 37. Bug fixes for date and number formatting, enhanced support for user preferences in the locale identifier. LocaleMatcher code and data improved. Number skeletons have a new “concise” form that can be used in MessageFormat strings.

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry picked from commit e3be3aadc1)
2021-03-22 00:31:34 +01:00
Tianling Shen 01ab015a9a msgpack-c: add new package
This is needed by tmate.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit cfc965b107)
2021-03-18 23:22:48 -10:00