From fd6d1b07005ce4bd6a4ec2c137572e7869dd11e4 Mon Sep 17 00:00:00 2001 From: CN_SZTL <22235437+1715173329@users.noreply.github.com> Date: Sun, 22 Mar 2020 10:08:58 +0800 Subject: [PATCH 01/11] openssl: update to 1.1.1e (#3926) This version includes bug and security fixes, including medium-severity CVE-2019-1551, affecting RSA1024, RSA1536, DSA1024 & DH512 on x86_64. Ref: openwrt/openwrt@dcef8d6 Signed-off-by: CN_SZTL --- package/libs/openssl/Makefile | 12 +++--- .../150-openssl.cnf-add-engines-conf.patch | 31 ++++++++++++- ...o-make-the-dev-crypto-engine-dynamic.patch | 43 ++++++------------- ...default-to-not-use-digests-in-engine.patch | 8 ++-- ...to-ignore-error-when-closing-session.patch | 6 +-- 5 files changed, 55 insertions(+), 45 deletions(-) diff --git a/package/libs/openssl/Makefile b/package/libs/openssl/Makefile index ca393be88f..7c90fcca33 100644 --- a/package/libs/openssl/Makefile +++ b/package/libs/openssl/Makefile @@ -9,9 +9,9 @@ include $(TOPDIR)/rules.mk PKG_NAME:=openssl PKG_BASE:=1.1.1 -PKG_BUGFIX:=d +PKG_BUGFIX:=e PKG_VERSION:=$(PKG_BASE)$(PKG_BUGFIX) -PKG_RELEASE:=3 +PKG_RELEASE:=1 PKG_USE_MIPS16:=0 ENGINES_DIR=engines-1.1 @@ -19,12 +19,12 @@ PKG_BUILD_PARALLEL:=1 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz PKG_SOURCE_URL:= \ + http://www.openssl.org/source/ \ + http://www.openssl.org/source/old/$(PKG_BASE)/ \ http://ftp.fi.muni.cz/pub/openssl/source/ \ http://ftp.linux.hr/pub/openssl/source/ \ - ftp://ftp.pca.dfn.de/pub/tools/net/openssl/source/ \ - http://www.openssl.org/source/ \ - http://www.openssl.org/source/old/$(PKG_BASE)/ -PKG_HASH:=1e3a91bc1f9dfce01af26026f856e064eab4c8ee0a8f457b5ae30b40b8b711f2 + ftp://ftp.pca.dfn.de/pub/tools/net/openssl/source/ +PKG_HASH:=694f61ac11cb51c9bf73f54e771ff6022b0327a43bbdfa1b2f19de1662a6dcbe PKG_LICENSE:=OpenSSL PKG_LICENSE_FILES:=LICENSE diff --git a/package/libs/openssl/patches/150-openssl.cnf-add-engines-conf.patch b/package/libs/openssl/patches/150-openssl.cnf-add-engines-conf.patch index 6c7143dd7e..81d41963c6 100644 --- a/package/libs/openssl/patches/150-openssl.cnf-add-engines-conf.patch +++ b/package/libs/openssl/patches/150-openssl.cnf-add-engines-conf.patch @@ -1,6 +1,6 @@ --- a/apps/openssl.cnf +++ b/apps/openssl.cnf -@@ -22,6 +22,53 @@ oid_section = new_oids +@@ -22,6 +22,82 @@ oid_section = new_oids # (Alternatively, use a configuration file that has only # X.509v3 extensions in its main [= default] section.) @@ -16,8 +16,37 @@ +#padlock=padlock + +[afalg] ++# Leave this alone and configure algorithms with CIPERS/DIGESTS below +default_algorithms = ALL + ++# The following commands are only available if using the alternative ++# (sync) AFALG engine ++# Configuration commands: ++# Run 'openssl engine -t -c -vv -pre DUMP_INFO devcrypto' to see a ++# list of supported algorithms, along with their driver, whether they ++# are hw accelerated or not, and the engine's configuration commands. ++ ++# USE_SOFTDRIVERS: specifies whether to use software (not accelerated) ++# drivers (0=use only accelerated drivers, 1=allow all drivers, 2=use ++# if acceleration can't be determined) [default=2] ++#USE_SOFTDRIVERS = 2 ++ ++# CIPHERS: either ALL, NONE, NO_ECB (all except ECB-mode) or a ++# comma-separated list of ciphers to enable [default=NO_ECB] ++# Starting in 1.2.0, if you use a cipher list, each cipher may be ++# followed by a colon (:) and the minimum request length to use ++# AF_ALG drivers for that cipher; smaller requests are processed by ++# softare; a negative value will use the default for that cipher ++#CIPHERS=AES-128-CBC:1024, AES-256-CBC:768, DES-EDE3-CBC:0 ++ ++# DIGESTS: either ALL, NONE, or a comma-separated list of digests to ++# enable [default=NONE] ++# It is strongly recommended not to enable digests; their performance ++# is poor, and there are many cases in which they will not work, ++# especially when calling fork with open crypto contexts. Openssh, ++# for example, does this, and you may not be able to login. ++#DIGESTS = NONE ++ +[devcrypto] +# Leave this alone and configure algorithms with CIPERS/DIGESTS below +default_algorithms = ALL diff --git a/package/libs/openssl/patches/430-e_devcrypto-make-the-dev-crypto-engine-dynamic.patch b/package/libs/openssl/patches/430-e_devcrypto-make-the-dev-crypto-engine-dynamic.patch index ee33942426..71dc5bf99b 100644 --- a/package/libs/openssl/patches/430-e_devcrypto-make-the-dev-crypto-engine-dynamic.patch +++ b/package/libs/openssl/patches/430-e_devcrypto-make-the-dev-crypto-engine-dynamic.patch @@ -1,4 +1,4 @@ -From f3cef70b34afde3afd13ce3636232d41533b0162 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Eneas U de Queiroz Date: Tue, 6 Nov 2018 10:57:03 -0200 Subject: e_devcrypto: make the /dev/crypto engine dynamic @@ -20,7 +20,7 @@ index e00802a3fd..47fe948966 100644 - SOURCE[../../libcrypto]=eng_devcrypto.c -ENDIF diff --git a/crypto/init.c b/crypto/init.c -index 9fc0e8ef68..b387559920 100644 +index 1b0d523bea..ee3e2eb075 100644 --- a/crypto/init.c +++ b/crypto/init.c @@ -329,18 +329,6 @@ DEFINE_RUN_ONCE_STATIC(ossl_init_engine_openssl) @@ -116,7 +116,7 @@ diff --git a/crypto/engine/eng_devcrypto.c b/engines/e_devcrypto.c similarity index 95% rename from crypto/engine/eng_devcrypto.c rename to engines/e_devcrypto.c -index 64dc6b891d..fb5c6e1636 100644 +index 0d420e50aa..3fcd81de7a 100644 --- a/crypto/engine/eng_devcrypto.c +++ b/engines/e_devcrypto.c @@ -7,7 +7,7 @@ @@ -128,15 +128,7 @@ index 64dc6b891d..fb5c6e1636 100644 #include #include #include -@@ -23,26 +23,26 @@ - #include - #include - --#include "internal/engine.h" -- - /* #define ENGINE_DEVCRYPTO_DEBUG */ - - #if CRYPTO_ALGORITHM_MIN < CRYPTO_ALGORITHM_MAX +@@ -31,18 +31,20 @@ # define CHECK_BSD_STYLE_MACROS #endif @@ -160,18 +152,7 @@ index 64dc6b891d..fb5c6e1636 100644 /* * cipher/digest status & acceleration definitions -@@ -66,6 +66,10 @@ struct driver_info_st { - char *driver_name; - }; - -+#ifdef OPENSSL_NO_DYNAMIC_ENGINE -+void engine_load_devcrypto_int(void); -+#endif -+ - static int clean_devcrypto_session(struct session_op *sess) { - if (ioctl(cfd, CIOCFSESSION, &sess->ses) < 0) { - SYSerr(SYS_F_IOCTL, errno); -@@ -341,6 +345,7 @@ static int cipher_ctrl(EVP_CIPHER_CTX *ctx, int type, int p1, void* p2) +@@ -341,6 +343,7 @@ static int cipher_ctrl(EVP_CIPHER_CTX *ctx, int type, int p1, void* p2) struct cipher_ctx *to_cipher_ctx; switch (type) { @@ -179,7 +160,7 @@ index 64dc6b891d..fb5c6e1636 100644 case EVP_CTRL_COPY: if (cipher_ctx == NULL) return 1; -@@ -702,7 +707,6 @@ static int digest_init(EVP_MD_CTX *ctx) +@@ -702,7 +705,6 @@ static int digest_init(EVP_MD_CTX *ctx) SYSerr(SYS_F_IOCTL, errno); return 0; } @@ -187,7 +168,7 @@ index 64dc6b891d..fb5c6e1636 100644 return 1; } -@@ -1058,7 +1062,7 @@ static const ENGINE_CMD_DEFN devcrypto_cmds[] = { +@@ -1058,7 +1060,7 @@ static const ENGINE_CMD_DEFN devcrypto_cmds[] = { OPENSSL_MSTR(DEVCRYPTO_USE_SOFTWARE) "=allow all drivers, " OPENSSL_MSTR(DEVCRYPTO_REJECT_SOFTWARE) "=use if acceleration can't be determined) [default=" @@ -196,7 +177,7 @@ index 64dc6b891d..fb5c6e1636 100644 ENGINE_CMD_FLAG_NUMERIC}, #endif -@@ -1166,55 +1170,70 @@ static int devcrypto_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f) (void)) +@@ -1166,55 +1168,70 @@ static int devcrypto_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f) (void)) * *****/ @@ -284,12 +265,12 @@ index 64dc6b891d..fb5c6e1636 100644 - || !ENGINE_set_ctrl_function(e, devcrypto_ctrl) + || !ENGINE_set_ctrl_function(e, devcrypto_ctrl)) + return 0; -+ + + prepare_cipher_methods(); +#ifdef IMPLEMENT_DIGEST + prepare_digest_methods(); +#endif - ++ + return (ENGINE_set_ciphers(e, devcrypto_ciphers) +#ifdef IMPLEMENT_DIGEST + && ENGINE_set_digests(e, devcrypto_digests) @@ -297,7 +278,7 @@ index 64dc6b891d..fb5c6e1636 100644 /* * Asymmetric ciphers aren't well supported with /dev/crypto. Among the BSD * implementations, it seems to only exist in FreeBSD, and regarding the -@@ -1237,23 +1256,36 @@ void engine_load_devcrypto_int() +@@ -1237,23 +1254,36 @@ void engine_load_devcrypto_int() */ #if 0 # ifndef OPENSSL_NO_RSA @@ -343,7 +324,7 @@ index 64dc6b891d..fb5c6e1636 100644 ENGINE_free(e); return; } -@@ -1262,3 +1294,22 @@ void engine_load_devcrypto_int() +@@ -1262,3 +1292,22 @@ void engine_load_devcrypto_int() ENGINE_free(e); /* Loose our local reference */ ERR_clear_error(); } diff --git a/package/libs/openssl/patches/500-e_devcrypto-default-to-not-use-digests-in-engine.patch b/package/libs/openssl/patches/500-e_devcrypto-default-to-not-use-digests-in-engine.patch index 89385fa477..1f1cd7a582 100644 --- a/package/libs/openssl/patches/500-e_devcrypto-default-to-not-use-digests-in-engine.patch +++ b/package/libs/openssl/patches/500-e_devcrypto-default-to-not-use-digests-in-engine.patch @@ -1,4 +1,4 @@ -From 52ddedc09ee81fe05ea2fa384fce89afe92d6d72 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Eneas U de Queiroz Date: Mon, 11 Mar 2019 09:29:13 -0300 Subject: e_devcrypto: default to not use digests in engine @@ -20,10 +20,10 @@ turn them on if it is safe and fast enough. Signed-off-by: Eneas U de Queiroz diff --git a/engines/e_devcrypto.c b/engines/e_devcrypto.c -index fb5c6e1636..7741138b82 100644 +index 3fcd81de7a..d25230d366 100644 --- a/engines/e_devcrypto.c +++ b/engines/e_devcrypto.c -@@ -854,7 +854,7 @@ static void prepare_digest_methods(void) +@@ -852,7 +852,7 @@ static void prepare_digest_methods(void) for (i = 0, known_digest_nids_amount = 0; i < OSSL_NELEM(digest_data); i++) { @@ -32,7 +32,7 @@ index fb5c6e1636..7741138b82 100644 /* * Check that the digest is usable -@@ -1074,7 +1074,7 @@ static const ENGINE_CMD_DEFN devcrypto_cmds[] = { +@@ -1072,7 +1072,7 @@ static const ENGINE_CMD_DEFN devcrypto_cmds[] = { #ifdef IMPLEMENT_DIGEST {DEVCRYPTO_CMD_DIGESTS, "DIGESTS", diff --git a/package/libs/openssl/patches/510-e_devcrypto-ignore-error-when-closing-session.patch b/package/libs/openssl/patches/510-e_devcrypto-ignore-error-when-closing-session.patch index 087994376d..bc514b88c9 100644 --- a/package/libs/openssl/patches/510-e_devcrypto-ignore-error-when-closing-session.patch +++ b/package/libs/openssl/patches/510-e_devcrypto-ignore-error-when-closing-session.patch @@ -1,4 +1,4 @@ -From b6b2744f06f64922b449b3cb4bf0ad3df3efba71 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Eneas U de Queiroz Date: Mon, 11 Mar 2019 10:15:14 -0300 Subject: e_devcrypto: ignore error when closing session @@ -9,10 +9,10 @@ session. It may have been closed by another process after a fork. Signed-off-by: Eneas U de Queiroz diff --git a/engines/e_devcrypto.c b/engines/e_devcrypto.c -index 7741138b82..2480bdbd57 100644 +index d25230d366..f4570f1666 100644 --- a/engines/e_devcrypto.c +++ b/engines/e_devcrypto.c -@@ -197,9 +197,8 @@ static int cipher_init(EVP_CIPHER_CTX *ctx, const unsigned char *key, +@@ -195,9 +195,8 @@ static int cipher_init(EVP_CIPHER_CTX *ctx, const unsigned char *key, get_cipher_data(EVP_CIPHER_CTX_nid(ctx)); /* cleanup a previous session */ From 00f8216c7e58f31e388f44cee6fff8bc28bed5b5 Mon Sep 17 00:00:00 2001 From: gudumuyu <32303402+gudumuyu@users.noreply.github.com> Date: Sun, 22 Mar 2020 10:09:36 +0800 Subject: [PATCH 02/11] wireguard:bump to v0.0.20200318 (#3920) * wireguard bump to v0.0.20200318 * wireguard-tools:bump to v1.0.20200319 * wireguard:bump to 0.0.20200318 * wireguard-tools:bump to 1.0.20200319 * Update Makefile * Update Makefile --- package/network/services/wireguard/Makefile | 6 +++--- package/network/utils/wireguard-tools/Makefile | 7 +++---- 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/package/network/services/wireguard/Makefile b/package/network/services/wireguard/Makefile index 231f1f41bc..bf4d6440ba 100644 --- a/package/network/services/wireguard/Makefile +++ b/package/network/services/wireguard/Makefile @@ -11,12 +11,12 @@ include $(INCLUDE_DIR)/kernel.mk PKG_NAME:=wireguard -PKG_VERSION:=0.0.20200215 -PKG_RELEASE:=1 +PKG_VERSION:=0.0.20200318 +PKG_RELEASE:=2 PKG_SOURCE:=wireguard-linux-compat-$(PKG_VERSION).tar.xz PKG_SOURCE_URL:=https://git.zx2c4.com/wireguard-linux-compat/snapshot/ -PKG_HASH:=0def6f3608ec06f6dfc454aa5281a7c38b06ff27096cb341448d20602da4e923 +PKG_HASH:=fa74a8627f731754fbf4ea7d6ae8f571a2cfe8cd4b744a5f165065619cb836a1 PKG_LICENSE:=GPL-2.0 PKG_LICENSE_FILES:=COPYING diff --git a/package/network/utils/wireguard-tools/Makefile b/package/network/utils/wireguard-tools/Makefile index b2b71ce880..173321517e 100644 --- a/package/network/utils/wireguard-tools/Makefile +++ b/package/network/utils/wireguard-tools/Makefile @@ -11,13 +11,12 @@ include $(INCLUDE_DIR)/kernel.mk PKG_NAME:=wireguard-tools -PKG_VERSION:=1.0.20200206 -PKG_RELEASE:=1 +PKG_VERSION:=1.0.20200319 +PKG_RELEASE:=2 PKG_SOURCE:=wireguard-tools-$(PKG_VERSION).tar.xz PKG_SOURCE_URL:=https://git.zx2c4.com/wireguard-tools/snapshot/ -PKG_HASH:=f5207248c6a3c3e3bfc9ab30b91c1897b00802ed861e1f9faaed873366078c64 - +PKG_HASH:=757ed31d4d48d5fd7853bfd9bfa6a3a1b53c24a94fe617439948784a2c0ed987 PKG_LICENSE:=GPL-2.0 PKG_LICENSE_FILES:=COPYING From 12f20458e7f6fc3992eed1faee0582f4e2b03e45 Mon Sep 17 00:00:00 2001 From: Kevin Yang Date: Sun, 22 Mar 2020 10:18:18 +0800 Subject: [PATCH 03/11] Update ssr-switch (#3908) Co-authored-by: KevinZjYang --- package/lean/luci-app-ssr-plus/root/usr/bin/ssr-switch | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/package/lean/luci-app-ssr-plus/root/usr/bin/ssr-switch b/package/lean/luci-app-ssr-plus/root/usr/bin/ssr-switch index b9cdd54aaa..6d3fa6ddad 100755 --- a/package/lean/luci-app-ssr-plus/root/usr/bin/ssr-switch +++ b/package/lean/luci-app-ssr-plus/root/usr/bin/ssr-switch @@ -134,12 +134,14 @@ start() { CURRENT_SERVER=$DEFAULT_SERVER switch_proxy $CURRENT_SERVER echo "$(date "+%Y-%m-%d %H:%M:%S") switch to default ["$(uci_get_by_name $CURRENT_SERVER server)"] proxy!" >>/tmp/ssrplus.log - continue else echo "$(date "+%Y-%m-%d %H:%M:%S") Main server is NOT avilable.Continue using current server." >>/tmp/ssrplus.log fi + else + echo "$(date "+%Y-%m-%d %H:%M:%S") The current server is the default server." >>/tmp/ssrplus.log fi #判断当前代理是否正常 + echo "$(date "+%Y-%m-%d %H:%M:%S") Start checking if the current server is available." >>/tmp/ssrplus.log check_proxy current_ret=$? if [ "$current_ret" == "1" ]; then From d291e2495609a515ebddc52de553bf3ed97cf6bf Mon Sep 17 00:00:00 2001 From: Xiaok <3795104+luxiaok@users.noreply.github.com> Date: Sun, 22 Mar 2020 10:19:20 +0800 Subject: [PATCH 04/11] x86: fix path for qemu-img (#3856) --- target/linux/x86/image/Makefile | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/target/linux/x86/image/Makefile b/target/linux/x86/image/Makefile index 86bb8cf1e9..094a2cffb8 100644 --- a/target/linux/x86/image/Makefile +++ b/target/linux/x86/image/Makefile @@ -227,7 +227,7 @@ endef ifneq ($(CONFIG_VDI_IMAGES),) define Image/Build/vdi rm $(BIN_DIR)/$(IMG_PREFIX)-combined-$(1).vdi || true - qemu-img convert -f raw -O vdi \ + $(STAGING_DIR_HOST)/bin/qemu-img convert -f raw -O vdi \ $(BIN_DIR)/$(IMG_PREFIX)-combined-$(1).img \ $(BIN_DIR)/$(IMG_PREFIX)-combined-$(1).vdi # XXX: VBoxManage insists on setting perms to 0600 @@ -235,7 +235,7 @@ ifneq ($(CONFIG_VDI_IMAGES),) endef define Image/Build/vdi_efi rm $(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).vdi || true - qemu-img convert -f raw -O vdi \ + $(STAGING_DIR_HOST)/bin/qemu-img convert -f raw -O vdi \ $(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).img \ $(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).vdi # XXX: VBoxManage insists on setting perms to 0600 @@ -246,13 +246,13 @@ endif ifneq ($(CONFIG_VMDK_IMAGES),) define Image/Build/vmdk rm $(BIN_DIR)/$(IMG_PREFIX)-combined-$(1).vmdk || true - /usr/bin/qemu-img convert -f raw -O vmdk -o adapter_type=lsilogic \ + $(STAGING_DIR_HOST)/bin/qemu-img convert -f raw -O vmdk -o adapter_type=lsilogic \ $(BIN_DIR)/$(IMG_PREFIX)-combined-$(1).img \ $(BIN_DIR)/$(IMG_PREFIX)-combined-$(1).vmdk endef define Image/Build/vmdk_efi rm $(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).vmdk || true - /usr/bin/qemu-img convert -f raw -O vmdk -o adapter_type=lsilogic \ + $(STAGING_DIR_HOST)/bin/qemu-img convert -f raw -O vmdk -o adapter_type=lsilogic \ $(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).img \ $(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).vmdk endef @@ -261,13 +261,13 @@ endif ifneq ($(CONFIG_VHD_IMAGES),) define Image/Build/vhd rm $(BIN_DIR)/$(IMG_PREFIX)-combined-$(1).vhdx || true - /usr/bin/qemu-img convert -O vhdx \ + $(STAGING_DIR_HOST)/bin/qemu-img convert -O vhdx \ $(BIN_DIR)/$(IMG_PREFIX)-combined-$(1).img \ $(BIN_DIR)/$(IMG_PREFIX)-combined-$(1).vhdx endef define Image/Build/vhd_efi rm $(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).vhdx || true - /usr/bin/qemu-img convert -O vhdx \ + $(STAGING_DIR_HOST)/bin/qemu-img convert -O vhdx \ $(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).img \ $(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).vhdx endef @@ -276,13 +276,13 @@ endif ifneq ($(CONFIG_QCOW2_IMAGES),) define Image/Build/qcow2 rm $(BIN_DIR)/$(IMG_PREFIX)-combined-$(1).qcow2 || true - /usr/bin/qemu-img convert -f raw -O qcow2 \ + $(STAGING_DIR_HOST)/bin/qemu-img convert -f raw -O qcow2 \ $(BIN_DIR)/$(IMG_PREFIX)-combined-$(1).img \ $(BIN_DIR)/$(IMG_PREFIX)-combined-$(1).qcow2 endef define Image/Build/qcow2_efi rm $(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).qcow2 || true - /usr/bin/qemu-img convert -f raw -O qcow2 \ + $(STAGING_DIR_HOST)/bin/qemu-img convert -f raw -O qcow2 \ $(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).img \ $(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).qcow2 endef From fd76b93998295ecef52b890da74e2040e36b4d8e Mon Sep 17 00:00:00 2001 From: AmadeusGhost <42570690+AmadeusGhost@users.noreply.github.com> Date: Sun, 22 Mar 2020 16:38:45 +0800 Subject: [PATCH 05/11] ipq40xx: add missing label for cm520 (#3935) --- .../arch/arm/boot/dts/qcom-ipq4019-cm520-79f.dts | 13 ++++--------- .../arch/arm/boot/dts/qcom-ipq4019-cm520-79f.dts | 13 ++++--------- .../patches-4.14/996-add-blsp1-uart2-label.patch | 11 +++++++++++ 3 files changed, 19 insertions(+), 18 deletions(-) create mode 100644 target/linux/ipq40xx/patches-4.14/996-add-blsp1-uart2-label.patch diff --git a/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4019-cm520-79f.dts b/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4019-cm520-79f.dts index 29fd2b3621..53f1cb75b7 100644 --- a/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4019-cm520-79f.dts +++ b/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4019-cm520-79f.dts @@ -14,7 +14,6 @@ led-failsafe = &led_sys; led-running = &led_sys; led-upgrade = &led_sys; - serial0 = &blsp1_uart1; }; chosen { @@ -191,8 +190,10 @@ &blsp1_uart1 { status = "okay"; - pinctrl-0 = <&serial_0_pins>; - pinctrl-names = "default"; +}; + +&blsp1_uart2 { + status = "okay"; }; &cryptobam { @@ -242,12 +243,6 @@ }; &tlmm { - serial_0_pins: serial0-pinmux { - pins = "gpio16", "gpio17"; - function = "blsp_uart0"; - bias-disable; - }; - mdio_pins: mdio_pinmux { mux_1 { pins = "gpio6"; diff --git a/target/linux/ipq40xx/files-4.19/arch/arm/boot/dts/qcom-ipq4019-cm520-79f.dts b/target/linux/ipq40xx/files-4.19/arch/arm/boot/dts/qcom-ipq4019-cm520-79f.dts index 29fd2b3621..53f1cb75b7 100644 --- a/target/linux/ipq40xx/files-4.19/arch/arm/boot/dts/qcom-ipq4019-cm520-79f.dts +++ b/target/linux/ipq40xx/files-4.19/arch/arm/boot/dts/qcom-ipq4019-cm520-79f.dts @@ -14,7 +14,6 @@ led-failsafe = &led_sys; led-running = &led_sys; led-upgrade = &led_sys; - serial0 = &blsp1_uart1; }; chosen { @@ -191,8 +190,10 @@ &blsp1_uart1 { status = "okay"; - pinctrl-0 = <&serial_0_pins>; - pinctrl-names = "default"; +}; + +&blsp1_uart2 { + status = "okay"; }; &cryptobam { @@ -242,12 +243,6 @@ }; &tlmm { - serial_0_pins: serial0-pinmux { - pins = "gpio16", "gpio17"; - function = "blsp_uart0"; - bias-disable; - }; - mdio_pins: mdio_pinmux { mux_1 { pins = "gpio6"; diff --git a/target/linux/ipq40xx/patches-4.14/996-add-blsp1-uart2-label.patch b/target/linux/ipq40xx/patches-4.14/996-add-blsp1-uart2-label.patch new file mode 100644 index 0000000000..eee917afbc --- /dev/null +++ b/target/linux/ipq40xx/patches-4.14/996-add-blsp1-uart2-label.patch @@ -0,0 +1,11 @@ +--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi ++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi +@@ -387,7 +387,7 @@ + dma-names = "rx", "tx"; + }; + +- serial@78b0000 { ++ blsp1_uart2: serial@78b0000 { + compatible = "qcom,msm-uartdm-v1.4", "qcom,msm-uartdm"; + reg = <0x78b0000 0x200>; + interrupts = ; From 6e7eb43250a2d093225e009af6b504b600c36872 Mon Sep 17 00:00:00 2001 From: lean Date: Sun, 22 Mar 2020 17:04:23 +0800 Subject: [PATCH 06/11] luci-app-ssr-plus: include SS by default --- package/lean/luci-app-ssr-plus/Makefile | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/package/lean/luci-app-ssr-plus/Makefile b/package/lean/luci-app-ssr-plus/Makefile index 75114593ce..534b12362f 100644 --- a/package/lean/luci-app-ssr-plus/Makefile +++ b/package/lean/luci-app-ssr-plus/Makefile @@ -1,18 +1,14 @@ include $(TOPDIR)/rules.mk PKG_NAME:=luci-app-ssr-plus -PKG_VERSION:=171 -PKG_RELEASE:=6 +PKG_VERSION:=172 +PKG_RELEASE:=1 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME) include $(INCLUDE_DIR)/package.mk define Package/$(PKG_NAME)/config -config PACKAGE_$(PKG_NAME)_INCLUDE_Shadowsocks - bool "Include Shadowsocks New Version" - default y if x86||x86_64||arm||aarch64 - config PACKAGE_$(PKG_NAME)_INCLUDE_Simple_obfs bool "Include Shadowsocks Simple-obfs Plugin" default y if x86||x86_64||arm||aarch64 @@ -49,8 +45,7 @@ define Package/$(PKG_NAME) TITLE:=SS/SSR/V2Ray/Trojan LuCI interface PKGARCH:=all DEPENDS:=+shadowsocksr-libev-alt +ipset +ip-full +iptables-mod-tproxy +dnsmasq-full +coreutils +coreutils-base64 +pdnsd-alt +wget +lua +libuci-lua \ - +microsocks +ipt2socks +dns2socks +shadowsocks-libev-ss-local +shadowsocksr-libev-ssr-local \ - +PACKAGE_$(PKG_NAME)_INCLUDE_Shadowsocks:shadowsocks-libev-ss-redir \ + +microsocks +ipt2socks +dns2socks +shadowsocks-libev-ss-local +shadowsocksr-libev-ssr-local +shadowsocks-libev-ss-redir \ +PACKAGE_$(PKG_NAME)_INCLUDE_Simple_obfs:simple-obfs \ +PACKAGE_$(PKG_NAME)_INCLUDE_V2ray_plugin:v2ray-plugin \ +PACKAGE_$(PKG_NAME)_INCLUDE_V2ray:v2ray \ From 4733e0fccefef25fb487b1fba64d08fc364f7127 Mon Sep 17 00:00:00 2001 From: lean Date: Sun, 22 Mar 2020 17:09:10 +0800 Subject: [PATCH 07/11] luci-app-ssr-plus: add simple-obfs by default --- package/lean/luci-app-ssr-plus/Makefile | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/package/lean/luci-app-ssr-plus/Makefile b/package/lean/luci-app-ssr-plus/Makefile index 534b12362f..8a530cdc28 100644 --- a/package/lean/luci-app-ssr-plus/Makefile +++ b/package/lean/luci-app-ssr-plus/Makefile @@ -9,10 +9,6 @@ PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME) include $(INCLUDE_DIR)/package.mk define Package/$(PKG_NAME)/config -config PACKAGE_$(PKG_NAME)_INCLUDE_Simple_obfs - bool "Include Shadowsocks Simple-obfs Plugin" - default y if x86||x86_64||arm||aarch64 - config PACKAGE_$(PKG_NAME)_INCLUDE_V2ray_plugin bool "Include Shadowsocks V2ray Plugin" default y if x86||x86_64||arm||aarch64 @@ -45,11 +41,11 @@ define Package/$(PKG_NAME) TITLE:=SS/SSR/V2Ray/Trojan LuCI interface PKGARCH:=all DEPENDS:=+shadowsocksr-libev-alt +ipset +ip-full +iptables-mod-tproxy +dnsmasq-full +coreutils +coreutils-base64 +pdnsd-alt +wget +lua +libuci-lua \ - +microsocks +ipt2socks +dns2socks +shadowsocks-libev-ss-local +shadowsocksr-libev-ssr-local +shadowsocks-libev-ss-redir \ - +PACKAGE_$(PKG_NAME)_INCLUDE_Simple_obfs:simple-obfs \ + +microsocks +dns2socks +shadowsocks-libev-ss-local +shadowsocksr-libev-ssr-local +shadowsocks-libev-ss-redir +simple-obfs \ +PACKAGE_$(PKG_NAME)_INCLUDE_V2ray_plugin:v2ray-plugin \ +PACKAGE_$(PKG_NAME)_INCLUDE_V2ray:v2ray \ +PACKAGE_$(PKG_NAME)_INCLUDE_Trojan:trojan \ + +PACKAGE_$(PKG_NAME)_INCLUDE_Trojan:ipt2socks \ +PACKAGE_$(PKG_NAME)_INCLUDE_Redsocks2:redsocks2 \ +PACKAGE_$(PKG_NAME)_INCLUDE_Kcptun:kcptun-client \ +PACKAGE_$(PKG_NAME)_INCLUDE_ShadowsocksR_Server:shadowsocksr-libev-server From 15ec89986ee60af9fcde47e750d39606a0c87666 Mon Sep 17 00:00:00 2001 From: lean Date: Sun, 22 Mar 2020 17:24:12 +0800 Subject: [PATCH 08/11] iptables: bump to 1.8.4 --- package/network/utils/iptables/Makefile | 42 +- ...sions_format-security_fixes_in_libip.patch | 52 -- ...build_with_kernel_headers_before_4_2.patch | 48 -- ...x_userspace_kernel_headers_collision.patch | 41 -- .../010-add-set-dscpmark-support.patch | 459 ++++++++++++++++++ .../patches/101-remove-check-already.patch | 4 +- .../iptables/patches/103-optional-xml.patch | 2 +- .../patches/200-configurable_builtin.patch | 12 +- .../iptables/patches/600-shared-libext.patch | 28 +- .../700-disable-legacy-revisions.patch | 10 +- 10 files changed, 500 insertions(+), 198 deletions(-) delete mode 100644 package/network/utils/iptables/patches/001-extensions_format-security_fixes_in_libip.patch delete mode 100644 package/network/utils/iptables/patches/002-include_fix_build_with_kernel_headers_before_4_2.patch delete mode 100644 package/network/utils/iptables/patches/003-ebtables-vlan-fix_userspace_kernel_headers_collision.patch create mode 100644 package/network/utils/iptables/patches/010-add-set-dscpmark-support.patch diff --git a/package/network/utils/iptables/Makefile b/package/network/utils/iptables/Makefile index 6c42774ef4..616274ebdd 100644 --- a/package/network/utils/iptables/Makefile +++ b/package/network/utils/iptables/Makefile @@ -9,13 +9,12 @@ include $(TOPDIR)/rules.mk include $(INCLUDE_DIR)/kernel.mk PKG_NAME:=iptables -PKG_VERSION:=1.8.2 -PKG_RELEASE:=2 +PKG_VERSION:=1.8.4 +PKG_RELEASE:=1 -PKG_SOURCE_PROTO:=git -PKG_SOURCE_URL:=https://git.netfilter.org/iptables -PKG_SOURCE_VERSION:=bba6bc692b0e6137e13881a1f398c134822e9f83 -PKG_MIRROR_HASH:=23a61d2a23fc0d587029690ef2564625d78fba4b2d90117edaf5b9eaf55bb7f9 +PKG_SOURCE_URL:=https://netfilter.org/projects/iptables/files +PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2 +PKG_HASH:=993a3a5490a544c2cbf2ef15cf7e7ed21af1845baf228318d5c36ef8827e157c PKG_FIXUP:=autoreconf PKG_FLAGS:=nonshared @@ -37,7 +36,7 @@ define Package/iptables/Default SECTION:=net CATEGORY:=Network SUBMENU:=Firewall - URL:=http://netfilter.org/ + URL:=https://netfilter.org/ endef define Package/iptables/Module @@ -488,21 +487,12 @@ define Package/ip6tables-mod-nat/description iptables extensions for IPv6-NAT targets. endef -define Package/libiptc -$(call Package/iptables/Default) - SECTION:=libs - CATEGORY:=Libraries - DEPENDS:=+libip4tc +libip6tc +libxtables - ABI_VERSION:=$(PKG_VERSION) - TITLE:=IPv4/IPv6 firewall - shared libiptc library (nf compatibility stub) -endef - define Package/libip4tc $(call Package/iptables/Default) SECTION:=libs CATEGORY:=Libraries TITLE:=IPv4 firewall - shared libiptc library - ABI_VERSION:=$(PKG_VERSION) + ABI_VERSION:=2 DEPENDS:=+libxtables endef @@ -511,7 +501,7 @@ $(call Package/iptables/Default) SECTION:=libs CATEGORY:=Libraries TITLE:=IPv6 firewall - shared libiptc library - ABI_VERSION:=$(PKG_VERSION) + ABI_VERSION:=2 DEPENDS:=+libxtables endef @@ -520,7 +510,7 @@ define Package/libxtables SECTION:=libs CATEGORY:=Libraries TITLE:=IPv4/IPv6 firewall - shared xtables library - ABI_VERSION:=$(PKG_VERSION) + ABI_VERSION:=12 DEPENDS:= \ +IPTABLES_CONNLABEL:libnetfilter-conntrack \ +IPTABLES_NFTABLES:libnftnl @@ -531,7 +521,7 @@ define Package/libxtables-nft SECTION:=libs CATEGORY:=Libraries TITLE:=IPv4/IPv6 firewall - shared xtables nft library - ABI_VERSION:=$(PKG_VERSION) + ABI_VERSION:=12 DEPENDS:=libxtables endef @@ -630,26 +620,21 @@ define Package/ip6tables-nft/install $(CP) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables{,-restore}-translate $(1)/usr/sbin/ endef -define Package/libiptc/install - $(INSTALL_DIR) $(1)/usr/lib - $(CP) $(PKG_INSTALL_DIR)/usr/lib/libiptc.so* $(1)/usr/lib/ -endef - define Package/libip4tc/install $(INSTALL_DIR) $(1)/usr/lib - $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip4tc.so* $(1)/usr/lib/ + $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip4tc.so.* $(1)/usr/lib/ $(CP) $(PKG_BUILD_DIR)/extensions/libiptext4.so $(1)/usr/lib/ endef define Package/libip6tc/install $(INSTALL_DIR) $(1)/usr/lib - $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip6tc.so* $(1)/usr/lib/ + $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip6tc.so.* $(1)/usr/lib/ $(CP) $(PKG_BUILD_DIR)/extensions/libiptext6.so $(1)/usr/lib/ endef define Package/libxtables/install $(INSTALL_DIR) $(1)/usr/lib - $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so* $(1)/usr/lib/ + $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so.* $(1)/usr/lib/ $(CP) $(PKG_BUILD_DIR)/extensions/libiptext.so $(1)/usr/lib/ endef @@ -700,7 +685,6 @@ $(eval $(call BuildPackage,ip6tables)) $(eval $(call BuildPackage,ip6tables-nft)) $(eval $(call BuildPlugin,ip6tables-extra,$(IPT_IPV6_EXTRA-m))) $(eval $(call BuildPlugin,ip6tables-mod-nat,$(IPT_NAT6-m))) -$(eval $(call BuildPackage,libiptc)) $(eval $(call BuildPackage,libip4tc)) $(eval $(call BuildPackage,libip6tc)) $(eval $(call BuildPackage,libxtables)) diff --git a/package/network/utils/iptables/patches/001-extensions_format-security_fixes_in_libip.patch b/package/network/utils/iptables/patches/001-extensions_format-security_fixes_in_libip.patch deleted file mode 100644 index 9bd85ec139..0000000000 --- a/package/network/utils/iptables/patches/001-extensions_format-security_fixes_in_libip.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 907e429d7548157016cd51aba4adc5d0c7d9f816 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Adam=20Go=C5=82=C4=99biowski?= -Date: Wed, 14 Nov 2018 07:35:28 +0100 -Subject: extensions: format-security fixes in libip[6]t_icmp -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -commit 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add") -introduced support for gcc feature to check format string against passed -argument. This commit adds missing bits to extenstions's libipt_icmp.c -and libip6t_icmp6.c that were causing build to fail. - -Fixes: 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add") -Signed-off-by: Adam Gołębiowski -Signed-off-by: Pablo Neira Ayuso ---- - extensions/libip6t_icmp6.c | 4 ++-- - extensions/libipt_icmp.c | 2 +- - 2 files changed, 3 insertions(+), 3 deletions(-) - ---- a/extensions/libip6t_icmp6.c -+++ b/extensions/libip6t_icmp6.c -@@ -230,7 +230,7 @@ static unsigned int type_xlate_print(str - type_name = icmp6_type_xlate(icmptype); - - if (type_name) { -- xt_xlate_add(xl, type_name); -+ xt_xlate_add(xl, "%s", type_name); - } else { - for (i = 0; i < ARRAY_SIZE(icmpv6_codes); ++i) - if (icmpv6_codes[i].type == icmptype && -@@ -239,7 +239,7 @@ static unsigned int type_xlate_print(str - break; - - if (i != ARRAY_SIZE(icmpv6_codes)) -- xt_xlate_add(xl, icmpv6_codes[i].name); -+ xt_xlate_add(xl, "%s", icmpv6_codes[i].name); - else - return 0; - } ---- a/extensions/libipt_icmp.c -+++ b/extensions/libipt_icmp.c -@@ -236,7 +236,7 @@ static unsigned int type_xlate_print(str - if (icmp_codes[i].type == icmptype && - icmp_codes[i].code_min == code_min && - icmp_codes[i].code_max == code_max) { -- xt_xlate_add(xl, icmp_codes[i].name); -+ xt_xlate_add(xl, "%s", icmp_codes[i].name); - return 1; - } - } diff --git a/package/network/utils/iptables/patches/002-include_fix_build_with_kernel_headers_before_4_2.patch b/package/network/utils/iptables/patches/002-include_fix_build_with_kernel_headers_before_4_2.patch deleted file mode 100644 index 13737cf7cd..0000000000 --- a/package/network/utils/iptables/patches/002-include_fix_build_with_kernel_headers_before_4_2.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 8d9d7e4b9ef4c6e6abab2cf35c747d7ca36824bd Mon Sep 17 00:00:00 2001 -From: Baruch Siach -Date: Fri, 16 Nov 2018 09:30:33 +0200 -Subject: include: fix build with kernel headers before 4.2 -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Commit 672accf1530 (include: update kernel netfilter header files) -updated linux/netfilter.h and brought with it the update from kernel -commit a263653ed798 (netfilter: don't pull include/linux/netfilter.h -from netns headers). This triggers conflict of headers that is fixed in -kernel commit 279c6c7fa64f (api: fix compatibility of linux/in.h with -netinet/in.h) included in kernel version 4.2. For earlier kernel headers -we need a workaround that prevents the headers conflict. - -Fixes the following build failure: - -In file included from .../sysroot/usr/include/netinet/ip.h:25:0, - from ../include/libiptc/ipt_kernel_headers.h:8, - from ../include/libiptc/libiptc.h:6, - from libip4tc.c:29: -.../sysroot/usr/include/linux/in.h:26:3: error: redeclaration of enumerator ‘IPPROTO_IP’ - IPPROTO_IP = 0, /* Dummy protocol for TCP */ - ^ -.../sysroot/usr/include/netinet/in.h:33:5: note: previous definition of ‘IPPROTO_IP’ was here - IPPROTO_IP = 0, /* Dummy protocol for TCP. */ - ^~~~~~~~~~ - -Signed-off-by: Baruch Siach -Signed-off-by: Florian Westphal ---- - include/linux/netfilter.h | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/include/linux/netfilter.h -+++ b/include/linux/netfilter.h -@@ -3,8 +3,10 @@ - - #include - -+#ifndef _NETINET_IN_H - #include - #include -+#endif - #include - - /* Responses from hook functions. */ diff --git a/package/network/utils/iptables/patches/003-ebtables-vlan-fix_userspace_kernel_headers_collision.patch b/package/network/utils/iptables/patches/003-ebtables-vlan-fix_userspace_kernel_headers_collision.patch deleted file mode 100644 index 53e1113003..0000000000 --- a/package/network/utils/iptables/patches/003-ebtables-vlan-fix_userspace_kernel_headers_collision.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 51d374ba41ae4f1bb851228c06b030b83dd2092f Mon Sep 17 00:00:00 2001 -From: Baruch Siach -Date: Tue, 13 Nov 2018 19:22:08 +0200 -Subject: ebtables: vlan: fix userspace/kernel headers collision -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Build with musl libc fails because of conflicting struct ethhdr -definitions: - -In file included from .../sysroot/usr/include/net/ethernet.h:10:0, - from ../iptables/nft-bridge.h:8, - from libebt_vlan.c:18: -.../sysroot/usr/include/netinet/if_ether.h:107:8: error: redefinition of ‘struct ethhdr’ - struct ethhdr { - ^~~~~~ -In file included from libebt_vlan.c:16:0: -.../sysroot/usr/include/linux/if_ether.h:160:8: note: originally defined here - struct ethhdr { - ^~~~~~ - -Include the userspace header first for the definition suppression logic -to do the right thing. - -Signed-off-by: Baruch Siach -Signed-off-by: Pablo Neira Ayuso ---- - extensions/libebt_vlan.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/extensions/libebt_vlan.c -+++ b/extensions/libebt_vlan.c -@@ -12,6 +12,7 @@ - #include - #include - #include -+#include - #include - #include - #include "iptables/nft.h" diff --git a/package/network/utils/iptables/patches/010-add-set-dscpmark-support.patch b/package/network/utils/iptables/patches/010-add-set-dscpmark-support.patch new file mode 100644 index 0000000000..fb6978e6f7 --- /dev/null +++ b/package/network/utils/iptables/patches/010-add-set-dscpmark-support.patch @@ -0,0 +1,459 @@ +From 74267bacce0c43e5038b0377cb7c08f1ad9d50a3 Mon Sep 17 00:00:00 2001 +From: Kevin Darbyshire-Bryant +Date: Sat, 23 Mar 2019 10:21:03 +0000 +Subject: [PATCH] iptables: connmark - add set-dscpmark option for openwrt + +Naive user space front end to xt_connmark 'setdscp' option. + +iptables -A QOS_MARK_eth0 -t mangle -j CONNMARK --set-dscpmark 0xfc000000/0x01000000 + +This version has a hack to support a backport to 4.14 + +Signed-off-by: Kevin Darbyshire-Bryant +--- + extensions/libxt_CONNMARK.c | 315 +++++++++++++++++++++++++- + include/linux/netfilter/xt_connmark.h | 10 + + 2 files changed, 324 insertions(+), 1 deletion(-) + +diff --git a/extensions/libxt_CONNMARK.c b/extensions/libxt_CONNMARK.c +index 21e10913..c777b110 100644 +--- a/extensions/libxt_CONNMARK.c ++++ b/extensions/libxt_CONNMARK.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -49,6 +50,7 @@ enum { + O_CTMASK, + O_NFMASK, + O_MASK, ++ O_DSCP_MARK, + F_SET_MARK = 1 << O_SET_MARK, + F_SAVE_MARK = 1 << O_SAVE_MARK, + F_RESTORE_MARK = 1 << O_RESTORE_MARK, +@@ -61,8 +63,10 @@ enum { + F_CTMASK = 1 << O_CTMASK, + F_NFMASK = 1 << O_NFMASK, + F_MASK = 1 << O_MASK, ++ F_DSCP_MARK = 1 << O_DSCP_MARK, + F_OP_ANY = F_SET_MARK | F_SAVE_MARK | F_RESTORE_MARK | +- F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK, ++ F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK | ++ F_DSCP_MARK, + }; + + static const char *const xt_connmark_shift_ops[] = { +@@ -114,6 +118,8 @@ static const struct xt_option_entry connmark_tg_opts[] = { + .excl = F_MASK, .flags = XTOPT_PUT, XTOPT_POINTER(s, nfmask)}, + {.name = "mask", .id = O_MASK, .type = XTTYPE_UINT32, + .excl = F_CTMASK | F_NFMASK}, ++ {.name = "set-dscpmark", .id = O_DSCP_MARK, .type = XTTYPE_MARKMASK32, ++ .excl = F_OP_ANY}, + XTOPT_TABLEEND, + }; + #undef s +@@ -148,6 +154,38 @@ static const struct xt_option_entry connmark_tg_opts_v2[] = { + }; + #undef s + ++#define s struct xt_connmark_tginfo3 ++static const struct xt_option_entry connmark_tg_opts_v3[] = { ++ {.name = "set-xmark", .id = O_SET_XMARK, .type = XTTYPE_MARKMASK32, ++ .excl = F_OP_ANY}, ++ {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32, ++ .excl = F_OP_ANY}, ++ {.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32, ++ .excl = F_OP_ANY}, ++ {.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32, ++ .excl = F_OP_ANY}, ++ {.name = "xor-mark", .id = O_XOR_MARK, .type = XTTYPE_UINT32, ++ .excl = F_OP_ANY}, ++ {.name = "save-mark", .id = O_SAVE_MARK, .type = XTTYPE_NONE, ++ .excl = F_OP_ANY}, ++ {.name = "restore-mark", .id = O_RESTORE_MARK, .type = XTTYPE_NONE, ++ .excl = F_OP_ANY}, ++ {.name = "left-shift-mark", .id = O_LEFT_SHIFT_MARK, .type = XTTYPE_UINT8, ++ .min = 0, .max = 32}, ++ {.name = "right-shift-mark", .id = O_RIGHT_SHIFT_MARK, .type = XTTYPE_UINT8, ++ .min = 0, .max = 32}, ++ {.name = "ctmask", .id = O_CTMASK, .type = XTTYPE_UINT32, ++ .excl = F_MASK, .flags = XTOPT_PUT, XTOPT_POINTER(s, ctmask)}, ++ {.name = "nfmask", .id = O_NFMASK, .type = XTTYPE_UINT32, ++ .excl = F_MASK, .flags = XTOPT_PUT, XTOPT_POINTER(s, nfmask)}, ++ {.name = "mask", .id = O_MASK, .type = XTTYPE_UINT32, ++ .excl = F_CTMASK | F_NFMASK}, ++ {.name = "set-dscpmark", .id = O_DSCP_MARK, .type = XTTYPE_MARKMASK32, ++ .excl = F_OP_ANY}, ++ XTOPT_TABLEEND, ++}; ++#undef s ++ + static void connmark_tg_help(void) + { + printf( +@@ -175,6 +213,15 @@ static void connmark_tg_help_v2(void) + ); + } + ++static void connmark_tg_help_v3(void) ++{ ++ connmark_tg_help_v2(); ++ printf( ++" --set-dscpmark value/mask Save DSCP to conntrack mark value\n" ++); ++} ++ ++ + static void connmark_tg_init(struct xt_entry_target *target) + { + struct xt_connmark_tginfo1 *info = (void *)target->data; +@@ -199,6 +246,16 @@ static void connmark_tg_init_v2(struct xt_entry_target *target) + info->shift_bits = 0; + } + ++static void connmark_tg_init_v3(struct xt_entry_target *target) ++{ ++ struct xt_connmark_tginfo3 *info; ++ ++ connmark_tg_init_v2(target); ++ info = (void *)target->data; ++ ++ info->func = 0; ++} ++ + static void CONNMARK_parse(struct xt_option_call *cb) + { + struct xt_connmark_target_info *markinfo = cb->data; +@@ -253,6 +310,23 @@ static void connmark_tg_parse(struct xt_option_call *cb) + info->ctmark = cb->val.u32; + info->ctmask = 0; + break; ++ case O_DSCP_MARK: ++/* we sneaky sneaky this. nfmask isn't used by the set mark functionality ++ * and by default is set to uint32max. We can use the top bit as a flag ++ * that we're in DSCP_MARK submode of SET_MARK, if set then it's normal ++ * if unset then we're in DSCP_MARK ++ */ ++ info->mode = XT_CONNMARK_SET; ++ info->ctmark = cb->val.mark; ++ info->ctmask = cb->val.mask; ++ info->nfmask = info->ctmark ? ffs(info->ctmark) - 1 : 0; ++ /* need 6 contiguous bits */ ++ if ((~0 & (info->ctmark >> info->nfmask)) != 0x3f) ++ xtables_error(PARAMETER_PROBLEM, ++ "CONNMARK set-dscpmark: need 6 contiguous dscpmask bits"); ++ if (info->ctmark & info->ctmask) ++ xtables_error(PARAMETER_PROBLEM, ++ "CONNMARK set-dscpmark: dscpmask/statemask bits overlap"); + case O_SAVE_MARK: + info->mode = XT_CONNMARK_SAVE; + break; +@@ -320,6 +394,78 @@ static void connmark_tg_parse_v2(struct xt_option_call *cb) + } + } + ++static void connmark_tg_parse_v3(struct xt_option_call *cb) ++{ ++ struct xt_connmark_tginfo3 *info = cb->data; ++ ++ xtables_option_parse(cb); ++ switch (cb->entry->id) { ++ case O_SET_XMARK: ++ info->mode = XT_CONNMARK_SET; ++ info->func = XT_CONNMARK_VALUE; ++ info->ctmark = cb->val.mark; ++ info->ctmask = cb->val.mask; ++ break; ++ case O_SET_MARK: ++ info->mode = XT_CONNMARK_SET; ++ info->func = XT_CONNMARK_VALUE; ++ info->ctmark = cb->val.mark; ++ info->ctmask = cb->val.mark | cb->val.mask; ++ break; ++ case O_AND_MARK: ++ info->mode = XT_CONNMARK_SET; ++ info->func = XT_CONNMARK_VALUE; ++ info->ctmark = 0; ++ info->ctmask = ~cb->val.u32; ++ break; ++ case O_OR_MARK: ++ info->mode = XT_CONNMARK_SET; ++ info->func = XT_CONNMARK_VALUE; ++ info->ctmark = cb->val.u32; ++ info->ctmask = cb->val.u32; ++ break; ++ case O_XOR_MARK: ++ info->mode = XT_CONNMARK_SET; ++ info->func = XT_CONNMARK_VALUE; ++ info->ctmark = cb->val.u32; ++ info->ctmask = 0; ++ break; ++ case O_DSCP_MARK: ++ info->mode = XT_CONNMARK_SET; ++ info->func = XT_CONNMARK_DSCP; ++ info->ctmark = cb->val.mark; ++ info->ctmask = cb->val.mask; ++ info->shift_bits = info->ctmark ? ffs(info->ctmark) - 1 : 0; ++ /* need 6 contiguous bits */ ++ if ((~0 & (info->ctmark >> info->shift_bits)) != 0x3f) ++ xtables_error(PARAMETER_PROBLEM, ++ "CONNMARK set-dscpmark: need 6 contiguous dscpmask bits"); ++ if (info->ctmark & info->ctmask) ++ xtables_error(PARAMETER_PROBLEM, ++ "CONNMARK set-dscpmark: dscpmask/statemask bits overlap"); ++ break; ++ case O_SAVE_MARK: ++ info->mode = XT_CONNMARK_SAVE; ++ break; ++ case O_RESTORE_MARK: ++ info->mode = XT_CONNMARK_RESTORE; ++ break; ++ case O_MASK: ++ info->nfmask = info->ctmask = cb->val.u32; ++ break; ++ case O_LEFT_SHIFT_MARK: ++ info->shift_dir = D_SHIFT_LEFT; ++ info->shift_bits = cb->val.u8; ++ break; ++ case O_RIGHT_SHIFT_MARK: ++ info->shift_dir = D_SHIFT_RIGHT; ++ info->shift_bits = cb->val.u8; ++ break; ++ default: ++ break; ++ } ++} ++ + static void connmark_tg_check(struct xt_fcheck_call *cb) + { + if (!(cb->xflags & F_OP_ANY)) +@@ -463,6 +609,65 @@ connmark_tg_print_v2(const void *ip, const struct xt_entry_target *target, + } + } + ++static void ++connmark_tg_print_v3(const void *ip, const struct xt_entry_target *target, ++ int numeric) ++{ ++ const struct xt_connmark_tginfo3 *info = (const void *)target->data; ++ const char *shift_op = xt_connmark_shift_ops[info->shift_dir]; ++ ++ switch (info->mode) { ++ case XT_CONNMARK_SET: ++ if (info->func & XT_CONNMARK_DSCP) { ++ printf(" CONNMARK DSCP 0x%x/0x%x", ++ info->ctmark, info->ctmask); ++ } ++ if (info->func & XT_CONNMARK_VALUE) { ++ if (info->ctmark == 0) ++ printf(" CONNMARK and 0x%x", ++ (unsigned int)(uint32_t)~info->ctmask); ++ else if (info->ctmark == info->ctmask) ++ printf(" CONNMARK or 0x%x", info->ctmark); ++ else if (info->ctmask == 0) ++ printf(" CONNMARK xor 0x%x", info->ctmark); ++ else if (info->ctmask == 0xFFFFFFFFU) ++ printf(" CONNMARK set 0x%x", info->ctmark); ++ else ++ printf(" CONNMARK xset 0x%x/0x%x", ++ info->ctmark, info->ctmask); ++ } ++ break; ++ case XT_CONNMARK_SAVE: ++ if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX) ++ printf(" CONNMARK save"); ++ else if (info->nfmask == info->ctmask) ++ printf(" CONNMARK save mask 0x%x", info->nfmask); ++ else ++ printf(" CONNMARK save nfmask 0x%x ctmask ~0x%x", ++ info->nfmask, info->ctmask); ++ break; ++ case XT_CONNMARK_RESTORE: ++ if (info->ctmask == UINT32_MAX && info->nfmask == UINT32_MAX) ++ printf(" CONNMARK restore"); ++ else if (info->ctmask == info->nfmask) ++ printf(" CONNMARK restore mask 0x%x", info->ctmask); ++ else ++ printf(" CONNMARK restore ctmask 0x%x nfmask ~0x%x", ++ info->ctmask, info->nfmask); ++ break; ++ ++ default: ++ printf(" ERROR: UNKNOWN CONNMARK MODE"); ++ break; ++ } ++ ++ if (info->mode <= XT_CONNMARK_RESTORE && ++ !(info->mode == XT_CONNMARK_SET && info->func == XT_CONNMARK_DSCP) && ++ info->shift_bits != 0) { ++ printf(" %s %u", shift_op, info->shift_bits); ++ } ++} ++ + static void CONNMARK_save(const void *ip, const struct xt_entry_target *target) + { + const struct xt_connmark_target_info *markinfo = +@@ -548,6 +753,38 @@ connmark_tg_save_v2(const void *ip, const struct xt_entry_target *target) + } + } + ++static void ++connmark_tg_save_v3(const void *ip, const struct xt_entry_target *target) ++{ ++ const struct xt_connmark_tginfo3 *info = (const void *)target->data; ++ const char *shift_op = xt_connmark_shift_ops[info->shift_dir]; ++ ++ switch (info->mode) { ++ case XT_CONNMARK_SET: ++ if (info->func & XT_CONNMARK_VALUE) ++ printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask); ++ if (info->func & XT_CONNMARK_DSCP) ++ printf(" --set-dscpmark 0x%x/0x%x", info->ctmark, info->ctmask); ++ break; ++ case XT_CONNMARK_SAVE: ++ printf(" --save-mark --nfmask 0x%x --ctmask 0x%x", ++ info->nfmask, info->ctmask); ++ break; ++ case XT_CONNMARK_RESTORE: ++ printf(" --restore-mark --nfmask 0x%x --ctmask 0x%x", ++ info->nfmask, info->ctmask); ++ break; ++ default: ++ printf(" ERROR: UNKNOWN CONNMARK MODE"); ++ break; ++ } ++ if (info->mode <= XT_CONNMARK_RESTORE && ++ !(info->mode == XT_CONNMARK_SET && info->func == XT_CONNMARK_DSCP) && ++ info->shift_bits != 0) { ++ printf(" --%s %u", shift_op, info->shift_bits); ++ } ++} ++ + static int connmark_tg_xlate(struct xt_xlate *xl, + const struct xt_xlate_tg_params *params) + { +@@ -639,6 +876,66 @@ static int connmark_tg_xlate_v2(struct xt_xlate *xl, + + return 1; + } ++ ++static int connmark_tg_xlate_v3(struct xt_xlate *xl, ++ const struct xt_xlate_tg_params *params) ++{ ++ const struct xt_connmark_tginfo3 *info = ++ (const void *)params->target->data; ++ const char *shift_op = xt_connmark_shift_ops[info->shift_dir]; ++ ++ switch (info->mode) { ++ case XT_CONNMARK_SET: ++ xt_xlate_add(xl, "ct mark set "); ++ if (info->func & XT_CONNMARK_VALUE) { ++ if (info->ctmask == 0xFFFFFFFFU) ++ xt_xlate_add(xl, "0x%x ", info->ctmark); ++ else if (info->ctmark == 0) ++ xt_xlate_add(xl, "ct mark and 0x%x", ~info->ctmask); ++ else if (info->ctmark == info->ctmask) ++ xt_xlate_add(xl, "ct mark or 0x%x", ++ info->ctmark); ++ else if (info->ctmask == 0) ++ xt_xlate_add(xl, "ct mark xor 0x%x", ++ info->ctmark); ++ else ++ xt_xlate_add(xl, "ct mark xor 0x%x and 0x%x", ++ info->ctmark, ~info->ctmask); ++ } ++ if (info->func & XT_CONNMARK_DSCP) { ++/* FIXME the nftables syntax would go here if only we knew what it was */ ++ xt_xlate_add(xl, "ct mark set typeof(ct mark) ip dscp " ++ "<< %u or 0x%x", info->shift_bits, ++ info->ctmask); ++ } ++ break; ++ case XT_CONNMARK_SAVE: ++ xt_xlate_add(xl, "ct mark set mark"); ++ if (!(info->nfmask == UINT32_MAX && ++ info->ctmask == UINT32_MAX)) { ++ if (info->nfmask == info->ctmask) ++ xt_xlate_add(xl, " and 0x%x", info->nfmask); ++ } ++ break; ++ case XT_CONNMARK_RESTORE: ++ xt_xlate_add(xl, "meta mark set ct mark"); ++ if (!(info->nfmask == UINT32_MAX && ++ info->ctmask == UINT32_MAX)) { ++ if (info->nfmask == info->ctmask) ++ xt_xlate_add(xl, " and 0x%x", info->nfmask); ++ } ++ break; ++ } ++ ++ if (info->mode <= XT_CONNMARK_RESTORE && ++ !(info->mode == XT_CONNMARK_SET && info->func == XT_CONNMARK_DSCP) && ++ info->shift_bits != 0) { ++ xt_xlate_add(xl, " %s %u", shift_op, info->shift_bits); ++ } ++ ++ return 1; ++} ++ + static struct xtables_target connmark_tg_reg[] = { + { + .family = NFPROTO_UNSPEC, +@@ -687,6 +984,22 @@ static struct xtables_target connmark_tg_reg[] = { + .x6_options = connmark_tg_opts_v2, + .xlate = connmark_tg_xlate_v2, + }, ++ { ++ .version = XTABLES_VERSION, ++ .name = "CONNMARK", ++ .revision = 3, ++ .family = NFPROTO_UNSPEC, ++ .size = XT_ALIGN(sizeof(struct xt_connmark_tginfo3)), ++ .userspacesize = XT_ALIGN(sizeof(struct xt_connmark_tginfo3)), ++ .help = connmark_tg_help_v3, ++ .init = connmark_tg_init_v3, ++ .print = connmark_tg_print_v3, ++ .save = connmark_tg_save_v3, ++ .x6_parse = connmark_tg_parse_v3, ++ .x6_fcheck = connmark_tg_check, ++ .x6_options = connmark_tg_opts_v3, ++ .xlate = connmark_tg_xlate_v3, ++ }, + }; + + void _init(void) +diff --git a/include/linux/netfilter/xt_connmark.h b/include/linux/netfilter/xt_connmark.h +index bbf2acc9..1d8e721c 100644 +--- a/include/linux/netfilter/xt_connmark.h ++++ b/include/linux/netfilter/xt_connmark.h +@@ -18,6 +18,11 @@ enum { + XT_CONNMARK_RESTORE + }; + ++enum { ++ XT_CONNMARK_VALUE = (1 << 0), ++ XT_CONNMARK_DSCP = (1 << 1) ++}; ++ + struct xt_connmark_tginfo1 { + __u32 ctmark, ctmask, nfmask; + __u8 mode; +@@ -28,6 +33,11 @@ struct xt_connmark_tginfo2 { + __u8 shift_dir, shift_bits, mode; + }; + ++struct xt_connmark_tginfo3 { ++ __u32 ctmark, ctmask, nfmask; ++ __u8 shift_dir, shift_bits, mode, func; ++}; ++ + struct xt_connmark_mtinfo1 { + __u32 mark, mask; + __u8 invert; +-- +2.21.0 (Apple Git-122.2) + diff --git a/package/network/utils/iptables/patches/101-remove-check-already.patch b/package/network/utils/iptables/patches/101-remove-check-already.patch index f8d1bf44b6..98e825f016 100644 --- a/package/network/utils/iptables/patches/101-remove-check-already.patch +++ b/package/network/utils/iptables/patches/101-remove-check-already.patch @@ -1,6 +1,6 @@ --- a/libxtables/xtables.c +++ b/libxtables/xtables.c -@@ -887,12 +887,6 @@ static void xtables_check_options(const +@@ -903,12 +903,6 @@ static void xtables_check_options(const void xtables_register_match(struct xtables_match *me) { @@ -13,7 +13,7 @@ if (me->version == NULL) { fprintf(stderr, "%s: match %s<%u> is missing a version\n", xt_params->program_name, me->name, me->revision); -@@ -1080,12 +1074,6 @@ void xtables_register_matches(struct xta +@@ -1096,12 +1090,6 @@ void xtables_register_matches(struct xta void xtables_register_target(struct xtables_target *me) { diff --git a/package/network/utils/iptables/patches/103-optional-xml.patch b/package/network/utils/iptables/patches/103-optional-xml.patch index 2396037fdd..342808a395 100644 --- a/package/network/utils/iptables/patches/103-optional-xml.patch +++ b/package/network/utils/iptables/patches/103-optional-xml.patch @@ -1,6 +1,6 @@ --- a/iptables/xtables-legacy-multi.c +++ b/iptables/xtables-legacy-multi.c -@@ -31,8 +31,10 @@ static const struct subcommand multi_sub +@@ -32,8 +32,10 @@ static const struct subcommand multi_sub #endif diff --git a/package/network/utils/iptables/patches/200-configurable_builtin.patch b/package/network/utils/iptables/patches/200-configurable_builtin.patch index 9c53c2bfed..5788a829b0 100644 --- a/package/network/utils/iptables/patches/200-configurable_builtin.patch +++ b/package/network/utils/iptables/patches/200-configurable_builtin.patch @@ -34,10 +34,10 @@ +pfa_objs := $(patsubst %,libarpt_%.o,${pfa_build_static}) +pf4_objs := $(patsubst %,libipt_%.o,${pf4_build_static}) +pf6_objs := $(patsubst %,libip6t_%.o,${pf6_build_static}) - pfx_solibs := $(patsubst %,libxt_%.so,${pfx_build_mod} ${pfx_symlinks}) + pfx_solibs := $(patsubst %,libxt_%.so,${pfx_build_mod}) pfb_solibs := $(patsubst %,libebt_%.so,${pfb_build_mod}) pfa_solibs := $(patsubst %,libarpt_%.so,${pfa_build_mod}) -@@ -67,13 +87,13 @@ pf6_solibs := $(patsubst %,libip6t_%. +@@ -68,14 +88,14 @@ pfx_symlink_files := $(patsubst %,libxt_ # targets := libext.a libext4.a libext6.a libext_ebt.a libext_arpt.a matches.man targets.man targets_install := @@ -46,19 +46,21 @@ -@ENABLE_STATIC_TRUE@ libext_arpt_objs := ${pfa_objs} -@ENABLE_STATIC_TRUE@ libext4_objs := ${pf4_objs} -@ENABLE_STATIC_TRUE@ libext6_objs := ${pf6_objs} --@ENABLE_STATIC_FALSE@ targets += ${pfx_solibs} ${pfb_solibs} ${pf4_solibs} ${pf6_solibs} ${pfa_solibs} +-@ENABLE_STATIC_FALSE@ targets += ${pfx_solibs} ${pfb_solibs} ${pf4_solibs} ${pf6_solibs} ${pfa_solibs} ${pfx_symlink_files} -@ENABLE_STATIC_FALSE@ targets_install += ${pfx_solibs} ${pfb_solibs} ${pf4_solibs} ${pf6_solibs} ${pfa_solibs} +-@ENABLE_STATIC_FALSE@ symlinks_install := ${pfx_symlink_files} +libext_objs := ${pfx_objs} +libext_ebt_objs := ${pfb_objs} +libext_arpt_objs := ${pfa_objs} +libext4_objs := ${pf4_objs} +libext6_objs := ${pf6_objs} -+targets += ${pfx_solibs} ${pfb_solibs} ${pf4_solibs} ${pf6_solibs} ${pfa_solibs} ++targets += ${pfx_solibs} ${pfb_solibs} ${pf4_solibs} ${pf6_solibs} ${pfa_solibs} ${pfx_symlink_files} +targets_install := $(strip ${pfx_solibs} ${pfb_solibs} ${pf4_solibs} ${pf6_solibs} ${pfa_solibs}) ++symlinks_install := ${pfx_symlink_files} .SECONDARY: -@@ -141,11 +161,11 @@ libext4.a: initext4.o ${libext4_objs} +@@ -148,11 +168,11 @@ libext4.a: initext4.o ${libext4_objs} libext6.a: initext6.o ${libext6_objs} ${AM_VERBOSE_AR} ${AR} crs $@ $^; diff --git a/package/network/utils/iptables/patches/600-shared-libext.patch b/package/network/utils/iptables/patches/600-shared-libext.patch index e88c288be6..7b798b7fda 100644 --- a/package/network/utils/iptables/patches/600-shared-libext.patch +++ b/package/network/utils/iptables/patches/600-shared-libext.patch @@ -1,6 +1,6 @@ --- a/extensions/GNUmakefile.in +++ b/extensions/GNUmakefile.in -@@ -85,7 +85,7 @@ pf6_solibs := $(patsubst %,libip6t_%. +@@ -86,7 +86,7 @@ pfx_symlink_files := $(patsubst %,libxt_ # # Building blocks # @@ -9,7 +9,7 @@ targets_install := libext_objs := ${pfx_objs} libext_ebt_objs := ${pfb_objs} -@@ -112,7 +112,7 @@ clean: +@@ -119,7 +119,7 @@ clean: distclean: clean init%.o: init%.c @@ -18,7 +18,7 @@ -include .*.d -@@ -144,22 +144,22 @@ xt_connlabel_LIBADD = @libnetfilter_conn +@@ -151,22 +151,22 @@ xt_connlabel_LIBADD = @libnetfilter_conn # handling code in the Makefiles. # lib%.o: ${srcdir}/lib%.c @@ -54,7 +54,7 @@ initextb_func := $(addprefix ebt_,${pfb_build_static}) --- a/iptables/Makefile.am +++ b/iptables/Makefile.am -@@ -8,7 +8,8 @@ BUILT_SOURCES = +@@ -7,19 +7,22 @@ BUILT_SOURCES = xtables_legacy_multi_SOURCES = xtables-legacy-multi.c iptables-xml.c xtables_legacy_multi_CFLAGS = ${AM_CFLAGS} @@ -64,26 +64,24 @@ if ENABLE_STATIC xtables_legacy_multi_CFLAGS += -DALL_INCLUSIVE endif -@@ -16,13 +17,15 @@ if ENABLE_IPV4 - xtables_legacy_multi_SOURCES += iptables-save.c iptables-restore.c \ - iptables-standalone.c iptables.c + if ENABLE_IPV4 + xtables_legacy_multi_SOURCES += iptables-standalone.c iptables.c xtables_legacy_multi_CFLAGS += -DENABLE_IPV4 -xtables_legacy_multi_LDADD += ../libiptc/libip4tc.la ../extensions/libext4.a +xtables_legacy_multi_LDADD += ../libiptc/libip4tc.la +xtables_legacy_multi_LDFLAGS += -liptext4 endif if ENABLE_IPV6 - xtables_legacy_multi_SOURCES += ip6tables-save.c ip6tables-restore.c \ - ip6tables-standalone.c ip6tables.c + xtables_legacy_multi_SOURCES += ip6tables-standalone.c ip6tables.c xtables_legacy_multi_CFLAGS += -DENABLE_IPV6 -xtables_legacy_multi_LDADD += ../libiptc/libip6tc.la ../extensions/libext6.a +xtables_legacy_multi_LDADD += ../libiptc/libip6tc.la +xtables_legacy_multi_LDFLAGS += -liptext6 endif - xtables_legacy_multi_SOURCES += xshared.c + xtables_legacy_multi_SOURCES += xshared.c iptables-restore.c iptables-save.c xtables_legacy_multi_LDADD += ../libxtables/libxtables.la -lm -@@ -32,7 +35,8 @@ if ENABLE_NFTABLES - BUILT_SOURCES += xtables-config-parser.h +@@ -28,7 +31,8 @@ xtables_legacy_multi_LDADD += ../libxt + if ENABLE_NFTABLES xtables_nft_multi_SOURCES = xtables-nft-multi.c iptables-xml.c xtables_nft_multi_CFLAGS = ${AM_CFLAGS} -xtables_nft_multi_LDADD = ../extensions/libext.a ../extensions/libext_ebt.a @@ -92,13 +90,13 @@ if ENABLE_STATIC xtables_nft_multi_CFLAGS += -DALL_INCLUSIVE endif -@@ -47,7 +51,8 @@ xtables_nft_multi_SOURCES += xtables-sav +@@ -42,7 +46,8 @@ xtables_nft_multi_SOURCES += xtables-sav xtables-eb-standalone.c xtables-eb.c \ xtables-eb-translate.c \ xtables-translate.c -xtables_nft_multi_LDADD += ${libmnl_LIBS} ${libnftnl_LIBS} ${libnetfilter_conntrack_LIBS} ../extensions/libext4.a ../extensions/libext6.a ../extensions/libext_ebt.a ../extensions/libext_arpt.a +xtables_nft_multi_LDADD += ${libmnl_LIBS} ${libnftnl_LIBS} ${libnetfilter_conntrack_LIBS} +xtables_nft_multi_LDFLAGS += -liptext4 -liptext6 -liptext_arpt - # yacc and lex generate dirty code - xtables_nft_multi-xtables-config-parser.o xtables_nft_multi-xtables-config-syntax.o: AM_CFLAGS += -Wno-missing-prototypes -Wno-missing-declarations -Wno-implicit-function-declaration -Wno-nested-externs -Wno-undef -Wno-redundant-decls xtables_nft_multi_SOURCES += xshared.c + xtables_nft_multi_LDADD += ../libxtables/libxtables.la -lm + endif diff --git a/package/network/utils/iptables/patches/700-disable-legacy-revisions.patch b/package/network/utils/iptables/patches/700-disable-legacy-revisions.patch index 328f3af18d..86715fc8e7 100644 --- a/package/network/utils/iptables/patches/700-disable-legacy-revisions.patch +++ b/package/network/utils/iptables/patches/700-disable-legacy-revisions.patch @@ -1,6 +1,6 @@ --- a/extensions/libxt_conntrack.c +++ b/extensions/libxt_conntrack.c -@@ -1389,6 +1389,7 @@ static int conntrack3_mt6_xlate(struct x +@@ -1387,6 +1387,7 @@ static int conntrack3_mt6_xlate(struct x } static struct xtables_match conntrack_mt_reg[] = { @@ -8,7 +8,7 @@ { .version = XTABLES_VERSION, .name = "conntrack", -@@ -1464,6 +1465,7 @@ static struct xtables_match conntrack_mt +@@ -1462,6 +1463,7 @@ static struct xtables_match conntrack_mt .alias = conntrack_print_name_alias, .x6_options = conntrack2_mt_opts, }, @@ -16,7 +16,7 @@ { .version = XTABLES_VERSION, .name = "conntrack", -@@ -1496,6 +1498,7 @@ static struct xtables_match conntrack_mt +@@ -1494,6 +1496,7 @@ static struct xtables_match conntrack_mt .x6_options = conntrack3_mt_opts, .xlate = conntrack3_mt6_xlate, }, @@ -24,7 +24,7 @@ { .family = NFPROTO_UNSPEC, .name = "state", -@@ -1526,6 +1529,8 @@ static struct xtables_match conntrack_mt +@@ -1524,6 +1527,8 @@ static struct xtables_match conntrack_mt .x6_parse = state_ct23_parse, .x6_options = state_opts, }, @@ -33,7 +33,7 @@ { .family = NFPROTO_UNSPEC, .name = "state", -@@ -1555,6 +1560,7 @@ static struct xtables_match conntrack_mt +@@ -1553,6 +1558,7 @@ static struct xtables_match conntrack_mt .x6_parse = state_parse, .x6_options = state_opts, }, From a6c59c9fb3442aae2b9af8f6b39b47bd4f490986 Mon Sep 17 00:00:00 2001 From: lean Date: Sun, 22 Mar 2020 17:38:19 +0800 Subject: [PATCH 09/11] procd: actually wire-up netns support --- package/system/procd/Makefile | 11 ++++--- package/system/procd/files/hotplug.json | 4 +++ package/system/procd/files/procd.sh | 41 +++++++++++++++++++++++-- 3 files changed, 48 insertions(+), 8 deletions(-) diff --git a/package/system/procd/Makefile b/package/system/procd/Makefile index 5ff0e726ca..7516089352 100644 --- a/package/system/procd/Makefile +++ b/package/system/procd/Makefile @@ -12,9 +12,9 @@ PKG_RELEASE:=1 PKG_SOURCE_PROTO:=git PKG_SOURCE_URL=$(PROJECT_GIT)/project/procd.git -PKG_SOURCE_DATE:=2019-05-30 -PKG_SOURCE_VERSION:=ade00ca585a49c8478bf60eb24ce385676be37a4 -PKG_MIRROR_HASH:=1417727ae6fcda01017e1bec3ec66e3e78116f9343cfe0256e40af54c52f2acc +PKG_SOURCE_DATE:=2020-03-13 +PKG_SOURCE_VERSION:=77a6782d6e4eba2c49e642672de134aff443ef72 +PKG_MIRROR_HASH:=bb7e98a6b6f997a4fa2fb924be248febe5a7633601df2e97e7a7513c57b63870 CMAKE_INSTALL:=1 PKG_LICENSE:=GPL-2.0 @@ -22,6 +22,7 @@ PKG_LICENSE_FILES:= PKG_MAINTAINER:=John Crispin +PKG_ASLR_PIE_REGULAR:=1 PKG_CONFIG_DEPENDS:= \ CONFIG_TARGET_INIT_PATH CONFIG_KERNEL_SECCOMP \ CONFIG_PROCD_SHOW_BOOT CONFIG_PROCD_ZRAM_TMPFS \ @@ -43,7 +44,7 @@ TARGET_LDFLAGS += -flto define Package/procd SECTION:=base CATEGORY:=Base system - DEPENDS:=+ubusd +ubus +libjson-script +ubox +USE_GLIBC:librt +libubox +libubus + DEPENDS:=+ubusd +ubus +libjson-script +ubox +USE_GLIBC:librt +libubox +libubus +libblobmsg-json +libjson-c TITLE:=OpenWrt system process manager USERID:=:dialout=20 :audio=29 endef @@ -51,7 +52,7 @@ endef define Package/procd-ujail SECTION:=base CATEGORY:=Base system - DEPENDS:=@KERNEL_NAMESPACES +@KERNEL_UTS_NS +@KERNEL_IPC_NS +@KERNEL_PID_NS +libubox +libblobmsg-json + DEPENDS:=@KERNEL_NAMESPACES +@KERNEL_UTS_NS +@KERNEL_IPC_NS +@KERNEL_PID_NS +libubox +libubus +libblobmsg-json TITLE:=OpenWrt process jail helper endef diff --git a/package/system/procd/files/hotplug.json b/package/system/procd/files/hotplug.json index f676bac79e..7e0f129d35 100644 --- a/package/system/procd/files/hotplug.json +++ b/package/system/procd/files/hotplug.json @@ -37,6 +37,10 @@ [ "load-firmware", "/lib/firmware" ], [ "return" ] ] + ], + [ "if", + [ "regex", "DEVNAME", "^ttyGS" ], + [ "start-console", "%DEVNAME%" ] ] ], "remove" : [ diff --git a/package/system/procd/files/procd.sh b/package/system/procd/files/procd.sh index a6a8fc12fc..7031763844 100644 --- a/package/system/procd/files/procd.sh +++ b/package/system/procd/files/procd.sh @@ -49,6 +49,14 @@ procd_lock() { local basescript=$(readlink "$initscript") local service_name="$(basename ${basescript:-$initscript})" + flock -n 1000 &> /dev/null + if [ "$?" != "0" ]; then + exec 1000>"$IPKG_INSTROOT/var/lock/procd_${service_name}.lock" + flock 1000 + if [ "$?" != "0" ]; then + logger "warning: procd flock for $service_name failed" + fi + fi } _procd_call() { @@ -186,6 +194,8 @@ _procd_add_jail() { procfs) json_add_boolean "procfs" "1";; sysfs) json_add_boolean "sysfs" "1";; ronly) json_add_boolean "ronly" "1";; + requirejail) json_add_boolean "requirejail" "1";; + netns) json_add_boolean "netns" "1";; esac done json_add_object "mount" @@ -399,12 +409,12 @@ _procd_add_instance() { procd_running() { local service="$1" - local instance="${2:-instance1}" - local running + local instance="${2:-*}" + [ "$instance" = "*" ] || instance="'$instance'" json_init json_add_string name "$service" - running=$(_procd_ubus_call list | jsonfilter -e "@.$service.instances.${instance}.running") + local running=$(_procd_ubus_call list | jsonfilter -l 1 -e "@['$service'].instances[$instance].running") [ "$running" = "true" ] } @@ -435,6 +445,31 @@ _procd_send_signal() { _procd_ubus_call signal } +_procd_status() { + local service="$1" + local instance="$2" + local data + + json_init + [ -n "$service" ] && json_add_string name "$service" + + data=$(_procd_ubus_call list | jsonfilter -e '@["'"$service"'"]') + [ -z "$data" ] && { echo "inactive"; return 3; } + + data=$(echo "$data" | jsonfilter -e '$.instances') + if [ -z "$data" ]; then + [ -z "$instance" ] && { echo "active with no instances"; return 0; } + data="[]" + fi + + [ -n "$instance" ] && instance="\"$instance\"" || instance='*' + if [ -z "$(echo "$data" | jsonfilter -e '$['"$instance"']')" ]; then + echo "unknown instance $instance"; return 4 + else + echo "running"; return 0 + fi +} + procd_open_data() { local name="$1" json_set_namespace procd __procd_old_cb From aadf217f5537e296db2b51b507d4c7c5558c21d4 Mon Sep 17 00:00:00 2001 From: lean Date: Sun, 22 Mar 2020 18:35:41 +0800 Subject: [PATCH 10/11] dropbear: bump to 2019.78 --- package/base-files/Makefile | 2 +- package/base-files/files/sbin/sysupgrade | 17 +- .../files/usr/libexec/validate_firmware_image | 66 ++++++ package/network/services/dropbear/Config.in | 35 ++- package/network/services/dropbear/Makefile | 66 ++++-- .../services/dropbear/files/dropbear.failsafe | 8 + .../services/dropbear/files/dropbear.init | 132 ++++++++--- .../patches/010-runtime-maxauthtries.patch | 130 ----------- .../020-Wait-to-fail-invalid-usernames.patch | 221 ------------------ .../dropbear/patches/100-pubkey_path.patch | 45 ++-- .../dropbear/patches/110-change_user.patch | 2 +- .../patches/120-openwrt_options.patch | 82 ------- .../patches/130-ssh_ignore_x_args.patch | 4 +- .../dropbear/patches/140-disable_assert.patch | 2 +- .../patches/150-dbconvert_standalone.patch | 14 -- .../dropbear/patches/160-lto-jobserver.patch | 8 +- .../600-allow-blank-root-password.patch | 2 +- ...610-skip-default-keys-in-custom-runs.patch | 18 -- .../patches/900-configure-hardening.patch | 56 +++++ .../patches/901-bundled-libs-cflags.patch | 48 ++++ 20 files changed, 391 insertions(+), 567 deletions(-) create mode 100755 package/base-files/files/usr/libexec/validate_firmware_image create mode 100755 package/network/services/dropbear/files/dropbear.failsafe delete mode 100644 package/network/services/dropbear/patches/010-runtime-maxauthtries.patch delete mode 100644 package/network/services/dropbear/patches/020-Wait-to-fail-invalid-usernames.patch delete mode 100644 package/network/services/dropbear/patches/120-openwrt_options.patch delete mode 100644 package/network/services/dropbear/patches/150-dbconvert_standalone.patch delete mode 100644 package/network/services/dropbear/patches/610-skip-default-keys-in-custom-runs.patch create mode 100644 package/network/services/dropbear/patches/900-configure-hardening.patch create mode 100644 package/network/services/dropbear/patches/901-bundled-libs-cflags.patch diff --git a/package/base-files/Makefile b/package/base-files/Makefile index fcc87bdeea..3c39b5d548 100644 --- a/package/base-files/Makefile +++ b/package/base-files/Makefile @@ -12,7 +12,7 @@ include $(INCLUDE_DIR)/version.mk include $(INCLUDE_DIR)/feeds.mk PKG_NAME:=base-files -PKG_RELEASE:=199 +PKG_RELEASE:=200 PKG_FLAGS:=nonshared PKG_FILE_DEPENDS:=$(PLATFORM_DIR)/ $(GENERIC_PLATFORM_DIR)/base-files/ diff --git a/package/base-files/files/sbin/sysupgrade b/package/base-files/files/sbin/sysupgrade index 3a5087a0c8..dc51826100 100755 --- a/package/base-files/files/sbin/sysupgrade +++ b/package/base-files/files/sbin/sysupgrade @@ -2,6 +2,7 @@ . /lib/functions.sh . /lib/functions/system.sh +. /usr/share/libubox/jshn.sh # initialize defaults export MTD_CONFIG_ARGS="" @@ -368,9 +369,15 @@ if [ -n "$FAILSAFE" ]; then printf '%s\x00%s\x00%s' "$RAM_ROOT" "$IMAGE" "$COMMAND" >/tmp/sysupgrade lock -u /tmp/.failsafe else - ubus call system sysupgrade "{ - \"prefix\": $(json_string "$RAM_ROOT"), - \"path\": $(json_string "$IMAGE"), - \"command\": $(json_string "$COMMAND") - }" + json_init + json_add_string prefix "$RAM_ROOT" + json_add_string path "$IMAGE" + [ $FORCE -eq 1 ] && json_add_boolean force 1 + [ $SAVE_CONFIG -eq 1 ] && json_add_string backup "$CONF_TAR" + json_add_string command "$COMMAND" + json_add_object options + json_add_int save_partitions "$SAVE_PARTITIONS" + json_close_object + + ubus call system sysupgrade "$(json_dump)" fi diff --git a/package/base-files/files/usr/libexec/validate_firmware_image b/package/base-files/files/usr/libexec/validate_firmware_image new file mode 100755 index 0000000000..f85fb9e4b4 --- /dev/null +++ b/package/base-files/files/usr/libexec/validate_firmware_image @@ -0,0 +1,66 @@ +#!/bin/sh + +. /lib/functions.sh +. /lib/functions/system.sh +. /usr/share/libubox/jshn.sh + +include /lib/upgrade + +VALID=1 +FORCEABLE=1 +ALLOW_BACKUP=1 + +# Mark image as invalid but still possible to install +notify_firmware_invalid() { + VALID=0 +} + +# Mark image as broken (impossible to install) +notify_firmware_broken() { + VALID=0 + FORCEABLE=0 +} + +# Mark image as incompatible with preserving a backup +notify_firmware_no_backup() { + ALLOW_BACKUP=0 +} + +# Add result of validation test +notify_firmware_test_result() { + local old_ns + + json_set_namespace validate_firmware_image old_ns + json_add_boolean "$1" "$2" + json_set_namespace $old_ns +} + +err_to_bool() { + [ "$1" -ne 0 ] && echo 0 || echo 1 +} + +fwtool_check_signature "$1" >&2 +FWTOOL_SIGNATURE=$? +[ "$FWTOOL_SIGNATURE" -ne 0 ] && notify_firmware_invalid + +fwtool_check_image "$1" >&2 +FWTOOL_DEVICE_MATCH=$? +[ "$FWTOOL_DEVICE_MATCH" -ne 0 ] && notify_firmware_invalid + +json_set_namespace validate_firmware_image old_ns +json_init + json_add_object "tests" + json_add_boolean fwtool_signature "$(err_to_bool $FWTOOL_SIGNATURE)" + json_add_boolean fwtool_device_match "$(err_to_bool $FWTOOL_DEVICE_MATCH)" + + # Call platform_check_image() here so it can add its test + # results and still mark image properly. + json_set_namespace $old_ns + platform_check_image "$1" >&2 || notify_firmware_invalid + json_set_namespace validate_firmware_image old_ns + json_close_object + json_add_boolean valid "$VALID" + json_add_boolean forceable "$FORCEABLE" + json_add_boolean allow_backup "$ALLOW_BACKUP" +json_dump -i +json_set_namespace $old_ns diff --git a/package/network/services/dropbear/Config.in b/package/network/services/dropbear/Config.in index ca0af9d5e0..61a04ec876 100644 --- a/package/network/services/dropbear/Config.in +++ b/package/network/services/dropbear/Config.in @@ -8,29 +8,46 @@ config DROPBEAR_CURVE25519 This enables the following key exchange algorithm: curve25519-sha256@libssh.org - Increases binary size by about 13 kB uncompressed (MIPS). + Increases binary size by about 8 kB uncompressed (MIPS). config DROPBEAR_ECC bool "Elliptic curve cryptography (ECC)" default n help - Enables elliptic curve cryptography (ECC) support in key exchange and public key - authentication. + Enables basic support for elliptic curve cryptography (ECC) + in key exchange and public key authentication. Key exchange algorithms: ecdh-sha2-nistp256 + + Public key algorithms: + ecdsa-sha2-nistp256 + + Increases binary size by about 24 kB (MIPS). + + If full ECC support is required, also select DROPBEAR_ECC_FULL. + +config DROPBEAR_ECC_FULL + bool "Elliptic curve cryptography (ECC), full support" + default n + depends on DROPBEAR_ECC + help + Enables full support for elliptic curve cryptography (ECC) + in key exchange and public key authentication. + + Key exchange algorithms: + ecdh-sha2-nistp256 (*) ecdh-sha2-nistp384 ecdh-sha2-nistp521 Public key algorithms: - ecdsa-sha2-nistp256 + ecdsa-sha2-nistp256 (*) ecdsa-sha2-nistp384 ecdsa-sha2-nistp521 - Does not generate ECC host keys by default (ECC key exchange will not be used, - only ECC public key auth). + (*) - basic ECC support; provided by DROPBEAR_ECC. - Increases binary size by about 23 kB (MIPS). + Increases binary size by about 4 kB (MIPS). config DROPBEAR_ZLIB bool "Enable compression" @@ -56,4 +73,8 @@ config DROPBEAR_PUTUTLINE help Dropbear will use pututline() to write the utmp structure into the utmp file. +config DROPBEAR_DBCLIENT + bool "Build dropbear with dbclient" + default y + endmenu diff --git a/package/network/services/dropbear/Makefile b/package/network/services/dropbear/Makefile index 0ed7199e68..59b4f54954 100644 --- a/package/network/services/dropbear/Makefile +++ b/package/network/services/dropbear/Makefile @@ -8,26 +8,29 @@ include $(TOPDIR)/rules.mk PKG_NAME:=dropbear -PKG_VERSION:=2017.75 -PKG_RELEASE:=9 +PKG_VERSION:=2019.78 +PKG_RELEASE:=3 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2 PKG_SOURCE_URL:= \ http://matt.ucc.asn.au/dropbear/releases/ \ https://dropbear.nl/mirror/releases/ -PKG_HASH:=6cbc1dcb1c9709d226dff669e5604172a18cf5dbf9a201474d5618ae4465098c +PKG_HASH:=525965971272270995364a0eb01f35180d793182e63dd0b0c3eb0292291644a4 PKG_LICENSE:=MIT PKG_LICENSE_FILES:=LICENSE libtomcrypt/LICENSE libtommath/LICENSE PKG_CPE_ID:=cpe:/a:matt_johnston:dropbear_ssh_server PKG_BUILD_PARALLEL:=1 +PKG_ASLR_PIE_REGULAR:=1 PKG_USE_MIPS16:=0 +PKG_FIXUP:=autoreconf PKG_CONFIG_DEPENDS:= \ - CONFIG_TARGET_INIT_PATH CONFIG_DROPBEAR_ECC \ + CONFIG_TARGET_INIT_PATH CONFIG_DROPBEAR_ECC CONFIG_DROPBEAR_ECC_FULL \ CONFIG_DROPBEAR_CURVE25519 CONFIG_DROPBEAR_ZLIB \ - CONFIG_DROPBEAR_UTMP CONFIG_DROPBEAR_PUTUTLINE + CONFIG_DROPBEAR_UTMP CONFIG_DROPBEAR_PUTUTLINE \ + CONFIG_DROPBEAR_DBCLIENT include $(INCLUDE_DIR)/package.mk @@ -60,6 +63,7 @@ define Package/dropbear/description endef define Package/dropbear/conffiles +$(if $(CONFIG_DROPBEAR_ECC),/etc/dropbear/dropbear_ecdsa_host_key) /etc/dropbear/dropbear_rsa_host_key /etc/config/dropbear endef @@ -69,6 +73,7 @@ define Package/dropbearconvert SECTION:=utils CATEGORY:=Utilities TITLE:=Utility for converting SSH keys + DEPENDS:= +DROPBEAR_ZLIB:zlib endef CONFIGURE_ARGS += \ @@ -90,41 +95,51 @@ TARGET_CFLAGS += -DARGTYPE=3 -ffunction-sections -fdata-sections -flto TARGET_LDFLAGS += -Wl,--gc-sections -flto=jobserver define Build/Configure + : > $(PKG_BUILD_DIR)/localoptions.h + $(Build/Configure/Default) - $(SED) 's,^#define DEFAULT_PATH .*$$$$,#define DEFAULT_PATH "$(TARGET_INIT_PATH)",g' \ - $(PKG_BUILD_DIR)/options.h + echo '#define DEFAULT_PATH "$(TARGET_INIT_PATH)"' >> \ + $(PKG_BUILD_DIR)/localoptions.h - awk 'BEGIN { rc = 1 } \ - /'DROPBEAR_CURVE25519'/ { $$$$0 = "$(if $(CONFIG_DROPBEAR_CURVE25519),,// )#define 'DROPBEAR_CURVE25519'"; rc = 0 } \ - { print } \ - END { exit(rc) }' $(PKG_BUILD_DIR)/options.h \ - >$(PKG_BUILD_DIR)/options.h.new && \ - mv $(PKG_BUILD_DIR)/options.h.new $(PKG_BUILD_DIR)/options.h + echo '#define DROPBEAR_CURVE25519 $(if $(CONFIG_DROPBEAR_CURVE25519),1,0)' >> \ + $(PKG_BUILD_DIR)/localoptions.h - # Enforce that all replacements are made, otherwise options.h has changed - # format and this logic is broken. for OPTION in DROPBEAR_ECDSA DROPBEAR_ECDH; do \ - awk 'BEGIN { rc = 1 } \ - /'$$$$OPTION'/ { $$$$0 = "$(if $(CONFIG_DROPBEAR_ECC),,// )#define '$$$$OPTION'"; rc = 0 } \ - { print } \ - END { exit(rc) }' $(PKG_BUILD_DIR)/options.h \ - >$(PKG_BUILD_DIR)/options.h.new && \ - mv $(PKG_BUILD_DIR)/options.h.new $(PKG_BUILD_DIR)/options.h || exit 1; \ + echo "#define $$$$OPTION $(if $(CONFIG_DROPBEAR_ECC),1,0)" >> \ + $(PKG_BUILD_DIR)/localoptions.h; \ done # remove protocol idented software version number - $(SED) 's,^#define LOCAL_IDENT .*$$$$,#define LOCAL_IDENT "SSH-2.0-dropbear",g' \ + $(ESED) 's,^(#define LOCAL_IDENT) .*$$$$,\1 "SSH-2.0-dropbear",g' \ $(PKG_BUILD_DIR)/sysoptions.h + # disable legacy/unsafe methods and unused functionality + for OPTION in INETD_MODE DROPBEAR_CLI_NETCAT \ + DROPBEAR_3DES DROPBEAR_DSS DROPBEAR_ENABLE_CBC_MODE \ + DROPBEAR_SHA1_96_HMAC DROPBEAR_USE_PASSWORD_ENV; do \ + echo "#define $$$$OPTION 0" >> \ + $(PKG_BUILD_DIR)/localoptions.h; \ + done + + # enable nistp384 and nistp521 only if full ECC support was requested + for OPTION in DROPBEAR_ECC_384 DROPBEAR_ECC_521; do \ + $(ESED) 's,^(#define '$$$$OPTION') .*$$$$,\1 $(if $(CONFIG_DROPBEAR_ECC_FULL),1,0),g' \ + $(PKG_BUILD_DIR)/sysoptions.h; \ + done + # Enforce rebuild of svr-chansession.c rm -f $(PKG_BUILD_DIR)/svr-chansession.o + + # Rebuild them on config change + +$(MAKE) -C $(PKG_BUILD_DIR)/libtomcrypt clean + +$(MAKE) -C $(PKG_BUILD_DIR)/libtommath clean endef define Build/Compile +$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR) \ $(TARGET_CONFIGURE_OPTS) \ - PROGRAMS="dropbear dbclient dropbearkey scp" \ + PROGRAMS="dropbear $(if $(CONFIG_DROPBEAR_DBCLIENT),dbclient,) dropbearkey scp" \ MULTI=1 SCPPROGRESS=1 +$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR) \ $(TARGET_CONFIGURE_OPTS) \ @@ -135,7 +150,7 @@ define Package/dropbear/install $(INSTALL_DIR) $(1)/usr/sbin $(INSTALL_BIN) $(PKG_BUILD_DIR)/dropbearmulti $(1)/usr/sbin/dropbear $(INSTALL_DIR) $(1)/usr/bin - $(LN) ../sbin/dropbear $(1)/usr/bin/dbclient + $(if $(CONFIG_DROPBEAR_DBCLIENT),$(LN) ../sbin/dropbear $(1)/usr/bin/dbclient,) $(LN) ../sbin/dropbear $(1)/usr/bin/dropbearkey $(INSTALL_DIR) $(1)/etc/config $(INSTALL_CONF) ./files/dropbear.config $(1)/etc/config/dropbear @@ -143,6 +158,9 @@ define Package/dropbear/install $(INSTALL_BIN) ./files/dropbear.init $(1)/etc/init.d/dropbear $(INSTALL_DIR) $(1)/usr/lib/opkg/info $(INSTALL_DIR) $(1)/etc/dropbear + $(INSTALL_DIR) $(1)/lib/preinit + $(INSTALL_DATA) ./files/dropbear.failsafe $(1)/lib/preinit/99_10_failsafe_dropbear + $(if $(CONFIG_DROPBEAR_ECC),touch $(1)/etc/dropbear/dropbear_ecdsa_host_key) touch $(1)/etc/dropbear/dropbear_rsa_host_key endef diff --git a/package/network/services/dropbear/files/dropbear.failsafe b/package/network/services/dropbear/files/dropbear.failsafe new file mode 100755 index 0000000000..a98ede459a --- /dev/null +++ b/package/network/services/dropbear/files/dropbear.failsafe @@ -0,0 +1,8 @@ +#!/bin/sh + +failsafe_dropbear () { + dropbearkey -t rsa -s 1024 -f /tmp/dropbear_failsafe_host_key + dropbear -r /tmp/dropbear_failsafe_host_key <> /dev/null 2>&1 +} + +boot_hook_add failsafe failsafe_dropbear diff --git a/package/network/services/dropbear/files/dropbear.init b/package/network/services/dropbear/files/dropbear.init index eef2643c14..173ab09285 100755 --- a/package/network/services/dropbear/files/dropbear.init +++ b/package/network/services/dropbear/files/dropbear.init @@ -12,6 +12,91 @@ PIDCOUNT=0 EXTRA_COMMANDS="killclients" EXTRA_HELP=" killclients Kill ${NAME} processes except servers and yourself" +_dropbearkey() +{ + /usr/bin/dropbearkey "$@" 0<&- 1>&- 2>&- +} + +# $1 - host key file name +hk_verify() +{ + [ -f "$1" ] || return 1 + [ -s "$1" ] || return 2 + _dropbearkey -y -f "$1" || return 3 + return 0 +} + +# $1 - hk_verify() return code +hk_errmsg() +{ + case "$1" in + 0) ;; + 1) echo "file does not exist" ;; + 2) echo "file has zero length" ;; + 3) echo "file is not valid host key or not supported" ;; + *) echo "unknown error" ;; + esac +} + +# $1 - config option +# $2 - host key file name +hk_config() +{ + local x m + hk_verify "$2"; x=$? + case "$x" in + 0) procd_append_param command -r "$2" + ;; + *) m=$(hk_errmsg "$x") + logger -t "${NAME}" -p daemon.warn \ + "option '$1', value '$2': $m, skipping" + ;; + esac +} + +# $1 - host key file name +hk_config__keyfile() +{ + hk_config 'keyfile' "$1" +} + +hk_generate_as_needed() +{ + local kdir kgen ktype tdir kcount tfile + kdir='/etc/dropbear' + + kgen='' + for ktype in ecdsa rsa; do + hk_verify "${kdir}/dropbear_${ktype}_host_key" && continue + + kgen="${kgen} ${ktype}" + done + + [ -z "${kgen}" ] && return + + tdir=$(mktemp -d); chmod 0700 "${tdir}" + + kcount=0 + for ktype in ${kgen}; do + tfile="${tdir}/dropbear_${ktype}_host_key" + + if ! _dropbearkey -t ${ktype} -f "${tfile}"; then + # unsupported key type + rm -f "${tfile}" + continue + fi + + kcount=$((kcount+1)) + done + + if [ ${kcount} -ne 0 ]; then + mkdir -p "${kdir}"; chmod 0700 "${kdir}"; chown root "${kdir}" + mv -f "${tdir}/"* "${kdir}/" + fi + + rm -rf "${tdir}" +} + append_ports() { local ipaddrs="$1" @@ -29,7 +114,7 @@ append_ports() validate_section_dropbear() { - uci_validate_section dropbear dropbear "${1}" \ + uci_load_validate dropbear dropbear "$1" "$2" \ 'PasswordAuth:bool:1' \ 'enable:bool:1' \ 'Interface:string' \ @@ -37,8 +122,9 @@ validate_section_dropbear() 'RootPasswordAuth:bool:1' \ 'RootLogin:bool:1' \ 'rsakeyfile:file' \ + 'keyfile:list(file)' \ 'BannerFile:file' \ - 'Port:list(port):22' \ + 'Port:port:22' \ 'SSHKeepAlive:uinteger:300' \ 'IdleTimeout:uinteger:0' \ 'MaxAuthTries:uinteger:3' \ @@ -48,12 +134,9 @@ validate_section_dropbear() dropbear_instance() { - local PasswordAuth enable Interface GatewayPorts \ - RootPasswordAuth RootLogin rsakeyfile \ - BannerFile Port SSHKeepAlive IdleTimeout \ - MaxAuthTries RecvWindowSize mdns ipaddrs + local ipaddrs - validate_section_dropbear "${1}" || { + [ "$2" = 0 ] || { echo "validation failed" return 1 } @@ -77,7 +160,13 @@ dropbear_instance() [ "${GatewayPorts}" -eq 1 ] && procd_append_param command -a [ "${RootPasswordAuth}" -eq 0 ] && procd_append_param command -g [ "${RootLogin}" -eq 0 ] && procd_append_param command -w - [ -n "${rsakeyfile}" ] && procd_append_param command -r "${rsakeyfile}" + if [ -n "${rsakeyfile}" ]; then + logger -t ${NAME} -p daemon.warn \ + "option 'rsakeyfile' is considered to be deprecated and" \ + "will be removed in future releases, use 'keyfile' instead" + hk_config 'rsakeyfile' "${rsakeyfile}" + fi + config_list_foreach "$1" "keyfile" hk_config__keyfile [ -n "${BannerFile}" ] && procd_append_param command -b "${BannerFile}" append_ports "${ipaddrs}" "${Port}" [ "${IdleTimeout}" -ne 0 ] && procd_append_param command -I "${IdleTimeout}" @@ -90,29 +179,6 @@ dropbear_instance() procd_close_instance } -keygen() -{ - for keytype in rsa; do - # check for keys - key=dropbear/dropbear_${keytype}_host_key - [ -f /tmp/$key -o -s /etc/$key ] || { - # generate missing keys - mkdir -p /tmp/dropbear - [ -x /usr/bin/dropbearkey ] && { - /usr/bin/dropbearkey -t $keytype -f /tmp/$key 2>&- >&- && exec /etc/rc.common "$initscript" start - } & - exit 0 - } - done - - lock /tmp/.switch2jffs - mkdir -p /etc/dropbear - mv /tmp/dropbear/dropbear_* /etc/dropbear/ - lock -u /tmp/.switch2jffs - chown root /etc/dropbear - chmod 0700 /etc/dropbear -} - load_interfaces() { config_get interface "$1" Interface @@ -129,13 +195,13 @@ boot() start_service() { - [ -s /etc/dropbear/dropbear_rsa_host_key ] || keygen + hk_generate_as_needed . /lib/functions.sh . /lib/functions/network.sh config_load "${NAME}" - config_foreach dropbear_instance dropbear + config_foreach validate_section_dropbear dropbear dropbear_instance } service_triggers() diff --git a/package/network/services/dropbear/patches/010-runtime-maxauthtries.patch b/package/network/services/dropbear/patches/010-runtime-maxauthtries.patch deleted file mode 100644 index 26db3181f2..0000000000 --- a/package/network/services/dropbear/patches/010-runtime-maxauthtries.patch +++ /dev/null @@ -1,130 +0,0 @@ -From 46b22e57d91e33a591d0fba97da52672af4d6ed2 Mon Sep 17 00:00:00 2001 -From: Kevin Darbyshire-Bryant -Date: Mon, 29 May 2017 10:25:09 +0100 -Subject: [PATCH] dropbear server: support -T max auth tries - -Add support for '-T n' for a run-time specification for maximum number -of authentication attempts where 'n' is between 1 and compile time -option MAX_AUTH_TRIES. - -A default number of tries can be specified at compile time using -'DEFAULT_AUTH_TRIES' which itself defaults to MAX_AUTH_TRIES for -backwards compatibility. - -Signed-off-by: Kevin Darbyshire-Bryant ---- - options.h | 7 +++++++ - runopts.h | 1 + - svr-auth.c | 2 +- - svr-runopts.c | 17 +++++++++++++++++ - 4 files changed, 26 insertions(+), 1 deletion(-) - -diff --git a/options.h b/options.h -index 0c51bb1..4d22704 100644 ---- a/options.h -+++ b/options.h -@@ -284,6 +284,13 @@ Homedir is prepended unless path begins with / */ - #define MAX_AUTH_TRIES 10 - #endif - -+/* Default maximum number of failed authentication tries. -+ * defaults to MAX_AUTH_TRIES */ -+ -+#ifndef DEFAULT_AUTH_TRIES -+#define DEFAULT_AUTH_TRIES MAX_AUTH_TRIES -+#endif -+ - /* The default file to store the daemon's process ID, for shutdown - scripts etc. This can be overridden with the -P flag */ - #ifndef DROPBEAR_PIDFILE -diff --git a/runopts.h b/runopts.h -index f7c869d..2f7da63 100644 ---- a/runopts.h -+++ b/runopts.h -@@ -96,6 +96,7 @@ typedef struct svr_runopts { - int noauthpass; - int norootpass; - int allowblankpass; -+ unsigned int maxauthtries; - - #ifdef ENABLE_SVR_REMOTETCPFWD - int noremotetcp; -diff --git a/svr-auth.c b/svr-auth.c -index 577ea88..6a7ce0b 100644 ---- a/svr-auth.c -+++ b/svr-auth.c -@@ -362,7 +362,7 @@ void send_msg_userauth_failure(int partial, int incrfail) { - ses.authstate.failcount++; - } - -- if (ses.authstate.failcount >= MAX_AUTH_TRIES) { -+ if (ses.authstate.failcount >= svr_opts.maxauthtries) { - char * userstr; - /* XXX - send disconnect ? */ - TRACE(("Max auth tries reached, exiting")) -diff --git a/svr-runopts.c b/svr-runopts.c -index 8f60059..1e7440f 100644 ---- a/svr-runopts.c -+++ b/svr-runopts.c -@@ -73,6 +73,7 @@ static void printhelp(const char * progname) { - "-g Disable password logins for root\n" - "-B Allow blank password logins\n" - #endif -+ "-T <1 to %d> Maximum authentication tries (default %d)\n" - #ifdef ENABLE_SVR_LOCALTCPFWD - "-j Disable local port forwarding\n" - #endif -@@ -106,6 +107,7 @@ static void printhelp(const char * progname) { - #ifdef DROPBEAR_ECDSA - ECDSA_PRIV_FILENAME, - #endif -+ MAX_AUTH_TRIES, DEFAULT_AUTH_TRIES, - DROPBEAR_MAX_PORTS, DROPBEAR_DEFPORT, DROPBEAR_PIDFILE, - DEFAULT_RECV_WINDOW, DEFAULT_KEEPALIVE, DEFAULT_IDLE_TIMEOUT); - } -@@ -118,6 +120,7 @@ void svr_getopts(int argc, char ** argv) { - char* recv_window_arg = NULL; - char* keepalive_arg = NULL; - char* idle_timeout_arg = NULL; -+ char* maxauthtries_arg = NULL; - char* keyfile = NULL; - char c; - -@@ -130,6 +133,7 @@ void svr_getopts(int argc, char ** argv) { - svr_opts.noauthpass = 0; - svr_opts.norootpass = 0; - svr_opts.allowblankpass = 0; -+ svr_opts.maxauthtries = DEFAULT_AUTH_TRIES; - svr_opts.inetdmode = 0; - svr_opts.portcount = 0; - svr_opts.hostkey = NULL; -@@ -234,6 +238,9 @@ void svr_getopts(int argc, char ** argv) { - case 'I': - next = &idle_timeout_arg; - break; -+ case 'T': -+ next = &maxauthtries_arg; -+ break; - #if defined(ENABLE_SVR_PASSWORD_AUTH) || defined(ENABLE_SVR_PAM_AUTH) - case 's': - svr_opts.noauthpass = 1; -@@ -330,6 +337,16 @@ void svr_getopts(int argc, char ** argv) { - dropbear_exit("Bad recv window '%s'", recv_window_arg); - } - } -+ -+ if (maxauthtries_arg) { -+ unsigned int val = 0; -+ if (m_str_to_uint(maxauthtries_arg, &val) == DROPBEAR_FAILURE || -+ val == 0 || val > MAX_AUTH_TRIES) { -+ dropbear_exit("Bad maxauthtries '%s'", maxauthtries_arg); -+ } -+ svr_opts.maxauthtries = val; -+ } -+ - - if (keepalive_arg) { - unsigned int val; --- -2.7.4 - diff --git a/package/network/services/dropbear/patches/020-Wait-to-fail-invalid-usernames.patch b/package/network/services/dropbear/patches/020-Wait-to-fail-invalid-usernames.patch deleted file mode 100644 index 593dca930d..0000000000 --- a/package/network/services/dropbear/patches/020-Wait-to-fail-invalid-usernames.patch +++ /dev/null @@ -1,221 +0,0 @@ -From 52adbb34c32d3e2e1bcdb941e20a6f81138b8248 Mon Sep 17 00:00:00 2001 -From: Matt Johnston -Date: Thu, 23 Aug 2018 23:43:12 +0800 -Subject: [PATCH 2/2] Wait to fail invalid usernames - ---- - auth.h | 6 +++--- - svr-auth.c | 19 +++++-------------- - svr-authpam.c | 26 ++++++++++++++++++++++---- - svr-authpasswd.c | 27 ++++++++++++++------------- - svr-authpubkey.c | 11 ++++++++++- - 5 files changed, 54 insertions(+), 35 deletions(-) - ---- a/auth.h -+++ b/auth.h -@@ -37,9 +37,9 @@ void recv_msg_userauth_request(void); - void send_msg_userauth_failure(int partial, int incrfail); - void send_msg_userauth_success(void); - void send_msg_userauth_banner(buffer *msg); --void svr_auth_password(void); --void svr_auth_pubkey(void); --void svr_auth_pam(void); -+void svr_auth_password(int valid_user); -+void svr_auth_pubkey(int valid_user); -+void svr_auth_pam(int valid_user); - - #ifdef ENABLE_SVR_PUBKEY_OPTIONS - int svr_pubkey_allows_agentfwd(void); ---- a/svr-auth.c -+++ b/svr-auth.c -@@ -176,10 +176,8 @@ void recv_msg_userauth_request() { - if (methodlen == AUTH_METHOD_PASSWORD_LEN && - strncmp(methodname, AUTH_METHOD_PASSWORD, - AUTH_METHOD_PASSWORD_LEN) == 0) { -- if (valid_user) { -- svr_auth_password(); -- goto out; -- } -+ svr_auth_password(valid_user); -+ goto out; - } - } - #endif -@@ -191,10 +189,8 @@ void recv_msg_userauth_request() { - if (methodlen == AUTH_METHOD_PASSWORD_LEN && - strncmp(methodname, AUTH_METHOD_PASSWORD, - AUTH_METHOD_PASSWORD_LEN) == 0) { -- if (valid_user) { -- svr_auth_pam(); -- goto out; -- } -+ svr_auth_pam(valid_user); -+ goto out; - } - } - #endif -@@ -204,12 +200,7 @@ void recv_msg_userauth_request() { - if (methodlen == AUTH_METHOD_PUBKEY_LEN && - strncmp(methodname, AUTH_METHOD_PUBKEY, - AUTH_METHOD_PUBKEY_LEN) == 0) { -- if (valid_user) { -- svr_auth_pubkey(); -- } else { -- /* pubkey has no failure delay */ -- send_msg_userauth_failure(0, 0); -- } -+ svr_auth_pubkey(valid_user); - goto out; - } - #endif ---- a/svr-authpam.c -+++ b/svr-authpam.c -@@ -178,13 +178,14 @@ pamConvFunc(int num_msg, - * Keyboard interactive would be a lot nicer, but since PAM is synchronous, it - * gets very messy trying to send the interactive challenges, and read the - * interactive responses, over the network. */ --void svr_auth_pam() { -+void svr_auth_pam(int valid_user) { - - struct UserDataS userData = {NULL, NULL}; - struct pam_conv pamConv = { - pamConvFunc, - &userData /* submitted to pamvConvFunc as appdata_ptr */ - }; -+ const char* printable_user = NULL; - - pam_handle_t* pamHandlep = NULL; - -@@ -204,12 +205,23 @@ void svr_auth_pam() { - - password = buf_getstring(ses.payload, &passwordlen); - -+ /* We run the PAM conversation regardless of whether the username is valid -+ in case the conversation function has an inherent delay. -+ Use ses.authstate.username rather than ses.authstate.pw_name. -+ After PAM succeeds we then check the valid_user flag too */ -+ - /* used to pass data to the PAM conversation function - don't bother with - * strdup() etc since these are touched only by our own conversation - * function (above) which takes care of it */ -- userData.user = ses.authstate.pw_name; -+ userData.user = ses.authstate.username; - userData.passwd = password; - -+ if (ses.authstate.pw_name) { -+ printable_user = ses.authstate.pw_name; -+ } else { -+ printable_user = ""; -+ } -+ - /* Init pam */ - if ((rc = pam_start("sshd", NULL, &pamConv, &pamHandlep)) != PAM_SUCCESS) { - dropbear_log(LOG_WARNING, "pam_start() failed, rc=%d, %s", -@@ -236,7 +248,7 @@ void svr_auth_pam() { - rc, pam_strerror(pamHandlep, rc)); - dropbear_log(LOG_WARNING, - "Bad PAM password attempt for '%s' from %s", -- ses.authstate.pw_name, -+ printable_user, - svr_ses.addrstring); - send_msg_userauth_failure(0, 1); - goto cleanup; -@@ -247,12 +259,18 @@ void svr_auth_pam() { - rc, pam_strerror(pamHandlep, rc)); - dropbear_log(LOG_WARNING, - "Bad PAM password attempt for '%s' from %s", -- ses.authstate.pw_name, -+ printable_user, - svr_ses.addrstring); - send_msg_userauth_failure(0, 1); - goto cleanup; - } - -+ if (!valid_user) { -+ /* PAM auth succeeded but the username isn't allowed in for another reason -+ (checkusername() failed) */ -+ send_msg_userauth_failure(0, 1); -+ } -+ - /* successful authentication */ - dropbear_log(LOG_NOTICE, "PAM password auth succeeded for '%s' from %s", - ses.authstate.pw_name, ---- a/svr-authpasswd.c -+++ b/svr-authpasswd.c -@@ -48,22 +48,14 @@ static int constant_time_strcmp(const ch - - /* Process a password auth request, sending success or failure messages as - * appropriate */ --void svr_auth_password() { -+void svr_auth_password(int valid_user) { - - char * passwdcrypt = NULL; /* the crypt from /etc/passwd or /etc/shadow */ - char * testcrypt = NULL; /* crypt generated from the user's password sent */ -- char * password; -+ char * password = NULL; - unsigned int passwordlen; -- - unsigned int changepw; - -- passwdcrypt = ses.authstate.pw_passwd; -- --#ifdef DEBUG_HACKCRYPT -- /* debugging crypt for non-root testing with shadows */ -- passwdcrypt = DEBUG_HACKCRYPT; --#endif -- - /* check if client wants to change password */ - changepw = buf_getbool(ses.payload); - if (changepw) { -@@ -73,12 +65,21 @@ void svr_auth_password() { - } - - password = buf_getstring(ses.payload, &passwordlen); -- -- /* the first bytes of passwdcrypt are the salt */ -- testcrypt = crypt(password, passwdcrypt); -+ if (valid_user) { -+ /* the first bytes of passwdcrypt are the salt */ -+ passwdcrypt = ses.authstate.pw_passwd; -+ testcrypt = crypt(password, passwdcrypt); -+ } - m_burn(password, passwordlen); - m_free(password); - -+ /* After we have got the payload contents we can exit if the username -+ is invalid. Invalid users have already been logged. */ -+ if (!valid_user) { -+ send_msg_userauth_failure(0, 1); -+ return; -+ } -+ - if (testcrypt == NULL) { - /* crypt() with an invalid salt like "!!" */ - dropbear_log(LOG_WARNING, "User account '%s' is locked", ---- a/svr-authpubkey.c -+++ b/svr-authpubkey.c -@@ -79,7 +79,7 @@ static int checkfileperm(char * filename - - /* process a pubkey auth request, sending success or failure message as - * appropriate */ --void svr_auth_pubkey() { -+void svr_auth_pubkey(int valid_user) { - - unsigned char testkey; /* whether we're just checking if a key is usable */ - char* algo = NULL; /* pubkey algo */ -@@ -102,6 +102,15 @@ void svr_auth_pubkey() { - keybloblen = buf_getint(ses.payload); - keyblob = buf_getptr(ses.payload, keybloblen); - -+ if (!valid_user) { -+ /* Return failure once we have read the contents of the packet -+ required to validate a public key. -+ Avoids blind user enumeration though it isn't possible to prevent -+ testing for user existence if the public key is known */ -+ send_msg_userauth_failure(0, 0); -+ goto out; -+ } -+ - /* check if the key is valid */ - if (checkpubkey(algo, algolen, keyblob, keybloblen) == DROPBEAR_FAILURE) { - send_msg_userauth_failure(0, 0); diff --git a/package/network/services/dropbear/patches/100-pubkey_path.patch b/package/network/services/dropbear/patches/100-pubkey_path.patch index 274d3af46a..732d84078f 100644 --- a/package/network/services/dropbear/patches/100-pubkey_path.patch +++ b/package/network/services/dropbear/patches/100-pubkey_path.patch @@ -1,6 +1,6 @@ --- a/svr-authpubkey.c +++ b/svr-authpubkey.c -@@ -229,14 +229,20 @@ static int checkpubkey(char* algo, unsig +@@ -338,14 +338,19 @@ static int checkpubkey(const char* algo, goto out; } @@ -25,34 +25,23 @@ + filename = m_malloc(30); + strncpy(filename, "/etc/dropbear/authorized_keys", 30); + } -+ + #if DROPBEAR_SVR_MULTIUSER /* open the file as the authenticating user. */ - origuid = getuid(); -@@ -405,26 +411,35 @@ static int checkpubkeyperms() { +@@ -426,27 +431,36 @@ static int checkpubkeyperms() { goto out; } - /* allocate max required pathname storage, - * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */ -- filename = m_malloc(len + 22); -- strncpy(filename, ses.authstate.pw_dir, len+1); +- len += 22; +- filename = m_malloc(len); +- strlcpy(filename, ses.authstate.pw_dir, len); - - /* check ~ */ - if (checkfileperm(filename) != DROPBEAR_SUCCESS) { - goto out; - } -- -- /* check ~/.ssh */ -- strncat(filename, "/.ssh", 5); /* strlen("/.ssh") == 5 */ -- if (checkfileperm(filename) != DROPBEAR_SUCCESS) { -- goto out; -- } -- -- /* now check ~/.ssh/authorized_keys */ -- strncat(filename, "/authorized_keys", 16); -- if (checkfileperm(filename) != DROPBEAR_SUCCESS) { -- goto out; + if (ses.authstate.pw_uid == 0) { + if (checkfileperm("/etc/dropbear") != DROPBEAR_SUCCESS) { + goto out; @@ -63,22 +52,32 @@ + } else { + /* allocate max required pathname storage, + * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */ -+ filename = m_malloc(len + 22); -+ strncpy(filename, ses.authstate.pw_dir, len+1); ++ len += 22; ++ filename = m_malloc(len); ++ strlcpy(filename, ses.authstate.pw_dir, len); + + /* check ~ */ + if (checkfileperm(filename) != DROPBEAR_SUCCESS) { + goto out; + } -+ + +- /* check ~/.ssh */ +- strlcat(filename, "/.ssh", len); +- if (checkfileperm(filename) != DROPBEAR_SUCCESS) { +- goto out; +- } + /* check ~/.ssh */ -+ strncat(filename, "/.ssh", 5); /* strlen("/.ssh") == 5 */ ++ strlcat(filename, "/.ssh", len); + if (checkfileperm(filename) != DROPBEAR_SUCCESS) { + goto out; + } -+ + +- /* now check ~/.ssh/authorized_keys */ +- strlcat(filename, "/authorized_keys", len); +- if (checkfileperm(filename) != DROPBEAR_SUCCESS) { +- goto out; + /* now check ~/.ssh/authorized_keys */ -+ strncat(filename, "/authorized_keys", 16); ++ strlcat(filename, "/authorized_keys", len); + if (checkfileperm(filename) != DROPBEAR_SUCCESS) { + goto out; + } diff --git a/package/network/services/dropbear/patches/110-change_user.patch b/package/network/services/dropbear/patches/110-change_user.patch index 4b5c1cb51b..27e7fbaf4f 100644 --- a/package/network/services/dropbear/patches/110-change_user.patch +++ b/package/network/services/dropbear/patches/110-change_user.patch @@ -1,6 +1,6 @@ --- a/svr-chansession.c +++ b/svr-chansession.c -@@ -922,12 +922,12 @@ static void execchild(void *user_data) { +@@ -953,12 +953,12 @@ static void execchild(const void *user_d /* We can only change uid/gid as root ... */ if (getuid() == 0) { diff --git a/package/network/services/dropbear/patches/120-openwrt_options.patch b/package/network/services/dropbear/patches/120-openwrt_options.patch deleted file mode 100644 index 7f47a74304..0000000000 --- a/package/network/services/dropbear/patches/120-openwrt_options.patch +++ /dev/null @@ -1,82 +0,0 @@ ---- a/options.h -+++ b/options.h -@@ -41,7 +41,7 @@ - * Both of these flags can be defined at once, don't compile without at least - * one of them. */ - #define NON_INETD_MODE --#define INETD_MODE -+/*#define INETD_MODE*/ - - /* Setting this disables the fast exptmod bignum code. It saves ~5kB, but is - * perhaps 20% slower for pubkey operations (it is probably worth experimenting -@@ -81,7 +81,7 @@ much traffic. */ - - /* Enable "Netcat mode" option. This will forward standard input/output - * to a remote TCP-forwarded connection */ --#define ENABLE_CLI_NETCAT -+/*#define ENABLE_CLI_NETCAT*/ - - /* Whether to support "-c" and "-m" flags to choose ciphers/MACs at runtime */ - #define ENABLE_USER_ALGO_LIST -@@ -91,16 +91,16 @@ much traffic. */ - * Including multiple keysize variants the same cipher - * (eg AES256 as well as AES128) will result in a minimal size increase.*/ - #define DROPBEAR_AES128 --#define DROPBEAR_3DES -+/*#define DROPBEAR_3DES*/ - #define DROPBEAR_AES256 - /* Compiling in Blowfish will add ~6kB to runtime heap memory usage */ - /*#define DROPBEAR_BLOWFISH*/ --#define DROPBEAR_TWOFISH256 --#define DROPBEAR_TWOFISH128 -+/*#define DROPBEAR_TWOFISH256*/ -+/*#define DROPBEAR_TWOFISH128*/ - - /* Enable CBC mode for ciphers. This has security issues though - * is the most compatible with older SSH implementations */ --#define DROPBEAR_ENABLE_CBC_MODE -+/*#define DROPBEAR_ENABLE_CBC_MODE*/ - - /* Enable "Counter Mode" for ciphers. This is more secure than normal - * CBC mode against certain attacks. It is recommended for security -@@ -131,10 +131,10 @@ If you test it please contact the Dropbe - * If you disable MD5, Dropbear will fall back to SHA1 fingerprints, - * which are not the standard form. */ - #define DROPBEAR_SHA1_HMAC --#define DROPBEAR_SHA1_96_HMAC -+/*#define DROPBEAR_SHA1_96_HMAC*/ - #define DROPBEAR_SHA2_256_HMAC --#define DROPBEAR_SHA2_512_HMAC --#define DROPBEAR_MD5_HMAC -+/*#define DROPBEAR_SHA2_512_HMAC*/ -+/*#define DROPBEAR_MD5_HMAC*/ - - /* You can also disable integrity. Don't bother disabling this if you're - * still using a cipher, it's relatively cheap. If you disable this it's dead -@@ -146,7 +146,7 @@ If you test it please contact the Dropbe - * Removing either of these won't save very much space. - * SSH2 RFC Draft requires dss, recommends rsa */ - #define DROPBEAR_RSA --#define DROPBEAR_DSS -+/*#define DROPBEAR_DSS*/ - /* ECDSA is significantly faster than RSA or DSS. Compiling in ECC - * code (either ECDSA or ECDH) increases binary size - around 30kB - * on x86-64 */ -@@ -194,7 +194,7 @@ If you test it please contact the Dropbe - - /* Whether to print the message of the day (MOTD). This doesn't add much code - * size */ --#define DO_MOTD -+/*#define DO_MOTD*/ - - /* The MOTD file path */ - #ifndef MOTD_FILENAME -@@ -242,7 +242,7 @@ Homedir is prepended unless path begins - * note that it will be provided for all "hidden" client-interactive - * style prompts - if you want something more sophisticated, use - * SSH_ASKPASS instead. Comment out this var to remove this functionality.*/ --#define DROPBEAR_PASSWORD_ENV "DROPBEAR_PASSWORD" -+/*#define DROPBEAR_PASSWORD_ENV "DROPBEAR_PASSWORD"*/ - - /* Define this (as well as ENABLE_CLI_PASSWORD_AUTH) to allow the use of - * a helper program for the ssh client. The helper program should be diff --git a/package/network/services/dropbear/patches/130-ssh_ignore_x_args.patch b/package/network/services/dropbear/patches/130-ssh_ignore_x_args.patch index ab09c2f3dc..5e736320cc 100644 --- a/package/network/services/dropbear/patches/130-ssh_ignore_x_args.patch +++ b/package/network/services/dropbear/patches/130-ssh_ignore_x_args.patch @@ -1,6 +1,6 @@ --- a/cli-runopts.c +++ b/cli-runopts.c -@@ -296,6 +296,8 @@ void cli_getopts(int argc, char ** argv) +@@ -299,6 +299,8 @@ void cli_getopts(int argc, char ** argv) debug_trace = 1; break; #endif @@ -8,4 +8,4 @@ + break; case 'F': case 'e': - #ifndef ENABLE_USER_ALGO_LIST + #if !DROPBEAR_USER_ALGO_LIST diff --git a/package/network/services/dropbear/patches/140-disable_assert.patch b/package/network/services/dropbear/patches/140-disable_assert.patch index 78b54acfa0..8c3ae7f119 100644 --- a/package/network/services/dropbear/patches/140-disable_assert.patch +++ b/package/network/services/dropbear/patches/140-disable_assert.patch @@ -1,6 +1,6 @@ --- a/dbutil.h +++ b/dbutil.h -@@ -78,7 +78,11 @@ int m_str_to_uint(const char* str, unsig +@@ -75,7 +75,11 @@ int m_str_to_uint(const char* str, unsig #define DEF_MP_INT(X) mp_int X = {0, 0, 0, NULL} /* Dropbear assertion */ diff --git a/package/network/services/dropbear/patches/150-dbconvert_standalone.patch b/package/network/services/dropbear/patches/150-dbconvert_standalone.patch deleted file mode 100644 index ccc2cb7925..0000000000 --- a/package/network/services/dropbear/patches/150-dbconvert_standalone.patch +++ /dev/null @@ -1,14 +0,0 @@ ---- a/options.h -+++ b/options.h -@@ -5,6 +5,11 @@ - #ifndef DROPBEAR_OPTIONS_H_ - #define DROPBEAR_OPTIONS_H_ - -+#if !defined(DROPBEAR_CLIENT) && !defined(DROPBEAR_SERVER) -+#define DROPBEAR_SERVER -+#define DROPBEAR_CLIENT -+#endif -+ - /* Define compile-time options below - the "#ifndef DROPBEAR_XXX .... #endif" - * parts are to allow for commandline -DDROPBEAR_XXX options etc. */ - diff --git a/package/network/services/dropbear/patches/160-lto-jobserver.patch b/package/network/services/dropbear/patches/160-lto-jobserver.patch index bb94492833..02765335d3 100644 --- a/package/network/services/dropbear/patches/160-lto-jobserver.patch +++ b/package/network/services/dropbear/patches/160-lto-jobserver.patch @@ -1,6 +1,6 @@ --- a/Makefile.in +++ b/Makefile.in -@@ -163,17 +163,17 @@ dropbearkey: $(dropbearkeyobjs) +@@ -189,17 +189,17 @@ dropbearkey: $(dropbearkeyobjs) dropbearconvert: $(dropbearconvertobjs) dropbear: $(HEADERS) $(LIBTOM_DEPS) Makefile @@ -12,8 +12,8 @@ + +$(CC) $(LDFLAGS) -o $@$(EXEEXT) $($@objs) $(LIBTOM_LIBS) $(LIBS) dropbearkey dropbearconvert: $(HEADERS) $(LIBTOM_DEPS) Makefile -- $(CC) $(LDFLAGS) -o $@$(EXEEXT) $($@objs) $(LIBTOM_LIBS) -+ +$(CC) $(LDFLAGS) -o $@$(EXEEXT) $($@objs) $(LIBTOM_LIBS) +- $(CC) $(LDFLAGS) -o $@$(EXEEXT) $($@objs) $(LIBTOM_LIBS) $(LIBS) ++ +$(CC) $(LDFLAGS) -o $@$(EXEEXT) $($@objs) $(LIBTOM_LIBS) $(LIBS) # scp doesn't use the libs so is special. scp: $(SCPOBJS) $(HEADERS) Makefile @@ -22,7 +22,7 @@ # multi-binary compilation. -@@ -184,7 +184,7 @@ ifeq ($(MULTI),1) +@@ -210,7 +210,7 @@ ifeq ($(MULTI),1) endif dropbearmulti$(EXEEXT): $(HEADERS) $(MULTIOBJS) $(LIBTOM_DEPS) Makefile diff --git a/package/network/services/dropbear/patches/600-allow-blank-root-password.patch b/package/network/services/dropbear/patches/600-allow-blank-root-password.patch index 7c67b086bb..b138862ca3 100644 --- a/package/network/services/dropbear/patches/600-allow-blank-root-password.patch +++ b/package/network/services/dropbear/patches/600-allow-blank-root-password.patch @@ -1,6 +1,6 @@ --- a/svr-auth.c +++ b/svr-auth.c -@@ -149,7 +149,7 @@ void recv_msg_userauth_request() { +@@ -125,7 +125,7 @@ void recv_msg_userauth_request() { AUTH_METHOD_NONE_LEN) == 0) { TRACE(("recv_msg_userauth_request: 'none' request")) if (valid_user diff --git a/package/network/services/dropbear/patches/610-skip-default-keys-in-custom-runs.patch b/package/network/services/dropbear/patches/610-skip-default-keys-in-custom-runs.patch deleted file mode 100644 index a555a9e498..0000000000 --- a/package/network/services/dropbear/patches/610-skip-default-keys-in-custom-runs.patch +++ /dev/null @@ -1,18 +0,0 @@ ---- a/svr-runopts.c -+++ b/svr-runopts.c -@@ -505,6 +505,7 @@ void load_all_hostkeys() { - m_free(hostkey_file); - } - -+ if (svr_opts.num_hostkey_files <= 0) { - #ifdef DROPBEAR_RSA - loadhostkey(RSA_PRIV_FILENAME, 0); - #endif -@@ -516,6 +517,7 @@ void load_all_hostkeys() { - #ifdef DROPBEAR_ECDSA - loadhostkey(ECDSA_PRIV_FILENAME, 0); - #endif -+ } - - #ifdef DROPBEAR_DELAY_HOSTKEY - if (svr_opts.delay_hostkey) { diff --git a/package/network/services/dropbear/patches/900-configure-hardening.patch b/package/network/services/dropbear/patches/900-configure-hardening.patch new file mode 100644 index 0000000000..ab1361f6ae --- /dev/null +++ b/package/network/services/dropbear/patches/900-configure-hardening.patch @@ -0,0 +1,56 @@ +--- a/configure.ac ++++ b/configure.ac +@@ -70,53 +70,6 @@ AC_ARG_ENABLE(harden, + + if test "$hardenbuild" -eq 1; then + AC_MSG_NOTICE(Checking for available hardened build flags:) +- # relocation flags don't make sense for static builds +- if test "$STATIC" -ne 1; then +- # pie +- DB_TRYADDCFLAGS([-fPIE]) +- +- OLDLDFLAGS="$LDFLAGS" +- TESTFLAGS="-Wl,-pie" +- LDFLAGS="$LDFLAGS $TESTFLAGS" +- AC_LINK_IFELSE([AC_LANG_PROGRAM([])], +- [AC_MSG_NOTICE([Setting $TESTFLAGS])], +- [ +- LDFLAGS="$OLDLDFLAGS" +- TESTFLAGS="-pie" +- LDFLAGS="$LDFLAGS $TESTFLAGS" +- AC_LINK_IFELSE([AC_LANG_PROGRAM([])], +- [AC_MSG_NOTICE([Setting $TESTFLAGS])], +- [AC_MSG_NOTICE([Not setting $TESTFLAGS]); LDFLAGS="$OLDLDFLAGS" ] +- ) +- ] +- ) +- # readonly elf relocation sections (relro) +- OLDLDFLAGS="$LDFLAGS" +- TESTFLAGS="-Wl,-z,now -Wl,-z,relro" +- LDFLAGS="$LDFLAGS $TESTFLAGS" +- AC_LINK_IFELSE([AC_LANG_PROGRAM([])], +- [AC_MSG_NOTICE([Setting $TESTFLAGS])], +- [AC_MSG_NOTICE([Not setting $TESTFLAGS]); LDFLAGS="$OLDLDFLAGS" ] +- ) +- fi # non-static +- # stack protector. -strong is good but only in gcc 4.9 or later +- OLDCFLAGS="$CFLAGS" +- TESTFLAGS="-fstack-protector-strong" +- CFLAGS="$CFLAGS $TESTFLAGS" +- AC_COMPILE_IFELSE([AC_LANG_PROGRAM([])], +- [AC_MSG_NOTICE([Setting $TESTFLAGS])], +- [ +- CFLAGS="$OLDCFLAGS" +- TESTFLAGS="-fstack-protector --param=ssp-buffer-size=4" +- CFLAGS="$CFLAGS $TESTFLAGS" +- AC_COMPILE_IFELSE([AC_LANG_PROGRAM([])], +- [AC_MSG_NOTICE([Setting $TESTFLAGS])], +- [AC_MSG_NOTICE([Not setting $TESTFLAGS]); CFLAGS="$OLDCFLAGS" ] +- ) +- ] +- ) +- # FORTIFY_SOURCE +- DB_TRYADDCFLAGS([-D_FORTIFY_SOURCE=2]) + + # Spectre v2 mitigations + DB_TRYADDCFLAGS([-mfunction-return=thunk]) diff --git a/package/network/services/dropbear/patches/901-bundled-libs-cflags.patch b/package/network/services/dropbear/patches/901-bundled-libs-cflags.patch new file mode 100644 index 0000000000..033aee3a06 --- /dev/null +++ b/package/network/services/dropbear/patches/901-bundled-libs-cflags.patch @@ -0,0 +1,48 @@ +--- a/libtomcrypt/makefile_include.mk ++++ b/libtomcrypt/makefile_include.mk +@@ -75,6 +75,13 @@ endif + + LTC_CFLAGS += -Wno-type-limits + ++ifdef OPENWRT_BUILD ++ ifeq (-Os,$(filter -Os,$(CFLAGS))) ++ LTC_CFLAGS += -DLTC_SMALL_CODE ++ endif ++else ++ ### ! OPENWRT_BUILD ++ + ifdef LTC_DEBUG + $(info Debug build) + # compile for DEBUGGING (required for ccmalloc checking!!!) +@@ -102,6 +109,9 @@ endif + endif # COMPILE_SMALL + endif # COMPILE_DEBUG + ++ ### ! OPENWRT_BUILD ++endif ++ + + ifneq ($(findstring clang,$(CC)),) + LTC_CFLAGS += -Wno-typedef-redefinition -Wno-tautological-compare -Wno-builtin-requires-header -Wno-missing-field-initializers +--- a/libtommath/makefile_include.mk ++++ b/libtommath/makefile_include.mk +@@ -37,6 +37,9 @@ CFLAGS += -Wsystem-headers -Wdeclaration + CFLAGS += -Wstrict-prototypes -Wpointer-arith + endif + ++ifndef OPENWRT_BUILD ++ ### ! OPENWRT_BUILD ++ + ifdef COMPILE_DEBUG + #debug + CFLAGS += -g3 +@@ -58,6 +61,9 @@ endif + endif # COMPILE_SIZE + endif # COMPILE_DEBUG + ++ ### ! OPENWRT_BUILD ++endif ++ + ifneq ($(findstring clang,$(CC)),) + CFLAGS += -Wno-typedef-redefinition -Wno-tautological-compare -Wno-builtin-requires-header + endif From 0197bc0fa82ccc6877f51a2232e276bf686b3307 Mon Sep 17 00:00:00 2001 From: lean Date: Sun, 22 Mar 2020 18:59:40 +0800 Subject: [PATCH 11/11] iwinfo: bump version --- package/lean/luci-app-adbyby-plus/Makefile | 2 +- .../root/usr/share/adbyby/adbybyupdate.sh | 3 ++- package/network/utils/iwinfo/Makefile | 8 ++++---- 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/package/lean/luci-app-adbyby-plus/Makefile b/package/lean/luci-app-adbyby-plus/Makefile index c3710b55ff..98b2bd283f 100644 --- a/package/lean/luci-app-adbyby-plus/Makefile +++ b/package/lean/luci-app-adbyby-plus/Makefile @@ -10,7 +10,7 @@ LUCI_DEPENDS:=+adbyby +wget +ipset +dnsmasq-full LUCI_PKGARCH:=all PKG_NAME:=luci-app-adbyby-plus PKG_VERSION:=2.0 -PKG_RELEASE:=67 +PKG_RELEASE:=68 include $(TOPDIR)/feeds/luci/luci.mk diff --git a/package/lean/luci-app-adbyby-plus/root/usr/share/adbyby/adbybyupdate.sh b/package/lean/luci-app-adbyby-plus/root/usr/share/adbyby/adbybyupdate.sh index ca4c56ffac..2f1153fef1 100755 --- a/package/lean/luci-app-adbyby-plus/root/usr/share/adbyby/adbybyupdate.sh +++ b/package/lean/luci-app-adbyby-plus/root/usr/share/adbyby/adbybyupdate.sh @@ -43,6 +43,7 @@ if [ ! -f "/tmp/adbyby.updated" ];then rm -f /tmp/adbyby/data/*.bak - /etc/init.d/adbyby restart + kill -9 $(busybox ps -w | grep "/tmp/adbyby/adbyby" | grep -v grep | grep -v update | awk '{print $1}') >/dev/null 2>&1 + /tmp/adbyby/adbyby >/dev/null 2>&1 & fi diff --git a/package/network/utils/iwinfo/Makefile b/package/network/utils/iwinfo/Makefile index 7c4839d3ee..b1b60e671c 100644 --- a/package/network/utils/iwinfo/Makefile +++ b/package/network/utils/iwinfo/Makefile @@ -11,9 +11,9 @@ PKG_RELEASE:=1 PKG_SOURCE_PROTO:=git PKG_SOURCE_URL=$(PROJECT_GIT)/project/iwinfo.git -PKG_SOURCE_DATE:=2019-09-22 -PKG_SOURCE_VERSION:=313e82709ba90f3a966f0dd348bcad007ca316be -PKG_MIRROR_HASH:=9d81fbc867eadb91ae6045aef334146c3928c0d353e4aa271f83b55bfa37999d +PKG_SOURCE_DATE:=2020-03-22 +PKG_SOURCE_VERSION:=9f5a7c4f9b78cb2de8fe5dd7af55bf0221706402 +PKG_MIRROR_HASH:=d62cae4b3d2f65c189f179c3dabf1c8c244c5de801439c483ea87dcf8e85b476 PKG_MAINTAINER:=Jo-Philipp Wich PKG_LICENSE:=GPL-2.0 @@ -33,7 +33,7 @@ define Package/libiwinfo CATEGORY:=Libraries TITLE:=Generalized Wireless Information Library (iwinfo) DEPENDS:=+PACKAGE_kmod-cfg80211:libnl-tiny +libuci +libubus - ABI_VERSION:=20181126 + ABI_VERSION:=20200105 endef define Package/libiwinfo/description