You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

243 lines
7.7 KiB

mosquitto: bump to 1.5.6 This is a bugfix and security release. CVE-2018-12551: If Mosquitto is configured to use a password file for authentication, any malformed data in the password file will be treated as valid. This typically means that the malformed data becomes a username and no password. If this occurs, clients can circumvent authentication and get access to the broker by using the malformed username. In particular, a blank line will be treated as a valid empty username. Other security measures are unaffected. => Users who have only used the mosquitto_passwd utility to create and modify their password files are unaffected by this vulnerability. CVE-2018-12550: If an ACL file is empty, or has only blank lines or comments, then mosquitto treats the ACL file as not being defined, which means that no topic access is denied. Although denying access to all topics is not a useful configuration, this behaviour is unexpected and could lead to access being incorrectly granted in some circumstances. CVE-2018-12546. If a client publishes a retained message to a topic that they have access to, and then their access to that topic is revoked, the retained message will still be delivered to future subscribers. This behaviour may be undesirable in some applications, so a configuration option `check_retain_source` has been introduced to enforce checking of the retained message source on publish. Plus the following bugfixes: * wills not sent to websocket clients * spaces now allowed in bridge usernames * durable clients not receiving offline messages with per_listener_settings==true * compilation with openssl without deprecated apis * TLS working over SOCKS * better comment handling in config files Full changelog available at: https://github.com/eclipse/mosquitto/blob/fixes/ChangeLog.txt#L1 Signed-off-by: Karl Palsson <karlp@etactica.com>
6 years ago
mosquitto: bump to 1.5.6 This is a bugfix and security release. CVE-2018-12551: If Mosquitto is configured to use a password file for authentication, any malformed data in the password file will be treated as valid. This typically means that the malformed data becomes a username and no password. If this occurs, clients can circumvent authentication and get access to the broker by using the malformed username. In particular, a blank line will be treated as a valid empty username. Other security measures are unaffected. => Users who have only used the mosquitto_passwd utility to create and modify their password files are unaffected by this vulnerability. CVE-2018-12550: If an ACL file is empty, or has only blank lines or comments, then mosquitto treats the ACL file as not being defined, which means that no topic access is denied. Although denying access to all topics is not a useful configuration, this behaviour is unexpected and could lead to access being incorrectly granted in some circumstances. CVE-2018-12546. If a client publishes a retained message to a topic that they have access to, and then their access to that topic is revoked, the retained message will still be delivered to future subscribers. This behaviour may be undesirable in some applications, so a configuration option `check_retain_source` has been introduced to enforce checking of the retained message source on publish. Plus the following bugfixes: * wills not sent to websocket clients * spaces now allowed in bridge usernames * durable clients not receiving offline messages with per_listener_settings==true * compilation with openssl without deprecated apis * TLS working over SOCKS * better comment handling in config files Full changelog available at: https://github.com/eclipse/mosquitto/blob/fixes/ChangeLog.txt#L1 Signed-off-by: Karl Palsson <karlp@etactica.com>
6 years ago
  1. #
  2. # Copyright (C) 2011-2013 OpenWrt.org
  3. # Copyright (C) 2010 Jo-Philipp Wich <xm@subsignal.org>
  4. #
  5. # This is free software, licensed under the GNU General Public License v2.
  6. # See /LICENSE for more information.
  7. #
  8. include $(TOPDIR)/rules.mk
  9. PKG_NAME:=mosquitto
  10. PKG_VERSION:=1.5.6
  11. PKG_RELEASE:=1
  12. PKG_LICENSE:=BSD-3-Clause
  13. PKG_LICENSE_FILES:=LICENSE.txt
  14. PKG_CPE_ID:=cpe:/a:eclipse:mosquitto
  15. PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
  16. PKG_SOURCE_URL:=https://mosquitto.org/files/source/
  17. PKG_HASH:=d5bdc13cc668350026376d57fc14de10aaee029f6840707677637d15e0751a40
  18. PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION)
  19. include $(INCLUDE_DIR)/package.mk
  20. define Package/mosquitto/default
  21. SECTION:=net
  22. CATEGORY:=Network
  23. TITLE:=mosquitto - an MQTT message broker
  24. URL:=http://www.mosquitto.org/
  25. MAINTAINER:=Karl Palsson <karlp@etactica.com>
  26. DEPENDS:= +librt +libuuid
  27. USERID:=mosquitto=200:mosquitto=200
  28. endef
  29. define Package/mosquitto-ssl
  30. $(call Package/mosquitto/default)
  31. TITLE+= (with SSL support)
  32. DEPENDS+= +libopenssl +MOSQUITTO_LWS:libwebsockets-openssl
  33. VARIANT:=ssl
  34. PROVIDES:=mosquitto
  35. endef
  36. define Package/mosquitto-nossl
  37. $(call Package/mosquitto/default)
  38. TITLE+= (without SSL support)
  39. VARIANT:=nossl
  40. PROVIDES:=mosquitto
  41. endef
  42. define Package/mosquitto-ssl/config
  43. source "$(SOURCE)/Config.in"
  44. endef
  45. define Package/mosquitto/default/description
  46. Mosquitto is an open source (BSD licensed) message broker that implements
  47. the MQTT protocol version 3.1 and 3.1.1. MQTT provides a lightweight
  48. method of carrying out messaging using a publish/subscribe model.
  49. This package also includes some basic support for configuring via UCI
  50. endef
  51. define Package/mosquitto-ssl/description
  52. $(call Package/mosquitto/default/description)
  53. This package is built with SSL support. TLS-PSK will be included (in both
  54. the client and broker) if OpenSSL is built with TLS-PSK support.
  55. endef
  56. define Package/mosquitto-nossl/description
  57. $(call Package/mosquitto/default/description)
  58. This package is built WITHOUT SSL support.
  59. endef
  60. define Package/mosquitto-client/default
  61. $(Package/mosquitto/default)
  62. TITLE:= mosquitto - client tools
  63. DEPENDS+=+libcares
  64. PROVIDES:=mosquitto-client
  65. endef
  66. define Package/mosquitto-client-ssl
  67. $(call Package/mosquitto-client/default)
  68. TITLE+= (With SSL support)
  69. DEPENDS+=+libmosquitto-ssl
  70. VARIANT:=ssl
  71. endef
  72. define Package/mosquitto-client-nossl
  73. $(call Package/mosquitto-client/default)
  74. TITLE+= (Without SSL support)
  75. DEPENDS+=+libmosquitto-nossl
  76. VARIANT:=nossl
  77. endef
  78. define Package/mosquitto-client/default/description
  79. Command line client tools for publishing messages to MQTT servers
  80. and subscribing to topics.
  81. endef
  82. define Package/mosquitto-client-ssl/description
  83. $(call Package/mosquitto-client/default/description)
  84. This package is built with SSL support
  85. endef
  86. define Package/mosquitto-client-nossl/description
  87. $(call Package/mosquitto-client/default/description)
  88. This package is built without SSL support
  89. endef
  90. define Package/libmosquitto/default
  91. $(Package/mosquitto/default)
  92. SECTION:=libs
  93. CATEGORY:=Libraries
  94. DEPENDS:=+libpthread +librt +libcares
  95. TITLE:= mosquitto - client library
  96. PROVIDES:=libmosquitto
  97. endef
  98. define Package/libmosquitto-ssl
  99. $(call Package/libmosquitto/default)
  100. TITLE+= (With SSL Support)
  101. DEPENDS+= +libopenssl
  102. VARIANT=ssl
  103. endef
  104. define Package/libmosquitto-nossl
  105. $(call Package/libmosquitto/default)
  106. TITLE+= (Without SSL Support)
  107. VARIANT=nossl
  108. endef
  109. define Package/libmosquitto/default/description
  110. Library required for mosquitto's command line client tools, also for
  111. use by any third party software that wants to communicate with a
  112. mosquitto server.
  113. Should be useable for communicating with any MQTT v3.1/3.1.1 compatible
  114. server, such as IBM's RSMB, in addition to Mosquitto
  115. endef
  116. define Package/libmosquitto-ssl/description
  117. $(call Package/libmosquitto/default/description)
  118. This package is built with SSL support
  119. endef
  120. define Package/libmosquitto-nossl/description
  121. $(call Package/libmosquitto/default/description)
  122. This package is built without SSL support
  123. endef
  124. define Package/libmosquittopp
  125. SECTION:=libs
  126. CATEGORY:=Libraries
  127. DEPENDS:=libmosquitto +libstdcpp
  128. TITLE:= mosquitto - client c++ library
  129. endef
  130. define Package/libmosquittopp/description
  131. C++ Library wrapper for libmosquitto.
  132. endef
  133. define Package/mosquitto-ssl/conffiles
  134. /etc/mosquitto/mosquitto.conf
  135. /etc/config/mosquitto
  136. endef
  137. Package/mosquitto-nossl/conffiles = $(Package/mosquitto-ssl/conffiles)
  138. define Package/mosquitto/install/default
  139. $(INSTALL_DIR) $(1)/usr/sbin
  140. $(INSTALL_BIN) $(PKG_BUILD_DIR)/src/mosquitto $(1)/usr/sbin/mosquitto
  141. $(INSTALL_DIR) $(1)/etc/mosquitto
  142. $(INSTALL_CONF) $(PKG_BUILD_DIR)/mosquitto.conf $(1)/etc/mosquitto/mosquitto.conf
  143. $(CP) ./files/* $(1)/
  144. endef
  145. define Package/mosquitto-nossl/install
  146. $(call Package/mosquitto/install/default,$(1))
  147. endef
  148. define Package/mosquitto-ssl/install
  149. $(call Package/mosquitto/install/default,$(1))
  150. ifeq ($(CONFIG_MOSQUITTO_PASSWD),y)
  151. $(INSTALL_DIR) $(1)/usr/bin
  152. $(INSTALL_BIN) $(PKG_BUILD_DIR)/src/mosquitto_passwd $(1)/usr/bin
  153. endif
  154. endef
  155. define Package/mosquitto-client-ssl/install
  156. $(INSTALL_DIR) $(1)/usr/bin
  157. $(INSTALL_BIN) $(PKG_BUILD_DIR)/client/mosquitto_pub $(1)/usr/bin/mosquitto_pub
  158. $(INSTALL_BIN) $(PKG_BUILD_DIR)/client/mosquitto_sub $(1)/usr/bin/mosquitto_sub
  159. endef
  160. Package/mosquitto-client-nossl/install = $(Package/mosquitto-client-ssl/install)
  161. # This installs files into ./staging_dir/. so that you can cross compile from the host
  162. define Build/InstallDev
  163. $(INSTALL_DIR) $(1)/usr/include
  164. $(CP) $(PKG_BUILD_DIR)/lib/mosquitto.h $(1)/usr/include
  165. $(CP) $(PKG_BUILD_DIR)/lib/cpp/mosquittopp.h $(1)/usr/include
  166. $(CP) $(PKG_BUILD_DIR)/src/mosquitto_plugin.h $(1)/usr/include
  167. $(CP) $(PKG_BUILD_DIR)/src/mosquitto_broker.h $(1)/usr/include
  168. $(INSTALL_DIR) $(1)/usr/lib
  169. $(CP) $(PKG_BUILD_DIR)/lib/libmosquitto.so.1 $(1)/usr/lib/
  170. $(CP) $(PKG_BUILD_DIR)/lib/cpp/libmosquittopp.so.1 $(1)/usr/lib/
  171. $(LN) libmosquitto.so.1 $(1)/usr/lib/libmosquitto.so
  172. $(LN) libmosquittopp.so.1 $(1)/usr/lib/libmosquittopp.so
  173. $(INSTALL_DIR) $(1)/usr/lib/pkgconfig
  174. $(CP) $(PKG_BUILD_DIR)/libmosquitto.pc.in $(1)/usr/lib/pkgconfig/libmosquitto.pc
  175. sed -i -e "s#@CMAKE_INSTALL_PREFIX@#/usr#" \
  176. -e "s#@VERSION@#$(PKG_VERSION)#" \
  177. $(1)/usr/lib/pkgconfig/libmosquitto.pc
  178. $(CP) $(PKG_BUILD_DIR)/libmosquittopp.pc.in $(1)/usr/lib/pkgconfig/libmosquittopp.pc
  179. sed -i -e "s#@CMAKE_INSTALL_PREFIX@#/usr#" \
  180. -e "s#@VERSION@#$(PKG_VERSION)#" \
  181. $(1)/usr/lib/pkgconfig/libmosquittopp.pc
  182. endef
  183. # This installs files on the target. Compare with Build/InstallDev
  184. define Package/libmosquitto-ssl/install
  185. $(INSTALL_DIR) $(1)/usr/lib
  186. $(INSTALL_BIN) $(PKG_BUILD_DIR)/lib/libmosquitto.so.1 $(1)/usr/lib/
  187. $(LN) libmosquitto.so.1 $(1)/usr/lib/libmosquitto.so
  188. endef
  189. Package/libmosquitto-nossl/install = $(Package/libmosquitto-ssl/install)
  190. define Package/libmosquittopp/install
  191. $(INSTALL_DIR) $(1)/usr/lib
  192. $(INSTALL_BIN) $(PKG_BUILD_DIR)/lib/cpp/libmosquittopp.so.1 $(1)/usr/lib/
  193. $(LN) libmosquittopp.so.1 $(1)/usr/lib/libmosquittopp.so
  194. endef
  195. # Applies to all...
  196. MAKE_FLAGS += WITH_DOCS=no UNAME=Linux
  197. ifeq ($(BUILD_VARIANT),nossl)
  198. MAKE_FLAGS += WITH_TLS=no WITH_WEBSOCKETS=no
  199. else
  200. MAKE_FLAGS += WITH_WEBSOCKETS=$(if $(CONFIG_MOSQUITTO_LWS),"yes","no")
  201. MAKE_FLAGS += WITH_TLS_PSK=$(if $(CONFIG_OPENSSL_WITH_PSK),"yes","no")
  202. endif
  203. $(eval $(call BuildPackage,mosquitto-ssl))
  204. $(eval $(call BuildPackage,mosquitto-nossl))
  205. $(eval $(call BuildPackage,libmosquitto-ssl))
  206. $(eval $(call BuildPackage,libmosquitto-nossl))
  207. $(eval $(call BuildPackage,libmosquittopp))
  208. $(eval $(call BuildPackage,mosquitto-client-ssl))
  209. $(eval $(call BuildPackage,mosquitto-client-nossl))