Commit Graph

59 Commits

Author SHA1 Message Date
Peter Marko c393973c85 squid: Upgrade to 6.10
Solves CVE-2024-37894

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2024-08-04 19:42:34 -07:00
Khem Raj ffc64e9c6f recipes: Start WORKDIR -> UNPACKDIR transition
Replace references of WORKDIR with UNPACKDIR where it makes sense to do
so in preparation for changing the default value of UNPACKDIR.

Signed-off-by: Khem Raj <raj.khem@gmail.com>
2024-05-23 08:44:44 -07:00
Yoann Congal 1429a784c7 squid: workaround a build failure with native gcc10
When build on Debian 11 (gcc10), squid fails to build[0] because of a
bug[1] in the configure step (it mixes options between old native compiler
and recent target compiler: the former needs the std=c++17 option, the latter
doesn't).

The workaround is to force the "-std=c++17" option for the native build.

NB: Our Buildroot friends have the same workaround[2].

[0]: https://autobuilder.yoctoproject.org/typhoon/#/builders/155/builds/23/steps/28/logs/stdio
[1]: https://bugs.squid-cache.org/show_bug.cgi?id=5376
     Bug closed as invalid by upstream
[2]: https://github.com/buildroot/buildroot/blob/932b52fad87d79d9f26a343edafe2981079de16e/package/squid/squid.mk#L24

Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Reviewed-by: Alexandre Truong <alexandre.truong@smile.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2024-05-19 08:28:01 -07:00
Wang Mingyu 8c1aa2b8ae squid: upgrade 6.8 -> 6.9
Changelog:
==========
- Regression Bug 5349: basic_nis_auth build error: unterminated #ifndef
- Bug 5069: Keep listening after getsockname() error
- Bug 5360: FwdState::noteDestinationsEnd() assertion "err"
- Reduce stale errno usage
- Plug memory leak in handling cache manager requests
- Fix error: template-id not allowed for constructor in C++20
- Improve release packaging automation

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2024-04-17 23:47:28 -07:00
Khem Raj dafd02adc5 squid: Upgrade to 6.8
Drop a patch which was needed for older gcc

Signed-off-by: Khem Raj <raj.khem@gmail.com>
2024-03-08 10:07:26 -08:00
Khem Raj 2b416eb0d6 squid: Add missing bash dependency for ptest package
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2024-02-26 08:13:21 -08:00
Wang Mingyu a178f67d97 squid: upgrade 6.6 -> 6.7
Changelog:
===========
- Bug 5337: workaround for crash on startup if -a option is used
- Bug 5274: Successful tunnels logged as TCP_TUNNEL/500
- Fix crash when NTLM and Negotiate helpers are queried with no HTTP request
- Fix SslBump memory leak when mimicking certificates with Authority Key Identifier
- Fix memory leak on SslBump certificates with Authority Key Identifier extension
- Fix a possible integer overflow in FTP Gateway
- Extend cache_log_message to Bug 5187 and job invalidation BUGs
- Remove incorrect beta version warning
- MS Windows portability improvements and some documentation improvements

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2024-02-09 09:52:09 -08:00
Wang Mingyu 0fae40f44c squid: upgrade 6.5 -> 6.6
Changelog:
===========
- Bug 5328: Fix ESI build with libxml2 v2.12.0
- Bug 5319: QOS Netfilter MARK preservation is always disabled
- Bug 5318: peer_digest.cc:399: "fetch->pd && receivedData.data"
- Bug 5317: FATAL attempt to read data from memory
- Bug 5154: Do not open IPv6 sockets when IPv6 is disabled
- FTP: Ignore credentials with a NUL-prefixed username
- log_db_daemon: Fix DSN construction
- Limit the number of allowed X-Forwarded-For hops
- Do not update StoreEntry expiration after errorAppendEntry()
- improve handling of response sending errors

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2024-01-02 00:35:51 -08:00
Patrick Wicki 501e5aa4b5 squid: add systemd service
Integrate the upstream unit file into the recipe.

Signed-off-by: Patrick Wicki <patrick.wicki@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2023-11-29 22:25:05 -08:00
Patrick Wicki a7275d4c1e squid: add url-rewrite-helpers packageconfig
Signed-off-by: Patrick Wicki <patrick.wicki@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2023-11-29 22:25:05 -08:00
Patrick Wicki 10ac056fc0 squid: move configs to sub package
Move the config files to a separate squid-conf package. This allows
shipping new configs via a custom conf package.

Signed-off-by: Patrick Wicki <patrick.wicki@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2023-11-29 22:25:05 -08:00
Patrick Wicki fa560acfdb squid: add auth packageconfig
Introduce PACKAGECONFIG[auth] and pin the dependencies to it. This
allows building squid without authentication support and all its related
dependencies.

Signed-off-by: Patrick Wicki <patrick.wicki@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2023-11-29 22:25:05 -08:00
Patrick Wicki a5f13e6231 squid: add nm dispatcher reload hook
This enables the networkmanager dispatcher to reload squid automatically
on network changes. This idea is from the Fedora package where they do
the same:
https://src.fedoraproject.org/rpms/squid/blob/rawhide/f/squid.spec#_207

Signed-off-by: Patrick Wicki <patrick.wicki@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2023-11-29 22:25:05 -08:00
Patrick Wicki f497274945 squid: update from v5.7 to v6.5
Refresh patches and clean up ones that are no longer needed:

* dlopen test was removed in b65d2165c5c250242764ed7cdac4540fba813dec
* libxml2 variables were removed in
  866a092dad01e58986a6e9ecb84ac89037a63e9a
* squid-conf-tests no longer run at build time since
  cd3dc147bf8abc0225237ced865c6660fffcb63a

Fix squid-conf-tests to allow running on target device.

License change: Update year

The version update eliminates the following CVEs:

* CVE-2023-5824  (affected: <6.4)
* CVE-2023-46724 (affected: >=3.3.0.1, <6.4)
* CVE-2023-46728 (affected: <6.0.1)
* CVE-2023-46846 (affected: >=2.6, <6.4)
* CVE-2023-46847 (affected: >=3.2.0.1, <6.4)
* CVE-2023-46848 (affected: >=5.0.3, <6.4)

Signed-off-by: Patrick Wicki <patrick.wicki@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2023-11-29 22:25:04 -08:00
Martin Jansa be8c765c7c *.patch: add Upstream-Status to all patches
There is new patch-status QA check in oe-core:
https://git.openembedded.org/openembedded-core/commit/?id=76a685bfcf927593eac67157762a53259089ea8a

This is temporary work around just to hide _many_ warnings from
optional patch-status (if you add it to WARN_QA).

This just added
Upstream-Status: Pending
everywhere without actually investigating what's the proper status.

This is just to hide current QA warnings and to catch new .patch files being
added without Upstream-Status, but the number of Pending patches is now terrible:

5 (26%) 	meta-xfce
6 (50%) 	meta-perl
15 (42%)        meta-webserver
21 (36%)        meta-gnome
25 (57%)        meta-filesystems
26 (43%)        meta-initramfs
45 (45%)        meta-python
47 (55%)        meta-multimedia
312 (63%)       meta-networking
756 (61%)       meta-oe

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2023-06-21 09:15:20 -07:00
Khem Raj 35bef1eae0 squid: Remove buildpaths from generated binaries
Compiler invocation and flags are added to SQUID_CONFIGURE_OPTIONS which
is added via generated autoconf.h during configure step. Since OE
encodes sysroot and buildpaths for cross compile, they end up in squid
binary, this patch removes from workdir from them so avoid encoding
build workspace path

Signed-off-by: Khem Raj <raj.khem@gmail.com>
2023-05-14 15:28:06 -07:00
Andrej Kozemcak 1dc95cae90 squid: upgrade 4.15 -> 5.7
- drop included patches
- refresh remaining patches
- update to new ptest

Licence change: update year

Signed-off-by: Andrej Kozemcak <andrej.kozemcak@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-09-22 16:45:05 -07:00
Khem Raj 7d8a0e840d recipes: Update LICENSE variable to use SPDX license identifiers
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-03-04 17:41:45 -08:00
Martin Jansa c61dc077bb Convert to new override syntax
This is the result of automated script (0.9.1) conversion:

oe-core/scripts/contrib/convert-overrides.py .

converting the metadata to use ":" as the override character instead of "_".

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2021-08-03 10:21:25 -07:00
Andrej Kozemcak 77e6147545 squid: upgrade 4.14 -> 4.15
Changes are found at: http://www.squid-cache.org/Versions/v4/changesets

Signed-off-by: Andrej Kozemcak <andrej.kozemcak@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2021-05-21 06:47:58 -07:00
Khem Raj c481ee79a2 squid: Include <limits> for using std::numeric_limits
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2021-03-03 11:08:29 -08:00
Andrej Valek c449e8a8b7 squid: upgrade 4.12 -> 4.13
Changes are found at: http://www.squid-cache.org/Versions/v4/changesets

Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-08-25 11:24:58 -07:00
Andreas Müller 63a4a54500 squid: upgrade 4.9 -> 4.12
License checksum was changed by change of copyright year

Changes are found at [1-3]

[1] http://www.squid-cache.org/Versions/v4/changesets/SQUID_4_12.html
[2] http://www.squid-cache.org/Versions/v4/changesets/SQUID_4_11.html
[3] http://www.squid-cache.org/Versions/v4/changesets/SQUID_4_10.html

Signed-off-by: Andreas Müller <schnitzeltony@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-06-19 12:42:55 -07:00
Khem Raj 626209aabb squid: Link with libatomic on riscv
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-01-28 13:55:35 -08:00
Martin Balik 4ac3c692f8 squid: upgrade 4.6 -> 4.9
Signed-off-by: Martin Balik <martin.balik@siemens.com>
Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-11-15 17:59:35 -08:00
Khem Raj 29e17f9c0a squid: Link with libatomic on mips/ppc
The atomics are not supported as builtins on these arches

Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-04-27 10:13:07 -07:00
Andrej Valek d219ba7a28 squid: upgrade squid 3.5.28 -> 4.6
- refresh and remove obsolete patches
 - add openssl and esi as package options
 - add missing header for std::bind implementation

Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-04-09 21:31:36 -07:00
Pascal Bach b42de097dd squid: upgrade 3.5.27 -> 3.5.28
Copyright year has changed in COPYRIGHTS file, thus the hash change.

Signed-off-by: Pascal Bach <pascal.bach@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-03-11 21:15:46 -07:00
Khem Raj 3ef9acf484 squid: Fix build with gcc8
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2018-06-24 23:04:04 -07:00
Khem Raj 309963b2f1 squid: Upgrade to 3.5.27
Drop upstreamed/backported patches

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-05-17 08:32:26 -07:00
Armin Kuster 68c8fe1aba squid: refresh patches
ARNING:
Some of the context lines in patches were ignored. This can lead to incorrectly applied patches.
The context lines in the patches can be updated with devtool:

    devtool modify <recipe>
    devtool finish --force-patch-refresh <recipe> <layer_path>

Then the updated patches and the source tree (in devtool's workspace)
should be reviewed to make sure the patches apply in the correct place
and don't introduce duplicate lines (which can, and does happen
when some of the context is ignored). Further information:
http://lists.openembedded.org/pipermail/openembedded-core/2018-March/148675.html
https://bugzilla.yoctoproject.org/show_bug.cgi?id=10450
Details:
checking file configure.ac
Hunk #1 succeeded at 27 with fuzz 1 (offset 8 lines).

and others

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-04-13 12:43:40 -07:00
Khem Raj 2179687c99 squid: Fix QA errors about wrong perl interpreter
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2017-09-12 10:55:05 -04:00
Khem Raj 112d30cc6a squid: Disable format-truncation warning only with gcc
Clang does not support this option

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2017-09-12 10:55:05 -04:00
Khem Raj e04ca3cc55 squid: Add missing dependencies on openssl expat and libxml2
inherit classes needed for pkgconfig and perl
NIS is not buildable with gold linker, disable it

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2017-09-12 10:37:18 -04:00
Khem Raj 841bb94ce8 squid: Fix build with hardening
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2017-06-28 10:29:39 -04:00
Khem Raj 325e3ebf42 squid: Upgrade to 3.5.26
Fix build errors with gcc7 along the way

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2017-06-28 10:29:16 -04:00
Khem Raj 52db0e6c05 squid: Upgrade to 3.5.25
Add patch to fix throw() errors with gcc7
Update copyright year to 2017

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2017-04-25 16:10:55 -04:00
Khem Raj d9dc6b2d4c squid: Update to 3.5.23
Disable NIS on musl, it doesnt yet build

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2017-04-25 15:55:35 -04:00
Oleksandr Kravchuk 4b4a62ec07 recipes: delete obsolete patches
Deleted bunch of patches which are not used anymore by any recipe.

Signed-off-by: Oleksandr Kravchuk <oleksandr.kravchuk@pelagicore.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2017-03-16 23:34:32 +01:00
Peter Kjellerstedt 0c31f55bcf Make use of the new bb.utils.filter() function
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2017-03-07 13:30:26 +01:00
Jackie Huang 12764d1cba squid: disable gnu atomic operations for mipsel
Disable GNU atomic operations for mipsel since it's
not supported.

Refer to https://gcc.gnu.org/bugzilla/show_bug.cgi?id=56300:

  There is no hardware support for 8 bytes atomic operations on
  32-bit MIPS targets.

Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-12-14 09:20:08 -05:00
Yi Zhao 9e8d127a80 squid: fix ptest failure
Fix error when run ptest on target:
cp: cannot stat '/usr/bin/true': No such file or directory
make: *** [Makefile:1120: squid-conf-tests] Error 1

The correct path should be /bin/true on target.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-10-20 11:16:53 -04:00
Yi Zhao 6f54f29b70 squid: specify sysconfdir and logdir
The default sysconfdir is /etc and logdir is /var/logs. Set sysconfdir
and logdir when configure, replace them with /etc/squid and
/var/log/squid.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-10-20 11:16:49 -04:00
Jackie Huang 3143193223 squid: don't do squid-conf-tests at build time
* squid-conf-tests is a test to run "squid -k parse -f"
  to perse the config files, which should not be run
  at build time since we are cross compiling, so remove
  it when compiling test-suite

* Fix the directories of the conf files for squid-conf-tests
  so that it can run on the target and add it for ptest

Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-09-05 13:34:12 -04:00
Jackie Huang 020db7d8c4 squid: control ipv6 support based on DISTRO_FEATURES
Add PACKAGECONFIG for ipv6 and control it based
on DISTRO_FEATURES.

Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-09-05 13:34:12 -04:00
Yi Zhao c7e8da3819 squid: add missing patch header
Add upstream-status and signed-off-by line to the patch to obey the
recommendations:
http://openembedded.org/wiki/Commit_Patch_Message_Guidelines#Patch_Header_Recommendations

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-09-05 13:34:11 -04:00
Martin Jansa 289217bbc3 meta-oe: fix indentation
* remove tabs which sneaked in since last cleanup
* meta-oe layers are using consistent indentation with 4 spaces, see
  http://www.openembedded.org/wiki/Styleguide

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2016-08-22 15:56:28 +02:00
Yue Tao 4307c6a746 squid: fix configure host contamination
When configuring squid with --enable-esi option,
the following error was observed:
[snip]
checking libxml/parser.h usability... no
checking libxml/parser.h presence... no
checking for libxml/parser.h... no
configure: Failed to find libxml2 header file libxml/parser.h
[snip]
ERROR: This autoconf log indicates errors, it looked at host include
and/or library paths while determining system capabilities.
[snip]

It tried to search libxml header file in host path. Set the SYSROOT
to avoid this host contamination.

Signed-off-by: Yue Tao <yue.tao@windriver.com>
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-08-16 21:26:10 -04:00
Jackie Huang 03b76ca4b0 squid: upgrade to 3.5.20
* Remove the blacklist since the issue is gone with new version
* Remove two CVE patches which have been fixed:
  - CVE-2016-3947 and CVE-2016-4553
* Rebased the patch for ptest.

Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-08-05 09:06:50 -04:00
Catalin Enache d46c89ae44 squid: CVE-2016-4553
client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10
does not properly ignore the Host header when absolute-URI
is provided, which allows remote attackers to conduct
cache-poisoning attacks via an HTTP request.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4553

Backported upstream patch:
http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-14039.patch

Signed-off-by: Catalin Enache <catalin.enache@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-06-01 19:35:50 -04:00