diff options
40 files changed, 899 insertions, 1323 deletions
diff --git a/aports/base-layout/APKBUILD b/aports/base-layout/APKBUILD index 7597bc4..9b46b78 100644 --- a/aports/base-layout/APKBUILD +++ b/aports/base-layout/APKBUILD @@ -1,16 +1,16 @@ # Maintainer: Gabor Pali <pali.gabor@gmail.com> pkgname=baselayout -pkgver=3.2.0 -pkgrel=21 # base: 23 +pkgver=3.4.0 +pkgrel=0 # base: 0 pkgdesc="Base dir structure and init scripts (Alpine Linux)" url="https://git.alpinelinux.org/cgit/aports/tree/main/alpine-baselayout" -arch="all" +arch="noarch" license="GPL-2.0-only" pkggroups="shadow" options="!fhs !check" install= -_nbver=6.2 +_nbver=6.4 source="crontab locale.sh @@ -195,7 +195,7 @@ b2fc9b72846a43a45ba9a8749e581cef34d1915836833b51b7919dfbf4e275b7d55fec4dea7b23df 806b8f23f823a9471846d12fa6b55690b95eedb4c613b82aefaba7ffef23f83e17552befd891a487864f72ef24e395d8611738933f684a85eb4c336cb20994f8 group 7cc3c23062c730ec7a1d7850423d9901047005520da5b347b7b24e5f33a9c9a9129b430557f7f41e565f143624b7f3c47e3f6e4a6a446e75f0ea245c03d70880 inittab 06d12a7b9ca14fe17e412d0f24814620b67d035ae859be7906cbf4782dd69e359a6a555dafb98060b7fb7e4714aaa676c88d9017cded36e6d8398e23369bb290 passwd -b14920eae431d1f15b066e264a94f804540c5dcbf91caef034019d95456c975c0c054672e53369082682dd9454a034f26bd45b312adfc0ab68a0311d97b037ac profile -eadc83e47fcc354ab83fd109bee452bda170886fb684e67faf615930c11480919505f4af60c685b124efc54af0ded9522663132f911eac6622144f8b4c8be695 protocols-6.2 -adfae0d2f569c2a2f413b7e27683a007fc8ca689b8c3349672fe0dcb6208c192ede4402eff09c604b7e7b4fd9d8df93b875efa5bdaa6c14ff1d8022a7caad5cd services-6.2 +a15252a5eb90983775f63e54d37242f4c76c5c358ad6d8c1622c7da35f1b8a722249e7375a07e9f08fbb25318bd1eb033d3927aed82c3f5e9b854ad550dad2ce profile +3a00083bcdf5a9e884c9d07877d52311e3d99e79cbee656e236ba06e08ba0dddb7ba76494fdc9dd1a826c48e197a790a69e6bb458e9df64832d6b5e904e9fd15 protocols-6.4 +47b0f3ee73af2d259bd206a026204be0ea25531a895a0b035a904b38fe5407bc3dd2beab7f8fcb3d760587e6159702ebdb9cbc4f508942befdf7f10c10c87888 services-6.4 " diff --git a/aports/base-layout/profile b/aports/base-layout/profile index fd7506b..e62587b 100644 --- a/aports/base-layout/profile +++ b/aports/base-layout/profile @@ -22,20 +22,18 @@ export PATH export PAGER=less umask 022 -# set up fallback default PS1 -: "${HOSTNAME:=$(hostname)}" -PS1='${HOSTNAME%%.*}:$PWD' -[ "$(id -u)" = "0" ] && PS1="${PS1}# " -[ "$(id -u)" = "0" ] || PS1="${PS1}\$ " - # use nicer PS1 for bash and busybox ash -[ -n "$BASH_VERSION" -o "$BB_ASH_VERSION" ] && PS1='\h:\w\$ ' - +if [ -n "$BASH_VERSION" -o "$BB_ASH_VERSION" ]; then + PS1='\h:\w\$ ' # use nicer PS1 for zsh -[ -n "$ZSH_VERSION" ] && PS1='%m:%~%# ' - -# export PS1 as before -export PS1 +elif [ -n "$ZSH_VERSION" ]; then + PS1='%m:%~%# ' +# set up fallback default PS1 +else + : "${HOSTNAME:=$(hostname)}" + PS1='${HOSTNAME%%.*}:$PWD' + [ "$(id -u)" -eq 0 ] && PS1="${PS1}# " || PS1="${PS1}\$ " +fi for script in /etc/profile.d/*.sh ; do if [ -r "$script" ] ; then diff --git a/aports/broadcom-wl/APKBUILD b/aports/broadcom-wl/APKBUILD index ae7cd74..4e19807 100644 --- a/aports/broadcom-wl/APKBUILD +++ b/aports/broadcom-wl/APKBUILD @@ -2,7 +2,7 @@ pkgname=broadcom-wl pkgver=6.30.223.271 -pkgrel=5 +pkgrel=6 pkgdesc='Broadcom 802.11 Linux STA wireless driver' arch="x86_64" url='https://www.broadcom.com/support/download-search/?pf=Wireless+LAN+Infrastructure' diff --git a/aports/busybox/0001-avoid-redefined-warnings-when-building-with-utmps.patch b/aports/busybox/0001-avoid-redefined-warnings-when-building-with-utmps.patch index 083b8a8..1ce06f8 100644 --- a/aports/busybox/0001-avoid-redefined-warnings-when-building-with-utmps.patch +++ b/aports/busybox/0001-avoid-redefined-warnings-when-building-with-utmps.patch @@ -1,6 +1,6 @@ -From 770825e4730fadc0b7fc5a0f154eb368a37564a0 Mon Sep 17 00:00:00 2001 +From 711de34e8fa42bd9ec704cc922db937edada84d8 Mon Sep 17 00:00:00 2001 From: Laurent Bercot <ska-devel@skarnet.org> -Date: Wed, 20 Jul 2022 10:39:22 +0200 +Date: Fri, 22 Jul 2022 01:35:14 +0200 Subject: [PATCH] Avoid redefined warnings when buiding with utmps Do not use _PATH_UTMP or _PATH_WTMP, and do not touch @@ -13,7 +13,7 @@ the files directly. 4 files changed, 10 insertions(+), 12 deletions(-) diff --git a/include/libbb.h b/include/libbb.h -index abbc9ac59..9710e804c 100644 +index abbc9ac59..405108b17 100644 --- a/include/libbb.h +++ b/include/libbb.h @@ -107,14 +107,12 @@ @@ -21,7 +21,7 @@ index abbc9ac59..9710e804c 100644 # else # if !defined(__FreeBSD__) -# include <utmp.h> -+# include <utmps/utmps.h> ++# include <utmpx.h> +# define _CORRECT_PATH_UTMPX "/run/utmps/utmp" +# define _CORRECT_PATH_WTMP "/var/log/wtmp" # else diff --git a/aports/busybox/0001-sed-check-errors-writing-file-with-sed-i.patch b/aports/busybox/0001-sed-check-errors-writing-file-with-sed-i.patch new file mode 100644 index 0000000..90a5115 --- /dev/null +++ b/aports/busybox/0001-sed-check-errors-writing-file-with-sed-i.patch @@ -0,0 +1,66 @@ +From b99395ebf70eadb248da0ecf913eea0236eceea1 Mon Sep 17 00:00:00 2001 +From: Dominique Martinet <dominique.martinet@atmark-techno.com> +Date: Wed, 16 Nov 2022 11:52:29 +0900 +Subject: [PATCH] sed: check errors writing file with sed -i + +sed would currently not error if write failed when modifying a file. + +This can be reproduced with the following 'script': +$ sudo mount -t tmpfs tmpfs -o size=1M /tmp/m +$ sudo chmod 777 /tmp/m +$ echo foo > /tmp/m/foo +$ dd if=/dev/zero of=/tmp/m/fill bs=4k +dd: error writing '/tmp/m/fill': No space left on device +256+0 records in +255+0 records out +1044480 bytes (1.0 MB, 1020 KiB) copied, 0.00234567 s, 445 MB/s +$ busybox sed -i -e 's/.*/bar/' /tmp/m/foo +$ echo $? +0 +$ cat /tmp/m/foo +<empty> + +new behaviour: +$ echo foo > /tmp/m/foo +$ ./busybox sed -i -e 's/.*/bar/' /tmp/m/foo +sed: write error +$ echo $? +4 +$ cat /tmp/m/foo +foo + +function old new delta +sed_main 754 801 +47 +------------------------------------------------------------------------------ +(add/remove: 0/0 grow/shrink: 1/0 up/down: 47/0) Total: 47 bytes + text data bss dec hex filename + 66957 2398 1552 70907 114fb busybox_old + 67004 2398 1552 70954 1152a busybox_unstripped + +Signed-off-by: Dominique Martinet <dominique.martinet@atmark-techno.com> +--- +Upstream patch: +http://lists.busybox.net/pipermail/busybox/2022-November/089967.html + + editors/sed.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/editors/sed.c b/editors/sed.c +index 32a4b61f6d4c..be709eef3a9c 100644 +--- a/editors/sed.c ++++ b/editors/sed.c +@@ -1639,6 +1639,11 @@ int sed_main(int argc UNUSED_PARAM, char **argv) + fchown(nonstdoutfd, statbuf.st_uid, statbuf.st_gid); + + process_files(); ++ fflush(G.nonstdout); ++ if (ferror(G.nonstdout)) { ++ xfunc_error_retval = 4; /* It's what gnu sed exits with... */ ++ bb_simple_error_msg_and_die(bb_msg_write_error); ++ } + fclose(G.nonstdout); + G.nonstdout = stdout; + +-- +2.35.1 + diff --git a/aports/busybox/0004-app-location-for-cpio-vi-and-lspci.patch b/aports/busybox/0004-app-location-for-cpio-vi-and-lspci.patch index 964db5df..2ca4bcd 100644 --- a/aports/busybox/0004-app-location-for-cpio-vi-and-lspci.patch +++ b/aports/busybox/0004-app-location-for-cpio-vi-and-lspci.patch @@ -1,4 +1,4 @@ -From 3f44fe588d0d68ff5897928b65c0749505937d8d Mon Sep 17 00:00:00 2001 +From 97d4a0ffc6f58813fd91e5728d474b984f29b9a6 Mon Sep 17 00:00:00 2001 From: Natanael Copa <ncopa@alpinelinux.org> Date: Tue, 27 Dec 2016 20:46:59 +0100 Subject: [PATCH] app location for cpio, vi and lspci @@ -11,12 +11,12 @@ Adjust location to where alpine linux installs them 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/archival/cpio.c b/archival/cpio.c -index d84f6937d..29e7d396a 100644 +index 7149782d7..ee80efd9f 100644 --- a/archival/cpio.c +++ b/archival/cpio.c -@@ -39,7 +39,7 @@ +@@ -53,7 +53,7 @@ //config: help - //config: Passthrough mode. Rarely used. + //config: Optionally renumber inodes when creating archives. -//applet:IF_CPIO(APPLET(cpio, BB_DIR_BIN, BB_SUID_DROP)) +//applet:IF_CPIO(APPLET(cpio, BB_DIR_USR_BIN, BB_SUID_DROP)) @@ -24,7 +24,7 @@ index d84f6937d..29e7d396a 100644 //kbuild:lib-$(CONFIG_CPIO) += cpio.o diff --git a/editors/vi.c b/editors/vi.c -index 3e1bd0820..774da291f 100644 +index 3dbe5b471..b29c16098 100644 --- a/editors/vi.c +++ b/editors/vi.c @@ -176,7 +176,7 @@ diff --git a/aports/busybox/0018-ash-fix-ifs-cleanup-on-error-paths.patch b/aports/busybox/0018-ash-fix-ifs-cleanup-on-error-paths.patch new file mode 100644 index 0000000..c09bc84 --- /dev/null +++ b/aports/busybox/0018-ash-fix-ifs-cleanup-on-error-paths.patch @@ -0,0 +1,91 @@ +From 1c5455284234e894dfb6086bf7f3e9a6d5d9611f Mon Sep 17 00:00:00 2001 +From: Denys Vlasenko <vda.linux@googlemail.com> +Date: Tue, 2 Aug 2022 11:13:44 +0200 +Subject: [PATCH] ash: fix ifs cleanup on error paths + +Patch by Alex Gorinson <algore3698@gmail.com> + +function old new delta +evalvar 477 495 +18 +varvalue 603 618 +15 +subevalvar 1557 1572 +15 +------------------------------------------------------------------------------ +(add/remove: 0/0 grow/shrink: 3/0 up/down: 48/0) Total: 48 bytes + +Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com> +--- + shell/ash.c | 2 ++ + shell/ash_test/ash-heredoc/heredoc_and_cmd.right | 2 ++ + shell/ash_test/ash-heredoc/heredoc_and_cmd.tests | 8 ++++++++ + shell/hush_test/hush-heredoc/heredoc_and_cmd.right | 2 ++ + shell/hush_test/hush-heredoc/heredoc_and_cmd.tests | 8 ++++++++ + 5 files changed, 22 insertions(+) + create mode 100644 shell/ash_test/ash-heredoc/heredoc_and_cmd.right + create mode 100755 shell/ash_test/ash-heredoc/heredoc_and_cmd.tests + create mode 100644 shell/hush_test/hush-heredoc/heredoc_and_cmd.right + create mode 100755 shell/hush_test/hush-heredoc/heredoc_and_cmd.tests + +diff --git a/shell/ash.c b/shell/ash.c +index d29de37b7..c731a333b 100644 +--- a/shell/ash.c ++++ b/shell/ash.c +@@ -7028,6 +7028,7 @@ varunset(const char *end, const char *var, const char *umsg, int varflags) + msg = umsg; + } + } ++ ifsfree(); + ash_msg_and_raise_error("%.*s: %s%s", (int)(end - var - 1), var, msg, tail); + } + +@@ -7453,6 +7454,7 @@ varvalue(char *name, int varflags, int flags, int quoted) + if (discard) + return -1; + ++ ifsfree(); + raise_error_syntax("bad substitution"); + } + +diff --git a/shell/ash_test/ash-heredoc/heredoc_and_cmd.right b/shell/ash_test/ash-heredoc/heredoc_and_cmd.right +new file mode 100644 +index 000000000..25ae70561 +--- /dev/null ++++ b/shell/ash_test/ash-heredoc/heredoc_and_cmd.right +@@ -0,0 +1,2 @@ ++./heredoc_and_cmd.tests: line 4: D: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA ++Y +diff --git a/shell/ash_test/ash-heredoc/heredoc_and_cmd.tests b/shell/ash_test/ash-heredoc/heredoc_and_cmd.tests +new file mode 100755 +index 000000000..197542de7 +--- /dev/null ++++ b/shell/ash_test/ash-heredoc/heredoc_and_cmd.tests +@@ -0,0 +1,8 @@ ++# The bug was only happening with <<REDIR;CMD form below: ++M='AAAAAAAAAAAAAAAAA' ++fff(){ ++date <<000; echo Y ++${D?$M$M$M$M$M$M} ++000 ++} ++fff +diff --git a/shell/hush_test/hush-heredoc/heredoc_and_cmd.right b/shell/hush_test/hush-heredoc/heredoc_and_cmd.right +new file mode 100644 +index 000000000..5c19a0621 +--- /dev/null ++++ b/shell/hush_test/hush-heredoc/heredoc_and_cmd.right +@@ -0,0 +1,2 @@ ++hush: D: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA ++Y +diff --git a/shell/hush_test/hush-heredoc/heredoc_and_cmd.tests b/shell/hush_test/hush-heredoc/heredoc_and_cmd.tests +new file mode 100755 +index 000000000..197542de7 +--- /dev/null ++++ b/shell/hush_test/hush-heredoc/heredoc_and_cmd.tests +@@ -0,0 +1,8 @@ ++# The bug was only happening with <<REDIR;CMD form below: ++M='AAAAAAAAAAAAAAAAA' ++fff(){ ++date <<000; echo Y ++${D?$M$M$M$M$M$M} ++000 ++} ++fff diff --git a/aports/busybox/APKBUILD b/aports/busybox/APKBUILD index 18e2308..112c885 100644 --- a/aports/busybox/APKBUILD +++ b/aports/busybox/APKBUILD @@ -1,13 +1,13 @@ # Maintainer: Gabor Pali <pali.gabor@gmail.com> pkgname=busybox pkgver=1.35.0 -pkgrel=2 # base: 17, -initscripts: 4.2-r0 +pkgrel=3 # base: 29 pkgdesc="Size optimized toolbox of many common UNIX utilities" url="https://busybox.net/" arch="all" license="GPL-2.0-only" makedepends_build="perl" -makedepends_host="linux-headers openssl-dev" +makedepends_host="linux-headers openssl-dev>3" # Only build with UTMPS support if we are not bootstrapping. # skalibs-static is needed for utmps-static [ -z "$BOOTSTRAP" ] && makedepends_host="$makedepends_host utmps-dev utmps-static skalibs-static" @@ -17,6 +17,14 @@ provides="/bin/sh" install= subpackages= options="!check" + +_openrc_files="acpid.initd + crond.confd crond.initd + defaults.initd + syslog.confd syslog.initd + udhcpd.confd udhcpd.initd" +_mdev_openrc_files="mdev.initd" + source="https://busybox.net/downloads/busybox-$pkgver.tar.bz2 0001-nologin-Install-applet-to-sbin-instead-of-usr-sbin.patch 0001-adduser-default-to-sbin-nologin-as-shell-for-system-.patch @@ -37,34 +45,29 @@ source="https://busybox.net/downloads/busybox-$pkgver.tar.bz2 0015-ed-don-t-use-memcpy-with-overlapping-memory-regions.patch 0016-ash-don-t-read-past-end-of-var-in-subvareval-for-bas.patch 0017-ash-Fix-use-after-free-on-idx-variable.patch + 0018-ash-fix-ifs-cleanup-on-error-paths.patch + 0001-ash-add-built-in-BB_ASH_VERSION-variable.patch + 0001-pgrep-add-support-for-matching-against-UID-and-RUID.patch + 0001-avoid-redefined-warnings-when-building-with-utmps.patch + 0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch 0002-nslookup-sanitize-all-printed-strings-with-printable.patch 0001-modinfo-add-k-option-for-kernel-version.patch CVE-2022-30065.patch + 0001-sed-check-errors-writing-file-with-sed-i.patch acpid.logrotate config default.script - - acpid.initd - crond.initd - mdev.initd - syslog.initd - udhcpd.initd - defaults.initd - - crond.confd - syslog.confd - udhcpd.confd - mdev.conf - persistent-storage - " + $_openrc_files + $_mdev_openrc_files +" # secfixes: -# 1.35.0-r15: +# 1.35.0-r17: # - CVE-2022-30065 # 1.35.0-r7: # - ALPINE-13661 @@ -108,6 +111,12 @@ prepare() { } build() { + local _extra_cflags= _extra_libs= + if [ -z "$BOOTSTRAP" ] ; then + _extra_cflags="$(pkg-config --cflags --static utmps)" + _extra_libs="$(pkg-config --libs --static utmps)" + fi + cd "$srcdir"/build echo "COPIED CONFIG to $(pwd)/.config" cp "$srcdir"/config .config @@ -115,16 +124,25 @@ build() { -e "s/CONFIG_EXTRA_COMPAT=y/CONFIG_EXTRA_COMPAT=n/" \ .config make -C "$builddir" O="$PWD" silentoldconfig - make + make CONFIG_EXTRA_CFLAGS="$_extra_cflags" CONFIG_EXTRA_LDLIBS="$_extra_libs" } package() { - local i + local file - cd "$srcdir"/build mkdir -p "$pkgdir"/usr/sbin "$pkgdir"/usr/bin "$pkgdir"/tmp \ - "$pkgdir"/var/cache/misc "$pkgdir"/bin "$pkgdir"/sbin + "$pkgdir"/var/cache/misc "$pkgdir"/bin "$pkgdir"/sbin \ + "$pkgdir"/etc/conf.d "$pkgdir"/etc/init.d chmod 1777 "$pkgdir"/tmp + cd "$srcdir" + for file in *.confd; do + install -D -m 0644 ${file} "$pkgdir"/etc/conf.d/${file%%\.confd} + done + for file in *.initd; do + install -D -m 0755 ${file} "$pkgdir"/etc/init.d/${file%%\.initd} + done + + cd "$srcdir"/build install -m755 busybox "$pkgdir"/bin/busybox for target in $("$pkgdir"/bin/busybox --list-full | sort); do @@ -162,27 +180,12 @@ EOF install -Dm755 "$srcdir"/default.script \ "$pkgdir"/usr/share/udhcpc/default.script - # deploy init scripts cd "$srcdir" - mkdir -p "$pkgdir"/etc/conf.d "$pkgdir"/etc/init.d "$pkgdir"/lib/mdev\ - "$pkgdir"/etc/acpi/PWRF - for i in *.initd; do - install -m755 "$srcdir"/$i "$pkgdir"/etc/init.d/${i%.*} || return 1 - done - for i in *.confd; do - install -m644 "$srcdir"/$i "$pkgdir"/etc/conf.d/${i%.*} || return 1 - done - install -m644 mdev.conf "$pkgdir"/etc - install -m755 persistent-storage \ - "$pkgdir"/lib/mdev/ - + mkdir -p "$pkgdir"/etc/acpi/PWRF # poweroff script for acpid - cat >"$pkgdir"/etc/acpi/PWRF/00000080 <<EOF -#!/bin/sh -poweroff -EOF - chmod +x "$pkgdir"/etc/acpi/PWRF/00000080 + { echo '#!/bin/sh'; echo poweroff ; } > "$pkgdir"/etc/acpi/PWRF/00000080 + chmod 0755 "$pkgdir"/etc/acpi/PWRF/00000080 } sha512sums=" @@ -193,7 +196,7 @@ a2787a3ecaf6746dadef62166e8ee6ecaa166147e5ad8b917c5838536057c875bab5f9cf40c3e05e 0cac9b944928500293e366b42e03211d4159d05b622da60664825e5ee87c9bf6d5a8ea5e794584713f7464efb4cdc431e02f439c717b7e62b1864a228bc8cbac 0001-modutils-check-ELF-header-before-calling-finit_module.patch d8694293edc8cd55cecafeb902f03c01af318e13966f399365cf792b840793891ac086bb67ef83e7a5a2e01b246497a6c6511cb6a856834f6672dee4bca76896 0002-fsck-resolve-LABEL-.-UUID-.-spec-to-device.patch 8c34dd5ce9a6e84279fa6494cbae0b254778976f341af1d0ccc2a3afb405fb22d374e9623ea83d1500da77c7463db2ed5218d2c9f49350a21114bd0bb17fd87d 0003-ash-exec-busybox.static.patch -a8fc2ccced4054f5eff6ea00389906a543a1716202b19ab71fda1de0e6860c8377ed3c306ffb9efabe9fb16779a306da6770b871229f6bd1d725a84fdaa03fef 0004-app-location-for-cpio-vi-and-lspci.patch +f9745497abd4d04621f089c62d9f2104c30d54f342125f597292253f2974d385c5f4a46e7d87a5d1b641b11b34ba5221183dd5dad1e3bbe74a787fb8d6a994b7 0004-app-location-for-cpio-vi-and-lspci.patch f12916e70f7cc1ef4f6d85d09b9a496a52a494e6318029fdce9a9c812ab5c7b2a046c33b66834127bf809f243c91a53c3c5e27efca026a96fe6b03421de26e60 0005-udhcpc-set-default-discover-retries-to-5.patch 89215c328a46afc686c458a133dd88dcda817586df60eb041a694715e73dc78a297fc0f9a92e8ee7d0a39ce7f6053a6b8e38f3ee078ff90ed13fac2608510105 0006-ping-make-ping-work-without-root-privileges.patch 7873b98c676a92faea61511d50c1efac1220354d20afd53de19e2c8f1472559cb333b9dd4e0d6432616d8c5f59885f1503c448c86a912e8031c9bfed628c2db1 0007-fbsplash-support-console-switching.patch @@ -206,25 +209,25 @@ ecbe5c890d966f09280c7eb534109f785c68e292765f17ed7ff62fcc61d20f61443c4155add0a1eb 0040800382a6e3adcc6a8094b821488c7e297fc80304afba23a4fca43b7b26ac699378dfbd930ebbf9985336b3e431301f7ca93e2d041a071902a48740d263ef 0015-ed-don-t-use-memcpy-with-overlapping-memory-regions.patch 4c95dc4bf6aff9018bfb52b400f6d8375a1d22493b44ea516cb12dba6556f12797a3cba55768d2e59ff57c0f3247ec1ff95edb8f17561f3d37ec18d83ca47eb0 0016-ash-don-t-read-past-end-of-var-in-subvareval-for-bas.patch ccdf098fb15eaa316708181469a1193d6eec7067131e7b7645e0219bf03cfd07f4f79e8f62c1e560f6146dcc38186a29bdee08aaa39f290e11d020b8f07d2f65 0017-ash-Fix-use-after-free-on-idx-variable.patch +3abdbd25f1f0daa24b0aabe92880c28dc2d3b59eb29fad357dfaf2b78bb895466bbf4495e2185370d9219d65b22e65e525769e369e50fb1fdfd71b5229a4f429 0018-ash-fix-ifs-cleanup-on-error-paths.patch 6d100fe44da2b97c2cbdda253d0504b487212d195144d9315cddbe8c51d18fae3745701923b170b40e35f54b592f94f02cadbffd9cb716661c12a7f1da022763 0001-ash-add-built-in-BB_ASH_VERSION-variable.patch e33dbc27d77c4636f4852d5d5216ef60a9a4343484e4559e391c13c813bf65c782b889914eff2e1f038d74cf02cb0d23824ebbb1044b5f8c86260d5a1bbc4e4d 0001-pgrep-add-support-for-matching-against-UID-and-RUID.patch -b4b8195390da70c96503e66e18420b8aea5754f64300082632fcaccd4ebe86cb771d6d4b912f5162e0538e6f756a9377689ad9a138f683cd729c3f54770304bf 0001-avoid-redefined-warnings-when-building-with-utmps.patch +7608fbb9deddc9268ba53bc5b762a00fa16744d595f6f8a2f5a857339e754ea0c3da084a1e48269c8281553e9171d2bb29b8530fbe85e6a934f97c3cfcdbe31b 0001-avoid-redefined-warnings-when-building-with-utmps.patch b52050678e79e4da856956906d07fcb620cbf35f2ef6b5a8ee3b8d244ea63b4b98eef505451184d5b4937740d91eef154ed748c30d329ac485be51b37626f251 0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch ead4ad65d270d8659e1898fa16f76b6cbcf567d8aba238eacccda3764edb4362240d9359d6389873bedc126d405f805fc6dfce653a7181618ebcc67c94bd08d2 0002-nslookup-sanitize-all-printed-strings-with-printable.patch 4f6ddd59d6096943f617b0938fca428114190b8b37732d6783faab291451a2c30c452ed39299db22d1d9679d007022f87d43e93b38a4f6ced64a8659e9233773 0001-modinfo-add-k-option-for-kernel-version.patch 22e2fa8f7a6105fd9990f93b71c235980fd4eab62269939a0e3a920fe517ee4f913c6bd0148a554b67fe01d1660bf0fd76a80e9dcac290b4b8b2c304ef6080a9 CVE-2022-30065.patch +d1a2fcbf9de623531953e7ad869e41e896aa79a0917983e6f0d20ddf7393e11220dda8be93c796b7abbf34006d8f03e871a6ab293988267df5aadb74cbd8aeb1 0001-sed-check-errors-writing-file-with-sed-i.patch aa93095e20de88730f526c6f463cef711b290b9582cdbd8c1ba2bd290019150cbeaa7007c2e15f0362d5b9315dd63f60511878f0ea05e893f4fdfb4a54af3fb1 acpid.logrotate 0b92eafab0722a6c9cc4880e3be4976de9713e1e1c715c6c727a948cbd68268fce01ce308291834f70d0cf3328f7c8a44cbdb5b7c70d90f91b15efcb5b90acb3 config e063599f412df919b75584fee9501925418ef21689232792e9d61178f4e34a65c3cff8a3b1b4cf3e5be61efea2065cc303db35c53ec07b361d3a65e888247544 default.script dd548670114a92404b8e35fb915fdbe5994498b05b0a418583271c3dd72fb7800950e42c095c902a014eb198c046b8a346d43dccd8e7a158048ae33767c572ed acpid.initd +34c6f3197064bb91619b899b28a201bd4d920b18bded3845440b2cb36dc6f16cabf447c96878349b16e46c30184cbe48bac00a01c5f7cf1be038c0b7136064c5 crond.confd c9d0fb0f8cc27d661d3b4e58c56eb598ca368890576e18ffffd42efdf68ba35537656be9be319b2e2818aa0152d3ca8611bece2433512fbfcd4eed7988765549 crond.initd -1aed59fb048f0636ee8a095a089a20554a20eda84c70485a894ae60b0f97b792b7ce8e832557457258f59a2750735c4a25e247364ccf1180e9652b292a5f9e8d mdev.initd -acfd45bda4526ab551a30faec1742ad1569aa85e0d315959c3e3a3d6a693f94c74efeb57a00b8791524651e8a61d3f7ea3e3e08a4b0291ec46309f594ee8124c syslog.initd -1d4574ec7cc6d7e9952bb50b4fcb10a910868688da03a25aede492835313c686247bde1faa17f50243d61a93bfc1d8fa54cf821d7be908581e365b0f1b6a5588 udhcpd.initd 23ef7f32447f239b617d5ae221b024c7b47ca4faa9a27f80a4a6a473fd148cb4339a728fee3bb55ce67d531a141ec07c66dca533138652058d3a6a936b68d3c7 defaults.initd -34c6f3197064bb91619b899b28a201bd4d920b18bded3845440b2cb36dc6f16cabf447c96878349b16e46c30184cbe48bac00a01c5f7cf1be038c0b7136064c5 crond.confd bf8173ee33a5d2b61cbdbc1b070e599a17a21e5433a0d8aa9beef71e4ac831304076af8e7e58dc594cdee61562329793afdc57af91e5496bf5fffb9b734a3d9c syslog.confd +acfd45bda4526ab551a30faec1742ad1569aa85e0d315959c3e3a3d6a693f94c74efeb57a00b8791524651e8a61d3f7ea3e3e08a4b0291ec46309f594ee8124c syslog.initd 2947b23728d3ad6839f660fee11fc4c86d0d1a3fc450ceff85480932b0699e7b7293eb7258cf0e957542ed3c7a4416376ebb284992e6682aede61f48069b1043 udhcpd.confd -634fa067629febcdd8ba9516fbaafddd5be2d38ac37bff9eccfacce0fcf3b259426c12ff967b179bd93b2962401a4a2f15709d32da0623bd078688b8611817cd mdev.conf -2873ec2ba41fe96b010b14fe3fc87d347b71eb6079c12e05ac72eac6c7f146e25096c0b29b2b9d69cbe6840e16dbf4a93ee81132de9fac497e41ab5e8bce2243 persistent-storage +1d4574ec7cc6d7e9952bb50b4fcb10a910868688da03a25aede492835313c686247bde1faa17f50243d61a93bfc1d8fa54cf821d7be908581e365b0f1b6a5588 udhcpd.initd +6ce0b2a8fe69cc7ea657c5b9076aba51c8f0beeaafa4a887d8673bcc9f9cf8ee40f4b07d2d901ec7a1a1e4f29c150c496559559e803595d0bd487dec56b530a2 mdev.initd " diff --git a/aports/busybox/CVE-2022-30065.patch b/aports/busybox/CVE-2022-30065.patch new file mode 100644 index 0000000..4a9cd67 --- /dev/null +++ b/aports/busybox/CVE-2022-30065.patch @@ -0,0 +1,63 @@ +From 3c284dcb726ff6599d3b87fb366fb04411cf5595 Mon Sep 17 00:00:00 2001 +From: Natanael Copa <ncopa@alpinelinux.org> +Date: Fri, 17 Jun 2022 09:52:11 +0000 +Subject: [PATCH 1/2] awk: fix use after free (CVE-2022-30065) + +fixes https://bugs.busybox.net/show_bug.cgi?id=14781 + +Signed-off-by: Natanael Copa <ncopa@alpinelinux.org> +--- + editors/awk.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/editors/awk.c b/editors/awk.c +index 079d0bde5..728ee8685 100644 +--- a/editors/awk.c ++++ b/editors/awk.c +@@ -3128,6 +3128,9 @@ static var *evaluate(node *op, var *res) + + case XC( OC_MOVE ): + debug_printf_eval("MOVE\n"); ++ /* make sure that we never return a temp var */ ++ if (L.v == TMPVAR0) ++ L.v = res; + /* if source is a temporary string, jusk relink it to dest */ + if (R.v == TMPVAR1 + && !(R.v->type & VF_NUMBER) +-- +2.36.1 + + +From 30c8f8e69230ef27f116a2c10ca2e4a6cc343dad Mon Sep 17 00:00:00 2001 +From: Natanael Copa <ncopa@alpinelinux.org> +Date: Thu, 16 Jun 2022 21:54:48 +0200 +Subject: [PATCH 2/2] awk: add tests for CVE-2022-30065 + +Signed-off-by: Natanael Copa <ncopa@alpinelinux.org> +--- + testsuite/awk.tests | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/testsuite/awk.tests b/testsuite/awk.tests +index 93e25d8c1..6c3a03c37 100755 +--- a/testsuite/awk.tests ++++ b/testsuite/awk.tests +@@ -479,4 +479,15 @@ testing 'awk backslash+newline eaten with no trace' \ + "Hello world\n" \ + '' '' + ++testing 'awk use-after-free (CVE-2022-30065)' \ ++ "awk '\$3i\$3in\$9=\$r||\$9=i6/6-9f'" \ ++ "" \ ++ "" \ ++ "" ++ ++testing 'awk assign while test' \ ++ "awk '\$1==\$1=\"foo\" {print \$1}'" \ ++ "foo\n" \ ++ "" \ ++ "foo" + exit $FAILCOUNT +-- +2.36.1 + diff --git a/aports/busybox/defaults.initd b/aports/busybox/defaults.initd new file mode 100644 index 0000000..a92a942 --- /dev/null +++ b/aports/busybox/defaults.initd @@ -0,0 +1,12 @@ +#!/sbin/openrc-run + +description="Sets service-specific defaults." + +start() { + ebegin "Setting defaults" + . /etc/udhcpc/udhcpc.conf + if [ ! -s "$UDHCPD_CONF" ] ; then + sed 's|%%DNS%%||' < "$UDHCPD_CONF_TEMPLATE" > "$UDHCPD_CONF" + fi + eend $? +} diff --git a/aports/busybox/mdev.conf b/aports/busybox/mdev.conf deleted file mode 100644 index 903786f..0000000 --- a/aports/busybox/mdev.conf +++ /dev/null @@ -1,134 +0,0 @@ -# -# This is a sample mdev.conf. -# - -# Devices: -# Syntax: %s %d:%d %s -# devices user:group mode - -$MODALIAS=.* root:root 0660 @modprobe -q -b "$MODALIAS" - -# null does already exist; therefore ownership has to be changed with command -null root:root 0666 @chmod 666 $MDEV -zero root:root 0666 -grsec root:root 0660 -full root:root 0666 - -random root:root 0666 -urandom root:root 0444 -hwrandom root:root 0660 - -console root:tty 0600 - -# load frambuffer console when first frambuffer is found -fb0 root:video 0660 @modprobe -q -b fbcon -vchiq root:video 0660 - -fd0 root:floppy 0660 -kmem root:root 0640 -mem root:root 0640 -port root:root 0640 -ptmx root:tty 0666 - -# Kernel-based Virtual Machine. -kvm root:kvm 660 - -# ram.* -ram([0-9]*) root:disk 0660 >rd/%1 -loop([0-9]+) root:disk 0660 >loop/%1 - -# persistent storage -dasd.* root:disk 0660 */lib/mdev/persistent-storage -mmcblk.* root:disk 0660 */lib/mdev/persistent-storage -nbd.* root:disk 0660 */lib/mdev/persistent-storage -nvme.* root:disk 0660 */lib/mdev/persistent-storage -sd[a-z].* root:disk 0660 */lib/mdev/persistent-storage -sr[0-9]+ root:cdrom 0660 */lib/mdev/persistent-storage -vd[a-z].* root:disk 0660 */lib/mdev/persistent-storage -xvd[a-z].* root:disk 0660 */lib/mdev/persistent-storage - -md[0-9] root:disk 0660 - -tty root:tty 0666 -tty[0-9] root:root 0600 -tty[0-9][0-9] root:tty 0660 -ttyS[0-9]* root:uucp 0660 -pty.* root:tty 0660 -vcs[0-9]* root:tty 0660 -vcsa[0-9]* root:tty 0660 - -# rpi bluetooth -#ttyAMA0 root:tty 660 @btattach -B /dev/$MDEV -P bcm -S 115200 -N & - -ttyACM[0-9] root:dialout 0660 @ln -sf $MDEV modem -ttyUSB[0-9] root:dialout 0660 @ln -sf $MDEV modem -ttyLTM[0-9] root:dialout 0660 @ln -sf $MDEV modem -ttySHSF[0-9] root:dialout 0660 @ln -sf $MDEV modem -slamr root:dialout 0660 @ln -sf $MDEV slamr0 -slusb root:dialout 0660 @ln -sf $MDEV slusb0 -fuse root:root 0666 - -# dri device -dri/.* root:video 0660 -card[0-9] root:video 0660 =dri/ - -# alsa sound devices and audio stuff -pcm.* root:audio 0660 =snd/ -control.* root:audio 0660 =snd/ -midi.* root:audio 0660 =snd/ -seq root:audio 0660 =snd/ -timer root:audio 0660 =snd/ - -adsp root:audio 0660 >sound/ -audio root:audio 0660 >sound/ -dsp root:audio 0660 >sound/ -mixer root:audio 0660 >sound/ -sequencer.* root:audio 0660 >sound/ - -SUBSYSTEM=sound;.* root:audio 0660 - -# virtio-ports -SUBSYSTEM=virtio-ports;vport.* root:root 0600 @mkdir -p virtio-ports; ln -sf ../$MDEV virtio-ports/$(cat /sys/class/virtio-ports/$MDEV/name) - -# misc stuff -agpgart root:root 0660 >misc/ -psaux root:root 0660 >misc/ -rtc root:root 0664 >misc/ - -# input stuff -event[0-9]+ root:input 0640 =input/ -mice root:input 0640 =input/ -mouse[0-9] root:input 0640 =input/ -js[0-9] root:input 0640 =input/ -ts[0-9] root:input 0600 =input/ - -# v4l stuff -vbi[0-9] root:video 0660 >v4l/ -video[0-9]+ root:video 0660 >v4l/ - -# dvb stuff -dvb.* root:video 0660 */lib/mdev/dvbdev - -# load drivers for usb devices -usb[0-9]+ root:root 0660 */lib/mdev/usbdev - -# net devices -# 666 is fine: https://www.kernel.org/doc/Documentation/networking/tuntap.txt -net/tun[0-9]* root:netdev 0666 -net/tap[0-9]* root:netdev 0666 - -# zaptel devices -zap(.*) root:dialout 0660 =zap/%1 -dahdi!(.*) root:dialout 0660 =dahdi/%1 -dahdi/(.*) root:dialout 0660 =dahdi/%1 - -# raid controllers -cciss!(.*) root:disk 0660 =cciss/%1 -cciss/(.*) root:disk 0660 =cciss/%1 -ida!(.*) root:disk 0660 =ida/%1 -ida/(.*) root:disk 0660 =ida/%1 -rd!(.*) root:disk 0660 =rd/%1 -rd/(.*) root:disk 0660 =rd/%1 - -# fallback for any!device -> any/device -(.*)!(.*) root:root 0660 =%1/%2 diff --git a/aports/busybox/mdev.initd b/aports/busybox/mdev.initd index 9dbb994..630d837 100644 --- a/aports/busybox/mdev.initd +++ b/aports/busybox/mdev.initd @@ -1,39 +1,40 @@ #!/sbin/openrc-run +description="the mdev device manager" + depend() { provide dev need sysfs dev-mount before checkfs fsck - keyword -vserver -lxc + keyword -containers -vserver -lxc } -start() { - # check if udev is specified on cmd line - if get_bootparam "udev"; then - ewarn "Skipping mdev as udev requested in kernel cmdline" - return 0 - fi - +_start_service () { ebegin "Starting busybox mdev" mkdir -p /dev - - # use mdev for hotplug echo "/sbin/mdev" > /proc/sys/kernel/hotplug - + eend $? +} + +_start_coldplug () { + ebegin "Scanning hardware for mdev" # mdev -s will not create /dev/usb[1-9] devices with recent kernels - # so we trigger hotplug events for usb for now + # so we manually trigger events for usb for i in $(find /sys/devices -name 'usb[0-9]*'); do [ -e $i/uevent ] && echo add > $i/uevent done - - # create devices + # trigger the rest of the coldplug mdev -s eend $? } +start() { + _start_service + _start_coldplug +} + stop() { ebegin "Stopping busybox mdev" - echo "" > /proc/sys/kernel/hotplug + echo > /proc/sys/kernel/hotplug eend } - diff --git a/aports/busybox/persistent-storage b/aports/busybox/persistent-storage deleted file mode 100644 index 4b821bc..0000000 --- a/aports/busybox/persistent-storage +++ /dev/null @@ -1,83 +0,0 @@ -#!/bin/sh - -symlink_action() { - case "$ACTION" in - add) ln -sf "$1" "$2";; - remove) rm -f "$2";; - esac -} - -: ${SYSFS:=/sys} - -# cdrom symlink -case "$MDEV" in - sr*|xvd*) - caps="$(cat $SYSFS/block/$MDEV/capability 2>/dev/null)" - if [ $(( 0x${caps:-0} & 8 )) -gt 0 ]; then - symlink_action $MDEV cdrom - fi -esac - -# by-id symlinks -mkdir -p disk/by-id - -partition=$(cat $SYSFS/class/block/$MDEV/partition 2>/dev/null) -case "$partition" in - [0-9]*) partsuffix="-part$partition";; -esac - -wwid=$(cat $SYSFS/class/block/$MDEV/wwid 2>/dev/null) -: ${wwid:=$(cat $SYSFS/class/block/$MDEV/device/wwid 2>/dev/null)} - -if [ -n "$wwid" ]; then - case "$MDEV" in - nvme*) symlink_action ../../$MDEV disk/by-id/nvme-${wwid}${partsuffix};; - esac - case "$wwid" in - naa.*) symlink_action ../../$MDEV disk/by-id/wwn-0x${wwid#naa.};; - esac -fi - -serial=$(sed -E -e 's/^\s+//' -e 's/\s+$//' -e 's/ /_/g' \ - $SYSFS/class/block/$MDEV/device/serial 2>/dev/null) - -model=$(sed -E -e 's/^\s+//' -e 's/\s+$//' -e 's/ /_/g' \ - $SYSFS/class/block/$MDEV/device/model 2>/dev/null) - -if [ -n "$serial" ] && [ -n "$model" ]; then - case "$MDEV" in - nvme*) symlink_action ../../$MDEV disk/by-id/nvme-${model}_${serial}${partsuffix};; - esac -fi - -# virtio-blk -if [ -n "$serial" ]; then - case "$MDEV" in - vd*) symlink_action ../../$MDEV disk/by-id/virtio-${serial}${partsuffix};; - esac -fi - -# by-uuid, by-partuuid -eval $(blkid /dev/$MDEV | cut -d: -f2-) -if [ -n "$UUID" ]; then - mkdir -p disk/by-uuid - symlink_action ../../$MDEV disk/by-uuid/$UUID -fi -if [ -n "$PARTUUID" ]; then - mkdir -p disk/by-partuuid - symlink_action ../../$MDEV disk/by-partuuid/$PARTUUID -fi - -# backwards compatibility with /dev/usbdisk for /dev/sd* -if [ "${MDEV#sd}" != "$MDEV" ]; then - sysdev=$(readlink $SYSFS/class/block/$MDEV) - case "$sysdev" in - *usb[0-9]*) - # require vfat for devices without partition - if ! [ -e $SYSFS/block/$MDEV ] || [ TYPE="vfat" ]; then - symlink_action $MDEV usbdisk - fi - ;; - esac -fi - diff --git a/aports/busybox/udhcpd.confd b/aports/busybox/udhcpd.confd new file mode 100644 index 0000000..69aaec3 --- /dev/null +++ b/aports/busybox/udhcpd.confd @@ -0,0 +1 @@ +UDHCPD_OPTS="-S /tmp/udhcpd.conf" diff --git a/aports/hostapd/0001-hostapd-Add-the-missing-CONFIG_SAE-option-to-the-def.patch b/aports/hostapd/0001-hostapd-Add-the-missing-CONFIG_SAE-option-to-the-def.patch new file mode 100644 index 0000000..97d6e04 --- /dev/null +++ b/aports/hostapd/0001-hostapd-Add-the-missing-CONFIG_SAE-option-to-the-def.patch @@ -0,0 +1,30 @@ +From 6ff8bda992463a8c0dc34ee18820ca56cf9cccc0 Mon Sep 17 00:00:00 2001 +From: Yegor Yefremov <yegorslists@googlemail.com> +Date: Wed, 30 Mar 2022 10:11:16 +0200 +Subject: [PATCH] hostapd: Add the missing CONFIG_SAE option to the defconfig + +CONFIG_SAE was added to wpa_supplicant's defconfig but wasn't +added to the hostapd's defconfig file. + +Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com> +--- + hostapd/defconfig | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/hostapd/defconfig b/hostapd/defconfig +index 6b50b6c59..611f96ffa 100644 +--- a/hostapd/defconfig ++++ b/hostapd/defconfig +@@ -161,6 +161,9 @@ CONFIG_IPV6=y + # final IEEE 802.11ax version. + #CONFIG_IEEE80211AX=y + ++# Simultaneous Authentication of Equals (SAE), WPA3-Personal ++#CONFIG_SAE=y ++ + # Remove debugging code that is printing out debug messages to stdout. + # This can be used to reduce the size of the hostapd considerably if debugging + # code is not needed. +-- +2.30.2 + diff --git a/aports/hostapd/APKBUILD b/aports/hostapd/APKBUILD index 12d4224..3e767b9 100644 --- a/aports/hostapd/APKBUILD +++ b/aports/hostapd/APKBUILD @@ -1,18 +1,20 @@ # Maintainer: Gabor Pali <pali.gabor@gmail.com> pkgname=hostapd pkgver=2.10 -pkgrel=1 # base: 1 +pkgrel=2 # base: 5 pkgdesc="daemon for wireless software access points" url="https://w1.fi/hostapd/" arch="all" license="BSD-3-Clause" -makedepends="openssl1.1-compat-dev libnl3-dev linux-headers" +makedepends="openssl-dev>3 libnl3-dev linux-headers" subpackages= source="https://w1.fi/releases/hostapd-$pkgver.tar.gz $pkgname.initd $pkgname.confd + 0001-hostapd-Add-the-missing-CONFIG_SAE-option-to-the-def.patch " options="!check" #no testsuite +patch_args="-p2" builddir="$srcdir"/$pkgname-$pkgver/hostapd # secfixes: @@ -40,46 +42,51 @@ builddir="$srcdir"/$pkgname-$pkgver/hostapd # - CVE-2017-13088 prepare() { - cd "$builddir" + default_prepare + sed -i -e "s:/etc/hostapd:/etc/hostapd/hostapd:g" \ hostapd.conf # toolchain setup - sed \ - -e '/^#CONFIG_DRIVER_NL80211=y/s/^#//' \ - -e '/^#CONFIG_RADIUS_SERVER=y/s/^#//' \ - -e '/^#CONFIG_DRIVER_WIRED=y/s/^#//' \ - -e '/^#CONFIG_DRIVER_NONE=y/s/^#//' \ - -e '/^#CONFIG_IEEE80211N=y/s/^#//' \ - -e '/^#CONFIG_IEEE80211R=y/s/^#//' \ - -e '/^#CONFIG_IEEE80211AC=y/s/^#//' \ - -e '/^#CONFIG_IEEE80211AX=y/s/^#//' \ - -e '/^#CONFIG_FULL_DYNAMIC_VLAN=y/s/^#//' \ - -e '/^#CONFIG_LIBNL32=y/s/^#//' \ - -e '/^#CONFIG_ACS=y/s/^#//' \ - -e '/^#CONFIG_WEP=y/s/^#//' \ - defconfig >> .config - echo "CC ?= ${CC:-gcc}" >> .config - echo "CFLAGS += -I/usr/include/libnl3" >> .config - echo "LIBS += -L/usr/lib" >> .config + { + sed \ + -e '/^#CONFIG_DRIVER_NL80211=y/s/^#//' \ + -e '/^#CONFIG_RADIUS_SERVER=y/s/^#//' \ + -e '/^#CONFIG_DRIVER_WIRED=y/s/^#//' \ + -e '/^#CONFIG_DRIVER_NONE=y/s/^#//' \ + -e '/^#CONFIG_IEEE80211N=y/s/^#//' \ + -e '/^#CONFIG_IEEE80211R=y/s/^#//' \ + -e '/^#CONFIG_IEEE80211AC=y/s/^#//' \ + -e '/^#CONFIG_IEEE80211AX=y/s/^#//' \ + -e '/^#CONFIG_FULL_DYNAMIC_VLAN=y/s/^#//' \ + -e '/^#CONFIG_LIBNL32=y/s/^#//' \ + -e '/^#CONFIG_ACS=y/s/^#//' \ + -e '/^#CONFIG_WEP=y/s/^#//' \ + defconfig + + echo "CC ?= ${CC:-gcc}" + echo "CFLAGS += -I/usr/include/libnl3" + echo "LIBS += -L/usr/lib" + } >> .config } build() { - cd "$builddir" + export CFLAGS="$CFLAGS -flto=auto" + make } package() { - cd "$builddir" - - install -Dm755 hostapd "$pkgdir"/usr/sbin/hostapd \ - && install -Dm755 "$srcdir"/hostapd.initd \ - "$pkgdir"/etc/init.d/hostapd \ - && install -Dm644 "$srcdir"/hostapd.confd \ - "$pkgdir"/etc/conf.d/hostapd + install -Dm755 hostapd \ + -t "$pkgdir"/usr/sbin/ + install -Dm755 "$srcdir"/hostapd.initd \ + "$pkgdir"/etc/init.d/hostapd + install -Dm644 "$srcdir"/hostapd.confd \ + "$pkgdir"/etc/conf.d/hostapd } sha512sums=" 243baa82d621f859d2507d8d5beb0ebda15a75548a62451dc9bca42717dcc8607adac49b354919a41d8257d16d07ac7268203a79750db0cfb34b51f80ff1ce8f hostapd-2.10.tar.gz -b54b7c6aa17e5cb86a9b354a516eb2dbefb544df18471339c61d82776de447011a2ac290bea1e6c8beae4b6cebefafb8174683ea42fb773e9e8fe6c679f33ba3 hostapd.initd -0882263bbd7c0b05bf51f51d66e11a23a0b8ca7da2a3b8a30166d2c5f044c0c134e6bccb1d02c9e81819ca8fb0c0fb55c7121a08fe7233ccaa73ff8ab9a238fe hostapd.confd +adeca34c6254ac6fccd84e6f08f8c394225e1b89e2c8771b46da5c85fe3fdabc568628530c39da3ab30b72e98891b07bbdb63f74217e79d6afb9796715d822f1 hostapd.initd +95a80f5ceafd70da3d11207e591300d0e4f03d48724147cf3572420b177d50687524b715fe2001d826020e8b28959fa8c7b8334a5cbbfeec7c82d1db9a0b333a hostapd.confd +7cde99c431f1cf746473ae53c3009735c2a718e7038c3bc1629fc45ca85a191d799e975960da96e3cf14a56389ba06eee78453a9dd457941d6af758b730cbd05 0001-hostapd-Add-the-missing-CONFIG_SAE-option-to-the-def.patch " diff --git a/aports/hostapd/hostapd.confd b/aports/hostapd/hostapd.confd index 6038115..2260629 100644 --- a/aports/hostapd/hostapd.confd +++ b/aports/hostapd/hostapd.confd @@ -1,5 +1,4 @@ -# Space separated list of configuration files -CONFIGS="/etc/hostapd/hostapd.conf" - -# Extra options to pass to hostapd, see hostapd(8) -OPTIONS="" +cfgfile="/etc/hostapd/hostapd.conf" +command_args="" +# Uncomment to run with process supervisor. +# supervisor="supervise-daemon" diff --git a/aports/hostapd/hostapd.initd b/aports/hostapd/hostapd.initd index 7813fd1..a7b6033 100644 --- a/aports/hostapd/hostapd.initd +++ b/aports/hostapd/hostapd.initd @@ -1,46 +1,34 @@ #!/sbin/openrc-run -# Copyright 1999-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/gentoo-x86/net-wireless/hostapd/files/hostapd-0.6.9-init.d,v 1.2 2009/05/17 10:18:18 gurligebis Exp $ + +name="hostapd" +description="User space daemon for access point and authentication servers" extra_started_commands="reload" +# $CONFIGS and $OPTIONS are deprecated since Alpine v3.17. +# NOTE: cfgfile can contain more than one file path in this case. +: ${cfgfile:=${CONFIGS:-"/etc/hostapd/hostapd.conf"}} + +command="/usr/sbin/hostapd" +command_args="${command_args:-$OPTIONS} $cfgfile" +command_background="yes" +pidfile="/run/$RC_SVCNAME.pid" + +required_files="$cfgfile" + depend() { need net after firewall use logger } -checkconfig() { - local file - - for file in ${CONFIGS}; do - if [ ! -r "${file}" ]; then - eerror "hostapd configuration file (${CONFIG}) not found" - return 1 - fi - done -} - -start() { - checkconfig || return 1 - - ebegin "Starting ${SVCNAME}" - start-stop-daemon --start --exec /usr/sbin/hostapd \ - -- -B ${OPTIONS} ${CONFIGS} - eend $? -} - -stop() { - ebegin "Stopping ${SVCNAME}" - start-stop-daemon --stop --exec /usr/sbin/hostapd - eend $? -} - reload() { - checkconfig || return 1 + ebegin "Reloading $name configuration" - ebegin "Reloading ${SVCNAME} configuration" - kill -HUP $(pidof /usr/sbin/hostapd) > /dev/null 2>&1 + if [ "$supervisor" ]; then + $supervisor "$RC_SVCNAME" --signal HUP + else + start-stop-daemon --signal HUP --pidfile "$pidfile" + fi eend $? } diff --git a/aports/iptables/APKBUILD b/aports/iptables/APKBUILD index 4dc6dc6..f6ed3cc 100644 --- a/aports/iptables/APKBUILD +++ b/aports/iptables/APKBUILD @@ -2,7 +2,7 @@ pkgname=iptables pkgver=1.8.8 -pkgrel=0 # base: 1 +pkgrel=0 # base: 2 pkgdesc="Linux kernel firewall, NAT and packet mangling tools" url="https://www.netfilter.org/projects/iptables/index.html" arch="all" diff --git a/aports/linux-lts/APKBUILD b/aports/linux-lts/APKBUILD index 1884f92..cdcdcd5 100644 --- a/aports/linux-lts/APKBUILD +++ b/aports/linux-lts/APKBUILD @@ -1,7 +1,7 @@ # Maintainer: Gabor Pali <pali.gabor@gmail.com> pkgname=linux-lts -pkgver=5.15.68 +pkgver=5.15.85 case $pkgver in *.*.*) _kernver=${pkgver%.*};; *.*) _kernver=$pkgver;; @@ -162,7 +162,7 @@ _dev() { sha512sums=" d25ad40b5bcd6a4c6042fd0fd84e196e7a58024734c3e9a484fd0d5d54a0c1d87db8a3c784eff55e43b6f021709dc685eb0efa18d2aec327e4f88a79f405705a linux-5.15.tar.xz -d88b8df06cc3aa02b94071fbcd980c85709235e6776031c06324db961e421554998a3242db0efe65bc989b63e8933b42137392bb11b7b5c4e9e851e64959bf9a config-lts.x86_64 +94cda531cdfc6337a19cde9888a2fde07b478756ddbd78039bde93e74e1677b2272995119b6f037f5b7a39305a41483d12b89933fce61f120c5f864b5d92d74c config-lts.x86_64 65504e60731f7254079caa997cd44585f8b9608aa66e0879e677872f89b91aa77b67f28617eddef7fe9932a73a5942466c12c733432405ee7e42944daadef6d4 0001-mt76-mt7921-add-support-for-PCIe-ID-0x0608.patch -2c499cd943c2e018fea2d2e776e058e5e7ad6ab97ecc657df271d05ad4e1364c79d4c32d487d0039e7e37079858ccda3a0541f8d24f9e78f60071158e2794ef4 patch-5.15.68.xz +aa7d75ab949a266495391728a93096e30d0579ec490ee97b3a5f7cb4ef4268c17fbc3ba337a289e14c3bebc7e7be4dc7656abe86abc3cb8d691e2d5f21a480b5 patch-5.15.85.xz " diff --git a/aports/linux-lts/config-lts.x86_64 b/aports/linux-lts/config-lts.x86_64 index 009d779..352db0c 100644 --- a/aports/linux-lts/config-lts.x86_64 +++ b/aports/linux-lts/config-lts.x86_64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86_64 5.15.68 Kernel Configuration +# Linux/x86_64 5.15.85 Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (Alpine 10.3.1_git20211027) 10.3.1 20211027" CONFIG_CC_IS_GCC=y @@ -382,7 +382,10 @@ CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y # Power management and ACPI options # # CONFIG_SUSPEND is not set -# CONFIG_PM is not set +CONFIG_PM=y +# CONFIG_PM_DEBUG is not set +CONFIG_PM_CLK=y +# CONFIG_WQ_POWER_EFFICIENT_DEFAULT is not set CONFIG_ARCH_SUPPORTS_ACPI=y CONFIG_ACPI=y CONFIG_ACPI_LEGACY_TABLES_LOOKUP=y @@ -609,6 +612,7 @@ CONFIG_EFI_PARTITION=y CONFIG_BLK_MQ_PCI=y CONFIG_BLK_MQ_VIRTIO=y +CONFIG_BLK_PM=y # # IO Schedulers @@ -745,6 +749,7 @@ CONFIG_SYN_COOKIES=y # CONFIG_INET_AH is not set # CONFIG_INET_ESP is not set # CONFIG_INET_IPCOMP is not set +CONFIG_INET_TABLE_PERTURB_ORDER=16 CONFIG_INET_TUNNEL=y # CONFIG_INET_DIAG is not set CONFIG_TCP_CONG_ADVANCED=y @@ -1081,6 +1086,7 @@ CONFIG_PCIEASPM_DEFAULT=y # CONFIG_PCIEASPM_POWERSAVE is not set # CONFIG_PCIEASPM_POWER_SUPERSAVE is not set # CONFIG_PCIEASPM_PERFORMANCE is not set +CONFIG_PCIE_PME=y # CONFIG_PCIE_PTM is not set CONFIG_PCI_MSI=y CONFIG_PCI_MSI_IRQ_DOMAIN=y @@ -1442,6 +1448,7 @@ CONFIG_ATH9K_PCI=y # CONFIG_ATH9K_AHB is not set # CONFIG_ATH9K_DEBUGFS is not set # CONFIG_ATH9K_DYNACK is not set +# CONFIG_ATH9K_WOW is not set CONFIG_ATH9K_RFKILL=y # CONFIG_ATH9K_CHANNEL_CONTEXT is not set CONFIG_ATH9K_PCOEM=y @@ -2884,6 +2891,8 @@ CONFIG_SYMBOLIC_ERRNAME=y CONFIG_DEBUG_BUGVERBOSE=y # end of printk and dmesg options +CONFIG_AS_HAS_NON_CONST_LEB128=y + # # Compile-time checks and compiler options # diff --git a/aports/openrc/0001-call-sbin-mkmntdirs-in-localmount-OpenRC-service.patch b/aports/openrc/0001-call-sbin-mkmntdirs-in-localmount-OpenRC-service.patch index 3d41060..c2b4f02 100644 --- a/aports/openrc/0001-call-sbin-mkmntdirs-in-localmount-OpenRC-service.patch +++ b/aports/openrc/0001-call-sbin-mkmntdirs-in-localmount-OpenRC-service.patch @@ -1,14 +1,19 @@ -From 78245081fe109ed7777b79ba9c99890d56c21272 Mon Sep 17 00:00:00 2001 +From 908f77d4f1930c1ac0be036d3d2e10ff15f84fbf Mon Sep 17 00:00:00 2001 From: Natanael Copa <ncopa@alpinelinux.org> Date: Wed, 1 Feb 2017 04:04:52 +0000 Subject: [PATCH] call /sbin/mkmntdirs in localmount OpenRC service --- - init.d/localmount.in | 2 ++ - 1 file changed, 2 insertions(+) + init.d/localmount.in | 2 ++ + src/meson.build | 1 + + src/mkmntdirs/meson.build | 5 +++ + src/mkmntdirs/mkmntdirs.c | 67 +++++++++++++++++++++++++++++++++++++++ + 4 files changed, 75 insertions(+) + create mode 100644 src/mkmntdirs/meson.build + create mode 100644 src/mkmntdirs/mkmntdirs.c diff --git a/init.d/localmount.in b/init.d/localmount.in -index c571504a..14189396 100644 +index 8a66eb8d..19693b6b 100644 --- a/init.d/localmount.in +++ b/init.d/localmount.in @@ -21,6 +21,8 @@ depend() @@ -20,6 +25,102 @@ index c571504a..14189396 100644 # Mount local filesystems in /etc/fstab. # The types variable must start with no, and must be a type local critical= types="noproc" x= no_netdev= rc= +diff --git a/src/meson.build b/src/meson.build +index 76f6d8a1..0f640eec 100644 +--- a/src/meson.build ++++ b/src/meson.build +@@ -12,6 +12,7 @@ subdir('is_newer_than') + subdir('is_older_than') + subdir('kill_all') + subdir('mark_service') ++subdir('mkmntdirs') + subdir('mountinfo') + subdir('on_ac_power') + subdir('openrc') +diff --git a/src/mkmntdirs/meson.build b/src/mkmntdirs/meson.build +new file mode 100644 +index 00000000..20f9762d +--- /dev/null ++++ b/src/mkmntdirs/meson.build +@@ -0,0 +1,5 @@ ++executable('mkmntdirs', ++ ['mkmntdirs.c'], ++ c_args : cc_branding_flags, ++ install: true, ++ install_dir: sbindir) +diff --git a/src/mkmntdirs/mkmntdirs.c b/src/mkmntdirs/mkmntdirs.c +new file mode 100644 +index 00000000..eaeae732 +--- /dev/null ++++ b/src/mkmntdirs/mkmntdirs.c +@@ -0,0 +1,67 @@ ++/* ++ * Create mount directories in fstab ++ * ++ * Copyright(c) 2008 Natanael Copa <natanael.copa@gmail.com> ++ * May be distributed under the terms of GPL-2 ++ * ++ * usage: mkmntdirs [fstab] ++ * ++ */ ++ ++#include <sys/stat.h> ++#include <sys/types.h> ++ ++#include <err.h> ++#include <mntent.h> ++#include <stdio.h> ++#include <string.h> ++ ++ ++#ifdef DEBUG ++#define mkdir_recursive(p) puts((p)) ++#else ++static void mkdir_recursive(char *path) ++{ ++ char *s = path; ++ while (1) { ++ int c = '\0'; ++ while (*s) { ++ if (*s == '/') { ++ do { ++ ++s; ++ } while (*s == '/'); ++ c = *s; /* Save the current char */ ++ *s = '\0'; /* and replace it with nul. */ ++ break; ++ } ++ ++s; ++ } ++ mkdir(path, 0755); ++ if (c == '\0') ++ return; ++ *s = c; ++ } ++} ++#endif ++ ++int main(int argc, const char *argv[]) ++{ ++ const char *filename = "/etc/fstab"; ++ FILE *f; ++ struct mntent *ent; ++ if (argc == 2) ++ filename = argv[1]; ++ ++ f = setmntent(filename, "r"); ++ if (f == NULL) ++ err(1, "%s", filename); ++ ++ while ((ent = getmntent(f)) != NULL) { ++ if (strcmp(ent->mnt_dir, "none") != 0) ++ mkdir_recursive(ent->mnt_dir); ++ } ++ ++ endmntent(f); ++ return 0; ++} ++ -- -2.33.1 +2.37.1 diff --git a/aports/openrc/0003-rc-pull-in-sysinit-and-boot-as-stacked-levels-when-n.patch b/aports/openrc/0003-rc-pull-in-sysinit-and-boot-as-stacked-levels-when-n.patch index 546ccb7..265a51e 100644 --- a/aports/openrc/0003-rc-pull-in-sysinit-and-boot-as-stacked-levels-when-n.patch +++ b/aports/openrc/0003-rc-pull-in-sysinit-and-boot-as-stacked-levels-when-n.patch @@ -21,8 +21,8 @@ Fixes issue #54. diff --git a/src/rc/rc.c b/src/rc/rc.c index ef46925d..82786074 100644 ---- a/src/rc/rc.c -+++ b/src/rc/rc.c +--- a/src/openrc/rc.c ++++ b/src/openrc/rc.c @@ -729,6 +729,7 @@ int main(int argc, char **argv) const char *bootlevel = NULL; char *newlevel = NULL; diff --git a/aports/openrc/0009-dont-overwrite-empty-supervise_daemon_args.patch b/aports/openrc/0009-dont-overwrite-empty-supervise_daemon_args.patch new file mode 100644 index 0000000..4716d06 --- /dev/null +++ b/aports/openrc/0009-dont-overwrite-empty-supervise_daemon_args.patch @@ -0,0 +1,40 @@ +Patch-Source: https://github.com/OpenRC/openrc/pull/558 +-- +From a2f1d65f1646e5f539e986f22964cf078ba58fce Mon Sep 17 00:00:00 2001 +From: Jakub Jirutka <jakub@jirutka.cz> +Date: Sun, 6 Nov 2022 02:14:26 +0100 +Subject: [PATCH] supervise-daemon: don't overwrite empty supervise_daemon_args + +If supervise_daemon_args is not set *or empty*, it defaults to +`start_stop_daemon_args`. This is bad because supervise-daemon doesn't +accept the same options as `start-stop-daemon`. So if we set e.g. +`start_stop_daemon_args="--wait 50"`, but not `supervise_daemon_args`, +and the user adds `supervisor=supervise-daemon` to the corresponding +/etc/conf.d/<service> file, the service will fail to start due to +unrecognized option "wait". + +It would be best to remove this fallback, but that might break some +existing scripts that depend on it. So this commit just changes it to +use `start_stop_daemon_args` as the default for `supervise_daemon_args` +only if `supervise_daemon_args` is not set at all, but not if it's +empty. + +This at least simplifies workarounds; we can just add +`supervise_daemon_args="$supervise_daemon_args"` to init scripts. +--- + sh/supervise-daemon.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sh/supervise-daemon.sh b/sh/supervise-daemon.sh +index 8d2d6faff..8eb98a17a 100644 +--- a/sh/supervise-daemon.sh ++++ b/sh/supervise-daemon.sh +@@ -41,7 +41,7 @@ supervise_start() + ${no_new_privs:+--no_new_privs} \ + ${command_user+--user} $command_user \ + ${umask+--umask} $umask \ +- ${supervise_daemon_args:-${start_stop_daemon_args}} \ ++ ${supervise_daemon_args-${start_stop_daemon_args}} \ + $command \ + -- $command_args $command_args_foreground + rc=$? diff --git a/aports/openrc/0009-fix-bootmisc-mv-error.patch b/aports/openrc/0009-fix-bootmisc-mv-error.patch deleted file mode 100644 index e87f9bb..0000000 --- a/aports/openrc/0009-fix-bootmisc-mv-error.patch +++ /dev/null @@ -1,27 +0,0 @@ -From: Dermot Bradley <dermot_bradley@yahoo.com> -Date: Sat, 29 Jan 2022 19:28 +0000 -Subject: prevent a bootmisc trying to move a nonexistant file - -During boot if the "previous_dmesg" setting is enabled in -/etc/conf.d/bootmisc then during the 1st boot of a machine the -bootmisc init.d script will attempt to move a nonexistant dmesg -file, so generating an error on the console. - -Modify the script to only move an existing file. - -Upstream has merged this as PR 496 so it will be in the next release. - ---- - -diff -aur a/init.d/bootmisc.in b/init.d/bootmisc.in ---- a/init.d/bootmisc.in -+++ b/init.d/bootmisc.in -@@ -226,7 +226,7 @@ - case "$RC_SYS" in - VSERVER|OPENVZ|LXC|SYSTEMD-NSPAWN) ;; - *) -- if yesno ${previous_dmesg:-no}; then -+ if yesno ${previous_dmesg:-no} && [ -e /var/log/dmesg ]; then - mv /var/log/dmesg /var/log/dmesg.old - fi - dmesg > /var/log/dmesg diff --git a/aports/openrc/0010-noexec-devfs.patch b/aports/openrc/0010-noexec-devfs.patch deleted file mode 100644 index 9a8928c..0000000 --- a/aports/openrc/0010-noexec-devfs.patch +++ /dev/null @@ -1,14 +0,0 @@ ---- a/init.d/devfs.in -+++ b/init.d/devfs.in -@@ -24,8 +24,9 @@ mount_dev() - action=--mount - conf_d_dir="${RC_SERVICE%/*/*}/conf.d" - msg=Mounting -- # Some devices require exec, Bug #92921 -- mountopts="exec,nosuid,mode=0755" -+ # Some devices require exec, https://bugs.gentoo.org/92921 -+ # Users with such requirements can use an fstab entry for /dev -+ mountopts="noexec,nosuid,mode=0755" - if yesno ${skip_mount_dev:-no} ; then - einfo "/dev will not be mounted due to user request" - return 0 diff --git a/aports/openrc/APKBUILD b/aports/openrc/APKBUILD index daff08b..c0289bd 100644 --- a/aports/openrc/APKBUILD +++ b/aports/openrc/APKBUILD @@ -1,18 +1,18 @@ # Maintainer: Gabor Pali <pali.gabor@gmail.com> pkgname=openrc -pkgver=0.44.10 +pkgver=0.45.2 pkgrel=0 # base: 7 pkgdesc="OpenRC manages the services, startup and shutdown of a host" url="https://github.com/OpenRC/openrc" arch="all" license="BSD-2-Clause" depends="ifupdown-any" -makedepends="bsd-compat-headers linux-headers meson" +makedepends_host="bsd-compat-headers libcap-dev linux-headers" +makedepends_build="meson" checkdepends= subpackages= install= source="$pkgname-$pkgver.tar.gz::https://github.com/OpenRC/openrc/archive/$pkgver.tar.gz - 0001-call-sbin-mkmntdirs-in-localmount-OpenRC-service.patch 0002-fsck-don-t-add-C0-to-busybox-fsck.patch 0003-rc-pull-in-sysinit-and-boot-as-stacked-levels-when-n.patch @@ -21,9 +21,12 @@ source="$pkgname-$pkgver.tar.gz::https://github.com/OpenRC/openrc/archive/$pkgve 0006-Add-support-for-starting-services-in-a-specified-VRF.patch 0007-Clean-up-staticroute-config-remove-irrelevant-parts-.patch 0008-bootmisc-switch-wipe_tmp-setting-to-no-by-default.patch - 0009-fix-bootmisc-mv-error.patch - 0010-noexec-devfs.patch - seedrng.patch + 0009-dont-overwrite-empty-supervise_daemon_args.patch + $pkgname-grep-3.8.patch::https://github.com/OpenRC/openrc/commit/9380347f042f7d294317f4420b648422817eb75a.patch + + remount-root.patch + supervise-daemon-defaults.patch + openrc.logrotate hostname.initd hwdrivers.initd @@ -46,8 +49,8 @@ prepare() { # meson overrides this with the aports tag, # we get there first :) sed -i -e "s|@VCS_TAG@|$pkgver|" \ - src/common/version.h.in \ - src/common/version.in + src/shared/version.h.in \ + src/shared/version.in } @@ -123,21 +126,22 @@ package() { } sha512sums=" -0e41f5268c6b8c325a6773511ca58c38ba52a1987aa47165794df8a99359bd1bfcb99d30e0d129b9242a2661663234f6f85c92c55c891dbb6c5b8a11d93edea4 openrc-0.44.10.tar.gz -6085d127f7385eb86a00676a263c8613748fb0cbbf064bc908d346a1b368e226d8a3014e871d281f57d334a70ec1301269fe431e085f0e907b4f6ef8a99bf07f 0001-call-sbin-mkmntdirs-in-localmount-OpenRC-service.patch +ca2958772240f6e5037e39db1ee62a81091a2efa654da967f68e03a721868c6c0a41d32a2bddf55c8eadbc9bf5837b710cc2e4564844a7fbc0e585366da4fdf9 openrc-0.45.2.tar.gz +257861f5f0562e9b9a9fccebae474bd75c4bb51f005a2b8132fd551f061f65863de46c5bc4437f137b4a9d3ca741f9de9274bfa7b418eda70497ed4b5fd3056d 0001-call-sbin-mkmntdirs-in-localmount-OpenRC-service.patch 3f47b4f7e6c5b7fb53ff8a13470fbada67f7470e5eba71a683e6c022162c3905f560d561c3d61698e3fde367d6ae715edf76e99949f52a22a3bbf79debc33f64 0002-fsck-don-t-add-C0-to-busybox-fsck.patch -61c72be18283108163bde4349616e55adb535bd34312ee09f90fcd85277ffe17dcef792bbf465877c0d8b1fec87a3836f714d8d849a9cf322902a89bc1256e13 0003-rc-pull-in-sysinit-and-boot-as-stacked-levels-when-n.patch +0bd69d9e8e9c321a5e67cf924be07b9dd0b58801143c18f74bebf442958fc878e46a65f07cc2842566a8c3434e788ef3ca0c90c607de6b10931f01324bfc1b11 0003-rc-pull-in-sysinit-and-boot-as-stacked-levels-when-n.patch 71a743bf969110a27259405ef4b4dc4fad608b8e49039fd6afb1b1486d0f1dfccc3ef5275410fa3d6d1554ccee59c5a3424be4f2919e14453ebb709282c588a7 0004-make-consolefont-service-compatible-with-busyboxs-se.patch 9e2ae6c8e189ceae0f3f2662d9504f796e9a6a987a26ee2e10add85746b6596eb04cc256dc532a39f711b4e1aa07f1d12a384ef45d23cab49878b887bf0a878c 0005-Support-early-loading-of-keymap-if-kbd-is-installed.patch 8bf00b82d7fc0eb1b529ec735009f91d277141ba7e5c04e23d10bbcf36eb453f0b31d48aec45e50b5be4c14f611acc4454933f3cefdf8beab07d851328223464 0006-Add-support-for-starting-services-in-a-specified-VRF.patch 431ac28808e684bea5511386bf5f06efe7f509f1dbe7e15ae6309563d813deae8f3edd872a0943ef8088e3cf778d7bc5ebd15a893dc4a08f4022b7a56bbafc63 0007-Clean-up-staticroute-config-remove-irrelevant-parts-.patch 475f4ea63b9b5d7eb9c623e96b6cc3d3072abcb7194d0045b84e0688836c8514fccfc68b0eae0b4bee60878cdea8042c3ce7e48406ee7a2f0e4a3e128a153468 0008-bootmisc-switch-wipe_tmp-setting-to-no-by-default.patch -354b2df343ddf82aedba104039bbdb1dd5fdd9c4abac52f89e881341443b73fcf000ed9e8b88e9610f1c3218cb89722ff6a774e1ef2f7fe71fa6ff62b75f572b 0009-fix-bootmisc-mv-error.patch -0535d7837ae0c695f25208199f4dec3a4031558366da346a8a1dd13c0fa2a044f14088b75eca37ce0f4a681e85c82b84aac3d65aac9176639e82b33a9355cb2a 0010-noexec-devfs.patch -715af2188cf4d1ed42f75b31ad718f5c533ea6f8cfc3c5df0fd7fc4240cd342dc637b7edf358c5da1e77d700618adaa7927ddaeae60698dd9f130dd64d83d8d5 seedrng.patch +7bdd5e97186fd9c9d17d3d9a19e16f8432e0abc27b067d2191c8038d3c32c5502ee0b5b6d539bc3550400cba63b6bccfcca05a7a3b95e352ea692b6a1be8000e 0009-dont-overwrite-empty-supervise_daemon_args.patch +0a19a00af670e38742cea8e7f59a8ef329cc2fe7f57582ce8dcd0bfb90f7b5116cc0e64a6138f56c1c20c35354f835d1638bd14d6d2ebef2e5b4332a12ec8021 openrc-grep-3.8.patch +5e60f2ea652349d716646ccf05b13a510e5797daafc5e491dd35cc3850c543a7e7499a70956f91f30702c524989386d6e08735d7ad9b7bda5ff0c2c249d52cf8 remount-root.patch +1323a8476580f7b56a9cf1b24b26b10da76c5916cf23d7dab01f08a3261751341dfe01d1ed884df8e6ea17ff6a52021cc40fb3101e99b77d4ae7f3f61ee330e8 supervise-daemon-defaults.patch 12bb6354e808fbf47bbab963de55ee7901738b4a912659982c57ef2777fff9a670e867fcb8ec316a76b151032c92dc89a950d7d1d835ef53f753a8f3b41d2cec openrc.logrotate 493f27d588e64bb2bb542b32493ed05873f4724e8ad1751002982d7b4e07963cfb72f93603b2d678f305177cf9556d408a87b793744c6b7cd46cf9be4b744c02 hostname.initd -c06eac7264f6cc6888563feeae5ca745aae538323077903de1b19102e4f16baa34c18b8c27af5dd5423e7670834e2261e9aa55f2b1ec8d8fdc2be105fe894d55 hwdrivers.initd +787d783f91919c115809890f18d06d0812055f0aca42378e081d2cfbe2ff20a1db8d937b823ec4adbe0d380a6f02a2310dc74f6c3a2c36fd5d5371d51ad6d459 hwdrivers.initd 7113c930f7f5fb5b345b115db175f8e5837e3541b3e022d5cecf1b59067ed4b40b2adea2324a008035b97d653311217ac5cf961b4d0fc8b714a8b2505883cdc6 modules.initd 61857beb0ce1b462ff4bde595ee3808d12b1c51935e6a6bc263bf26a4adc99b434676277e270d82ed2886ceb9c82cb2a5604887bc25fef20bec223097c4d0ee4 modloop.initd 80e43ded522e2d48b876131c7c9997debd43f3790e0985801a8c1dd60bc6e09f625b35a127bf225eb45a65eec7808a50d1c08a5e8abceafc61726211e061e0a2 modloop.confd diff --git a/aports/openrc/hwdrivers.initd b/aports/openrc/hwdrivers.initd index 80184c9..c713990 100644 --- a/aports/openrc/hwdrivers.initd +++ b/aports/openrc/hwdrivers.initd @@ -16,10 +16,10 @@ start() { fi ebegin "Loading hardware drivers" - find /sys -name modalias -type f -print0 | xargs -0 sort -u \ + find /sys -name modalias -type f -print0 2> /dev/null | xargs -0 sort -u \ | xargs modprobe -b -a 2> /dev/null # we run it twice so we detect all devices - find /sys -name modalias -type f -print0 | xargs -0 sort -u \ + find /sys -name modalias -type f -print0 2> /dev/null | xargs -0 sort -u \ | xargs modprobe -b -a 2> /dev/null # check if framebuffer drivers got pulled in diff --git a/aports/openrc/remount-root.patch b/aports/openrc/remount-root.patch new file mode 100644 index 0000000..ae4f5b6 --- /dev/null +++ b/aports/openrc/remount-root.patch @@ -0,0 +1,42 @@ +From 489413c913af0708e9cfad987d6b3385d904e1ee Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?S=C3=B6ren=20Tempel?= <soeren+git@soeren-tempel.net> +Date: Mon, 20 Jun 2022 19:04:49 +0200 +Subject: [PATCH] init.d/root: also remount / with options provided in + /etc/fstab + +Without this commit, the root OpenRC service remounts all mounted +filesystems (except /) with the options defined in /etc/fstab via +fstabinfo. It is presently unclear to me why / was excluded from +remounting in 497ff7ee41168d863971efb52e2ca6b42f765832 and unfortunately +neither the commit nor the associated Bugzilla issue [1] provides +further information on this. + +At Alpine, our initramfs does currently not remount / with all options +defined in /etc/fstab [2]. As part of the discussion on the Alpine side +of things we wondered why OpenRC does not remount / since this would be +the easier solution for us. For this reason, this commit changes the +behavior of the OpenRC root services accordingly to also remount / with +the options defined in /etc/fstab. + +[1]: https://bugs.gentoo.org/401573 +[2]: https://gitlab.alpinelinux.org/alpine/mkinitfs/-/merge_requests/103 +This fixes #533. +--- + init.d/root.in | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/init.d/root.in b/init.d/root.in +index 045bcd0f..2f7d82f2 100644 +--- a/init.d/root.in ++++ b/init.d/root.in +@@ -49,9 +49,7 @@ start() + local mountpoint + for mountpoint in $(fstabinfo); do + case "${mountpoint}" in +- /) +- ;; +- /*) ++ /*) # Don't remount swap etc. + mountinfo -q "${mountpoint}" && \ + fstabinfo --remount "${mountpoint}" + ;; diff --git a/aports/openrc/seedrng.patch b/aports/openrc/seedrng.patch deleted file mode 100644 index ff61d81..0000000 --- a/aports/openrc/seedrng.patch +++ /dev/null @@ -1,640 +0,0 @@ -From 076c2552aeff88a27fe275dfaae61dedf4bb4bd5 Mon Sep 17 00:00:00 2001 -From: "Jason A. Donenfeld" <Jason@zx2c4.com> -Date: Thu, 24 Mar 2022 22:07:16 -0600 -Subject: [PATCH] Use seedrng for seeding the random number generator - -The RNG can't actually be seeded from a shell script, due to the -reliance on ioctls. For this reason, the seedrng project provides a -basic script meant to be copy and pasted into projects like OpenRC and -tweaked as needed: https://git.zx2c4.com/seedrng/about/ - -This commit imports it into OpenRC and wires up /etc/init.d/urandom to -call it. It shouldn't be called by other things on the system, so it -lives in rc_sbindir. - -Closes #506. -Closes #507. - -Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> ---- - AUTHORS | 1 + - conf.d/urandom | 9 +- - init.d/urandom.in | 41 ++-- - src/rc/Makefile | 6 +- - src/rc/meson.build | 10 +- - src/rc/seedrng.c | 453 +++++++++++++++++++++++++++++++++++++++++++++ - 6 files changed, 499 insertions(+), 21 deletions(-) - create mode 100644 src/rc/seedrng.c - -diff --git a/AUTHORS b/AUTHORS -index 0616d5175..ede0f471b 100644 ---- a/AUTHORS -+++ b/AUTHORS -@@ -43,6 +43,7 @@ Ian Stakenvicius <axs@gentoo.org> - Jakob Drexel <jake42@rommel.stw.uni-erlangen.de> - James Le Cuirot <chewi@aura-online.co.uk> - Jan Psota <jasiu@belsznica.pl> -+Jason A. Donenfeld <Jason@zx2c4.com> - Jason Zaman <jason@perfinion.com> - Joe Harvell <jharvell@dogpad.net> - Joe M <joe9mail@gmail.com> -diff --git a/conf.d/urandom b/conf.d/urandom -index f721a2491..744e4f702 100644 ---- a/conf.d/urandom -+++ b/conf.d/urandom -@@ -2,4 +2,11 @@ - # (say for crypt swap), so you will need to customize this - # behavior. If you have /var on a separate partition, then - # make sure this path lives on your root device somewhere. --urandom_seed="/var/lib/misc/random-seed" -+seed_dir="/var/lib/seedrng" -+lock_file="/var/run/seedrng.lock" -+ -+# Set this to true if you do not want seed files to actually -+# credit the RNG. Set this if you plan to replicate this -+# file system image and do not have the wherewithal to first -+# delete the contents of /var/lib/seedrng. -+skip_credit="false" -diff --git a/init.d/urandom.in b/init.d/urandom.in -index 0d6ab66e0..cda431fdb 100644 ---- a/init.d/urandom.in -+++ b/init.d/urandom.in -@@ -1,5 +1,5 @@ - #!@SBINDIR@/openrc-run --# Copyright (c) 2007-2015 The OpenRC Authors. -+# Copyright (c) 2007-2022 The OpenRC Authors. - # See the Authors file at the top-level directory of this distribution and - # https://github.com/OpenRC/openrc/blob/HEAD/AUTHORS - # -@@ -9,7 +9,10 @@ - # This file may not be copied, modified, propagated, or distributed - # except according to the terms contained in the LICENSE file. - --: ${urandom_seed:=${URANDOM_SEED:-/var/lib/misc/random-seed}} -+export SEEDRNG_SEED_DIR="${seed_dir:-/var/lib/seedrng}" -+export SEEDRNG_LOCK_FILE="${lock_file:-/var/run/seedrng.lock}" -+export SEEDRNG_SKIP_CREDIT="${skip_credit:-false}" -+: ${urandom_seed:=${SEEDRNG_SEED_DIR}/../misc/random-seed} - description="Initializes the random number generator." - - depend() -@@ -21,33 +24,35 @@ depend() - - save_seed() - { -- local psz=1 -- -- if [ -e /proc/sys/kernel/random/poolsize ]; then -- : $(( psz = $(cat /proc/sys/kernel/random/poolsize) / 4096 )) -- fi -- - ( # sub shell to prevent umask pollution - umask 077 -- dd if=/dev/urandom of="$urandom_seed" count=${psz} 2>/dev/null -+ dd if=/dev/urandom of="$urandom_seed" count=1 2>/dev/null - ) - } - - start() - { -- [ -c /dev/urandom ] || return -- if [ -f "$urandom_seed" ]; then -- ebegin "Initializing random number generator" -- cat "$urandom_seed" > /dev/urandom -- eend $? "Error initializing random number generator" -+ if [ "$RC_UNAME" = Linux ]; then -+ seedrng -+ else -+ [ -c /dev/urandom ] || return -+ if [ -f "$urandom_seed" ]; then -+ ebegin "Initializing random number generator" -+ cat "$urandom_seed" > /dev/urandom -+ eend $? "Error initializing random number generator" -+ fi -+ rm -f "$urandom_seed" && save_seed - fi -- rm -f "$urandom_seed" && save_seed - return 0 - } - - stop() - { -- ebegin "Saving random seed" -- save_seed -- eend $? "Failed to save random seed" -+ if [ "$RC_UNAME" = Linux ]; then -+ seedrng -+ else -+ ebegin "Saving random seed" -+ save_seed -+ eend $? "Failed to save random seed" -+ fi - } -diff --git a/src/rc/Makefile b/src/rc/Makefile -index fd796d920..62539f134 100644 ---- a/src/rc/Makefile -+++ b/src/rc/Makefile -@@ -15,7 +15,7 @@ endif - - ifeq (${OS},Linux) - SRCS+= kill_all.c openrc-init.c openrc-shutdown.c rc-sysvinit.c broadcast.c \ -- rc-wtmp.c -+ rc-wtmp.c seedrng.c - endif - - CLEANFILES= version.h rc-selinux.o -@@ -47,6 +47,7 @@ RC_SBINPROGS= mark_service_starting mark_service_started \ - - ifeq (${OS},Linux) - RC_BINPROGS+= kill_all -+RC_SBINPROGS+= seedrng - SBINPROGS+= openrc-init openrc-shutdown - endif - -@@ -180,3 +181,6 @@ shell_var: shell_var.o - - swclock: swclock.o _usage.o rc-misc.o - ${CC} ${LOCAL_CFLAGS} ${LOCAL_LDFLAGS} ${CFLAGS} ${LDFLAGS} -o $@ $^ ${LDADD} -+ -+seedrng: seedrng.o -+ ${CC} ${LOCAL_CFLAGS} ${LOCAL_LDFLAGS} ${CFLAGS} ${LDFLAGS} -o $@ $^ ${LDADD} -diff --git a/src/rc/meson.build b/src/rc/meson.build -index 8fdf3ac3b..b724c51f2 100644 ---- a/src/rc/meson.build -+++ b/src/rc/meson.build -@@ -268,7 +268,15 @@ if os == 'Linux' - link_with: [libeinfo,librc], - install: true, - install_dir: rc_bindir) -- endif -+ -+ executable('seedrng', -+ ['seedrng.c'], -+ c_args : cc_branding_flags, -+ include_directories: [incdir, einfo_incdir, rc_incdir], -+ link_with: [libeinfo, librc], -+ install: true, -+ install_dir: rc_sbindir) -+endif - - executable('shell_var', - ['shell_var.c'], -diff --git a/src/rc/seedrng.c b/src/rc/seedrng.c -new file mode 100644 -index 000000000..c1f941457 ---- /dev/null -+++ b/src/rc/seedrng.c -@@ -0,0 +1,453 @@ -+/* -+ * seedrng.c -+ * Seed kernel RNG from seed file, based on code from: -+ * https://git.zx2c4.com/seedrng/about/ -+ */ -+ -+/* -+ * Copyright (c) 2022 The OpenRC Authors. -+ * See the Authors file at the top-level directory of this distribution and -+ * https://github.com/OpenRC/openrc/blob/HEAD/AUTHORS -+ * -+ * This file is part of OpenRC. It is subject to the license terms in -+ * the LICENSE file found in the top-level directory of this -+ * distribution and at https://github.com/OpenRC/openrc/blob/HEAD/LICENSE -+ * This file may not be copied, modified, propagated, or distributed -+ * except according to the terms contained in the LICENSE file. -+ */ -+ -+#include <linux/random.h> -+#include <sys/random.h> -+#include <sys/ioctl.h> -+#include <sys/file.h> -+#include <sys/stat.h> -+#include <sys/types.h> -+#include <fcntl.h> -+#include <poll.h> -+#include <unistd.h> -+#include <time.h> -+#include <errno.h> -+#include <endian.h> -+#include <stdbool.h> -+#include <stdint.h> -+#include <string.h> -+#include <stdio.h> -+#include <stdlib.h> -+ -+#include "rc.h" -+#include "einfo.h" -+#include "helpers.h" -+ -+#ifndef GRND_INSECURE -+#define GRND_INSECURE 0x0004 /* Apparently some headers don't ship with this yet. */ -+#endif -+ -+static const char *SEED_DIR; -+static const char *LOCK_FILE; -+static char *CREDITABLE_SEED; -+static char *NON_CREDITABLE_SEED; -+ -+enum blake2s_lengths { -+ BLAKE2S_BLOCK_LEN = 64, -+ BLAKE2S_HASH_LEN = 32, -+ BLAKE2S_KEY_LEN = 32 -+}; -+ -+enum seedrng_lengths { -+ MAX_SEED_LEN = 512, -+ MIN_SEED_LEN = BLAKE2S_HASH_LEN -+}; -+ -+struct blake2s_state { -+ uint32_t h[8]; -+ uint32_t t[2]; -+ uint32_t f[2]; -+ uint8_t buf[BLAKE2S_BLOCK_LEN]; -+ unsigned int buflen; -+ unsigned int outlen; -+}; -+ -+#define le32_to_cpup(a) le32toh(*(a)) -+#define cpu_to_le32(a) htole32(a) -+#ifndef ARRAY_SIZE -+#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0])) -+#endif -+#ifndef DIV_ROUND_UP -+#define DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d)) -+#endif -+ -+static inline void cpu_to_le32_array(uint32_t *buf, unsigned int words) -+{ -+ while (words--) { -+ *buf = cpu_to_le32(*buf); -+ ++buf; -+ } -+} -+ -+static inline void le32_to_cpu_array(uint32_t *buf, unsigned int words) -+{ -+ while (words--) { -+ *buf = le32_to_cpup(buf); -+ ++buf; -+ } -+} -+ -+static inline uint32_t ror32(uint32_t word, unsigned int shift) -+{ -+ return (word >> (shift & 31)) | (word << ((-shift) & 31)); -+} -+ -+static const uint32_t blake2s_iv[8] = { -+ 0x6A09E667UL, 0xBB67AE85UL, 0x3C6EF372UL, 0xA54FF53AUL, -+ 0x510E527FUL, 0x9B05688CUL, 0x1F83D9ABUL, 0x5BE0CD19UL -+}; -+ -+static const uint8_t blake2s_sigma[10][16] = { -+ { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 }, -+ { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 }, -+ { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 }, -+ { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 }, -+ { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 }, -+ { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 }, -+ { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 }, -+ { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 }, -+ { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 }, -+ { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0 }, -+}; -+ -+static void blake2s_set_lastblock(struct blake2s_state *state) -+{ -+ state->f[0] = -1; -+} -+ -+static void blake2s_increment_counter(struct blake2s_state *state, const uint32_t inc) -+{ -+ state->t[0] += inc; -+ state->t[1] += (state->t[0] < inc); -+} -+ -+static void blake2s_init_param(struct blake2s_state *state, const uint32_t param) -+{ -+ int i; -+ -+ memset(state, 0, sizeof(*state)); -+ for (i = 0; i < 8; ++i) -+ state->h[i] = blake2s_iv[i]; -+ state->h[0] ^= param; -+} -+ -+static void blake2s_init(struct blake2s_state *state, const size_t outlen) -+{ -+ blake2s_init_param(state, 0x01010000 | outlen); -+ state->outlen = outlen; -+} -+ -+static void blake2s_compress(struct blake2s_state *state, const uint8_t *block, size_t nblocks, const uint32_t inc) -+{ -+ uint32_t m[16]; -+ uint32_t v[16]; -+ int i; -+ -+ while (nblocks > 0) { -+ blake2s_increment_counter(state, inc); -+ memcpy(m, block, BLAKE2S_BLOCK_LEN); -+ le32_to_cpu_array(m, ARRAY_SIZE(m)); -+ memcpy(v, state->h, 32); -+ v[ 8] = blake2s_iv[0]; -+ v[ 9] = blake2s_iv[1]; -+ v[10] = blake2s_iv[2]; -+ v[11] = blake2s_iv[3]; -+ v[12] = blake2s_iv[4] ^ state->t[0]; -+ v[13] = blake2s_iv[5] ^ state->t[1]; -+ v[14] = blake2s_iv[6] ^ state->f[0]; -+ v[15] = blake2s_iv[7] ^ state->f[1]; -+ -+#define G(r, i, a, b, c, d) do { \ -+ a += b + m[blake2s_sigma[r][2 * i + 0]]; \ -+ d = ror32(d ^ a, 16); \ -+ c += d; \ -+ b = ror32(b ^ c, 12); \ -+ a += b + m[blake2s_sigma[r][2 * i + 1]]; \ -+ d = ror32(d ^ a, 8); \ -+ c += d; \ -+ b = ror32(b ^ c, 7); \ -+} while (0) -+ -+#define ROUND(r) do { \ -+ G(r, 0, v[0], v[ 4], v[ 8], v[12]); \ -+ G(r, 1, v[1], v[ 5], v[ 9], v[13]); \ -+ G(r, 2, v[2], v[ 6], v[10], v[14]); \ -+ G(r, 3, v[3], v[ 7], v[11], v[15]); \ -+ G(r, 4, v[0], v[ 5], v[10], v[15]); \ -+ G(r, 5, v[1], v[ 6], v[11], v[12]); \ -+ G(r, 6, v[2], v[ 7], v[ 8], v[13]); \ -+ G(r, 7, v[3], v[ 4], v[ 9], v[14]); \ -+} while (0) -+ ROUND(0); -+ ROUND(1); -+ ROUND(2); -+ ROUND(3); -+ ROUND(4); -+ ROUND(5); -+ ROUND(6); -+ ROUND(7); -+ ROUND(8); -+ ROUND(9); -+ -+#undef G -+#undef ROUND -+ -+ for (i = 0; i < 8; ++i) -+ state->h[i] ^= v[i] ^ v[i + 8]; -+ -+ block += BLAKE2S_BLOCK_LEN; -+ --nblocks; -+ } -+} -+ -+static void blake2s_update(struct blake2s_state *state, const void *inp, size_t inlen) -+{ -+ const size_t fill = BLAKE2S_BLOCK_LEN - state->buflen; -+ const uint8_t *in = inp; -+ -+ if (!inlen) -+ return; -+ if (inlen > fill) { -+ memcpy(state->buf + state->buflen, in, fill); -+ blake2s_compress(state, state->buf, 1, BLAKE2S_BLOCK_LEN); -+ state->buflen = 0; -+ in += fill; -+ inlen -= fill; -+ } -+ if (inlen > BLAKE2S_BLOCK_LEN) { -+ const size_t nblocks = DIV_ROUND_UP(inlen, BLAKE2S_BLOCK_LEN); -+ blake2s_compress(state, in, nblocks - 1, BLAKE2S_BLOCK_LEN); -+ in += BLAKE2S_BLOCK_LEN * (nblocks - 1); -+ inlen -= BLAKE2S_BLOCK_LEN * (nblocks - 1); -+ } -+ memcpy(state->buf + state->buflen, in, inlen); -+ state->buflen += inlen; -+} -+ -+static void blake2s_final(struct blake2s_state *state, uint8_t *out) -+{ -+ blake2s_set_lastblock(state); -+ memset(state->buf + state->buflen, 0, BLAKE2S_BLOCK_LEN - state->buflen); -+ blake2s_compress(state, state->buf, 1, state->buflen); -+ cpu_to_le32_array(state->h, ARRAY_SIZE(state->h)); -+ memcpy(out, state->h, state->outlen); -+} -+ -+static size_t determine_optimal_seed_len(void) -+{ -+ size_t ret = 0; -+ char poolsize_str[11] = { 0 }; -+ int fd = open("/proc/sys/kernel/random/poolsize", O_RDONLY); -+ -+ if (fd < 0 || read(fd, poolsize_str, sizeof(poolsize_str) - 1) < 0) { -+ ewarn("Unable to determine pool size, falling back to %u bits: %s", MIN_SEED_LEN * 8, strerror(errno)); -+ ret = MIN_SEED_LEN; -+ } else -+ ret = DIV_ROUND_UP(strtoul(poolsize_str, NULL, 10), 8); -+ if (fd >= 0) -+ close(fd); -+ if (ret < MIN_SEED_LEN) -+ ret = MIN_SEED_LEN; -+ else if (ret > MAX_SEED_LEN) -+ ret = MAX_SEED_LEN; -+ return ret; -+} -+ -+static int read_new_seed(uint8_t *seed, size_t len, bool *is_creditable) -+{ -+ ssize_t ret; -+ int urandom_fd; -+ -+ *is_creditable = false; -+ ret = getrandom(seed, len, GRND_NONBLOCK); -+ if (ret == (ssize_t)len) { -+ *is_creditable = true; -+ return 0; -+ } -+ if (ret == -1 && errno == ENOSYS) { -+ struct pollfd random_fd = { -+ .fd = open("/dev/random", O_RDONLY), -+ .events = POLLIN -+ }; -+ if (random_fd.fd < 0) -+ return -errno; -+ *is_creditable = poll(&random_fd, 1, 0) == 1; -+ close(random_fd.fd); -+ } else if (getrandom(seed, len, GRND_INSECURE) == (ssize_t)len) -+ return 0; -+ urandom_fd = open("/dev/urandom", O_RDONLY); -+ if (urandom_fd < 0) -+ return -errno; -+ ret = read(urandom_fd, seed, len); -+ if (ret == (ssize_t)len) -+ ret = 0; -+ else -+ ret = -errno ? -errno : -EIO; -+ close(urandom_fd); -+ return ret; -+} -+ -+static int seed_rng(uint8_t *seed, size_t len, bool credit) -+{ -+ struct { -+ int entropy_count; -+ int buf_size; -+ uint8_t buffer[MAX_SEED_LEN]; -+ } req = { -+ .entropy_count = credit ? len * 8 : 0, -+ .buf_size = len -+ }; -+ int random_fd, ret; -+ -+ if (len > sizeof(req.buffer)) -+ return -EFBIG; -+ memcpy(req.buffer, seed, len); -+ -+ random_fd = open("/dev/random", O_RDWR); -+ if (random_fd < 0) -+ return -errno; -+ ret = ioctl(random_fd, RNDADDENTROPY, &req); -+ if (ret) -+ ret = -errno ? -errno : -EIO; -+ close(random_fd); -+ return ret; -+} -+ -+static int seed_from_file_if_exists(const char *filename, bool credit, struct blake2s_state *hash) -+{ -+ uint8_t seed[MAX_SEED_LEN]; -+ ssize_t seed_len; -+ int fd, dfd, ret = 0; -+ -+ fd = open(filename, O_RDONLY); -+ if (fd < 0 && errno == ENOENT) -+ return 0; -+ else if (fd < 0) { -+ ret = -errno; -+ eerror("Unable to open seed file: %s", strerror(errno)); -+ return ret; -+ } -+ dfd = open(SEED_DIR, O_DIRECTORY | O_RDONLY); -+ if (dfd < 0) { -+ ret = -errno; -+ close(fd); -+ eerror("Unable to open seed directory: %s", strerror(errno)); -+ return ret; -+ } -+ seed_len = read(fd, seed, sizeof(seed)); -+ if (seed_len < 0) { -+ ret = -errno; -+ eerror("Unable to read seed file: %s", strerror(errno)); -+ } -+ close(fd); -+ if (ret) { -+ close(dfd); -+ return ret; -+ } -+ if ((unlink(filename) < 0 || fsync(dfd) < 0) && seed_len) { -+ ret = -errno; -+ eerror("Unable to remove seed after reading, so not seeding: %s", strerror(errno)); -+ } -+ close(dfd); -+ if (ret) -+ return ret; -+ if (!seed_len) -+ return 0; -+ -+ blake2s_update(hash, &seed_len, sizeof(seed_len)); -+ blake2s_update(hash, seed, seed_len); -+ -+ einfo("Seeding %zd bits %s crediting", seed_len * 8, credit ? "and" : "without"); -+ ret = seed_rng(seed, seed_len, credit); -+ if (ret < 0) -+ eerror("Unable to seed: %s", strerror(-ret)); -+ return ret; -+} -+ -+static void populate_global_paths(void) -+{ -+ SEED_DIR = getenv("SEEDRNG_SEED_DIR"); -+ if (!SEED_DIR || !*SEED_DIR) -+ SEED_DIR = "/var/lib/seedrng"; -+ LOCK_FILE = getenv("SEEDRNG_LOCK_FILE"); -+ if (!LOCK_FILE || !*LOCK_FILE) -+ LOCK_FILE = "/var/run/seedrng.lock"; -+ xasprintf(&CREDITABLE_SEED, "%s/seed.credit", SEED_DIR); -+ xasprintf(&NON_CREDITABLE_SEED, "%s/seed.no-credit", SEED_DIR); -+} -+ -+int main(int argc _unused, char *argv[] _unused) -+{ -+ static const char seedrng_prefix[] = "SeedRNG v1 Old+New Prefix"; -+ static const char seedrng_failure[] = "SeedRNG v1 No New Seed Failure"; -+ int ret, fd, lock, program_ret = 0; -+ uint8_t new_seed[MAX_SEED_LEN]; -+ size_t new_seed_len; -+ bool new_seed_creditable; -+ struct timespec realtime = { 0 }, boottime = { 0 }; -+ struct blake2s_state hash; -+ -+ umask(0077); -+ if (getuid()) -+ eerrorx("This rc helper program requires root"); -+ -+ populate_global_paths(); -+ blake2s_init(&hash, BLAKE2S_HASH_LEN); -+ blake2s_update(&hash, seedrng_prefix, strlen(seedrng_prefix)); -+ clock_gettime(CLOCK_REALTIME, &realtime); -+ clock_gettime(CLOCK_BOOTTIME, &boottime); -+ blake2s_update(&hash, &realtime, sizeof(realtime)); -+ blake2s_update(&hash, &boottime, sizeof(boottime)); -+ -+ if (mkdir(SEED_DIR, 0700) < 0 && errno != EEXIST) -+ eerrorx("Unable to create \"%s\" directory: %s", SEED_DIR, strerror(errno)); -+ -+ lock = open(LOCK_FILE, O_WRONLY | O_CREAT, 0000); -+ if (lock < 0 || flock(lock, LOCK_EX) < 0) -+ eerrorx("Unable to open lock file: %s", strerror(errno)); -+ -+ ret = seed_from_file_if_exists(NON_CREDITABLE_SEED, false, &hash); -+ if (ret < 0) -+ program_ret |= 1 << 1; -+ ret = seed_from_file_if_exists(CREDITABLE_SEED, !rc_yesno(getenv("SEEDRNG_SKIP_CREDIT")), &hash); -+ if (ret < 0) -+ program_ret |= 1 << 2; -+ -+ new_seed_len = determine_optimal_seed_len(); -+ ret = read_new_seed(new_seed, new_seed_len, &new_seed_creditable); -+ if (ret < 0) { -+ eerror("Unable to read new seed: %s", strerror(-ret)); -+ new_seed_len = BLAKE2S_HASH_LEN; -+ strncpy((char *)new_seed, seedrng_failure, new_seed_len); -+ program_ret |= 1 << 3; -+ } -+ blake2s_update(&hash, &new_seed_len, sizeof(new_seed_len)); -+ blake2s_update(&hash, new_seed, new_seed_len); -+ blake2s_final(&hash, new_seed + new_seed_len - BLAKE2S_HASH_LEN); -+ -+ einfo("Saving %zu bits of %s seed for next boot", new_seed_len * 8, new_seed_creditable ? "creditable" : "non-creditable"); -+ fd = open(NON_CREDITABLE_SEED, O_WRONLY | O_CREAT | O_TRUNC, 0400); -+ if (fd < 0) { -+ eerror("Unable to open seed file for writing: %s", strerror(errno)); -+ program_ret |= 1 << 4; -+ goto out; -+ } -+ if (write(fd, new_seed, new_seed_len) != (ssize_t)new_seed_len || fsync(fd) < 0) { -+ eerror("Unable to write seed file: %s", strerror(errno)); -+ program_ret |= 1 << 5; -+ goto out; -+ } -+ if (new_seed_creditable && rename(NON_CREDITABLE_SEED, CREDITABLE_SEED) < 0) { -+ ewarn("Unable to make new seed creditable: %s", strerror(errno)); -+ program_ret |= 1 << 6; -+ } -+out: -+ close(fd); -+ close(lock); -+ return program_ret; -+} diff --git a/aports/openrc/supervise-daemon-defaults.patch b/aports/openrc/supervise-daemon-defaults.patch new file mode 100644 index 0000000..53a70bb --- /dev/null +++ b/aports/openrc/supervise-daemon-defaults.patch @@ -0,0 +1,31 @@ +From: Jakub Jirutka <jakub@jirutka.cz> +Date: Wed, 16 Nov 2022 01:47:34 +0100 +Subject: [PATCH] Provide more reasonable defaults for supervise-daemon + +The vendor's default parameters for the supervise-daemon are unreasonable +or even unusable for most of the services (empirically found), especially +respawn_delay=0 (i.e. respawn crashed service immediately). + +--- a/etc/rc.conf ++++ b/etc/rc.conf +@@ -315,3 +315,20 @@ + # If this is set to no, we do not send sigkill to all processes in the + # cgroup. + #rc_send_sigkill="YES" ++ ++############################################################################## ++# SUPERVISE DAEMON CONFIGURATION VARIABLES ++# These variables sets more reasonable defaults for supervise-daemon(8). ++# They may be overriden on a per service basis. ++ ++# Wait this number of seconds before restarting a daemon after it crashes. ++respawn_delay=2 ++ ++# Sets the maximum number of times a daemon will be respawned during a respawn ++# period. If a daemon dies more than this number of times during a respawn ++# period, supervise-daemon(8) will give up trying to respawn it and exit. ++# 0 means unlimited. ++respawn_max=5 ++ ++# Sets the length in seconds of a respawn period. ++respawn_period=1800 diff --git a/aports/openrc/test-networking.sh b/aports/openrc/test-networking.sh deleted file mode 100644 index 5e5f70b..0000000 --- a/aports/openrc/test-networking.sh +++ /dev/null @@ -1,65 +0,0 @@ -#!/bin/sh - -# unit tests for find_ifaces and find_running_ifaces in networking.initd - -cfgfile=/tmp/openrc-test-network.$$ -sourcefile=$cfgfile.source -sourcedir=$cfgfile.d -ifstate=$cfgfile.state - -cat >$cfgfile<<EOF -auto eth0 -iface eth0 inet dhcp - -source $sourcefile - -source-directory $sourcedir -EOF - -cat >$sourcefile<<EOF -auto eth1 -iface eth1 inet dhcp -EOF - -mkdir -p $sourcedir -cat >$sourcedir/a<<EOF -auto eth2 -iface eth2 inet dhcp -EOF - -cat >$ifstate<<EOF -eth4=eth4 1 -EOF - -errors=0 -fail() { - echo "$@" - errors=$(( $errors + 1)) -} - -# test fallback, when ifquery does not exist -ifquery=does-not-exist -. ./networking.initd - -find_ifaces | grep -q -w eth0 || fail "Did not find eth0" -find_ifaces | grep -q -E '(eth1|eth2)' && fail "Unexpectedly found eth1 or eth2" - -# test that ifquery finds source and source-directory -unset ifquery -. ./networking.initd -for i in eth0 eth1 eth2; do - find_ifaces | grep -q -w "$i" || fail "Did not find $i" -done - -# test that ifquery picks up the running state file -find_running_ifaces | grep -q -w "eth4" || fail "Did not detect eth4 running" - - -# test /etc/init.d/net.eth5 -RC_SVCNAME=net.eth5 -. ./networking.initd -find_ifaces | grep -q -w "eth5" || fail "Did not detect eth5" -find_running_ifaces | grep -q -w "eth5" || fail "Did not detect eth5 running" - -rm -rf $cfgfile $sourcefile $sourcedir $ifstate -exit $errors diff --git a/aports/rtl8821ce/APKBUILD b/aports/rtl8821ce/APKBUILD index 0b48b5f..e3028a7 100644 --- a/aports/rtl8821ce/APKBUILD +++ b/aports/rtl8821ce/APKBUILD @@ -2,7 +2,7 @@ pkgname='rtl8821ce' pkgver=20220911 -pkgrel=0 +pkgrel=1 _gitrev='50c1b120b06a3b0805e23ca9a4dbd274d74bb305' pkgdesc='Driver for Realtek 8821CE, an 802.11ac device' arch="x86_64" diff --git a/aports/wpa_supplicant/APKBUILD b/aports/wpa_supplicant/APKBUILD index 5e7e18b..a9da28f 100644 --- a/aports/wpa_supplicant/APKBUILD +++ b/aports/wpa_supplicant/APKBUILD @@ -2,18 +2,20 @@ pkgname=wpa_supplicant pkgver=2.10 -pkgrel=0 # base: 1 +pkgrel=1 # base: 4 pkgdesc="utility providing key negotiation for WPA wireless networks" url="https://w1.fi/wpa_supplicant/" arch="all" options="!check" # has no tests license="BSD-3-Clause" subpackages= -makedepends="linux-headers openssl1.1-compat-dev dbus-dev libnl3-dev pcsc-lite-dev" +makedepends="linux-headers openssl-dev>3 dbus-dev libnl3-dev pcsc-lite-dev" source="https://w1.fi/releases/wpa_supplicant-$pkgver.tar.gz wpa_supplicant.initd wpa_supplicant.confd eloop.patch + unsafe-renegotiation-1.patch + unsafe-renegotiation-2.patch no-tools.patch config" @@ -55,6 +57,7 @@ prepare() { } build() { + export CFLAGS="$CFLAGS -flto=auto" cd "$builddir"/wpa_supplicant make LIBDIR=/lib BINDIR=/sbin } @@ -75,6 +78,8 @@ sha512sums=" 92c4cbaa9776a354275640c9411d2f547f4c0e00415af4ab30039f1a0be6a11082d49e2514905010f0abcc4a9276353276da9864e3d5f7264a0f0767c8cc9d78 wpa_supplicant.initd c7e4041fe41743c5e63a07edc9234d0c44c4c0f193a180b27342b43f3be45fb87b42ee0f9e4a20614cf6ad58cf64d25f74d1e75e2e1d521c2f6d45cdc5737eae wpa_supplicant.confd 2be055dd1f7da5a3d8e79c2f2c0220ddd31df309452da18f290144d2112d6dbde0fc633bb2ad02c386a39d7785323acaf5f70e5969995a1e8303a094eb5fe232 eloop.patch +9528735924faf876a7094de46760605e5e66e265187421a668be06dbf03d7b4db6b84cbad793fcd6bd614e3ba540f82f1f80660d75e8a6070eeb7e9abb54ed28 unsafe-renegotiation-1.patch +a92ba3ed3f41022a8af9396d2b703ee47f78aa05c1fddb42919a7fe6a6fad71e3515c63457e97e252ae0a32c6c34d67ea6efe0278df1e141cf36e650237e5295 unsafe-renegotiation-2.patch 3278eff7118f9dc9e177adc3ed91cad562a8edde396af8619321ac8552a86e9c7de25212d5578ea17cbe4b6dc928d83cd6e9a7f0d41e07576656e6e9274107d6 no-tools.patch -0e1af7084026c3b50b3a77636758f1ce3c1004e1e6d7eb71038e42c5c63866e2bbee3b0933b1131b80a6f2f6848983847a017ba2555a3162f0ccd3aa57fcf257 config +021d7d192b2e8e6bc89457ce4c8ada7eb897b3c4e8202697da44bde4cab49c0424156569c7a04dc58cae26e0e83e5f56421946679629535d0a749cda31f890c5 config " diff --git a/aports/wpa_supplicant/CVE-2019-16275.patch b/aports/wpa_supplicant/CVE-2019-16275.patch deleted file mode 100644 index d764a9d..0000000 --- a/aports/wpa_supplicant/CVE-2019-16275.patch +++ /dev/null @@ -1,73 +0,0 @@ -From 8c07fa9eda13e835f3f968b2e1c9a8be3a851ff9 Mon Sep 17 00:00:00 2001 -From: Jouni Malinen <j@w1.fi> -Date: Thu, 29 Aug 2019 11:52:04 +0300 -Subject: [PATCH] AP: Silently ignore management frame from unexpected source - address - -Do not process any received Management frames with unexpected/invalid SA -so that we do not add any state for unexpected STA addresses or end up -sending out frames to unexpected destination. This prevents unexpected -sequences where an unprotected frame might end up causing the AP to send -out a response to another device and that other device processing the -unexpected response. - -In particular, this prevents some potential denial of service cases -where the unexpected response frame from the AP might result in a -connected station dropping its association. - -Signed-off-by: Jouni Malinen <j@w1.fi> ---- - src/ap/drv_callbacks.c | 13 +++++++++++++ - src/ap/ieee802_11.c | 12 ++++++++++++ - 2 files changed, 25 insertions(+) - -diff --git a/src/ap/drv_callbacks.c b/src/ap/drv_callbacks.c -index 31587685fe3b..34ca379edc3d 100644 ---- a/src/ap/drv_callbacks.c -+++ b/src/ap/drv_callbacks.c -@@ -131,6 +131,19 @@ int hostapd_notif_assoc(struct hostapd_data *hapd, const u8 *addr, - "hostapd_notif_assoc: Skip event with no address"); - return -1; - } -+ -+ if (is_multicast_ether_addr(addr) || -+ is_zero_ether_addr(addr) || -+ os_memcmp(addr, hapd->own_addr, ETH_ALEN) == 0) { -+ /* Do not process any frames with unexpected/invalid SA so that -+ * we do not add any state for unexpected STA addresses or end -+ * up sending out frames to unexpected destination. */ -+ wpa_printf(MSG_DEBUG, "%s: Invalid SA=" MACSTR -+ " in received indication - ignore this indication silently", -+ __func__, MAC2STR(addr)); -+ return 0; -+ } -+ - random_add_randomness(addr, ETH_ALEN); - - hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211, -diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c -index c85a28db44b7..e7065372e158 100644 ---- a/src/ap/ieee802_11.c -+++ b/src/ap/ieee802_11.c -@@ -4626,6 +4626,18 @@ int ieee802_11_mgmt(struct hostapd_data *hapd, const u8 *buf, size_t len, - fc = le_to_host16(mgmt->frame_control); - stype = WLAN_FC_GET_STYPE(fc); - -+ if (is_multicast_ether_addr(mgmt->sa) || -+ is_zero_ether_addr(mgmt->sa) || -+ os_memcmp(mgmt->sa, hapd->own_addr, ETH_ALEN) == 0) { -+ /* Do not process any frames with unexpected/invalid SA so that -+ * we do not add any state for unexpected STA addresses or end -+ * up sending out frames to unexpected destination. */ -+ wpa_printf(MSG_DEBUG, "MGMT: Invalid SA=" MACSTR -+ " in received frame - ignore this frame silently", -+ MAC2STR(mgmt->sa)); -+ return 0; -+ } -+ - if (stype == WLAN_FC_STYPE_BEACON) { - handle_beacon(hapd, mgmt, len, fi); - return 1; --- -2.20.1 - diff --git a/aports/wpa_supplicant/CVE-2021-0326.patch b/aports/wpa_supplicant/CVE-2021-0326.patch deleted file mode 100644 index 2ad5f44..0000000 --- a/aports/wpa_supplicant/CVE-2021-0326.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 947272febe24a8f0ea828b5b2f35f13c3821901e Mon Sep 17 00:00:00 2001 -From: Jouni Malinen <jouni@codeaurora.org> -Date: Mon, 9 Nov 2020 11:43:12 +0200 -Subject: P2P: Fix copying of secondary device types for P2P group client - -Parsing and copying of WPS secondary device types list was verifying -that the contents is not too long for the internal maximum in the case -of WPS messages, but similar validation was missing from the case of P2P -group information which encodes this information in a different -attribute. This could result in writing beyond the memory area assigned -for these entries and corrupting memory within an instance of struct -p2p_device. This could result in invalid operations and unexpected -behavior when trying to free pointers from that corrupted memory. - -Credit to OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27269 -Fixes: e57ae6e19edf ("P2P: Keep track of secondary device types for peers") -Signed-off-by: Jouni Malinen <jouni@codeaurora.org> ---- - src/p2p/p2p.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/src/p2p/p2p.c b/src/p2p/p2p.c -index 74b7b52..5cbfc21 100644 ---- a/src/p2p/p2p.c -+++ b/src/p2p/p2p.c -@@ -453,6 +453,8 @@ static void p2p_copy_client_info(struct p2p_device *dev, - dev->info.config_methods = cli->config_methods; - os_memcpy(dev->info.pri_dev_type, cli->pri_dev_type, 8); - dev->info.wps_sec_dev_type_list_len = 8 * cli->num_sec_dev_types; -+ if (dev->info.wps_sec_dev_type_list_len > WPS_SEC_DEV_TYPE_MAX_LEN) -+ dev->info.wps_sec_dev_type_list_len = WPS_SEC_DEV_TYPE_MAX_LEN; - os_memcpy(dev->info.wps_sec_dev_type_list, cli->sec_dev_types, - dev->info.wps_sec_dev_type_list_len); - } --- -cgit v0.12 - diff --git a/aports/wpa_supplicant/CVE-2021-27803.patch b/aports/wpa_supplicant/CVE-2021-27803.patch deleted file mode 100644 index 1942bb3..0000000 --- a/aports/wpa_supplicant/CVE-2021-27803.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 8460e3230988ef2ec13ce6b69b687e941f6cdb32 Mon Sep 17 00:00:00 2001 -From: Jouni Malinen <jouni@codeaurora.org> -Date: Tue, 8 Dec 2020 23:52:50 +0200 -Subject: [PATCH] P2P: Fix a corner case in peer addition based on PD Request - -p2p_add_device() may remove the oldest entry if there is no room in the -peer table for a new peer. This would result in any pointer to that -removed entry becoming stale. A corner case with an invalid PD Request -frame could result in such a case ending up using (read+write) freed -memory. This could only by triggered when the peer table has reached its -maximum size and the PD Request frame is received from the P2P Device -Address of the oldest remaining entry and the frame has incorrect P2P -Device Address in the payload. - -Fix this by fetching the dev pointer again after having called -p2p_add_device() so that the stale pointer cannot be used. - -Fixes: 17bef1e97a50 ("P2P: Add peer entry based on Provision Discovery Request") -Signed-off-by: Jouni Malinen <jouni@codeaurora.org> ---- - src/p2p/p2p_pd.c | 12 +++++------- - 1 file changed, 5 insertions(+), 7 deletions(-) - -diff --git a/src/p2p/p2p_pd.c b/src/p2p/p2p_pd.c -index 3994ec03f86b..05fd593494ef 100644 ---- a/src/p2p/p2p_pd.c -+++ b/src/p2p/p2p_pd.c -@@ -595,14 +595,12 @@ void p2p_process_prov_disc_req(struct p2p_data *p2p, const u8 *sa, - goto out; - } - -+ dev = p2p_get_device(p2p, sa); - if (!dev) { -- dev = p2p_get_device(p2p, sa); -- if (!dev) { -- p2p_dbg(p2p, -- "Provision Discovery device not found " -- MACSTR, MAC2STR(sa)); -- goto out; -- } -+ p2p_dbg(p2p, -+ "Provision Discovery device not found " -+ MACSTR, MAC2STR(sa)); -+ goto out; - } - } else if (msg.wfd_subelems) { - wpabuf_free(dev->info.wfd_subelems); --- -2.25.1 - diff --git a/aports/wpa_supplicant/config b/aports/wpa_supplicant/config index ab425d0..12f711a 100644 --- a/aports/wpa_supplicant/config +++ b/aports/wpa_supplicant/config @@ -32,7 +32,7 @@ CONFIG_DRIVER_NL80211=y # QCA vendor extensions to nl80211 -#CONFIG_DRIVER_NL80211_QCA=y +CONFIG_DRIVER_NL80211_QCA=y # driver_nl80211.c requires libnl. If you are compiling it yourself # you may need to point hostapd to your version of libnl. @@ -207,7 +207,7 @@ CONFIG_HT_OVERRIDES=y CONFIG_VHT_OVERRIDES=y # Development testing -CONFIG_EAPOL_TEST=n +#CONFIG_EAPOL_TEST=y # Enable IPv6 support in eapol_test. # See: https://gitlab.alpinelinux.org/alpine/aports/-/issues/12429 @@ -486,7 +486,7 @@ CONFIG_DELAYED_MIC_ERROR_REPORT=y # Should we attempt to use the getrandom(2) call that provides more reliable # yet secure randomness source than /dev/random on Linux 3.17 and newer. # Requires glibc 2.25 to build, falls back to /dev/random if unavailable. -#CONFIG_GETRANDOM=y +CONFIG_GETRANDOM=y # IEEE 802.11n (High Throughput) support (mainly for AP mode) #CONFIG_IEEE80211N=y @@ -503,10 +503,10 @@ CONFIG_DELAYED_MIC_ERROR_REPORT=y # This can be used to enable functionality to improve interworking with # external networks (GAS/ANQP to learn more about the networks and network # selection based on available credentials). -#CONFIG_INTERWORKING=y +CONFIG_INTERWORKING=y # Hotspot 2.0 -#CONFIG_HS20=y +CONFIG_HS20=y # Enable interface matching in wpa_supplicant #CONFIG_MATCH_IFACE=y @@ -527,7 +527,7 @@ CONFIG_AP=y CONFIG_P2P=y # Enable TDLS support -#CONFIG_TDLS=y +CONFIG_TDLS=y # Wi-Fi Display # This can be used to enable Wi-Fi Display extensions for P2P using an external @@ -585,7 +585,7 @@ CONFIG_AUTOSCAN_PERIODIC=y # # For more details refer to: # http://wireless.kernel.org/en/users/Documentation/acs -#CONFIG_ACS=y +CONFIG_ACS=y # Support Multi Band Operation #CONFIG_MBO=y diff --git a/aports/wpa_supplicant/unsafe-renegotiation-1.patch b/aports/wpa_supplicant/unsafe-renegotiation-1.patch new file mode 100644 index 0000000..0802a1b --- /dev/null +++ b/aports/wpa_supplicant/unsafe-renegotiation-1.patch @@ -0,0 +1,103 @@ +Patch-Source: https://w1.fi/cgit/hostap/commit/?id=566ce69a8d0e64093309cbde80235aa522fbf84e +From 566ce69a8d0e64093309cbde80235aa522fbf84e Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <quic_jouni@quicinc.com> +Date: Thu, 5 May 2022 00:07:44 +0300 +Subject: EAP peer: Workaround for servers that do not support safe TLS + renegotiation + +The TLS protocol design for renegotiation was identified to have a +significant security flaw in 2009 and an extension to secure this design +was published in 2010 (RFC 5746). However, some old RADIUS +authentication servers without support for this are still used commonly. + +This is obviously not good from the security view point, but since there +are cases where the user of a network service has no realistic means for +getting the authentication server upgraded, TLS handshake may still need +to be allowed to be able to use the network. + +OpenSSL 3.0 disabled the client side workaround by default and this +resulted in issues connection to some networks with insecure +authentication servers. With OpenSSL 3.0, the client is now enforcing +security by refusing to authenticate with such servers. The pre-3.0 +behavior of ignoring this issue and leaving security to the server can +now be enabled with a new phase1 parameter allow_unsafe_renegotiation=1. +This should be used only when having to connect to a network that has an +insecure authentication server that cannot be upgraded. + +The old (pre-2010) TLS renegotiation mechanism might open security +vulnerabilities if the authentication server were to allow TLS +renegotiation to be initiated. While this is unlikely to cause real +issues with EAP-TLS, there might be cases where use of PEAP or TTLS with +an authentication server that does not support RFC 5746 might result in +a security vulnerability. + +Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com> +--- + src/crypto/tls.h | 1 + + src/crypto/tls_openssl.c | 5 +++++ + src/eap_peer/eap_tls_common.c | 4 ++++ + wpa_supplicant/wpa_supplicant.conf | 5 +++++ + 4 files changed, 15 insertions(+) + +diff --git a/src/crypto/tls.h b/src/crypto/tls.h +index ccaac94c9..7ea32ee4a 100644 +--- a/src/crypto/tls.h ++++ b/src/crypto/tls.h +@@ -112,6 +112,7 @@ struct tls_config { + #define TLS_CONN_ENABLE_TLSv1_1 BIT(15) + #define TLS_CONN_ENABLE_TLSv1_2 BIT(16) + #define TLS_CONN_TEAP_ANON_DH BIT(17) ++#define TLS_CONN_ALLOW_UNSAFE_RENEGOTIATION BIT(18) + + /** + * struct tls_connection_params - Parameters for TLS connection +diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c +index 388c6b0f4..0d23f44ad 100644 +--- a/src/crypto/tls_openssl.c ++++ b/src/crypto/tls_openssl.c +@@ -3081,6 +3081,11 @@ static int tls_set_conn_flags(struct tls_connection *conn, unsigned int flags, + SSL_clear_options(ssl, SSL_OP_NO_TICKET); + #endif /* SSL_OP_NO_TICKET */ + ++#ifdef SSL_OP_LEGACY_SERVER_CONNECT ++ if (flags & TLS_CONN_ALLOW_UNSAFE_RENEGOTIATION) ++ SSL_set_options(ssl, SSL_OP_LEGACY_SERVER_CONNECT); ++#endif /* SSL_OP_LEGACY_SERVER_CONNECT */ ++ + #ifdef SSL_OP_NO_TLSv1 + if (flags & TLS_CONN_DISABLE_TLSv1_0) + SSL_set_options(ssl, SSL_OP_NO_TLSv1); +diff --git a/src/eap_peer/eap_tls_common.c b/src/eap_peer/eap_tls_common.c +index 06c9b211e..6193b4bdb 100644 +--- a/src/eap_peer/eap_tls_common.c ++++ b/src/eap_peer/eap_tls_common.c +@@ -102,6 +102,10 @@ static void eap_tls_params_flags(struct tls_connection_params *params, + params->flags |= TLS_CONN_SUITEB_NO_ECDH; + if (os_strstr(txt, "tls_suiteb_no_ecdh=0")) + params->flags &= ~TLS_CONN_SUITEB_NO_ECDH; ++ if (os_strstr(txt, "allow_unsafe_renegotiation=1")) ++ params->flags |= TLS_CONN_ALLOW_UNSAFE_RENEGOTIATION; ++ if (os_strstr(txt, "allow_unsafe_renegotiation=0")) ++ params->flags &= ~TLS_CONN_ALLOW_UNSAFE_RENEGOTIATION; + } + + +diff --git a/wpa_supplicant/wpa_supplicant.conf b/wpa_supplicant/wpa_supplicant.conf +index a1dc769c9..b5304a77e 100644 +--- a/wpa_supplicant/wpa_supplicant.conf ++++ b/wpa_supplicant/wpa_supplicant.conf +@@ -1370,6 +1370,11 @@ fast_reauth=1 + # tls_suiteb=0 - do not apply Suite B 192-bit constraints on TLS (default) + # tls_suiteb=1 - apply Suite B 192-bit constraints on TLS; this is used in + # particular when using Suite B with RSA keys of >= 3K (3072) bits ++# allow_unsafe_renegotiation=1 - allow connection with a TLS server that does ++# not support safe renegotiation (RFC 5746); please note that this ++# workaround should be only when having to authenticate with an old ++# authentication server that cannot be updated to use secure TLS ++# implementation. + # + # Following certificate/private key fields are used in inner Phase2 + # authentication when using EAP-TTLS or EAP-PEAP. +-- +cgit v1.2.3-18-g5258 + diff --git a/aports/wpa_supplicant/unsafe-renegotiation-2.patch b/aports/wpa_supplicant/unsafe-renegotiation-2.patch new file mode 100644 index 0000000..2046637 --- /dev/null +++ b/aports/wpa_supplicant/unsafe-renegotiation-2.patch @@ -0,0 +1,105 @@ +Patch-Source: https://w1.fi/cgit/hostap/commit/?id=a561d12d24c2c8bb0f825d4a3a55a5e47e845853 +From a561d12d24c2c8bb0f825d4a3a55a5e47e845853 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <quic_jouni@quicinc.com> +Date: Wed, 4 May 2022 23:55:38 +0300 +Subject: EAP peer status notification for server not supporting RFC 5746 + +Add a notification message to indicate reason for TLS handshake failure +due to the server not supporting safe renegotiation (RFC 5746). + +Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com> +--- + src/ap/authsrv.c | 3 +++ + src/crypto/tls.h | 3 ++- + src/crypto/tls_openssl.c | 15 +++++++++++++-- + src/eap_peer/eap.c | 5 +++++ + 4 files changed, 23 insertions(+), 3 deletions(-) + +diff --git a/src/ap/authsrv.c b/src/ap/authsrv.c +index 516c1da74..fd9c96fad 100644 +--- a/src/ap/authsrv.c ++++ b/src/ap/authsrv.c +@@ -169,6 +169,9 @@ static void authsrv_tls_event(void *ctx, enum tls_event ev, + wpa_printf(MSG_DEBUG, "authsrv: remote TLS alert: %s", + data->alert.description); + break; ++ case TLS_UNSAFE_RENEGOTIATION_DISABLED: ++ /* Not applicable to TLS server */ ++ break; + } + } + #endif /* EAP_TLS_FUNCS */ +diff --git a/src/crypto/tls.h b/src/crypto/tls.h +index 7ea32ee4a..7a2ee32df 100644 +--- a/src/crypto/tls.h ++++ b/src/crypto/tls.h +@@ -22,7 +22,8 @@ enum tls_event { + TLS_CERT_CHAIN_SUCCESS, + TLS_CERT_CHAIN_FAILURE, + TLS_PEER_CERTIFICATE, +- TLS_ALERT ++ TLS_ALERT, ++ TLS_UNSAFE_RENEGOTIATION_DISABLED, + }; + + /* +diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c +index 0d23f44ad..912471ba2 100644 +--- a/src/crypto/tls_openssl.c ++++ b/src/crypto/tls_openssl.c +@@ -4443,6 +4443,7 @@ int tls_connection_get_eap_fast_key(void *tls_ctx, struct tls_connection *conn, + static struct wpabuf * + openssl_handshake(struct tls_connection *conn, const struct wpabuf *in_data) + { ++ struct tls_context *context = conn->context; + int res; + struct wpabuf *out_data; + +@@ -4472,7 +4473,19 @@ openssl_handshake(struct tls_connection *conn, const struct wpabuf *in_data) + wpa_printf(MSG_DEBUG, "SSL: SSL_connect - want to " + "write"); + else { ++ unsigned long error = ERR_peek_last_error(); ++ + tls_show_errors(MSG_INFO, __func__, "SSL_connect"); ++ ++ if (context->event_cb && ++ ERR_GET_LIB(error) == ERR_LIB_SSL && ++ ERR_GET_REASON(error) == ++ SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED) { ++ context->event_cb( ++ context->cb_ctx, ++ TLS_UNSAFE_RENEGOTIATION_DISABLED, ++ NULL); ++ } + conn->failed++; + if (!conn->server && !conn->client_hello_generated) { + /* The server would not understand TLS Alert +@@ -4495,8 +4508,6 @@ openssl_handshake(struct tls_connection *conn, const struct wpabuf *in_data) + if ((conn->flags & TLS_CONN_SUITEB) && !conn->server && + os_strncmp(SSL_get_cipher(conn->ssl), "DHE-", 4) == 0 && + conn->server_dh_prime_len < 3072) { +- struct tls_context *context = conn->context; +- + /* + * This should not be reached since earlier cert_cb should have + * terminated the handshake. Keep this check here for extra +diff --git a/src/eap_peer/eap.c b/src/eap_peer/eap.c +index 429b20d3a..729388f4f 100644 +--- a/src/eap_peer/eap.c ++++ b/src/eap_peer/eap.c +@@ -2172,6 +2172,11 @@ static void eap_peer_sm_tls_event(void *ctx, enum tls_event ev, + eap_notify_status(sm, "remote TLS alert", + data->alert.description); + break; ++ case TLS_UNSAFE_RENEGOTIATION_DISABLED: ++ wpa_printf(MSG_INFO, ++ "TLS handshake failed due to the server not supporting safe renegotiation (RFC 5746); phase1 parameter allow_unsafe_renegotiation=1 can be used to work around this"); ++ eap_notify_status(sm, "unsafe server renegotiation", "failure"); ++ break; + } + + os_free(hash_hex); +-- +cgit v1.2.3-18-g5258 + |