Michal Hrusecky [Wed, 11 Oct 2023 06:18:45 +0000 (08:18 +0200)]
curl: Update to version 8.4.0
For detailed changes, see https://curl.se/changes.html#8_4_0
Switching to tar.bz2 for the time being as tar.xz is not yet available.
Fixes CVE-2023-38546 and CVE-2023-38545.
The package should not only depend on a package dropbear but on the dbclient.
Otherwise the dbclient may be disabled during compilation and the dependency will be not satisfied.
Oskari Rauta [Sun, 8 Oct 2023 14:51:50 +0000 (17:51 +0300)]
cni-protocol: update protocol
Changes to protocol file and it's description.
Works better now and restarts firewall automaticly
when tunnel comes available. More informative/guiding
description.
The dbclient doesn't support the -o StrictHostKeyChecking but it has it's own -y option:
-y Always accept remote host key if unknown
-y -y Don't perform any remote host key checking (caution)
So we can add these options to make the StrictHostKeyChecking working.
The dbclient will ignore -o StrictHostKeyChecking but use the -y or -yy instead.
The only problem is that the -y flag is also used by the openssh-client:
-y Send log information using the syslog(3) system module. By default this information is sent to stderr.
This is not critical and once the dbclient start to support the StrictHostKeyChecking we can remove the -y flag.
sshtunnel: set StrictHostKeyChecking=accept-new by default
Without the option the ssh will propt a user to accept the host key.
So a user should perform a connection manualy and accept before useing the sshtunnel.
The accept-new is a reasonable trade off.
Simplify comment and make it shorter.
Remove triling tab after retrydelay.
Use a full path for IdentityFile because otherwise the uci validation fails with the relative path ~/.ssh
Daniel Golle [Fri, 6 Oct 2023 21:38:23 +0000 (23:38 +0200)]
exim: update to version 4.96.1
This is a security release.
JH/01 Bug 2999: Fix a possible OOB write in the external authenticator, which
could be triggered by externally-supplied input. Found by Trend Micro.
CVE-2023-42115
JH/02 Bug 3000: Fix a possible OOB write in the SPA authenticator, which could
be triggered by externally-controlled input. Found by Trend Micro.
CVE-2023-42116
JH/03 Bug 3001: Fix a possible OOB read in the SPA authenticator, which could
be triggered by externally-controlled input. Found by Trend Micro.
CVE-2023-42114
This release includes more Neon and AVX2 optimizations, adds a new codec
control to set per frame QP, upgrades GoogleTest to v1.12.1, and includes
numerous bug fixes.
v1.13.1
This release contains two security related fixes. One each for VP8 and VP9.
Jan Kratochvil [Wed, 4 Oct 2023 19:51:51 +0000 (03:51 +0800)]
ffmpeg: fix compilation error of ffmpeg-custom
Fixes: #12320
After plain enable of libffmpeg-custom and ffmpeg-custom which adds:
- CONFIG_PACKAGE_libbz2=m
- CONFIG_PACKAGE_libffmpeg-custom=m
- CONFIG_FFMPEG_CUSTOM_GPL=y
- CONFIG_PACKAGE_zlib=m
- CONFIG_PACKAGE_ffmpeg-custom=m
I get on v22.03.5 compilation error:
```
cp -fpR /.../openwrt-git/build_dir/target-mips_24kc_musl/ffmpeg-custom/ffmpeg-5.1/ipkg-install/usr/bin/ffmpeg /.../openwrt-git/build_dir/target-mips_24kc_musl/ffmpeg-custom/ffmpeg-5.1/ipkg-mips_24kc/ffmpeg-custom/usr/bin/
cp: cannot stat '/.../openwrt-git/build_dir/target-mips_24kc_musl/ffmpeg-custom/ffmpeg-5.1/ipkg-install/usr/bin/ffmpeg': No such file or directory
make[2]: *** [Makefile:756: /.../openwrt-git/bin/packages/mips_24kc/packages/ffmpeg-custom_5.1-1_mips_24kc.ipk] Error 1
```
It is because configure is missing `ffmpeg` in its `Programs:` section:
```
( cd /.../openwrt-git/build_dir/target-mips_24kc_musl/ffmpeg-custom/ffmpeg-5.1; CFLAGS="-Os -pipe -mno-branch-likely -mips32r2 -mtune=24kc -fno-caller-saves -fno-plt -fhonour-copts -Wno-error=unused-but-set-variable -Wno-error=unused-result -msoft-float -mips16 -minterlink-mips16 -fmacro-prefix-map=/.../openwrt-git/build_dir/target-mips_24kc_musl/ffmpeg-custom/ffmpeg-5.1=ffmpeg-5.1 -Wformat -Werror=format-security -fstack-protector -D_FORTIFY_SOURCE=1 -Wl,-z,now -Wl,-z,relro -I/.../openwrt-git/staging_dir/toolchain-mips_24kc_gcc-11.2.0_musl/usr/include -I/.../openwrt-git/staging_dir/toolchain-mips_24kc_gcc-11.2.0_musl/include/fortify -I/.../openwrt-git/staging_dir/toolchain-mips_24kc_gcc-11.2.0_musl/include -DPIC -fpic" LDFLAGS="-L/.../openwrt-git/staging_dir/toolchain-mips_24kc_gcc-11.2.0_musl/usr/lib -L/.../openwrt-git/staging_dir/toolchain-mips_24kc_gcc-11.2.0_musl/lib -znow -zrelro" ./configure --enable-cross-compile --cross-prefix="mips-openwrt-linux-musl-" --arch="mips" --cpu=24kc --target-os=linux --prefix="/usr" --pkg-config="pkg-config" --enable-shared --enable-static --enable-pthreads --enable-zlib --disable-doc --disable-debug --disable-lzma --disable-vaapi --disable-vdpau --disable-outdevs --disable-altivec --disable-vsx --disable-power8 --disable-armv5te --disable-armv6 --disable-armv6t2 --disable-fast-unaligned --disable-runtime-cpudetect --disable-x86asm --enable-small --enable-gpl --disable-programs --disable-avfilter --disable-swresample --disable-swscale --disable-everything --disable-postproc )
install prefix /usr
source path .
C compiler mips-openwrt-linux-musl-gcc
C library
host C compiler gcc
host C library glibc
ARCH mips (24kc)
big-endian yes
runtime cpu detection no
MIPS FPU enabled no
MIPS DSP R1 enabled no
MIPS DSP R2 enabled no
MIPS MSA enabled no
LOONGSON MMI enabled no
debug symbols no
strip symbols yes
optimize for size yes
optimizations yes
static yes
shared yes
postprocessing support no
network support yes
threading support pthreads
safe bitstream reader yes
texi2html enabled no
perl enabled yes
pod2man enabled yes
makeinfo enabled yes
makeinfo supports HTML no
xmllint enabled yes
Replace the PYTHON3_PYMYSQL_SHA_PASSWORD_SUPPORT option, which is
causing circular dependencies, with a meta-package that installs both
python3-pymysql and python3-cryptography.
Move the order in which BuildPackage is called, so that the libpython
package is built ahead of the module packages, to avoid forcing a
clean-build of the package when 'make package/python3/compile' is called
a second time without changes.
The library must be built first, so that when the buildsystem checks for
ABI version changes using libpython3.version, its timestamp should be
older than the dependent package's STAMP_PREPARED file.
Dirk Brenken [Tue, 3 Oct 2023 19:30:15 +0000 (21:30 +0200)]
banip: release 0.9.1-1
* drop packets silently on input and forwardwan chains or actively reject the traffic, set 'ban_blocktype' accordingly
* optimized banIP boot/reload handling
* removed pppoe quirk in device detection
* small fixes and optimizations
Jeffery To [Tue, 3 Oct 2023 14:26:02 +0000 (22:26 +0800)]
python-cffi: Update to 1.16.0
This includes a patch to unpin the version of setuptools required for
build; the required version is newer than the version bundled with
Python 3.11. This patch should not be necessary when Python 3.12 is
available.
Josef Schlehofer [Fri, 29 Sep 2023 15:40:29 +0000 (17:40 +0200)]
prometheus-node-exporter-lua: drop bmx6 package
In the OpenWrt routing feed, package bmx6 and luci-app-bmx6 were removed because the LuCI app was vulnerable to several CVEs, as found by dependabot. It has been reporting it for a few months and has even created an issue. These two packages are not maintained in OpenWrt as well in upstream.
Users should switch to the bmx7 package.
Fixes: 9fb9d9343ea27d6dbb5008ece10c0c843dd2c781 ("bmx6: drop package") in the routing feed Signed-off-by: Josef Schlehofer <redacted>
Oskari Rauta [Sun, 1 Oct 2023 16:27:49 +0000 (19:27 +0300)]
netavark: update to 1.8.0
changelog:
- iptables: improve error when ip6?tables commands are missing
- docs: Convert markdown with go-md2man instead of mandown
- iptables: drop invalid packages
- bump rust edition to 2021
- Add ACCEPT rules in firewall for bridge network with internal dns
- Add vrf support for bridges
git.99rst.org / openwrt-packages.git / log