9c108afab8
Fixes the following security issues: - CVE-2021-32918: DoS via insufficient memory consumption controls It was discovered that default settings leave Prosody susceptible to remote unauthenticated denial-of-service (DoS) attacks via memory exhaustion when running under Lua 5.2 or Lua 5.3. Lua 5.2 is the default and recommended Lua version for Prosody 0.11.x series. - CVE-2021-32920: DoS via repeated TLS renegotiation causing excessive CPU consumption It was discovered that Prosody does not disable SSL/TLS renegotiation, even though this is not used in XMPP. A malicious client may flood a connection with renegotiation requests to consume excessive CPU resources on the server. - CVE-2021-32921: Use of timing-dependent string comparison with sensitive values It was discovered that Prosody does not use a constant-time algorithm for comparing certain secret strings when running under Lua 5.2 or later. This can potentially be used in a timing attack to reveal the contents of secret strings to an attacker. - CVE-2021-32917: Use of mod_proxy65 is unrestricted in default configuration mod_proxy65 is a file transfer proxy provided with Prosody to facilitate the transfer of files and other data between XMPP clients. It was discovered that the proxy65 component of Prosody allows open access by default, even if neither of the users have an XMPP account on the local server, allowing unrestricted use of the server’s bandwidth. - CVE-2021-32919: Undocumented dialback-without-dialback option insecure The undocumented option ‘dialback_without_dialback’ enabled an experimental feature for server-to-server authentication. A flaw in this feature meant it did not correctly authenticate remote servers, allowing a remote server to impersonate another server when this option is enabled. For more details, see the advisory: https://prosody.im/security/advisory_20210512/ Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
64 lines
1.7 KiB
Makefile
64 lines
1.7 KiB
Makefile
################################################################################
|
|
#
|
|
# prosody
|
|
#
|
|
################################################################################
|
|
|
|
PROSODY_VERSION = 0.11.9
|
|
PROSODY_SITE = https://prosody.im/downloads/source
|
|
PROSODY_LICENSE = MIT
|
|
PROSODY_LICENSE_FILES = COPYING
|
|
PROSODY_CPE_ID_VENDOR = prosody
|
|
PROSODY_DEPENDENCIES = host-luainterpreter luainterpreter libidn openssl
|
|
|
|
PROSODY_CFLAGS = $(TARGET_CFLAGS) -fPIC -std=c99 \
|
|
$(if BR2_TOOLCHAIN_USES_MUSL,-DWITHOUT_MALLINFO)
|
|
|
|
PROSODY_CONF_OPTS = \
|
|
--with-lua-bin=$(HOST_DIR)/bin \
|
|
--with-lua=$(STAGING_DIR)/usr \
|
|
--lua-version=$(LUAINTERPRETER_ABIVER) \
|
|
--c-compiler=$(TARGET_CC) \
|
|
--cflags="$(PROSODY_CFLAGS)" \
|
|
--linker=$(TARGET_CC) \
|
|
--ldflags="$(TARGET_LDFLAGS) -shared" \
|
|
--sysconfdir=/etc/prosody \
|
|
--prefix=/usr
|
|
|
|
ifeq ($(BR2_PACKAGE_LUAJIT),y)
|
|
PROSODY_CONF_OPTS += --runwith=luajit
|
|
endif
|
|
|
|
define PROSODY_CONFIGURE_CMDS
|
|
cd $(@D) && \
|
|
$(TARGET_CONFIGURE_OPTS) \
|
|
./configure $(PROSODY_CONF_OPTS)
|
|
endef
|
|
|
|
define PROSODY_BUILD_CMDS
|
|
$(TARGET_MAKE_ENV) $(MAKE) -C $(@D)
|
|
endef
|
|
|
|
define PROSODY_INSTALL_TARGET_CMDS
|
|
$(TARGET_MAKE_ENV) $(MAKE) DESTDIR="$(TARGET_DIR)" -C $(@D) install
|
|
endef
|
|
|
|
define PROSODY_INSTALL_INIT_SYSV
|
|
$(INSTALL) -D -m 0755 package/prosody/S50prosody \
|
|
$(TARGET_DIR)/etc/init.d/S50prosody
|
|
endef
|
|
|
|
define PROSODY_USERS
|
|
prosody -1 prosody -1 * - - - Prosody user
|
|
endef
|
|
|
|
# make install installs a Makefile and meta data to generate certs
|
|
define PROSODY_REMOVE_CERT_GENERATOR
|
|
rm -f $(TARGET_DIR)/etc/prosody/certs/Makefile
|
|
rm -f $(TARGET_DIR)/etc/prosody/certs/*.cnf
|
|
endef
|
|
|
|
PROSODY_POST_INSTALL_TARGET_HOOKS += PROSODY_REMOVE_CERT_GENERATOR
|
|
|
|
$(eval $(generic-package))
|