If we're going to have a list of ntp servers, we should at least respect
them. Fallback to the original static list if no configured servers are
found.
Signed-off-by: Karl Palsson <karlp@etactica.com>
This is a minor bugfix release. Full changelog available at:
https://mosquitto.org/blog/2019/02/version-1-5-7-released/
Most relevant to OpenWrt are probably:
* fixing persistent store bloat
* fix sorting of included config files
* fix errors related to per_listener_settings
Signed-off-by: Karl Palsson <karlp@etactica.com>
This is a bugfix and security release.
CVE-2018-12551: If Mosquitto is configured to use a password file for
authentication, any malformed data in the password file will be
treated as valid. This typically means that the malformed data becomes
a username and no password. If this occurs, clients can circumvent
authentication and get access to the broker by using the malformed
username. In particular, a blank line will be treated as a valid empty
username. Other security measures are unaffected.
=> Users who have only used the mosquitto_passwd utility to create and
modify their password files are unaffected by this vulnerability.
CVE-2018-12550: If an ACL file is empty, or has only blank lines or
comments, then mosquitto treats the ACL file as not being defined,
which means that no topic access is denied. Although denying access to
all topics is not a useful configuration, this behaviour is unexpected
and could lead to access being incorrectly granted in some
circumstances.
CVE-2018-12546. If a client publishes a retained message to a topic
that they have access to, and then their access to that topic is
revoked, the retained message will still be delivered to future
subscribers. This behaviour may be undesirable in some applications,
so a configuration option `check_retain_source` has been introduced to
enforce checking of the retained message source on publish.
Plus the following bugfixes:
* wills not sent to websocket clients
* spaces now allowed in bridge usernames
* durable clients not receiving offline messages with
per_listener_settings==true
* compilation with openssl without deprecated apis
* TLS working over SOCKS
* better comment handling in config files
Full changelog available at: https://github.com/eclipse/mosquitto/blob/fixes/ChangeLog.txt#L1
Signed-off-by: Karl Palsson <karlp@etactica.com>
Drops an openssl deprecation patch applied upstream.
Changes since 3.0.0, the following list of websocket related features:
* gzip+brotli compression in the webserver
* threadpools
* string tokenizers
* http reverse proxies
* managed disk cache
Full changes at https://libwebsockets.org/git/libwebsockets/tree/changelog?id=89eedcaa94e1c8a97ea3af10642fd224bcea068f#n4
Tested on ath79, and classic usage of libwebsockets to provide
websockets support to a C application.
Signed-off-by: Karl Palsson <karlp@etactica.com>
Adds support for acl_plugin, and acl_opt_* options.
acl_opt_* requires some care as it relies on the internal behaviour of
cfg_load setting environment variables in a certain form. However,
given that _all_ of the cfg_load infrastructure relies on that, we can
be pretty sure that it won't change in a way that will hurt us.
Originally reported as: https://github.com/openwrt/packages/pull/7434
Signed-off-by: Karl Palsson <karlp@etactica.com>
Full changelog at https://github.com/eclipse/mosquitto/blob/v1.5.3/ChangeLog.txt
Primary change:
CVE fix for CVE-2018-12543 - prevent crash on topics that begin with $
but are not $SYS
Selected other fixes relevant to OpenWrt since 1.5.1:
- Fix retained messages not sent by bridges on outgoing topics at the first
connection. Closes#701.
- Fix duplicate clients being added to by_id hash before the old client was
removed. Closes#645.
- Fix excessive CPU usage when the number of sockets exceeds the system limit.
Closes#948.
- Fix for bridge connections when using WITH_ADNS=yes.
- Fix round_robin false behaviour. Closes#481.
- Fix segfault on HUP when bridges and security options are configured.
Closes#965.
Signed-off-by: Karl Palsson <karlp@etactica.com>
As usual, LWS upstream completely failed to maintain their changelog.
Skimming the git log by hand, probably the biggest change of note here
is fixed compatibility with openssl 1.1.0
Tested on ath79.
Signed-off-by: Karl Palsson <karlp@etactica.com>
Bugfix release. Full changelog at:
https://mosquitto.org/blog/2018/08/version-151-released/
Of most interest to OpenWrt:
* Remove use of AI_ADDRCONFIG, which means the broker can be used on systems where only the loopback interface is defined.
* Fix IPv6 addresses not being able to be used as bridge addresses.
* Fix problem opening listeners on Pi caused by unsigned char being default.
* Fix segfault on startup if bridge CA certificates could not be read.
* Fix possible endian issue when reading the memory_limit option.
* library and client bugfixes including: https://github.com/openwrt/packages/issues/6765
Signed-off-by: Karl Palsson <karlp@etactica.com>
Changes in the package
* ability to pass flags to the open() calls
* multithreading helpers
Full log at http://lua.sqlite.org/index.cgi/artifact/cc0df52dfc332ae0
Changes in packaging
* actually use PKG_BUILD_DIR
* Work with current upstream sources. (current release only builds
because it's archived on openwrt servers)
* don't link against liblua, this is an anti-pattern
* properly specify the LSQLITE version instead of overriding the SQLITE
version.
Signed-off-by: Karl Palsson <karlp@etactica.com>
musl-libc doesn't define _XOPEN_REALTIME as it doesn't implement the
full set of the realtime operations. However, it _does_ implement
POSIX_TIMERS, which is what luaposix _should_ be checking for in the
posix.time module.
I've filed https://github.com/luaposix/luaposix/issues/295 to track this
upstream, but this is a simpler, verified fix for our older version of
luaposix.
This restores functions like posix.time.clock_gettime(CLOCK_MONOTONIC)
for instance, which was available with pre-musl builds of luaposix.
Signed-off-by: Karl Palsson <karlp@etactica.com>
Remove build timestamp. Using currently proposed upstream patch.
Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
Signed-off-by: Karl Palsson <karlp@etactica.com>
Can't use DEPENDS:= +libname when libname is now a virtual package.
Switch to plain DEPENDS:= libname.
Fixes Github issue 4751
Signed-off-by: Karl Palsson <karlp@etactica.com>
Libwebsockets 2.4.0 now includes mbedtls as a first class citizen.
Drop the problematic and poorly supported wolf/cyassl variant and add
mbedtls variant instead.
Signed-off-by: Karl Palsson <karlp@etactica.com>
On some environments, connecting to localhost was resolving to ::1,
which didn't match the bind to the explicit 127.0.0.1.
Signed-off-by: Karl Palsson <karlp@etactica.com>
Added many more UCI config options, particularly for bridge connections
The recently introduced username/password options for bridges are kept,
even though they have been deprecated upstream for a while. In keeping
with this, while support is kept in UCI, the generated mosquitto.conf
file will always generate the "modern" remote_username/remote_password
options preferred by mosquitto instead.
Likewise for bridge clientid and remote_clientid options.
Signed-off-by: Karl Palsson <karlp@etactica.com>
Adds the "notifications" option which is important when connecting
mosquitto to rabbitmq for instance.
Signed-off-by: Karl Palsson <karlp@etactica.com>
Earlier, PROVIDES handling was clarified for the broker and the library.
Use the same style to properly provide the -client-ssl and -client-nossl
packages.
Signed-off-by: Karl Palsson <karlp@etactica.com>
Adding PROVIDES to both the daemon and library and -nossl variants allow
downstream packages to simply declare a single dependency.
mosquitto-client however, still needs to explicitly depend on the ssl or
nossl variant however.
Signed-off-by: Karl Palsson <karlp@etactica.com>
Old keplerproject.org urls are all down.
github project source for this project references new githubio website.
Signed-off-by: Karl Palsson <karlp@etactica.com>
The package creates a "mosquitto" user, but the support added for
persistence creates the data directory as root running the init script.
Properly chown the newly created directory to ensure it's writable.
Signed-off-by: Karl Palsson <karlp@etactica.com>
This should always have been available in the mosquitto package itself.
This file needs to exist in basic form to allow the init scripts to even check whether it exists.
Signed-off-by: Karl Palsson <karlp@etactica.com>
Instead of manually copying files and renaming on install, use the nice
clean "files/<mirror>" structure and just $(CP) them into place.
Signed-off-by: Karl Palsson <karlp@etactica.com>
Karl Palsson