| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
14a279411cff fix certificate blob parsing vulnerability by using blob_parse_untrusted
19a7225ac018 fix leaking memory in cert_dump_blob
9dba44ddd4f5 fix possibly garbage value returned in cert_process_revoker
4462ff9dedfa add cram based unit tests
5fe64b5606aa cmake: split usign bits into static library
5d7626a2b6d8 cmake: reindent the file
e284ed941972 cmake: enable hardening compiler flags and fix the reported issues
7e5390666347 add initial GitLab CI support
fa0bf4ef45b1 cmake: add proper include and library dependencies
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 2544cb1ba377149a8663c7ac4a625d5399993e33)
|
|
|
|
|
|
|
|
|
|
| |
- both packages provide ca-certs
- make ca-bundle the default provider
This should allow easy transition between these two forms of CA certificates storage
Signed-off-by: Maxim Storchak <m.storchak@gmail.com>
(cherry picked from commit dd299805ad18472a8245b4524a25e4381e166057)
|
|
|
|
|
|
|
| |
823faa0 block: re-discover mtd devices on extroot mount retry
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 22a178e89282c7bd5bb181fc5c2c5cb6ff2403c8)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Contains following changes:
a5af33ce9a16 instance: strdup string attributes
d2e8bf6ef7cf system: watchdog_set: fix misleading indentation
9814807bd71c system: sysupgrade: fix possibly misleading error
c7a2db3c1eb6 system: sysupgrade: rework firmware validation
ea45c4a0f07c system: fix failing image validation due to EINTR
4fde95506243 cmake: fix lookup of external libraries
5ed190aae1b3 jail: remove accidentally added lines
52c5c1980ba3 jail: set user and group inside jail
3aa051b44177 system: sysupgrade: close input side of pipe before reading
f47622e89c4d instance: Warn about unexpected number of parameters
564ecdfd9cc4 instance: ujail: Fix allocated size for no_new_privs parameter
7fb2e1dfa221 procd: simplify code in procd_inittab_run
4a127c3c60af procd: replace exit(-1) with exit(EXIT_FAILURE)
bc0a73eaad58 procd: add upgraded binary to .gitignore
ba4c4dbbbd65 procd: add start-console support
3e39fe539490 procd: shift arguments for askfirst only once
5d6282906baf procd: skip respawn in case device disappeared
d27949f12fd7 procd: guard fork_worker calls
258aa04328a2 procd: Add cached and available to memory table
8e9fb51fa66e procd: Switch to nanosleep
c844ace9729a system: Fix possible integer overflows
Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Contains following changes:
041c9d1c052b ubusd/libubus-io: fix socket descriptor passing
8f2292478c57 ci: enable unit testing
a1523d76b016 fix blob parsing vulnerability by using blob_parse_untrusted
c60583743ccf ubus_monitor: workaround possibly false positive uses of memory after it is freed
dac6c7c575ac ubusd_monitor: fix possible null pointer dereference
060dfbb26da3 ubus_common: remove duplicate ARRAY_SIZE and add missing include
c5f2053dfcfd workaround possibly false positive uses of memory after it is freed
72be8e93f07d lua: ubus_lua_do_subscribe: fix copy&paste error
a995b1e68129 lua: workaround false positive dereference of null pointer
08f17c87a000 add fuzzer and cram based unit tests
c413be9b376c refactor ubusd.c into reusable ubusd_library
afd47189e864 examples: remove dead increments
b2e544238672 add initial GitLab CI support
058f4e9526ed libubus: fix incompatible pointer types assigment
d2e026a33df8 iron out all extra compiler warnings
5d7ca8309d0a ubusd/libubus-io: fix variable sized struct position warning
d61282db5640 ubusd: fix comparison of integers of different signs
90fb16234c22 cmake: enable extra compiler checks
2e051f628996 ubus: Support static builds
588baa3cd784 ubusd: retry sending messages on EINTR
76ea27a62774 libubus: attempt to receive data before calling poll
4daab27d004f libubus: do not abort recv_retry before completing a message
and bumps ABI_VERSION to 20191227.
Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
|
|
|
|
|
|
|
|
| |
b4e25d5 libblkid-tiny: fix symbol collision with full libblkid
Fixes: FS#2691, FS#2692
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 5f4244150f99d7bf72a96ec4d9c1055386e66b53)
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
111a43f libblkid-tiny: vfat: Change parsing label in special cases
f43a1aa libblkid-tiny: vfat: Fix reading labels which starts with byte 0x05
157924d libblkid-tiny: add blkid_probe_set_id_label() stub
0c5761f libblkid-tiny: use separated buffer for each block device read
b82c5c1 libblkid-tiny: add functions for allocating & freeing probe struct
12851d6 blockd: don't flush devices list on "hotplug" call
5ea47fe blockd: fix vlist memory corruption
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 4ebc9dc9c4faf8d9abc4197a74b892a66d9c1bcb)
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
2f2a09a block: mount_device: err log only when mp deviates from spec
da4edc1 block: mount_device: skip extroot earlier
32c3126 block: mount_action: handle mount/umount deps
fb0700f block: support hierarchical mount/umount
1212b5b block: umount: skip / unless -a is given
eda8b3f block: use fsck.fat instead of dosfsck
d05276d libblkid-tiny: ntfs: fix use-after-free
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry picked from commit e4af39d56395738d86daa4babb379ab605b4d277)
|
|
|
|
|
|
|
|
|
| |
4327ed4 mkdev: Avoid out of bounds read
9b3eb63 libblkid-tiny: use blkid_probe_set_utf8label for label set
c9d0462 libblkid-tiny: adds blkid_probe_set_utf8label support
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 541a3210707d1fc4b439ac61dc06816dcec2ab10)
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
e4bd927 cast ucert_argv to proper type when passing to execv
Fixes warnings:
warning: passing argument 2 of 'execv' from incompatible pointer type
[-Wincompatible-pointer-types]
254 | execv(usign_argv[0], usign_argv)
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 9c272dd3e42a51c1343ed4fad54ac38bb97349dd)
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This decreases the size of the usign application by 16% on MIPS BE.
old:
24,597 /usr/bin/usign
new:
20,501 /usr/bin/usign
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 6ffd8a8f92ab5337ab967ab2922d7de7f0480bc9)
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This decreases the size of the mtd application by 25% on MIPS BE.
old:
20,597 /sbin/mtd
new:
16,421 /sbin/mtd
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 1eb34b7287ed97ad1e2ae60a436babbb5c68076f)
|
|
|
|
|
|
|
| |
77ad0de plugin: avoid truncating numeric values
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit aa89bdcd04676b21cbe3e8a7b8df3545a86d947a)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
d442d62 plugin: fix double free in finish callback
ee26d83 main: exec_self: make clang analyzer happy
90e40bd file: exec: properly free memory on error
9ecfada uci: free configs list memory on return
32fba36 exec: always call finish_cb to allow plugin to free up memory
ca3e2d5 plugin: do not free method name separately
02c6e1d exec: properly free memory on rpc_exec() error
cc50263 plugin: exec: properly free memory on parse error
bd0ed25 uci: reset uci_ptr flags when merging set operations
37aa919 plugin: fix leaking invoked method name for exec plugins
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit c2675bb0cef373ff59fcc2dbd77471d244bbc774)
|
|
|
|
|
|
|
| |
95f0973 file: increase minimum read buffer size to 4096 bytes
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 2a603cfcfccc4b20b10b7992bc07be0945345ed9)
|
|
|
|
|
|
|
| |
e2a7bc4 iwinfo: add WPA3 support
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit d6a405280f0156a2dad7d9cfa96695d53ed87dab)
|
|
|
|
|
|
|
|
|
|
|
|
| |
69eeb1b file: refactor message parsing and permission checking
f65527a iwinfo: expose all rate info fields in assoclist reply
7fec636 sys: fix symbol redeclaration
27c24c7 rpcd: sys: actually move timespec declaration
345363b file: add remove operation
604db20 rpcd: Switch to nanosleep
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 2f9f8769e334d2e8d0bac4edadbcf6bcdd229519)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The fwutil command will interpret the final 16 byte of a given firmware
image files as "struct fwimage_trailer".
In case these bytes do look like a valid trailer, we must ensure that we
print them out along with the remainder of the image to not accidentally
truncate non-trailer-images by 16 bytes when they're piped through fwtool,
e.g. as part of an image verification command sequence.
Some command sequences pipe images through fwtool in order to strip any
possible metadata, certificate or signature trailers and do not expect
bare images without any of that metadata to get truncated as other non-
fwtool specific metadata is expected at the end of the file, e.g. an
information block with an md5sum in case of the combined image format.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 889b841048c5eb7f975135cab363f1fdd9b6cfa1)
|
|
|
|
|
|
|
|
|
|
| |
Since service and instance names may contain characters which are not allowed
in JSON path labels, such as dashes or spaces, change the filter expression
to array square bracket notation to properly match these cases as well.
Fixes: 2c3dd70741 ("procd: add procd_running() helper for checking running state")
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit c933b6d22478c1113629ef549beea6337f978d62)
|
|
|
|
|
|
|
|
| |
62dc8c0 system: sysupgrade: send reply on error
2710c65 system: refuse sysupgrade with backup if it's unsupported
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 04e912d21720b2d906d84aaf172af79a25076a41)
|
|
|
|
|
|
|
|
|
|
| |
b8238df sysupgrade: support "backup" attribute
This update requires "sysupgrade" method callers to pass "backup"
attribute if $UPGRADE_BACKUP is used in the project.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 9785a9121d2d7a0a25bcd2924ee78fafada056da)
|
|
|
|
|
|
|
|
|
|
|
| |
0f3c136 sysupgrade: set UPGRADE_BACKUP env variable
0bcbbbf system: fix uninitialized variables in firmware validation code
This update includes a fix for uninitialized variable usage.
Fixes: db5164d3d056 ("procd: update to the latest git HEAD")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit e8dcbbc865cb6acef1cfbafe77f30c1f003c3dc3)
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
34ac88c system: reject sysupgrade of invalid firmware images by default
f55c235 system: reject sysupgrade of broken firmware images
e990e21 system: add "validate_firmware_image" ubus method
This update changes "sysupgrade" ubus method API. It's now required to
pass "force" attribute whenever invalid firmware is meant to be
installed.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 7290963d0992b9aa412e0066dcf721857fbd40f7)
|
|
|
|
|
|
|
| |
415f9e4 uci/file: replace mktemp() with mkstemp()
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 6aa962a62288952aec08c1f67fb0735f420f720e)
|
|
|
|
|
|
|
|
| |
821045f file: add path based read/write/exec ACL checks
fb337e5 file: add stat() information to directory listings
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 02169bd3f8ccfa3076bb4d46e979d2fdcc7d413e)
|
|
|
|
|
|
|
| |
0430252 sysupgrade: add missing _GNU_SOURCE define (FS#2469)
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
(cherry picked from commit 6e45ba4699eb8424951648cfeddc0a8633f8891e)
|
|
|
|
|
|
|
| |
9558031 system: support passing "options" to the "sysupgrade" ubus method
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 2b1a6d263cc84ac6189447fe971b52d8b34cea51)
|
|
|
|
|
|
|
| |
8323690 state: fix shutdown when running in a container (FS#2425)
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
(cherry picked from commit d9364c1cbc6a13f1dc2ea8432c98962ed157991f)
|
|
|
|
|
|
|
|
|
|
|
|
| |
This changes the default PKG_BUILD_DIR to take BUILD_VARIANT into
account (if set), so that packages do not need to manually override
PKG_BUILD_DIR just to handle variants.
This also updates most base packages with variants to use the updated
default PKG_BUILD_DIR.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit e545fac8d968864a965edb9e50c6f90940b0a6c9)
|
|
|
|
|
|
|
| |
It allows checking if service is running.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 1b937cb14184b5ff9a7a75fbc5d226032f931c35)
|
|
|
|
|
|
|
| |
It allows checking if service is running.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 285c83a004ea57d484e6f27df9ac04d0d7b0f00f)
|
|
|
|
|
|
|
| |
31f0765 procd: check strchr() result before using it
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
(cherry picked from commit 9a72e7f60171d73e4eb83b5ec71df20e48ee5f18)
|
|
|
|
|
|
|
|
|
|
| |
This patch adds two new commands:
zram status - shows memory stats for all zram swaps
zram compaction - trigger compaction for all zram swaps
Signed-off-by: Emil Muratov <gpm@hotplug.ru>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
(cherry picked from commit a9deed62af569608af3e4e076138d788e24b1652)
|
|
|
|
|
|
|
|
|
|
| |
Executing '/etc/init.d/zram start' during runtime (with a swap being already
mounted) triggers zram device compaction and prints out nice stats info about
zram memory usage
Signed-off-by: Emil Muratov <gpm@hotplug.ru>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com> [use IEC's MiB unit]
(cherry picked from commit b062c90f47dd0745562a8f2618c2a43136a4c7e1)
|
|
|
|
|
|
|
|
|
| |
- fix dependency on BUSYBOX_CONFIG_SWAPONOFF (removed in 84da2a6)
- add busybox defaults checking (fix zram-swap always installs swap-utils
and libblkid as dependency, even if busybox includes mkswap by default)
Signed-off-by: Emil Muratov <gpm@hotplug.ru>
(cherry picked from commit c0d93432f2446fbf193ec15e4880cbafa9980779)
|
|
|
|
|
|
|
|
|
|
|
|
| |
The OpenWrt buildroot ABI version rebuild tracker does not handle
transient dependencies, therefor add all libraries linked by rpcd
as direct dependencies to the corresponding binary package definition.
This ensures that rpcd is automatically rebuilt and relinked if any
of these libraries has its ABI_VERSION updated in the future.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit eaad2211dbfb9fdf0815c8d19423069ec099bad2)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
After commit e82a4d9cfb ("config: regenerate *_shipped sources") the mconf
parser became more strict as a side effect and started to spew a series of
warnings when evaluating our generated kconfig sources:
tmp/.config-package.in:705:warning: ignoring unsupported character '@'
The root cause of these warnings is a wrong use of the @SYMBOL dependency
syntax in various Makefile. Fix the corresponding Makefiles by turning
`@SYM||@SYM2` expressions into the proper `@(SYM||SYM2)` form.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 74739c4228f3bd0aa757165c67c53016c3deb544)
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The OpenWrt buildroot ABI version rebuild tracker does not handle
transient dependencies, therefor add all libraries linked by procd
as direct dependencies to the corresponding binary package definition.
This ensures that procd is automatically rebuilt and relinked
if any of these libraries has its ABI_VERSION updated in the
future.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 66838cd8513e50d82996425434efcb260d893180)
|
|
|
|
|
|
|
| |
Let's move project to a proper place.
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit bec8fb1ee7188bfe7eff0f39e060039623e2575e)
|
|
|
|
|
|
|
|
|
| |
Also the other type is worng and causes compile problems on ARM64
platforms.
Fixes: 9b53201d9c53 ("urngd: Fix wrong type in format string")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 1ae1276eab1903d194c1a0f8037e7f44304568b1)
|
|
|
|
|
|
|
|
| |
GCC 9.1 complains about this wrong type used in the format string, fix
this to make the compiler happy.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 9b53201d9c53cd7021455ac9748b3dba744b468b)
|
|
|
|
|
|
|
| |
4df34a4 kmodloader: Increase path array size to make it always fit
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 22d3d91c774f085fbbe607b96c39398c73f7151c)
|
|
|
|
|
|
|
|
|
|
| |
6a61b9a probe: fallback to libblkid.so.1 when libblkid.so does not exist
Also remove deprecation notices from init script while we're at it.
Fixes: FS#2274
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 517cb0b70bebdc283965c7873521f7bf9b4fe736)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Update fstools to commit 1539b535ac327a3bc599d1ca871e14fd0dc3bba1
git log --pretty=oneline --abbrev-commit ff1ded63..1539b535
1539b53 libblkid-tiny: increment label size to 256
d563f3c libblkid-tiny: fix wrong btrfs label length
3957dd3 block: prevent mount point confusion
9b36dc2 libfstools: avoid false positives when matching devices and volumes
Created with the help of the make-package-update-commit.sh script.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
(cherry picked from commit 8036345225ced243782dcea055889fd821897393)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Introduce a new option CONFIG_SIGNATURE_CHECK which defaults to the value
of CONFIG_SIGNED_PACKAGES and thus is enabled by default.
This option is needed to support building target opkg with enabled
signature verification while having the signed package lists disabled.
Our buildbots currently disable package signing globally in the
buildroot and SDK to avoid the need to ship private signing keys to
the build workers and to prevent the triggering of random key generation
on the worker nodes since package signing happens off-line on the master
nodes.
As unintended side-effect, updated opkg packages will get built with
disabled signature verification, hence the need for a new override option.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit f565f276e2c06ac8f3176e0b16d6f2d40cd653d4)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This update fixes usign signature verification on files with certain
file sizes triggering a bug in the shipped SHA-512 implementation.
5a52b37 sha512: fix bad hardcoded constant in sha512_final()
3e6648b README: replace unicode character
716c3f2 README: add reference to OpenBSD signify
86d3668 README: provide reference for ed25519 algorithm
939ec35 usign: main.c: describe necessary arguments for -G
Ref: https://forum.openwrt.org/t/signature-check-failed/41945
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 991dd5a89340367920315a3fd0390a7423e6b34a)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
8080ef3 usign: add 19.07 release build pubkey
e24fe0d usign: use distro agnostic comments
251ded7 usign: fix filename of Stijn's usign key
14f0efc gpg: update snapshots public signing key
14f845b gpg: replace my public GPG key
4f735b8 gpg: add OpenWrt 19.07 signing key
228f8da gpg: add OpenWrt 18.06 v2 signing key
36057d9 gpg: update LEDE 17.01 public signing key
f2989ab Add my public GPG and usign key
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit e9216b3336f7a774be7021dd663a433d9ec5edc7)
|
|
|
|
|
|
|
| |
Let's move project to a proper place.
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit bec8fb1ee7188bfe7eff0f39e060039623e2575e)
|
|
|
|
|
|
|
|
| |
So it's possible to install or remove it as needed.
Tested-by: Lucian Cristian <lucian.cristian@gmail.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 27bfde9c9f789dbfabebf13047e8b042c27cdeef)
|
|
|
|
|
|
|
|
| |
So it's possible to install or remove it as needed.
Tested-by: Lucian Cristian <lucian.cristian@gmail.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 9b4de712cae9b3d745ea4331a804242505f58619)
|