Fixes:
CVE-2015-5291 - Remote attack on clients using session tickets or SNI
Also includes countermeasures against Lenstra's RSA-CRT attach for
PKCS#1 v1.5 signatures (1.2.16) and the Logjam attack (1.2.15).
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Reviewed-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Tested-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
On some machines, the network interface is slow to appear. For example,
on the Raspberry Pi, the network interface eth0 is an ethernet-over-USB,
and our standard boot process is too fast, so our network startup script
is called before the USB bus is compeltely enumerated, thus it can't
configure eth0.
Closes#8116.
[Peter: move to S40network, handle multiple interfaces]
Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Add upstream patch that fixes a sysfs path in br_set.
The patch is on top of the latest release 1.5, which already dates from
2011.
Signed-off-by: Thomas De Schampheleire <thomas.de.schampheleire@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[Thomas:
- Check for Thread::Queue, not Thread:Queue.
- Use 'printf' instead of 'echo -e', since printf is POSIX, but not
'echo -e'.]
Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Disabling sconesite image isn't enough to avoid imagemagick
autodetection, and if it's present in the host (distro) but not in the
target it gets automatically picked up. Fixes:
http://autobuild.buildroot.net/results/377/37705926f3023395c54af0532ff95f0125fbaa66/
Also add a comment about autoreconf.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
apng and tdsc are enabled by default, but they need zlib, otherwise the
compilation will fail with an error like this one:
libavcodec/pngdec.c:35:18: fatal error: zlib.h: No such file or
directory
#include <zlib.h>
^
compilation terminated.
So add an autodep on BR2_PACKAGE_ZLIB to enable or disable support for
apng and tdsc accordingly.
Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
In commit b1dcb1c2 a fix was attempted at fixing a build failure where
sqlcipher finds the distribution tcl and tries to build against it.
sqlcipher has two tcl usage scenarios: host-tcl which is required to
actually build it, and target tcl to build bindings.
Since cross-compilation of the bindings isn't clean it fails as well,
and since it wasn't a feature before either just disable it completely,
since the wrong fix makes the sqlcipher build failures worse.
Fixes:
http://autobuild.buildroot.net/results/fc0/fc0528de7fed2f34f503fe8dd8b4c21ded0d6dff/
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
The current commit used for the kernel Git repository for Cubieboard,
274a66a7bfcbaabb88d63e4eba161965383cc416, actually points to 3.0
kernel. This is incorrect since the kernel headers version specified
by the defconfig is 3.4. And anyway, the 3.4 kernel is kind of the
official vendor kernel for Allwinner platforms.
mfld.fr@gmail.com reported in bug #7931 that commit
9a1cd034181af628d4145202289e1993c1687db6 was working for him. It is
the latest commit in the sunxi-3.4 branch. So we switch to using this
commit, which was build tested successfully.
While we're at it, remove the definition of BR2_LINUX_KERNEL_VERSION
from the defconfig: it doesn't make sense to have it defined in a
defconfig, as it's a blind option that gets defined from the value of
BR2_LINUX_KERNEL_CUSTOM_REPO_VERSION when a Git repository is used to
source the kernel.
Fixes#7931.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
As pointed by Rich Fekler on IRC the basic hush shell is pretty much
useless since it doesn't support if conditionals, loops, functions, case
or even interactive mode.
So enable the full feature-set.
Size delta: +10184 bytes uncompressed for blackfin fdpic.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Otherwise if the host distro has net-snmp devel files sane-backends will
find /usr/bin/net-snmp-config first and the build will break. Fixes:
http://autobuild.buildroot.net/results/c38/c381c316907964787ebe1a0807399022f15d8158/
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
pango-querymodules is deprecated/removed, so ditch the initscript.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
[Thomas: use SHARED_STATIC_LIBS_OPTS to simplify the logic.]
Signed-off-by: Charles Duffy <chaduffy@cisco.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
If the host has oniguruma installed then slang can detect it and try to
(wrongly) link against it resulting in build failure. Fixes:
http://autobuild.buildroot.net/results/51f/51ff079ebbd363e0445d226ec80bc28e524fd88c/
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
The Advanced XIP File System is a Linux kernel filesystem driver that
enables files to be executed directly from flash or ROM memory rather
than being copied into RAM. It has the ability to store individual
*pages* in a file uncompressed/XIP or compressed/Demand Paged.
This commit only adds support for 'XIP all' mode, so all the files that
have the execute attribute set will be XIP'ed.
At the moment, the FS is not supported in Linux mainline (v4.3-rc5), so
the kernel has to be built with the axfs patches to be able to read it.
Patches can be found here: https://github.com/jaredeh/axfs
[Thomas: rewrap Config.in help text.]
Signed-off-by: Ariel D'Alessandro <ariel@vanguardiasur.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Tools for building AXFS Filesystem.
The Advanced XIP File System is a Linux kernel filesystem driver that
enables files to be executed directly from flash or ROM memory rather
than being copied into RAM. It has the ability to store individual
*pages* in a file uncompressed/XIP or compressed/Demand Paged.
Source:
https://github.com/jaredeh/axfs
[Thomas:
- add hash file.
- use $(INSTALL) -D -m 0755 instead of cp for installing mkfs.axfs.]
Signed-off-by: Ariel D'Alessandro <ariel@vanguardiasur.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
This commit backports upstream gpsd commit
3e25e2167beb3936de3986fad9b6c9bdec82b81f, which fixes the build of the
NMEA driver.
Fixes Buildroot bug #8401, reported by kevin.alden2@gmail.com.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
systemd is increasingly expecting things to live in /usr/bin, /usr/sbin
or /usr/lib nad not in /bin, /sbin or /lib. It has inherited those
expectations from a Fedora change:
https://fedoraproject.org/wiki/Features/UsrMove
Note however, that systemd does support /usr being on a separate
filesystem; it just expects an initramfs to mount it before the final
switchroot over to the actual rootfs.
But the traditional use-case for Buildroot is not to boot with an
initramfs; although that is totally feasible, that's probably not what
is commonly done in the vast majority of cases.
However, a lot of packages still install stuff directly into /bin,
/sbin or /lib, which systemd may need early-on in the boot process,
even before it may have a chance to mount /usr. Even though we can
tell systemd, at configure-time, where it should expect programs to
be at runtime, it does not make sense to go head-first against an
upstream wa^Hill.
Add an option so that /bin, /sbin and /lib be symlinks to /usr/bin
and /usr/sbin. That option is forcibly enabled when the init system
is systemd.
Note: we need not handle /lib32 or /lib64, as they already are symlinks
to /lib, which means they will automatically be redirected to /usr/lib,
as /usr/lib32 and /usr/lib64 already are.
Furthermore, this means we're no longer supporting a split-usr setup, so
the corresponding configure options have been removed as well for
systemd and, when using a merged /usr, for eudev as well.
In Buildroot, we decided (with this patch) not to support a split-usr
when systemd is used as an init system. This is a design decision, not
a systemd issue. Thus the select is with BR2_INIT_SYSTEMD rather than
with BR2_PACKAGE_SYSTEMD.
Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Cc: Arnout Vandecappelle <arnout@mind.be>
Cc: Mike Williams <mike@mikebwilliams.com>
Cc: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Cc: Baruch Siach <baruch@tkos.co.il>
Tested-by: Mike Williams <mike@mikebwilliams.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
systemd seems to do its release using their github repository up from
the 221 version.
Since they use the auto generated release, we can't have a hash file.
They don't provide the Makefile.in file in the 'po' directory.
We need to run intltoolize so it's created for us.
Signed-off-by: Maxime Hadjinlian <maxime.hadjinlian@gmail.com>
Tested-by: Mike Williams <mike@mikebwilliams.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
DSP support depends on the core implementation, not on the ISA, so
enabling it for mips64r2 is not correct since you can build a mips64r2
core without DSP support.
Disable mipsdspr1 and mipsdspr2 options by default and let the user
enable them via the BR2_PACKAGE_FFMPEG_EXTRACONF kconfig option, which
will take preference and override the default values.
Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Also switch from ftp to http, it's better for firewall-laden places.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Disabled vala bindings since they're not used by the current buildroot
packages and it requires gobject-introspection which we don't provide
yet.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
python-pypcap calls thez pyrexc Python script directly. This script is
generated by the pyrexc installation with a shebang line that has a
full path to our host-python interpreter. Unfortunately, since Linux
cuts the shebang line at 128 characters, it means that if you have an
output directory with a very very long name, the pyrexc script does
not run.
To solve that, we explicitly invoke pyrexc with the python2
interpreter.
Note that invoking the python2 interpreter directly is safe because
python-pypcap is only available for Python 2.x, so we are just that
$(HOST_DIR)/usr/bin/python2 is available.
Fixes#8281.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
