From b740d4c1f76ede928a81f68e239393316fcb52f3 Mon Sep 17 00:00:00 2001 From: Beginner <70857188+Beginner-Go@users.noreply.github.com> Date: Tue, 6 Apr 2021 10:09:57 +0800 Subject: [PATCH 1/9] v2ray-core: update to 4.37.1 --- package/lean/v2ray/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/package/lean/v2ray/Makefile b/package/lean/v2ray/Makefile index 2350121370..ac7bfd1e4c 100644 --- a/package/lean/v2ray/Makefile +++ b/package/lean/v2ray/Makefile @@ -9,13 +9,13 @@ include $(TOPDIR)/rules.mk PKG_NAME:=v2ray -PKG_VERSION:=4.37.0 +PKG_VERSION:=4.37.1 PKG_RELEASE:=1 PKG_BUILD_DIR:=$(BUILD_DIR)/v2ray-core-$(PKG_VERSION) PKG_SOURCE:=v2ray-core-$(PKG_VERSION).tar.gz PKG_SOURCE_URL:=https://codeload.github.com/v2fly/v2ray-core/tar.gz/v$(PKG_VERSION)? -PKG_HASH:=64cd43776802493b43d33b0038b71c227cc54ace79164cf19d47c0c1c85aaaf2 +PKG_HASH:=45b8e977477e586c5b3d54b2f7f92c013fd7e88a407237b8f9701a350b706aef PKG_LICENSE:=MIT PKG_LICENSE_FILES:=LICENSE From 2bf1f6771d208d7aadc6254cc7b370a23cf17e54 Mon Sep 17 00:00:00 2001 From: Stijn Tintel Date: Fri, 12 Mar 2021 01:03:22 +0200 Subject: [PATCH 2/9] libcap: import from packages feed Having libcap in OpenWrt base allows us to enable libcap support in other packages in base. In lldpd, this would allow the monitor process to drop its privileges instead of running as root, improving security. It will also allow us to drop our patch to disable libcap. Signed-off-by: Stijn Tintel Acked-by: Hauke Mehrtens Signed-off-by: Tianling Shen --- package/libs/libcap/Makefile | 116 ++++++++++++++++++ .../libcap/patches/300-disable-tests.patch | 10 ++ 2 files changed, 126 insertions(+) create mode 100644 package/libs/libcap/Makefile create mode 100644 package/libs/libcap/patches/300-disable-tests.patch diff --git a/package/libs/libcap/Makefile b/package/libs/libcap/Makefile new file mode 100644 index 0000000000..0206bd9d1d --- /dev/null +++ b/package/libs/libcap/Makefile @@ -0,0 +1,116 @@ +# +# Copyright (C) 2011 OpenWrt.org +# +# This is free software, licensed under the GNU General Public License v2. +# See /LICENSE for more information. +# + +include $(TOPDIR)/rules.mk + +PKG_NAME:=libcap +PKG_VERSION:=2.43 +PKG_RELEASE:=1 + +PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz +PKG_SOURCE_URL:=@KERNEL/linux/libs/security/linux-privs/libcap2 +PKG_HASH:=512a0e5fc4c1e06d472a20da26aa96a9b9bf2a26b23f094f77f1b8da56cc427f + +PKG_MAINTAINER:=Paul Wassi +PKG_LICENSE:=GPL-2.0-only +PKG_LICENSE_FILES:=License + +PKG_INSTALL:=1 +PKG_BUILD_PARALLEL:=1 + +include $(INCLUDE_DIR)/package.mk +include $(INCLUDE_DIR)/kernel.mk + +define Package/libcap/Default + TITLE:=Linux capabilities library + SECTION:=libs + CATEGORY:=Libraries + URL:=https://www.kernel.org/pub/linux/libs/security/linux-privs/libcap2/ +endef + +define Package/libcap/description/Default + Linux capabilities +endef + +define Package/libcap + $(call Package/libcap/Default) + TITLE += library +endef + +define Package/libcap-bin + $(call Package/libcap/Default) + TITLE += binaries + DEPENDS += libcap +endef + +define Package/libcap-bin/description + $(call Package/libcap/description/Default) + . + This package contains the libcap utilities. +endef + +define Package/libcap-bin/config + if PACKAGE_libcap-bin + config PACKAGE_libcap-bin-capsh-shell + string "capsh shell" + help + Set the capsh shell. + default "/bin/sh" + endif +endef + +MAKE_FLAGS += \ + BUILD_CC="$(CC)" \ + BUILD_CFLAGS="$(FPIC) -I$(PKG_BUILD_DIR)/libcap/include" \ + CFLAGS="$(TARGET_CFLAGS)" \ + LD="$(TARGET_CC) -Wl,-x -shared" \ + LDFLAGS="$(TARGET_LDFLAGS)" \ + INDENT="| true" \ + GOLANG="no" \ + PAM_CAP="no" \ + RAISE_SETFCAP="no" \ + DYNAMIC="yes" \ + lib="lib" + +ifneq ($(CONFIG_PACKAGE_libcap-bin-capsh-shell),) +TARGET_CFLAGS += -DSHELL='\"$(CONFIG_PACKAGE_libcap-bin-capsh-shell)\"' +endif + +TARGET_CFLAGS += $(if $(CONFIG_USE_MUSL),-Dpthread_yield=sched_yield) + +define Build/InstallDev + $(INSTALL_DIR) $(1)/usr/include/sys + $(CP) $(PKG_INSTALL_DIR)/usr/include/sys/*.h $(1)/usr/include/sys/ + $(INSTALL_DIR) $(1)/usr/lib + $(CP) $(PKG_INSTALL_DIR)/lib/libcap.{so*,a} $(1)/usr/lib/ + $(INSTALL_DATA) $(PKG_INSTALL_DIR)/lib/libpsx.a $(1)/usr/lib/ + $(INSTALL_DIR) $(1)/usr/lib/pkgconfig + $(INSTALL_DATA) $(PKG_INSTALL_DIR)/lib/pkgconfig/libcap.pc $(1)/usr/lib/pkgconfig/ + $(SED) 's,exec_prefix=,exec_prefix=/usr,g' $(1)/usr/lib/pkgconfig/libcap.pc + $(SED) 's,/lib,$$$${exec_prefix}/lib,g' $(1)/usr/lib/pkgconfig/libcap.pc + $(SED) 's,/usr/include,$$$${prefix}/include,g' $(1)/usr/lib/pkgconfig/libcap.pc + $(INSTALL_DATA) $(PKG_INSTALL_DIR)/lib/pkgconfig/libpsx.pc $(1)/usr/lib/pkgconfig/ + $(SED) 's,exec_prefix=,exec_prefix=/usr,g' $(1)/usr/lib/pkgconfig/libpsx.pc + $(SED) 's,/lib,$$$${exec_prefix}/lib,g' $(1)/usr/lib/pkgconfig/libpsx.pc + $(SED) 's,/usr/include,$$$${prefix}/include,g' $(1)/usr/lib/pkgconfig/libpsx.pc +endef + +define Package/libcap/install + $(INSTALL_DIR) $(1)/usr/lib + $(CP) $(PKG_INSTALL_DIR)/lib/libcap.so* $(1)/usr/lib/ +endef + +define Package/libcap-bin/install + $(INSTALL_DIR) $(1)/usr/sbin + $(CP) $(PKG_INSTALL_DIR)/sbin/capsh $(1)/usr/sbin/ + $(CP) $(PKG_INSTALL_DIR)/sbin/getcap $(1)/usr/sbin/ + $(CP) $(PKG_INSTALL_DIR)/sbin/getpcaps $(1)/usr/sbin/ + $(CP) $(PKG_INSTALL_DIR)/sbin/setcap $(1)/usr/sbin/ +endef + +$(eval $(call BuildPackage,libcap)) +$(eval $(call BuildPackage,libcap-bin)) diff --git a/package/libs/libcap/patches/300-disable-tests.patch b/package/libs/libcap/patches/300-disable-tests.patch new file mode 100644 index 0000000000..c1779e28ec --- /dev/null +++ b/package/libs/libcap/patches/300-disable-tests.patch @@ -0,0 +1,10 @@ +--- a/Makefile ++++ b/Makefile +@@ -17,7 +17,6 @@ ifeq ($(GOLANG),yes) + $(MAKE) -C go $@ + rm -f cap/go.sum + endif +- $(MAKE) -C tests $@ + $(MAKE) -C progs $@ + $(MAKE) -C doc $@ + $(MAKE) -C kdebug $@ From 01601a0bf6947aab59b5ffb0ab49f93397ea0f07 Mon Sep 17 00:00:00 2001 From: Stijn Tintel Date: Fri, 12 Mar 2021 01:03:43 +0200 Subject: [PATCH 3/9] libcap: drop invalid copyright header Signed-off-by: Stijn Tintel Acked-by: Hauke Mehrtens Signed-off-by: Tianling Shen --- package/libs/libcap/Makefile | 2 -- 1 file changed, 2 deletions(-) diff --git a/package/libs/libcap/Makefile b/package/libs/libcap/Makefile index 0206bd9d1d..29ff75c5cd 100644 --- a/package/libs/libcap/Makefile +++ b/package/libs/libcap/Makefile @@ -1,6 +1,4 @@ # -# Copyright (C) 2011 OpenWrt.org -# # This is free software, licensed under the GNU General Public License v2. # See /LICENSE for more information. # From d992dfb22a927757faeb412577e00921cf12692a Mon Sep 17 00:00:00 2001 From: Stijn Tintel Date: Fri, 12 Mar 2021 01:08:25 +0200 Subject: [PATCH 4/9] libcap: bump to 2.48 Signed-off-by: Stijn Tintel Acked-by: Hauke Mehrtens Signed-off-by: Tianling Shen --- package/libs/libcap/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/package/libs/libcap/Makefile b/package/libs/libcap/Makefile index 29ff75c5cd..b8e45a52c7 100644 --- a/package/libs/libcap/Makefile +++ b/package/libs/libcap/Makefile @@ -6,12 +6,12 @@ include $(TOPDIR)/rules.mk PKG_NAME:=libcap -PKG_VERSION:=2.43 +PKG_VERSION:=2.48 PKG_RELEASE:=1 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz PKG_SOURCE_URL:=@KERNEL/linux/libs/security/linux-privs/libcap2 -PKG_HASH:=512a0e5fc4c1e06d472a20da26aa96a9b9bf2a26b23f094f77f1b8da56cc427f +PKG_HASH:=4de9590ee09a87c282d558737ffb5b6175ccbfd26d580add10df44d0f047f6c2 PKG_MAINTAINER:=Paul Wassi PKG_LICENSE:=GPL-2.0-only From b7f06252e31ff0ce028778febc1cfbca4a3b4335 Mon Sep 17 00:00:00 2001 From: Stijn Tintel Date: Fri, 12 Mar 2021 01:10:07 +0200 Subject: [PATCH 5/9] lldpd: add libcap dependency Now that libcap is in OpenWrt base, we can drop our custom patch to disable libcap support and have lldpd depend on it instead. This will allow the monitor process to drop its privileges instead of running as root, improving security. Signed-off-by: Stijn Tintel Signed-off-by: Tianling Shen --- package/network/services/lldpd/Makefile | 4 ++-- .../lldpd/patches/001-disable_libcap.patch | 17 ----------------- 2 files changed, 2 insertions(+), 19 deletions(-) delete mode 100644 package/network/services/lldpd/patches/001-disable_libcap.patch diff --git a/package/network/services/lldpd/Makefile b/package/network/services/lldpd/Makefile index 74d6791091..1329abe874 100644 --- a/package/network/services/lldpd/Makefile +++ b/package/network/services/lldpd/Makefile @@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=lldpd PKG_VERSION:=1.0.7 -PKG_RELEASE:=1 +PKG_RELEASE:=2 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz PKG_SOURCE_URL:=https://media.luffy.cx/files/lldpd @@ -30,7 +30,7 @@ define Package/lldpd SUBMENU:=Routing and Redirection TITLE:=Link Layer Discovery Protocol daemon URL:=https://vincentbernat.github.io/lldpd/ - DEPENDS:=+libevent2 +USE_GLIBC:libbsd +LLDPD_WITH_JSON:libjson-c +LLDPD_WITH_SNMP:libnetsnmp + DEPENDS:=+libcap +libevent2 +USE_GLIBC:libbsd +LLDPD_WITH_JSON:libjson-c +LLDPD_WITH_SNMP:libnetsnmp USERID:=lldp=121:lldp=129 MENU:=1 endef diff --git a/package/network/services/lldpd/patches/001-disable_libcap.patch b/package/network/services/lldpd/patches/001-disable_libcap.patch deleted file mode 100644 index 96cf00a653..0000000000 --- a/package/network/services/lldpd/patches/001-disable_libcap.patch +++ /dev/null @@ -1,17 +0,0 @@ ---- a/configure.ac -+++ b/configure.ac -@@ -246,7 +246,13 @@ PKG_CHECK_MODULES([check], [check >= 0.9 - - # Third-party libraries - lldp_CHECK_LIBEVENT --lldp_CHECK_LIBCAP -+ -+#libcap is not a core package so disable this capability -+#lldp_CHECK_LIBCAP -+libcap_LIBS= -+libcap_CFLAGS= -+AC_SUBST([libcap_LIBS]) -+AC_SUBST([libcap_CFLAGS]) - - # Compatibility with pkg.m4 < 0.27 - m4_ifdef([PKG_INSTALLDIR], [PKG_INSTALLDIR], From 69a15b59c52c16e807743b0c14fb61464c020cd4 Mon Sep 17 00:00:00 2001 From: Stijn Tintel Date: Mon, 5 Apr 2021 17:35:39 +0300 Subject: [PATCH 6/9] lldpd: bump to 1.0.9 Contains fixes related to CVE-2020-27827. Signed-off-by: Stijn Tintel Signed-off-by: Tianling Shen --- package/network/services/lldpd/Makefile | 6 +- ...2-fix-AX_LIB_READLINE-macro-conflict.patch | 61 ------------------- 2 files changed, 3 insertions(+), 64 deletions(-) delete mode 100644 package/network/services/lldpd/patches/002-fix-AX_LIB_READLINE-macro-conflict.patch diff --git a/package/network/services/lldpd/Makefile b/package/network/services/lldpd/Makefile index 1329abe874..5f5ff89740 100644 --- a/package/network/services/lldpd/Makefile +++ b/package/network/services/lldpd/Makefile @@ -8,12 +8,12 @@ include $(TOPDIR)/rules.mk PKG_NAME:=lldpd -PKG_VERSION:=1.0.7 -PKG_RELEASE:=2 +PKG_VERSION:=1.0.9 +PKG_RELEASE:=1 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz PKG_SOURCE_URL:=https://media.luffy.cx/files/lldpd -PKG_HASH:=1df79179d489c841b49265f2ab5ff05f284a647e95862d2f3c02b3fb079a87e1 +PKG_HASH:=6b64eb3125952b1e33472198b054e8aa0dee45f45d3d4be22789090a474949f5 PKG_MAINTAINER:=Stijn Tintel PKG_LICENSE:=ISC diff --git a/package/network/services/lldpd/patches/002-fix-AX_LIB_READLINE-macro-conflict.patch b/package/network/services/lldpd/patches/002-fix-AX_LIB_READLINE-macro-conflict.patch deleted file mode 100644 index 9cdf66f2e7..0000000000 --- a/package/network/services/lldpd/patches/002-fix-AX_LIB_READLINE-macro-conflict.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 23509dc05b24a28fb46022800e0e271ae0118de2 Mon Sep 17 00:00:00 2001 -From: Jo-Philipp Wich -Date: Wed, 9 Dec 2020 12:04:04 +0100 -Subject: [PATCH] build: prevent conflict with official AX_LIB_READLINE macro - -On systems where the official AX_LIB_READLINE (ax_lib_readline.m4) is -present in a globally shared autoconf include directory, auto(re)conf -will prefer including that offical version over the local variant due -to the offical macro having a higher serial number. - -As a consequence, @READLINE_LIBS@ will not be substituted in *.in files, -eventually failing the compilation with errors similar to: - - gcc: error: READLINE_LIBS@: No such file or directory - -Avoid this problem by renaming the incompatible local macro to -AX_LIB_READLINE_LLDPD which is sufficient to prevent any clashes. - -We encountered this problem on OpenWrt which uses GNU autoconf-archive -to provide commonly used M4 macros through a global include directory, -which happens to ship AX_LIB_READLINE as well. - -Signed-off-by: Jo-Philipp Wich ---- - configure.ac | 2 +- - m4/ax_lib_readline.m4 | 6 +++--- - 2 files changed, 4 insertions(+), 4 deletions(-) - ---- a/configure.ac -+++ b/configure.ac -@@ -273,7 +273,7 @@ AC_ARG_WITH([readline], - [], - [with_readline=auto]) - if test x"$with_readline" != x"no"; then -- AX_LIB_READLINE -+ AX_LIB_READLINE_LLDPD - if test x"$with_readline" != x"check" -a x"$with_readline" != x"auto"; then - if test x"$ax_cv_lib_readline" = x"no"; then - AC_MSG_FAILURE([*** no readline support found]) ---- a/m4/ax_lib_readline.m4 -+++ b/m4/ax_lib_readline.m4 -@@ -4,7 +4,7 @@ - # - # SYNOPSIS - # --# AX_LIB_READLINE -+# AX_LIB_READLINE_LLDPD - # - # DESCRIPTION - # -@@ -66,8 +66,8 @@ - - #serial 6 - --AU_ALIAS([VL_LIB_READLINE], [AX_LIB_READLINE]) --AC_DEFUN([AX_LIB_READLINE], [ -+AU_ALIAS([VL_LIB_READLINE], [AX_LIB_READLINE_LLDPD]) -+AC_DEFUN([AX_LIB_READLINE_LLDPD], [ - AC_CACHE_CHECK([for a readline compatible library], - ax_cv_lib_readline, [ - _save_LIBS="$LIBS" From b737530a496117f692b14fa48bb51a6e536c3fcf Mon Sep 17 00:00:00 2001 From: Stijn Tintel Date: Mon, 5 Apr 2021 18:30:45 +0300 Subject: [PATCH 7/9] lldpd: enable LTO Size difference on mips_4kec: W/o LTO: 139674 W/ LTO: 120196 Signed-off-by: Stijn Tintel Suggested-by: Lucian Cristian Signed-off-by: Tianling Shen --- package/network/services/lldpd/Makefile | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/package/network/services/lldpd/Makefile b/package/network/services/lldpd/Makefile index 5f5ff89740..7b9bcccd4d 100644 --- a/package/network/services/lldpd/Makefile +++ b/package/network/services/lldpd/Makefile @@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=lldpd PKG_VERSION:=1.0.9 -PKG_RELEASE:=1 +PKG_RELEASE:=2 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz PKG_SOURCE_URL:=https://media.luffy.cx/files/lldpd @@ -110,4 +110,7 @@ CONFIGURE_ARGS += \ $(if $(CONFIG_LLDPD_WITH_SNMP),--with-snmp,) \ $(if $(CONFIG_USE_GLIBC),,--without-libbsd) +TARGET_CFLAGS += -flto +TARGET_LDFLAGS += -flto + $(eval $(call BuildPackage,lldpd)) From 949e9a6101012a04a7a780834376b8ac72258d62 Mon Sep 17 00:00:00 2001 From: Stijn Tintel Date: Mon, 5 Apr 2021 18:48:41 +0300 Subject: [PATCH 8/9] lldpd: further size reductions Size difference on mips_4kec: Before: 120196 After: 120006 Closes https://github.com/openwrt/openwrt/pull/3823 Signed-off-by: Stijn Tintel Suggested-by: Lucian Cristian Signed-off-by: Tianling Shen --- package/network/services/lldpd/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/package/network/services/lldpd/Makefile b/package/network/services/lldpd/Makefile index 7b9bcccd4d..920e113e66 100644 --- a/package/network/services/lldpd/Makefile +++ b/package/network/services/lldpd/Makefile @@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=lldpd PKG_VERSION:=1.0.9 -PKG_RELEASE:=2 +PKG_RELEASE:=3 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz PKG_SOURCE_URL:=https://media.luffy.cx/files/lldpd @@ -111,6 +111,6 @@ CONFIGURE_ARGS += \ $(if $(CONFIG_USE_GLIBC),,--without-libbsd) TARGET_CFLAGS += -flto -TARGET_LDFLAGS += -flto +TARGET_LDFLAGS += -flto -Wl,--gc-sections,--as-needed $(eval $(call BuildPackage,lldpd)) From 07267d373aa0c609ca4b59758f2fa42b448d5463 Mon Sep 17 00:00:00 2001 From: Hans Dedecker Date: Mon, 5 Apr 2021 18:34:19 +0200 Subject: [PATCH 9/9] glibc: update to latest git HEAD (BZ #27468, BZ #27511) e78ea9bd26 Update Nios II libm-test-ulps. 98bb18f52a malloc: Fix a realloc crash with heap tagging [BZ 27468] fc4ecce85b S390: Also check vector support in memmove ifunc-selector [BZ #27511] Signed-off-by: Hans Dedecker Signed-off-by: Tianling Shen --- toolchain/glibc/common.mk | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/toolchain/glibc/common.mk b/toolchain/glibc/common.mk index 01b15a5cd2..fa6a792f61 100644 --- a/toolchain/glibc/common.mk +++ b/toolchain/glibc/common.mk @@ -12,8 +12,8 @@ PKG_RELEASE:=2 PKG_SOURCE_PROTO:=git PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION) -PKG_SOURCE_VERSION:=db32fc27e7bdfb5468200a94e9152bcc1c971d25 -PKG_MIRROR_HASH:=e02f8b7df03d675db6279b99212c8a645aa50f1ae7789fafd7bc1987145a4c92 +PKG_SOURCE_VERSION:=e78ea9bd26199497b9f047e421f16284297629cf +PKG_MIRROR_HASH:=1e08d10f04333cc6cd82c6cfc4c83a37db6b7ce1523b3f6e56673178379a9c2c PKG_SOURCE_URL:=https://sourceware.org/git/glibc.git PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.xz