rpi/domo
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Bump buidlroot version to 2018.02.6

Browse Source
This commit is contained in:
jbnadal
2018-10-22 14:55:59 +02:00
parent 222960cedb
commit bec94fdb63
6150 changed files with 84803 additions and 117446 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
bsp/buildroot/package/ipsec-tools/0002-configure-automake.patch Normal file
View File

@@ -0,0 +1,21 @@
Needed to fix broken autoreconf
Downloaded from
https://sources.debian.net/src/ipsec-tools/1:0.8.2%2B20140711-8/debian/patches/automake-options/
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Index: pkg-ipsec-tools/configure.ac
===================================================================
--- pkg-ipsec-tools.orig/configure.ac 2014-06-28 17:25:22.000000000 +0200
+++ pkg-ipsec-tools/configure.ac 2014-06-28 17:28:13.818373322 +0200
@@ -6,7 +6,8 @@ AC_INIT(ipsec-tools, 0.8.2)
AC_CONFIG_SRCDIR([configure.ac])
AC_CONFIG_HEADERS(config.h)
-AM_INIT_AUTOMAKE(dist-bzip2)
+AC_CONFIG_MACRO_DIR([.])
+AM_INIT_AUTOMAKE([dist-bzip2 foreign serial-tests])
AC_ENABLE_SHARED(no)

92
bsp/buildroot/package/ipsec-tools/0003-Don-t-link-against-libfl.patch Normal file
View File

@@ -0,0 +1,92 @@
From e48b9097dce7bc2bfbb9e9c542124d3b5cebab39 Mon Sep 17 00:00:00 2001
From: Paul Barker <paul@paulbarker.me.uk>
Date: Wed, 5 Mar 2014 13:39:14 +0000
Subject: [PATCH] Don't link against libfl
We can remove all references to yywrap by adding "%option noyywrap" statements
to each flex source file that doesn't override yywrap. After this, we no longer
need to link against libfl and so no longer get errors about undefined
references to yylex.
Signed-off-by: Paul Barker <paul@paulbarker.me.uk>
Upstream-status: Submitted 2014-03-11
see http://sourceforge.net/p/ipsec-tools/mailman/ipsec-tools-devel/thread/CANyK_8ewmxGA3vBVJW6s1APXPmxPR%2BDFWZ61EL8pCt288aKQ6w%40mail.gmail.com/#msg32088797
Downloaded from
http://cgit.openembedded.org/meta-openembedded/tree/meta-networking/recipes-support/ipsec-tools/ipsec-tools/0002-Don-t-link-against-libfl.patch
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
---
src/libipsec/Makefile.am | 1 -
src/racoon/Makefile.am | 2 +-
src/racoon/cftoken.l | 2 ++
src/setkey/Makefile.am | 1 -
src/setkey/token.l | 2 ++
5 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/src/libipsec/Makefile.am b/src/libipsec/Makefile.am
index 6a4e3b3..df1e106 100644
--- a/src/libipsec/Makefile.am
+++ b/src/libipsec/Makefile.am
@@ -26,7 +26,6 @@ libipsec_la_SOURCES = \
# version is current:revision:age.
# See: http://www.gnu.org/manual/libtool-1.4.2/html_chapter/libtool_6.html#SEC32
libipsec_la_LDFLAGS = -version-info 0:1:0
-libipsec_la_LIBADD = $(LEXLIB)
noinst_HEADERS = ipsec_strerror.h
diff --git a/src/racoon/Makefile.am b/src/racoon/Makefile.am
index dbaded9..0662957 100644
--- a/src/racoon/Makefile.am
+++ b/src/racoon/Makefile.am
@@ -38,7 +38,7 @@ racoon_SOURCES = \
cftoken.l cfparse.y prsa_tok.l prsa_par.y
EXTRA_racoon_SOURCES = isakmp_xauth.c isakmp_cfg.c isakmp_unity.c throttle.c \
isakmp_frag.c nattraversal.c security.c $(MISSING_ALGOS)
-racoon_LDADD = $(CRYPTOBJS) $(HYBRID_OBJS) $(NATT_OBJS) $(FRAG_OBJS) $(LEXLIB) \
+racoon_LDADD = $(CRYPTOBJS) $(HYBRID_OBJS) $(NATT_OBJS) $(FRAG_OBJS) \
$(SECCTX_OBJS) vmbuf.o sockmisc.o misc.o ../libipsec/libipsec.la
racoon_DEPENDENCIES = \
$(CRYPTOBJS) $(HYBRID_OBJS) $(NATT_OBJS) $(FRAG_OBJS) $(SECCTX_OBJS) \
diff --git a/src/racoon/cftoken.l b/src/racoon/cftoken.l
index 490242c..1701922 100644
--- a/src/racoon/cftoken.l
+++ b/src/racoon/cftoken.l
@@ -106,6 +106,8 @@ static int incstackp = 0;
static int yy_first_time = 1;
%}
+%option noyywrap
+
/* common seciton */
nl \n
ws [ \t]+
diff --git a/src/setkey/Makefile.am b/src/setkey/Makefile.am
index 746c1f1..389e6cf 100644
--- a/src/setkey/Makefile.am
+++ b/src/setkey/Makefile.am
@@ -13,7 +13,6 @@ setkey_SOURCES = \
setkey_LDFLAGS = ../libipsec/libipsec.la
setkey_DEPENDENCIES = ../libipsec/libipsec.la
-setkey_LDADD = $(LEXLIB)
noinst_HEADERS = vchar.h extern.h
man8_MANS = setkey.8
diff --git a/src/setkey/token.l b/src/setkey/token.l
index ad3d843..eb23b76 100644
--- a/src/setkey/token.l
+++ b/src/setkey/token.l
@@ -88,6 +88,8 @@
#endif
%}
+%option noyywrap
+
/* common section */
nl \n
ws [ \t]+
--
1.9.0

0
bsp/buildroot/package/ipsec-tools/0002-CVE-2015-4047.patch → bsp/buildroot/package/ipsec-tools/0004-CVE-2015-4047.patch
View File

208
bsp/buildroot/package/ipsec-tools/0005-CVE-2016-10396.patch Normal file
View File

@@ -0,0 +1,208 @@
Fix CVE-2016-10396
Description: Fix remotely exploitable DoS. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10396
Source: vendor; https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=51682
Bug-debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867986
Downloaded from
https://github.com/openwrt/packages/blob/master/net/ipsec-tools/patches/010-CVE-2016-10396.patch
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Index: ipsec-tools-0.8.2/src/racoon/isakmp_frag.c
===================================================================
--- ipsec-tools-0.8.2.orig/src/racoon/isakmp_frag.c
+++ ipsec-tools-0.8.2/src/racoon/isakmp_frag.c
@@ -1,4 +1,4 @@
-/* $NetBSD: isakmp_frag.c,v 1.5 2009/04/22 11:24:20 tteras Exp $ */
+/* $NetBSD: isakmp_frag.c,v 1.5.36.1 2017/04/21 16:50:42 bouyer Exp $ */
/* Id: isakmp_frag.c,v 1.4 2004/11/13 17:31:36 manubsd Exp */
@@ -173,6 +173,43 @@ vendorid_frag_cap(gen)
return ntohl(hp[MD5_DIGEST_LENGTH / sizeof(*hp)]);
}
+static int
+isakmp_frag_insert(struct ph1handle *iph1, struct isakmp_frag_item *item)
+{
+ struct isakmp_frag_item *pitem = NULL;
+ struct isakmp_frag_item *citem = iph1->frag_chain;
+
+ /* no frag yet, just insert at beginning of list */
+ if (iph1->frag_chain == NULL) {
+ iph1->frag_chain = item;
+ return 0;
+ }
+
+ do {
+ /* duplicate fragment number, abort (CVE-2016-10396) */
+ if (citem->frag_num == item->frag_num)
+ return -1;
+
+ /* need to insert before current item */
+ if (citem->frag_num > item->frag_num) {
+ if (pitem != NULL)
+ pitem->frag_next = item;
+ else
+ /* insert at the beginning of the list */
+ iph1->frag_chain = item;
+ item->frag_next = citem;
+ return 0;
+ }
+
+ pitem = citem;
+ citem = citem->frag_next;
+ } while (citem != NULL);
+
+ /* we reached the end of the list, insert */
+ pitem->frag_next = item;
+ return 0;
+}
+
int
isakmp_frag_extract(iph1, msg)
struct ph1handle *iph1;
@@ -224,39 +261,43 @@ isakmp_frag_extract(iph1, msg)
item->frag_next = NULL;
item->frag_packet = buf;
- /* Look for the last frag while inserting the new item in the chain */
- if (item->frag_last)
- last_frag = item->frag_num;
+ /* Check for the last frag before inserting the new item in the chain */
+ if (item->frag_last) {
+ /* if we have the last fragment, indices must match */
+ if (iph1->frag_last_index != 0 &&
+ item->frag_last != iph1->frag_last_index) {
+ plog(LLV_ERROR, LOCATION, NULL,
+ "Repeated last fragment index mismatch\n");
+ racoon_free(item);
+ vfree(buf);
+ return -1;
+ }
- if (iph1->frag_chain == NULL) {
- iph1->frag_chain = item;
- } else {
- struct isakmp_frag_item *current;
+ last_frag = iph1->frag_last_index = item->frag_num;
+ }
- current = iph1->frag_chain;
- while (current->frag_next) {
- if (current->frag_last)
- last_frag = item->frag_num;
- current = current->frag_next;
- }
- current->frag_next = item;
+ /* insert fragment into chain */
+ if (isakmp_frag_insert(iph1, item) == -1) {
+ plog(LLV_ERROR, LOCATION, NULL,
+ "Repeated fragment index mismatch\n");
+ racoon_free(item);
+ vfree(buf);
+ return -1;
}
- /* If we saw the last frag, check if the chain is complete */
+ /* If we saw the last frag, check if the chain is complete
+ * we have a sorted list now, so just walk through */
if (last_frag != 0) {
+ item = iph1->frag_chain;
for (i = 1; i <= last_frag; i++) {
- item = iph1->frag_chain;
- do {
- if (item->frag_num == i)
- break;
- item = item->frag_next;
- } while (item != NULL);
-
+ if (item->frag_num != i)
+ break;
+ item = item->frag_next;
if (item == NULL) /* Not found */
break;
}
- if (item != NULL) /* It is complete */
+ if (i > last_frag) /* It is complete */
return 1;
}
@@ -291,15 +332,9 @@ isakmp_frag_reassembly(iph1)
}
data = buf->v;
+ item = iph1->frag_chain;
for (i = 1; i <= frag_count; i++) {
- item = iph1->frag_chain;
- do {
- if (item->frag_num == i)
- break;
- item = item->frag_next;
- } while (item != NULL);
-
- if (item == NULL) {
+ if (item->frag_num != i) {
plog(LLV_ERROR, LOCATION, NULL,
"Missing fragment #%d\n", i);
vfree(buf);
@@ -308,6 +343,7 @@ isakmp_frag_reassembly(iph1)
}
memcpy(data, item->frag_packet->v, item->frag_packet->l);
data += item->frag_packet->l;
+ item = item->frag_next;
}
out:
Index: ipsec-tools-0.8.2/src/racoon/isakmp_inf.c
===================================================================
--- ipsec-tools-0.8.2.orig/src/racoon/isakmp_inf.c
+++ ipsec-tools-0.8.2/src/racoon/isakmp_inf.c
@@ -720,6 +720,7 @@ isakmp_info_send_nx(isakmp, remote, loca
#endif
#ifdef ENABLE_FRAG
iph1->frag = 0;
+ iph1->frag_last_index = 0;
iph1->frag_chain = NULL;
#endif
Index: ipsec-tools-0.8.2/src/racoon/isakmp.c
===================================================================
--- ipsec-tools-0.8.2.orig/src/racoon/isakmp.c
+++ ipsec-tools-0.8.2/src/racoon/isakmp.c
@@ -1071,6 +1071,7 @@ isakmp_ph1begin_i(rmconf, remote, local)
iph1->frag = 1;
else
iph1->frag = 0;
+ iph1->frag_last_index = 0;
iph1->frag_chain = NULL;
#endif
iph1->approval = NULL;
@@ -1175,6 +1176,7 @@ isakmp_ph1begin_r(msg, remote, local, et
#endif
#ifdef ENABLE_FRAG
iph1->frag = 0;
+ iph1->frag_last_index = 0;
iph1->frag_chain = NULL;
#endif
iph1->approval = NULL;
Index: ipsec-tools-0.8.2/src/racoon/handler.h
===================================================================
--- ipsec-tools-0.8.2.orig/src/racoon/handler.h
+++ ipsec-tools-0.8.2/src/racoon/handler.h
@@ -1,4 +1,4 @@
-/* $NetBSD: handler.h,v 1.25 2010/11/17 10:40:41 tteras Exp $ */
+/* $NetBSD: handler.h,v 1.26 2017/01/24 19:23:56 christos Exp $ */
/* Id: handler.h,v 1.19 2006/02/25 08:25:12 manubsd Exp */
@@ -141,6 +141,7 @@ struct ph1handle {
#endif
#ifdef ENABLE_FRAG
int frag; /* IKE phase 1 fragmentation */
+ int frag_last_index;
struct isakmp_frag_item *frag_chain; /* Received fragments */
#endif

6
bsp/buildroot/package/ipsec-tools/Config.in
View File

@@ -12,8 +12,8 @@ config BR2_PACKAGE_IPSEC_TOOLS
if BR2_PACKAGE_IPSEC_TOOLS
config BR2_PACKAGE_IPSEC_TOOLS_ADMINPORT
default y
bool "Enable racoonctl(8)"
default y
help
Lets racoon to listen to racoon admin port, which is to
be contacted by racoonctl(8).
@@ -42,12 +42,12 @@ config BR2_PACKAGE_IPSEC_TOOLS_DPD
Enable dead peer detection support
config BR2_PACKAGE_IPSEC_TOOLS_STATS
default y
bool "Enable statistics logging function"
default y
config BR2_PACKAGE_IPSEC_TOOLS_READLINE
select BR2_PACKAGE_READLINE
bool "Enable readline input support"
select BR2_PACKAGE_READLINE
config BR2_PACKAGE_IPSEC_TOOLS_HYBRID
bool "Enable hybrid, both mode-cfg and xauth support"

4
bsp/buildroot/package/ipsec-tools/ipsec-tools.mk
View File

@@ -9,7 +9,9 @@ IPSEC_TOOLS_SOURCE = ipsec-tools-$(IPSEC_TOOLS_VERSION).tar.bz2
IPSEC_TOOLS_SITE = http://sourceforge.net/projects/ipsec-tools/files/ipsec-tools/$(IPSEC_TOOLS_VERSION)
IPSEC_TOOLS_INSTALL_STAGING = YES
IPSEC_TOOLS_MAKE = $(MAKE1)
IPSEC_TOOLS_DEPENDENCIES = openssl flex host-flex
IPSEC_TOOLS_DEPENDENCIES = openssl flex host-flex host-bison
# we patch configure.ac
IPSEC_TOOLS_AUTORECONF = YES
# configure hardcodes -Werror, so override CFLAGS on make invocation
IPSEC_TOOLS_MAKE_OPTS = CFLAGS='$(TARGET_CFLAGS)'