Create an anonymous inode in /tmp using O_TMPFILE and attempt to link the
file in place using linkat(). Only fall back to the old file copy when
linking the tempfile fails.
Avoids double memory use if both the temporary upload file and the
destination file are located in /tmp.
Ref: https://github.com/openwrt/luci/issues/3654
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 4f4a7e9532)
Allocate dynamic buffer memory for decoding post data and allow post
requsts up to 128KB compared to the previos 1KB limit.
Also support downloading /proc and /sys files by falling back to
chunked transfer encoding when the file size cannot be determined.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 39087eba18)
In the command read side, close the superfluous write end of the pipe
early to ensure that EOF is reliably detected. Without that change, splice
calls to read from the pipe will occasionally hang until the CGI process
is eventually killed due to timeout.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit dde503da13)
Implement a new "cgi-exec" applet which allows to invoke remote commands
and stream their stdandard output back to the client via HTTP. This is
needed in cases where large amounts of data or binary encoded contents
such as tar archives need to be transferred, which are unsuitable to be
transported via ubus directly.
The exec call is guarded by the same ACL semantics as rpcd's file plugin,
means in order to be able to execute a command remotely, the ubus session
identified by the given session ID must have read access to the "exec"
function of the "cgi-io" scope and an explicit "exec" permission rule for
the invoked command in the "file" scope.
In order to initiate a transfer, a POST request in x-www-form-urlencoded
format must be sent to the applet, with one field "sessionid" holding
the login session and another field "command" specifiying the commandline
to invoke.
Further optional fields are "filename" which - if present - will cause
the download applet to set a Content-Dispostition header and "mimetype"
which allows to let the applet respond with a specific type instead of
the default "application/octet-stream".
Below is an example for the required ACL rules to grant exec access to
both the "date" and "iptables" commands. The "date" rule specifies the
base name of the executable and thus allows invocation with arbitrary
parameters while the latter "iptables" rule merely allows one specific
set of arguments which must appear exactly in the given order.
ubus call session grant '{
"ubus_rpc_session": "...",
"scope": "cgi-io",
"objects": [
[ "exec", "read" ]
]
}'
ubus call session grant '{
"ubus_rpc_session": "...",
"scope": "file",
"objects": [
[ "/bin/date", "exec" ],
[ "/usr/sbin/iptables -n -v -L", "exec" ]
]
}'
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit b2a890f6ad)
Instead of always replying with a generic 500 internal server error code,
use more appropriate codes such as 403 to indicate denied permissions.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 8c22db6531)
Add a new `cgi-download` applet which allows to retrieve the contents
of regular files or block devices.
In order to initiate a transfer, a POST request in x-www-form-urlencoded
format must be sent to the applet, with one field "sessionid" holding
the login session and another field "path" containing the file path to
download.
Further optional fields are "filename" which - if present - will cause
the download applet to set a Content-Dispostition header and "mimetype"
which allows to let the applet respond with a specific type instead of
the default "application/octet-stream".
Below is an example for the required acl rules to grant download access
to files or block devices:
ubus call session grant '{
"ubus_rpc_session": "...",
"scope": "cgi-io",
"objects": [
[ "download", "read" ]
]
}'
ubus call session grant '{
"ubus_rpc_session": "...",
"scope": "file",
"objects": [
[ "/etc/config/*", "read" ],
[ "/dev/mtdblock*", "read" ]
]
}'
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit ab2a2b080d)
Use the `cgi-io` scope to check for permission to execute the requested
command (`upload`, `backup`) and the `file` scope to check path
permissions.
The reasoning of this change is that `cgi-io` is usually used in
conjunction with `rpcd-mod-file` to transfer large file data out
of band and `rpcd-mod-file` already uses the `file` scope to manage
file path access permissions. After this change, both `rpc-mod-file`
and `cgi-io` can share the same path acl rules.
Write access to a path can be granted by using an ubus call in the
following form:
ubus call session grant '{
"ubus_rpc_session": "...",
"scope": "file",
"objects": [
[ "/var/lib/uploads/*", "write" ]
]
}'
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit c8a86c8c8e)
Introduce further ACL checks to verify that the request-supplied
upload location may be written to. This prevents overwriting things
like /bin/busybox and allows to confine uploads to specific directories.
To setup the required ACLs, the following ubus command may be used
on the command line:
ubus call session grant '{
"ubus_rpc_session": "d41d8cd98f00b204e9800998ecf8427e",
"scope": "cgi-io",
"objects": [
[ "/etc/certificates/*", "write" ],
[ "/var/uploads/*", "write" ]
]
}'
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 22be9a1c01)
The libelf1 source package has been renamed to libelf in OpenWrt base,
adjust the dependency in "at" accordingly.
There are no functional changes and no changes in the resulting binary.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
The libelf1 source package has been renamed to libelf in OpenWrt base,
adjust the dependency in avrdude accordingly.
There are no functional changes and no changes in the resulting binary.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Add a forgotten patch which was part of the original PR to switch ct tools
to libtirpc.
Fixes: ecebe0ed1 ("conntrack-tools: update to 1.4.5 and link against libtirpc")
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
In order to allow for the switch from librpc to libtirpc, we need to
relocate the conntrack-tools package here.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Currently luci-app-sqm provided by sqm-scripts depends on luci-base instead
of selecting it, this leads to an indirect circular dependency in kconfig:
tmp/.config-package.in:34646:error: recursive dependency detected!
For a resolution refer to Documentation/kbuild/kconfig-language.txt
subsection "Kconfig recursive dependency limitations"
tmp/.config-package.in:34646: symbol PACKAGE_iptables is selected by PACKAGE_sqm-scripts
For a resolution refer to Documentation/kbuild/kconfig-language.txt
subsection "Kconfig recursive dependency limitations"
tmp/.config-package.in:961: symbol PACKAGE_sqm-scripts is selected by PACKAGE_luci-app-sqm
For a resolution refer to Documentation/kbuild/kconfig-language.txt
subsection "Kconfig recursive dependency limitations"
tmp/.config-package.in:22421: symbol PACKAGE_luci-app-sqm depends on PACKAGE_luci-base
For a resolution refer to Documentation/kbuild/kconfig-language.txt
subsection "Kconfig recursive dependency limitations"
tmp/.config-package.in:21387: symbol PACKAGE_luci-base is selected by PACKAGE_luci-lib-iptparser
For a resolution refer to Documentation/kbuild/kconfig-language.txt
subsection "Kconfig recursive dependency limitations"
tmp/.config-package.in:22899: symbol PACKAGE_luci-lib-iptparser is selected by PACKAGE_luci-app-splash
For a resolution refer to Documentation/kbuild/kconfig-language.txt
subsection "Kconfig recursive dependency limitations"
tmp/.config-package.in:22402: symbol PACKAGE_luci-app-splash is selected by PACKAGE_luci-mod-freifunk-community
For a resolution refer to Documentation/kbuild/kconfig-language.txt
subsection "Kconfig recursive dependency limitations"
tmp/.config-package.in:21552: symbol PACKAGE_luci-mod-freifunk-community depends on PACKAGE_iptables
Solve the issue by turning the dependencies into selecting ones which also
matches the behaviour of other LuCI applications.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Since https://git.openwrt.org/d0e0b7049f88774e67c3d5ad6b573f7070e5f900,
OpenWrt SDKs ship the appropriate sources for building usbip userspace
packages, so special nonshared handling is not required anymore.
Sucessfully tested by compiling usbip utilities for various architectures
using self built SDKs after applying the change linked above.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
OpenWrt changed the way the uci shell parsing functions deal with list
configuration items.
This change broke the generation of the privoxy runtime configuration
because no callbacks were emitted anymore.
Fix the problem by defining a list_cb() that simply calls the existing
option_cb() to deal with list item values.
Ref: c9c0fc28a9 ("base-files: fix UCI config parsing and callback handling")
Ref: https://forum.lede-project.org/t/openwrt-snapshot-privoxy-error/15919
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Update to flashrom version 1.0 and cherry-pick an upstream fix for deprecated
libusb api usage.
Fixes the following error spotted by the buildbots:
ch341a_spi.c: In function 'ch341a_spi_init':
ch341a_spi.c:447:2: error: 'libusb_set_debug' is deprecated: [...]
libusb_set_debug(NULL, 3); // Enable information, warning and [...]
^~~~~~~~~~~~~~~~
In file included from ch341a_spi.c:25:0:
.../libusb-1.0/libusb.h:1300:18: note: declared here
void LIBUSB_CALL libusb_set_debug(libusb_context *ctx, int level);
^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
Makefile:1030: recipe for target 'ch341a_spi.o' failed
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
This commit adds a simple procd init script for bcp38 with the sole purpose
to register a configuration change trigger for /etc/config/bcp38.
The change will allow for automatic firewall reloads triggered by invoking
/sbin/reload_config or through ubus config change events emitted by LuCI.
With the init script in place and started, calling
ubus call service event '{"type":"config.change","data":{"package":"bcp38"}}'
or
/sbin/reload_config
will issue an /etc/init.d/firewall reload if /etc/config/bcp38 has been
modified since the last reload_config call.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Make most dependencies depend on the selection state of the respective
plugins requiring them. This cuts down compile time considerably when
plugins like MySQL support are disabled.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
The arpa/nameser.h header of musl libc indirectly depends on the endian.h
header but fails to explicitely include it to properly define
`__BYTE_ORDER` and `__BIG_ENDIAN` prior to declaring the DNS `HEADER`
structure.
When both the appropriate `__BYTE_ORDER` and `__BIG_ENDIAN` defines are
unset, the `#if __BYTE_ORDER == __BIG_ENDIAN` condition in `nameser.h`
evaluates to true, causing it to declare a bad (big endian) DNS packet
header structure on little endian systems.
Work around this musl bug by forcibly passing `-include endian.h` through
the `osflags` file.
An upstream fix for musl libc has been submitted with
http://www.openwall.com/lists/musl/2017/12/04/3
This should solve iodine packet corruption on little endian musl systems
reported at
http://lists.infradead.org/pipermail/lede-dev/2017-November/010085.html
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
This packages setserial, the standard Linux program for setting serial
device attributes such as baud rate, flow control etc.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Update to latest Git HEAD in order to solve a number of issues.
- Improves MAC address lookup reliability
- Properly counts DNAT-ed connections (e.g. for port forwards)
- Fixes stack corruption when parsing netlink records
- Fixes deletion of gzipped databases
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Currently `polipo.h` uses the conditional
`(__GLIBC__ > 2) || (__GLIBC__ == 2 && __GLIBC_MINOR__ >= 2)` to decide
whether to enable IPv6 support.
This used to work for OpenWrt CC which uses uClibc disguising itself
as Glibc 2.x but it does not work with Musl libc anymore as this library
does not export any Glibc defines.
Forcibly enable IPv6 support by passing `-DHAVE_IPv6` unconditionally
through the build flags in the OpenWrt/LEDE Makefile.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Report SHA256 checksums in addition to the MD5 ones to make cgi-io suitable
for sysupgrade image verification.
Also allow stat(), md5sum and/or sha256sum to fail and respond with a JSON
null value instead, leaving it to the frontend to handle errors as needed.
Fixes#4790.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Remove an improperly placed semicolon in order to solve the following
compiler error:
.../main.c:144:3: error: this 'if' clause does not guard... [-Werror=misleading-indentation]
if (execl("/bin/busybox", "/bin/busybox", "md5sum", file, NULL));
^~
.../main.c:145:4: note: ...this statement, but the latter is misleadingly indented as if it were guarded by the 'if'
return NULL;
^~~~~~
cc1: all warnings being treated as errors
Fixes#4723.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
This commit introduces nlbwmon, the lightweight NetLink BandWidth Montor.
The nlbwmon daemon gathers per-host traffic statistics by querying netlink
accounting data. Due to this approach, the executable is very small and does
not rely on libpcap and CPU intensive raw sockets to monitor traffic.
Besides raw per-host traffic counters, nlbwmon also support rudimentary
traffic classification by observing IP protocols and used port numbers.
Gathered accounting data is stored into a series of database files which
are regularily committed to persistent storage.
Refresh, commit and accounting intervals are freely configurable as well
as the layer7 protocol mapping rules and observed source subnets.
This package also bundles a cli client which can be used to dump the
gathered traffic data as JSON, CSV or plaintext data. A pull request to
add a graphical LuCI frontend for nlbwmon is pending.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
This reverts commit 79b6e9dc61.
Undo the recent vnstat update due to upstream bugs preventing database
restoration.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
The virtual package declared by PROVIDES must not have the same name as the
variant declaring it, otherwise buildroot will fail with errors like:
cp: '.../pkginfo/mosquitto.provides' and '.../pkginfo/mosquitto.provides' are the same file
In order to fix the above error, rename the existing "mosquitto" and
"libmosquitto" packages into "mosquitto-ssl" and "libmosquitto-ssl"
respectively.
Also substitute use of $(PKG_NAME) with literal "mosquitto" in
Package/* defines to improve readability of the Makefile.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
If libcap happens to be present in the environment, coreutils will pick it up
and link some applets against it.
Since the idea of coreutils is to provide a full featured alternative to the
busybox applets, do not inhibit the optional dependency but explicitely
require libcap instead.
Fixes the following error spotted on the buildbots:
Package coreutils-dir is missing dependencies for the following libraries:
libcap.so.2
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Do not override configure recipe and do not invoke upstream autogen.sh.
The shipped autogen.sh attempts to call "gtkdocize" which is no guaranteed
build prereq of LEDE or OpenWrt.
Also add a patch to disable the processing of documentation, tests and
examples as these resources rely on gtk-doc infrastructure which is not
available within LEDE or OpenWrt.
Example error for the bad autogen.sh invocation:
( cd .../loudmouth-1.5.3; ./autogen.sh )
./autogen.sh: 33: ./autogen.sh: gtkdocize: not found
Makefile:73: recipe for target '.../.configured_yynyyyyn' failed
Example error for the lacking gtk-doc automake infrastructure:
automake: error: cannot open < gtk-doc.make: No such file or directory
autoreconf: .../host/bin/automake failed with exit status: 1
[...]
config.status: error: cannot find input file: `docs/reference/Makefile.in'
Makefile:72: recipe for target '.../.configured_yynyn' failed
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Extend the existing patch handling disabled SSLv2 to cover the SSLv3 case as
well in order to fix the following build error reported by the buildbot:
openssl.o: In function `ssl_open':
openssl.c:(.text+0xa1c): undefined reference to `SSLv3_client_method'
collect2: error: ld returned 1 exit status
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Update the pen package to upstream release v0.34.0 in order to fix the
following build error reported by the buildbot:
ssl.o: In function `ssl_create_context':
ssl.c:(.text+0x9c): undefined reference to `SSLv3_method'
collect2: error: ld returned 1 exit status
Also switch from PKG_MD5SUM to PKG_HASH with SHA256 while we're at it.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Import a proposed upstream bug fix to allow building against recent curl
versions. Fixes the following error observed by the buildbots:
curlopt-constants.c:129:49: error: 'CURL_STRICTER' undeclared (first use in this function)
if (strEQ(name, "STRICTER")) return CURL_STRICTER;
Upstream bug: https://rt.cpan.org/Public/Bug/Display.html?id=117793
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
The buildbots fail to build socat due to the following error:
nestlex.c:14:7: error: unknown type name 'ptrdiff_t'
It appears that certain source files do not include all required headers,
depending on the configure options passed to socat.
Work around the error by passing `-include stddef.h` via `TARGET_CFLAGS` to
forcibly inject this header file into all compilation units.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Instead of causing nondeterministing conditional compilation depending on
whether libnl-core happens to be present or not, fixup the net-snmp package
to link against libnl-tiny which is present by default on the majority of
systems.
In order to successfully build against libnl-tiny, a number of things had
to be fixed in both the upstream configure and the outer Makefile:
- Add a patch which fixes the upstream configure macros to properly handle
cases where the cache variables for nl_connect() and netlink.h tests are
predefined. Without this patch, all subsequent link tests in configure
will fail, causing the build system to assume functions like opendir() or
readdir() to be missing, leading to build failures later on due to
conflicting redefinitions of structures and function prototypes
- In the same patch, stop probing the host systems /usr/include/libnl-3 if
ac_cv_header_netlink_netlink_h is given. This brings the proprietary
configure bits in line with the behaviour expected from autoconfig in a
cross compile setting
- Explicitely request nl support by passing the --with-nl flag to configure
- Pass the required cache variables to skip the broken tests for
nl_connect() and netlink.h
- Amend TARGET_CPPFLAGS to let net-snmp's build system discover nl-tiny's
netlink/netlink.h and netlink/socket.h
- Enable the autoreconf fixup to regenerate the broken shipped configure
from patched macros
- Adjust the depends to unconditionally require libnl-tiny
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Move the python-host.mk and python-package.mk includes after the definition of
common package variables. This is required to ensure that PKG_UNPACK is not set
to to the dummy "true" command which happens if PKG_SOURCE is not yet set.
Fixes the following error observed while attempting to build Python on a recent
LEDE version:
make[2]: Entering directory '.../lang/python'
true
[ ! -d ./src/ ] || cp -fpR ./src/* .../Python-2.7.12
Applying ./patches/001-enable-zlib.patch using plaintext:
can't find file to patch at input line 14
Perhaps you used the wrong -p or --strip option?
[...]
Patch failed! Please fix ./patches/001-enable-zlib.patch!
Makefile:242: recipe for target '.../Python-2.7.12/.prepared_...' failed
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
When only kmod-openvswitch is enabled, which commonly happens during LEDE
release builds, there is no need to build the entire userland of openvswitch
as this is done at a later stage on systems dedicated to build only userspace
packages.
This change conditionalizes the dependency on python, which means that python
prerequisites are only compiled if the openvswitch-python package is enabled,
which allows us to eliminate the entire python dependency chain.
Furthermore, this change sets MAKE_PATH to the kernel module sub directory
if only kmod-openvswitch is enabled which causes the openvswitch build system
to only process sources related to the .ko files.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Jo-Philipp Wich