mirrors/buildroot
0
0
Fork 0
mirror of https://git.busybox.net/buildroot.git synced 2025-01-10 06:23:38 +08:00
Code Issues Packages Projects Releases Wiki Activity
d5a7158e12
buildroot/package/squid/squid.mk

96 lines
2.5 KiB
Makefile
Raw Normal View History

Normalize separator size to 80 Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2013-06-06 07:53:30 +08:00
################################################################################
New package squid 3.0.STABLE21 Closes #513 Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2009-12-23 20:30:45 +08:00
#
# squid
#
Normalize separator size to 80 Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2013-06-06 07:53:30 +08:00
################################################################################
New package squid 3.0.STABLE21 Closes #513 Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2009-12-23 20:30:45 +08:00
package/squid: security bump to version 4.13 Fixes the following security issues: CVE-2020-15810: HTTP(S) Request Smuggling Due to incorrect data validation Squid is vulnerable to HTTP Request Smuggling attacks against HTTP and HTTPS traffic. This leads to cache poisoning. https://github.com/squid-cache/squid/security/advisories/GHSA-3365-q9qx-f98m CVE-2020-15811: HTTP(S) Request Splitting Due to incorrect data validation Squid is vulnerable to HTTP Request Splitting attacks against HTTP and HTTPS traffic. This leads to cache poisoning. https://github.com/squid-cache/squid/security/advisories/GHSA-c7p8-xqhm-49wv CVE-2020-24606: Denial of Service processing Cache Digest Response Due to Improper Input Validation Squid is vulnerable to a Denial of Service attack against the machine operating Squid. https://github.com/squid-cache/squid/security/advisories/GHSA-vvj7-xjgq-g2jg Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2020-08-29 17:51:19 +08:00
SQUID_VERSION = 4.13
squid: security bump to version 3.5.17 Fixes: SQUID-2016:5 (CVE-2016-4051) - Buffer overflow in cachemgr.cgi SQUID-2016:6 (CVE-2016-4052) - Multiple issues in ESI processing. CVE-2016-4053 & CVE-2016-4054 which are part of SQUID-2016:6. Switch to xz-compressed tarball as well. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2016-04-21 02:38:10 +08:00
SQUID_SOURCE = squid-$(SQUID_VERSION).tar.xz
package/squid: bump version to 4.2 Added dependency for libxml2: http://www.squid-cache.org/Versions/v4/RELEASENOTES.html#ss2.9 Rebased patch 0001, removed patches 0002 & 0003 after being applied upstream. Added sha256 hash for tarball. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-08-20 04:50:20 +08:00
SQUID_SITE = http://www.squid-cache.org/Versions/v4
boot, linux, package: use SPDX short identifier for GPLv2/GPLv2+ We want to use SPDX identifier for license strings as much as possible. SPDX short identifier for GPLv2/GPLv2+ is GPL-2.0/GPL-2.0+. This change is done by using following command. find . -name "*.mk" | xargs sed -ri '/LICENSE( )?[\+:]?=/s/\<GPLv2\>/GPL-2.0/g' Signed-off-by: Rahul Bedarkar <rahulbedarkar89@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-03-30 21:43:32 +08:00
SQUID_LICENSE = GPL-2.0+
squid: bump to version 3.2.3 Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2012-10-29 18:57:16 +08:00
SQUID_LICENSE_FILES = COPYING
package/squid: bump version to 4.2 Added dependency for libxml2: http://www.squid-cache.org/Versions/v4/RELEASENOTES.html#ss2.9 Rebased patch 0001, removed patches 0002 & 0003 after being applied upstream. Added sha256 hash for tarball. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-08-20 04:50:20 +08:00
SQUID_DEPENDENCIES = libcap host-libcap libxml2 host-pkgconf \
squid: bump to version 3.2.3 Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2012-10-29 18:57:16 +08:00
$(if $(BR2_PACKAGE_LIBNETFILTER_CONNTRACK),libnetfilter_conntrack)
package: indentation cleanup Signed-off-by: Jerzy Grzegorek <jerzy.grzegorek@trzebnica.net> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2014-12-24 15:54:24 +08:00
SQUID_CONF_ENV = \
ac_cv_epoll_works=yes \
ac_cv_func_setresuid=yes \
ac_cv_func_va_copy=yes \
ac_cv_func___va_copy=yes \
ac_cv_func_strnstr=no \
squid: fix automake breakage Squid bundles a copy of libltdl (from libtool) which autoreconfigures on its own. For some odd reason when automake was bumped to version 1.15 and if the host system has another automake version, for example 1.14, the ACLOCAL and AUTOMAKE variables don't expand properly when the internal autoreconf is triggered hence calling the missing handler which in turn tries to use an incorrect automake version. The solution is to pass unexpanded ACLOCAL and AUTOMAKE variables that defer the evaluation to a later moment and avoid the issue. Fixes: http://autobuild.buildroot.net/results/73f/73fcffafbea320f8c64378bbe8a96922b5e7c6b5/ Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Tested-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-01-08 09:09:27 +08:00
ac_cv_have_squid=yes \
package/squid: fix typo Fixed typo added by https://git.buildroot.net/buildroot/commit/package/squid?id=d2f7d0d72cd7e00ffbe869011d200f0a4a53e7a5 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-08-27 21:43:36 +08:00
BUILDCXX="$(HOSTCXX)" \
squid: fix old distro gcc build failure Squid 3.5.x deprecated the use of HOSTCXX & friends in favour of BUILDCXX and BUILDCXXFLAGS. When they are not specified BUILDCXXFLAGS takes flags from target CXXFLAGS which specifies C11 standard and which older vesions of gcc don't understand, thus causing breakage. cf_gen hasn't got any C11 features so it's not required. Fixes: http://autobuild.buildroot.net/results/816/8162e4ec941e7642248373be47cca99113a648e8/ Also drop ACLOCAL and AUTOMAKE trickery from e27ccbab since it's no longer required. And fix a typo in the hash file pointing to an improper hash file upstream. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2015-01-28 04:30:54 +08:00
BUILDCXXFLAGS="$(HOST_CXXFLAGS)"
package: indentation cleanup Signed-off-by: Jerzy Grzegorek <jerzy.grzegorek@trzebnica.net> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2014-12-24 15:54:24 +08:00
SQUID_CONF_OPTS = \
--enable-async-io=8 \
squid: bump to version 4.3 Drop get_certificate test avoidance patch; upstream made the test cross compile friendly in commit 958ae827cabf (Fix cross-compile issues with SSL_get_certificate()) Drop the patch adding <time.h>; the code does not call time() anymore. Restore netfilter support under musl libc. Squid build fine with current musl version. Cc: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-10-09 19:49:34 +08:00
--enable-linux-netfilter \
package: indentation cleanup Signed-off-by: Jerzy Grzegorek <jerzy.grzegorek@trzebnica.net> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2014-12-24 15:54:24 +08:00
--enable-removal-policies="lru,heap" \
--with-filedescriptors=1024 \
--disable-ident-lookups \
--enable-auth-basic="fake getpwnam" \
--enable-auth-digest="file" \
--enable-auth-negotiate="wrapper" \
--enable-auth-ntlm="fake" \
--disable-strict-error-checking \
--enable-external-acl-helpers="file_userip" \
--with-logdir=/var/log/squid/ \
--with-pidfile=/var/run/squid.pid \
--with-swapdir=/var/cache/squid/ \
squid: create a user/group Even though squid uses nobody/nogroup it ain't good for security if every daemon around uses it, specially since squid is used as a caching proxy most of the time and that would mean other daemons/scripts run as nobody would have access to potentially sensitive information. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-01-15 03:14:43 +08:00
--with-default-user=squid
squid: bump to version 3.1.9 Closes #2773 Fixes several security issues and host-openssl dependency for cf_gen. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2010-11-09 00:40:35 +08:00
package/squid: needs atomic Since https://github.com/squid-cache/squid/commit/4b0f89121135aae68fbaf2aa33b5fb2e0da66d3e squid tries to find if latomic is needed through: AC_SEARCH_LIBS([__atomic_load_8],[atomic],[ATOMICLIB="-latomic"],[]) However, this can fails on: configure:21147: /home/fabrice/buildroot/output/host/bin/arc-buildroot-linux-gnu-g++ -o conftest -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -matomic -Os -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -g conftest.cpp -latomic >&5 conftest.cpp:55:6: error: new declaration 'char __atomic_load_8()' ambiguates built-in declaration 'long long unsigned int __atomic_load_8(const volatile void*, int)' [-fpermissive] char __atomic_load_8 (); ^~~~~~~~~~~~~~~ conftest.cpp: In function 'int main()': conftest.cpp:59:25: error: too few arguments to function 'long long unsigned int __atomic_load_8(const volatile void*, int)' return __atomic_load_8 (); So add -latomic to LIBS if BR2_TOOLCHAIN_HAS_LIBATOMIC is set Fixes: - http://autobuild.buildroot.org/results/13082cea836a12ac8bf85cbdb53a56a5d30c70b1 Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-11-24 22:54:50 +08:00
ifeq ($(BR2_TOOLCHAIN_HAS_LIBATOMIC),y)
SQUID_CONF_ENV += LIBS=-latomic
squid: bump to version 3.5.3 [Thomas: slightly expand the comment about atomic operations, after the discussion with Baruch.] Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-03-29 22:33:31 +08:00
endif
squid: add optional dependency on libkrb5 Signed-off-by: André Hentschel <nerv@dawncrow.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-03-08 04:15:58 +08:00
ifeq ($(BR2_PACKAGE_LIBKRB5),y)
SQUID_CONF_OPTS += --with-mit-krb5
SQUID_DEPENDENCIES += libkrb5
else
SQUID_CONF_OPTS += --without-mit-krb5
endif
New package squid 3.0.STABLE21 Closes #513 Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2009-12-23 20:30:45 +08:00
ifeq ($(BR2_PACKAGE_OPENSSL),y)
squid: bump to version 3.5.6 - Bump to version 3.5.6 - Update hash file - Change configure options according to release notes Release notes: http://www.squid-cache.org/Versions/v3/3.5/squid-3.5.6-RELEASENOTES.html Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-07-06 16:02:04 +08:00
SQUID_CONF_OPTS += --with-openssl
squid: adjust style Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-03-29 22:33:32 +08:00
SQUID_DEPENDENCIES += openssl
squid: explicitly disable openssl support when BR2_PACKAGE_OPENSSL != y Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-07-06 23:53:35 +08:00
else
SQUID_CONF_OPTS += --without-openssl
New package squid 3.0.STABLE21 Closes #513 Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2009-12-23 20:30:45 +08:00
endif
squid: add gnutls support A new --without-gnutls option has been added to configure, so let's use it in order to enable or disable gnutls support in squid. Related: http://www.squid-cache.org/Versions/v3/3.5/squid-3.5.6-RELEASENOTES.html#ss4.1 Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-07-06 16:02:05 +08:00
ifeq ($(BR2_PACKAGE_GNUTLS),y)
SQUID_CONF_OPTS += --with-gnutls
SQUID_DEPENDENCIES += gnutls
else
SQUID_CONF_OPTS += --without-gnutls
endif
package/squid: add optional systemd dependency systemd is an optional dependency (enabled by default) since version 4.11 and https://github.com/squid-cache/squid/commit/6fa8c66435d55a2e713db0222cdca3a9dccf5bbe Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-07-24 05:56:22 +08:00
ifeq ($(BR2_PACKAGE_SYSTEMD),y)
SQUID_CONF_OPTS += --with-systemd
SQUID_DEPENDENCIES += systemd
else
SQUID_CONF_OPTS += --without-systemd
endif
squid: convert old-style hook to new-style hook Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2010-09-02 05:08:46 +08:00
define SQUID_CLEANUP_TARGET
New package squid 3.0.STABLE21 Closes #513 Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2009-12-23 20:30:45 +08:00
rm -f $(addprefix $(TARGET_DIR)/usr/bin/, \
RunCache RunAccel)
rm -f $(addprefix $(TARGET_DIR)/etc/, \
cachemgr.conf mime.conf.default squid.conf.default)
squid: convert old-style hook to new-style hook Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2010-09-02 05:08:46 +08:00
endef
SQUID_POST_INSTALL_TARGET_HOOKS += SQUID_CLEANUP_TARGET
squid: create a user/group Even though squid uses nobody/nogroup it ain't good for security if every daemon around uses it, specially since squid is used as a caching proxy most of the time and that would mean other daemons/scripts run as nobody would have access to potentially sensitive information. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-01-15 03:14:43 +08:00
define SQUID_USERS
squid -1 squid -1 * - - - Squid proxy cache
endef
squid: add sysv initscript Add SysV-style initscript, complete rewrite from http://patchwork.ozlabs.org/patch/412057/ 'stop' is handled by squid itself to gracefully (as possible) close every pending connection and commit changes to disk. By default this is configured for 30 seconds and can be configured via shutdown_lifetime in /etc/squid.conf if someone is too anxious. The script won't block until squid is properly shutdown - but people should _REALLY_ use restart or reload if that's what they want, instead of stop+start. 'restart' is handled by squid itself, since if we do a stop/start cycle we must wait for a clean shutdown cycle (takes time). 'reload' is also handled by squid itself and it's not the same as restart, it will just trigger a configuration reload without purging runtime cache (RAM) contents. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-01-15 03:14:44 +08:00
define SQUID_INSTALL_INIT_SYSV
$(INSTALL) -m 755 -D package/squid/S97squid \
$(TARGET_DIR)/etc/init.d/S97squid
endef
squid: systemd support squid comes with a .service file, but does not install it. [Thomas: use relative path for symlink instead of absolute path.] Signed-off-by: Alex Suykov <alex.suykov@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-05-23 18:07:42 +08:00
define SQUID_INSTALL_INIT_SYSTEMD
squid: fix systemd unit file location squid.service is in tools/systemd/, not in tools/. Fixes: http://autobuild.buildroot.net/results/cec/cecb968172cb00281e439566e5ae154538435a51/ Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-08-06 17:06:32 +08:00
$(INSTALL) -D -m 0644 $(@D)/tools/systemd/squid.service \
squid: systemd support squid comes with a .service file, but does not install it. [Thomas: use relative path for symlink instead of absolute path.] Signed-off-by: Alex Suykov <alex.suykov@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-05-23 18:07:42 +08:00
$(TARGET_DIR)/usr/lib/systemd/system/squid.service
endef
all packages: rename XXXTARGETS to xxx-package Also remove the redundant $(call ...). This is a purely mechanical change, performed with find package linux toolchain boot -name \*.mk | \ xargs sed -i -e 's/$(eval $(call GENTARGETS))/$(eval $(generic-package))/' \ -e 's/$(eval $(call AUTOTARGETS))/$(eval $(autotools-package))/' \ -e 's/$(eval $(call CMAKETARGETS))/$(eval $(cmake-package))/' Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2012-07-03 06:07:32 +08:00
$(eval $(autotools-package))
Reference in New Issue Copy Permalink