Merge Mainline

2020-11-12 15:44:23 +08:00 · 2020-11-12 15:44:23 +08:00 · 38f7610841
commit 38f7610841
parent 79d6146932 c6e2d07cae
20 changed files with 220 additions and 137 deletions
--- a/config/Config-build.in
+++ b/config/Config-build.in
@ -351,6 +351,12 @@ menu "Global build settings"
 			help
 			  SELinux Reference Policy (refpolicy)

+		config SELINUXTYPE_targeted-modular
+			bool "targeted-modular"
+			select PACKAGE_refpolicy-modular
+			help
+			  Modular SELinux Reference Policy (refpolicy-modular)
+
 		config SELINUXTYPE_dssp
 			bool "dssp"
 			select PACKAGE_selinux-policy
--- a/package/ctcgfw/yq/Makefile
+++ b/package/ctcgfw/yq/Makefile
@ -6,7 +6,7 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=yq
 PKG_VERSION:=3.4.1
-PKG_RELEASE:=1
+PKG_RELEASE:=2

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/mikefarah/yq/tar.gz/$(PKG_VERSION)?
@ -18,6 +18,7 @@ PKG_LICENSE_FILES:=LICENSE

 PKG_BUILD_DEPENDS:=golang/host
 PKG_BUILD_PARALLEL:=1
+PKG_USE_MIPS16:=0

 PKG_CONFIG_DEPENDS:= \
 	CONFIG_YQ_COMPRESS_GOPROXY \
@ -31,7 +32,7 @@ include $(TOPDIR)/feeds/packages/lang/golang/golang-package.mk
 define Package/yq
  SECTION:=utils
  CATEGORY:=Utilities
-  TITLE:=yq is a portable command-line YAML processor
+  TITLE:=Portable command-line YAML processor
  URL:=https://mikefarah.gitbook.io/yq/
  DEPENDS:=$(GO_ARCH_DEPENDS)
 endef
@ -62,9 +63,5 @@ ifeq ($(CONFIG_YQ_COMPRESS_UPX),y)
 endif
 endef

-define Package/yq/install
-	$(INSTALL_DIR) $(1)/usr/bin/
-	$(INSTALL_BIN) $(GO_PKG_BUILD_BIN_DIR)/yq $(1)/usr/bin/
-endef
-
+$(eval $(call GoBinPackage,yq))
 $(eval $(call BuildPackage,yq))
--- a/package/lean/luci-app-ssr-plus/luasrc/controller/shadowsocksr.lua
+++ b/package/lean/luci-app-ssr-plus/luasrc/controller/shadowsocksr.lua
@ -99,7 +99,7 @@ function refresh_data()
 				if type == "gfw_data" or type == "ad_data" then
 					luci.sys.exec("/usr/share/shadowsocksr/gfw2ipset.sh")
 				else
-					luci.sys.exec("/etc/init.d/shadowsocksr restart &")
+					luci.sys.exec("/usr/share/shadowsocksr/chinaipset.sh /tmp/etc/china_ssr.txt")
 				end
 			end
 		else
@ -111,7 +111,7 @@ function refresh_data()
 		update(uci:get_first("shadowsocksr", "global", "gfwlist_url", "https://cdn.jsdelivr.net/gh/gfwlist/gfwlist/gfwlist.txt"), "/etc/ssr/gfw_list.conf", set, "/tmp/dnsmasq.ssr/gfw_list.conf")
 	end
 	if set == "ip_data" then
-		update(uci:get_first("shadowsocksr", "global", "chnroute_url","https://ispip.clang.cn/all_cn.txt"), "/etc/ssr/china_ssr.txt", set)
+		update(uci:get_first("shadowsocksr", "global", "chnroute_url","https://ispip.clang.cn/all_cn.txt"), "/etc/ssr/china_ssr.txt", set, "/tmp/etc/china_ssr.txt")
 	end
 	if set == "ad_data" then
 		update(uci:get_first("shadowsocksr", "global", "adblock_url","https://easylist-downloads.adblockplus.org/easylistchina+easylist.txt"), "/etc/ssr/ad.conf", set, "/tmp/dnsmasq.ssr/ad.conf")
--- a/package/lean/luci-app-ssr-plus/root/etc/init.d/shadowsocksr
+++ b/package/lean/luci-app-ssr-plus/root/etc/init.d/shadowsocksr
@ -63,14 +63,10 @@ uci_get_by_cfgid() {

 get_host_ip() {
 	local host=$1
-	local isip=""
-	local ip=$host
-	isip=$(echo $host | grep -E "([0-9]{1,3}[\.]){3}[0-9]{1,3}")
-	if [ -z "$isip" ]; then
-		if [ "$host" != "${host#*:[0-9a-fA-F]}" ]; then
-			ip=$host
-		else
-			local ip=$(resolveip -4 -t 3 $host | awk 'NR==1{print}')
+	local ip=$1
+	if [ -z "$(echo $1 | grep -E "([0-9]{1,3}[\.]){3}[0-9]{1,3}")" ]; then
+		if [ "$1" == "${1#*:[0-9a-fA-F]}" ]; then
+			ip=$(resolveip -4 -t 3 $1 | awk 'NR==1{print}')
 			[ -z "$ip" ] && ip=$(wget -q -O- http://119.29.29.29/d?dn=$1 | awk -F ';' '{print $1}')
 		fi
 	fi
@ -133,9 +129,8 @@ gen_config_file() {
 	else
 		uci_set_by_name $1 ip $hostip
 	fi
-	[ "$2" == "0" -a "$kcp_flag" == "1" ] && hostip="127.0.0.1"
 	case "$2" in
-	0) config_file=$CONFIG_FILE ;;
+	0) config_file=$CONFIG_FILE && [ "$kcp_flag" == "1" ] && hostip="127.0.0.1" ;;
 	1) config_file=$CONFIG_UDP_FILE ;;
 	2) config_file=$CONFIG_NETFLIX_FILE ;;
 	*) config_file=$CONFIG_SOCK5_FILE ;;
@ -302,21 +297,23 @@ start_dns() {
 		EOF
 		/usr/sbin/pdnsd -c /var/etc/pdnsd.conf >/dev/null 2>&1 &
 	}
-	if [ "$ssr_dns" != "0" ]; then
+	ipset_add_dns() {
 		case "$run_mode" in
 		gfw) ipset add gfwlist $dnsserver 2>/dev/null ;;
 		oversea) ipset add oversea $dnsserver 2>/dev/null ;;
 		*) ipset add ss_spec_wan_ac $dnsserver nomatch 2>/dev/null ;;
 		esac
-	fi
+	}
 	case "$ssr_dns" in
 	1)
 		start_pdnsd $dnsserver $dnsport
+		ipset_add_dns
 		pdnsd_enable_flag=1
 		;;
 	2)
 		microsocks -i 127.0.0.1 -p 10802 ssr-dns >/dev/null 2>&1 &
 		dns2socks 127.0.0.1:10802 $dnsserver:$dnsport 127.0.0.1:5335 -q >/dev/null 2>&1 &
+		ipset_add_dns
 		pdnsd_enable_flag=2
 		;;
 	esac
@ -684,8 +681,8 @@ start_rules() {
 		2) echo "-m multiport --dports 22,53,587,465,995,993,143,80,443,853" ;;
 		esac
 	}
+	run_mode=$(uci_get_by_type global run_mode router)
 	get_mode() {
-		run_mode=$(uci_get_by_type global run_mode router)
 		case "$run_mode" in
 		gfw) echo "-g" ;;
 		router) echo "-r" ;;
@ -767,8 +764,10 @@ start() {
 }

 boot() {
+	echo "$(date "+%Y-%m-%d %H:%M:%S") boot！" >/tmp/ssrplus.log
 	ulimit -n 65535
-	(/usr/share/shadowsocksr/chinaipset.sh && sleep 3 && start >/dev/null 2>&1) &
+	/usr/share/shadowsocksr/chinaipset.sh
+	start >/dev/null 2>&1
 }

 stop() {
--- a/package/lean/luci-app-ssr-plus/root/etc/uci-defaults/luci-ssr-plus
+++ b/package/lean/luci-app-ssr-plus/root/etc/uci-defaults/luci-ssr-plus
--- a/package/lean/luci-app-ssr-plus/root/usr/bin/ssr-rules
+++ b/package/lean/luci-app-ssr-plus/root/usr/bin/ssr-rules
@ -87,12 +87,14 @@ ipset_r() {
 	$IPT -I SS_SPEC_WAN_AC -p tcp ! --dport 53 -d $server -j RETURN
 	case "$RUNMODE" in
 	router)
+		set_china_ip
 		ipset -! -R <<-EOF || return 1
 			create ss_spec_wan_ac hash:net
 			$(gen_iplist | sed -e "s/^/add ss_spec_wan_ac /")
 		EOF
 		ipset -N gfwlist hash:net 2>/dev/null
 		$IPT -A SS_SPEC_WAN_AC -m set --match-set ss_spec_wan_ac dst -j RETURN
+		$IPT -A SS_SPEC_WAN_AC -m set --match-set china dst -j RETURN
 		$IPT -A SS_SPEC_WAN_AC -j SS_SPEC_WAN_FW
 		;;
 	gfw)
@ -280,10 +282,13 @@ gen_iplist() {
 		240.0.0.0/4
 		255.255.255.255
 		$(get_wan_ip)
-		$(cat ${IGNORE_LIST:=/dev/null} 2>/dev/null)
 	EOF
 }

+set_china_ip() {
+	[ -f "$IGNORE_LIST" ] && /usr/share/shadowsocksr/chinaipset.sh $IGNORE_LIST
+}
+
 gen_spec_iplist() {
 	cat <<-EOF
 		0.0.0.0/8
--- a/package/lean/luci-app-ssr-plus/root/usr/bin/ssr-switch
+++ b/package/lean/luci-app-ssr-plus/root/usr/bin/ssr-switch
@ -38,14 +38,10 @@ CURRENT_SERVER=$DEFAULT_SERVER
 #解析ip
 get_host_ip() {
 	local host=$1
-	local isip=""
-	local ip=$host
-	isip=$(echo $host | grep -E "([0-9]{1,3}[\.]){3}[0-9]{1,3}")
-	if [ -z "$isip" ]; then
-		if [ "$host" != "${host#*:[0-9a-fA-F]}" ]; then
-			ip=$host
-		else
-			local ip=$(resolveip -4 -t 3 $host | awk 'NR==1{print}')
+	local ip=$1
+	if [ -z "$(echo $1 | grep -E "([0-9]{1,3}[\.]){3}[0-9]{1,3}")" ]; then
+		if [ "$1" == "${1#*:[0-9a-fA-F]}" ]; then
+			ip=$(resolveip -4 -t 3 $1 | awk 'NR==1{print}')
 			[ -z "$ip" ] && ip=$(wget -q -O- http://119.29.29.29/d?dn=$1 | awk -F ';' '{print $1}')
 		fi
 	fi
--- a/package/lean/luci-app-ssr-plus/root/usr/share/shadowsocksr/chinaipset.sh
+++ b/package/lean/luci-app-ssr-plus/root/usr/share/shadowsocksr/chinaipset.sh
@ -1,9 +1,11 @@
 #!/bin/sh
 LOCK_FILE="/var/lock/ssr-chinaipset.lock"
 [ -f "$LOCK_FILE" ] && exit 2
+[ -f "$1" ] && china_ip=$1
 touch "$LOCK_FILE"
-echo "create china hash:net family inet hashsize 1024 maxelem 65536" >/tmp/china.ipset
-awk '!/^$/&&!/^#/{printf("add china %s'" "'\n",$0)}' /etc/ssr/china_ssr.txt >>/tmp/china.ipset
-ipset -! flush china
-ipset -! restore </tmp/china.ipset 2>/dev/null
-rm -f /tmp/china.ipset $LOCK_FILE
+ipset -! flush china 2>/dev/null
+ipset -! -R <<-EOF || rm -f $LOCK_FILE && exit 1
+	create china hash:net
+	$(cat ${china_ip:=/etc/ssr/china_ssr.txt} | sed -e "s/^/add china /")
+EOF
+rm -f $LOCK_FILE
--- a/package/lean/luci-app-ssr-plus/root/usr/share/shadowsocksr/ssrplusupdate.sh
+++ b/package/lean/luci-app-ssr-plus/root/usr/share/shadowsocksr/ssrplusupdate.sh
@ -1,6 +1,6 @@
 #!/bin/sh
 /usr/bin/lua /usr/share/shadowsocksr/update.lua
 sleep 2s
-/usr/share/shadowsocksr/chinaipset.sh
+/usr/share/shadowsocksr/chinaipset.sh /tmp/etc/china_ssr.txt
 sleep 2s
 /usr/bin/lua /usr/share/shadowsocksr/subscribe.lua
--- a/package/lean/luci-app-ssr-plus/root/usr/share/shadowsocksr/update.lua
+++ b/package/lean/luci-app-ssr-plus/root/usr/share/shadowsocksr/update.lua
@ -42,7 +42,7 @@ end
 log("正在更新【GFW列表】数据库")
 update(uci:get_first("shadowsocksr", "global", "gfwlist_url", "https://cdn.jsdelivr.net/gh/v2fly/domain-list-community@release/gfwlist.txt"), "/etc/ssr/gfw_list.conf", "gfw_data", "/tmp/dnsmasq.ssr/gfw_list.conf")
 log("正在更新【国内IP段】数据库")
-update(uci:get_first("shadowsocksr", "global", "chnroute_url","https://ispip.clang.cn/all_cn.txt"), "/etc/ssr/china_ssr.txt", "cnip")
+update(uci:get_first("shadowsocksr", "global", "chnroute_url","https://ispip.clang.cn/all_cn.txt"), "/etc/ssr/china_ssr.txt", "cnip", "/tmp/etc/china_ssr.txt")
 if uci:get_first("shadowsocksr", "global", "adblock","0") == "1" then
 	log("正在更新【广告屏蔽】数据库")
 	update(uci:get_first("shadowsocksr", "global", "adblock_url","https://easylist-downloads.adblockplus.org/easylistchina+easylist.txt"), "/etc/ssr/ad.conf", "ad_data", "/tmp/dnsmasq.ssr/ad.conf")
--- a/package/network/services/dnsmasq/Makefile
+++ b/package/network/services/dnsmasq/Makefile
@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=dnsmasq
 PKG_VERSION:=2.82
-PKG_RELEASE:=5
+PKG_RELEASE:=7

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=http://thekelleys.org.uk/dnsmasq
--- a/package/network/services/dnsmasq/files/dhcp.conf
+++ b/package/network/services/dnsmasq/files/dhcp.conf
@ -22,6 +22,7 @@ config dnsmasq
 	option localservice	1  # disable to allow DNS requests from non-local subnets
 	option filter_aaaa	0
 	option dns_redirect	1
+	option ednspacket_max	1232

 config dhcp lan
 	option interface	lan
--- a/package/network/services/dnsmasq/files/dnsmasq.init
+++ b/package/network/services/dnsmasq/files/dnsmasq.init
@ -769,6 +769,29 @@ dhcp_relay_add() {
 	fi
 }

+dnsmasq_ipset_add() {
+	local cfg="$1"
+	local ipsets domains
+
+	add_ipset() {
+		ipsets="${ipsets:+$ipsets,}$1"
+	}
+
+	add_domain() {
+		# leading '/' is expected
+		domains="$domains/$1"
+	}
+
+	config_list_foreach "$cfg" "name" add_ipset
+	config_list_foreach "$cfg" "domain" add_domain
+
+	if [ -z "$ipsets" ] || [ -z "$domains" ]; then
+		return 0
+	fi
+
+	xappend "--ipset=$domains/$ipsets"
+}
+
 dnsmasq_start()
 {
 	local cfg="$1"
@ -1060,6 +1083,10 @@ dnsmasq_start()
 	config_foreach filter_dnsmasq cname dhcp_cname_add "$cfg"
 	echo >> $CONFIGFILE_TMP

+	echo >> $CONFIGFILE_TMP
+	config_foreach filter_dnsmasq ipset dnsmasq_ipset_add "$cfg"
+	echo >> $CONFIGFILE_TMP
+
 	echo >> $CONFIGFILE_TMP
 	mv -f $CONFIGFILE_TMP $CONFIGFILE
 	mv -f $HOSTFILE_TMP $HOSTFILE
--- a/package/system/refpolicy/Makefile
+++ b/package/system/refpolicy/Makefile
@ -24,7 +24,7 @@ TAR_OPTIONS:=--transform='s%^refpolicy%$(PKG_NAME)-$(PKG_VERSION)%' -xf -

 include $(INCLUDE_DIR)/package.mk

-define Package/refpolicy
+define Package/refpolicy/Default
  SECTION:=system
  CATEGORY:=Base system
  TITLE:=SELinux reference policy
@ -32,6 +32,19 @@ define Package/refpolicy
  PKGARCH:=all
 endef

+define Package/refpolicy
+  $(call Package/refpolicy/Default)
+  CONFLICTS:=refpolicy-modular
+  VARIANT:=default
+endef
+
+define Package/refpolicy-modular
+  $(call Package/refpolicy/Default)
+  TITLE += (modular)
+  VARIANT:=modular
+  PROVIDES:=refpolicy
+endef
+
 define Package/refpolicy/description
 	The SELinux Reference Policy project (refpolicy) is a
 	complete SELinux policy that can be used as the system
@ -56,25 +69,43 @@ endef
 # builds is a small host tool that gets run as part of the build
 # process.
 MAKE_FLAGS += \
+	DESTDIR="$(PKG_INSTALL_DIR)"
 	SETFILES="$(STAGING_DIR_HOST)/bin/setfiles" \
 	CHECKPOLICY="$(STAGING_DIR_HOSTPKG)/bin/checkpolicy" \
 	CC="$(HOSTCC)" \
 	CFLAGS="$(HOST_CFLAGS)"

 define Build/Configure
-	$(SED) "/MONOLITHIC/c\MONOLITHIC = y" $(PKG_BUILD_DIR)/build.conf
 	$(SED) "/NAME/c\NAME = targeted" $(PKG_BUILD_DIR)/build.conf
+ifneq ($(BUILD_VARIANT),modular)
+	$(SED) "/MONOLITHIC/c\MONOLITHIC = y" $(PKG_BUILD_DIR)/build.conf
+endif
 	$(call Build/Compile/Default,conf)
 endef

+ifeq ($(BUILD_VARIANT),modular)
+define Build/Install
+	$(call Build/Compile/Default,install install-headers)
+endef
+endif
+
 define Package/refpolicy/conffiles
 /etc/selinux/config
 endef

+Package/refpolicy-modular/conffiles = $(Package/refpolicy/conffiles)
+
 define Package/refpolicy/install
 	$(INSTALL_DIR) $(1)/etc/selinux
 	$(CP) $(PKG_INSTALL_DIR)/etc/selinux/* $(1)/etc/selinux/
 	$(CP) ./files/selinux-config $(1)/etc/selinux/config
+ifeq ($(BUILD_VARIANT),modular)
+	$(INSTALL_DIR) $(1)/usr/share/selinux
+	$(CP) $(PKG_INSTALL_DIR)/usr/share/selinux/* $(1)/usr/share/selinux/
+endif
 endef

+Package/refpolicy-modular/install = $(Package/refpolicy/install)
+
 $(eval $(call BuildPackage,refpolicy))
+$(eval $(call BuildPackage,refpolicy-modular))
--- a/scripts/mkhash.c
+++ b/scripts/mkhash.c
@ -85,6 +85,7 @@
 #include <stdint.h>
 #include <stdbool.h>
 #include <unistd.h>
+#include <sys/stat.h>

 #define ARRAY_SIZE(_n) (sizeof(_n) / sizeof((_n)[0]))

@ -736,7 +737,10 @@ static int usage(const char *progname)
 {
 	int i;

-	fprintf(stderr, "Usage: %s <hash type> [<file>...]\n"
+	fprintf(stderr, "Usage: %s <hash type> [options] [<file>...]\n"
+		"Options:\n"
+		"	-n		Print filename(s)\n"
+		"\n"
 		"Supported hash types:", progname);

 	for (i = 0; i < ARRAY_SIZE(types); i++)
@ -767,6 +771,13 @@ static int hash_file(struct hash_type *t, const char *filename, bool add_filenam
 	if (!filename || !strcmp(filename, "-")) {
 		str = t->func(stdin);
 	} else {
+		struct stat path_stat;
+		stat(filename, &path_stat);
+		if (S_ISDIR(path_stat.st_mode)) {
+			fprintf(stderr, "Failed to open '%s': Is a directory\n", filename);
+			return 1;
+		}
+
 		FILE *f = fopen(filename, "r");

 		if (!f) {
@ -820,8 +831,11 @@ int main(int argc, char **argv)
 	if (argc < 2)
 		return hash_file(t, NULL, add_filename);

-	for (i = 0; i < argc - 1; i++)
-		hash_file(t, argv[1 + i], add_filename);
+	for (i = 0; i < argc - 1; i++) {
+		int ret = hash_file(t, argv[1 + i], add_filename);
+		if (ret)
+			return ret;
+	}

 	return 0;
 }
--- a/target/imagebuilder/Makefile
+++ b/target/imagebuilder/Makefile
@ -90,7 +90,7 @@ endif
 	(cd $(PKG_BUILD_DIR); find staging_dir/host/bin/ $(IB_LDIR)/scripts/dtc/ -type f | \
 		$(XARGS) $(SCRIPT_DIR)/bundle-libraries.sh $(PKG_BUILD_DIR)/staging_dir/host)
 	$(CP) $(TOPDIR)/staging_dir/host/lib/libfakeroot* $(PKG_BUILD_DIR)/staging_dir/host/lib
-	STRIP=sstrip $(SCRIPT_DIR)/rstrip.sh $(PKG_BUILD_DIR)/staging_dir/host/bin/
+	STRIP=$(STAGING_DIR_HOST)/bin/sstrip $(SCRIPT_DIR)/rstrip.sh $(PKG_BUILD_DIR)/staging_dir/host/bin/
 	$(TAR) -cf - -C $(BUILD_DIR) $(IB_NAME) | xz -T$(if $(filter 1,$(NPROC)),2,0) -zc -7e > $@

 download:
--- a/toolchain/glibc/common.mk
+++ b/toolchain/glibc/common.mk
@ -7,13 +7,13 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=glibc
-PKG_VERSION:=2.31
+PKG_VERSION:=2.32
 PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
-PKG_SOURCE_VERSION:=4bc9918c998085800ecf5bbb3c863e66ea6252a0
-PKG_MIRROR_HASH:=51877ffff6819b5ccc004a842de755c6c203996d673d94d7013927712e252c17
+PKG_SOURCE_VERSION:=70ee5e8b573f76745760dd6b75f705590fc1923a
+PKG_MIRROR_HASH:=d816dc7658446c2969d307730b58df5f8a65853b4e57a655895feb685590d63b
 PKG_SOURCE_URL:=https://sourceware.org/git/glibc.git
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.xz

--- a/toolchain/glibc/patches/050-Revert-Disallow-use-of-DES-encryption-functions-in-n.patch
+++ b/toolchain/glibc/patches/050-Revert-Disallow-use-of-DES-encryption-functions-in-n.patch
@ -1,11 +1,11 @@
-From cfc93329e00cd23c226f34b3ffd5552a93c35bd7 Mon Sep 17 00:00:00 2001
-From: Hauke Mehrtens <hauke@hauke-m.de>
-Date: Mon, 23 Mar 2020 22:33:46 +0100
+From 08f5e0df46ce1ad617bcde1fd5542545397630b9 Mon Sep 17 00:00:00 2001
+From: Hans Dedecker <dedeckeh@gmail.com>
+Date: Sat, 24 Oct 2020 21:13:30 +0200
 Subject: Revert "Disallow use of DES encryption functions in new programs."

 This reverts commit b10a0accee709a5efff2fadf0b0bbb79ff0ad759.

-ppp still uses the encrypt functions from the libc. musl libc also
+ppp still uses the encrypt functions from the libc while musl libc also
 provides them.
 ---
 conform/data/stdlib.h-data |   3 +
@ -15,18 +15,19 @@ provides them.
 crypt/crypt.h              |  16 +++
 crypt/crypt_util.c         |   9 --
 manual/conf.texi           |   2 -
- manual/crypt.texi          | 201 +++++++++++++++++++++++++++++++++++++
+ manual/crypt.texi          | 204 +++++++++++++++++++++++++++++++++++++
 manual/string.texi         |  82 +++++++--------
- posix/unistd.h             |  22 ++--
+ posix/unistd.h             |  17 +++-
 stdlib/stdlib.h            |   6 ++
- sunrpc/Makefile            |   2 +-
 sunrpc/des_crypt.c         |   7 +-
 sunrpc/des_soft.c          |   2 +-
- 14 files changed, 303 insertions(+), 96 deletions(-)
+ 13 files changed, 305 insertions(+), 90 deletions(-)

+diff --git a/conform/data/stdlib.h-data b/conform/data/stdlib.h-data
+index 6913828196..d8fcccc2fb 100644
 --- a/conform/data/stdlib.h-data
 +++ b/conform/data/stdlib.h-data
-@@ -149,6 +149,9 @@ function {unsigned short int*} seed48 (u
+@@ -149,6 +149,9 @@ function {unsigned short int*} seed48 (unsigned short int[3])
 #if !defined ISO && !defined ISO99 && !defined ISO11 && !defined POSIX && !defined XPG4 && !defined XPG42 && !defined UNIX98
 function int setenv (const char*, const char*, int)
 #endif
@ -36,6 +37,8 @@ provides them.
 #if !defined ISO && !defined ISO99 && !defined ISO11 && !defined XPG4 && !defined POSIX && !defined POSIX2008
 function {char*} setstate (char*)
 #endif
+diff --git a/conform/data/unistd.h-data b/conform/data/unistd.h-data
+index aa070528e8..ddf4f25132 100644
 --- a/conform/data/unistd.h-data
 +++ b/conform/data/unistd.h-data
@@ -437,6 +437,9 @@ function int chroot (const char*)
@ -58,6 +61,8 @@ provides them.
 function int execl (const char*, const char*, ...)
 function int execle (const char*, const char*, ...)
 function int execlp (const char*, const char*, ...)
+diff --git a/crypt/cert.c b/crypt/cert.c
+index e070ca398d..80029e9078 100644
 --- a/crypt/cert.c
 +++ b/crypt/cert.c
@@ -10,22 +10,6 @@
@ -97,6 +102,8 @@ provides them.
 -}
 -
 -#endif
+diff --git a/crypt/crypt-entry.c b/crypt/crypt-entry.c
+index 502b5846f0..09332c690a 100644
 --- a/crypt/crypt-entry.c
 +++ b/crypt/crypt-entry.c
@@ -35,7 +35,6 @@
@ -107,7 +114,7 @@ provides them.
 
 /* Prototypes for local functions.  */
 #ifndef __GNU_LIBRARY__
-@@ -177,7 +176,17 @@ crypt (const char *key, const char *salt
+@@ -177,7 +176,17 @@ crypt (const char *key, const char *salt)
   return __crypt_r (key, salt, &_ufc_foobar);
 }
 
@ -127,6 +134,8 @@ provides them.
 +  return crypt (key, salt);
 +}
 #endif
+diff --git a/crypt/crypt.h b/crypt/crypt.h
+index ca8ad456cc..7d0de95018 100644
 --- a/crypt/crypt.h
 +++ b/crypt/crypt.h
@@ -36,6 +36,14 @@ __BEGIN_DECLS
@ -159,6 +168,8 @@ provides them.
 #endif
 
 __END_DECLS
+diff --git a/crypt/crypt_util.c b/crypt/crypt_util.c
+index 4b2f0a89cb..b012cde6bd 100644
 --- a/crypt/crypt_util.c
 +++ b/crypt/crypt_util.c
@@ -34,7 +34,6 @@
@ -185,7 +196,7 @@ provides them.
 
 /*
  * This is the final
-@@ -788,7 +785,6 @@ _ufc_output_conversion_r (ufc_long v1, u
+@@ -788,7 +785,6 @@ _ufc_output_conversion_r (ufc_long v1, ufc_long v2, const char *salt,
   __data->crypt_3_buf[13] = 0;
 }
 
@ -193,7 +204,7 @@ provides them.
 
 /*
  * UNIX encrypt function. Takes a bitvector
-@@ -889,14 +885,12 @@ __encrypt_r (char *__block, int __edflag
+@@ -889,14 +885,12 @@ __encrypt_r (char *__block, int __edflag,
   }
 }
 weak_alias (__encrypt_r, encrypt_r)
@ -208,7 +219,7 @@ provides them.
 
 
 /*
-@@ -921,15 +915,12 @@ __setkey_r (const char *__key, struct cr
+@@ -921,15 +915,12 @@ __setkey_r (const char *__key, struct crypt_data * __restrict __data)
   _ufc_mk_keytab_r((char *) ktab, __data);
 }
 weak_alias (__setkey_r, setkey_r)
@ -224,9 +235,11 @@ provides them.
 
 void
 __b64_from_24bit (char **cp, int *buflen,
+diff --git a/manual/conf.texi b/manual/conf.texi
+index f959b00bb6..51fb2f5aa1 100644
 --- a/manual/conf.texi
 +++ b/manual/conf.texi
-@@ -780,8 +780,6 @@ Inquire about the parameter correspondin
+@@ -780,8 +780,6 @@ Inquire about the parameter corresponding to @code{_XOPEN_LEGACY}.
 @item _SC_XOPEN_CRYPT
 @standards{X/Open, unistd.h}
 Inquire about the parameter corresponding to @code{_XOPEN_CRYPT}.
@ -235,9 +248,11 @@ provides them.
 
 @item _SC_XOPEN_ENH_I18N
 @standards{X/Open, unistd.h}
+diff --git a/manual/crypt.texi b/manual/crypt.texi
+index af23dd7847..1b151f2d74 100644
 --- a/manual/crypt.texi
 +++ b/manual/crypt.texi
-@@ -16,8 +16,19 @@ subject to them, even if you do not use
+@@ -16,8 +16,19 @@ subject to them, even if you do not use the functions in this chapter
 yourself.  The restrictions vary from place to place and are changed
 often, so we cannot give any more specific advice than this warning.
 
@ -253,12 +268,12 @@ provides them.
 +
 @menu
 * Passphrase Storage::          One-way hashing for passphrases.
-+* DES Encryption::              Routines for DES encryption.
+* crypt::                       A one-way function for passwords.
 * Unpredictable Bytes::         Randomness for cryptographic purposes.
 @end menu
 
-@@ -200,6 +211,196 @@ hashes for the same passphrase.
- @include testpass.c.texi
+@@ -190,6 +201,199 @@ unpredictable as possible; @pxref{Unpredictable Bytes}.
+ @include genpass.c.texi
 @end smallexample
 
 +@node DES Encryption
@ -451,9 +466,14 @@ provides them.
 +functions and their accompanying macros are all defined in the header
 +@file{rpc/des_crypt.h}.
 +
- @node Unpredictable Bytes
- @section Generating Unpredictable Bytes
- @cindex randomness source
+@node Unpredictable Bytes
+@section Generating Unpredictable Bytes
+
+ The next program demonstrates how to verify a passphrase.  It checks a
+ hash hardcoded into the program, because looking up real users' hashed
+ passphrases may require special privileges (@pxref{User Database}).
+diff --git a/manual/string.texi b/manual/string.texi
+index 23f516439a..5586b52dee 100644
 --- a/manual/string.texi
 +++ b/manual/string.texi
@@ -36,8 +36,8 @@ too.
@ -467,7 +487,7 @@ provides them.
 * Encode Binary Data::          Encoding and Decoding of Binary Data.
 * Argz and Envz Vectors::       Null-separated string vectors.
 @end menu
-@@ -2426,73 +2426,73 @@ functionality under a different name, su
+@@ -2426,73 +2426,73 @@ functionality under a different name, such as @code{explicit_memset},
 systems it may be in @file{strings.h} instead.
 @end deftypefun
 
@ -518,19 +538,10 @@ provides them.
 
 -@node Obfuscating Data
 -@section Obfuscating Data
+-@cindex Rot13
 +@node Trivial Encryption
 +@section Trivial Encryption
 +@cindex encryption
-+
-+
-+The @code{memfrob} function converts an array of data to something
-+unrecognizable and back again.  It is not encryption in its usual sense
-+since it is easy for someone to convert the encrypted data back to clear
-+text.  The transformation is analogous to Usenet's ``Rot13'' encryption
-+method for obscuring offensive jokes from sensitive eyes and such.
-+Unlike Rot13, @code{memfrob} works on arbitrary binary data, not just
-+text.
- @cindex Rot13
 
 -The @code{memfrob} function reversibly obfuscates an array of binary
 -data.  This is not true encryption; the obfuscated data still bears a
@ -538,12 +549,20 @@ provides them.
 -undo the obfuscation.  It is analogous to the ``Rot13'' cipher used on
 -Usenet for obscuring offensive jokes, spoilers for works of fiction,
 -and so on, but it can be applied to arbitrary binary data.
-
+ 
 -Programs that need true encryption---a transformation that completely
 -obscures the original and cannot be reversed without knowledge of a
 -secret key---should use a dedicated cryptography library, such as
 -@uref{https://www.gnu.org/software/libgcrypt/,,libgcrypt}.
-
+The @code{memfrob} function converts an array of data to something
+unrecognizable and back again.  It is not encryption in its usual sense
+since it is easy for someone to convert the encrypted data back to clear
+text.  The transformation is analogous to Usenet's ``Rot13'' encryption
+method for obscuring offensive jokes from sensitive eyes and such.
+Unlike Rot13, @code{memfrob} works on arbitrary binary data, not just
+text.
+@cindex Rot13
+ 
 -Programs that need to @emph{destroy} data should use
 -@code{explicit_bzero} (@pxref{Erasing Sensitive Data}), or possibly
 -@code{strfry} (@pxref{Shuffling Bytes}).
@ -560,14 +579,13 @@ provides them.
 -beginning at @var{mem}, in place.  Each byte is bitwise xor-ed with
 -the binary pattern 00101010 (hexadecimal 0x2A).  The return value is
 -always @var{mem}.
-
-@code{memfrob} a second time on the same data returns it to
-its original state.
 +@code{memfrob} transforms (frobnicates) each byte of the data structure
 +at @var{mem}, which is @var{length} bytes long, by bitwise exclusive
 +oring it with binary 00101010.  It does the transformation in place and
 +its return value is always @var{mem}.
-+
+ 
+-@code{memfrob} a second time on the same data returns it to
+-its original state.
 +Note that @code{memfrob} a second time on the same data structure
 +returns it to its original state.
 +
@ -582,6 +600,8 @@ provides them.
 @end deftypefun
 
 @node Encode Binary Data
+diff --git a/posix/unistd.h b/posix/unistd.h
+index 32b8161619..6fac59999f 100644
 --- a/posix/unistd.h
 +++ b/posix/unistd.h
@@ -107,6 +107,9 @@ __BEGIN_DECLS
@ -594,20 +614,20 @@ provides them.
 /* The enhanced internationalization capabilities according to XPG4.2
    are present.  */
 #define	_XOPEN_ENH_I18N	1
-@@ -1115,17 +1118,20 @@ ssize_t copy_file_range (int __infd, __o
+@@ -1129,17 +1132,25 @@ ssize_t copy_file_range (int __infd, __off64_t *__pinoff,
 extern int fdatasync (int __fildes);
 #endif /* Use POSIX199309 */
 
 -#ifdef __USE_MISC
-/* One-way hash PHRASE, returning a string suitable for storage in the
-   user database.  SALT selects the one-way function to use, and
-   ensures that no two users' hashes are the same, even if they use
-   the same passphrase.  The return value points to static storage
-   which will be overwritten by the next call to crypt.  */
-+
 +/* XPG4.2 specifies that prototypes for the encryption functions must
 +   be defined here.  */
 +#ifdef	__USE_XOPEN
+ /* One-way hash PHRASE, returning a string suitable for storage in the
+    user database.  SALT selects the one-way function to use, and
+    ensures that no two users' hashes are the same, even if they use
+    the same passphrase.  The return value points to static storage
+    which will be overwritten by the next call to crypt.  */
+
 +/* Encrypt at most 8 characters from KEY using salt to perturb DES.  */
 extern char *crypt (const char *__key, const char *__salt)
      __THROW __nonnull ((1, 2));
@ -623,9 +643,11 @@ provides them.
 /* Swab pairs bytes in the first N bytes of the area pointed to by
    FROM and copy the result to TO.  The value of TO must not be in the
    range [FROM - N + 1, FROM - 1].  If N is odd the first byte in FROM
+diff --git a/stdlib/stdlib.h b/stdlib/stdlib.h
+index 3aa27a9d25..67e5e66f94 100644
 --- a/stdlib/stdlib.h
 +++ b/stdlib/stdlib.h
-@@ -961,6 +961,12 @@ extern int getsubopt (char **__restrict
+@@ -962,6 +962,12 @@ extern int getsubopt (char **__restrict __optionp,
 #endif
 
 
@ -638,20 +660,11 @@ provides them.
 /* X/Open pseudo terminal handling.  */
 
 #ifdef __USE_XOPEN2KXSI
--- a/sunrpc/Makefile
-+++ b/sunrpc/Makefile
-@@ -51,7 +51,7 @@ rpcsvc = bootparam_prot.x nlm_prot.x rst
- headers-sunrpc = $(addprefix rpc/,auth.h auth_unix.h clnt.h pmap_clnt.h \
- 				  pmap_prot.h pmap_rmt.h rpc.h rpc_msg.h \
- 				  svc.h svc_auth.h types.h xdr.h auth_des.h \
-				  key_prot.h) \
-+				  des_crypt.h key_prot.h rpc_des.h) \
- 		       $(rpcsvc:%=rpcsvc/%) rpcsvc/bootparam.h
- headers = rpc/netdb.h
- install-others = $(inst_sysconfdir)/rpc
+diff --git a/sunrpc/des_crypt.c b/sunrpc/des_crypt.c
+index 9b4bd2d5dd..a4d8b2936b 100644
 --- a/sunrpc/des_crypt.c
 +++ b/sunrpc/des_crypt.c
-@@ -86,9 +86,6 @@ common_crypt (char *key, char *buf, regi
+@@ -86,9 +86,6 @@ common_crypt (char *key, char *buf, register unsigned len,
   return desdev == DES_SW ? DESERR_NONE : DESERR_NOHWDEVICE;
 }
 
@ -661,7 +674,7 @@ provides them.
 /*
  * CBC mode encryption
  */
-@@ -105,7 +102,7 @@ cbc_crypt (char *key, char *buf, unsigne
+@@ -105,7 +102,7 @@ cbc_crypt (char *key, char *buf, unsigned int len, unsigned int mode,
   COPY8 (dp.des_ivec, ivec);
   return err;
 }
@ -670,12 +683,14 @@ provides them.
 
 /*
  * ECB mode encryption
-@@ -118,4 +115,4 @@ ecb_crypt (char *key, char *buf, unsigne
+@@ -118,4 +115,4 @@ ecb_crypt (char *key, char *buf, unsigned int len, unsigned int mode)
   dp.des_mode = ECB;
   return common_crypt (key, buf, len, mode, &dp);
 }
 -hidden_nolink (ecb_crypt, libc, GLIBC_2_1)
 +libc_hidden_nolink_sunrpc (ecb_crypt, GLIBC_2_1)
+diff --git a/sunrpc/des_soft.c b/sunrpc/des_soft.c
+index a87de96cc7..f884f8f21b 100644
 --- a/sunrpc/des_soft.c
 +++ b/sunrpc/des_soft.c
@@ -71,4 +71,4 @@ des_setparity (char *p)
@ -684,3 +699,6 @@ provides them.
 }
 -hidden_nolink (des_setparity, libc, GLIBC_2_1)
 +libc_hidden_nolink_sunrpc (des_setparity, GLIBC_2_1)
+-- 
+2.25.1
+
--- a/toolchain/glibc/patches/100-fix_cross_rpcgen.patch
+++ b/toolchain/glibc/patches/100-fix_cross_rpcgen.patch
@ -33,20 +33,3 @@
 +typedef char *caddr_t;
 # define __daddr_t_defined
 #endif
- 
--- a/sunrpc/rpc_main.c
-+++ b/sunrpc/rpc_main.c
-@@ -958,9 +958,10 @@ mkfile_output (struct commandline *cmd)
- 	abort ();
-       temp = strrchr (cmd->infile, '.');
-       cp = stpcpy (mkfilename, "Makefile.");
-      if (temp != NULL)
-	*((char *) stpncpy (cp, cmd->infile, temp - cmd->infile)) = '\0';
-      else
-+      if (temp != NULL) {
-+        strncpy(cp, cmd->infile, temp - cmd->infile);
-+        cp[temp - cmd->infile - 1] = 0;
-+      } else
- 	stpcpy (cp, cmd->infile);
- 
-     }
--- a/tools/fakeroot/patches/000-relocatable.patch
+++ b/tools/fakeroot/patches/000-relocatable.patch
@ -1,25 +1,29 @@
 --- a/scripts/fakeroot.in
 +++ b/scripts/fakeroot.in
-@@ -30,12 +30,19 @@ fatal ()
+@@ -30,13 +30,20 @@ fatal ()
 }
 
 # strip /bin/fakeroot to find install prefix
 -FAKEROOT_PREFIX=@prefix@
 -FAKEROOT_BINDIR=@bindir@
 +if [ -n "$STAGING_DIR_HOST" ]; then
-+    FAKEROOT_PREFIX="${STAGING_DIR_HOST}"
-+    FAKEROOT_BINDIR="${STAGING_DIR_HOST}/bin"
-+    FAKEROOT_LIBDIR="${STAGING_DIR_HOST}/lib"
+    USEABSLIBPATH=1
+    LIB=${STAGING_DIR_HOST}/lib/lib@fakeroot_transformed@@DLSUFFIX@
+    FAKED=${STAGING_DIR_HOST}/bin/faked
+    PATHS=
 +else
 +    FAKEROOT_PREFIX=@prefix@
 +    FAKEROOT_BINDIR=@bindir@
-+    FAKEROOT_LIBDIR=@libdir@
+ 
+-USEABSLIBPATH=@LDPRELOADABS@
+-LIB=lib@fakeroot_transformed@@DLSUFFIX@
+-PATHS=@libdir@:${FAKEROOT_PREFIX}/lib64/libfakeroot:${FAKEROOT_PREFIX}/lib32/libfakeroot
+-FAKED=${FAKEROOT_BINDIR}/@faked_transformed@
+    USEABSLIBPATH=@LDPRELOADABS@
+    LIB=lib@fakeroot_transformed@@DLSUFFIX@
+    PATHS=@libdir@:${FAKEROOT_PREFIX}/lib64/libfakeroot:${FAKEROOT_PREFIX}/lib32/libfakeroot
+    FAKED=${FAKEROOT_BINDIR}/@faked_transformed@
 +fi
 
- USEABSLIBPATH=@LDPRELOADABS@
- LIB=lib@fakeroot_transformed@@DLSUFFIX@
-PATHS=@libdir@:${FAKEROOT_PREFIX}/lib64/libfakeroot:${FAKEROOT_PREFIX}/lib32/libfakeroot
-+PATHS=${FAKEROOT_LIBDIR}:${FAKEROOT_PREFIX}/lib64/libfakeroot:${FAKEROOT_PREFIX}/lib32/libfakeroot
- FAKED=${FAKEROOT_BINDIR}/@faked_transformed@
- 
 FAKED_MODE="unknown-is-root"
+ export FAKED_MODE