[OpenWrt-Devel] [PATCH] fuse: remove
This package was last updated in 2016. All of the dependent packages
are in the packages feeds, where this will be moved.
Signed-off-by: Rosen Penev
---
package/utils/fuse/Makefile | 103 --
.../fuse/patches/100-missing_includes.patch | 10 --
.../fuse/patches/112-no_break_on_mknod.patch | 11 --
...t_arm64_fuse_kernel_h_clean_includes.patch | 30 -
4 files changed, 154 deletions(-)
delete mode 100644 package/utils/fuse/Makefile
delete mode 100644 package/utils/fuse/patches/100-missing_includes.patch
delete mode 100644 package/utils/fuse/patches/112-no_break_on_mknod.patch
delete mode 100644
package/utils/fuse/patches/200-backport_arm64_fuse_kernel_h_clean_includes.patch
diff --git a/package/utils/fuse/Makefile b/package/utils/fuse/Makefile
deleted file mode 100644
index be80b03c42..00
--- a/package/utils/fuse/Makefile
+++ /dev/null
@@ -1,103 +0,0 @@
-#
-# Copyright (C) 2006-2015 OpenWrt.org
-#
-# This is free software, licensed under the GNU General Public License v2.
-# See /LICENSE for more information.
-#
-
-include $(TOPDIR)/rules.mk
-include $(INCLUDE_DIR)/kernel.mk
-
-PKG_NAME:=fuse
-PKG_VERSION:=2.9.7
-PKG_RELEASE:=2
-
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://github.com/libfuse/libfuse/releases/download/$(PKG_NAME)-$(PKG_VERSION)
-PKG_HASH:=832432d1ad4f833c20e13b57cf40ce5277a9d33e483205fc63c78111b3358874
-
-PKG_LICENSE:=LGPLv2.1 GPLv2
-PKG_LICENSE_FILES:=COPYING.LIB COPYING
-PKG_CPE_ID:=cpe:/a:fuse_project:fuse
-
-PKG_INSTALL:=1
-
-include $(INCLUDE_DIR)/package.mk
-
-define Package/fuse/Default
- TITLE:=FUSE
- URL:=http://fuse.sourceforge.net/
-endef
-
-define Package/fuse/Default/description
- FUSE (Filesystem in UserSpacE)
-endef
-
-define Package/fuse-utils
-$(call Package/fuse/Default)
- SECTION:=utils
- CATEGORY:=Utilities
- DEPENDS:=+libfuse
- TITLE+= (utilities)
- SUBMENU:=Filesystem
-endef
-
-define Package/fuse-utils/description
-$(call Package/fuse/Default/description)
- This package contains the FUSE utilities.
- - fusermount
- - ulockmgr_server
-endef
-
-define Package/libfuse
-$(call Package/fuse/Default)
- SECTION:=libs
- CATEGORY:=Libraries
- TITLE+= (library)
- DEPENDS:=+kmod-fuse +libpthread
- SUBMENU:=Filesystem
- ABI_VERSION:=1
-endef
-
-define Package/libfuse/description
-$(call Package/fuse/Default/description)
- This package contains the FUSE shared libraries, needed by other programs.
- - libfuse
- - libulockmgr
-endef
-
-# generic args
-CONFIGURE_ARGS += \
- --enable-shared \
- --enable-static \
- --enable-lib \
- --enable-util \
- --disable-rpath \
- --disable-example \
- --disable-mtab
-
-define Build/InstallDev
- $(INSTALL_DIR) $(1)/usr/include
- $(CP) $(PKG_INSTALL_DIR)/usr/include/{fuse,fuse.h,ulockmgr.h}
$(1)/usr/include/
- $(INSTALL_DIR) $(1)/usr/lib
- $(CP) $(PKG_INSTALL_DIR)/usr/lib/lib{fuse,ulockmgr}.{a,so*}
$(1)/usr/lib/
- $(INSTALL_DIR) $(1)/usr/lib/pkgconfig
- $(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/fuse.pc
$(1)/usr/lib/pkgconfig/
- $(SED) 's,-I{includedir}/fuse,,g' $(1)/usr/lib/pkgconfig/fuse.pc
- $(SED) 's,-L{libdir},,g' $(1)/usr/lib/pkgconfig/fuse.pc
-endef
-
-define Package/fuse-utils/install
- $(INSTALL_DIR) $(1)/sbin
- $(CP) $(PKG_INSTALL_DIR)/sbin/mount.fuse $(1)/sbin/
- $(INSTALL_DIR) $(1)/usr/bin
- $(CP) $(PKG_INSTALL_DIR)/usr/bin/{fusermount,ulockmgr_server}
$(1)/usr/bin/
-endef
-
-define Package/libfuse/install
- $(INSTALL_DIR) $(1)/usr/lib
- $(CP) $(PKG_INSTALL_DIR)/usr/lib/lib{fuse,ulockmgr}.so.* $(1)/usr/lib/
-endef
-
-$(eval $(call BuildPackage,fuse-utils))
-$(eval $(call BuildPackage,libfuse))
diff --git a/package/utils/fuse/patches/100-missing_includes.patch
b/package/utils/fuse/patches/100-missing_includes.patch
deleted file mode 100644
index e74a1870f0..00
--- a/package/utils/fuse/patches/100-missing_includes.patch
+++ /dev/null
@@ -1,10 +0,0 @@
a/include/fuse.h
-+++ b/include/fuse.h
-@@ -32,6 +32,7 @@
- #include
- #include
- #include
-+#include
-
- #ifdef __cplusplus
- extern "C" {
diff --git a/package/utils/fuse/patches/112-no_break_on_mknod.patch
b/package/utils/fuse/patches/112-no_break_on_mknod.patch
deleted file mode 100644
index f679c4116d..00
--- a/package/utils/fuse/patches/112-no_break_on_mknod.patch
+++ /dev/null
@@ -1,11 +0,0 @@
a/util/Makefile.in
-+++ b/util/Makefile.in
-@@ -723,7 +723,7 @@ mount_util.c: $(top_srcdir)/lib/mount_ut
-
- install-exec-hook:
- -chmod u+s $(DESTDIR)$(bindir)/fusermount
-- @if test ! -e $(DESTDIR)/dev/fuse; then \
-+ -@if test ! -e $(DESTDIR)/dev/fuse; then \
- $(MKDIR_P) $(DESTDIR)/dev; \
- echo "mknod $(DESTDIR)/dev/fuse -m 0666 c 10 229 || true"; \
- mknod $(DESTDIR)/dev/fuse -m 0666 c 10 229 || true; \
diff --git
[OpenWrt-Devel] [PATCH ucert 13/13] Do not print line number in debug messages
The line number does not add any significant information, and it makes
the unit tests which check for these debug messages very fragile.
Signed-off-by: Matthias Schiffer
---
tests/cram/test_ucert.t | 4 ++--
ucert.c | 8
2 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/tests/cram/test_ucert.t b/tests/cram/test_ucert.t
index 985740def8f2..d4d57b243da5 100644
--- a/tests/cram/test_ucert.t
+++ b/tests/cram/test_ucert.t
@@ -57,9 +57,9 @@ check that ucert is producing expected results:
---
$ ucert -D -c $TEST_INPUTS/invalid.ucert
- cert_dump(406): cannot parse cert
+ cert_dump: cannot parse cert
[1]
$ ucert-san -D -c $TEST_INPUTS/invalid.ucert
- cert_dump(406): cannot parse cert
+ cert_dump: cannot parse cert
[1]
diff --git a/ucert.c b/ucert.c
index 24349c41349b..5523b02a7eb2 100644
--- a/ucert.c
+++ b/ucert.c
@@ -49,10 +49,10 @@ static enum {
static bool quiet;
#ifndef UCERT_STRIP_MESSAGES
-#define DPRINTF(format, ...)
\
- do {
\
- if (!quiet)
\
- fprintf(stderr, "%s(%d): " format, __func__, __LINE__,
## __VA_ARGS__); \
+#define DPRINTF(format, ...)
\
+ do {
\
+ if (!quiet)
\
+ fprintf(stderr, "%s: " format, __func__, ##
__VA_ARGS__); \
} while (0)
#else
#define DPRINTF(format, ...) do { } while (0)
--
2.26.2
___
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel
[OpenWrt-Devel] [PATCH ucert 10/13] usign-exec: return code fixes
- WEXITSTATUS() should only be called when WIFEXITED() returns true
- Fix double WEXITSTATUS() in usign_f()
Signed-off-by: Matthias Schiffer
---
usign-exec.c | 9 +
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/usign-exec.c b/usign-exec.c
index 0dde81ed647b..241d63077365 100644
--- a/usign-exec.c
+++ b/usign-exec.c
@@ -79,7 +79,7 @@ int usign_s(const char *msgfile, const char *seckeyfile,
const char *sigfile, bo
}
waitpid(pid, , 0);
- return WEXITSTATUS(status);
+ return WIFEXITED(status) ? WEXITSTATUS(status) : -1;
}
#else
int usign_s(const char *msgfile, const char *seckeyfile, const char *sigfile,
bool quiet) {
@@ -139,8 +139,9 @@ static int usign_f(char fingerprint[17], const char
*pubkeyfile, const char *sec
close(fds[1]);
waitpid(pid, , 0);
- status = WEXITSTATUS(status);
- if (fingerprint && !WEXITSTATUS(status)) {
+ status = WIFEXITED(status) ? WEXITSTATUS(status) : -1;
+
+ if (fingerprint && !status) {
ssize_t r;
memset(fingerprint, 0, 17);
r = read(fds[0], fingerprint, 17);
@@ -235,5 +236,5 @@ int usign_v(const char *msgfile, const char *pubkeyfile,
}
waitpid(pid, , 0);
- return WEXITSTATUS(status);
+ return WIFEXITED(status) ? WEXITSTATUS(status) : -1;
}
--
2.26.2
___
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel
[OpenWrt-Devel] [PATCH ucert 11/13] usign-exec: improve usign -F output handling
While not likely to happen in pratice, nothing guarantees that read()
will retrieve more than 1 byte at a time. The easiest way to make this
code compliant is to wrap the file descriptor using fdopen().
While we're at it, also
- remove useless memset()
- check fingerprint for validity
The check is particularly relevant, as a usign bug [1] causing short
fingerprint outputs only went unnoticed for so long because the trailing
newline was considered one of the 16 characters ucert was expecting.
[1]
https://patchwork.ozlabs.org/project/openwrt/patch/8ead1fd6a61117b54b4efd5111fe0d19e4eef9c5.1589642591.git.mschif...@universe-factory.net/
Signed-off-by: Matthias Schiffer
---
usign-exec.c | 24 +++-
1 file changed, 15 insertions(+), 9 deletions(-)
diff --git a/usign-exec.c b/usign-exec.c
index 241d63077365..482e51057124 100644
--- a/usign-exec.c
+++ b/usign-exec.c
@@ -93,6 +93,7 @@ int usign_s(const char *msgfile, const char *seckeyfile,
const char *sigfile, bo
*/
static int usign_f(char fingerprint[17], const char *pubkeyfile, const char
*seckeyfile, const char *sigfile, bool quiet) {
int fds[2];
+ FILE *f;
pid_t pid;
int status;
const char *usign_argv[16] = {0};
@@ -141,17 +142,22 @@ static int usign_f(char fingerprint[17], const char
*pubkeyfile, const char *sec
waitpid(pid, , 0);
status = WIFEXITED(status) ? WEXITSTATUS(status) : -1;
- if (fingerprint && !status) {
- ssize_t r;
- memset(fingerprint, 0, 17);
- r = read(fds[0], fingerprint, 17);
- if (r < 16)
- status = -1;
+ if (!fingerprint || status) {
+ close(fds[0]);
+ return status;
+ }
- fingerprint[16] = '\0';
+ f = fdopen(fds[0], "r");
+ if (fread(fingerprint, 1, 16, f) != 16)
+ status = -1;
+ fclose(f);
+ if (status)
+ return status;
+
+ fingerprint[16] = '\0';
+ if (strspn(fingerprint, "0123456789abcdefABCDEF") != 16)
+ status = -1;
- }
- close(fds[0]);
return status;
}
--
2.26.2
___
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel
[OpenWrt-Devel] [PATCH ucert 12/13] Fix length checks in cert_load()
cert_load() iterates over multiple blobs, so the length argument to
blob_parse_untrusted() needs to be updated to prevent out-of-bounds
accesses.
Some other checks have become redundant and are removed, as
blob_parse_untrusted() already ensures that all attrs are contained in
the passed buffer.
Note that this issue currently does not pose a security threat, as an
over-restrictive check in blob_parse_untrusted() broke parsing of
buffers with multiple blobs completely.
Signed-off-by: Matthias Schiffer
---
ucert.c | 34 +++---
1 file changed, 19 insertions(+), 15 deletions(-)
diff --git a/ucert.c b/ucert.c
index 208d5f67e10d..24349c41349b 100644
--- a/ucert.c
+++ b/ucert.c
@@ -164,9 +164,8 @@ static int cert_load(const char *certfile, struct list_head
*chain) {
struct blob_attr *certtb[CERT_ATTR_MAX];
struct blob_attr *bufpt;
struct cert_object *cobj;
- char filebuf[CERT_BUF_LEN];
- int ret = 0, pret = 0;
- size_t pos = 0;
+ char filebuf[CERT_BUF_LEN], *end;
+ int ret = 1;
ssize_t len;
len = read_file(certfile, filebuf, sizeof(filebuf) - 1, 0);
@@ -177,17 +176,16 @@ static int cert_load(const char *certfile, struct
list_head *chain) {
}
bufpt = (struct blob_attr *)filebuf;
- do {
- pret = blob_parse_untrusted(bufpt, len, certtb, cert_policy,
CERT_ATTR_MAX);
- if (pret <= 0)
- /* no attributes found */
+ end = filebuf + len;
+
+ while (true) {
+ len = end - (char *)bufpt;
+ if (len <= 0)
break;
- if (pos + blob_pad_len(bufpt) > (size_t) len)
- /* blob exceeds filebuffer */
+ if (blob_parse_untrusted(bufpt, len, certtb, cert_policy,
CERT_ATTR_MAX) <= 0)
+ /* no attributes found */
break;
- else
- pos += blob_pad_len(bufpt);
if (!certtb[CERT_ATTR_SIGNATURE])
/* no signature -> drop */
@@ -199,11 +197,17 @@ static int cert_load(const char *certfile, struct
list_head *chain) {
cobj->cert[CERT_ATTR_PAYLOAD] =
blob_memdup(certtb[CERT_ATTR_PAYLOAD]);
list_add_tail(>list, chain);
- ret += pret;
- /* repeat parsing while there is still enough remaining data in buffer
*/
- } while((size_t) len > pos + sizeof(struct blob_attr) && (bufpt =
blob_next(bufpt)));
+ ret = 0;
+
+ /* Repeat parsing while there is still enough remaining data in
buffer
+*
+* Note that blob_next() is only valid for untrusted data
because blob_parse_untrusted()
+* verified that the buffer contains at least one blob, and
that it is completely contained
+* in the buffer */
+ bufpt = blob_next(bufpt);
+ }
- return (ret <= 0);
+ return ret;
}
#ifdef UCERT_FULL
--
2.26.2
___
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel
[OpenWrt-Devel] [PATCH ucert 06/13] usign-exec: do not close stdin and stderr before exec
FDs 0, 1 and 2 should always be available. This also allows the exec error
message in the forked process to be displayed.
Signed-off-by: Matthias Schiffer
---
usign-exec.c | 8 +++-
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/usign-exec.c b/usign-exec.c
index 22fdc14e7ebb..436c627356b0 100644
--- a/usign-exec.c
+++ b/usign-exec.c
@@ -46,7 +46,7 @@ int _usign_key_is_revoked(const char *fingerprint, const char
*pubkeydir) {
#ifdef UCERT_FULL
/*
* call usign -S ...
- * return WEXITSTATUS or -1 if fork or execv fails
+ * return WEXITSTATUS or -1 if fork fails
*/
int usign_s(const char *msgfile, const char *seckeyfile, const char *sigfile,
bool quiet) {
pid_t pid;
@@ -92,7 +92,7 @@ int usign_s(const char *msgfile, const char *seckeyfile,
const char *sigfile, bo
/*
* call usign -F ... and set fingerprint returned
- * return WEXITSTATUS or -1 if fork or execv fails
+ * return WEXITSTATUS or -1 if fork fails
*/
static int usign_f(char *fingerprint, const char *pubkeyfile, const char
*seckeyfile, const char *sigfile, bool quiet) {
int fds[2];
@@ -130,8 +130,6 @@ static int usign_f(char *fingerprint, const char
*pubkeyfile, const char *seckey
case 0:
dup2(fds[1], 1);
- close(0);
- close(2);
close(fds[0]);
close(fds[1]);
@@ -185,7 +183,7 @@ int usign_f_sig(char *fingerprint, const char *sigfile,
bool quiet) {
/*
* call usign -V ...
- * return WEXITSTATUS or -1 if fork or execv fails
+ * return WEXITSTATUS or -1 if fork fails
*/
int usign_v(const char *msgfile, const char *pubkeyfile,
const char *pubkeydir, const char *sigfile, bool quiet) {
--
2.26.2
___
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel
[OpenWrt-Devel] [PATCH ucert 00/13] ucert fixes and cleanup
While looking for a build issue (see [1]), I noticed various issues in the ucert code (and this should not be applied before [1] is applied to usign). There might well be more problems lurking - I did not read all the code. In particular patch 12/12 is critical: It must be applied before the attached libubox patch to avoid a new security issue. The libubox patch is necessary to make ucert verification work at all again; without it, cert_load() will always fail, and in consequence, all images will be found invalid when REQUIRE_IMAGE_SIGNATURE is enabled. [1] https://patchwork.ozlabs.org/project/openwrt/patch/8ead1fd6a61117b54b4efd5111fe0d19e4eef9c5.1589642591.git.mschif...@universe-factory.net/ Matthias Schiffer (13): stdout/stderr improvements Fix return code of write_file() Introduce read_file() helper, improve error reporting usign-exec: simplify usign execv calls usign-exec: fix exec error handling usign-exec: do not close stdin and stderr before exec usign-exec: change usign_f_* fingerprint argument to char[17] usign-exec: remove redundant return statements usign-exec: close writing end of pipe early in parent process usign-exec: return code fixes usign-exec: improve usign -F output handling Fix length checks in cert_load() Do not print line number in debug messages tests/cram/test_ucert.t | 4 +- ucert.c | 147 +++- usign-exec.c| 115 +-- usign.h | 8 ++- 4 files changed, 138 insertions(+), 136 deletions(-) -- 2.26.2 ___ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/mailman/listinfo/openwrt-devel
[OpenWrt-Devel] [PATCH ucert 09/13] usign-exec: close writing end of pipe early in parent process
When the child process exited without producing output (for example
because usign was not found), the parent process would hang forever in
read(). By closing the writing end early in the parent process, read
will return as soon as no writing FDs are left - that is, when the child
process has exited.
Signed-off-by: Matthias Schiffer
---
usign-exec.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/usign-exec.c b/usign-exec.c
index c9aecf99f9c0..0dde81ed647b 100644
--- a/usign-exec.c
+++ b/usign-exec.c
@@ -136,6 +136,8 @@ static int usign_f(char fingerprint[17], const char
*pubkeyfile, const char *sec
_exit(1);
}
+ close(fds[1]);
+
waitpid(pid, , 0);
status = WEXITSTATUS(status);
if (fingerprint && !WEXITSTATUS(status)) {
@@ -149,7 +151,6 @@ static int usign_f(char fingerprint[17], const char
*pubkeyfile, const char *sec
}
close(fds[0]);
- close(fds[1]);
return status;
}
--
2.26.2
___
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel
[OpenWrt-Devel] [PATCH ucert 02/13] Fix return code of write_file()
write_file() returns 1/true on success; it should return 0/false when
opening the file fails.
To make it more obvious that is function returns true and not 0 on
success, also change its return type to bool.
Signed-off-by: Matthias Schiffer
---
ucert.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/ucert.c b/ucert.c
index 2ea939947d72..7de4c12711e8 100644
--- a/ucert.c
+++ b/ucert.c
@@ -116,13 +116,13 @@ struct cert_object {
};
/* write buffer to file */
-static int write_file(const char *filename, void *buf, size_t len, bool
append) {
+static bool write_file(const char *filename, void *buf, size_t len, bool
append) {
FILE *f;
size_t outlen;
f = fopen(filename, append?"a":"w");
if (!f)
- return 1;
+ return false;
outlen = fwrite(buf, 1, len, f);
fclose(f);
--
2.26.2
___
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel
[OpenWrt-Devel] [PATCH ucert 08/13] usign-exec: remove redundant return statements
All switch() cases were already returning value or exiting. Instead,
move the default case out of the switch to reduce indentation (only
relevant for usign_f()).
Signed-off-by: Matthias Schiffer
---
usign-exec.c | 43 +--
1 file changed, 17 insertions(+), 26 deletions(-)
diff --git a/usign-exec.c b/usign-exec.c
index 294c794b1c50..c9aecf99f9c0 100644
--- a/usign-exec.c
+++ b/usign-exec.c
@@ -76,13 +76,10 @@ int usign_s(const char *msgfile, const char *seckeyfile,
const char *sigfile, bo
if (!quiet)
perror("Failed to execute usign");
_exit(1);
-
- default:
- waitpid(pid, , 0);
- return WEXITSTATUS(status);
}
- return -1;
+ waitpid(pid, , 0);
+ return WEXITSTATUS(status);
}
#else
int usign_s(const char *msgfile, const char *seckeyfile, const char *sigfile,
bool quiet) {
@@ -137,26 +134,23 @@ static int usign_f(char fingerprint[17], const char
*pubkeyfile, const char *sec
if (!quiet)
perror("Failed to execute usign");
_exit(1);
+ }
- default:
- waitpid(pid, , 0);
- status = WEXITSTATUS(status);
- if (fingerprint && !WEXITSTATUS(status)) {
- ssize_t r;
- memset(fingerprint, 0, 17);
- r = read(fds[0], fingerprint, 17);
- if (r < 16)
- status = -1;
+ waitpid(pid, , 0);
+ status = WEXITSTATUS(status);
+ if (fingerprint && !WEXITSTATUS(status)) {
+ ssize_t r;
+ memset(fingerprint, 0, 17);
+ r = read(fds[0], fingerprint, 17);
+ if (r < 16)
+ status = -1;
- fingerprint[16] = '\0';
+ fingerprint[16] = '\0';
- }
- close(fds[0]);
- close(fds[1]);
- return status;
}
-
- return -1;
+ close(fds[0]);
+ close(fds[1]);
+ return status;
}
/*
@@ -237,11 +231,8 @@ int usign_v(const char *msgfile, const char *pubkeyfile,
if (!quiet)
perror("Failed to execute usign");
_exit(1);
-
- default:
- waitpid(pid, , 0);
- return WEXITSTATUS(status);
}
- return -1;
+ waitpid(pid, , 0);
+ return WEXITSTATUS(status);
}
--
2.26.2
___
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel
[OpenWrt-Devel] [PATCH ucert 07/13] usign-exec: change usign_f_* fingerprint argument to char[17]
This makes it more obvious that a buffer with space for 17 characters is
expected to be passed. The code still works the same (a char[17] is
equivalent to char* as an argument).
Signed-off-by: Matthias Schiffer
---
usign-exec.c | 8
usign.h | 6 +++---
2 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/usign-exec.c b/usign-exec.c
index 436c627356b0..294c794b1c50 100644
--- a/usign-exec.c
+++ b/usign-exec.c
@@ -94,7 +94,7 @@ int usign_s(const char *msgfile, const char *seckeyfile,
const char *sigfile, bo
* call usign -F ... and set fingerprint returned
* return WEXITSTATUS or -1 if fork fails
*/
-static int usign_f(char *fingerprint, const char *pubkeyfile, const char
*seckeyfile, const char *sigfile, bool quiet) {
+static int usign_f(char fingerprint[17], const char *pubkeyfile, const char
*seckeyfile, const char *sigfile, bool quiet) {
int fds[2];
pid_t pid;
int status;
@@ -162,21 +162,21 @@ static int usign_f(char *fingerprint, const char
*pubkeyfile, const char *seckey
/*
* call usign -F -p ...
*/
-int usign_f_pubkey(char *fingerprint, const char *pubkeyfile, bool quiet) {
+int usign_f_pubkey(char fingerprint[17], const char *pubkeyfile, bool quiet) {
return usign_f(fingerprint, pubkeyfile, NULL, NULL, quiet);
}
/*
* call usign -F -s ...
*/
-int usign_f_seckey(char *fingerprint, const char *seckeyfile, bool quiet) {
+int usign_f_seckey(char fingerprint[17], const char *seckeyfile, bool quiet) {
return usign_f(fingerprint, NULL, seckeyfile, NULL, quiet);
}
/*
* call usign -F -x ...
*/
-int usign_f_sig(char *fingerprint, const char *sigfile, bool quiet) {
+int usign_f_sig(char fingerprint[17], const char *sigfile, bool quiet) {
return usign_f(fingerprint, NULL, NULL, sigfile, quiet);
}
diff --git a/usign.h b/usign.h
index 9c3207aa97ed..fc734575a76b 100644
--- a/usign.h
+++ b/usign.h
@@ -37,11 +37,11 @@ int usign_s(const char *msgfile, const char *seckeyfile,
const char *sigfile, bo
*
* calls: usign -F ...
*/
-int usign_f_pubkey(char *fingerprint, const char *pubkeyfile, bool quiet);
+int usign_f_pubkey(char fingerprint[17], const char *pubkeyfile, bool quiet);
-int usign_f_seckey(char *fingerprint, const char *seckeyfile, bool quiet);
+int usign_f_seckey(char fingerprint[17], const char *seckeyfile, bool quiet);
-int usign_f_sig(char *fingerprint, const char *sigfile, bool quiet);
+int usign_f_sig(char fingerprint[17], const char *sigfile, bool quiet);
/**
* custom extension to check for revokers
--
2.26.2
___
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel
[OpenWrt-Devel] [PATCH ucert 04/13] usign-exec: simplify usign execv calls
When the executable to exec is passed as an absolute path, execv() and execvp() are equivalent, so there it no need to make the code hard to read with #ifdefs. Signed-off-by: Matthias Schiffer --- usign-exec.c | 24 +++- 1 file changed, 3 insertions(+), 21 deletions(-) diff --git a/usign-exec.c b/usign-exec.c index 7f6106580b16..4ff2e63c5be1 100644 --- a/usign-exec.c +++ b/usign-exec.c @@ -72,13 +72,7 @@ int usign_s(const char *msgfile, const char *seckeyfile, const char *sigfile, bo return -1; case 0: - if ( -#ifdef UCERT_HOST_BUILD - execvp(usign_argv[0], (char *const *)usign_argv) -#else - execv(usign_argv[0], (char *const *)usign_argv) -#endif - ) + if (execvp(usign_argv[0], (char *const *)usign_argv)) return -1; break; @@ -141,13 +135,7 @@ static int usign_f(char *fingerprint, const char *pubkeyfile, const char *seckey close(fds[0]); close(fds[1]); - if ( -#ifdef UCERT_HOST_BUILD - execvp(usign_argv[0], (char *const *)usign_argv) -#else - execv(usign_argv[0], (char *const *)usign_argv) -#endif - ) + if (execvp(usign_argv[0], (char *const *)usign_argv)) return -1; break; @@ -247,13 +235,7 @@ int usign_v(const char *msgfile, const char *pubkeyfile, return -1; case 0: - if ( -#ifdef UCERT_HOST_BUILD - execvp(usign_argv[0], (char *const *)usign_argv) -#else - execv(usign_argv[0], (char *const *)usign_argv) -#endif - ) + if (execvp(usign_argv[0], (char *const *)usign_argv)) return -1; break; -- 2.26.2 ___ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/mailman/listinfo/openwrt-devel
[OpenWrt-Devel] [PATCH ucert 05/13] usign-exec: fix exec error handling
When execvp fails in the forked process, we must exit. Also add an error
message.
Signed-off-by: Matthias Schiffer
---
ucert.c | 4 ++--
usign-exec.c | 40
usign.h | 8 +---
3 files changed, 27 insertions(+), 25 deletions(-)
diff --git a/ucert.c b/ucert.c
index 89bf0c64d4b5..208d5f67e10d 100644
--- a/ucert.c
+++ b/ucert.c
@@ -349,7 +349,7 @@ static int chain_verify(const char *msgfile, const char
*pubkeyfile,
blobmsg_data_len(payloadtb[CERT_PL_ATTR_PUBKEY]),
false);
- if (usign_f_pubkey(chainedfp, chainedpubkey)) {
+ if (usign_f_pubkey(chainedfp, chainedpubkey, quiet)) {
DPRINTF("cannot get fingerprint for chained
key\n");
ret = 2;
goto clean_and_return;
@@ -460,7 +460,7 @@ static int cert_issue(const char *certfile, const char
*pubkeyfile, const char *
pkb[pklen] = '\0';
- if (usign_f_pubkey(pkfp, pubkeyfile))
+ if (usign_f_pubkey(pkfp, pubkeyfile, quiet))
return -1;
gettimeofday(, NULL);
diff --git a/usign-exec.c b/usign-exec.c
index 4ff2e63c5be1..22fdc14e7ebb 100644
--- a/usign-exec.c
+++ b/usign-exec.c
@@ -72,10 +72,10 @@ int usign_s(const char *msgfile, const char *seckeyfile,
const char *sigfile, bo
return -1;
case 0:
- if (execvp(usign_argv[0], (char *const *)usign_argv))
- return -1;
-
- break;
+ execvp(usign_argv[0], (char *const *)usign_argv);
+ if (!quiet)
+ perror("Failed to execute usign");
+ _exit(1);
default:
waitpid(pid, , 0);
@@ -94,7 +94,7 @@ int usign_s(const char *msgfile, const char *seckeyfile,
const char *sigfile, bo
* call usign -F ... and set fingerprint returned
* return WEXITSTATUS or -1 if fork or execv fails
*/
-static int usign_f(char *fingerprint, const char *pubkeyfile, const char
*seckeyfile, const char *sigfile) {
+static int usign_f(char *fingerprint, const char *pubkeyfile, const char
*seckeyfile, const char *sigfile, bool quiet) {
int fds[2];
pid_t pid;
int status;
@@ -135,10 +135,10 @@ static int usign_f(char *fingerprint, const char
*pubkeyfile, const char *seckey
close(fds[0]);
close(fds[1]);
- if (execvp(usign_argv[0], (char *const *)usign_argv))
- return -1;
-
- break;
+ execvp(usign_argv[0], (char *const *)usign_argv);
+ if (!quiet)
+ perror("Failed to execute usign");
+ _exit(1);
default:
waitpid(pid, , 0);
@@ -164,22 +164,22 @@ static int usign_f(char *fingerprint, const char
*pubkeyfile, const char *seckey
/*
* call usign -F -p ...
*/
-int usign_f_pubkey(char *fingerprint, const char *pubkeyfile) {
- return usign_f(fingerprint, pubkeyfile, NULL, NULL);
+int usign_f_pubkey(char *fingerprint, const char *pubkeyfile, bool quiet) {
+ return usign_f(fingerprint, pubkeyfile, NULL, NULL, quiet);
}
/*
* call usign -F -s ...
*/
-int usign_f_seckey(char *fingerprint, const char *seckeyfile) {
- return usign_f(fingerprint, NULL, seckeyfile, NULL);
+int usign_f_seckey(char *fingerprint, const char *seckeyfile, bool quiet) {
+ return usign_f(fingerprint, NULL, seckeyfile, NULL, quiet);
}
/*
* call usign -F -x ...
*/
-int usign_f_sig(char *fingerprint, const char *sigfile) {
- return usign_f(fingerprint, NULL, NULL, sigfile);
+int usign_f_sig(char *fingerprint, const char *sigfile, bool quiet) {
+ return usign_f(fingerprint, NULL, NULL, sigfile, quiet);
}
@@ -195,7 +195,7 @@ int usign_v(const char *msgfile, const char *pubkeyfile,
unsigned int usign_argc = 0;
char fingerprint[17];
- if (usign_f_sig(fingerprint, sigfile)) {
+ if (usign_f_sig(fingerprint, sigfile, quiet)) {
if (!quiet)
fprintf(stderr, "cannot get signing key fingerprint\n");
return 1;
@@ -235,10 +235,10 @@ int usign_v(const char *msgfile, const char *pubkeyfile,
return -1;
case 0:
- if (execvp(usign_argv[0], (char *const *)usign_argv))
- return -1;
-
- break;
+ execvp(usign_argv[0], (char *const *)usign_argv);
+ if (!quiet)
+ perror("Failed to execute usign");
+ _exit(1);
default:
waitpid(pid, , 0);
diff --git a/usign.h b/usign.h
index d57d09ec7b74..9c3207aa97ed 100644
--- a/usign.h
+++ b/usign.h
@@ -15,6 +15,8 @@
#ifndef _USIGN_H
#define _USIGN_H
+#include
+
/**
* Verify
*
@@ -35,11 +37,11 @@ int
[OpenWrt-Devel] [PATCH ucert 01/13] stdout/stderr improvements
- Print error messages to stderr
- fprintf(stdout, ...) is just printf(...)
Signed-off-by: Matthias Schiffer
---
ucert.c | 6 +++---
usign-exec.c | 4 ++--
2 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/ucert.c b/ucert.c
index d822199eb7f8..2ea939947d72 100644
--- a/ucert.c
+++ b/ucert.c
@@ -381,7 +381,7 @@ static void cert_dump_blob(struct blob_attr
*cert[CERT_ATTR_MAX]) {
switch(cert_policy[i].type) {
case BLOB_ATTR_BINARY:
- fprintf(stdout, "signature:\n---\n%s---\n", (char *)
blob_data(v));
+ printf("signature:\n---\n%s---\n", (char *)
blob_data(v));
break;
case BLOB_ATTR_NESTED:
json = blobmsg_format_json_indent(blob_data(v), false,
0);
@@ -389,7 +389,7 @@ static void cert_dump_blob(struct blob_attr
*cert[CERT_ATTR_MAX]) {
DPRINTF("cannot parse payload\n");
continue;
}
- fprintf(stdout, "payload:\n---\n%s\n---\n", json);
+ printf("payload:\n---\n%s\n---\n", json);
free(json);
break;
}
@@ -408,7 +408,7 @@ static int cert_dump(const char *certfile) {
}
list_for_each_entry(cobj, , list) {
- fprintf(stdout, "=== CHAIN ELEMENT %02u ===\n", ++count);
+ printf("=== CHAIN ELEMENT %02u ===\n", ++count);
cert_dump_blob(cobj->cert);
}
diff --git a/usign-exec.c b/usign-exec.c
index 85e5f956ee1f..7f6106580b16 100644
--- a/usign-exec.c
+++ b/usign-exec.c
@@ -209,13 +209,13 @@ int usign_v(const char *msgfile, const char *pubkeyfile,
if (usign_f_sig(fingerprint, sigfile)) {
if (!quiet)
- fprintf(stdout, "cannot get signing key fingerprint\n");
+ fprintf(stderr, "cannot get signing key fingerprint\n");
return 1;
}
if (pubkeydir && _usign_key_is_revoked(fingerprint, pubkeydir)) {
if (!quiet)
- fprintf(stdout, "key %s has been revoked!\n",
fingerprint);
+ fprintf(stderr, "key %s has been revoked!\n",
fingerprint);
return 1;
}
usign_argv[usign_argc++] = USIGN_EXEC;
--
2.26.2
___
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel
[OpenWrt-Devel] [PATCH ucert 03/13] Introduce read_file() helper, improve error reporting
This helper simplifies handling, ensures that there are no resource
leaks, and checks for EOF more robustly.
Also introduce error reporting at all call sites to give the user some
feedback when something went wrong.
Signed-off-by: Matthias Schiffer
---
ucert.c | 97 +
1 file changed, 57 insertions(+), 40 deletions(-)
diff --git a/ucert.c b/ucert.c
index 7de4c12711e8..89bf0c64d4b5 100644
--- a/ucert.c
+++ b/ucert.c
@@ -15,6 +15,7 @@
#include
#include
+#include
#include
#include
#include
@@ -129,28 +130,51 @@ static bool write_file(const char *filename, void *buf,
size_t len, bool append)
return (outlen == len);
}
+/* reads a whole file to a buffer - returns -1 on errors and sets errno */
+static ssize_t read_file(const char *filename, void *buf, size_t len, size_t
minlen) {
+ FILE *f;
+ ssize_t ret;
+
+ f = fopen(filename, "r");
+ if (!f)
+ return -1;
+
+ ret = fread(buf, 1, len, f);
+
+ /* Ensure that feof() yields the correct result when the file is exactly
+* len bytes long */
+ fgetc(f);
+
+ if (ferror(f)) {
+ ret = -1;
+ } else if (!feof(f)) {
+ errno = EOVERFLOW;
+ ret = -1;
+ } else if ((size_t)ret < minlen) {
+ errno = EINVAL;
+ ret = -1;
+ }
+
+ fclose(f);
+ return ret;
+}
+
/* load certfile into list */
static int cert_load(const char *certfile, struct list_head *chain) {
- FILE *f;
struct blob_attr *certtb[CERT_ATTR_MAX];
struct blob_attr *bufpt;
struct cert_object *cobj;
char filebuf[CERT_BUF_LEN];
int ret = 0, pret = 0;
- size_t len, pos = 0;
-
- f = fopen(certfile, "r");
- if (!f)
- return 1;
-
- len = fread(, 1, CERT_BUF_LEN - 1, f);
- if (len < 64)
- return 1;
+ size_t pos = 0;
+ ssize_t len;
- ret = ferror(f) || !feof(f);
- fclose(f);
- if (ret)
+ len = read_file(certfile, filebuf, sizeof(filebuf) - 1, 0);
+ if (len < 0) {
+ if (!quiet)
+ perror("Unable to load certificate file");
return 1;
+ }
bufpt = (struct blob_attr *)filebuf;
do {
@@ -159,7 +183,7 @@ static int cert_load(const char *certfile, struct list_head
*chain) {
/* no attributes found */
break;
- if (pos + blob_pad_len(bufpt) > len)
+ if (pos + blob_pad_len(bufpt) > (size_t) len)
/* blob exceeds filebuffer */
break;
else
@@ -177,7 +201,7 @@ static int cert_load(const char *certfile, struct list_head
*chain) {
list_add_tail(>list, chain);
ret += pret;
/* repeat parsing while there is still enough remaining data in buffer
*/
- } while(len > pos + sizeof(struct blob_attr) && (bufpt =
blob_next(bufpt)));
+ } while((size_t) len > pos + sizeof(struct blob_attr) && (bufpt =
blob_next(bufpt)));
return (ret <= 0);
}
@@ -185,21 +209,18 @@ static int cert_load(const char *certfile, struct
list_head *chain) {
#ifdef UCERT_FULL
/* append signature to certfile */
static int cert_append(const char *certfile, const char *sigfile) {
- FILE *fs;
char filebuf[CERT_BUF_LEN];
struct blob_buf sigbuf = {0};
- int len;
+ ssize_t len;
int ret;
- fs = fopen(sigfile, "r");
- if (!fs)
- return 1;
+ len = read_file(sigfile, filebuf, sizeof(filebuf) - 1, 64);
+ if (len < 0) {
+ if (!quiet)
+ perror("Unable to load signature file");
- len = fread(, 1, CERT_BUF_LEN - 1, fs);
- ret = ferror(fs) || !feof(fs) || (len < 64);
- fclose(fs);
- if (ret)
return 1;
+ }
blob_buf_init(, 0);
blob_put(, CERT_ATTR_SIGNATURE, filebuf, len);
@@ -420,27 +441,24 @@ static int cert_issue(const char *certfile, const char
*pubkeyfile, const char *
struct blob_buf payloadbuf = {0};
struct blob_buf certbuf = {0};
struct timeval tv;
- int pklen, siglen;
+ ssize_t pklen, siglen;
int revoker = 1;
void *c;
- FILE *pkf, *sigf;
char pkb[512];
char sigb[1024];
char fname[256], sfname[256];
char pkfp[17];
char tmpdir[] = "/tmp/ucert-XX";
- pkf = fopen(pubkeyfile, "r");
- if (!pkf)
- return -1;
-
- pklen = fread(pkb, 1, 512, pkf);
- pkb[pklen] = '\0';
+ pklen = read_file(pubkeyfile, pkb, sizeof(pkb) - 1, 32);
+ if (pklen < 0) {
+ if (!quiet)
+ perror("Unable to load public key file");
- if (pklen < 32)
return -1;
+
[OpenWrt-Devel] [PATCH libubox] blob: make blob_parse_untrusted more permissive
Some tools like ucert use concatenations of multiple blobs. Account for this case by allowing the underlying buffer length to be greater than the blog length. Signed-off-by: Matthias Schiffer --- blob.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blob.c b/blob.c index 528e717615d6..433becb904f5 100644 --- a/blob.c +++ b/blob.c @@ -277,7 +277,7 @@ blob_parse_untrusted(struct blob_attr *attr, size_t attr_len, struct blob_attr * return 0; len = blob_raw_len(attr); - if (len != attr_len) + if (attr_len < len) return 0; memset(data, 0, sizeof(struct blob_attr *) * max); -- 2.26.2 ___ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/mailman/listinfo/openwrt-devel
Re: [OpenWrt-Devel] hostap commit 6c9543fcb breaks MESH-SAE with wolfssl
On Wed, May 13, 2020 at 05:34:31PM +0100, Daniel Golle wrote: > I've just built OpenWrt for MIPS malta (BE) with mac80211-hwsim and > hereby confirm the problem shows up there in exactly the same way. > Also on MIPS malta with mac80211-hwsim, mesh with SAE works with > WolfSSL up to and including hostapd git revision 2b84ca4dd work fine, > starting from revision 6c9543fcb7 don't. > > As OpenWrt might not be what you want for QA, I've been following > https://markuta.com/how-to-build-a-mips-qemu-image-on-debian/ > and ended up with a functional Debian install inside QEMU about 20 > minutes later. (I had to replace kernel image vmlinux-4.9.0-6-4kc-malta > mentioned in that guide with vmlinux-4.19.0-9-4kc-malta which is the > current version and exists on Debian's download server) > This would allow to run the whole test-suite as-is on MIPS32 BE, maybe > even with buildbot.w1.fi... Thanks for the pointer. That 20 minutes seemed a bit optimistic for the full setup, but I did get this running with buildroot-based cross compiler setup. Emulating a big endian MIPS processor with QEMU does not look exactly fast, though.. This can get the mac80211_hwsim test cases started, but significant portion of them fails due to various timeouts and it takes hours--or well, maybe days--to run through the full test set (but to be fair, I could run multiple VM instances in parallel to speed this up). Anyway, this can be quite useful to have available for manually testing some specific implementation details.. As far as this issue with SAE is concerned, there is actually nothing wrong with the calculation results, i.e., all the values are correct and I was able to get SAE completed with the current snapshot.. However, it is really slow. To the point of taking close to a minute to complete authentication. I'd assume you are seeing timeouts from this or just giving up on waiting before the operation is completed. While the current standard version of SAE is inconveniently slow on low end processors, it was not supposed to be this slow. It turned out that the real issue here is in not exactly ideal implementation of the wolfssl wrapper function crypto_bignum_rand(). This function is expected to return a random value between 0 and m-1. That is what the function did, but it did that by finding a random _prime_ double the maximum length of that range and then scaling to to the range which is significantly harder calculation (took around 40 times longer than needed in some of my tests) and completely unnecessary for this function. This commit fixes that issue: https://w1.fi/cgit/hostap/commit/?id=eb595b3e3ab531645a5bde71cf6385335b7a4b95 -- Jouni MalinenPGP id EFC895FA ___ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/mailman/listinfo/openwrt-devel
[OpenWrt-Devel] [PATCH v2] generic: platform/mikrotik: fix LZOR support
31e99fe3da which introduced this code was unfortunately untested.
This commit fixes a number of issues and works around the fact that in
this particular scheme, the LZO payload may be padded at the end which
will trigger a harmless lzo decompression error.
This commit also disambiguates the debug printks.
Tested-by: Robert Marko
Signed-off-by: Thibaut VARÈNE
Fixes: 31e99fe3da ("generic: platform/mikrotik: support LZOR encoding")
---
.../drivers/platform/mikrotik/rb_hardconfig.c | 57 ++
1 file changed, 36 insertions(+), 21 deletions(-)
diff --git
a/target/linux/generic/files/drivers/platform/mikrotik/rb_hardconfig.c
b/target/linux/generic/files/drivers/platform/mikrotik/rb_hardconfig.c
index 26218d6a7d..93c731a5f0 100644
--- a/target/linux/generic/files/drivers/platform/mikrotik/rb_hardconfig.c
+++ b/target/linux/generic/files/drivers/platform/mikrotik/rb_hardconfig.c
@@ -36,7 +36,7 @@
#include "routerboot.h"
-#define RB_HARDCONFIG_VER "0.02"
+#define RB_HARDCONFIG_VER "0.03"
#define RB_HC_PR_PFX "[rb_hardconfig] "
/* ID values for hardware settings */
@@ -484,16 +484,18 @@ static int hc_wlan_data_unpack_lzor(const u8 *inbuf,
size_t inlen,
void *outbuf, size_t *outlen)
{
u16 rle_ofs, rle_len;
- size_t templen;
+ const u32 *needle;
u8 *tempbuf;
+ size_t templen, lzo_len;
int ret;
- templen = inlen + sizeof(hc_lzor_prefix);
- if (templen > *outlen)
+ lzo_len = inlen + sizeof(hc_lzor_prefix);
+ if (lzo_len > *outlen)
return -EFBIG;
/* Temporary buffer same size as the outbuf */
- tempbuf = kmalloc(*outlen, GFP_KERNEL);
+ templen = *outlen;
+ tempbuf = kmalloc(templen, GFP_KERNEL);
if (!outbuf)
return -ENOMEM;
@@ -501,41 +503,54 @@ static int hc_wlan_data_unpack_lzor(const u8 *inbuf,
size_t inlen,
memcpy(outbuf, hc_lzor_prefix, sizeof(hc_lzor_prefix));
memcpy(outbuf + sizeof(hc_lzor_prefix), inbuf, inlen);
- /* LZO-decompress templen bytes of outbuf into the tempbuf */
- ret = lzo1x_decompress_safe(outbuf, templen, tempbuf, outlen);
+ /* LZO-decompress lzo_len bytes of outbuf into the tempbuf */
+ ret = lzo1x_decompress_safe(outbuf, lzo_len, tempbuf, );
if (ret) {
- pr_debug(RB_HC_PR_PFX "LZO decompression error (%d)\n", ret);
- goto fail;
+ if (LZO_E_INPUT_NOT_CONSUMED == ret) {
+ /*
+* It is assumed that because the LZO payload is
embedded
+* in a "root" RB_ID_WLAN_DATA tag, the tag length is
aligned
+* and the payload is padded at the end, which triggers
a
+* spurious error which we ignore here.
+*/
+ pr_debug(RB_HC_PR_PFX "LZOR: LZO EOF before buffer end
- this may be harmless\n");
+ } else {
+ pr_debug(RB_HC_PR_PFX "LZOR: LZO decompression error
(%d)\n", ret);
+ goto fail;
+ }
}
- templen = *outlen;
/*
* Post decompression we have a blob (possibly byproduct of the lzo
* dictionary). We need to find RB_MAGIC_ERD. The magic number seems to
* be 32bit-aligned in the decompression output.
*/
-
- while (RB_MAGIC_ERD != *(u32 *)tempbuf) {
- tempbuf += 4;
- templen -= 4;
- }
+ needle = (const u32 *)tempbuf;
+ while (RB_MAGIC_ERD != *needle++) {
+ if ((u8 *)needle >= tempbuf+templen) {
+ pr_debug(RB_HC_PR_PFX "LZOR: ERD magic not found\n");
+ goto fail;
+ }
+ };
+ templen -= (u8 *)needle - tempbuf;
/* Past magic. Look for tag node */
- ret = routerboot_tag_find(tempbuf, templen, 0x1, _ofs, _len);
+ ret = routerboot_tag_find((u8 *)needle, templen, 0x1, _ofs,
_len);
if (ret) {
- pr_debug(RB_HC_PR_PFX "RLE data not found\n");
+ pr_debug(RB_HC_PR_PFX "LZOR: RLE data not found\n");
goto fail;
}
if (rle_len > templen) {
- pr_debug(RB_HC_PR_PFX "Invalid RLE data length\n");
+ pr_debug(RB_HC_PR_PFX "LZOR: Invalid RLE data length\n");
+ ret = -EINVAL;
goto fail;
}
- /* RLE-decode tempbuf back into the outbuf */
- ret = routerboot_rle_decode(tempbuf+rle_ofs, rle_len, outbuf, outlen);
+ /* RLE-decode tempbuf from needle back into the outbuf */
+ ret = routerboot_rle_decode((u8 *)needle+rle_ofs, rle_len, outbuf,
outlen);
if (ret)
- pr_debug(RB_HC_PR_PFX "RLE decoding error (%d)\n", ret);
+ pr_debug(RB_HC_PR_PFX "LZOR: RLE
[OpenWrt-Devel] [PATCH] generic: platform/mikrotik: fix LZOR support
31e99fe3da which introduced this code was unfortunately untested.
This commit fixes a number of issues and works around the fact that in
this particular scheme, the LZO payload may be padded at the end which
will trigger a harmless lzo decompression error.
This commit also disambiguates the debug printks.
Tested-by: Robert Marko
Signed-off-by: Thibaut VARÈNE
---
.../drivers/platform/mikrotik/rb_hardconfig.c | 59 ++
1 file changed, 37 insertions(+), 22 deletions(-)
diff --git
a/target/linux/generic/files/drivers/platform/mikrotik/rb_hardconfig.c
b/target/linux/generic/files/drivers/platform/mikrotik/rb_hardconfig.c
index 26218d6a7d..7402320428 100644
--- a/target/linux/generic/files/drivers/platform/mikrotik/rb_hardconfig.c
+++ b/target/linux/generic/files/drivers/platform/mikrotik/rb_hardconfig.c
@@ -36,7 +36,7 @@
#include "routerboot.h"
-#define RB_HARDCONFIG_VER "0.02"
+#define RB_HARDCONFIG_VER "0.03"
#define RB_HC_PR_PFX "[rb_hardconfig] "
/* ID values for hardware settings */
@@ -484,16 +484,18 @@ static int hc_wlan_data_unpack_lzor(const u8 *inbuf,
size_t inlen,
void *outbuf, size_t *outlen)
{
u16 rle_ofs, rle_len;
- size_t templen;
- u8 *tempbuf;
+ const u32 *needle;
+ u8 *tempbuf, *ptr;
+ size_t templen, lzo_len;
int ret;
- templen = inlen + sizeof(hc_lzor_prefix);
- if (templen > *outlen)
+ lzo_len = inlen + sizeof(hc_lzor_prefix);
+ if (lzo_len > *outlen)
return -EFBIG;
/* Temporary buffer same size as the outbuf */
- tempbuf = kmalloc(*outlen, GFP_KERNEL);
+ templen = *outlen;
+ tempbuf = kmalloc(templen, GFP_KERNEL);
if (!outbuf)
return -ENOMEM;
@@ -501,41 +503,54 @@ static int hc_wlan_data_unpack_lzor(const u8 *inbuf,
size_t inlen,
memcpy(outbuf, hc_lzor_prefix, sizeof(hc_lzor_prefix));
memcpy(outbuf + sizeof(hc_lzor_prefix), inbuf, inlen);
- /* LZO-decompress templen bytes of outbuf into the tempbuf */
- ret = lzo1x_decompress_safe(outbuf, templen, tempbuf, outlen);
+ /* LZO-decompress lzo_len bytes of outbuf into the tempbuf */
+ ret = lzo1x_decompress_safe(outbuf, lzo_len, tempbuf, );
if (ret) {
- pr_debug(RB_HC_PR_PFX "LZO decompression error (%d)\n", ret);
- goto fail;
+ if (LZO_E_INPUT_NOT_CONSUMED == ret) {
+ /*
+* It is assumed that because the LZO payload is
embedded
+* in a "root" RB_ID_WLAN_DATA tag, the tag length is
aligned
+* and the payload is padded at the end, which triggers
a
+* spurious error which we ignore here.
+*/
+ pr_debug(RB_HC_PR_PFX "LZOR: LZO EOF before buffer end
- this may be harmless\n");
+ } else {
+ pr_debug(RB_HC_PR_PFX "LZOR: LZO decompression error
(%d)\n", ret);
+ goto fail;
+ }
}
- templen = *outlen;
/*
* Post decompression we have a blob (possibly byproduct of the lzo
* dictionary). We need to find RB_MAGIC_ERD. The magic number seems to
* be 32bit-aligned in the decompression output.
*/
-
- while (RB_MAGIC_ERD != *(u32 *)tempbuf) {
- tempbuf += 4;
- templen -= 4;
- }
+ needle = (const u32 *)tempbuf;
+ while (RB_MAGIC_ERD != *needle++) {
+ if ((u8 *)needle >= tempbuf+templen) {
+ pr_debug(RB_HC_PR_PFX "LZOR: ERD magic not found\n");
+ goto fail;
+ }
+ };
+ templen -= (u8 *)needle - tempbuf;
/* Past magic. Look for tag node */
- ret = routerboot_tag_find(tempbuf, templen, 0x1, _ofs, _len);
+ ret = routerboot_tag_find((u8 *)needle, templen, 0x1, _ofs,
_len);
if (ret) {
- pr_debug(RB_HC_PR_PFX "RLE data not found\n");
+ pr_debug(RB_HC_PR_PFX "LZOR: RLE data not found\n");
goto fail;
}
if (rle_len > templen) {
- pr_debug(RB_HC_PR_PFX "Invalid RLE data length\n");
+ pr_debug(RB_HC_PR_PFX "LZOR: Invalid RLE data length\n");
+ ret = -EINVAL;
goto fail;
}
- /* RLE-decode tempbuf back into the outbuf */
- ret = routerboot_rle_decode(tempbuf+rle_ofs, rle_len, outbuf, outlen);
+ /* RLE-decode tempbuf from needle back into the outbuf */
+ ret = routerboot_rle_decode((u8 *)needle+rle_ofs, rle_len, outbuf,
outlen);
if (ret)
- pr_debug(RB_HC_PR_PFX "RLE decoding error (%d)\n", ret);
+ pr_debug(RB_HC_PR_PFX "LZOR: RLE decoding error (%d)\n", ret);
fail:
[OpenWrt-Devel] [PATCH usign] Always pad fingerprints to 16 characters
Fingerprints were not padded with zeros. This led to an ucert failure
when the first byte of the fingerprint is 00, as it expects the
fingerprint to have a constant length (and this expectation seems
reasonable to me).
Signed-off-by: Matthias Schiffer
---
This issue was noticed as a spurious build failure in Gluon's CI - our
GHA CI generates a new build key for each build, and in 1 out of 256
builds, the fingerprint would start with a 0 byte and trigger the issue.
I'm also working on some ucert fixes (for example for the fact that it
was still working when only the first 4 bits of the fingerprint were 0,
as the trailing newline was considered as one of the expected 16
characters then.)
main.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/main.c b/main.c
index ef47b282a7cc..ebfdfb0809c4 100644
--- a/main.c
+++ b/main.c
@@ -149,7 +149,7 @@ static void write_file(const char *name, const uint8_t
*fingerprint,
if (comment)
fputs(comment, f);
else
- fprintf(f, "%s %"PRIx64, prefix,
+ fprintf(f, "%s %016"PRIx64, prefix,
fingerprint_u64(fingerprint));
fprintf(f, "\n%s\n", buf);
fclose(f);
@@ -177,7 +177,7 @@ static int verify(const char *msgfile)
}
if (!pubkeyfile) {
- snprintf(buf, sizeof(buf), "%s/%"PRIx64, pubkeydir,
+ snprintf(buf, sizeof(buf), "%s/%016"PRIx64, pubkeydir,
fingerprint_u64(sig.fingerprint));
pubkeyfile = buf;
}
@@ -276,7 +276,7 @@ static int fingerprint(void)
else
return 1;
- fprintf(stdout, "%"PRIx64"\n", fingerprint_u64(fp));
+ fprintf(stdout, "%016"PRIx64"\n", fingerprint_u64(fp));
return 0;
}
--
2.26.2
___
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel
Re: [OpenWrt-Devel] [PATCH] netifd: Improve handling of device rename
Hi, On Wed, Mar 11, 2020 at 2:13 PM Kristian Evensen wrote: > > After an interface has been renamed on a "fast" device (for example > x86_64), the interface is sometimes not handled correctly by netifd. > Looking in the logs, I see the following messages when renaming fails: > > Wed Mar 11 08:52:44 2020 kern.info kernel: [68383.522038] igb :03:00.0 > nlw_1: renamed from eth2 > Wed Mar 11 08:52:44 2020 daemon.err netifd[2739]: __device_add_user(710): Add > user for device 'nlw_1', refcount=2 > Wed Mar 11 08:52:44 2020 daemon.err netifd[2739]: device_claim(413): Claim > Network device nlw_1, new active count: 2 > Wed Mar 11 08:52:44 2020 daemon.err netifd[2739]: device_claim(432): claim > Network device nlw_1 failed: -1 > > Instrumenting netifd further reveals that there is a race between the hotplug > "@move" event and ioctl(SIOCGIFINDEX). When the above error happens, the > ioctl-call fails with ENODEV. Looking closer at the kernel code, it seems the > hotplug-event is triggered before the renaming is completed. The easiest way > to > trigger the race, is if an interface name with the old name is not handled by > netifd and an interface with the new name is. If only the old name is handled, > or both names, I was not able to provoke the race. > > When the renaming is complete, a NEWLINK-message is generated. This patch > modifies the logic surrounding renaming, so that we wait for the > NEWLINK-message before marking an interface as present. The changes made are: > > * We only handle move-events for interfaces we know, and we return after > device has been set as not present. > * When we receive a NEWLINK message for an interface managed by netifd, > we call device_set_present. device_set_present is guarded by the same > checks as the add hotplug-event. > > After these changes, renaming works properly on both "fast" and "slow" > devices. Removing a device is also handled correctly. > > Signed-off-by: Kristian Evensen I was wondering if anyone has had time to look at this patch and have any opinions? I've been running the change in production since the change was submitted, and all my renaming issues have been resolved (and no new ones have appeared :)). BR, Kristian ___ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/mailman/listinfo/openwrt-devel
[OpenWrt-Devel] Is 18.06 packages buildbot intentionally offline?
Apparently the openwrt-18.06 packages buildbot has been offline three weeks, since 22 April 2020: http://buildbot.openwrt.org/openwrt-18.06/packages/one_line_per_build Is that intentional? There has been some talk about 18.06.3 (http://lists.infradead.org/pipermail/openwrt-devel/2020-May/023226.html ), so it seems strange that the packages buildbt would be intentionally offline for several weeks. Looks like the two buildslaves from truecz were switched off at Wed Apr 22 11:57:32 2020 and removed from the buildbot config, and the third defined buildslave from nomosphere has never(?) done a build. ___ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/mailman/listinfo/openwrt-devel
Re: [OpenWrt-Devel] [PATCH 2/2] build: compress kernel debuginfo using zstd
On 5/16/20 3:38 AM, Paul Spooren wrote: > Could we use that for the SDK/ImageBuilder as well? > > Best, > Paul Sure, have some benchmark results with the current ath79 snapshot IB: * openwrt-imagebuilder-ath79-generic.Linux-x86_64.tar: 515M * xz -7e (current implementation): 96M, ~100s * zstd -3 (default setting): 248M, ~1s * zstd -19: 112M, ~73s * zstd --ultra -20: 93M, ~97s * zstd --ultra -22: 78M, ~136s So it seems at --ultra -20 we have a sweet spot where we surpass xz -7e in both compression ratio and speed. --ultra just unlocks the highest compression levels >19, at the cost of addional memory use for both compression and decompression. All of the above measurements were made without multithreading. The multithreaded mode of xz (as used in OpenWrt master) makes compression worse, while zstd produces an idential file with and without multithreading: * xz -7e -T32: 113M, ~17s * zstd -19 -T32: 112M: ~12s * zstd --ultra -20 -T32: 93M, ~30s IMO the fact that xz compresses differently depending on the number of threads used is also a big problem, as it makes it harder to make builds fully reproducible. If we switch to zstd for SDK/IB, I would go for level -19: it's significantly faster than --ultra -20, especially in multithreaded mode, and the size difference seems acceptable to me (in fact, our current snapshot builds use xz in multithreaded mode, so the current IB tar.xz on the download server is 113M, not 96M. Matthias signature.asc Description: OpenPGP digital signature ___ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/mailman/listinfo/openwrt-devel
Re: [OpenWrt-Devel] Quectel RM500Q failing to get ip address assignment with netifd and modemmanager
Hey! > > > > root@localhost:~# mmcli -b 2 > > > > > > > > General| dbus path: > > > > /org/freedesktop/ModemManager1/Bearer/2 > > > > | type: default > > > > > > > > Status | connected: yes > > > > | suspended: no > > > > | interface: wwan0 > > > > | ip timeout: 20 > > > > > > > > Properties |roaming: allowed > > > > > > > > IPv4 configuration | method: dhcp > > > > > > This is the issue here. It shouldn't say DHCP, it should say > > > "static", because the WWAN network interface of all the new 5G > > > modules are always in raw-ip instead of 802.3, and therefore MM > > > should fallback to request static IP addressing instead of DHCP. > > > > > > Please try to backport the following fix: > > > https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/commit/a8fd33ebaa80a0844c375fdb39173736d18f71cb > > > > > > I really haven't spent much time backporting 5G related fixes to the > > > 1.12 branch, because they will all be released together in 1.14 > > > soon. > > > > > > > I found it easier to switch my own setup to use the libqmi master > > branch and modemmanager from the commit you mentioned. It works just > > fine so far, wwan0 gets the correct address and the modem can ping > > fine now. > > > > I attached the makefiles and patches I used for my openwrt build if > > anyone needs them. In order to build the master branch, I also needed > > to add > > > > https://github.com/autoconf-archive/autoconf-archive > > > > as a build dependency. > > > > > > I have another quick question about modemmanager support for the > Quectel RM500Q. The commit a8fd33ebaa80a0844c375fdb39173736d18f71cb on > the modemmanager git isn't in the current release. Will it be slated > for the next release, and if so is there a rough time estimate as to > when that will be? > If enough testing gets done with git master in the following weeks, we can probably have a new stable 1.14 release at the beginning of June or so. Please test with git master as much as you can! -- Aleksander https://aleksander.es ___ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/mailman/listinfo/openwrt-devel
[OpenWrt-Devel] Upgraded to 19.07.2 and my file shares disappeared
Hello, I feel that this really needs to be added to either the Samba setup documentation and/or the storage documentation: *Enable also anon_mount in your /etc/config/fstab* submitted by* hnyman* at https://forum.openwrt.org/t/mounting-usb-block-info-block-detect-not-able-to-see-exfat-solved/1244/10 After upgrading and reinstalling the necessary packages to get my USB connected SSD drive recognized my data was no where to be found. gdisk reported a missing gpt header which it fixed (q - without saving any changes in a panic) And in Lede under mount points a weirdly sized partition was reported with no used space at all (my panic greatly increased) I had not made a back-up of my partition table, something I have taken care of now. As I morosely read the man-page for gdisk and how to repair a partition and tried a few things without saving the changes, nothing continued to be found. I stumbled across the above change to fstab in bold. I crossed my fingers, made the change, saved and rebooted *Everything is back,* nothing missing and nothing corrupted. I realize that my problem is probably self-caused in how I setup my samba shares in the first place. In my defense all I did was follow the instructions in the OpenWRT documentation pages regarding: USB storage and Samba fileshares. Sincerely, David B. ___ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/mailman/listinfo/openwrt-devel
