From: Fabrice Fontaine Date: Sun, 22 Dec 2019 10:29:08 +0000 (+0100) Subject: package/openocd: selects jimtcl X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=06aa2995350922197c6db0a46e39ac5c37d5a49e;p=buildroot.git package/openocd: selects jimtcl Selects jimtcl instead of using the bundled one and drop first patch as it is not needed anymore Signed-off-by: Fabrice Fontaine Signed-off-by: Yann E. MORIN --- diff --git a/package/openocd/0001-Fix-jimtcl-auto-configuration-to-force-static-librar.patch b/package/openocd/0001-Fix-jimtcl-auto-configuration-to-force-static-librar.patch deleted file mode 100644 index fd3cfa469a..0000000000 --- a/package/openocd/0001-Fix-jimtcl-auto-configuration-to-force-static-librar.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 3bef159779c8fd39a070ec5c8191e18ba2efa79d Mon Sep 17 00:00:00 2001 -From: Claudio Laurita -Date: Sun, 30 Nov 2014 18:21:58 +0100 -Subject: [PATCH 2/2] Fix jimtcl auto configuration to force static library - only. jimtcl ignores a --disable-shared option if a previous --enable-shared - option was given. This breaks openocd compilation if shared was the preferred - option in buildroot project. - -Signed-off-by: Claudio Laurita - ---- a/jimtcl/auto.def -+++ b/jimtcl/auto.def -@@ -194,12 +194,8 @@ - msg-result "Enabling references" - define JIM_REFERENCES - } --if {[opt-bool shared with-jim-shared]} { -- msg-result "Building shared library" --} else { -- msg-result "Building static library" -- define JIM_STATICLIB --} -+msg-result "Building static library" -+define JIM_STATICLIB - define LIBSOEXT [format [get-define SH_SOEXTVER] [format %.2f [expr {[get-define JIM_VERSION] / 100.0}]]] - define JIM_INSTALL [opt-bool install-jim] - define JIM_DOCS [opt-bool docs] diff --git a/package/openocd/0001-configure-enable-build-on-uclinux.patch b/package/openocd/0001-configure-enable-build-on-uclinux.patch new file mode 100644 index 0000000000..2f2d320840 --- /dev/null +++ b/package/openocd/0001-configure-enable-build-on-uclinux.patch @@ -0,0 +1,26 @@ +From 11ea78c4d253bb90296e2dd8c3f7fbf59ba397b6 Mon Sep 17 00:00:00 2001 +From: Bernd Kuhls +Date: Thu, 17 Aug 2017 06:30:31 +0200 +Subject: [PATCH] configure: enable build on uclinux + +Signed-off-by: Bernd Kuhls +--- + configure.ac | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/configure.ac b/configure.ac +index c680bda7..1a7980a0 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -327,7 +327,7 @@ AC_ARG_ENABLE([sysfsgpio], + [build_sysfsgpio=$enableval], [build_sysfsgpio=no]) + + AS_CASE([$host_os], +- [linux*], [], ++ [linux*|uclinux*], [], + [ + AS_IF([test "x$build_sysfsgpio" = "xyes"], [ + AC_MSG_ERROR([sysfsgpio is only available on linux]) +-- +2.11.0 + diff --git a/package/openocd/0002-CVE-2018-5704-Prevent-some-forms-of-Cross-Protocol-S.patch b/package/openocd/0002-CVE-2018-5704-Prevent-some-forms-of-Cross-Protocol-S.patch new file mode 100644 index 0000000000..ba19bf5735 --- /dev/null +++ b/package/openocd/0002-CVE-2018-5704-Prevent-some-forms-of-Cross-Protocol-S.patch @@ -0,0 +1,50 @@ +From 3a223ca3ebc7ac24d7726a0cd58e5695bc813657 Mon Sep 17 00:00:00 2001 +From: Andreas Fritiofson +Date: Sat, 13 Jan 2018 21:00:47 +0100 +Subject: [PATCH] CVE-2018-5704: Prevent some forms of Cross Protocol Scripting + attacks + +OpenOCD can be targeted by a Cross Protocol Scripting attack from +a web browser running malicious code, such as the following PoC: + +var x = new XMLHttpRequest(); +x.open("POST", "http://127.0.0.1:4444", true); +x.send("exec xcalc\r\n"); + +This mitigation should provide some protection from browser-based +attacks and is based on the corresponding fix in Redis: + +https://github.com/antirez/redis/blob/8075572207b5aebb1385c4f233f5302544439325/src/networking.c#L1758 + + +Upstream-status: Under review: http://openocd.zylin.com/#/c/4335/ +Change-Id: Ia96ebe19b74b5805dc228bf7364c7971a90a4581 +Signed-off-by: Andreas Fritiofson +Reported-by: Josef Gajdusek +Signed-off-by: Peter Korsgaard +--- + src/server/startup.tcl | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/src/server/startup.tcl b/src/server/startup.tcl +index 64ace407..dd1b31e4 100644 +--- a/src/server/startup.tcl ++++ b/src/server/startup.tcl +@@ -8,3 +8,14 @@ proc ocd_gdb_restart {target_id} { + # one target + reset halt + } ++ ++proc prevent_cps {} { ++ echo "Possible SECURITY ATTACK detected." ++ echo "It looks like somebody is sending POST or Host: commands to OpenOCD." ++ echo "This is likely due to an attacker attempting to use Cross Protocol Scripting" ++ echo "to compromise your OpenOCD instance. Connection aborted." ++ exit ++} ++ ++proc POST {args} { prevent_cps } ++proc Host: {args} { prevent_cps } +-- +2.11.0 + diff --git a/package/openocd/0002-configure-enable-build-on-uclinux.patch b/package/openocd/0002-configure-enable-build-on-uclinux.patch deleted file mode 100644 index 2f2d320840..0000000000 --- a/package/openocd/0002-configure-enable-build-on-uclinux.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 11ea78c4d253bb90296e2dd8c3f7fbf59ba397b6 Mon Sep 17 00:00:00 2001 -From: Bernd Kuhls -Date: Thu, 17 Aug 2017 06:30:31 +0200 -Subject: [PATCH] configure: enable build on uclinux - -Signed-off-by: Bernd Kuhls ---- - configure.ac | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/configure.ac b/configure.ac -index c680bda7..1a7980a0 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -327,7 +327,7 @@ AC_ARG_ENABLE([sysfsgpio], - [build_sysfsgpio=$enableval], [build_sysfsgpio=no]) - - AS_CASE([$host_os], -- [linux*], [], -+ [linux*|uclinux*], [], - [ - AS_IF([test "x$build_sysfsgpio" = "xyes"], [ - AC_MSG_ERROR([sysfsgpio is only available on linux]) --- -2.11.0 - diff --git a/package/openocd/0003-CVE-2018-5704-Prevent-some-forms-of-Cross-Protocol-S.patch b/package/openocd/0003-CVE-2018-5704-Prevent-some-forms-of-Cross-Protocol-S.patch deleted file mode 100644 index ba19bf5735..0000000000 --- a/package/openocd/0003-CVE-2018-5704-Prevent-some-forms-of-Cross-Protocol-S.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 3a223ca3ebc7ac24d7726a0cd58e5695bc813657 Mon Sep 17 00:00:00 2001 -From: Andreas Fritiofson -Date: Sat, 13 Jan 2018 21:00:47 +0100 -Subject: [PATCH] CVE-2018-5704: Prevent some forms of Cross Protocol Scripting - attacks - -OpenOCD can be targeted by a Cross Protocol Scripting attack from -a web browser running malicious code, such as the following PoC: - -var x = new XMLHttpRequest(); -x.open("POST", "http://127.0.0.1:4444", true); -x.send("exec xcalc\r\n"); - -This mitigation should provide some protection from browser-based -attacks and is based on the corresponding fix in Redis: - -https://github.com/antirez/redis/blob/8075572207b5aebb1385c4f233f5302544439325/src/networking.c#L1758 - - -Upstream-status: Under review: http://openocd.zylin.com/#/c/4335/ -Change-Id: Ia96ebe19b74b5805dc228bf7364c7971a90a4581 -Signed-off-by: Andreas Fritiofson -Reported-by: Josef Gajdusek -Signed-off-by: Peter Korsgaard ---- - src/server/startup.tcl | 11 +++++++++++ - 1 file changed, 11 insertions(+) - -diff --git a/src/server/startup.tcl b/src/server/startup.tcl -index 64ace407..dd1b31e4 100644 ---- a/src/server/startup.tcl -+++ b/src/server/startup.tcl -@@ -8,3 +8,14 @@ proc ocd_gdb_restart {target_id} { - # one target - reset halt - } -+ -+proc prevent_cps {} { -+ echo "Possible SECURITY ATTACK detected." -+ echo "It looks like somebody is sending POST or Host: commands to OpenOCD." -+ echo "This is likely due to an attacker attempting to use Cross Protocol Scripting" -+ echo "to compromise your OpenOCD instance. Connection aborted." -+ exit -+} -+ -+proc POST {args} { prevent_cps } -+proc Host: {args} { prevent_cps } --- -2.11.0 - diff --git a/package/openocd/Config.in b/package/openocd/Config.in index abba07e889..448872061b 100644 --- a/package/openocd/Config.in +++ b/package/openocd/Config.in @@ -1,5 +1,6 @@ config BR2_PACKAGE_OPENOCD bool "openocd" + select BR2_PACKAGE_JIMTCL help OpenOCD - Open On-Chip Debugger diff --git a/package/openocd/openocd.mk b/package/openocd/openocd.mk index d35ed77cd1..29e4f4b31f 100644 --- a/package/openocd/openocd.mk +++ b/package/openocd/openocd.mk @@ -11,18 +11,13 @@ OPENOCD_LICENSE = GPL-2.0+ OPENOCD_LICENSE_FILES = COPYING # 0002-configure-enable-build-on-uclinux.patch patches configure.ac OPENOCD_AUTORECONF = YES - -# The bundled jimtcl really wants to find a existing $CXX, so feed it -# false when we do not have one. -OPENOCD_CONF_ENV = \ - $(if $(BR2_INSTALL_LIBSTDCPP),,CXX=false) \ - CFLAGS="$(TARGET_CFLAGS) -std=gnu99" +OPENOCD_CONF_ENV = CFLAGS="$(TARGET_CFLAGS) -std=gnu99" OPENOCD_CONF_OPTS = \ --oldincludedir=$(STAGING_DIR)/usr/include \ --includedir=$(STAGING_DIR)/usr/include \ --disable-doxygen-html \ - --with-jim-shared=no \ + --disable-internal-jimtcl \ --disable-shared \ --enable-dummy \ --disable-werror @@ -32,6 +27,7 @@ OPENOCD_CONF_OPTS = \ OPENOCD_DEPENDENCIES = \ host-pkgconf \ + jimtcl \ $(if $(BR2_PACKAGE_LIBFTDI1),libftdi1) \ $(if $(BR2_PACKAGE_LIBUSB),libusb) \ $(if $(BR2_PACKAGE_LIBUSB_COMPAT),libusb-compat) \