+++ /dev/null
-FROM debian:10
-
-
-# Configuration version history
-# v1.0 - Initial version by Etienne Champetier
-# v1.0.1 - Run as non-root, add unzip, xz-utils
-# v1.0.2 - Add bzr
-# v1.0.3 - Verify usign signatures
-# v1.0.4 - Add support for Python3
-# v1.0.5 - Add 19.07 public keys, verify keys
-# v1.0.6 - Add 21.02 public keys, update Debian image to version 10, add rsync
-# v1.0.7 - Add 22.03 public keys, 18.06 v2 gpg key, 18.06 usign key
-
-RUN apt update && apt install -y \
-build-essential \
-bzr \
-curl \
-jq \
-gawk \
-gettext \
-git \
-libncurses5-dev \
-libssl-dev \
-python \
-python3 \
-signify-openbsd \
-subversion \
-rsync \
-time \
-unzip \
-wget \
-xz-utils \
-zlib1g-dev \
-&& rm -rf /var/lib/apt/lists/*
-
-RUN useradd -c "OpenWrt Builder" -m -d /home/build -s /bin/bash build
-USER build
-ENV HOME /home/build
-
-# OpenWrt Build System (PGP key for unattended snapshot builds)
-RUN curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=gpg/626471F1.asc' | gpg --import \
- && gpg --fingerprint --with-colons '<pgpsign-snapshots@openwrt.org>' | grep '^fpr:::::::::54CC74307A2C6DC9CE618269CD84BCED626471F1:$' \
- && echo '54CC74307A2C6DC9CE618269CD84BCED626471F1:6:' | gpg --import-ownertrust
-
-# OpenWrt Build System (PGP key for 17.01 "Reboot" release builds)
-RUN curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=gpg/D52BBB6B.asc' | gpg --import \
- && gpg --fingerprint --with-colons '<pgpsign-17.01@openwrt.org>' | grep '^fpr:::::::::B09BE781AE8A0CD4702FDCD3833C6010D52BBB6B:$' \
- && echo 'B09BE781AE8A0CD4702FDCD3833C6010D52BBB6B:6:' | gpg --import-ownertrust
-
-# OpenWrt Release Builder (18.06 Signing Key)
-RUN curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=gpg/17E1CE16.asc' | gpg --import \
- && gpg --fingerprint --with-colons '<openwrt-devel@lists.openwrt.org>' | grep '^fpr:::::::::6768C55E79B032D77A28DA5F0F20257417E1CE16:$' \
- && echo '6768C55E79B032D77A28DA5F0F20257417E1CE16:6:' | gpg --import-ownertrust
-
-# OpenWrt Build System (PGP key for 18.06 release builds)
-RUN curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=gpg/15807931.asc' | gpg --import \
- && gpg --fingerprint --with-colons '<pgpsign-18.06@openwrt.org>' | grep '^fpr:::::::::AD0507363D2BCE9C9E36CEC4FBCB78F015807931:$' \
- && echo 'AD0507363D2BCE9C9E36CEC4FBCB78F015807931:6:' | gpg --import-ownertrust
-
-# OpenWrt Build System (PGP key for 19.07 release builds)
-RUN curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=gpg/2074BE7A.asc' | gpg --import \
- && gpg --fingerprint --with-colons '<pgpsign-19.07@openwrt.org>' | grep '^fpr:::::::::D9C6901F45C9B86858687DFF28A39BC32074BE7A:$' \
- && echo 'D9C6901F45C9B86858687DFF28A39BC32074BE7A:6:' | gpg --import-ownertrust
-
-# OpenWrt Build System (PGP key for 21.02 release builds)
-RUN curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=gpg/88CA59E8.asc' | gpg --import \
- && gpg --fingerprint --with-colons '<pgpsign-21.02@openwrt.org>' | grep '^fpr:::::::::667205E379BAF348863A5C6688CA59E88F681580:$' \
- && echo '667205E379BAF348863A5C6688CA59E88F681580:6:' | gpg --import-ownertrust
-
-# OpenWrt Build System (GnuPGP key for 22.03 release builds)
-RUN curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=gpg/CD54E82DADB3684D.asc' | gpg --import \
- && gpg --fingerprint --with-colons '<pgpsign-22.03@openwrt.org>' | grep '^fpr:::::::::BF856781A01293C8409ABE72CD54E82DADB3684D:$' \
- && echo 'BF856781A01293C8409ABE72CD54E82DADB3684D:6:' | gpg --import-ownertrust
-
-# untrusted comment: Public usign key for unattended snapshot builds
-RUN curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=usign/b5043e70f9a75cde' --create-dirs -o /home/build/usign/b5043e70f9a75cde \
- && echo 'd7ac10f9ed1b38033855f3d27c9327d558444fca804c685b17d9dcfb0648228f */home/build/usign/b5043e70f9a75cde' | sha256sum --check
-
-# untrusted comment: Public usign key for 18.06 release builds
-RUN curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=usign/1035ac73cc4e59e3' --create-dirs -o /home/build/usign/1035ac73cc4e59e3 \
- && echo '8dc2e7f5c4e634437e6641f4df77a18bf59f0c8e9016c8ba4be5d4a0111e68c2 */home/build/usign/1035ac73cc4e59e3' | sha256sum --check
-
-# untrusted comment: Public usign key for 19.07 release builds
-RUN curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=usign/f94b9dd6febac963' --create-dirs -o /home/build/usign/f94b9dd6febac963 \
- && echo 'b1d09457cfbc36fccfe18382d65c54a2ade3e7fd3902da490a53aa517b512755 */home/build/usign/f94b9dd6febac963' | sha256sum --check
-
-# untrusted comment: Public usign key for 21.02 release builds
-RUN curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=usign/2f8b0b98e08306bf' --create-dirs -o /home/build/usign/2f8b0b98e08306bf \
- && echo 'd102bdd75421c62490b97f520f9db06aadb44ad408b244755d26e96ea5cd3b7f */home/build/usign/2f8b0b98e08306bf' | sha256sum --check
-
-# untrusted comment: Public usign key for 22.03 release builds
-RUN curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=usign/4d017e6f1ed5d616' --create-dirs -o /home/build/usign/4d017e6f1ed5d616 \
- && echo 'f3c5fdf447d7c2743442e68077d60acc7c3e91754849e1f4b6be837b4204b7e2 */home/build/usign/4d017e6f1ed5d616' | sha256sum --check
+++ /dev/null
-# Build/update the docker image
-
-docker pull debian:10
-docker build --rm -t docker.io/openwrtorg/packages-cci:latest .
-docker tag <IMAGE ID> docker.io/openwrtorg/packages-cci:<VERSION-TAG>
-docker push docker.io/openwrtorg/packages-cci
+++ /dev/null
-version: 2.0
-jobs:
- build:
- docker:
- - image: docker.io/openwrtorg/packages-cci:v1.0.7
- environment:
- - SDK_HOST: "downloads.openwrt.org"
- - SDK_PATH: "snapshots/targets/ath79/generic"
- - SDK_FILE: "openwrt-sdk-ath79-generic_*.Linux-x86_64.tar.xz"
- - BRANCH: "master"
- steps:
- - checkout:
- path: ~/openwrt_packages
-
- - run:
- name: Check changes / verify commits
- working_directory: ~/openwrt_packages
- command: |
- cat >> $BASH_ENV <<EOF
- echo_red() { printf "\033[1;31m\$*\033[m\n"; }
- echo_green() { printf "\033[1;32m\$*\033[m\n"; }
- echo_blue() { printf "\033[1;34m\$*\033[m\n"; }
- EOF
- source $BASH_ENV
-
- RET=0
- for commit in $(git rev-list HEAD ^origin/$BRANCH); do
- echo_blue "=== Checking commit '$commit'"
- if git show --format='%P' -s $commit | grep -qF ' '; then
- echo_red "Pull request should not include merge commits"
- RET=1
- fi
-
- author="$(git show -s --format=%aN $commit)"
- if echo $author | grep -q '\S\+\s\+\S\+'; then
- echo_green "Author name ($author) seems ok"
- else
- echo_red "Author name ($author) need to be your real name 'firstname lastname'"
- RET=1
- fi
-
- subject="$(git show -s --format=%s $commit)"
- if echo "$subject" | grep -q -e '^[0-9A-Za-z,+/_-]\+: ' -e '^Revert '; then
- echo_green "Commit subject line seems ok ($subject)"
- else
- echo_red "Commit subject line MUST start with '<package name>: ' ($subject)"
- RET=1
- fi
-
- body="$(git show -s --format=%b $commit)"
- sob="$(git show -s --format='Signed-off-by: %aN <%aE>' $commit)"
- if echo "$body" | grep -qF "$sob"; then
- echo_green "Signed-off-by match author"
- else
- echo_red "Signed-off-by is missing or doesn't match author (should be '$sob')"
- RET=1
- fi
- done
-
- exit $RET
-
- - run:
- name: Download the SDK
- working_directory: ~/sdk
- command: |
- curl "https://$SDK_HOST/$SDK_PATH/sha256sums" -sS -o sha256sums
- curl "https://$SDK_HOST/$SDK_PATH/sha256sums.asc" -fs -o sha256sums.asc || true
- curl "https://$SDK_HOST/$SDK_PATH/sha256sums.sig" -fs -o sha256sums.sig || true
- if [ ! -f sha256sums.asc ] && [ ! -f sha256sums.sig ]; then
- echo_red "Missing sha256sums signature files"
- exit 1
- fi
- [ ! -f sha256sums.asc ] || gpg --with-fingerprint --verify sha256sums.asc sha256sums
- if [ -f sha256sums.sig ]; then
- VERIFIED=
- for KEY in ~/usign/*; do
- echo "Trying $KEY..."
- if signify-openbsd -V -q -p "$KEY" -x sha256sums.sig -m sha256sums; then
- echo "...verified"
- VERIFIED=1
- break
- fi
- done
- if [ -z "$VERIFIED" ]; then
- echo_red "Could not verify usign signature"
- exit 1
- fi
- fi
- rsync -av "$SDK_HOST::downloads/$SDK_PATH/$SDK_FILE" .
- sha256sum -c --ignore-missing sha256sums
-
- - run:
- name: Prepare build_dir
- working_directory: ~/build_dir
- command: |
- tar Jxf ~/sdk/$SDK_FILE --strip=1
- touch .config
- make prepare-tmpinfo scripts/config/conf
- ./scripts/config/conf --defconfig=.config Config.in
- make prereq
- rm .config
- cat > feeds.conf <<EOF
- src-git base https://github.com/openwrt/openwrt.git;$BRANCH
- src-link packages $HOME/openwrt_packages
- src-git luci https://github.com/openwrt/luci.git;$BRANCH
- EOF
- cat feeds.conf
- ./scripts/feeds update -a > /dev/null
- make defconfig > /dev/null
- # enable BUILD_LOG
- sed -i 's/# CONFIG_BUILD_LOG is not set/CONFIG_BUILD_LOG=y/' .config
-
- - run:
- name: Install & download source, check package, compile
- working_directory: ~/build_dir
- command: |
- set +o pipefail
- PKGS=$(cd ~/openwrt_packages; git diff --diff-filter=d --name-only "origin/$BRANCH..." | grep 'Makefile$' | grep -Ev '/files/|/src/' | awk -F/ '{ print $(NF-1) }')
- if [ -z "$PKGS" ] ; then
- echo_blue "WARNING: No new or modified packages found!"
- exit 0
- fi
-
- echo_blue "=== Found new/modified packages: $PKGS"
- for PKG in $PKGS ; do
- echo_blue "===+ Install: $PKG"
- ./scripts/feeds install "$PKG"
-
- echo_blue "===+ Download: $PKG"
- make "package/$PKG/download" V=s
-
- echo_blue "===+ Check package: $PKG"
- make "package/$PKG/check" V=s 2>&1 | tee logtmp
- RET=${PIPESTATUS[0]}
-
- if [ $RET -ne 0 ]; then
- echo_red "=> Package check failed: $RET)"
- exit $RET
- fi
-
- badhash_msg="HASH does not match "
- badhash_msg+="|HASH uses deprecated hash,"
- badhash_msg+="|HASH is missing,"
- if grep -qE "$badhash_msg" logtmp; then
- echo_red "=> Package HASH check failed"
- exit 1
- fi
- echo_green "=> Package check OK"
- done
-
- make \
- -f .config \
- -f tmp/.packagedeps \
- -f <(echo '$(info $(sort $(package-y) $(package-m)))'; echo -en 'a:\n\t@:') \
- | tr ' ' '\n' >enabled-package-subdirs.txt
- for PKG in $PKGS ; do
- if ! grep -m1 -qE "(^|/)$PKG$" enabled-package-subdirs.txt; then
- echo_red "===+ Building: $PKG skipped. It cannot be enabled with $SDK_FILE"
- continue
- fi
- echo_blue "===+ Building: $PKG"
- make "package/$PKG/compile" -j3 V=s || {
- RET=$?
- echo_red "===+ Building: $PKG failed, rebuilding with -j1 for human readable error log"
- make "package/$PKG/compile" -j1 V=s; exit $RET
- }
- done
-
- - store_artifacts:
- path: ~/build_dir/logs
-
- - store_artifacts:
- path: ~/build_dir/bin
-
-workflows:
- version: 2
- buildpr:
- jobs:
- - build:
- filters:
- branches:
- ignore: master
include $(TOPDIR)/rules.mk
PKG_NAME:=syslog-ng
-PKG_VERSION:=4.6.0
-PKG_RELEASE:=2
+PKG_VERSION:=4.7.1
+PKG_RELEASE:=1
PKG_MAINTAINER:=Josef Schlehofer <pepe.schlehofer@gmail.com>
PKG_LICENSE:=LGPL-2.1-or-later GPL-2.0-or-later
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://github.com/syslog-ng/syslog-ng/releases/download/$(PKG_NAME)-$(PKG_VERSION)/
-PKG_HASH:=b69e3360dfb96a754a4e1cbead4daef37128b1152a23572356db4ab64a475d4f
+PKG_HASH:=5477189a2d12325aa4faebfcf59f5bdd9084234732f0c3ec16dd253847dacf1c
PKG_BUILD_PARALLEL:=1
PKG_INSTALL:=1
# Collect all local logs into a single file /var/log/messages.
# See https://www.syslog-ng.com/technical-documents/list/syslog-ng-open-source-edition
-@version: 4.6
+@version: 4.7
@include "scl.conf"
options {
PKG_NAME:=gcc
GCC_VERSION:=$(call qstrip,$(CONFIG_GCC_VERSION))
PKG_VERSION:=$(firstword $(subst +, ,$(GCC_VERSION)))
-PKG_RELEASE:=5
+GCC_MAJOR_VERSION:=$(word 1,$(subst ., ,$(PKG_VERSION)))
+PKG_RELEASE:=6
GCC_DIR:=$(PKG_NAME)-$(PKG_VERSION)
PKG_SOURCE_URL:=@GNU/gcc/gcc-$(PKG_VERSION)
PKG_HASH:=949a5d4f99e786421a93b532b22ffab5578de7321369975b91aec97adfda8c3b
endif
-PATCH_DIR=./patches/$(GCC_VERSION)
+ifeq ($(PKG_VERSION),13.2.0)
+ PKG_HASH:=e275e76442a6067341a27f04c5c6b83d8613144004c0413528863dc6b5c743da
+endif
+
+PATCH_DIR:=patches-$(GCC_MAJOR_VERSION).x
include $(INCLUDE_DIR)/package.mk
--- /dev/null
+commit 81cc26c706b2bc8c8c1eb1a322e5c5157900836e
+Author: Felix Fietkau <nbd@openwrt.org>
+Date: Sun Oct 19 21:45:51 2014 +0000
+
+ gcc: do not assume that the Mac OS X filesystem is case insensitive
+
+ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+
+ SVN-Revision: 42973
+
+--- a/include/filenames.h
++++ b/include/filenames.h
+@@ -44,11 +44,6 @@ extern "C" {
+ # define IS_DIR_SEPARATOR(c) IS_DOS_DIR_SEPARATOR (c)
+ # define IS_ABSOLUTE_PATH(f) IS_DOS_ABSOLUTE_PATH (f)
+ #else /* not DOSish */
+-# if defined(__APPLE__)
+-# ifndef HAVE_CASE_INSENSITIVE_FILE_SYSTEM
+-# define HAVE_CASE_INSENSITIVE_FILE_SYSTEM 1
+-# endif
+-# endif /* __APPLE__ */
+ # define HAS_DRIVE_SPEC(f) (0)
+ # define IS_DIR_SEPARATOR(c) IS_UNIX_DIR_SEPARATOR (c)
+ # define IS_ABSOLUTE_PATH(f) IS_UNIX_ABSOLUTE_PATH (f)
--- /dev/null
+--- a/gcc/real.h
++++ b/gcc/real.h
+@@ -77,8 +77,10 @@ struct GTY(()) real_value {
+ + (REAL_VALUE_TYPE_SIZE%HOST_BITS_PER_WIDE_INT ? 1 : 0)) /* round up */
+
+ /* Verify the guess. */
++#ifndef __LP64__
+ extern char test_real_width
+ [sizeof (REAL_VALUE_TYPE) <= REAL_WIDTH * sizeof (HOST_WIDE_INT) ? 1 : -1];
++#endif
+
+ /* Calculate the format for CONST_DOUBLE. We need as many slots as
+ are necessary to overlay a REAL_VALUE_TYPE on them. This could be
--- /dev/null
+commit 098bd91f5eae625c7d2ee621e10930fc4434e5e2
+Author: Luka Perkov <luka@openwrt.org>
+Date: Tue Feb 26 16:16:33 2013 +0000
+
+ gcc: don't build documentation
+
+ This closes #13039.
+
+ Signed-off-by: Luka Perkov <luka@openwrt.org>
+
+ SVN-Revision: 35807
+
+--- a/gcc/Makefile.in
++++ b/gcc/Makefile.in
+@@ -3285,18 +3285,10 @@ doc/gcc.info: $(TEXI_GCC_FILES)
+ doc/gccint.info: $(TEXI_GCCINT_FILES)
+ doc/cppinternals.info: $(TEXI_CPPINT_FILES)
+
+-doc/%.info: %.texi
+- if [ x$(BUILD_INFO) = xinfo ]; then \
+- $(MAKEINFO) $(MAKEINFOFLAGS) -I . -I $(gcc_docdir) \
+- -I $(gcc_docdir)/include -o $@ $<; \
+- fi
++doc/%.info:
+
+ # Duplicate entry to handle renaming of gccinstall.info
+-doc/gccinstall.info: $(TEXI_GCCINSTALL_FILES)
+- if [ x$(BUILD_INFO) = xinfo ]; then \
+- $(MAKEINFO) $(MAKEINFOFLAGS) -I $(gcc_docdir) \
+- -I $(gcc_docdir)/include -o $@ $<; \
+- fi
++doc/gccinstall.info:
+
+ doc/cpp.dvi: $(TEXI_CPP_FILES)
+ doc/gcc.dvi: $(TEXI_GCC_FILES)
--- /dev/null
+Fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84790.
+MIPS16 functions have a static assembler prologue which clobbers
+registers v0 and v1. Add these register clobbers to function call
+instructions.
+
+--- a/gcc/config/mips/mips.c
++++ b/gcc/config/mips/mips.c
+@@ -3132,6 +3132,12 @@ mips_emit_call_insn (rtx pattern, rtx or
+ emit_insn (gen_update_got_version ());
+ }
+
++ if (TARGET_MIPS16 && TARGET_USE_GOT)
++ {
++ clobber_reg (&CALL_INSN_FUNCTION_USAGE (insn), MIPS16_PIC_TEMP);
++ clobber_reg (&CALL_INSN_FUNCTION_USAGE (insn), MIPS_PROLOGUE_TEMP (word_mode));
++ }
++
+ if (TARGET_MIPS16
+ && TARGET_EXPLICIT_RELOCS
+ && TARGET_CALL_CLOBBERED_GP)
--- /dev/null
+--- a/gcc/gcc.c
++++ b/gcc/gcc.c
+@@ -875,7 +875,9 @@ proper position among the other output f
+ #endif
+
+ #ifndef LINK_SSP_SPEC
+-#ifdef TARGET_LIBC_PROVIDES_SSP
++#if DEFAULT_LIBC == LIBC_MUSL
++#define LINK_SSP_SPEC "-lssp_nonshared"
++#elif defined(TARGET_LIBC_PROVIDES_SSP)
+ #define LINK_SSP_SPEC "%{fstack-protector|fstack-protector-all" \
+ "|fstack-protector-strong|fstack-protector-explicit:}"
+ #else
--- /dev/null
+commit ecf7671b769fe96f7b5134be442089f8bdba55d2
+Author: Felix Fietkau <nbd@nbd.name>
+Date: Thu Aug 4 20:29:45 2016 +0200
+
+gcc: add a patch to generate better code with Os on mips
+
+Also happens to reduce compressed code size a bit
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+
+--- a/gcc/config/mips/mips.c
++++ b/gcc/config/mips/mips.c
+@@ -20041,7 +20041,7 @@ mips_option_override (void)
+ flag_pcc_struct_return = 0;
+
+ /* Decide which rtx_costs structure to use. */
+- if (optimize_size)
++ if (0 && optimize_size)
+ mips_cost = &mips_rtx_cost_optimize_size;
+ else
+ mips_cost = &mips_rtx_cost_data[mips_tune];
--- /dev/null
+commit 8570c4be394cff7282f332f97da2ff569a927ddb
+Author: Imre Kaloz <kaloz@openwrt.org>
+Date: Wed Feb 2 20:06:12 2011 +0000
+
+ fixup arm soft-float symbols
+
+ SVN-Revision: 25325
+
+--- a/libgcc/config/arm/t-linux
++++ b/libgcc/config/arm/t-linux
+@@ -1,6 +1,10 @@
+ LIB1ASMSRC = arm/lib1funcs.S
+ LIB1ASMFUNCS = _udivsi3 _divsi3 _umodsi3 _modsi3 _dvmd_lnx _clzsi2 _clzdi2 \
+- _ctzsi2 _arm_addsubdf3 _arm_addsubsf3
++ _ctzsi2 _arm_addsubdf3 _arm_addsubsf3 \
++ _arm_negdf2 _arm_muldivdf3 _arm_cmpdf2 _arm_unorddf2 \
++ _arm_fixdfsi _arm_fixunsdfsi _arm_truncdfsf2 \
++ _arm_negsf2 _arm_muldivsf3 _arm_cmpsf2 _arm_unordsf2 \
++ _arm_fixsfsi _arm_fixunssfsi
+
+ # Just for these, we omit the frame pointer since it makes such a big
+ # difference.
+--- a/gcc/config/arm/linux-elf.h
++++ b/gcc/config/arm/linux-elf.h
+@@ -58,8 +58,6 @@
+ %{shared:-lc} \
+ %{!shared:%{profile:-lc_p}%{!profile:-lc}}"
+
+-#define LIBGCC_SPEC "%{mfloat-abi=soft*:-lfloat} -lgcc"
+-
+ #define GLIBC_DYNAMIC_LINKER "/lib/ld-linux.so.2"
+
+ #define LINUX_TARGET_LINK_SPEC "%{h*} \
--- /dev/null
+commit c96312958c0621e72c9b32da5bc224ffe2161384
+Author: Felix Fietkau <nbd@openwrt.org>
+Date: Mon Oct 19 23:26:09 2009 +0000
+
+ gcc: create a proper libgcc_pic.a static library for relinking (4.3.3+ for now, backport will follow)
+
+ SVN-Revision: 18086
+
+--- a/libgcc/Makefile.in
++++ b/libgcc/Makefile.in
+@@ -929,11 +929,12 @@ $(libgcov-driver-objects): %$(objext): $
+
+ # Static libraries.
+ libgcc.a: $(libgcc-objects)
++libgcc_pic.a: $(libgcc-s-objects)
+ libgcov.a: $(libgcov-objects)
+ libunwind.a: $(libunwind-objects)
+ libgcc_eh.a: $(libgcc-eh-objects)
+
+-libgcc.a libgcov.a libunwind.a libgcc_eh.a:
++libgcc.a libgcov.a libunwind.a libgcc_eh.a libgcc_pic.a:
+ -rm -f $@
+
+ objects="$(objects)"; \
+@@ -957,7 +958,7 @@ all: libunwind.a
+ endif
+
+ ifeq ($(enable_shared),yes)
+-all: libgcc_eh.a libgcc_s$(SHLIB_EXT)
++all: libgcc_eh.a libgcc_pic.a libgcc_s$(SHLIB_EXT)
+ ifneq ($(LIBUNWIND),)
+ all: libunwind$(SHLIB_EXT)
+ libgcc_s$(SHLIB_EXT): libunwind$(SHLIB_EXT)
+@@ -1163,6 +1164,10 @@ install-shared:
+ chmod 644 $(DESTDIR)$(inst_libdir)/libgcc_eh.a
+ $(RANLIB) $(DESTDIR)$(inst_libdir)/libgcc_eh.a
+
++ $(INSTALL_DATA) libgcc_pic.a $(mapfile) $(DESTDIR)$(inst_libdir)/
++ chmod 644 $(DESTDIR)$(inst_libdir)/libgcc_pic.a
++ $(RANLIB) $(DESTDIR)$(inst_libdir)/libgcc_pic.a
++
+ $(subst @multilib_dir@,$(MULTIDIR),$(subst \
+ @shlib_base_name@,libgcc_s,$(subst \
+ @shlib_slibdir_qual@,$(MULTIOSSUBDIR),$(SHLIB_INSTALL))))
--- /dev/null
+commit 7edc8ca5456d9743dd0075eb3cc5b04f4f24c8cc
+Author: Imre Kaloz <kaloz@openwrt.org>
+Date: Wed Feb 2 19:34:36 2011 +0000
+
+ add armv4 fixup patches
+
+ SVN-Revision: 25322
+
+
+--- a/gcc/config/arm/linux-eabi.h
++++ b/gcc/config/arm/linux-eabi.h
+@@ -91,10 +91,15 @@
+ #define MUSL_DYNAMIC_LINKER \
+ "/lib/ld-musl-arm" MUSL_DYNAMIC_LINKER_E "%{mfloat-abi=hard:hf}%{mfdpic:-fdpic}.so.1"
+
++/* For armv4 we pass --fix-v4bx to linker to support EABI */
++#undef TARGET_FIX_V4BX_SPEC
++#define TARGET_FIX_V4BX_SPEC " %{mcpu=arm8|mcpu=arm810|mcpu=strongarm*"\
++ "|march=armv4|mcpu=fa526|mcpu=fa626:--fix-v4bx}"
++
+ /* At this point, bpabi.h will have clobbered LINK_SPEC. We want to
+ use the GNU/Linux version, not the generic BPABI version. */
+ #undef LINK_SPEC
+-#define LINK_SPEC EABI_LINK_SPEC \
++#define LINK_SPEC EABI_LINK_SPEC TARGET_FIX_V4BX_SPEC \
+ LINUX_OR_ANDROID_LD (LINUX_TARGET_LINK_SPEC, \
+ LINUX_TARGET_LINK_SPEC " " ANDROID_LINK_SPEC)
+
--- /dev/null
+commit dcfc40358b5a3cae7320c17f8d1cebd5ad5540cd
+Author: Felix Fietkau <nbd@openwrt.org>
+Date: Sun Feb 12 20:25:47 2012 +0000
+
+ gcc 4.6: port over the missing patch 850-use_shared_libgcc.patch to prevent libgcc crap from leaking into every single binary
+
+ SVN-Revision: 30486
+--- a/gcc/config/arm/linux-eabi.h
++++ b/gcc/config/arm/linux-eabi.h
+@@ -132,10 +132,6 @@
+ "%{Ofast|ffast-math|funsafe-math-optimizations:crtfastmath.o%s} " \
+ LINUX_OR_ANDROID_LD (GNU_USER_TARGET_ENDFILE_SPEC, ANDROID_ENDFILE_SPEC)
+
+-/* Use the default LIBGCC_SPEC, not the version in linux-elf.h, as we
+- do not use -lfloat. */
+-#undef LIBGCC_SPEC
+-
+ /* Clear the instruction cache from `beg' to `end'. This is
+ implemented in lib1funcs.S, so ensure an error if this definition
+ is used. */
+--- a/gcc/config/linux.h
++++ b/gcc/config/linux.h
+@@ -66,6 +66,10 @@ see the files COPYING3 and COPYING.RUNTI
+ builtin_version ("CRuntime_Musl"); \
+ } while (0)
+
++#ifndef LIBGCC_SPEC
++#define LIBGCC_SPEC "%{static|static-libgcc:-lgcc}%{!static:%{!static-libgcc:-lgcc_s}}"
++#endif
++
+ /* Determine which dynamic linker to use depending on whether GLIBC or
+ uClibc or Bionic or musl is the default C library and whether
+ -muclibc or -mglibc or -mbionic or -mmusl has been passed to change
+--- a/libgcc/mkmap-symver.awk
++++ b/libgcc/mkmap-symver.awk
+@@ -136,5 +136,5 @@ function output(lib) {
+ else if (inherit[lib])
+ printf("} %s;\n", inherit[lib]);
+ else
+- printf ("\n local:\n\t*;\n};\n");
++ printf ("\n\t*;\n};\n");
+ }
+--- a/gcc/config/rs6000/linux.h
++++ b/gcc/config/rs6000/linux.h
+@@ -62,6 +62,9 @@
+ #undef CPP_OS_DEFAULT_SPEC
+ #define CPP_OS_DEFAULT_SPEC "%(cpp_os_linux)"
+
++#undef LIBGCC_SPEC
++#define LIBGCC_SPEC "%{!static:%{!static-libgcc:-lgcc_s}} -lgcc"
++
+ #undef LINK_SHLIB_SPEC
+ #define LINK_SHLIB_SPEC "%{shared:-shared} %{!shared: %{static:-static}} \
+ %{static-pie:-static -pie --no-dynamic-linker -z text}"
--- /dev/null
+commit 64661de100da1ec1061ef3e5e400285dce115e6b
+Author: Felix Fietkau <nbd@openwrt.org>
+Date: Sun May 10 13:16:35 2015 +0000
+
+ gcc: add some size optimization patches
+
+ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+
+ SVN-Revision: 45664
+
+--- a/libgcc/config/t-libunwind
++++ b/libgcc/config/t-libunwind
+@@ -2,8 +2,7 @@
+
+ HOST_LIBGCC2_CFLAGS += -DUSE_GAS_SYMVER
+
+-LIB2ADDEH = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c \
+- $(srcdir)/unwind-compat.c $(srcdir)/unwind-dw2-fde-compat.c
++LIB2ADDEH = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c
+ LIB2ADDEHSTATIC = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c
+
+ # Override the default value from t-slibgcc-elf-ver and mention -lunwind
--- /dev/null
+--- a/gcc/config/rs6000/rs6000-logue.c
++++ b/gcc/config/rs6000/rs6000-logue.c
+@@ -348,7 +348,7 @@ rs6000_savres_strategy (rs6000_stack_t *
+ /* Define cutoff for using out-of-line functions to save registers. */
+ if (DEFAULT_ABI == ABI_V4 || TARGET_ELF)
+ {
+- if (!optimize_size)
++ if (1)
+ {
+ strategy |= SAVE_INLINE_FPRS | REST_INLINE_FPRS;
+ strategy |= SAVE_INLINE_GPRS | REST_INLINE_GPRS;
--- /dev/null
+--- a/libgcc/crtstuff.c
++++ b/libgcc/crtstuff.c
+@@ -152,7 +152,7 @@ call_ ## FUNC (void) \
+ #endif
+
+ #if !defined(USE_TM_CLONE_REGISTRY) && defined(OBJECT_FORMAT_ELF)
+-# define USE_TM_CLONE_REGISTRY 1
++# define USE_TM_CLONE_REGISTRY 0
+ #elif !defined(USE_TM_CLONE_REGISTRY)
+ # define USE_TM_CLONE_REGISTRY 0
+ #endif
--- /dev/null
+--- a/libgcc/config/mips/t-mips16
++++ b/libgcc/config/mips/t-mips16
+@@ -43,3 +43,6 @@ SYNC_CFLAGS = -mno-mips16
+
+ # Version these symbols if building libgcc.so.
+ SHLIB_MAPFILES += $(srcdir)/config/mips/libgcc-mips16.ver
++
++CRTSTUFF_T_CFLAGS += -mno-mips16
++CRTSTUFF_T_CFLAGS_S += -mno-mips16
--- /dev/null
+commit 99368862e44740ff4fd33760893f04e14f9dbdf1
+Author: Felix Fietkau <nbd@openwrt.org>
+Date: Tue Jul 31 00:52:27 2007 +0000
+
+ Port the mbsd_multi patch from freewrt, which adds -fhonour-copts. This will emit warnings in packages that don't use our target cflags properly
+
+ SVN-Revision: 8256
+
+ This patch brings over a feature from MirBSD:
+ * -fhonour-copts
+ If this option is not given, it's warned (depending
+ on environment variables). This is to catch errors
+ of misbuilt packages which override CFLAGS themselves.
+
+ This patch was authored by Thorsten Glaser <tg at mirbsd.de>
+ with copyright assignment to the FSF in effect.
+
+--- a/gcc/c-family/c-opts.c
++++ b/gcc/c-family/c-opts.c
+@@ -107,6 +107,9 @@ static dump_flags_t original_dump_flags;
+ /* Whether any standard preincluded header has been preincluded. */
+ static bool done_preinclude;
+
++/* Check if a port honours COPTS. */
++static int honour_copts = 0;
++
+ static void handle_OPT_d (const char *);
+ static void set_std_cxx98 (int);
+ static void set_std_cxx11 (int);
+@@ -455,6 +458,12 @@ c_common_handle_option (size_t scode, co
+ flag_no_builtin = !value;
+ break;
+
++ case OPT_fhonour_copts:
++ if (c_language == clk_c) {
++ honour_copts++;
++ }
++ break;
++
+ case OPT_fconstant_string_class_:
+ constant_string_class_name = arg;
+ break;
+@@ -1168,6 +1177,47 @@ c_common_init (void)
+ return false;
+ }
+
++ if (c_language == clk_c) {
++ char *ev = getenv ("GCC_HONOUR_COPTS");
++ int evv;
++ if (ev == NULL)
++ evv = -1;
++ else if ((*ev == '0') || (*ev == '\0'))
++ evv = 0;
++ else if (*ev == '1')
++ evv = 1;
++ else if (*ev == '2')
++ evv = 2;
++ else if (*ev == 's')
++ evv = -1;
++ else {
++ warning (0, "unknown GCC_HONOUR_COPTS value, assuming 1");
++ evv = 1; /* maybe depend this on something like MIRBSD_NATIVE? */
++ }
++ if (evv == 1) {
++ if (honour_copts == 0) {
++ error ("someone does not honour COPTS at all in lenient mode");
++ return false;
++ } else if (honour_copts != 1) {
++ warning (0, "someone does not honour COPTS correctly, passed %d times",
++ honour_copts);
++ }
++ } else if (evv == 2) {
++ if (honour_copts == 0) {
++ error ("someone does not honour COPTS at all in strict mode");
++ return false;
++ } else if (honour_copts != 1) {
++ error ("someone does not honour COPTS correctly, passed %d times",
++ honour_copts);
++ return false;
++ }
++ } else if (evv == 0) {
++ if (honour_copts != 1)
++ inform (UNKNOWN_LOCATION, "someone does not honour COPTS correctly, passed %d times",
++ honour_copts);
++ }
++ }
++
+ return true;
+ }
+
+--- a/gcc/c-family/c.opt
++++ b/gcc/c-family/c.opt
+@@ -1590,6 +1590,9 @@ C++ ObjC++ Optimization Alias(fexception
+ fhonor-std
+ C++ ObjC++ WarnRemoved
+
++fhonour-copts
++C ObjC C++ ObjC++ RejectNegative
++
+ fhosted
+ C ObjC
+ Assume normal C execution environment.
+--- a/gcc/common.opt
++++ b/gcc/common.opt
+@@ -1660,6 +1660,9 @@ fguess-branch-probability
+ Common Report Var(flag_guess_branch_prob) Optimization
+ Enable guessing of branch probabilities.
+
++fhonour-copts
++Common RejectNegative
++
+ ; Nonzero means ignore `#ident' directives. 0 means handle them.
+ ; Generate position-independent code for executables if possible
+ ; On SVR4 targets, it also controls whether or not to emit a
+--- a/gcc/doc/invoke.texi
++++ b/gcc/doc/invoke.texi
+@@ -8171,6 +8171,17 @@ This option is only supported for C and
+ @option{-Wall} and by @option{-Wpedantic}, which can be disabled with
+ @option{-Wno-pointer-sign}.
+
++@item -fhonour-copts
++@opindex fhonour-copts
++If @env{GCC_HONOUR_COPTS} is set to 1, abort if this option is not
++given at least once, and warn if it is given more than once.
++If @env{GCC_HONOUR_COPTS} is set to 2, abort if this option is not
++given exactly once.
++If @env{GCC_HONOUR_COPTS} is set to 0 or unset, warn if this option
++is not given exactly once.
++The warning is quelled if @env{GCC_HONOUR_COPTS} is set to @samp{s}.
++This flag and environment variable only affect the C language.
++
+ @item -Wstack-protector
+ @opindex Wstack-protector
+ @opindex Wno-stack-protector
+--- a/gcc/opts.c
++++ b/gcc/opts.c
+@@ -2318,6 +2318,9 @@ common_handle_option (struct gcc_options
+ /* Currently handled in a prescan. */
+ break;
+
++ case OPT_fhonour_copts:
++ break;
++
+ case OPT_Werror:
+ dc->warning_as_error_requested = value;
+ break;
--- /dev/null
+Author: Jo-Philipp Wich <jow@openwrt.org>
+Date: Sat Apr 21 03:02:39 2012 +0000
+
+ gcc: add patch to make the getenv() spec function nonfatal if requested environment variable is unset
+
+ SVN-Revision: 31390
+
+--- a/gcc/gcc.c
++++ b/gcc/gcc.c
+@@ -9396,8 +9396,10 @@ getenv_spec_function (int argc, const ch
+ }
+
+ if (!value)
+- fatal_error (input_location,
+- "environment variable %qs not defined", varname);
++ {
++ warning (input_location, "environment variable %qs not defined", varname);
++ value = "";
++ }
+
+ /* We have to escape every character of the environment variable so
+ they are not interpreted as active spec characters. A
--- /dev/null
+From da45b3fde60095756f5f6030f6012c23a3d34429 Mon Sep 17 00:00:00 2001
+From: Andrew McDonnell <bugs@andrewmcdonnell.net>
+Date: Fri, 3 Oct 2014 19:09:00 +0930
+Subject: Add .note.GNU-stack section
+
+See http://lists.busybox.net/pipermail/uclibc/2014-October/048671.html
+Below copied from https://gcc.gnu.org/ml/gcc-patches/2014-09/msg02430.html
+
+Re: [Patch, MIPS] Add .note.GNU-stack section
+
+ From: Steve Ellcey <sellcey at mips dot com>
+
+On Wed, 2014-09-10 at 10:15 -0700, Eric Christopher wrote:
+>
+>
+> On Wed, Sep 10, 2014 at 9:27 AM, <pinskia@gmail.com> wrote:
+
+> This works except you did not update the assembly files in
+> libgcc or glibc. We (Cavium) have the same patch in our tree
+> for a few released versions.
+
+> Mind just checking yours in then Andrew?
+
+> Thanks!
+> -eric
+
+I talked to Andrew about what files he changed in GCC and created and
+tested this new patch. Andrew also mentioned changing some assembly
+files in glibc but I don't see any use of '.section .note.GNU-stack' in
+any assembly files in glibc (for any platform) so I wasn't planning on
+creating a glibc to add them to mips glibc assembly language files.
+
+OK to check in this patch?
+
+Steve Ellcey
+sellcey@mips.com
+
+
+
+2014-09-26 Steve Ellcey <sellcey@mips.com>
+---
+ gcc/config/mips/mips.c | 3 +++
+ libgcc/config/mips/crti.S | 4 ++++
+ libgcc/config/mips/crtn.S | 3 +++
+ libgcc/config/mips/mips16.S | 4 ++++
+ libgcc/config/mips/vr4120-div.S | 4 ++++
+ 5 files changed, 18 insertions(+)
+
+--- a/gcc/config/mips/mips.c
++++ b/gcc/config/mips/mips.c
+@@ -22881,6 +22881,9 @@ mips_asm_file_end (void)
+ #define TARGET_ASM_FILE_END mips_asm_file_end
+
+
++#undef TARGET_ASM_FILE_END
++#define TARGET_ASM_FILE_END file_end_indicate_exec_stack
++
+ struct gcc_target targetm = TARGET_INITIALIZER;
+ \f
+ #include "gt-mips.h"
+--- a/libgcc/config/mips/crti.S
++++ b/libgcc/config/mips/crti.S
+@@ -24,6 +24,10 @@ see the files COPYING3 and COPYING.RUNTI
+ /* An executable stack is *not* required for these functions. */
+ #include "gnustack.h"
+
++
++/* An executable stack is *not* required for these functions. */
++ .section .note.GNU-stack,"",%progbits
++
+ /* 4 slots for argument spill area. 1 for cpreturn, 1 for stack.
+ Return spill offset of 40 and 20. Aligned to 16 bytes for n32. */
+
+--- a/libgcc/config/mips/crtn.S
++++ b/libgcc/config/mips/crtn.S
+@@ -24,6 +24,9 @@ see the files COPYING3 and COPYING.RUNTI
+ /* An executable stack is *not* required for these functions. */
+ #include "gnustack.h"
+
++/* An executable stack is *not* required for these functions. */
++ .section .note.GNU-stack,"",%progbits
++
+ /* 4 slots for argument spill area. 1 for cpreturn, 1 for stack.
+ Return spill offset of 40 and 20. Aligned to 16 bytes for n32. */
+
+--- a/libgcc/config/mips/mips16.S
++++ b/libgcc/config/mips/mips16.S
+@@ -51,6 +51,10 @@ see the files COPYING3 and COPYING.RUNTI
+ values using the soft-float calling convention, but do the actual
+ operation using the hard floating point instructions. */
+
++/* An executable stack is *not* required for these functions. */
++ .section .note.GNU-stack,"",%progbits
++ .previous
++
+ #if defined _MIPS_SIM && (_MIPS_SIM == _ABIO32 || _MIPS_SIM == _ABIO64)
+
+ /* This file contains 32-bit assembly code. */
+--- a/libgcc/config/mips/vr4120-div.S
++++ b/libgcc/config/mips/vr4120-div.S
+@@ -29,6 +29,10 @@ see the files COPYING3 and COPYING.RUNTI
+ -mfix-vr4120. div and ddiv do not give the correct result when one
+ of the operands is negative. */
+
++/* An executable stack is *not* required for these functions. */
++ .section .note.GNU-stack,"",%progbits
++ .previous
++
+ .set nomips16
+
+ #define DIV \
--- /dev/null
+From c0c62fa4256f805389f16ebfc4a60cf789129b50 Mon Sep 17 00:00:00 2001
+From: BangLang Huang <banglang.huang@foxmail.com>
+Date: Wed, 9 Nov 2016 10:36:49 +0800
+Subject: [PATCH] libffi: fix MIPS softfloat build issue
+
+Backported from github.com/libffi/libffi#272
+
+Signed-off-by: BangLang Huang <banglang.huang@foxmail.com>
+Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
+---
+ libffi/src/mips/n32.S | 17 +++++++++++++++++
+ libffi/src/mips/o32.S | 17 +++++++++++++++++
+ 2 files changed, 34 insertions(+)
+
+--- a/libffi/src/mips/n32.S
++++ b/libffi/src/mips/n32.S
+@@ -107,6 +107,16 @@ loadregs:
+
+ REG_L t6, 3*FFI_SIZEOF_ARG($fp) # load the flags word into t6.
+
++#ifdef __mips_soft_float
++ REG_L a0, 0*FFI_SIZEOF_ARG(t9)
++ REG_L a1, 1*FFI_SIZEOF_ARG(t9)
++ REG_L a2, 2*FFI_SIZEOF_ARG(t9)
++ REG_L a3, 3*FFI_SIZEOF_ARG(t9)
++ REG_L a4, 4*FFI_SIZEOF_ARG(t9)
++ REG_L a5, 5*FFI_SIZEOF_ARG(t9)
++ REG_L a6, 6*FFI_SIZEOF_ARG(t9)
++ REG_L a7, 7*FFI_SIZEOF_ARG(t9)
++#else
+ and t4, t6, ((1<<FFI_FLAG_BITS)-1)
+ REG_L a0, 0*FFI_SIZEOF_ARG(t9)
+ beqz t4, arg1_next
+@@ -193,6 +203,7 @@ arg7_next:
+ arg8_doublep:
+ l.d $f19, 7*FFI_SIZEOF_ARG(t9)
+ arg8_next:
++#endif
+
+ callit:
+ # Load the function pointer
+@@ -214,6 +225,7 @@ retint:
+ b epilogue
+
+ retfloat:
++#ifndef __mips_soft_float
+ bne t6, FFI_TYPE_FLOAT, retdouble
+ jal t9
+ REG_L t4, 4*FFI_SIZEOF_ARG($fp)
+@@ -272,6 +284,7 @@ retstruct_f_d:
+ s.s $f0, 0(t4)
+ s.d $f2, 8(t4)
+ b epilogue
++#endif
+
+ retstruct_d_soft:
+ bne t6, FFI_TYPE_STRUCT_D_SOFT, retstruct_f_soft
+@@ -429,6 +442,7 @@ ffi_closure_N32:
+ REG_S a6, A6_OFF2($sp)
+ REG_S a7, A7_OFF2($sp)
+
++#ifndef __mips_soft_float
+ # Store all possible float/double registers.
+ s.d $f12, F12_OFF2($sp)
+ s.d $f13, F13_OFF2($sp)
+@@ -438,6 +452,7 @@ ffi_closure_N32:
+ s.d $f17, F17_OFF2($sp)
+ s.d $f18, F18_OFF2($sp)
+ s.d $f19, F19_OFF2($sp)
++#endif
+
+ # Call ffi_closure_mips_inner_N32 to do the real work.
+ LA t9, ffi_closure_mips_inner_N32
+@@ -458,6 +473,7 @@ cls_retint:
+ b cls_epilogue
+
+ cls_retfloat:
++#ifndef __mips_soft_float
+ bne v0, FFI_TYPE_FLOAT, cls_retdouble
+ l.s $f0, V0_OFF2($sp)
+ b cls_epilogue
+@@ -500,6 +516,7 @@ cls_retstruct_f_d:
+ l.s $f0, V0_OFF2($sp)
+ l.d $f2, V1_OFF2($sp)
+ b cls_epilogue
++#endif
+
+ cls_retstruct_small2:
+ REG_L v0, V0_OFF2($sp)
+--- a/libffi/src/mips/o32.S
++++ b/libffi/src/mips/o32.S
+@@ -82,13 +82,16 @@ sixteen:
+
+ ADDU $sp, 4 * FFI_SIZEOF_ARG # adjust $sp to new args
+
++#ifndef __mips_soft_float
+ bnez t0, pass_d # make it quick for int
++#endif
+ REG_L a0, 0*FFI_SIZEOF_ARG($sp) # just go ahead and load the
+ REG_L a1, 1*FFI_SIZEOF_ARG($sp) # four regs.
+ REG_L a2, 2*FFI_SIZEOF_ARG($sp)
+ REG_L a3, 3*FFI_SIZEOF_ARG($sp)
+ b call_it
+
++#ifndef __mips_soft_float
+ pass_d:
+ bne t0, FFI_ARGS_D, pass_f
+ l.d $f12, 0*FFI_SIZEOF_ARG($sp) # load $fp regs from args
+@@ -130,6 +133,7 @@ pass_f_d:
+ # bne t0, FFI_ARGS_F_D, call_it
+ l.s $f12, 0*FFI_SIZEOF_ARG($sp) # load $fp regs from args
+ l.d $f14, 2*FFI_SIZEOF_ARG($sp) # passing double and float
++#endif
+
+ call_it:
+ # Load the function pointer
+@@ -158,14 +162,23 @@ retfloat:
+ bne t2, FFI_TYPE_FLOAT, retdouble
+ jalr t9
+ REG_L t0, SIZEOF_FRAME + 4*FFI_SIZEOF_ARG($fp)
++#ifndef __mips_soft_float
+ s.s $f0, 0(t0)
++#else
++ REG_S v0, 0(t0)
++#endif
+ b epilogue
+
+ retdouble:
+ bne t2, FFI_TYPE_DOUBLE, noretval
+ jalr t9
+ REG_L t0, SIZEOF_FRAME + 4*FFI_SIZEOF_ARG($fp)
++#ifndef __mips_soft_float
+ s.d $f0, 0(t0)
++#else
++ REG_S v1, 4(t0)
++ REG_S v0, 0(t0)
++#endif
+ b epilogue
+
+ noretval:
+@@ -261,9 +274,11 @@ $LCFI7:
+ li $13, 1 # FFI_O32
+ bne $16, $13, 1f # Skip fp save if FFI_O32_SOFT_FLOAT
+
++#ifndef __mips_soft_float
+ # Store all possible float/double registers.
+ s.d $f12, FA_0_0_OFF2($fp)
+ s.d $f14, FA_1_0_OFF2($fp)
++#endif
+ 1:
+ # Call ffi_closure_mips_inner_O32 to do the work.
+ la t9, ffi_closure_mips_inner_O32
+@@ -281,6 +296,7 @@ $LCFI7:
+ li $13, 1 # FFI_O32
+ bne $16, $13, 1f # Skip fp restore if FFI_O32_SOFT_FLOAT
+
++#ifndef __mips_soft_float
+ li $9, FFI_TYPE_FLOAT
+ l.s $f0, V0_OFF2($fp)
+ beq $8, $9, closure_done
+@@ -288,6 +304,7 @@ $LCFI7:
+ li $9, FFI_TYPE_DOUBLE
+ l.d $f0, V0_OFF2($fp)
+ beq $8, $9, closure_done
++#endif
+ 1:
+ REG_L $3, V1_OFF2($fp)
+ REG_L $2, V0_OFF2($fp)
--- /dev/null
+From dda6b050cd74a352670787a294596a9c56c21327 Mon Sep 17 00:00:00 2001
+From: Yousong Zhou <yszhou4tech@gmail.com>
+Date: Fri, 4 May 2018 18:20:53 +0800
+Subject: [PATCH] gotools: fix compilation when making cross compiler
+
+libgo is "the runtime support library for the Go programming language.
+This library is intended for use with the Go frontend."
+
+gccgo will link target files with libgo.so which depends on libgcc_s.so.1, but
+the linker will complain that it cannot find it. That's because shared libgcc
+is not present in the install directory yet. libgo.so was made without problem
+because gcc will emit -lgcc_s when compiled with -shared option. When gotools
+were being made, it was supplied with -static-libgcc thus no link option was
+provided. Check LIBGO in gcc/go/gcc-spec.c for how gccgo make a builtin spec
+for linking with libgo.so
+
+- GccgoCrossCompilation, https://github.com/golang/go/wiki/GccgoCrossCompilation
+- Cross-building instructions, http://www.eglibc.org/archives/patches/msg00078.html
+
+When 3-pass GCC compilation is used, shared libgcc runtime libraries will be
+available after gcc pass2 completed and will meet the gotools link requirement
+at gcc pass3
+---
+ gotools/Makefile.am | 4 +++-
+ gotools/Makefile.in | 4 +++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/gotools/Makefile.am
++++ b/gotools/Makefile.am
+@@ -26,6 +26,7 @@ PWD_COMMAND = $${PWDCMD-pwd}
+ STAMP = echo timestamp >
+
+ libgodir = ../$(target_noncanonical)/libgo
++libgccdir = ../$(target_noncanonical)/libgcc
+ LIBGODEP = $(libgodir)/libgo.la
+
+ LIBGOTOOL = $(libgodir)/libgotool.a
+@@ -41,7 +42,8 @@ GOCFLAGS = $(CFLAGS_FOR_TARGET)
+ GOCOMPILE = $(GOCOMPILER) $(GOCFLAGS)
+
+ AM_GOCFLAGS = -I $(libgodir)
+-AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs
++AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs \
++ -L $(libgccdir) -L $(libgccdir)/.libs -lgcc_s
+ GOLINK = $(GOCOMPILER) $(GOCFLAGS) $(AM_GOCFLAGS) $(LDFLAGS) $(AM_LDFLAGS) -o $@
+
+ libgosrcdir = $(srcdir)/../libgo/go
+--- a/gotools/Makefile.in
++++ b/gotools/Makefile.in
+@@ -337,6 +337,7 @@ mkinstalldirs = $(SHELL) $(toplevel_srcd
+ PWD_COMMAND = $${PWDCMD-pwd}
+ STAMP = echo timestamp >
+ libgodir = ../$(target_noncanonical)/libgo
++libgccdir = ../$(target_noncanonical)/libgcc
+ LIBGODEP = $(libgodir)/libgo.la
+ LIBGOTOOL = $(libgodir)/libgotool.a
+ @NATIVE_FALSE@GOCOMPILER = $(GOC)
+@@ -346,7 +347,8 @@ LIBGOTOOL = $(libgodir)/libgotool.a
+ GOCFLAGS = $(CFLAGS_FOR_TARGET)
+ GOCOMPILE = $(GOCOMPILER) $(GOCFLAGS)
+ AM_GOCFLAGS = -I $(libgodir)
+-AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs
++AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs \
++ -L $(libgccdir) -L $(libgccdir)/.libs -lgcc_s
+ GOLINK = $(GOCOMPILER) $(GOCFLAGS) $(AM_GOCFLAGS) $(LDFLAGS) $(AM_LDFLAGS) -o $@
+ libgosrcdir = $(srcdir)/../libgo/go
+ cmdsrcdir = $(libgosrcdir)/cmd
--- /dev/null
+commit 81cc26c706b2bc8c8c1eb1a322e5c5157900836e
+Author: Felix Fietkau <nbd@openwrt.org>
+Date: Sun Oct 19 21:45:51 2014 +0000
+
+ gcc: do not assume that the Mac OS X filesystem is case insensitive
+
+ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+
+ SVN-Revision: 42973
+
+--- a/include/filenames.h
++++ b/include/filenames.h
+@@ -44,11 +44,6 @@ extern "C" {
+ # define IS_DIR_SEPARATOR(c) IS_DOS_DIR_SEPARATOR (c)
+ # define IS_ABSOLUTE_PATH(f) IS_DOS_ABSOLUTE_PATH (f)
+ #else /* not DOSish */
+-# if defined(__APPLE__)
+-# ifndef HAVE_CASE_INSENSITIVE_FILE_SYSTEM
+-# define HAVE_CASE_INSENSITIVE_FILE_SYSTEM 1
+-# endif
+-# endif /* __APPLE__ */
+ # define HAS_DRIVE_SPEC(f) (0)
+ # define IS_DIR_SEPARATOR(c) IS_UNIX_DIR_SEPARATOR (c)
+ # define IS_ABSOLUTE_PATH(f) IS_UNIX_ABSOLUTE_PATH (f)
--- /dev/null
+--- a/gcc/real.h
++++ b/gcc/real.h
+@@ -77,8 +77,10 @@ struct GTY(()) real_value {
+ + (REAL_VALUE_TYPE_SIZE%HOST_BITS_PER_WIDE_INT ? 1 : 0)) /* round up */
+
+ /* Verify the guess. */
++#ifndef __LP64__
+ extern char test_real_width
+ [sizeof (REAL_VALUE_TYPE) <= REAL_WIDTH * sizeof (HOST_WIDE_INT) ? 1 : -1];
++#endif
+
+ /* Calculate the format for CONST_DOUBLE. We need as many slots as
+ are necessary to overlay a REAL_VALUE_TYPE on them. This could be
--- /dev/null
+commit 098bd91f5eae625c7d2ee621e10930fc4434e5e2
+Author: Luka Perkov <luka@openwrt.org>
+Date: Tue Feb 26 16:16:33 2013 +0000
+
+ gcc: don't build documentation
+
+ This closes #13039.
+
+ Signed-off-by: Luka Perkov <luka@openwrt.org>
+
+ SVN-Revision: 35807
+
+--- a/gcc/Makefile.in
++++ b/gcc/Makefile.in
+@@ -3348,18 +3348,10 @@ doc/gcc.info: $(TEXI_GCC_FILES)
+ doc/gccint.info: $(TEXI_GCCINT_FILES)
+ doc/cppinternals.info: $(TEXI_CPPINT_FILES)
+
+-doc/%.info: %.texi
+- if [ x$(BUILD_INFO) = xinfo ]; then \
+- $(MAKEINFO) $(MAKEINFOFLAGS) -I . -I $(gcc_docdir) \
+- -I $(gcc_docdir)/include -o $@ $<; \
+- fi
++doc/%.info:
+
+ # Duplicate entry to handle renaming of gccinstall.info
+-doc/gccinstall.info: $(TEXI_GCCINSTALL_FILES)
+- if [ x$(BUILD_INFO) = xinfo ]; then \
+- $(MAKEINFO) $(MAKEINFOFLAGS) -I $(gcc_docdir) \
+- -I $(gcc_docdir)/include -o $@ $<; \
+- fi
++doc/gccinstall.info:
+
+ doc/cpp.dvi: $(TEXI_CPP_FILES)
+ doc/gcc.dvi: $(TEXI_GCC_FILES)
--- /dev/null
+From ea650cae26da4a8fc04f0c4666f4dd776d0b5fc0 Mon Sep 17 00:00:00 2001
+From: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
+Date: Sun, 14 Nov 2021 21:54:25 -0800
+Subject: [PATCH] configure: define TARGET_LIBC_GNUSTACK on musl
+
+musl only uses PT_GNU_STACK to set default thread stack size and has no
+executable stack support[0], so there is no reason not to emit the
+.note.GNU-stack section on musl builds.
+
+[0]: https://lore.kernel.org/all/20190423192534.GN23599@brightrain.aerifal.cx/T/#u
+
+gcc/ChangeLog:
+
+ * configure: Regenerate.
+ * configure.ac: define TARGET_LIBC_GNUSTACK on musl
+
+Signed-off-by: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
+---
+ gcc/configure | 3 +++
+ gcc/configure.ac | 3 +++
+ 2 files changed, 6 insertions(+)
+
+--- a/gcc/configure
++++ b/gcc/configure
+@@ -31533,6 +31533,9 @@ fi
+ # Check if the target LIBC handles PT_GNU_STACK.
+ gcc_cv_libc_gnustack=unknown
+ case "$target" in
++ mips*-*-linux-musl*)
++ gcc_cv_libc_gnustack=yes
++ ;;
+ mips*-*-linux*)
+
+ if test $glibc_version_major -gt 2 \
+--- a/gcc/configure.ac
++++ b/gcc/configure.ac
+@@ -7023,6 +7023,9 @@ fi
+ # Check if the target LIBC handles PT_GNU_STACK.
+ gcc_cv_libc_gnustack=unknown
+ case "$target" in
++ mips*-*-linux-musl*)
++ gcc_cv_libc_gnustack=yes
++ ;;
+ mips*-*-linux*)
+ GCC_GLIBC_VERSION_GTE_IFELSE([2], [31], [gcc_cv_libc_gnustack=yes], )
+ ;;
--- /dev/null
+Fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84790.
+MIPS16 functions have a static assembler prologue which clobbers
+registers v0 and v1. Add these register clobbers to function call
+instructions.
+
+--- a/gcc/config/mips/mips.c
++++ b/gcc/config/mips/mips.c
+@@ -3132,6 +3132,12 @@ mips_emit_call_insn (rtx pattern, rtx or
+ emit_insn (gen_update_got_version ());
+ }
+
++ if (TARGET_MIPS16 && TARGET_USE_GOT)
++ {
++ clobber_reg (&CALL_INSN_FUNCTION_USAGE (insn), MIPS16_PIC_TEMP);
++ clobber_reg (&CALL_INSN_FUNCTION_USAGE (insn), MIPS_PROLOGUE_TEMP (word_mode));
++ }
++
+ if (TARGET_MIPS16
+ && TARGET_EXPLICIT_RELOCS
+ && TARGET_CALL_CLOBBERED_GP)
--- /dev/null
+--- a/gcc/gcc.c
++++ b/gcc/gcc.c
+@@ -978,7 +978,9 @@ proper position among the other output f
+ #endif
+
+ #ifndef LINK_SSP_SPEC
+-#ifdef TARGET_LIBC_PROVIDES_SSP
++#if DEFAULT_LIBC == LIBC_MUSL
++#define LINK_SSP_SPEC "-lssp_nonshared"
++#elif defined(TARGET_LIBC_PROVIDES_SSP)
+ #define LINK_SSP_SPEC "%{fstack-protector|fstack-protector-all" \
+ "|fstack-protector-strong|fstack-protector-explicit:}"
+ #else
--- /dev/null
+commit ecf7671b769fe96f7b5134be442089f8bdba55d2
+Author: Felix Fietkau <nbd@nbd.name>
+Date: Thu Aug 4 20:29:45 2016 +0200
+
+gcc: add a patch to generate better code with Os on mips
+
+Also happens to reduce compressed code size a bit
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+
+--- a/gcc/config/mips/mips.c
++++ b/gcc/config/mips/mips.c
+@@ -20041,7 +20041,7 @@ mips_option_override (void)
+ flag_pcc_struct_return = 0;
+
+ /* Decide which rtx_costs structure to use. */
+- if (optimize_size)
++ if (0 && optimize_size)
+ mips_cost = &mips_rtx_cost_optimize_size;
+ else
+ mips_cost = &mips_rtx_cost_data[mips_tune];
--- /dev/null
+commit 8570c4be394cff7282f332f97da2ff569a927ddb
+Author: Imre Kaloz <kaloz@openwrt.org>
+Date: Wed Feb 2 20:06:12 2011 +0000
+
+ fixup arm soft-float symbols
+
+ SVN-Revision: 25325
+
+--- a/libgcc/config/arm/t-linux
++++ b/libgcc/config/arm/t-linux
+@@ -1,6 +1,10 @@
+ LIB1ASMSRC = arm/lib1funcs.S
+ LIB1ASMFUNCS = _udivsi3 _divsi3 _umodsi3 _modsi3 _dvmd_lnx _clzsi2 _clzdi2 \
+- _ctzsi2 _arm_addsubdf3 _arm_addsubsf3
++ _ctzsi2 _arm_addsubdf3 _arm_addsubsf3 \
++ _arm_negdf2 _arm_muldivdf3 _arm_cmpdf2 _arm_unorddf2 \
++ _arm_fixdfsi _arm_fixunsdfsi _arm_truncdfsf2 \
++ _arm_negsf2 _arm_muldivsf3 _arm_cmpsf2 _arm_unordsf2 \
++ _arm_fixsfsi _arm_fixunssfsi
+
+ # Just for these, we omit the frame pointer since it makes such a big
+ # difference.
+--- a/gcc/config/arm/linux-elf.h
++++ b/gcc/config/arm/linux-elf.h
+@@ -58,8 +58,6 @@
+ %{shared:-lc} \
+ %{!shared:%{profile:-lc_p}%{!profile:-lc}}"
+
+-#define LIBGCC_SPEC "%{mfloat-abi=soft*:-lfloat} -lgcc"
+-
+ #define GLIBC_DYNAMIC_LINKER "/lib/ld-linux.so.2"
+
+ #define LINUX_TARGET_LINK_SPEC "%{h*} \
--- /dev/null
+commit c96312958c0621e72c9b32da5bc224ffe2161384
+Author: Felix Fietkau <nbd@openwrt.org>
+Date: Mon Oct 19 23:26:09 2009 +0000
+
+ gcc: create a proper libgcc_pic.a static library for relinking (4.3.3+ for now, backport will follow)
+
+ SVN-Revision: 18086
+
+--- a/libgcc/Makefile.in
++++ b/libgcc/Makefile.in
+@@ -930,11 +930,12 @@ $(libgcov-driver-objects): %$(objext): $
+
+ # Static libraries.
+ libgcc.a: $(libgcc-objects)
++libgcc_pic.a: $(libgcc-s-objects)
+ libgcov.a: $(libgcov-objects)
+ libunwind.a: $(libunwind-objects)
+ libgcc_eh.a: $(libgcc-eh-objects)
+
+-libgcc.a libgcov.a libunwind.a libgcc_eh.a:
++libgcc.a libgcov.a libunwind.a libgcc_eh.a libgcc_pic.a:
+ -rm -f $@
+
+ objects="$(objects)"; \
+@@ -958,7 +959,7 @@ all: libunwind.a
+ endif
+
+ ifeq ($(enable_shared),yes)
+-all: libgcc_eh.a libgcc_s$(SHLIB_EXT)
++all: libgcc_eh.a libgcc_pic.a libgcc_s$(SHLIB_EXT)
+ ifneq ($(LIBUNWIND),)
+ all: libunwind$(SHLIB_EXT)
+ libgcc_s$(SHLIB_EXT): libunwind$(SHLIB_EXT)
+@@ -1164,6 +1165,10 @@ install-shared:
+ chmod 644 $(DESTDIR)$(inst_libdir)/libgcc_eh.a
+ $(RANLIB) $(DESTDIR)$(inst_libdir)/libgcc_eh.a
+
++ $(INSTALL_DATA) libgcc_pic.a $(mapfile) $(DESTDIR)$(inst_libdir)/
++ chmod 644 $(DESTDIR)$(inst_libdir)/libgcc_pic.a
++ $(RANLIB) $(DESTDIR)$(inst_libdir)/libgcc_pic.a
++
+ $(subst @multilib_dir@,$(MULTIDIR),$(subst \
+ @shlib_base_name@,libgcc_s,$(subst \
+ @shlib_slibdir_qual@,$(MULTIOSSUBDIR),$(SHLIB_INSTALL))))
--- /dev/null
+commit 7edc8ca5456d9743dd0075eb3cc5b04f4f24c8cc
+Author: Imre Kaloz <kaloz@openwrt.org>
+Date: Wed Feb 2 19:34:36 2011 +0000
+
+ add armv4 fixup patches
+
+ SVN-Revision: 25322
+
+
+--- a/gcc/config/arm/linux-eabi.h
++++ b/gcc/config/arm/linux-eabi.h
+@@ -91,10 +91,15 @@
+ #define MUSL_DYNAMIC_LINKER \
+ "/lib/ld-musl-arm" MUSL_DYNAMIC_LINKER_E "%{mfloat-abi=hard:hf}%{mfdpic:-fdpic}.so.1"
+
++/* For armv4 we pass --fix-v4bx to linker to support EABI */
++#undef TARGET_FIX_V4BX_SPEC
++#define TARGET_FIX_V4BX_SPEC " %{mcpu=arm8|mcpu=arm810|mcpu=strongarm*"\
++ "|march=armv4|mcpu=fa526|mcpu=fa626:--fix-v4bx}"
++
+ /* At this point, bpabi.h will have clobbered LINK_SPEC. We want to
+ use the GNU/Linux version, not the generic BPABI version. */
+ #undef LINK_SPEC
+-#define LINK_SPEC EABI_LINK_SPEC \
++#define LINK_SPEC EABI_LINK_SPEC TARGET_FIX_V4BX_SPEC \
+ LINUX_OR_ANDROID_LD (LINUX_TARGET_LINK_SPEC, \
+ LINUX_TARGET_LINK_SPEC " " ANDROID_LINK_SPEC)
+
--- /dev/null
+commit dcfc40358b5a3cae7320c17f8d1cebd5ad5540cd
+Author: Felix Fietkau <nbd@openwrt.org>
+Date: Sun Feb 12 20:25:47 2012 +0000
+
+ gcc 4.6: port over the missing patch 850-use_shared_libgcc.patch to prevent libgcc crap from leaking into every single binary
+
+ SVN-Revision: 30486
+--- a/gcc/config/arm/linux-eabi.h
++++ b/gcc/config/arm/linux-eabi.h
+@@ -132,10 +132,6 @@
+ "%{Ofast|ffast-math|funsafe-math-optimizations:crtfastmath.o%s} " \
+ LINUX_OR_ANDROID_LD (GNU_USER_TARGET_ENDFILE_SPEC, ANDROID_ENDFILE_SPEC)
+
+-/* Use the default LIBGCC_SPEC, not the version in linux-elf.h, as we
+- do not use -lfloat. */
+-#undef LIBGCC_SPEC
+-
+ /* Clear the instruction cache from `beg' to `end'. This is
+ implemented in lib1funcs.S, so ensure an error if this definition
+ is used. */
+--- a/gcc/config/linux.h
++++ b/gcc/config/linux.h
+@@ -66,6 +66,10 @@ see the files COPYING3 and COPYING.RUNTI
+ builtin_version ("CRuntime_Musl"); \
+ } while (0)
+
++#ifndef LIBGCC_SPEC
++#define LIBGCC_SPEC "%{static|static-libgcc:-lgcc}%{!static:%{!static-libgcc:-lgcc_s}}"
++#endif
++
+ /* Determine which dynamic linker to use depending on whether GLIBC or
+ uClibc or Bionic or musl is the default C library and whether
+ -muclibc or -mglibc or -mbionic or -mmusl has been passed to change
+--- a/libgcc/mkmap-symver.awk
++++ b/libgcc/mkmap-symver.awk
+@@ -136,5 +136,5 @@ function output(lib) {
+ else if (inherit[lib])
+ printf("} %s;\n", inherit[lib]);
+ else
+- printf ("\n local:\n\t*;\n};\n");
++ printf ("\n\t*;\n};\n");
+ }
+--- a/gcc/config/rs6000/linux.h
++++ b/gcc/config/rs6000/linux.h
+@@ -62,6 +62,9 @@
+ #undef CPP_OS_DEFAULT_SPEC
+ #define CPP_OS_DEFAULT_SPEC "%(cpp_os_linux)"
+
++#undef LIBGCC_SPEC
++#define LIBGCC_SPEC "%{!static:%{!static-libgcc:-lgcc_s}} -lgcc"
++
+ #undef LINK_SHLIB_SPEC
+ #define LINK_SHLIB_SPEC "%{shared:-shared} %{!shared: %{static:-static}} \
+ %{static-pie:-static -pie --no-dynamic-linker -z text}"
--- /dev/null
+commit 64661de100da1ec1061ef3e5e400285dce115e6b
+Author: Felix Fietkau <nbd@openwrt.org>
+Date: Sun May 10 13:16:35 2015 +0000
+
+ gcc: add some size optimization patches
+
+ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+
+ SVN-Revision: 45664
+
+--- a/libgcc/config/t-libunwind
++++ b/libgcc/config/t-libunwind
+@@ -2,8 +2,7 @@
+
+ HOST_LIBGCC2_CFLAGS += -DUSE_GAS_SYMVER
+
+-LIB2ADDEH = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c \
+- $(srcdir)/unwind-compat.c $(srcdir)/unwind-dw2-fde-compat.c
++LIB2ADDEH = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c
+ LIB2ADDEHSTATIC = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c
+
+ # Override the default value from t-slibgcc-elf-ver and mention -lunwind
--- /dev/null
+--- a/gcc/config/rs6000/rs6000-logue.c
++++ b/gcc/config/rs6000/rs6000-logue.c
+@@ -348,7 +348,7 @@ rs6000_savres_strategy (rs6000_stack_t *
+ /* Define cutoff for using out-of-line functions to save registers. */
+ if (DEFAULT_ABI == ABI_V4 || TARGET_ELF)
+ {
+- if (!optimize_size)
++ if (1)
+ {
+ strategy |= SAVE_INLINE_FPRS | REST_INLINE_FPRS;
+ strategy |= SAVE_INLINE_GPRS | REST_INLINE_GPRS;
--- /dev/null
+--- a/libgcc/crtstuff.c
++++ b/libgcc/crtstuff.c
+@@ -152,7 +152,7 @@ call_ ## FUNC (void) \
+ #endif
+
+ #if !defined(USE_TM_CLONE_REGISTRY) && defined(OBJECT_FORMAT_ELF)
+-# define USE_TM_CLONE_REGISTRY 1
++# define USE_TM_CLONE_REGISTRY 0
+ #elif !defined(USE_TM_CLONE_REGISTRY)
+ # define USE_TM_CLONE_REGISTRY 0
+ #endif
--- /dev/null
+--- a/libgcc/config/mips/t-mips16
++++ b/libgcc/config/mips/t-mips16
+@@ -43,3 +43,6 @@ SYNC_CFLAGS = -mno-mips16
+
+ # Version these symbols if building libgcc.so.
+ SHLIB_MAPFILES += $(srcdir)/config/mips/libgcc-mips16.ver
++
++CRTSTUFF_T_CFLAGS += -mno-mips16
++CRTSTUFF_T_CFLAGS_S += -mno-mips16
--- /dev/null
+commit 99368862e44740ff4fd33760893f04e14f9dbdf1
+Author: Felix Fietkau <nbd@openwrt.org>
+Date: Tue Jul 31 00:52:27 2007 +0000
+
+ Port the mbsd_multi patch from freewrt, which adds -fhonour-copts. This will emit warnings in packages that don't use our target cflags properly
+
+ SVN-Revision: 8256
+
+ This patch brings over a feature from MirBSD:
+ * -fhonour-copts
+ If this option is not given, it's warned (depending
+ on environment variables). This is to catch errors
+ of misbuilt packages which override CFLAGS themselves.
+
+ This patch was authored by Thorsten Glaser <tg at mirbsd.de>
+ with copyright assignment to the FSF in effect.
+
+--- a/gcc/c-family/c-opts.c
++++ b/gcc/c-family/c-opts.c
+@@ -107,6 +107,9 @@ static dump_flags_t original_dump_flags;
+ /* Whether any standard preincluded header has been preincluded. */
+ static bool done_preinclude;
+
++/* Check if a port honours COPTS. */
++static int honour_copts = 0;
++
+ static void handle_OPT_d (const char *);
+ static void set_std_cxx98 (int);
+ static void set_std_cxx11 (int);
+@@ -469,6 +472,12 @@ c_common_handle_option (size_t scode, co
+ flag_no_builtin = !value;
+ break;
+
++ case OPT_fhonour_copts:
++ if (c_language == clk_c) {
++ honour_copts++;
++ }
++ break;
++
+ case OPT_fconstant_string_class_:
+ constant_string_class_name = arg;
+ break;
+@@ -1198,6 +1207,47 @@ c_common_init (void)
+ return false;
+ }
+
++ if (c_language == clk_c) {
++ char *ev = getenv ("GCC_HONOUR_COPTS");
++ int evv;
++ if (ev == NULL)
++ evv = -1;
++ else if ((*ev == '0') || (*ev == '\0'))
++ evv = 0;
++ else if (*ev == '1')
++ evv = 1;
++ else if (*ev == '2')
++ evv = 2;
++ else if (*ev == 's')
++ evv = -1;
++ else {
++ warning (0, "unknown GCC_HONOUR_COPTS value, assuming 1");
++ evv = 1; /* maybe depend this on something like MIRBSD_NATIVE? */
++ }
++ if (evv == 1) {
++ if (honour_copts == 0) {
++ error ("someone does not honour COPTS at all in lenient mode");
++ return false;
++ } else if (honour_copts != 1) {
++ warning (0, "someone does not honour COPTS correctly, passed %d times",
++ honour_copts);
++ }
++ } else if (evv == 2) {
++ if (honour_copts == 0) {
++ error ("someone does not honour COPTS at all in strict mode");
++ return false;
++ } else if (honour_copts != 1) {
++ error ("someone does not honour COPTS correctly, passed %d times",
++ honour_copts);
++ return false;
++ }
++ } else if (evv == 0) {
++ if (honour_copts != 1)
++ inform (UNKNOWN_LOCATION, "someone does not honour COPTS correctly, passed %d times",
++ honour_copts);
++ }
++ }
++
+ return true;
+ }
+
+--- a/gcc/c-family/c.opt
++++ b/gcc/c-family/c.opt
+@@ -1663,6 +1663,9 @@ C++ ObjC++ Optimization Alias(fexception
+ fhonor-std
+ C++ ObjC++ WarnRemoved
+
++fhonour-copts
++C ObjC C++ ObjC++ RejectNegative
++
+ fhosted
+ C ObjC
+ Assume normal C execution environment.
+--- a/gcc/common.opt
++++ b/gcc/common.opt
+@@ -1698,6 +1698,9 @@ fguess-branch-probability
+ Common Var(flag_guess_branch_prob) Optimization
+ Enable guessing of branch probabilities.
+
++fhonour-copts
++Common RejectNegative
++
+ ; Nonzero means ignore `#ident' directives. 0 means handle them.
+ ; Generate position-independent code for executables if possible
+ ; On SVR4 targets, it also controls whether or not to emit a
+--- a/gcc/doc/invoke.texi
++++ b/gcc/doc/invoke.texi
+@@ -9058,6 +9058,17 @@ This option is only supported for C and
+ @option{-Wall} and by @option{-Wpedantic}, which can be disabled with
+ @option{-Wno-pointer-sign}.
+
++@item -fhonour-copts
++@opindex fhonour-copts
++If @env{GCC_HONOUR_COPTS} is set to 1, abort if this option is not
++given at least once, and warn if it is given more than once.
++If @env{GCC_HONOUR_COPTS} is set to 2, abort if this option is not
++given exactly once.
++If @env{GCC_HONOUR_COPTS} is set to 0 or unset, warn if this option
++is not given exactly once.
++The warning is quelled if @env{GCC_HONOUR_COPTS} is set to @samp{s}.
++This flag and environment variable only affect the C language.
++
+ @item -Wstack-protector
+ @opindex Wstack-protector
+ @opindex Wno-stack-protector
+--- a/gcc/opts.c
++++ b/gcc/opts.c
+@@ -2448,6 +2448,9 @@ common_handle_option (struct gcc_options
+ /* Currently handled in a prescan. */
+ break;
+
++ case OPT_fhonour_copts:
++ break;
++
+ case OPT_Werror:
+ dc->warning_as_error_requested = value;
+ break;
--- /dev/null
+Author: Jo-Philipp Wich <jow@openwrt.org>
+Date: Sat Apr 21 03:02:39 2012 +0000
+
+ gcc: add patch to make the getenv() spec function nonfatal if requested environment variable is unset
+
+ SVN-Revision: 31390
+
+--- a/gcc/gcc.c
++++ b/gcc/gcc.c
+@@ -10106,8 +10106,10 @@ getenv_spec_function (int argc, const ch
+ }
+
+ if (!value)
+- fatal_error (input_location,
+- "environment variable %qs not defined", varname);
++ {
++ warning (input_location, "environment variable %qs not defined", varname);
++ value = "";
++ }
+
+ /* We have to escape every character of the environment variable so
+ they are not interpreted as active spec characters. A
--- /dev/null
+From c0c62fa4256f805389f16ebfc4a60cf789129b50 Mon Sep 17 00:00:00 2001
+From: BangLang Huang <banglang.huang@foxmail.com>
+Date: Wed, 9 Nov 2016 10:36:49 +0800
+Subject: [PATCH] libffi: fix MIPS softfloat build issue
+
+Backported from github.com/libffi/libffi#272
+
+Signed-off-by: BangLang Huang <banglang.huang@foxmail.com>
+Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
+---
+ libffi/src/mips/n32.S | 17 +++++++++++++++++
+ libffi/src/mips/o32.S | 17 +++++++++++++++++
+ 2 files changed, 34 insertions(+)
+
+--- a/libffi/src/mips/n32.S
++++ b/libffi/src/mips/n32.S
+@@ -107,6 +107,16 @@ loadregs:
+
+ REG_L t6, 3*FFI_SIZEOF_ARG($fp) # load the flags word into t6.
+
++#ifdef __mips_soft_float
++ REG_L a0, 0*FFI_SIZEOF_ARG(t9)
++ REG_L a1, 1*FFI_SIZEOF_ARG(t9)
++ REG_L a2, 2*FFI_SIZEOF_ARG(t9)
++ REG_L a3, 3*FFI_SIZEOF_ARG(t9)
++ REG_L a4, 4*FFI_SIZEOF_ARG(t9)
++ REG_L a5, 5*FFI_SIZEOF_ARG(t9)
++ REG_L a6, 6*FFI_SIZEOF_ARG(t9)
++ REG_L a7, 7*FFI_SIZEOF_ARG(t9)
++#else
+ and t4, t6, ((1<<FFI_FLAG_BITS)-1)
+ REG_L a0, 0*FFI_SIZEOF_ARG(t9)
+ beqz t4, arg1_next
+@@ -193,6 +203,7 @@ arg7_next:
+ arg8_doublep:
+ l.d $f19, 7*FFI_SIZEOF_ARG(t9)
+ arg8_next:
++#endif
+
+ callit:
+ # Load the function pointer
+@@ -214,6 +225,7 @@ retint:
+ b epilogue
+
+ retfloat:
++#ifndef __mips_soft_float
+ bne t6, FFI_TYPE_FLOAT, retdouble
+ jal t9
+ REG_L t4, 4*FFI_SIZEOF_ARG($fp)
+@@ -272,6 +284,7 @@ retstruct_f_d:
+ s.s $f0, 0(t4)
+ s.d $f2, 8(t4)
+ b epilogue
++#endif
+
+ retstruct_d_soft:
+ bne t6, FFI_TYPE_STRUCT_D_SOFT, retstruct_f_soft
+@@ -429,6 +442,7 @@ ffi_closure_N32:
+ REG_S a6, A6_OFF2($sp)
+ REG_S a7, A7_OFF2($sp)
+
++#ifndef __mips_soft_float
+ # Store all possible float/double registers.
+ s.d $f12, F12_OFF2($sp)
+ s.d $f13, F13_OFF2($sp)
+@@ -438,6 +452,7 @@ ffi_closure_N32:
+ s.d $f17, F17_OFF2($sp)
+ s.d $f18, F18_OFF2($sp)
+ s.d $f19, F19_OFF2($sp)
++#endif
+
+ # Call ffi_closure_mips_inner_N32 to do the real work.
+ LA t9, ffi_closure_mips_inner_N32
+@@ -458,6 +473,7 @@ cls_retint:
+ b cls_epilogue
+
+ cls_retfloat:
++#ifndef __mips_soft_float
+ bne v0, FFI_TYPE_FLOAT, cls_retdouble
+ l.s $f0, V0_OFF2($sp)
+ b cls_epilogue
+@@ -500,6 +516,7 @@ cls_retstruct_f_d:
+ l.s $f0, V0_OFF2($sp)
+ l.d $f2, V1_OFF2($sp)
+ b cls_epilogue
++#endif
+
+ cls_retstruct_small2:
+ REG_L v0, V0_OFF2($sp)
+--- a/libffi/src/mips/o32.S
++++ b/libffi/src/mips/o32.S
+@@ -82,13 +82,16 @@ sixteen:
+
+ ADDU $sp, 4 * FFI_SIZEOF_ARG # adjust $sp to new args
+
++#ifndef __mips_soft_float
+ bnez t0, pass_d # make it quick for int
++#endif
+ REG_L a0, 0*FFI_SIZEOF_ARG($sp) # just go ahead and load the
+ REG_L a1, 1*FFI_SIZEOF_ARG($sp) # four regs.
+ REG_L a2, 2*FFI_SIZEOF_ARG($sp)
+ REG_L a3, 3*FFI_SIZEOF_ARG($sp)
+ b call_it
+
++#ifndef __mips_soft_float
+ pass_d:
+ bne t0, FFI_ARGS_D, pass_f
+ l.d $f12, 0*FFI_SIZEOF_ARG($sp) # load $fp regs from args
+@@ -130,6 +133,7 @@ pass_f_d:
+ # bne t0, FFI_ARGS_F_D, call_it
+ l.s $f12, 0*FFI_SIZEOF_ARG($sp) # load $fp regs from args
+ l.d $f14, 2*FFI_SIZEOF_ARG($sp) # passing double and float
++#endif
+
+ call_it:
+ # Load the function pointer
+@@ -158,14 +162,23 @@ retfloat:
+ bne t2, FFI_TYPE_FLOAT, retdouble
+ jalr t9
+ REG_L t0, SIZEOF_FRAME + 4*FFI_SIZEOF_ARG($fp)
++#ifndef __mips_soft_float
+ s.s $f0, 0(t0)
++#else
++ REG_S v0, 0(t0)
++#endif
+ b epilogue
+
+ retdouble:
+ bne t2, FFI_TYPE_DOUBLE, noretval
+ jalr t9
+ REG_L t0, SIZEOF_FRAME + 4*FFI_SIZEOF_ARG($fp)
++#ifndef __mips_soft_float
+ s.d $f0, 0(t0)
++#else
++ REG_S v1, 4(t0)
++ REG_S v0, 0(t0)
++#endif
+ b epilogue
+
+ noretval:
+@@ -261,9 +274,11 @@ $LCFI7:
+ li $13, 1 # FFI_O32
+ bne $16, $13, 1f # Skip fp save if FFI_O32_SOFT_FLOAT
+
++#ifndef __mips_soft_float
+ # Store all possible float/double registers.
+ s.d $f12, FA_0_0_OFF2($fp)
+ s.d $f14, FA_1_0_OFF2($fp)
++#endif
+ 1:
+ # Call ffi_closure_mips_inner_O32 to do the work.
+ la t9, ffi_closure_mips_inner_O32
+@@ -281,6 +296,7 @@ $LCFI7:
+ li $13, 1 # FFI_O32
+ bne $16, $13, 1f # Skip fp restore if FFI_O32_SOFT_FLOAT
+
++#ifndef __mips_soft_float
+ li $9, FFI_TYPE_FLOAT
+ l.s $f0, V0_OFF2($fp)
+ beq $8, $9, closure_done
+@@ -288,6 +304,7 @@ $LCFI7:
+ li $9, FFI_TYPE_DOUBLE
+ l.d $f0, V0_OFF2($fp)
+ beq $8, $9, closure_done
++#endif
+ 1:
+ REG_L $3, V1_OFF2($fp)
+ REG_L $2, V0_OFF2($fp)
--- /dev/null
+From dda6b050cd74a352670787a294596a9c56c21327 Mon Sep 17 00:00:00 2001
+From: Yousong Zhou <yszhou4tech@gmail.com>
+Date: Fri, 4 May 2018 18:20:53 +0800
+Subject: [PATCH] gotools: fix compilation when making cross compiler
+
+libgo is "the runtime support library for the Go programming language.
+This library is intended for use with the Go frontend."
+
+gccgo will link target files with libgo.so which depends on libgcc_s.so.1, but
+the linker will complain that it cannot find it. That's because shared libgcc
+is not present in the install directory yet. libgo.so was made without problem
+because gcc will emit -lgcc_s when compiled with -shared option. When gotools
+were being made, it was supplied with -static-libgcc thus no link option was
+provided. Check LIBGO in gcc/go/gcc-spec.c for how gccgo make a builtin spec
+for linking with libgo.so
+
+- GccgoCrossCompilation, https://github.com/golang/go/wiki/GccgoCrossCompilation
+- Cross-building instructions, http://www.eglibc.org/archives/patches/msg00078.html
+
+When 3-pass GCC compilation is used, shared libgcc runtime libraries will be
+available after gcc pass2 completed and will meet the gotools link requirement
+at gcc pass3
+---
+ gotools/Makefile.am | 4 +++-
+ gotools/Makefile.in | 4 +++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/gotools/Makefile.am
++++ b/gotools/Makefile.am
+@@ -26,6 +26,7 @@ PWD_COMMAND = $${PWDCMD-pwd}
+ STAMP = echo timestamp >
+
+ libgodir = ../$(target_noncanonical)/libgo
++libgccdir = ../$(target_noncanonical)/libgcc
+ LIBGODEP = $(libgodir)/libgo.la
+
+ LIBGOTOOL = $(libgodir)/libgotool.a
+@@ -41,7 +42,8 @@ GOCFLAGS = $(CFLAGS_FOR_TARGET)
+ GOCOMPILE = $(GOCOMPILER) $(GOCFLAGS)
+
+ AM_GOCFLAGS = -I $(libgodir)
+-AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs
++AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs \
++ -L $(libgccdir) -L $(libgccdir)/.libs -lgcc_s
+ GOLINK = $(GOCOMPILER) $(GOCFLAGS) $(AM_GOCFLAGS) $(LDFLAGS) $(AM_LDFLAGS) -o $@
+
+ libgosrcdir = $(srcdir)/../libgo/go
+--- a/gotools/Makefile.in
++++ b/gotools/Makefile.in
+@@ -337,6 +337,7 @@ mkinstalldirs = $(SHELL) $(toplevel_srcd
+ PWD_COMMAND = $${PWDCMD-pwd}
+ STAMP = echo timestamp >
+ libgodir = ../$(target_noncanonical)/libgo
++libgccdir = ../$(target_noncanonical)/libgcc
+ LIBGODEP = $(libgodir)/libgo.la
+ LIBGOTOOL = $(libgodir)/libgotool.a
+ @NATIVE_FALSE@GOCOMPILER = $(GOC)
+@@ -346,7 +347,8 @@ LIBGOTOOL = $(libgodir)/libgotool.a
+ GOCFLAGS = $(CFLAGS_FOR_TARGET)
+ GOCOMPILE = $(GOCOMPILER) $(GOCFLAGS)
+ AM_GOCFLAGS = -I $(libgodir)
+-AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs
++AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs \
++ -L $(libgccdir) -L $(libgccdir)/.libs -lgcc_s
+ GOLINK = $(GOCOMPILER) $(GOCFLAGS) $(AM_GOCFLAGS) $(LDFLAGS) $(AM_LDFLAGS) -o $@
+ libgosrcdir = $(srcdir)/../libgo/go
+ cmdsrcdir = $(libgosrcdir)/cmd
--- /dev/null
+commit 9c6e71079b46ad5433165feaa2001450f2017b56
+Author: Przemysław Buczkowski <prem@prem.moe>
+Date: Mon Aug 16 13:16:21 2021 +0100
+
+ GCC: Patch for Apple Silicon compatibility
+
+ This patch fixes a linker error occuring when compiling
+ the cross-compiler on macOS and ARM64 architecture.
+
+ Adapted from:
+ https://github.com/richfelker/musl-cross-make/issues/116#issuecomment-823612404
+
+ Change-Id: Ia3ee98a163bbb62689f42e2da83a5ef36beb0913
+ Reviewed-on: https://review.haiku-os.org/c/buildtools/+/4329
+ Reviewed-by: John Scipione <jscipione@gmail.com>
+ Reviewed-by: Adrien Destugues <pulkomandy@gmail.com>
+
+--- a/gcc/config/aarch64/aarch64.h
++++ b/gcc/config/aarch64/aarch64.h
+@@ -1236,7 +1236,7 @@ extern const char *aarch64_rewrite_mcpu
+ #define MCPU_TO_MARCH_SPEC_FUNCTIONS \
+ { "rewrite_mcpu", aarch64_rewrite_mcpu },
+
+-#if defined(__aarch64__)
++#if defined(__aarch64__) && ! defined(__APPLE__)
+ extern const char *host_detect_local_cpu (int argc, const char **argv);
+ #define HAVE_LOCAL_CPU_DETECT
+ # define EXTRA_SPEC_FUNCTIONS \
+--- a/gcc/config/host-darwin.c
++++ b/gcc/config/host-darwin.c
+@@ -22,6 +22,8 @@
+ #include "coretypes.h"
+ #include "diagnostic-core.h"
+ #include "config/host-darwin.h"
++#include "hosthooks.h"
++#include "hosthooks-def.h"
+
+ /* Yes, this is really supposed to work. */
+ /* This allows for a pagesize of 16384, which we have on Darwin20, but should
+@@ -79,3 +81,5 @@ darwin_gt_pch_use_address (void *addr, s
+
+ return ret;
+ }
++
++const struct host_hooks host_hooks = HOST_HOOKS_INITIALIZER;
--- /dev/null
+commit 81cc26c706b2bc8c8c1eb1a322e5c5157900836e
+Author: Felix Fietkau <nbd@openwrt.org>
+Date: Sun Oct 19 21:45:51 2014 +0000
+
+ gcc: do not assume that the Mac OS X filesystem is case insensitive
+
+ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+
+ SVN-Revision: 42973
+
+--- a/include/filenames.h
++++ b/include/filenames.h
+@@ -44,11 +44,6 @@ extern "C" {
+ # define IS_DIR_SEPARATOR(c) IS_DOS_DIR_SEPARATOR (c)
+ # define IS_ABSOLUTE_PATH(f) IS_DOS_ABSOLUTE_PATH (f)
+ #else /* not DOSish */
+-# if defined(__APPLE__)
+-# ifndef HAVE_CASE_INSENSITIVE_FILE_SYSTEM
+-# define HAVE_CASE_INSENSITIVE_FILE_SYSTEM 1
+-# endif
+-# endif /* __APPLE__ */
+ # define HAS_DRIVE_SPEC(f) (0)
+ # define IS_DIR_SEPARATOR(c) IS_UNIX_DIR_SEPARATOR (c)
+ # define IS_ABSOLUTE_PATH(f) IS_UNIX_ABSOLUTE_PATH (f)
--- /dev/null
+--- a/gcc/real.h
++++ b/gcc/real.h
+@@ -77,8 +77,10 @@ struct GTY(()) real_value {
+ + (REAL_VALUE_TYPE_SIZE%HOST_BITS_PER_WIDE_INT ? 1 : 0)) /* round up */
+
+ /* Verify the guess. */
++#ifndef __LP64__
+ extern char test_real_width
+ [sizeof (REAL_VALUE_TYPE) <= REAL_WIDTH * sizeof (HOST_WIDE_INT) ? 1 : -1];
++#endif
+
+ /* Calculate the format for CONST_DOUBLE. We need as many slots as
+ are necessary to overlay a REAL_VALUE_TYPE on them. This could be
--- /dev/null
+commit 098bd91f5eae625c7d2ee621e10930fc4434e5e2
+Author: Luka Perkov <luka@openwrt.org>
+Date: Tue Feb 26 16:16:33 2013 +0000
+
+ gcc: don't build documentation
+
+ This closes #13039.
+
+ Signed-off-by: Luka Perkov <luka@openwrt.org>
+
+ SVN-Revision: 35807
+
+--- a/gcc/Makefile.in
++++ b/gcc/Makefile.in
+@@ -3366,18 +3366,10 @@ doc/gcc.info: $(TEXI_GCC_FILES)
+ doc/gccint.info: $(TEXI_GCCINT_FILES)
+ doc/cppinternals.info: $(TEXI_CPPINT_FILES)
+
+-doc/%.info: %.texi
+- if [ x$(BUILD_INFO) = xinfo ]; then \
+- $(MAKEINFO) $(MAKEINFOFLAGS) -I . -I $(gcc_docdir) \
+- -I $(gcc_docdir)/include -o $@ $<; \
+- fi
++doc/%.info:
+
+ # Duplicate entry to handle renaming of gccinstall.info
+-doc/gccinstall.info: $(TEXI_GCCINSTALL_FILES)
+- if [ x$(BUILD_INFO) = xinfo ]; then \
+- $(MAKEINFO) $(MAKEINFOFLAGS) -I $(gcc_docdir) \
+- -I $(gcc_docdir)/include -o $@ $<; \
+- fi
++doc/gccinstall.info:
+
+ doc/cpp.dvi: $(TEXI_CPP_FILES)
+ doc/gcc.dvi: $(TEXI_GCC_FILES)
--- /dev/null
+Fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84790.
+MIPS16 functions have a static assembler prologue which clobbers
+registers v0 and v1. Add these register clobbers to function call
+instructions.
+
+--- a/gcc/config/mips/mips.cc
++++ b/gcc/config/mips/mips.cc
+@@ -3134,6 +3134,12 @@ mips_emit_call_insn (rtx pattern, rtx or
+ emit_insn (gen_update_got_version ());
+ }
+
++ if (TARGET_MIPS16 && TARGET_USE_GOT)
++ {
++ clobber_reg (&CALL_INSN_FUNCTION_USAGE (insn), MIPS16_PIC_TEMP);
++ clobber_reg (&CALL_INSN_FUNCTION_USAGE (insn), MIPS_PROLOGUE_TEMP (word_mode));
++ }
++
+ if (TARGET_MIPS16
+ && TARGET_EXPLICIT_RELOCS
+ && TARGET_CALL_CLOBBERED_GP)
--- /dev/null
+--- a/gcc/gcc.cc
++++ b/gcc/gcc.cc
+@@ -987,7 +987,9 @@ proper position among the other output f
+ #endif
+
+ #ifndef LINK_SSP_SPEC
+-#ifdef TARGET_LIBC_PROVIDES_SSP
++#if DEFAULT_LIBC == LIBC_MUSL
++#define LINK_SSP_SPEC "-lssp_nonshared"
++#elif defined(TARGET_LIBC_PROVIDES_SSP)
+ #define LINK_SSP_SPEC "%{fstack-protector|fstack-protector-all" \
+ "|fstack-protector-strong|fstack-protector-explicit:}"
+ #else
--- /dev/null
+commit ecf7671b769fe96f7b5134be442089f8bdba55d2
+Author: Felix Fietkau <nbd@nbd.name>
+Date: Thu Aug 4 20:29:45 2016 +0200
+
+gcc: add a patch to generate better code with Os on mips
+
+Also happens to reduce compressed code size a bit
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+
+--- a/gcc/config/mips/mips.cc
++++ b/gcc/config/mips/mips.cc
+@@ -20216,7 +20216,7 @@ mips_option_override (void)
+ flag_pcc_struct_return = 0;
+
+ /* Decide which rtx_costs structure to use. */
+- if (optimize_size)
++ if (0 && optimize_size)
+ mips_cost = &mips_rtx_cost_optimize_size;
+ else
+ mips_cost = &mips_rtx_cost_data[mips_tune];
--- /dev/null
+From f797260adaf52bee0ec0e16190bbefbe1bfc3692 Mon Sep 17 00:00:00 2001
+From: Patrick O'Neill <patrick@rivosinc.com>
+Date: Tue, 18 Apr 2023 14:33:13 -0700
+Subject: [PATCH] RISCV: Inline subword atomic ops
+
+RISC-V has no support for subword atomic operations; code currently
+generates libatomic library calls.
+
+This patch changes the default behavior to inline subword atomic calls
+(using the same logic as the existing library call).
+Behavior can be specified using the -minline-atomics and
+-mno-inline-atomics command line flags.
+
+gcc/libgcc/config/riscv/atomic.c has the same logic implemented in asm.
+This will need to stay for backwards compatibility and the
+-mno-inline-atomics flag.
+
+2023-04-18 Patrick O'Neill <patrick@rivosinc.com>
+
+gcc/ChangeLog:
+ PR target/104338
+ * config/riscv/riscv-protos.h: Add helper function stubs.
+ * config/riscv/riscv.cc: Add helper functions for subword masking.
+ * config/riscv/riscv.opt: Add command-line flag.
+ * config/riscv/sync.md: Add masking logic and inline asm for fetch_and_op,
+ fetch_and_nand, CAS, and exchange ops.
+ * doc/invoke.texi: Add blurb regarding command-line flag.
+
+libgcc/ChangeLog:
+ PR target/104338
+ * config/riscv/atomic.c: Add reference to duplicate logic.
+
+gcc/testsuite/ChangeLog:
+ PR target/104338
+ * gcc.target/riscv/inline-atomics-1.c: New test.
+ * gcc.target/riscv/inline-atomics-2.c: New test.
+ * gcc.target/riscv/inline-atomics-3.c: New test.
+ * gcc.target/riscv/inline-atomics-4.c: New test.
+ * gcc.target/riscv/inline-atomics-5.c: New test.
+ * gcc.target/riscv/inline-atomics-6.c: New test.
+ * gcc.target/riscv/inline-atomics-7.c: New test.
+ * gcc.target/riscv/inline-atomics-8.c: New test.
+
+Signed-off-by: Patrick O'Neill <patrick@rivosinc.com>
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+---
+ gcc/config/riscv/riscv-protos.h | 2 +
+ gcc/config/riscv/riscv.cc | 49 ++
+ gcc/config/riscv/riscv.opt | 4 +
+ gcc/config/riscv/sync.md | 301 +++++++++
+ gcc/doc/invoke.texi | 10 +-
+ .../gcc.target/riscv/inline-atomics-1.c | 18 +
+ .../gcc.target/riscv/inline-atomics-2.c | 9 +
+ .../gcc.target/riscv/inline-atomics-3.c | 569 ++++++++++++++++++
+ .../gcc.target/riscv/inline-atomics-4.c | 566 +++++++++++++++++
+ .../gcc.target/riscv/inline-atomics-5.c | 87 +++
+ .../gcc.target/riscv/inline-atomics-6.c | 87 +++
+ .../gcc.target/riscv/inline-atomics-7.c | 69 +++
+ .../gcc.target/riscv/inline-atomics-8.c | 69 +++
+ libgcc/config/riscv/atomic.c | 2 +
+ 14 files changed, 1841 insertions(+), 1 deletion(-)
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-1.c
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-2.c
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-3.c
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-4.c
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-5.c
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-6.c
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-7.c
+ create mode 100644 gcc/testsuite/gcc.target/riscv/inline-atomics-8.c
+
+--- a/gcc/config/riscv/riscv-protos.h
++++ b/gcc/config/riscv/riscv-protos.h
+@@ -74,6 +74,8 @@ extern bool riscv_expand_block_move (rtx
+ extern bool riscv_store_data_bypass_p (rtx_insn *, rtx_insn *);
+ extern rtx riscv_gen_gpr_save_insn (struct riscv_frame_info *);
+ extern bool riscv_gpr_save_operation_p (rtx);
++extern void riscv_subword_address (rtx, rtx *, rtx *, rtx *, rtx *);
++extern void riscv_lshift_subword (machine_mode, rtx, rtx, rtx *);
+
+ /* Routines implemented in riscv-c.cc. */
+ void riscv_cpu_cpp_builtins (cpp_reader *);
+--- a/gcc/config/riscv/riscv.cc
++++ b/gcc/config/riscv/riscv.cc
+@@ -5605,6 +5605,55 @@ riscv_asan_shadow_offset (void)
+ return TARGET_64BIT ? (HOST_WIDE_INT_1 << 29) : 0;
+ }
+
++/* Given memory reference MEM, expand code to compute the aligned
++ memory address, shift and mask values and store them into
++ *ALIGNED_MEM, *SHIFT, *MASK and *NOT_MASK. */
++
++void
++riscv_subword_address (rtx mem, rtx *aligned_mem, rtx *shift, rtx *mask,
++ rtx *not_mask)
++{
++ /* Align the memory address to a word. */
++ rtx addr = force_reg (Pmode, XEXP (mem, 0));
++
++ rtx addr_mask = gen_int_mode (-4, Pmode);
++
++ rtx aligned_addr = gen_reg_rtx (Pmode);
++ emit_move_insn (aligned_addr, gen_rtx_AND (Pmode, addr, addr_mask));
++
++ *aligned_mem = change_address (mem, SImode, aligned_addr);
++
++ /* Calculate the shift amount. */
++ emit_move_insn (*shift, gen_rtx_AND (SImode, gen_lowpart (SImode, addr),
++ gen_int_mode (3, SImode)));
++ emit_move_insn (*shift, gen_rtx_ASHIFT (SImode, *shift,
++ gen_int_mode (3, SImode)));
++
++ /* Calculate the mask. */
++ int unshifted_mask = GET_MODE_MASK (GET_MODE (mem));
++
++ emit_move_insn (*mask, gen_int_mode (unshifted_mask, SImode));
++
++ emit_move_insn (*mask, gen_rtx_ASHIFT (SImode, *mask,
++ gen_lowpart (QImode, *shift)));
++
++ emit_move_insn (*not_mask, gen_rtx_NOT(SImode, *mask));
++}
++
++/* Leftshift a subword within an SImode register. */
++
++void
++riscv_lshift_subword (machine_mode mode, rtx value, rtx shift,
++ rtx *shifted_value)
++{
++ rtx value_reg = gen_reg_rtx (SImode);
++ emit_move_insn (value_reg, simplify_gen_subreg (SImode, value,
++ mode, 0));
++
++ emit_move_insn(*shifted_value, gen_rtx_ASHIFT (SImode, value_reg,
++ gen_lowpart (QImode, shift)));
++}
++
+ /* Initialize the GCC target structure. */
+ #undef TARGET_ASM_ALIGNED_HI_OP
+ #define TARGET_ASM_ALIGNED_HI_OP "\t.half\t"
+--- a/gcc/config/riscv/riscv.opt
++++ b/gcc/config/riscv/riscv.opt
+@@ -209,6 +209,10 @@ int riscv_vector_elen_flags
+ TargetVariable
+ int riscv_zvl_flags
+
++minline-atomics
++Target Var(TARGET_INLINE_SUBWORD_ATOMIC) Init(1)
++Always inline subword atomic operations.
++
+ Enum
+ Name(isa_spec_class) Type(enum riscv_isa_spec_class)
+ Supported ISA specs (for use with the -misa-spec= option):
+--- a/gcc/config/riscv/sync.md
++++ b/gcc/config/riscv/sync.md
+@@ -21,8 +21,11 @@
+
+ (define_c_enum "unspec" [
+ UNSPEC_COMPARE_AND_SWAP
++ UNSPEC_COMPARE_AND_SWAP_SUBWORD
+ UNSPEC_SYNC_OLD_OP
++ UNSPEC_SYNC_OLD_OP_SUBWORD
+ UNSPEC_SYNC_EXCHANGE
++ UNSPEC_SYNC_EXCHANGE_SUBWORD
+ UNSPEC_ATOMIC_STORE
+ UNSPEC_MEMORY_BARRIER
+ ])
+@@ -92,6 +95,135 @@
+ "%F3amo<insn>.<amo>%A3 %0,%z2,%1"
+ [(set (attr "length") (const_int 8))])
+
++(define_insn "subword_atomic_fetch_strong_<atomic_optab>"
++ [(set (match_operand:SI 0 "register_operand" "=&r") ;; old value at mem
++ (match_operand:SI 1 "memory_operand" "+A")) ;; mem location
++ (set (match_dup 1)
++ (unspec_volatile:SI
++ [(any_atomic:SI (match_dup 1)
++ (match_operand:SI 2 "register_operand" "rI")) ;; value for op
++ (match_operand:SI 3 "register_operand" "rI")] ;; mask
++ UNSPEC_SYNC_OLD_OP_SUBWORD))
++ (match_operand:SI 4 "register_operand" "rI") ;; not_mask
++ (clobber (match_scratch:SI 5 "=&r")) ;; tmp_1
++ (clobber (match_scratch:SI 6 "=&r"))] ;; tmp_2
++ "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++ {
++ return "1:\;"
++ "lr.w.aq\t%0, %1\;"
++ "<insn>\t%5, %0, %2\;"
++ "and\t%5, %5, %3\;"
++ "and\t%6, %0, %4\;"
++ "or\t%6, %6, %5\;"
++ "sc.w.rl\t%5, %6, %1\;"
++ "bnez\t%5, 1b";
++ }
++ [(set (attr "length") (const_int 28))])
++
++(define_expand "atomic_fetch_nand<mode>"
++ [(match_operand:SHORT 0 "register_operand") ;; old value at mem
++ (not:SHORT (and:SHORT (match_operand:SHORT 1 "memory_operand") ;; mem location
++ (match_operand:SHORT 2 "reg_or_0_operand"))) ;; value for op
++ (match_operand:SI 3 "const_int_operand")] ;; model
++ "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++{
++ /* We have no QImode/HImode atomics, so form a mask, then use
++ subword_atomic_fetch_strong_nand to implement a LR/SC version of the
++ operation. */
++
++ /* Logic duplicated in gcc/libgcc/config/riscv/atomic.c for use when inlining
++ is disabled */
++
++ rtx old = gen_reg_rtx (SImode);
++ rtx mem = operands[1];
++ rtx value = operands[2];
++ rtx aligned_mem = gen_reg_rtx (SImode);
++ rtx shift = gen_reg_rtx (SImode);
++ rtx mask = gen_reg_rtx (SImode);
++ rtx not_mask = gen_reg_rtx (SImode);
++
++ riscv_subword_address (mem, &aligned_mem, &shift, &mask, ¬_mask);
++
++ rtx shifted_value = gen_reg_rtx (SImode);
++ riscv_lshift_subword (<MODE>mode, value, shift, &shifted_value);
++
++ emit_insn (gen_subword_atomic_fetch_strong_nand (old, aligned_mem,
++ shifted_value,
++ mask, not_mask));
++
++ emit_move_insn (old, gen_rtx_ASHIFTRT (SImode, old,
++ gen_lowpart (QImode, shift)));
++
++ emit_move_insn (operands[0], gen_lowpart (<MODE>mode, old));
++
++ DONE;
++})
++
++(define_insn "subword_atomic_fetch_strong_nand"
++ [(set (match_operand:SI 0 "register_operand" "=&r") ;; old value at mem
++ (match_operand:SI 1 "memory_operand" "+A")) ;; mem location
++ (set (match_dup 1)
++ (unspec_volatile:SI
++ [(not:SI (and:SI (match_dup 1)
++ (match_operand:SI 2 "register_operand" "rI"))) ;; value for op
++ (match_operand:SI 3 "register_operand" "rI")] ;; mask
++ UNSPEC_SYNC_OLD_OP_SUBWORD))
++ (match_operand:SI 4 "register_operand" "rI") ;; not_mask
++ (clobber (match_scratch:SI 5 "=&r")) ;; tmp_1
++ (clobber (match_scratch:SI 6 "=&r"))] ;; tmp_2
++ "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++ {
++ return "1:\;"
++ "lr.w.aq\t%0, %1\;"
++ "and\t%5, %0, %2\;"
++ "not\t%5, %5\;"
++ "and\t%5, %5, %3\;"
++ "and\t%6, %0, %4\;"
++ "or\t%6, %6, %5\;"
++ "sc.w.rl\t%5, %6, %1\;"
++ "bnez\t%5, 1b";
++ }
++ [(set (attr "length") (const_int 32))])
++
++(define_expand "atomic_fetch_<atomic_optab><mode>"
++ [(match_operand:SHORT 0 "register_operand") ;; old value at mem
++ (any_atomic:SHORT (match_operand:SHORT 1 "memory_operand") ;; mem location
++ (match_operand:SHORT 2 "reg_or_0_operand")) ;; value for op
++ (match_operand:SI 3 "const_int_operand")] ;; model
++ "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++{
++ /* We have no QImode/HImode atomics, so form a mask, then use
++ subword_atomic_fetch_strong_<mode> to implement a LR/SC version of the
++ operation. */
++
++ /* Logic duplicated in gcc/libgcc/config/riscv/atomic.c for use when inlining
++ is disabled */
++
++ rtx old = gen_reg_rtx (SImode);
++ rtx mem = operands[1];
++ rtx value = operands[2];
++ rtx aligned_mem = gen_reg_rtx (SImode);
++ rtx shift = gen_reg_rtx (SImode);
++ rtx mask = gen_reg_rtx (SImode);
++ rtx not_mask = gen_reg_rtx (SImode);
++
++ riscv_subword_address (mem, &aligned_mem, &shift, &mask, ¬_mask);
++
++ rtx shifted_value = gen_reg_rtx (SImode);
++ riscv_lshift_subword (<MODE>mode, value, shift, &shifted_value);
++
++ emit_insn (gen_subword_atomic_fetch_strong_<atomic_optab> (old, aligned_mem,
++ shifted_value,
++ mask, not_mask));
++
++ emit_move_insn (old, gen_rtx_ASHIFTRT (SImode, old,
++ gen_lowpart (QImode, shift)));
++
++ emit_move_insn (operands[0], gen_lowpart (<MODE>mode, old));
++
++ DONE;
++})
++
+ (define_insn "atomic_exchange<mode>"
+ [(set (match_operand:GPR 0 "register_operand" "=&r")
+ (unspec_volatile:GPR
+@@ -104,6 +236,56 @@
+ "%F3amoswap.<amo>%A3 %0,%z2,%1"
+ [(set (attr "length") (const_int 8))])
+
++(define_expand "atomic_exchange<mode>"
++ [(match_operand:SHORT 0 "register_operand") ;; old value at mem
++ (match_operand:SHORT 1 "memory_operand") ;; mem location
++ (match_operand:SHORT 2 "register_operand") ;; value
++ (match_operand:SI 3 "const_int_operand")] ;; model
++ "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++{
++ rtx old = gen_reg_rtx (SImode);
++ rtx mem = operands[1];
++ rtx value = operands[2];
++ rtx aligned_mem = gen_reg_rtx (SImode);
++ rtx shift = gen_reg_rtx (SImode);
++ rtx mask = gen_reg_rtx (SImode);
++ rtx not_mask = gen_reg_rtx (SImode);
++
++ riscv_subword_address (mem, &aligned_mem, &shift, &mask, ¬_mask);
++
++ rtx shifted_value = gen_reg_rtx (SImode);
++ riscv_lshift_subword (<MODE>mode, value, shift, &shifted_value);
++
++ emit_insn (gen_subword_atomic_exchange_strong (old, aligned_mem,
++ shifted_value, not_mask));
++
++ emit_move_insn (old, gen_rtx_ASHIFTRT (SImode, old,
++ gen_lowpart (QImode, shift)));
++
++ emit_move_insn (operands[0], gen_lowpart (<MODE>mode, old));
++ DONE;
++})
++
++(define_insn "subword_atomic_exchange_strong"
++ [(set (match_operand:SI 0 "register_operand" "=&r") ;; old value at mem
++ (match_operand:SI 1 "memory_operand" "+A")) ;; mem location
++ (set (match_dup 1)
++ (unspec_volatile:SI
++ [(match_operand:SI 2 "reg_or_0_operand" "rI") ;; value
++ (match_operand:SI 3 "reg_or_0_operand" "rI")] ;; not_mask
++ UNSPEC_SYNC_EXCHANGE_SUBWORD))
++ (clobber (match_scratch:SI 4 "=&r"))] ;; tmp_1
++ "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++ {
++ return "1:\;"
++ "lr.w.aq\t%0, %1\;"
++ "and\t%4, %0, %3\;"
++ "or\t%4, %4, %2\;"
++ "sc.w.rl\t%4, %4, %1\;"
++ "bnez\t%4, 1b";
++ }
++ [(set (attr "length") (const_int 20))])
++
+ (define_insn "atomic_cas_value_strong<mode>"
+ [(set (match_operand:GPR 0 "register_operand" "=&r")
+ (match_operand:GPR 1 "memory_operand" "+A"))
+@@ -152,6 +334,125 @@
+ DONE;
+ })
+
++(define_expand "atomic_compare_and_swap<mode>"
++ [(match_operand:SI 0 "register_operand") ;; bool output
++ (match_operand:SHORT 1 "register_operand") ;; val output
++ (match_operand:SHORT 2 "memory_operand") ;; memory
++ (match_operand:SHORT 3 "reg_or_0_operand") ;; expected value
++ (match_operand:SHORT 4 "reg_or_0_operand") ;; desired value
++ (match_operand:SI 5 "const_int_operand") ;; is_weak
++ (match_operand:SI 6 "const_int_operand") ;; mod_s
++ (match_operand:SI 7 "const_int_operand")] ;; mod_f
++ "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++{
++ emit_insn (gen_atomic_cas_value_strong<mode> (operands[1], operands[2],
++ operands[3], operands[4],
++ operands[6], operands[7]));
++
++ rtx val = gen_reg_rtx (SImode);
++ if (operands[1] != const0_rtx)
++ emit_move_insn (val, gen_rtx_SIGN_EXTEND (SImode, operands[1]));
++ else
++ emit_move_insn (val, const0_rtx);
++
++ rtx exp = gen_reg_rtx (SImode);
++ if (operands[3] != const0_rtx)
++ emit_move_insn (exp, gen_rtx_SIGN_EXTEND (SImode, operands[3]));
++ else
++ emit_move_insn (exp, const0_rtx);
++
++ rtx compare = val;
++ if (exp != const0_rtx)
++ {
++ rtx difference = gen_rtx_MINUS (SImode, val, exp);
++ compare = gen_reg_rtx (SImode);
++ emit_move_insn (compare, difference);
++ }
++
++ if (word_mode != SImode)
++ {
++ rtx reg = gen_reg_rtx (word_mode);
++ emit_move_insn (reg, gen_rtx_SIGN_EXTEND (word_mode, compare));
++ compare = reg;
++ }
++
++ emit_move_insn (operands[0], gen_rtx_EQ (SImode, compare, const0_rtx));
++ DONE;
++})
++
++(define_expand "atomic_cas_value_strong<mode>"
++ [(match_operand:SHORT 0 "register_operand") ;; val output
++ (match_operand:SHORT 1 "memory_operand") ;; memory
++ (match_operand:SHORT 2 "reg_or_0_operand") ;; expected value
++ (match_operand:SHORT 3 "reg_or_0_operand") ;; desired value
++ (match_operand:SI 4 "const_int_operand") ;; mod_s
++ (match_operand:SI 5 "const_int_operand") ;; mod_f
++ (match_scratch:SHORT 6)]
++ "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++{
++ /* We have no QImode/HImode atomics, so form a mask, then use
++ subword_atomic_cas_strong<mode> to implement a LR/SC version of the
++ operation. */
++
++ /* Logic duplicated in gcc/libgcc/config/riscv/atomic.c for use when inlining
++ is disabled */
++
++ rtx old = gen_reg_rtx (SImode);
++ rtx mem = operands[1];
++ rtx aligned_mem = gen_reg_rtx (SImode);
++ rtx shift = gen_reg_rtx (SImode);
++ rtx mask = gen_reg_rtx (SImode);
++ rtx not_mask = gen_reg_rtx (SImode);
++
++ riscv_subword_address (mem, &aligned_mem, &shift, &mask, ¬_mask);
++
++ rtx o = operands[2];
++ rtx n = operands[3];
++ rtx shifted_o = gen_reg_rtx (SImode);
++ rtx shifted_n = gen_reg_rtx (SImode);
++
++ riscv_lshift_subword (<MODE>mode, o, shift, &shifted_o);
++ riscv_lshift_subword (<MODE>mode, n, shift, &shifted_n);
++
++ emit_move_insn (shifted_o, gen_rtx_AND (SImode, shifted_o, mask));
++ emit_move_insn (shifted_n, gen_rtx_AND (SImode, shifted_n, mask));
++
++ emit_insn (gen_subword_atomic_cas_strong (old, aligned_mem,
++ shifted_o, shifted_n,
++ mask, not_mask));
++
++ emit_move_insn (old, gen_rtx_ASHIFTRT (SImode, old,
++ gen_lowpart (QImode, shift)));
++
++ emit_move_insn (operands[0], gen_lowpart (<MODE>mode, old));
++
++ DONE;
++})
++
++(define_insn "subword_atomic_cas_strong"
++ [(set (match_operand:SI 0 "register_operand" "=&r") ;; old value at mem
++ (match_operand:SI 1 "memory_operand" "+A")) ;; mem location
++ (set (match_dup 1)
++ (unspec_volatile:SI [(match_operand:SI 2 "reg_or_0_operand" "rJ") ;; expected value
++ (match_operand:SI 3 "reg_or_0_operand" "rJ")] ;; desired value
++ UNSPEC_COMPARE_AND_SWAP_SUBWORD))
++ (match_operand:SI 4 "register_operand" "rI") ;; mask
++ (match_operand:SI 5 "register_operand" "rI") ;; not_mask
++ (clobber (match_scratch:SI 6 "=&r"))] ;; tmp_1
++ "TARGET_ATOMIC && TARGET_INLINE_SUBWORD_ATOMIC"
++ {
++ return "1:\;"
++ "lr.w.aq\t%0, %1\;"
++ "and\t%6, %0, %4\;"
++ "bne\t%6, %z2, 1f\;"
++ "and\t%6, %0, %5\;"
++ "or\t%6, %6, %3\;"
++ "sc.w.rl\t%6, %6, %1\;"
++ "bnez\t%6, 1b\;"
++ "1:";
++ }
++ [(set (attr "length") (const_int 28))])
++
+ (define_expand "atomic_test_and_set"
+ [(match_operand:QI 0 "register_operand" "") ;; bool output
+ (match_operand:QI 1 "memory_operand" "+A") ;; memory
+--- a/gcc/doc/invoke.texi
++++ b/gcc/doc/invoke.texi
+@@ -753,7 +753,8 @@ Objective-C and Objective-C++ Dialects}.
+ -moverride=@var{string} -mverbose-cost-dump @gol
+ -mstack-protector-guard=@var{guard} -mstack-protector-guard-reg=@var{sysreg} @gol
+ -mstack-protector-guard-offset=@var{offset} -mtrack-speculation @gol
+--moutline-atomics }
++-moutline-atomics
++-minline-atomics -mno-inline-atomics}
+
+ @emph{Adapteva Epiphany Options}
+ @gccoptlist{-mhalf-reg-file -mprefer-short-insn-regs @gol
+@@ -28035,6 +28036,13 @@ Do or don't use smaller but slower prolo
+ library function calls. The default is to use fast inline prologues and
+ epilogues.
+
++@opindex minline-atomics
++@item -minline-atomics
++@itemx -mno-inline-atomics
++Do or don't use smaller but slower subword atomic emulation code that uses
++libatomic function calls. The default is to use fast inline subword atomics
++that do not require libatomic.
++
+ @item -mshorten-memrefs
+ @itemx -mno-shorten-memrefs
+ @opindex mshorten-memrefs
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-1.c
+@@ -0,0 +1,18 @@
++/* { dg-do compile } */
++/* { dg-options "-mno-inline-atomics" } */
++/* { dg-message "note: '__sync_fetch_and_nand' changed semantics in GCC 4.4" "fetch_and_nand" { target *-*-* } 0 } */
++/* { dg-final { scan-assembler "\tcall\t__sync_fetch_and_add_1" } } */
++/* { dg-final { scan-assembler "\tcall\t__sync_fetch_and_nand_1" } } */
++/* { dg-final { scan-assembler "\tcall\t__sync_bool_compare_and_swap_1" } } */
++
++char foo;
++char bar;
++char baz;
++
++int
++main ()
++{
++ __sync_fetch_and_add(&foo, 1);
++ __sync_fetch_and_nand(&bar, 1);
++ __sync_bool_compare_and_swap (&baz, 1, 2);
++}
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-2.c
+@@ -0,0 +1,9 @@
++/* { dg-do compile } */
++/* Verify that subword atomics do not generate calls. */
++/* { dg-options "-minline-atomics" } */
++/* { dg-message "note: '__sync_fetch_and_nand' changed semantics in GCC 4.4" "fetch_and_nand" { target *-*-* } 0 } */
++/* { dg-final { scan-assembler-not "\tcall\t__sync_fetch_and_add_1" } } */
++/* { dg-final { scan-assembler-not "\tcall\t__sync_fetch_and_nand_1" } } */
++/* { dg-final { scan-assembler-not "\tcall\t__sync_bool_compare_and_swap_1" } } */
++
++#include "inline-atomics-1.c"
+\ No newline at end of file
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-3.c
+@@ -0,0 +1,569 @@
++/* Check all char alignments. */
++/* Duplicate logic as libatomic/testsuite/libatomic.c/atomic-op-1.c */
++/* Test __atomic routines for existence and proper execution on 1 byte
++ values with each valid memory model. */
++/* { dg-do run } */
++/* { dg-options "-minline-atomics -Wno-address-of-packed-member" } */
++
++/* Test the execution of the __atomic_*OP builtin routines for a char. */
++
++extern void abort(void);
++
++char count, res;
++const char init = ~0;
++
++struct A
++{
++ char a;
++ char b;
++ char c;
++ char d;
++} __attribute__ ((packed)) A;
++
++/* The fetch_op routines return the original value before the operation. */
++
++void
++test_fetch_add (char* v)
++{
++ *v = 0;
++ count = 1;
++
++ if (__atomic_fetch_add (v, count, __ATOMIC_RELAXED) != 0)
++ abort ();
++
++ if (__atomic_fetch_add (v, 1, __ATOMIC_CONSUME) != 1)
++ abort ();
++
++ if (__atomic_fetch_add (v, count, __ATOMIC_ACQUIRE) != 2)
++ abort ();
++
++ if (__atomic_fetch_add (v, 1, __ATOMIC_RELEASE) != 3)
++ abort ();
++
++ if (__atomic_fetch_add (v, count, __ATOMIC_ACQ_REL) != 4)
++ abort ();
++
++ if (__atomic_fetch_add (v, 1, __ATOMIC_SEQ_CST) != 5)
++ abort ();
++}
++
++
++void
++test_fetch_sub (char* v)
++{
++ *v = res = 20;
++ count = 0;
++
++ if (__atomic_fetch_sub (v, count + 1, __ATOMIC_RELAXED) != res--)
++ abort ();
++
++ if (__atomic_fetch_sub (v, 1, __ATOMIC_CONSUME) != res--)
++ abort ();
++
++ if (__atomic_fetch_sub (v, count + 1, __ATOMIC_ACQUIRE) != res--)
++ abort ();
++
++ if (__atomic_fetch_sub (v, 1, __ATOMIC_RELEASE) != res--)
++ abort ();
++
++ if (__atomic_fetch_sub (v, count + 1, __ATOMIC_ACQ_REL) != res--)
++ abort ();
++
++ if (__atomic_fetch_sub (v, 1, __ATOMIC_SEQ_CST) != res--)
++ abort ();
++}
++
++void
++test_fetch_and (char* v)
++{
++ *v = init;
++
++ if (__atomic_fetch_and (v, 0, __ATOMIC_RELAXED) != init)
++ abort ();
++
++ if (__atomic_fetch_and (v, init, __ATOMIC_CONSUME) != 0)
++ abort ();
++
++ if (__atomic_fetch_and (v, 0, __ATOMIC_ACQUIRE) != 0)
++ abort ();
++
++ *v = ~*v;
++ if (__atomic_fetch_and (v, init, __ATOMIC_RELEASE) != init)
++ abort ();
++
++ if (__atomic_fetch_and (v, 0, __ATOMIC_ACQ_REL) != init)
++ abort ();
++
++ if (__atomic_fetch_and (v, 0, __ATOMIC_SEQ_CST) != 0)
++ abort ();
++}
++
++void
++test_fetch_nand (char* v)
++{
++ *v = init;
++
++ if (__atomic_fetch_nand (v, 0, __ATOMIC_RELAXED) != init)
++ abort ();
++
++ if (__atomic_fetch_nand (v, init, __ATOMIC_CONSUME) != init)
++ abort ();
++
++ if (__atomic_fetch_nand (v, 0, __ATOMIC_ACQUIRE) != 0 )
++ abort ();
++
++ if (__atomic_fetch_nand (v, init, __ATOMIC_RELEASE) != init)
++ abort ();
++
++ if (__atomic_fetch_nand (v, init, __ATOMIC_ACQ_REL) != 0)
++ abort ();
++
++ if (__atomic_fetch_nand (v, 0, __ATOMIC_SEQ_CST) != init)
++ abort ();
++}
++
++void
++test_fetch_xor (char* v)
++{
++ *v = init;
++ count = 0;
++
++ if (__atomic_fetch_xor (v, count, __ATOMIC_RELAXED) != init)
++ abort ();
++
++ if (__atomic_fetch_xor (v, ~count, __ATOMIC_CONSUME) != init)
++ abort ();
++
++ if (__atomic_fetch_xor (v, 0, __ATOMIC_ACQUIRE) != 0)
++ abort ();
++
++ if (__atomic_fetch_xor (v, ~count, __ATOMIC_RELEASE) != 0)
++ abort ();
++
++ if (__atomic_fetch_xor (v, 0, __ATOMIC_ACQ_REL) != init)
++ abort ();
++
++ if (__atomic_fetch_xor (v, ~count, __ATOMIC_SEQ_CST) != init)
++ abort ();
++}
++
++void
++test_fetch_or (char* v)
++{
++ *v = 0;
++ count = 1;
++
++ if (__atomic_fetch_or (v, count, __ATOMIC_RELAXED) != 0)
++ abort ();
++
++ count *= 2;
++ if (__atomic_fetch_or (v, 2, __ATOMIC_CONSUME) != 1)
++ abort ();
++
++ count *= 2;
++ if (__atomic_fetch_or (v, count, __ATOMIC_ACQUIRE) != 3)
++ abort ();
++
++ count *= 2;
++ if (__atomic_fetch_or (v, 8, __ATOMIC_RELEASE) != 7)
++ abort ();
++
++ count *= 2;
++ if (__atomic_fetch_or (v, count, __ATOMIC_ACQ_REL) != 15)
++ abort ();
++
++ count *= 2;
++ if (__atomic_fetch_or (v, count, __ATOMIC_SEQ_CST) != 31)
++ abort ();
++}
++
++/* The OP_fetch routines return the new value after the operation. */
++
++void
++test_add_fetch (char* v)
++{
++ *v = 0;
++ count = 1;
++
++ if (__atomic_add_fetch (v, count, __ATOMIC_RELAXED) != 1)
++ abort ();
++
++ if (__atomic_add_fetch (v, 1, __ATOMIC_CONSUME) != 2)
++ abort ();
++
++ if (__atomic_add_fetch (v, count, __ATOMIC_ACQUIRE) != 3)
++ abort ();
++
++ if (__atomic_add_fetch (v, 1, __ATOMIC_RELEASE) != 4)
++ abort ();
++
++ if (__atomic_add_fetch (v, count, __ATOMIC_ACQ_REL) != 5)
++ abort ();
++
++ if (__atomic_add_fetch (v, count, __ATOMIC_SEQ_CST) != 6)
++ abort ();
++}
++
++
++void
++test_sub_fetch (char* v)
++{
++ *v = res = 20;
++ count = 0;
++
++ if (__atomic_sub_fetch (v, count + 1, __ATOMIC_RELAXED) != --res)
++ abort ();
++
++ if (__atomic_sub_fetch (v, 1, __ATOMIC_CONSUME) != --res)
++ abort ();
++
++ if (__atomic_sub_fetch (v, count + 1, __ATOMIC_ACQUIRE) != --res)
++ abort ();
++
++ if (__atomic_sub_fetch (v, 1, __ATOMIC_RELEASE) != --res)
++ abort ();
++
++ if (__atomic_sub_fetch (v, count + 1, __ATOMIC_ACQ_REL) != --res)
++ abort ();
++
++ if (__atomic_sub_fetch (v, count + 1, __ATOMIC_SEQ_CST) != --res)
++ abort ();
++}
++
++void
++test_and_fetch (char* v)
++{
++ *v = init;
++
++ if (__atomic_and_fetch (v, 0, __ATOMIC_RELAXED) != 0)
++ abort ();
++
++ *v = init;
++ if (__atomic_and_fetch (v, init, __ATOMIC_CONSUME) != init)
++ abort ();
++
++ if (__atomic_and_fetch (v, 0, __ATOMIC_ACQUIRE) != 0)
++ abort ();
++
++ *v = ~*v;
++ if (__atomic_and_fetch (v, init, __ATOMIC_RELEASE) != init)
++ abort ();
++
++ if (__atomic_and_fetch (v, 0, __ATOMIC_ACQ_REL) != 0)
++ abort ();
++
++ *v = ~*v;
++ if (__atomic_and_fetch (v, 0, __ATOMIC_SEQ_CST) != 0)
++ abort ();
++}
++
++void
++test_nand_fetch (char* v)
++{
++ *v = init;
++
++ if (__atomic_nand_fetch (v, 0, __ATOMIC_RELAXED) != init)
++ abort ();
++
++ if (__atomic_nand_fetch (v, init, __ATOMIC_CONSUME) != 0)
++ abort ();
++
++ if (__atomic_nand_fetch (v, 0, __ATOMIC_ACQUIRE) != init)
++ abort ();
++
++ if (__atomic_nand_fetch (v, init, __ATOMIC_RELEASE) != 0)
++ abort ();
++
++ if (__atomic_nand_fetch (v, init, __ATOMIC_ACQ_REL) != init)
++ abort ();
++
++ if (__atomic_nand_fetch (v, 0, __ATOMIC_SEQ_CST) != init)
++ abort ();
++}
++
++
++
++void
++test_xor_fetch (char* v)
++{
++ *v = init;
++ count = 0;
++
++ if (__atomic_xor_fetch (v, count, __ATOMIC_RELAXED) != init)
++ abort ();
++
++ if (__atomic_xor_fetch (v, ~count, __ATOMIC_CONSUME) != 0)
++ abort ();
++
++ if (__atomic_xor_fetch (v, 0, __ATOMIC_ACQUIRE) != 0)
++ abort ();
++
++ if (__atomic_xor_fetch (v, ~count, __ATOMIC_RELEASE) != init)
++ abort ();
++
++ if (__atomic_xor_fetch (v, 0, __ATOMIC_ACQ_REL) != init)
++ abort ();
++
++ if (__atomic_xor_fetch (v, ~count, __ATOMIC_SEQ_CST) != 0)
++ abort ();
++}
++
++void
++test_or_fetch (char* v)
++{
++ *v = 0;
++ count = 1;
++
++ if (__atomic_or_fetch (v, count, __ATOMIC_RELAXED) != 1)
++ abort ();
++
++ count *= 2;
++ if (__atomic_or_fetch (v, 2, __ATOMIC_CONSUME) != 3)
++ abort ();
++
++ count *= 2;
++ if (__atomic_or_fetch (v, count, __ATOMIC_ACQUIRE) != 7)
++ abort ();
++
++ count *= 2;
++ if (__atomic_or_fetch (v, 8, __ATOMIC_RELEASE) != 15)
++ abort ();
++
++ count *= 2;
++ if (__atomic_or_fetch (v, count, __ATOMIC_ACQ_REL) != 31)
++ abort ();
++
++ count *= 2;
++ if (__atomic_or_fetch (v, count, __ATOMIC_SEQ_CST) != 63)
++ abort ();
++}
++
++
++/* Test the OP routines with a result which isn't used. Use both variations
++ within each function. */
++
++void
++test_add (char* v)
++{
++ *v = 0;
++ count = 1;
++
++ __atomic_add_fetch (v, count, __ATOMIC_RELAXED);
++ if (*v != 1)
++ abort ();
++
++ __atomic_fetch_add (v, count, __ATOMIC_CONSUME);
++ if (*v != 2)
++ abort ();
++
++ __atomic_add_fetch (v, 1 , __ATOMIC_ACQUIRE);
++ if (*v != 3)
++ abort ();
++
++ __atomic_fetch_add (v, 1, __ATOMIC_RELEASE);
++ if (*v != 4)
++ abort ();
++
++ __atomic_add_fetch (v, count, __ATOMIC_ACQ_REL);
++ if (*v != 5)
++ abort ();
++
++ __atomic_fetch_add (v, count, __ATOMIC_SEQ_CST);
++ if (*v != 6)
++ abort ();
++}
++
++
++void
++test_sub (char* v)
++{
++ *v = res = 20;
++ count = 0;
++
++ __atomic_sub_fetch (v, count + 1, __ATOMIC_RELAXED);
++ if (*v != --res)
++ abort ();
++
++ __atomic_fetch_sub (v, count + 1, __ATOMIC_CONSUME);
++ if (*v != --res)
++ abort ();
++
++ __atomic_sub_fetch (v, 1, __ATOMIC_ACQUIRE);
++ if (*v != --res)
++ abort ();
++
++ __atomic_fetch_sub (v, 1, __ATOMIC_RELEASE);
++ if (*v != --res)
++ abort ();
++
++ __atomic_sub_fetch (v, count + 1, __ATOMIC_ACQ_REL);
++ if (*v != --res)
++ abort ();
++
++ __atomic_fetch_sub (v, count + 1, __ATOMIC_SEQ_CST);
++ if (*v != --res)
++ abort ();
++}
++
++void
++test_and (char* v)
++{
++ *v = init;
++
++ __atomic_and_fetch (v, 0, __ATOMIC_RELAXED);
++ if (*v != 0)
++ abort ();
++
++ *v = init;
++ __atomic_fetch_and (v, init, __ATOMIC_CONSUME);
++ if (*v != init)
++ abort ();
++
++ __atomic_and_fetch (v, 0, __ATOMIC_ACQUIRE);
++ if (*v != 0)
++ abort ();
++
++ *v = ~*v;
++ __atomic_fetch_and (v, init, __ATOMIC_RELEASE);
++ if (*v != init)
++ abort ();
++
++ __atomic_and_fetch (v, 0, __ATOMIC_ACQ_REL);
++ if (*v != 0)
++ abort ();
++
++ *v = ~*v;
++ __atomic_fetch_and (v, 0, __ATOMIC_SEQ_CST);
++ if (*v != 0)
++ abort ();
++}
++
++void
++test_nand (char* v)
++{
++ *v = init;
++
++ __atomic_fetch_nand (v, 0, __ATOMIC_RELAXED);
++ if (*v != init)
++ abort ();
++
++ __atomic_fetch_nand (v, init, __ATOMIC_CONSUME);
++ if (*v != 0)
++ abort ();
++
++ __atomic_nand_fetch (v, 0, __ATOMIC_ACQUIRE);
++ if (*v != init)
++ abort ();
++
++ __atomic_nand_fetch (v, init, __ATOMIC_RELEASE);
++ if (*v != 0)
++ abort ();
++
++ __atomic_fetch_nand (v, init, __ATOMIC_ACQ_REL);
++ if (*v != init)
++ abort ();
++
++ __atomic_nand_fetch (v, 0, __ATOMIC_SEQ_CST);
++ if (*v != init)
++ abort ();
++}
++
++
++
++void
++test_xor (char* v)
++{
++ *v = init;
++ count = 0;
++
++ __atomic_xor_fetch (v, count, __ATOMIC_RELAXED);
++ if (*v != init)
++ abort ();
++
++ __atomic_fetch_xor (v, ~count, __ATOMIC_CONSUME);
++ if (*v != 0)
++ abort ();
++
++ __atomic_xor_fetch (v, 0, __ATOMIC_ACQUIRE);
++ if (*v != 0)
++ abort ();
++
++ __atomic_fetch_xor (v, ~count, __ATOMIC_RELEASE);
++ if (*v != init)
++ abort ();
++
++ __atomic_fetch_xor (v, 0, __ATOMIC_ACQ_REL);
++ if (*v != init)
++ abort ();
++
++ __atomic_xor_fetch (v, ~count, __ATOMIC_SEQ_CST);
++ if (*v != 0)
++ abort ();
++}
++
++void
++test_or (char* v)
++{
++ *v = 0;
++ count = 1;
++
++ __atomic_or_fetch (v, count, __ATOMIC_RELAXED);
++ if (*v != 1)
++ abort ();
++
++ count *= 2;
++ __atomic_fetch_or (v, count, __ATOMIC_CONSUME);
++ if (*v != 3)
++ abort ();
++
++ count *= 2;
++ __atomic_or_fetch (v, 4, __ATOMIC_ACQUIRE);
++ if (*v != 7)
++ abort ();
++
++ count *= 2;
++ __atomic_fetch_or (v, 8, __ATOMIC_RELEASE);
++ if (*v != 15)
++ abort ();
++
++ count *= 2;
++ __atomic_or_fetch (v, count, __ATOMIC_ACQ_REL);
++ if (*v != 31)
++ abort ();
++
++ count *= 2;
++ __atomic_fetch_or (v, count, __ATOMIC_SEQ_CST);
++ if (*v != 63)
++ abort ();
++}
++
++int
++main ()
++{
++ char* V[] = {&A.a, &A.b, &A.c, &A.d};
++
++ for (int i = 0; i < 4; i++) {
++ test_fetch_add (V[i]);
++ test_fetch_sub (V[i]);
++ test_fetch_and (V[i]);
++ test_fetch_nand (V[i]);
++ test_fetch_xor (V[i]);
++ test_fetch_or (V[i]);
++
++ test_add_fetch (V[i]);
++ test_sub_fetch (V[i]);
++ test_and_fetch (V[i]);
++ test_nand_fetch (V[i]);
++ test_xor_fetch (V[i]);
++ test_or_fetch (V[i]);
++
++ test_add (V[i]);
++ test_sub (V[i]);
++ test_and (V[i]);
++ test_nand (V[i]);
++ test_xor (V[i]);
++ test_or (V[i]);
++ }
++
++ return 0;
++}
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-4.c
+@@ -0,0 +1,566 @@
++/* Check all short alignments. */
++/* Duplicate logic as libatomic/testsuite/libatomic.c/atomic-op-2.c */
++/* Test __atomic routines for existence and proper execution on 2 byte
++ values with each valid memory model. */
++/* { dg-do run } */
++/* { dg-options "-minline-atomics -Wno-address-of-packed-member" } */
++
++/* Test the execution of the __atomic_*OP builtin routines for a short. */
++
++extern void abort(void);
++
++short count, res;
++const short init = ~0;
++
++struct A
++{
++ short a;
++ short b;
++} __attribute__ ((packed)) A;
++
++/* The fetch_op routines return the original value before the operation. */
++
++void
++test_fetch_add (short* v)
++{
++ *v = 0;
++ count = 1;
++
++ if (__atomic_fetch_add (v, count, __ATOMIC_RELAXED) != 0)
++ abort ();
++
++ if (__atomic_fetch_add (v, 1, __ATOMIC_CONSUME) != 1)
++ abort ();
++
++ if (__atomic_fetch_add (v, count, __ATOMIC_ACQUIRE) != 2)
++ abort ();
++
++ if (__atomic_fetch_add (v, 1, __ATOMIC_RELEASE) != 3)
++ abort ();
++
++ if (__atomic_fetch_add (v, count, __ATOMIC_ACQ_REL) != 4)
++ abort ();
++
++ if (__atomic_fetch_add (v, 1, __ATOMIC_SEQ_CST) != 5)
++ abort ();
++}
++
++
++void
++test_fetch_sub (short* v)
++{
++ *v = res = 20;
++ count = 0;
++
++ if (__atomic_fetch_sub (v, count + 1, __ATOMIC_RELAXED) != res--)
++ abort ();
++
++ if (__atomic_fetch_sub (v, 1, __ATOMIC_CONSUME) != res--)
++ abort ();
++
++ if (__atomic_fetch_sub (v, count + 1, __ATOMIC_ACQUIRE) != res--)
++ abort ();
++
++ if (__atomic_fetch_sub (v, 1, __ATOMIC_RELEASE) != res--)
++ abort ();
++
++ if (__atomic_fetch_sub (v, count + 1, __ATOMIC_ACQ_REL) != res--)
++ abort ();
++
++ if (__atomic_fetch_sub (v, 1, __ATOMIC_SEQ_CST) != res--)
++ abort ();
++}
++
++void
++test_fetch_and (short* v)
++{
++ *v = init;
++
++ if (__atomic_fetch_and (v, 0, __ATOMIC_RELAXED) != init)
++ abort ();
++
++ if (__atomic_fetch_and (v, init, __ATOMIC_CONSUME) != 0)
++ abort ();
++
++ if (__atomic_fetch_and (v, 0, __ATOMIC_ACQUIRE) != 0)
++ abort ();
++
++ *v = ~*v;
++ if (__atomic_fetch_and (v, init, __ATOMIC_RELEASE) != init)
++ abort ();
++
++ if (__atomic_fetch_and (v, 0, __ATOMIC_ACQ_REL) != init)
++ abort ();
++
++ if (__atomic_fetch_and (v, 0, __ATOMIC_SEQ_CST) != 0)
++ abort ();
++}
++
++void
++test_fetch_nand (short* v)
++{
++ *v = init;
++
++ if (__atomic_fetch_nand (v, 0, __ATOMIC_RELAXED) != init)
++ abort ();
++
++ if (__atomic_fetch_nand (v, init, __ATOMIC_CONSUME) != init)
++ abort ();
++
++ if (__atomic_fetch_nand (v, 0, __ATOMIC_ACQUIRE) != 0 )
++ abort ();
++
++ if (__atomic_fetch_nand (v, init, __ATOMIC_RELEASE) != init)
++ abort ();
++
++ if (__atomic_fetch_nand (v, init, __ATOMIC_ACQ_REL) != 0)
++ abort ();
++
++ if (__atomic_fetch_nand (v, 0, __ATOMIC_SEQ_CST) != init)
++ abort ();
++}
++
++void
++test_fetch_xor (short* v)
++{
++ *v = init;
++ count = 0;
++
++ if (__atomic_fetch_xor (v, count, __ATOMIC_RELAXED) != init)
++ abort ();
++
++ if (__atomic_fetch_xor (v, ~count, __ATOMIC_CONSUME) != init)
++ abort ();
++
++ if (__atomic_fetch_xor (v, 0, __ATOMIC_ACQUIRE) != 0)
++ abort ();
++
++ if (__atomic_fetch_xor (v, ~count, __ATOMIC_RELEASE) != 0)
++ abort ();
++
++ if (__atomic_fetch_xor (v, 0, __ATOMIC_ACQ_REL) != init)
++ abort ();
++
++ if (__atomic_fetch_xor (v, ~count, __ATOMIC_SEQ_CST) != init)
++ abort ();
++}
++
++void
++test_fetch_or (short* v)
++{
++ *v = 0;
++ count = 1;
++
++ if (__atomic_fetch_or (v, count, __ATOMIC_RELAXED) != 0)
++ abort ();
++
++ count *= 2;
++ if (__atomic_fetch_or (v, 2, __ATOMIC_CONSUME) != 1)
++ abort ();
++
++ count *= 2;
++ if (__atomic_fetch_or (v, count, __ATOMIC_ACQUIRE) != 3)
++ abort ();
++
++ count *= 2;
++ if (__atomic_fetch_or (v, 8, __ATOMIC_RELEASE) != 7)
++ abort ();
++
++ count *= 2;
++ if (__atomic_fetch_or (v, count, __ATOMIC_ACQ_REL) != 15)
++ abort ();
++
++ count *= 2;
++ if (__atomic_fetch_or (v, count, __ATOMIC_SEQ_CST) != 31)
++ abort ();
++}
++
++/* The OP_fetch routines return the new value after the operation. */
++
++void
++test_add_fetch (short* v)
++{
++ *v = 0;
++ count = 1;
++
++ if (__atomic_add_fetch (v, count, __ATOMIC_RELAXED) != 1)
++ abort ();
++
++ if (__atomic_add_fetch (v, 1, __ATOMIC_CONSUME) != 2)
++ abort ();
++
++ if (__atomic_add_fetch (v, count, __ATOMIC_ACQUIRE) != 3)
++ abort ();
++
++ if (__atomic_add_fetch (v, 1, __ATOMIC_RELEASE) != 4)
++ abort ();
++
++ if (__atomic_add_fetch (v, count, __ATOMIC_ACQ_REL) != 5)
++ abort ();
++
++ if (__atomic_add_fetch (v, count, __ATOMIC_SEQ_CST) != 6)
++ abort ();
++}
++
++
++void
++test_sub_fetch (short* v)
++{
++ *v = res = 20;
++ count = 0;
++
++ if (__atomic_sub_fetch (v, count + 1, __ATOMIC_RELAXED) != --res)
++ abort ();
++
++ if (__atomic_sub_fetch (v, 1, __ATOMIC_CONSUME) != --res)
++ abort ();
++
++ if (__atomic_sub_fetch (v, count + 1, __ATOMIC_ACQUIRE) != --res)
++ abort ();
++
++ if (__atomic_sub_fetch (v, 1, __ATOMIC_RELEASE) != --res)
++ abort ();
++
++ if (__atomic_sub_fetch (v, count + 1, __ATOMIC_ACQ_REL) != --res)
++ abort ();
++
++ if (__atomic_sub_fetch (v, count + 1, __ATOMIC_SEQ_CST) != --res)
++ abort ();
++}
++
++void
++test_and_fetch (short* v)
++{
++ *v = init;
++
++ if (__atomic_and_fetch (v, 0, __ATOMIC_RELAXED) != 0)
++ abort ();
++
++ *v = init;
++ if (__atomic_and_fetch (v, init, __ATOMIC_CONSUME) != init)
++ abort ();
++
++ if (__atomic_and_fetch (v, 0, __ATOMIC_ACQUIRE) != 0)
++ abort ();
++
++ *v = ~*v;
++ if (__atomic_and_fetch (v, init, __ATOMIC_RELEASE) != init)
++ abort ();
++
++ if (__atomic_and_fetch (v, 0, __ATOMIC_ACQ_REL) != 0)
++ abort ();
++
++ *v = ~*v;
++ if (__atomic_and_fetch (v, 0, __ATOMIC_SEQ_CST) != 0)
++ abort ();
++}
++
++void
++test_nand_fetch (short* v)
++{
++ *v = init;
++
++ if (__atomic_nand_fetch (v, 0, __ATOMIC_RELAXED) != init)
++ abort ();
++
++ if (__atomic_nand_fetch (v, init, __ATOMIC_CONSUME) != 0)
++ abort ();
++
++ if (__atomic_nand_fetch (v, 0, __ATOMIC_ACQUIRE) != init)
++ abort ();
++
++ if (__atomic_nand_fetch (v, init, __ATOMIC_RELEASE) != 0)
++ abort ();
++
++ if (__atomic_nand_fetch (v, init, __ATOMIC_ACQ_REL) != init)
++ abort ();
++
++ if (__atomic_nand_fetch (v, 0, __ATOMIC_SEQ_CST) != init)
++ abort ();
++}
++
++
++
++void
++test_xor_fetch (short* v)
++{
++ *v = init;
++ count = 0;
++
++ if (__atomic_xor_fetch (v, count, __ATOMIC_RELAXED) != init)
++ abort ();
++
++ if (__atomic_xor_fetch (v, ~count, __ATOMIC_CONSUME) != 0)
++ abort ();
++
++ if (__atomic_xor_fetch (v, 0, __ATOMIC_ACQUIRE) != 0)
++ abort ();
++
++ if (__atomic_xor_fetch (v, ~count, __ATOMIC_RELEASE) != init)
++ abort ();
++
++ if (__atomic_xor_fetch (v, 0, __ATOMIC_ACQ_REL) != init)
++ abort ();
++
++ if (__atomic_xor_fetch (v, ~count, __ATOMIC_SEQ_CST) != 0)
++ abort ();
++}
++
++void
++test_or_fetch (short* v)
++{
++ *v = 0;
++ count = 1;
++
++ if (__atomic_or_fetch (v, count, __ATOMIC_RELAXED) != 1)
++ abort ();
++
++ count *= 2;
++ if (__atomic_or_fetch (v, 2, __ATOMIC_CONSUME) != 3)
++ abort ();
++
++ count *= 2;
++ if (__atomic_or_fetch (v, count, __ATOMIC_ACQUIRE) != 7)
++ abort ();
++
++ count *= 2;
++ if (__atomic_or_fetch (v, 8, __ATOMIC_RELEASE) != 15)
++ abort ();
++
++ count *= 2;
++ if (__atomic_or_fetch (v, count, __ATOMIC_ACQ_REL) != 31)
++ abort ();
++
++ count *= 2;
++ if (__atomic_or_fetch (v, count, __ATOMIC_SEQ_CST) != 63)
++ abort ();
++}
++
++
++/* Test the OP routines with a result which isn't used. Use both variations
++ within each function. */
++
++void
++test_add (short* v)
++{
++ *v = 0;
++ count = 1;
++
++ __atomic_add_fetch (v, count, __ATOMIC_RELAXED);
++ if (*v != 1)
++ abort ();
++
++ __atomic_fetch_add (v, count, __ATOMIC_CONSUME);
++ if (*v != 2)
++ abort ();
++
++ __atomic_add_fetch (v, 1 , __ATOMIC_ACQUIRE);
++ if (*v != 3)
++ abort ();
++
++ __atomic_fetch_add (v, 1, __ATOMIC_RELEASE);
++ if (*v != 4)
++ abort ();
++
++ __atomic_add_fetch (v, count, __ATOMIC_ACQ_REL);
++ if (*v != 5)
++ abort ();
++
++ __atomic_fetch_add (v, count, __ATOMIC_SEQ_CST);
++ if (*v != 6)
++ abort ();
++}
++
++
++void
++test_sub (short* v)
++{
++ *v = res = 20;
++ count = 0;
++
++ __atomic_sub_fetch (v, count + 1, __ATOMIC_RELAXED);
++ if (*v != --res)
++ abort ();
++
++ __atomic_fetch_sub (v, count + 1, __ATOMIC_CONSUME);
++ if (*v != --res)
++ abort ();
++
++ __atomic_sub_fetch (v, 1, __ATOMIC_ACQUIRE);
++ if (*v != --res)
++ abort ();
++
++ __atomic_fetch_sub (v, 1, __ATOMIC_RELEASE);
++ if (*v != --res)
++ abort ();
++
++ __atomic_sub_fetch (v, count + 1, __ATOMIC_ACQ_REL);
++ if (*v != --res)
++ abort ();
++
++ __atomic_fetch_sub (v, count + 1, __ATOMIC_SEQ_CST);
++ if (*v != --res)
++ abort ();
++}
++
++void
++test_and (short* v)
++{
++ *v = init;
++
++ __atomic_and_fetch (v, 0, __ATOMIC_RELAXED);
++ if (*v != 0)
++ abort ();
++
++ *v = init;
++ __atomic_fetch_and (v, init, __ATOMIC_CONSUME);
++ if (*v != init)
++ abort ();
++
++ __atomic_and_fetch (v, 0, __ATOMIC_ACQUIRE);
++ if (*v != 0)
++ abort ();
++
++ *v = ~*v;
++ __atomic_fetch_and (v, init, __ATOMIC_RELEASE);
++ if (*v != init)
++ abort ();
++
++ __atomic_and_fetch (v, 0, __ATOMIC_ACQ_REL);
++ if (*v != 0)
++ abort ();
++
++ *v = ~*v;
++ __atomic_fetch_and (v, 0, __ATOMIC_SEQ_CST);
++ if (*v != 0)
++ abort ();
++}
++
++void
++test_nand (short* v)
++{
++ *v = init;
++
++ __atomic_fetch_nand (v, 0, __ATOMIC_RELAXED);
++ if (*v != init)
++ abort ();
++
++ __atomic_fetch_nand (v, init, __ATOMIC_CONSUME);
++ if (*v != 0)
++ abort ();
++
++ __atomic_nand_fetch (v, 0, __ATOMIC_ACQUIRE);
++ if (*v != init)
++ abort ();
++
++ __atomic_nand_fetch (v, init, __ATOMIC_RELEASE);
++ if (*v != 0)
++ abort ();
++
++ __atomic_fetch_nand (v, init, __ATOMIC_ACQ_REL);
++ if (*v != init)
++ abort ();
++
++ __atomic_nand_fetch (v, 0, __ATOMIC_SEQ_CST);
++ if (*v != init)
++ abort ();
++}
++
++
++
++void
++test_xor (short* v)
++{
++ *v = init;
++ count = 0;
++
++ __atomic_xor_fetch (v, count, __ATOMIC_RELAXED);
++ if (*v != init)
++ abort ();
++
++ __atomic_fetch_xor (v, ~count, __ATOMIC_CONSUME);
++ if (*v != 0)
++ abort ();
++
++ __atomic_xor_fetch (v, 0, __ATOMIC_ACQUIRE);
++ if (*v != 0)
++ abort ();
++
++ __atomic_fetch_xor (v, ~count, __ATOMIC_RELEASE);
++ if (*v != init)
++ abort ();
++
++ __atomic_fetch_xor (v, 0, __ATOMIC_ACQ_REL);
++ if (*v != init)
++ abort ();
++
++ __atomic_xor_fetch (v, ~count, __ATOMIC_SEQ_CST);
++ if (*v != 0)
++ abort ();
++}
++
++void
++test_or (short* v)
++{
++ *v = 0;
++ count = 1;
++
++ __atomic_or_fetch (v, count, __ATOMIC_RELAXED);
++ if (*v != 1)
++ abort ();
++
++ count *= 2;
++ __atomic_fetch_or (v, count, __ATOMIC_CONSUME);
++ if (*v != 3)
++ abort ();
++
++ count *= 2;
++ __atomic_or_fetch (v, 4, __ATOMIC_ACQUIRE);
++ if (*v != 7)
++ abort ();
++
++ count *= 2;
++ __atomic_fetch_or (v, 8, __ATOMIC_RELEASE);
++ if (*v != 15)
++ abort ();
++
++ count *= 2;
++ __atomic_or_fetch (v, count, __ATOMIC_ACQ_REL);
++ if (*v != 31)
++ abort ();
++
++ count *= 2;
++ __atomic_fetch_or (v, count, __ATOMIC_SEQ_CST);
++ if (*v != 63)
++ abort ();
++}
++
++int
++main () {
++ short* V[] = {&A.a, &A.b};
++
++ for (int i = 0; i < 2; i++) {
++ test_fetch_add (V[i]);
++ test_fetch_sub (V[i]);
++ test_fetch_and (V[i]);
++ test_fetch_nand (V[i]);
++ test_fetch_xor (V[i]);
++ test_fetch_or (V[i]);
++
++ test_add_fetch (V[i]);
++ test_sub_fetch (V[i]);
++ test_and_fetch (V[i]);
++ test_nand_fetch (V[i]);
++ test_xor_fetch (V[i]);
++ test_or_fetch (V[i]);
++
++ test_add (V[i]);
++ test_sub (V[i]);
++ test_and (V[i]);
++ test_nand (V[i]);
++ test_xor (V[i]);
++ test_or (V[i]);
++ }
++
++ return 0;
++}
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-5.c
+@@ -0,0 +1,87 @@
++/* Test __atomic routines for existence and proper execution on 1 byte
++ values with each valid memory model. */
++/* Duplicate logic as libatomic/testsuite/libatomic.c/atomic-compare-exchange-1.c */
++/* { dg-do run } */
++/* { dg-options "-minline-atomics" } */
++
++/* Test the execution of the __atomic_compare_exchange_n builtin for a char. */
++
++extern void abort(void);
++
++char v = 0;
++char expected = 0;
++char max = ~0;
++char desired = ~0;
++char zero = 0;
++
++#define STRONG 0
++#define WEAK 1
++
++int
++main ()
++{
++
++ if (!__atomic_compare_exchange_n (&v, &expected, max, STRONG , __ATOMIC_RELAXED, __ATOMIC_RELAXED))
++ abort ();
++ if (expected != 0)
++ abort ();
++
++ if (__atomic_compare_exchange_n (&v, &expected, 0, STRONG , __ATOMIC_ACQUIRE, __ATOMIC_RELAXED))
++ abort ();
++ if (expected != max)
++ abort ();
++
++ if (!__atomic_compare_exchange_n (&v, &expected, 0, STRONG , __ATOMIC_RELEASE, __ATOMIC_ACQUIRE))
++ abort ();
++ if (expected != max)
++ abort ();
++ if (v != 0)
++ abort ();
++
++ if (__atomic_compare_exchange_n (&v, &expected, desired, WEAK, __ATOMIC_ACQ_REL, __ATOMIC_ACQUIRE))
++ abort ();
++ if (expected != 0)
++ abort ();
++
++ if (!__atomic_compare_exchange_n (&v, &expected, desired, STRONG , __ATOMIC_SEQ_CST, __ATOMIC_SEQ_CST))
++ abort ();
++ if (expected != 0)
++ abort ();
++ if (v != max)
++ abort ();
++
++ /* Now test the generic version. */
++
++ v = 0;
++
++ if (!__atomic_compare_exchange (&v, &expected, &max, STRONG, __ATOMIC_RELAXED, __ATOMIC_RELAXED))
++ abort ();
++ if (expected != 0)
++ abort ();
++
++ if (__atomic_compare_exchange (&v, &expected, &zero, STRONG , __ATOMIC_ACQUIRE, __ATOMIC_RELAXED))
++ abort ();
++ if (expected != max)
++ abort ();
++
++ if (!__atomic_compare_exchange (&v, &expected, &zero, STRONG , __ATOMIC_RELEASE, __ATOMIC_ACQUIRE))
++ abort ();
++ if (expected != max)
++ abort ();
++ if (v != 0)
++ abort ();
++
++ if (__atomic_compare_exchange (&v, &expected, &desired, WEAK, __ATOMIC_ACQ_REL, __ATOMIC_ACQUIRE))
++ abort ();
++ if (expected != 0)
++ abort ();
++
++ if (!__atomic_compare_exchange (&v, &expected, &desired, STRONG , __ATOMIC_SEQ_CST, __ATOMIC_SEQ_CST))
++ abort ();
++ if (expected != 0)
++ abort ();
++ if (v != max)
++ abort ();
++
++ return 0;
++}
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-6.c
+@@ -0,0 +1,87 @@
++/* Test __atomic routines for existence and proper execution on 2 byte
++ values with each valid memory model. */
++/* Duplicate logic as libatomic/testsuite/libatomic.c/atomic-compare-exchange-2.c */
++/* { dg-do run } */
++/* { dg-options "-minline-atomics" } */
++
++/* Test the execution of the __atomic_compare_exchange_n builtin for a short. */
++
++extern void abort(void);
++
++short v = 0;
++short expected = 0;
++short max = ~0;
++short desired = ~0;
++short zero = 0;
++
++#define STRONG 0
++#define WEAK 1
++
++int
++main ()
++{
++
++ if (!__atomic_compare_exchange_n (&v, &expected, max, STRONG , __ATOMIC_RELAXED, __ATOMIC_RELAXED))
++ abort ();
++ if (expected != 0)
++ abort ();
++
++ if (__atomic_compare_exchange_n (&v, &expected, 0, STRONG , __ATOMIC_ACQUIRE, __ATOMIC_RELAXED))
++ abort ();
++ if (expected != max)
++ abort ();
++
++ if (!__atomic_compare_exchange_n (&v, &expected, 0, STRONG , __ATOMIC_RELEASE, __ATOMIC_ACQUIRE))
++ abort ();
++ if (expected != max)
++ abort ();
++ if (v != 0)
++ abort ();
++
++ if (__atomic_compare_exchange_n (&v, &expected, desired, WEAK, __ATOMIC_ACQ_REL, __ATOMIC_ACQUIRE))
++ abort ();
++ if (expected != 0)
++ abort ();
++
++ if (!__atomic_compare_exchange_n (&v, &expected, desired, STRONG , __ATOMIC_SEQ_CST, __ATOMIC_SEQ_CST))
++ abort ();
++ if (expected != 0)
++ abort ();
++ if (v != max)
++ abort ();
++
++ /* Now test the generic version. */
++
++ v = 0;
++
++ if (!__atomic_compare_exchange (&v, &expected, &max, STRONG, __ATOMIC_RELAXED, __ATOMIC_RELAXED))
++ abort ();
++ if (expected != 0)
++ abort ();
++
++ if (__atomic_compare_exchange (&v, &expected, &zero, STRONG , __ATOMIC_ACQUIRE, __ATOMIC_RELAXED))
++ abort ();
++ if (expected != max)
++ abort ();
++
++ if (!__atomic_compare_exchange (&v, &expected, &zero, STRONG , __ATOMIC_RELEASE, __ATOMIC_ACQUIRE))
++ abort ();
++ if (expected != max)
++ abort ();
++ if (v != 0)
++ abort ();
++
++ if (__atomic_compare_exchange (&v, &expected, &desired, WEAK, __ATOMIC_ACQ_REL, __ATOMIC_ACQUIRE))
++ abort ();
++ if (expected != 0)
++ abort ();
++
++ if (!__atomic_compare_exchange (&v, &expected, &desired, STRONG , __ATOMIC_SEQ_CST, __ATOMIC_SEQ_CST))
++ abort ();
++ if (expected != 0)
++ abort ();
++ if (v != max)
++ abort ();
++
++ return 0;
++}
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-7.c
+@@ -0,0 +1,69 @@
++/* Test __atomic routines for existence and proper execution on 1 byte
++ values with each valid memory model. */
++/* Duplicate logic as libatomic/testsuite/libatomic.c/atomic-exchange-1.c */
++/* { dg-do run } */
++/* { dg-options "-minline-atomics" } */
++
++/* Test the execution of the __atomic_exchange_n builtin for a char. */
++
++extern void abort(void);
++
++char v, count, ret;
++
++int
++main ()
++{
++ v = 0;
++ count = 0;
++
++ if (__atomic_exchange_n (&v, count + 1, __ATOMIC_RELAXED) != count)
++ abort ();
++ count++;
++
++ if (__atomic_exchange_n (&v, count + 1, __ATOMIC_ACQUIRE) != count)
++ abort ();
++ count++;
++
++ if (__atomic_exchange_n (&v, count + 1, __ATOMIC_RELEASE) != count)
++ abort ();
++ count++;
++
++ if (__atomic_exchange_n (&v, count + 1, __ATOMIC_ACQ_REL) != count)
++ abort ();
++ count++;
++
++ if (__atomic_exchange_n (&v, count + 1, __ATOMIC_SEQ_CST) != count)
++ abort ();
++ count++;
++
++ /* Now test the generic version. */
++
++ count++;
++
++ __atomic_exchange (&v, &count, &ret, __ATOMIC_RELAXED);
++ if (ret != count - 1 || v != count)
++ abort ();
++ count++;
++
++ __atomic_exchange (&v, &count, &ret, __ATOMIC_ACQUIRE);
++ if (ret != count - 1 || v != count)
++ abort ();
++ count++;
++
++ __atomic_exchange (&v, &count, &ret, __ATOMIC_RELEASE);
++ if (ret != count - 1 || v != count)
++ abort ();
++ count++;
++
++ __atomic_exchange (&v, &count, &ret, __ATOMIC_ACQ_REL);
++ if (ret != count - 1 || v != count)
++ abort ();
++ count++;
++
++ __atomic_exchange (&v, &count, &ret, __ATOMIC_SEQ_CST);
++ if (ret != count - 1 || v != count)
++ abort ();
++ count++;
++
++ return 0;
++}
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/riscv/inline-atomics-8.c
+@@ -0,0 +1,69 @@
++/* Test __atomic routines for existence and proper execution on 2 byte
++ values with each valid memory model. */
++/* Duplicate logic as libatomic/testsuite/libatomic.c/atomic-exchange-2.c */
++/* { dg-do run } */
++/* { dg-options "-minline-atomics" } */
++
++/* Test the execution of the __atomic_X builtin for a short. */
++
++extern void abort(void);
++
++short v, count, ret;
++
++int
++main ()
++{
++ v = 0;
++ count = 0;
++
++ if (__atomic_exchange_n (&v, count + 1, __ATOMIC_RELAXED) != count)
++ abort ();
++ count++;
++
++ if (__atomic_exchange_n (&v, count + 1, __ATOMIC_ACQUIRE) != count)
++ abort ();
++ count++;
++
++ if (__atomic_exchange_n (&v, count + 1, __ATOMIC_RELEASE) != count)
++ abort ();
++ count++;
++
++ if (__atomic_exchange_n (&v, count + 1, __ATOMIC_ACQ_REL) != count)
++ abort ();
++ count++;
++
++ if (__atomic_exchange_n (&v, count + 1, __ATOMIC_SEQ_CST) != count)
++ abort ();
++ count++;
++
++ /* Now test the generic version. */
++
++ count++;
++
++ __atomic_exchange (&v, &count, &ret, __ATOMIC_RELAXED);
++ if (ret != count - 1 || v != count)
++ abort ();
++ count++;
++
++ __atomic_exchange (&v, &count, &ret, __ATOMIC_ACQUIRE);
++ if (ret != count - 1 || v != count)
++ abort ();
++ count++;
++
++ __atomic_exchange (&v, &count, &ret, __ATOMIC_RELEASE);
++ if (ret != count - 1 || v != count)
++ abort ();
++ count++;
++
++ __atomic_exchange (&v, &count, &ret, __ATOMIC_ACQ_REL);
++ if (ret != count - 1 || v != count)
++ abort ();
++ count++;
++
++ __atomic_exchange (&v, &count, &ret, __ATOMIC_SEQ_CST);
++ if (ret != count - 1 || v != count)
++ abort ();
++ count++;
++
++ return 0;
++}
+--- a/libgcc/config/riscv/atomic.c
++++ b/libgcc/config/riscv/atomic.c
+@@ -30,6 +30,8 @@ see the files COPYING3 and COPYING.RUNTI
+ #define INVERT "not %[tmp1], %[tmp1]\n\t"
+ #define DONT_INVERT ""
+
++/* Logic duplicated in gcc/gcc/config/riscv/sync.md for use when inlining is enabled */
++
+ #define GENERATE_FETCH_AND_OP(type, size, opname, insn, invert, cop) \
+ type __sync_fetch_and_ ## opname ## _ ## size (type *p, type v) \
+ { \
--- /dev/null
+From 203f3060dd363361b172f7295f42bb6bf5ac0b3b Mon Sep 17 00:00:00 2001
+From: Andreas Schwab <schwab@suse.de>
+Date: Sat, 23 Apr 2022 15:48:42 +0200
+Subject: [PATCH] riscv/linux: Don't add -latomic with -pthread
+
+Now that we have support for inline subword atomic operations, it is no
+longer necessary to link against libatomic. This also fixes testsuite
+failures because the framework does not properly set up the linker flags
+for finding libatomic.
+The use of atomic operations is also independent of the use of libpthread.
+
+gcc/
+ * config/riscv/linux.h (LIB_SPEC): Don't redefine.
+---
+ gcc/config/riscv/linux.h | 10 ----------
+ 1 file changed, 10 deletions(-)
+
+--- a/gcc/config/riscv/linux.h
++++ b/gcc/config/riscv/linux.h
+@@ -35,16 +35,6 @@ along with GCC; see the file COPYING3.
+ #undef MUSL_DYNAMIC_LINKER
+ #define MUSL_DYNAMIC_LINKER "/lib/ld-musl-riscv" XLEN_SPEC MUSL_ABI_SUFFIX ".so.1"
+
+-/* Because RISC-V only has word-sized atomics, it requries libatomic where
+- others do not. So link libatomic by default, as needed. */
+-#undef LIB_SPEC
+-#ifdef LD_AS_NEEDED_OPTION
+-#define LIB_SPEC GNU_USER_TARGET_LIB_SPEC \
+- " %{pthread:" LD_AS_NEEDED_OPTION " -latomic " LD_NO_AS_NEEDED_OPTION "}"
+-#else
+-#define LIB_SPEC GNU_USER_TARGET_LIB_SPEC " -latomic "
+-#endif
+-
+ #define ICACHE_FLUSH_FUNC "__riscv_flush_icache"
+
+ #define CPP_SPEC "%{pthread:-D_REENTRANT}"
--- /dev/null
+commit 8570c4be394cff7282f332f97da2ff569a927ddb
+Author: Imre Kaloz <kaloz@openwrt.org>
+Date: Wed Feb 2 20:06:12 2011 +0000
+
+ fixup arm soft-float symbols
+
+ SVN-Revision: 25325
+
+--- a/libgcc/config/arm/t-linux
++++ b/libgcc/config/arm/t-linux
+@@ -1,6 +1,10 @@
+ LIB1ASMSRC = arm/lib1funcs.S
+ LIB1ASMFUNCS = _udivsi3 _divsi3 _umodsi3 _modsi3 _dvmd_lnx _clzsi2 _clzdi2 \
+- _ctzsi2 _arm_addsubdf3 _arm_addsubsf3
++ _ctzsi2 _arm_addsubdf3 _arm_addsubsf3 \
++ _arm_negdf2 _arm_muldivdf3 _arm_cmpdf2 _arm_unorddf2 \
++ _arm_fixdfsi _arm_fixunsdfsi _arm_truncdfsf2 \
++ _arm_negsf2 _arm_muldivsf3 _arm_cmpsf2 _arm_unordsf2 \
++ _arm_fixsfsi _arm_fixunssfsi
+
+ # Just for these, we omit the frame pointer since it makes such a big
+ # difference.
+--- a/gcc/config/arm/linux-elf.h
++++ b/gcc/config/arm/linux-elf.h
+@@ -58,8 +58,6 @@
+ %{shared:-lc} \
+ %{!shared:%{profile:-lc_p}%{!profile:-lc}}"
+
+-#define LIBGCC_SPEC "%{mfloat-abi=soft*:-lfloat} -lgcc"
+-
+ #define GLIBC_DYNAMIC_LINKER "/lib/ld-linux.so.2"
+
+ #define LINUX_TARGET_LINK_SPEC "%{h*} \
--- /dev/null
+commit c96312958c0621e72c9b32da5bc224ffe2161384
+Author: Felix Fietkau <nbd@openwrt.org>
+Date: Mon Oct 19 23:26:09 2009 +0000
+
+ gcc: create a proper libgcc_pic.a static library for relinking (4.3.3+ for now, backport will follow)
+
+ SVN-Revision: 18086
+
+--- a/libgcc/Makefile.in
++++ b/libgcc/Makefile.in
+@@ -930,11 +930,12 @@ $(libgcov-driver-objects): %$(objext): $
+
+ # Static libraries.
+ libgcc.a: $(libgcc-objects)
++libgcc_pic.a: $(libgcc-s-objects)
+ libgcov.a: $(libgcov-objects)
+ libunwind.a: $(libunwind-objects)
+ libgcc_eh.a: $(libgcc-eh-objects)
+
+-libgcc.a libgcov.a libunwind.a libgcc_eh.a:
++libgcc.a libgcov.a libunwind.a libgcc_eh.a libgcc_pic.a:
+ -rm -f $@
+
+ objects="$(objects)"; \
+@@ -958,7 +959,7 @@ all: libunwind.a
+ endif
+
+ ifeq ($(enable_shared),yes)
+-all: libgcc_eh.a libgcc_s$(SHLIB_EXT)
++all: libgcc_eh.a libgcc_pic.a libgcc_s$(SHLIB_EXT)
+ ifneq ($(LIBUNWIND),)
+ all: libunwind$(SHLIB_EXT)
+ libgcc_s$(SHLIB_EXT): libunwind$(SHLIB_EXT)
+@@ -1164,6 +1165,10 @@ install-shared:
+ chmod 644 $(DESTDIR)$(inst_libdir)/libgcc_eh.a
+ $(RANLIB) $(DESTDIR)$(inst_libdir)/libgcc_eh.a
+
++ $(INSTALL_DATA) libgcc_pic.a $(mapfile) $(DESTDIR)$(inst_libdir)/
++ chmod 644 $(DESTDIR)$(inst_libdir)/libgcc_pic.a
++ $(RANLIB) $(DESTDIR)$(inst_libdir)/libgcc_pic.a
++
+ $(subst @multilib_dir@,$(MULTIDIR),$(subst \
+ @shlib_base_name@,libgcc_s,$(subst \
+ @shlib_slibdir_qual@,$(MULTIOSSUBDIR),$(SHLIB_INSTALL))))
--- /dev/null
+commit 7edc8ca5456d9743dd0075eb3cc5b04f4f24c8cc
+Author: Imre Kaloz <kaloz@openwrt.org>
+Date: Wed Feb 2 19:34:36 2011 +0000
+
+ add armv4 fixup patches
+
+ SVN-Revision: 25322
+
+
+--- a/gcc/config/arm/linux-eabi.h
++++ b/gcc/config/arm/linux-eabi.h
+@@ -91,10 +91,15 @@
+ #define MUSL_DYNAMIC_LINKER \
+ "/lib/ld-musl-arm" MUSL_DYNAMIC_LINKER_E "%{mfloat-abi=hard:hf}%{mfdpic:-fdpic}.so.1"
+
++/* For armv4 we pass --fix-v4bx to linker to support EABI */
++#undef TARGET_FIX_V4BX_SPEC
++#define TARGET_FIX_V4BX_SPEC " %{mcpu=arm8|mcpu=arm810|mcpu=strongarm*"\
++ "|march=armv4|mcpu=fa526|mcpu=fa626:--fix-v4bx}"
++
+ /* At this point, bpabi.h will have clobbered LINK_SPEC. We want to
+ use the GNU/Linux version, not the generic BPABI version. */
+ #undef LINK_SPEC
+-#define LINK_SPEC EABI_LINK_SPEC \
++#define LINK_SPEC EABI_LINK_SPEC TARGET_FIX_V4BX_SPEC \
+ LINUX_OR_ANDROID_LD (LINUX_TARGET_LINK_SPEC, \
+ LINUX_TARGET_LINK_SPEC " " ANDROID_LINK_SPEC)
+
--- /dev/null
+commit dcfc40358b5a3cae7320c17f8d1cebd5ad5540cd
+Author: Felix Fietkau <nbd@openwrt.org>
+Date: Sun Feb 12 20:25:47 2012 +0000
+
+ gcc 4.6: port over the missing patch 850-use_shared_libgcc.patch to prevent libgcc crap from leaking into every single binary
+
+ SVN-Revision: 30486
+--- a/gcc/config/arm/linux-eabi.h
++++ b/gcc/config/arm/linux-eabi.h
+@@ -132,10 +132,6 @@
+ "%{Ofast|ffast-math|funsafe-math-optimizations:crtfastmath.o%s} " \
+ LINUX_OR_ANDROID_LD (GNU_USER_TARGET_ENDFILE_SPEC, ANDROID_ENDFILE_SPEC)
+
+-/* Use the default LIBGCC_SPEC, not the version in linux-elf.h, as we
+- do not use -lfloat. */
+-#undef LIBGCC_SPEC
+-
+ /* Clear the instruction cache from `beg' to `end'. This is
+ implemented in lib1funcs.S, so ensure an error if this definition
+ is used. */
+--- a/gcc/config/linux.h
++++ b/gcc/config/linux.h
+@@ -71,6 +71,10 @@ see the files COPYING3 and COPYING.RUNTI
+ builtin_version ("CRuntime_Musl"); \
+ } while (0)
+
++#ifndef LIBGCC_SPEC
++#define LIBGCC_SPEC "%{static|static-libgcc:-lgcc}%{!static:%{!static-libgcc:-lgcc_s}}"
++#endif
++
+ /* Determine which dynamic linker to use depending on whether GLIBC or
+ uClibc or Bionic or musl is the default C library and whether
+ -muclibc or -mglibc or -mbionic or -mmusl has been passed to change
+--- a/libgcc/mkmap-symver.awk
++++ b/libgcc/mkmap-symver.awk
+@@ -136,5 +136,5 @@ function output(lib) {
+ else if (inherit[lib])
+ printf("} %s;\n", inherit[lib]);
+ else
+- printf ("\n local:\n\t*;\n};\n");
++ printf ("\n\t*;\n};\n");
+ }
+--- a/gcc/config/rs6000/linux.h
++++ b/gcc/config/rs6000/linux.h
+@@ -67,6 +67,9 @@
+ #undef CPP_OS_DEFAULT_SPEC
+ #define CPP_OS_DEFAULT_SPEC "%(cpp_os_linux)"
+
++#undef LIBGCC_SPEC
++#define LIBGCC_SPEC "%{!static:%{!static-libgcc:-lgcc_s}} -lgcc"
++
+ #undef LINK_SHLIB_SPEC
+ #define LINK_SHLIB_SPEC "%{shared:-shared} %{!shared: %{static:-static}} \
+ %{static-pie:-static -pie --no-dynamic-linker -z text}"
--- /dev/null
+commit 64661de100da1ec1061ef3e5e400285dce115e6b
+Author: Felix Fietkau <nbd@openwrt.org>
+Date: Sun May 10 13:16:35 2015 +0000
+
+ gcc: add some size optimization patches
+
+ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+
+ SVN-Revision: 45664
+
+--- a/libgcc/config/t-libunwind
++++ b/libgcc/config/t-libunwind
+@@ -2,8 +2,7 @@
+
+ HOST_LIBGCC2_CFLAGS += -DUSE_GAS_SYMVER
+
+-LIB2ADDEH = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c \
+- $(srcdir)/unwind-compat.c $(srcdir)/unwind-dw2-fde-compat.c
++LIB2ADDEH = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c
+ LIB2ADDEHSTATIC = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c
+
+ # Override the default value from t-slibgcc-elf-ver and mention -lunwind
--- /dev/null
+--- a/gcc/config/rs6000/rs6000-logue.cc
++++ b/gcc/config/rs6000/rs6000-logue.cc
+@@ -348,7 +348,7 @@ rs6000_savres_strategy (rs6000_stack_t *
+ /* Define cutoff for using out-of-line functions to save registers. */
+ if (DEFAULT_ABI == ABI_V4 || TARGET_ELF)
+ {
+- if (!optimize_size)
++ if (1)
+ {
+ strategy |= SAVE_INLINE_FPRS | REST_INLINE_FPRS;
+ strategy |= SAVE_INLINE_GPRS | REST_INLINE_GPRS;
--- /dev/null
+--- a/libgcc/crtstuff.c
++++ b/libgcc/crtstuff.c
+@@ -152,7 +152,7 @@ call_ ## FUNC (void) \
+ #endif
+
+ #if !defined(USE_TM_CLONE_REGISTRY) && defined(OBJECT_FORMAT_ELF)
+-# define USE_TM_CLONE_REGISTRY 1
++# define USE_TM_CLONE_REGISTRY 0
+ #elif !defined(USE_TM_CLONE_REGISTRY)
+ # define USE_TM_CLONE_REGISTRY 0
+ #endif
--- /dev/null
+--- a/libgcc/config/mips/t-mips16
++++ b/libgcc/config/mips/t-mips16
+@@ -43,3 +43,6 @@ SYNC_CFLAGS = -mno-mips16
+
+ # Version these symbols if building libgcc.so.
+ SHLIB_MAPFILES += $(srcdir)/config/mips/libgcc-mips16.ver
++
++CRTSTUFF_T_CFLAGS += -mno-mips16
++CRTSTUFF_T_CFLAGS_S += -mno-mips16
--- /dev/null
+commit 99368862e44740ff4fd33760893f04e14f9dbdf1
+Author: Felix Fietkau <nbd@openwrt.org>
+Date: Tue Jul 31 00:52:27 2007 +0000
+
+ Port the mbsd_multi patch from freewrt, which adds -fhonour-copts. This will emit warnings in packages that don't use our target cflags properly
+
+ SVN-Revision: 8256
+
+ This patch brings over a feature from MirBSD:
+ * -fhonour-copts
+ If this option is not given, it's warned (depending
+ on environment variables). This is to catch errors
+ of misbuilt packages which override CFLAGS themselves.
+
+ This patch was authored by Thorsten Glaser <tg at mirbsd.de>
+ with copyright assignment to the FSF in effect.
+
+--- a/gcc/c-family/c-opts.cc
++++ b/gcc/c-family/c-opts.cc
+@@ -107,6 +107,9 @@ static dump_flags_t original_dump_flags;
+ /* Whether any standard preincluded header has been preincluded. */
+ static bool done_preinclude;
+
++/* Check if a port honours COPTS. */
++static int honour_copts = 0;
++
+ static void handle_OPT_d (const char *);
+ static void set_std_cxx98 (int);
+ static void set_std_cxx11 (int);
+@@ -478,6 +481,12 @@ c_common_handle_option (size_t scode, co
+ flag_no_builtin = !value;
+ break;
+
++ case OPT_fhonour_copts:
++ if (c_language == clk_c) {
++ honour_copts++;
++ }
++ break;
++
+ case OPT_fconstant_string_class_:
+ constant_string_class_name = arg;
+ break;
+@@ -1218,6 +1227,47 @@ c_common_init (void)
+ return false;
+ }
+
++ if (c_language == clk_c) {
++ char *ev = getenv ("GCC_HONOUR_COPTS");
++ int evv;
++ if (ev == NULL)
++ evv = -1;
++ else if ((*ev == '0') || (*ev == '\0'))
++ evv = 0;
++ else if (*ev == '1')
++ evv = 1;
++ else if (*ev == '2')
++ evv = 2;
++ else if (*ev == 's')
++ evv = -1;
++ else {
++ warning (0, "unknown GCC_HONOUR_COPTS value, assuming 1");
++ evv = 1; /* maybe depend this on something like MIRBSD_NATIVE? */
++ }
++ if (evv == 1) {
++ if (honour_copts == 0) {
++ error ("someone does not honour COPTS at all in lenient mode");
++ return false;
++ } else if (honour_copts != 1) {
++ warning (0, "someone does not honour COPTS correctly, passed %d times",
++ honour_copts);
++ }
++ } else if (evv == 2) {
++ if (honour_copts == 0) {
++ error ("someone does not honour COPTS at all in strict mode");
++ return false;
++ } else if (honour_copts != 1) {
++ error ("someone does not honour COPTS correctly, passed %d times",
++ honour_copts);
++ return false;
++ }
++ } else if (evv == 0) {
++ if (honour_copts != 1)
++ inform (UNKNOWN_LOCATION, "someone does not honour COPTS correctly, passed %d times",
++ honour_copts);
++ }
++ }
++
+ return true;
+ }
+
+--- a/gcc/c-family/c.opt
++++ b/gcc/c-family/c.opt
+@@ -1755,6 +1755,9 @@ C++ ObjC++ Optimization Alias(fexception
+ fhonor-std
+ C++ ObjC++ WarnRemoved
+
++fhonour-copts
++C ObjC C++ ObjC++ RejectNegative
++
+ fhosted
+ C ObjC
+ Assume normal C execution environment.
+--- a/gcc/common.opt
++++ b/gcc/common.opt
+@@ -1770,6 +1770,9 @@ fharden-conditional-branches
+ Common Var(flag_harden_conditional_branches) Optimization
+ Harden conditional branches by checking reversed conditions.
+
++fhonour-copts
++Common RejectNegative
++
+ ; Nonzero means ignore `#ident' directives. 0 means handle them.
+ ; Generate position-independent code for executables if possible
+ ; On SVR4 targets, it also controls whether or not to emit a
+--- a/gcc/doc/invoke.texi
++++ b/gcc/doc/invoke.texi
+@@ -9597,6 +9597,17 @@ This option is only supported for C and
+ @option{-Wall} and by @option{-Wpedantic}, which can be disabled with
+ @option{-Wno-pointer-sign}.
+
++@item -fhonour-copts
++@opindex fhonour-copts
++If @env{GCC_HONOUR_COPTS} is set to 1, abort if this option is not
++given at least once, and warn if it is given more than once.
++If @env{GCC_HONOUR_COPTS} is set to 2, abort if this option is not
++given exactly once.
++If @env{GCC_HONOUR_COPTS} is set to 0 or unset, warn if this option
++is not given exactly once.
++The warning is quelled if @env{GCC_HONOUR_COPTS} is set to @samp{s}.
++This flag and environment variable only affect the C language.
++
+ @item -Wstack-protector
+ @opindex Wstack-protector
+ @opindex Wno-stack-protector
+--- a/gcc/opts.cc
++++ b/gcc/opts.cc
+@@ -2699,6 +2699,9 @@ common_handle_option (struct gcc_options
+ add_comma_separated_to_vector (&opts->x_flag_ignored_attributes, arg);
+ break;
+
++ case OPT_fhonour_copts:
++ break;
++
+ case OPT_Werror:
+ dc->warning_as_error_requested = value;
+ break;
--- /dev/null
+Author: Jo-Philipp Wich <jow@openwrt.org>
+Date: Sat Apr 21 03:02:39 2012 +0000
+
+ gcc: add patch to make the getenv() spec function nonfatal if requested environment variable is unset
+
+ SVN-Revision: 31390
+
+--- a/gcc/gcc.cc
++++ b/gcc/gcc.cc
+@@ -10186,8 +10186,10 @@ getenv_spec_function (int argc, const ch
+ }
+
+ if (!value)
+- fatal_error (input_location,
+- "environment variable %qs not defined", varname);
++ {
++ warning (input_location, "environment variable %qs not defined", varname);
++ value = "";
++ }
+
+ /* We have to escape every character of the environment variable so
+ they are not interpreted as active spec characters. A
--- /dev/null
+From dda6b050cd74a352670787a294596a9c56c21327 Mon Sep 17 00:00:00 2001
+From: Yousong Zhou <yszhou4tech@gmail.com>
+Date: Fri, 4 May 2018 18:20:53 +0800
+Subject: [PATCH] gotools: fix compilation when making cross compiler
+
+libgo is "the runtime support library for the Go programming language.
+This library is intended for use with the Go frontend."
+
+gccgo will link target files with libgo.so which depends on libgcc_s.so.1, but
+the linker will complain that it cannot find it. That's because shared libgcc
+is not present in the install directory yet. libgo.so was made without problem
+because gcc will emit -lgcc_s when compiled with -shared option. When gotools
+were being made, it was supplied with -static-libgcc thus no link option was
+provided. Check LIBGO in gcc/go/gcc-spec.c for how gccgo make a builtin spec
+for linking with libgo.so
+
+- GccgoCrossCompilation, https://github.com/golang/go/wiki/GccgoCrossCompilation
+- Cross-building instructions, http://www.eglibc.org/archives/patches/msg00078.html
+
+When 3-pass GCC compilation is used, shared libgcc runtime libraries will be
+available after gcc pass2 completed and will meet the gotools link requirement
+at gcc pass3
+---
+ gotools/Makefile.am | 4 +++-
+ gotools/Makefile.in | 4 +++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/gotools/Makefile.am
++++ b/gotools/Makefile.am
+@@ -26,6 +26,7 @@ PWD_COMMAND = $${PWDCMD-pwd}
+ STAMP = echo timestamp >
+
+ libgodir = ../$(target_noncanonical)/libgo
++libgccdir = ../$(target_noncanonical)/libgcc
+ LIBGODEP = $(libgodir)/libgo.la
+
+ LIBGOTOOL = $(libgodir)/libgotool.a
+@@ -41,7 +42,8 @@ GOCFLAGS = $(CFLAGS_FOR_TARGET)
+ GOCOMPILE = $(GOCOMPILER) $(GOCFLAGS)
+
+ AM_GOCFLAGS = -I $(libgodir)
+-AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs
++AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs \
++ -L $(libgccdir) -L $(libgccdir)/.libs -lgcc_s
+ GOLINK = $(GOCOMPILER) $(GOCFLAGS) $(AM_GOCFLAGS) $(LDFLAGS) $(AM_LDFLAGS) -o $@
+
+ libgosrcdir = $(srcdir)/../libgo/go
+--- a/gotools/Makefile.in
++++ b/gotools/Makefile.in
+@@ -337,6 +337,7 @@ mkinstalldirs = $(SHELL) $(toplevel_srcd
+ PWD_COMMAND = $${PWDCMD-pwd}
+ STAMP = echo timestamp >
+ libgodir = ../$(target_noncanonical)/libgo
++libgccdir = ../$(target_noncanonical)/libgcc
+ LIBGODEP = $(libgodir)/libgo.la
+ LIBGOTOOL = $(libgodir)/libgotool.a
+ @NATIVE_FALSE@GOCOMPILER = $(GOC)
+@@ -346,7 +347,8 @@ LIBGOTOOL = $(libgodir)/libgotool.a
+ GOCFLAGS = $(CFLAGS_FOR_TARGET)
+ GOCOMPILE = $(GOCOMPILER) $(GOCFLAGS)
+ AM_GOCFLAGS = -I $(libgodir)
+-AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs
++AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs \
++ -L $(libgccdir) -L $(libgccdir)/.libs -lgcc_s
+ GOLINK = $(GOCOMPILER) $(GOCFLAGS) $(AM_GOCFLAGS) $(LDFLAGS) $(AM_LDFLAGS) -o $@
+ libgosrcdir = $(srcdir)/../libgo/go
+ cmdsrcdir = $(libgosrcdir)/cmd
--- /dev/null
+commit 9c6e71079b46ad5433165feaa2001450f2017b56
+Author: Przemysław Buczkowski <prem@prem.moe>
+Date: Mon Aug 16 13:16:21 2021 +0100
+
+ GCC: Patch for Apple Silicon compatibility
+
+ This patch fixes a linker error occuring when compiling
+ the cross-compiler on macOS and ARM64 architecture.
+
+ Adapted from:
+ https://github.com/richfelker/musl-cross-make/issues/116#issuecomment-823612404
+
+ Change-Id: Ia3ee98a163bbb62689f42e2da83a5ef36beb0913
+ Reviewed-on: https://review.haiku-os.org/c/buildtools/+/4329
+ Reviewed-by: John Scipione <jscipione@gmail.com>
+ Reviewed-by: Adrien Destugues <pulkomandy@gmail.com>
+
+--- a/gcc/config/aarch64/aarch64.h
++++ b/gcc/config/aarch64/aarch64.h
+@@ -1293,7 +1293,7 @@ extern const char *aarch64_rewrite_mcpu
+ #define MCPU_TO_MARCH_SPEC_FUNCTIONS \
+ { "rewrite_mcpu", aarch64_rewrite_mcpu },
+
+-#if defined(__aarch64__)
++#if defined(__aarch64__) && ! defined(__APPLE__)
+ extern const char *host_detect_local_cpu (int argc, const char **argv);
+ #define HAVE_LOCAL_CPU_DETECT
+ # define EXTRA_SPEC_FUNCTIONS \
+--- a/gcc/config/host-darwin.cc
++++ b/gcc/config/host-darwin.cc
+@@ -23,6 +23,8 @@
+ #include "options.h"
+ #include "diagnostic-core.h"
+ #include "config/host-darwin.h"
++#include "hosthooks.h"
++#include "hosthooks-def.h"
+ #include <errno.h>
+
+ /* For Darwin (macOS only) platforms, without ASLR (PIE) enabled on the
+@@ -181,3 +183,5 @@ darwin_gt_pch_use_address (void *&addr,
+
+ return 1;
+ }
++
++const struct host_hooks host_hooks = HOST_HOOKS_INITIALIZER;
--- /dev/null
+commit 81cc26c706b2bc8c8c1eb1a322e5c5157900836e
+Author: Felix Fietkau <nbd@openwrt.org>
+Date: Sun Oct 19 21:45:51 2014 +0000
+
+ gcc: do not assume that the Mac OS X filesystem is case insensitive
+
+ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+
+ SVN-Revision: 42973
+
+--- a/include/filenames.h
++++ b/include/filenames.h
+@@ -44,11 +44,6 @@ extern "C" {
+ # define IS_DIR_SEPARATOR(c) IS_DOS_DIR_SEPARATOR (c)
+ # define IS_ABSOLUTE_PATH(f) IS_DOS_ABSOLUTE_PATH (f)
+ #else /* not DOSish */
+-# if defined(__APPLE__)
+-# ifndef HAVE_CASE_INSENSITIVE_FILE_SYSTEM
+-# define HAVE_CASE_INSENSITIVE_FILE_SYSTEM 1
+-# endif
+-# endif /* __APPLE__ */
+ # define HAS_DRIVE_SPEC(f) (0)
+ # define IS_DIR_SEPARATOR(c) IS_UNIX_DIR_SEPARATOR (c)
+ # define IS_ABSOLUTE_PATH(f) IS_UNIX_ABSOLUTE_PATH (f)
--- /dev/null
+--- a/gcc/real.h
++++ b/gcc/real.h
+@@ -77,8 +77,10 @@ struct GTY(()) real_value {
+ + (REAL_VALUE_TYPE_SIZE%HOST_BITS_PER_WIDE_INT ? 1 : 0)) /* round up */
+
+ /* Verify the guess. */
++#ifndef __LP64__
+ extern char test_real_width
+ [sizeof (REAL_VALUE_TYPE) <= REAL_WIDTH * sizeof (HOST_WIDE_INT) ? 1 : -1];
++#endif
+
+ /* Calculate the format for CONST_DOUBLE. We need as many slots as
+ are necessary to overlay a REAL_VALUE_TYPE on them. This could be
--- /dev/null
+commit 098bd91f5eae625c7d2ee621e10930fc4434e5e2
+Author: Luka Perkov <luka@openwrt.org>
+Date: Tue Feb 26 16:16:33 2013 +0000
+
+ gcc: don't build documentation
+
+ This closes #13039.
+
+ Signed-off-by: Luka Perkov <luka@openwrt.org>
+
+ SVN-Revision: 35807
+
+--- a/gcc/Makefile.in
++++ b/gcc/Makefile.in
+@@ -3397,18 +3397,10 @@ doc/gcc.info: $(TEXI_GCC_FILES)
+ doc/gccint.info: $(TEXI_GCCINT_FILES)
+ doc/cppinternals.info: $(TEXI_CPPINT_FILES)
+
+-doc/%.info: %.texi
+- if [ x$(BUILD_INFO) = xinfo ]; then \
+- $(MAKEINFO) $(MAKEINFOFLAGS) -I . -I $(gcc_docdir) \
+- -I $(gcc_docdir)/include -o $@ $<; \
+- fi
++doc/%.info:
+
+ # Duplicate entry to handle renaming of gccinstall.info
+-doc/gccinstall.info: $(TEXI_GCCINSTALL_FILES)
+- if [ x$(BUILD_INFO) = xinfo ]; then \
+- $(MAKEINFO) $(MAKEINFOFLAGS) -I $(gcc_docdir) \
+- -I $(gcc_docdir)/include -o $@ $<; \
+- fi
++doc/gccinstall.info:
+
+ doc/cpp.dvi: $(TEXI_CPP_FILES)
+ doc/gcc.dvi: $(TEXI_GCC_FILES)
--- /dev/null
+From 9970b576b7e4ae337af1268395ff221348c4b34a Mon Sep 17 00:00:00 2001
+From: Francois-Xavier Coudert <fxcoudert@gcc.gnu.org>
+Date: Thu, 7 Mar 2024 14:36:03 +0100
+Subject: [PATCH] Include safe-ctype.h after C++ standard headers, to avoid
+ over-poisoning
+
+When building gcc's C++ sources against recent libc++, the poisoning of
+the ctype macros due to including safe-ctype.h before including C++
+standard headers such as <list>, <map>, etc, causes many compilation
+errors, similar to:
+
+ In file included from /home/dim/src/gcc/master/gcc/gensupport.cc:23:
+ In file included from /home/dim/src/gcc/master/gcc/system.h:233:
+ In file included from /usr/include/c++/v1/vector:321:
+ In file included from
+ /usr/include/c++/v1/__format/formatter_bool.h:20:
+ In file included from
+ /usr/include/c++/v1/__format/formatter_integral.h:32:
+ In file included from /usr/include/c++/v1/locale:202:
+ /usr/include/c++/v1/__locale:546:5: error: '__abi_tag__' attribute
+ only applies to structs, variables, functions, and namespaces
+ 546 | _LIBCPP_INLINE_VISIBILITY
+ | ^
+ /usr/include/c++/v1/__config:813:37: note: expanded from macro
+ '_LIBCPP_INLINE_VISIBILITY'
+ 813 | # define _LIBCPP_INLINE_VISIBILITY _LIBCPP_HIDE_FROM_ABI
+ | ^
+ /usr/include/c++/v1/__config:792:26: note: expanded from macro
+ '_LIBCPP_HIDE_FROM_ABI'
+ 792 |
+ __attribute__((__abi_tag__(_LIBCPP_TOSTRING(
+ _LIBCPP_VERSIONED_IDENTIFIER))))
+ | ^
+ In file included from /home/dim/src/gcc/master/gcc/gensupport.cc:23:
+ In file included from /home/dim/src/gcc/master/gcc/system.h:233:
+ In file included from /usr/include/c++/v1/vector:321:
+ In file included from
+ /usr/include/c++/v1/__format/formatter_bool.h:20:
+ In file included from
+ /usr/include/c++/v1/__format/formatter_integral.h:32:
+ In file included from /usr/include/c++/v1/locale:202:
+ /usr/include/c++/v1/__locale:547:37: error: expected ';' at end of
+ declaration list
+ 547 | char_type toupper(char_type __c) const
+ | ^
+ /usr/include/c++/v1/__locale:553:48: error: too many arguments
+ provided to function-like macro invocation
+ 553 | const char_type* toupper(char_type* __low, const
+ char_type* __high) const
+ | ^
+ /home/dim/src/gcc/master/gcc/../include/safe-ctype.h:146:9: note:
+ macro 'toupper' defined here
+ 146 | #define toupper(c) do_not_use_toupper_with_safe_ctype
+ | ^
+
+This is because libc++ uses different transitive includes than
+libstdc++, and some of those transitive includes pull in various ctype
+declarations (typically via <locale>).
+
+There was already a special case for including <string> before
+safe-ctype.h, so move the rest of the C++ standard header includes to
+the same location, to fix the problem.
+
+gcc/ChangeLog:
+
+ * system.h: Include safe-ctype.h after C++ standard headers.
+
+Signed-off-by: Dimitry Andric <dimitry@andric.com>
+---
+ gcc/system.h | 39 ++++++++++++++++++---------------------
+ 1 file changed, 18 insertions(+), 21 deletions(-)
+
+--- a/gcc/system.h
++++ b/gcc/system.h
+@@ -194,27 +194,8 @@ extern int fprintf_unlocked (FILE *, con
+ #undef fread_unlocked
+ #undef fwrite_unlocked
+
+-/* Include <string> before "safe-ctype.h" to avoid GCC poisoning
+- the ctype macros through safe-ctype.h */
+-
+-#ifdef __cplusplus
+-#ifdef INCLUDE_STRING
+-# include <string>
+-#endif
+-#endif
+-
+-/* There are an extraordinary number of issues with <ctype.h>.
+- The last straw is that it varies with the locale. Use libiberty's
+- replacement instead. */
+-#include "safe-ctype.h"
+-
+-#include <sys/types.h>
+-
+-#include <errno.h>
+-
+-#if !defined (errno) && defined (HAVE_DECL_ERRNO) && !HAVE_DECL_ERRNO
+-extern int errno;
+-#endif
++/* Include C++ standard headers before "safe-ctype.h" to avoid GCC
++ poisoning the ctype macros through safe-ctype.h */
+
+ #ifdef __cplusplus
+ #if defined (INCLUDE_ALGORITHM) || !defined (HAVE_SWAP_IN_UTILITY)
+@@ -229,6 +210,9 @@ extern int errno;
+ #ifdef INCLUDE_SET
+ # include <set>
+ #endif
++#ifdef INCLUDE_STRING
++# include <string>
++#endif
+ #ifdef INCLUDE_VECTOR
+ # include <vector>
+ #endif
+@@ -245,6 +229,19 @@ extern int errno;
+ # include <type_traits>
+ #endif
+
++/* There are an extraordinary number of issues with <ctype.h>.
++ The last straw is that it varies with the locale. Use libiberty's
++ replacement instead. */
++#include "safe-ctype.h"
++
++#include <sys/types.h>
++
++#include <errno.h>
++
++#if !defined (errno) && defined (HAVE_DECL_ERRNO) && !HAVE_DECL_ERRNO
++extern int errno;
++#endif
++
+ /* Some of glibc's string inlines cause warnings. Plus we'd rather
+ rely on (and therefore test) GCC's string builtins. */
+ #define __NO_STRING_INLINES
--- /dev/null
+From 5213047b1d50af63dfabb5e5649821a6cb157e33 Mon Sep 17 00:00:00 2001
+From: Francois-Xavier Coudert <fxcoudert@gcc.gnu.org>
+Date: Sat, 16 Mar 2024 09:50:00 +0100
+Subject: [PATCH] libcc1: fix <vector> include
+
+Use INCLUDE_VECTOR before including system.h, instead of directly
+including <vector>, to avoid running into poisoned identifiers.
+
+Signed-off-by: Dimitry Andric <dimitry@andric.com>
+
+libcc1/ChangeLog:
+
+ PR middle-end/111632
+ * libcc1plugin.cc: Fix include.
+ * libcp1plugin.cc: Fix include.
+---
+ libcc1/libcc1plugin.cc | 3 +--
+ libcc1/libcp1plugin.cc | 3 +--
+ 2 files changed, 2 insertions(+), 4 deletions(-)
+
+--- a/libcc1/libcc1plugin.cc
++++ b/libcc1/libcc1plugin.cc
+@@ -32,6 +32,7 @@
+ #undef PACKAGE_VERSION
+
+ #define INCLUDE_MEMORY
++#define INCLUDE_VECTOR
+ #include "gcc-plugin.h"
+ #include "system.h"
+ #include "coretypes.h"
+@@ -69,8 +70,6 @@
+ #include "gcc-c-interface.h"
+ #include "context.hh"
+
+-#include <vector>
+-
+ using namespace cc1_plugin;
+
+ \f
+--- a/libcc1/libcp1plugin.cc
++++ b/libcc1/libcp1plugin.cc
+@@ -33,6 +33,7 @@
+ #undef PACKAGE_VERSION
+
+ #define INCLUDE_MEMORY
++#define INCLUDE_VECTOR
+ #include "gcc-plugin.h"
+ #include "system.h"
+ #include "coretypes.h"
+@@ -71,8 +72,6 @@
+ #include "rpc.hh"
+ #include "context.hh"
+
+-#include <vector>
+-
+ using namespace cc1_plugin;
+
+ \f
--- /dev/null
+Fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84790.
+MIPS16 functions have a static assembler prologue which clobbers
+registers v0 and v1. Add these register clobbers to function call
+instructions.
+
+--- a/gcc/config/mips/mips.cc
++++ b/gcc/config/mips/mips.cc
+@@ -3134,6 +3134,12 @@ mips_emit_call_insn (rtx pattern, rtx or
+ emit_insn (gen_update_got_version ());
+ }
+
++ if (TARGET_MIPS16 && TARGET_USE_GOT)
++ {
++ clobber_reg (&CALL_INSN_FUNCTION_USAGE (insn), MIPS16_PIC_TEMP);
++ clobber_reg (&CALL_INSN_FUNCTION_USAGE (insn), MIPS_PROLOGUE_TEMP (word_mode));
++ }
++
+ if (TARGET_MIPS16
+ && TARGET_EXPLICIT_RELOCS
+ && TARGET_CALL_CLOBBERED_GP)
--- /dev/null
+--- a/gcc/gcc.cc
++++ b/gcc/gcc.cc
+@@ -972,7 +972,9 @@ proper position among the other output f
+ #endif
+
+ #ifndef LINK_SSP_SPEC
+-#ifdef TARGET_LIBC_PROVIDES_SSP
++#if DEFAULT_LIBC == LIBC_MUSL
++#define LINK_SSP_SPEC "-lssp_nonshared"
++#elif defined(TARGET_LIBC_PROVIDES_SSP)
+ #define LINK_SSP_SPEC "%{fstack-protector|fstack-protector-all" \
+ "|fstack-protector-strong|fstack-protector-explicit:}"
+ #else
--- /dev/null
+commit ecf7671b769fe96f7b5134be442089f8bdba55d2
+Author: Felix Fietkau <nbd@nbd.name>
+Date: Thu Aug 4 20:29:45 2016 +0200
+
+gcc: add a patch to generate better code with Os on mips
+
+Also happens to reduce compressed code size a bit
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+
+--- a/gcc/config/mips/mips.cc
++++ b/gcc/config/mips/mips.cc
+@@ -20213,7 +20213,7 @@ mips_option_override (void)
+ flag_pcc_struct_return = 0;
+
+ /* Decide which rtx_costs structure to use. */
+- if (optimize_size)
++ if (0 && optimize_size)
+ mips_cost = &mips_rtx_cost_optimize_size;
+ else
+ mips_cost = &mips_rtx_cost_data[mips_tune];
--- /dev/null
+commit 8570c4be394cff7282f332f97da2ff569a927ddb
+Author: Imre Kaloz <kaloz@openwrt.org>
+Date: Wed Feb 2 20:06:12 2011 +0000
+
+ fixup arm soft-float symbols
+
+ SVN-Revision: 25325
+
+--- a/libgcc/config/arm/t-linux
++++ b/libgcc/config/arm/t-linux
+@@ -1,6 +1,10 @@
+ LIB1ASMSRC = arm/lib1funcs.S
+ LIB1ASMFUNCS = _udivsi3 _divsi3 _umodsi3 _modsi3 _dvmd_lnx _clzsi2 _clzdi2 \
+- _ctzsi2 _arm_addsubdf3 _arm_addsubsf3
++ _ctzsi2 _arm_addsubdf3 _arm_addsubsf3 \
++ _arm_negdf2 _arm_muldivdf3 _arm_cmpdf2 _arm_unorddf2 \
++ _arm_fixdfsi _arm_fixunsdfsi _arm_truncdfsf2 \
++ _arm_negsf2 _arm_muldivsf3 _arm_cmpsf2 _arm_unordsf2 \
++ _arm_fixsfsi _arm_fixunssfsi
+
+ # Just for these, we omit the frame pointer since it makes such a big
+ # difference.
+--- a/gcc/config/arm/linux-elf.h
++++ b/gcc/config/arm/linux-elf.h
+@@ -58,8 +58,6 @@
+ %{shared:-lc} \
+ %{!shared:%{profile:-lc_p}%{!profile:-lc}}"
+
+-#define LIBGCC_SPEC "%{mfloat-abi=soft*:-lfloat} -lgcc"
+-
+ #define GLIBC_DYNAMIC_LINKER "/lib/ld-linux.so.2"
+
+ #define LINUX_TARGET_LINK_SPEC "%{h*} \
--- /dev/null
+commit c96312958c0621e72c9b32da5bc224ffe2161384
+Author: Felix Fietkau <nbd@openwrt.org>
+Date: Mon Oct 19 23:26:09 2009 +0000
+
+ gcc: create a proper libgcc_pic.a static library for relinking (4.3.3+ for now, backport will follow)
+
+ SVN-Revision: 18086
+
+--- a/libgcc/Makefile.in
++++ b/libgcc/Makefile.in
+@@ -933,11 +933,12 @@ $(libgcov-driver-objects): %$(objext): $
+
+ # Static libraries.
+ libgcc.a: $(libgcc-objects)
++libgcc_pic.a: $(libgcc-s-objects)
+ libgcov.a: $(libgcov-objects)
+ libunwind.a: $(libunwind-objects)
+ libgcc_eh.a: $(libgcc-eh-objects)
+
+-libgcc.a libgcov.a libunwind.a libgcc_eh.a:
++libgcc.a libgcov.a libunwind.a libgcc_eh.a libgcc_pic.a:
+ -rm -f $@
+
+ objects="$(objects)"; \
+@@ -961,7 +962,7 @@ all: libunwind.a
+ endif
+
+ ifeq ($(enable_shared),yes)
+-all: libgcc_eh.a libgcc_s$(SHLIB_EXT)
++all: libgcc_eh.a libgcc_pic.a libgcc_s$(SHLIB_EXT)
+ ifneq ($(LIBUNWIND),)
+ all: libunwind$(SHLIB_EXT)
+ libgcc_s$(SHLIB_EXT): libunwind$(SHLIB_EXT)
+@@ -1167,6 +1168,10 @@ install-shared:
+ chmod 644 $(DESTDIR)$(inst_libdir)/libgcc_eh.a
+ $(RANLIB) $(DESTDIR)$(inst_libdir)/libgcc_eh.a
+
++ $(INSTALL_DATA) libgcc_pic.a $(mapfile) $(DESTDIR)$(inst_libdir)/
++ chmod 644 $(DESTDIR)$(inst_libdir)/libgcc_pic.a
++ $(RANLIB) $(DESTDIR)$(inst_libdir)/libgcc_pic.a
++
+ $(subst @multilib_dir@,$(MULTIDIR),$(subst \
+ @shlib_base_name@,libgcc_s,$(subst \
+ @shlib_slibdir_qual@,$(MULTIOSSUBDIR),$(SHLIB_INSTALL))))
--- /dev/null
+commit 7edc8ca5456d9743dd0075eb3cc5b04f4f24c8cc
+Author: Imre Kaloz <kaloz@openwrt.org>
+Date: Wed Feb 2 19:34:36 2011 +0000
+
+ add armv4 fixup patches
+
+ SVN-Revision: 25322
+
+
+--- a/gcc/config/arm/linux-eabi.h
++++ b/gcc/config/arm/linux-eabi.h
+@@ -88,10 +88,15 @@
+ #define MUSL_DYNAMIC_LINKER \
+ "/lib/ld-musl-arm" MUSL_DYNAMIC_LINKER_E "%{mfloat-abi=hard:hf}%{mfdpic:-fdpic}.so.1"
+
++/* For armv4 we pass --fix-v4bx to linker to support EABI */
++#undef TARGET_FIX_V4BX_SPEC
++#define TARGET_FIX_V4BX_SPEC " %{mcpu=arm8|mcpu=arm810|mcpu=strongarm*"\
++ "|march=armv4|mcpu=fa526|mcpu=fa626:--fix-v4bx}"
++
+ /* At this point, bpabi.h will have clobbered LINK_SPEC. We want to
+ use the GNU/Linux version, not the generic BPABI version. */
+ #undef LINK_SPEC
+-#define LINK_SPEC EABI_LINK_SPEC \
++#define LINK_SPEC EABI_LINK_SPEC TARGET_FIX_V4BX_SPEC \
+ LINUX_OR_ANDROID_LD (LINUX_TARGET_LINK_SPEC, \
+ LINUX_TARGET_LINK_SPEC " " ANDROID_LINK_SPEC)
+
--- /dev/null
+commit dcfc40358b5a3cae7320c17f8d1cebd5ad5540cd
+Author: Felix Fietkau <nbd@openwrt.org>
+Date: Sun Feb 12 20:25:47 2012 +0000
+
+ gcc 4.6: port over the missing patch 850-use_shared_libgcc.patch to prevent libgcc crap from leaking into every single binary
+
+ SVN-Revision: 30486
+--- a/gcc/config/arm/linux-eabi.h
++++ b/gcc/config/arm/linux-eabi.h
+@@ -129,10 +129,6 @@
+ "%{Ofast|ffast-math|funsafe-math-optimizations:%{!shared:crtfastmath.o%s}} " \
+ LINUX_OR_ANDROID_LD (GNU_USER_TARGET_ENDFILE_SPEC, ANDROID_ENDFILE_SPEC)
+
+-/* Use the default LIBGCC_SPEC, not the version in linux-elf.h, as we
+- do not use -lfloat. */
+-#undef LIBGCC_SPEC
+-
+ /* Clear the instruction cache from `beg' to `end'. This is
+ implemented in lib1funcs.S, so ensure an error if this definition
+ is used. */
+--- a/gcc/config/linux.h
++++ b/gcc/config/linux.h
+@@ -58,6 +58,10 @@ see the files COPYING3 and COPYING.RUNTI
+ builtin_assert ("system=posix"); \
+ } while (0)
+
++#ifndef LIBGCC_SPEC
++#define LIBGCC_SPEC "%{static|static-libgcc:-lgcc}%{!static:%{!static-libgcc:-lgcc_s}}"
++#endif
++
+ /* Determine which dynamic linker to use depending on whether GLIBC or
+ uClibc or Bionic or musl is the default C library and whether
+ -muclibc or -mglibc or -mbionic or -mmusl has been passed to change
+--- a/libgcc/mkmap-symver.awk
++++ b/libgcc/mkmap-symver.awk
+@@ -136,5 +136,5 @@ function output(lib) {
+ else if (inherit[lib])
+ printf("} %s;\n", inherit[lib]);
+ else
+- printf ("\n local:\n\t*;\n};\n");
++ printf ("\n\t*;\n};\n");
+ }
+--- a/gcc/config/rs6000/linux.h
++++ b/gcc/config/rs6000/linux.h
+@@ -67,6 +67,9 @@
+ #undef CPP_OS_DEFAULT_SPEC
+ #define CPP_OS_DEFAULT_SPEC "%(cpp_os_linux)"
+
++#undef LIBGCC_SPEC
++#define LIBGCC_SPEC "%{!static:%{!static-libgcc:-lgcc_s}} -lgcc"
++
+ #undef LINK_SHLIB_SPEC
+ #define LINK_SHLIB_SPEC "%{shared:-shared} %{!shared: %{static:-static}} \
+ %{static-pie:-static -pie --no-dynamic-linker -z text}"
--- /dev/null
+commit 64661de100da1ec1061ef3e5e400285dce115e6b
+Author: Felix Fietkau <nbd@openwrt.org>
+Date: Sun May 10 13:16:35 2015 +0000
+
+ gcc: add some size optimization patches
+
+ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+
+ SVN-Revision: 45664
+
+--- a/libgcc/config/t-libunwind
++++ b/libgcc/config/t-libunwind
+@@ -2,8 +2,7 @@
+
+ HOST_LIBGCC2_CFLAGS += -DUSE_GAS_SYMVER
+
+-LIB2ADDEH = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c \
+- $(srcdir)/unwind-compat.c $(srcdir)/unwind-dw2-fde-compat.c
++LIB2ADDEH = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c
+ LIB2ADDEHSTATIC = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c
+
+ # Override the default value from t-slibgcc-elf-ver and mention -lunwind
--- /dev/null
+--- a/gcc/config/rs6000/rs6000-logue.cc
++++ b/gcc/config/rs6000/rs6000-logue.cc
+@@ -344,7 +344,7 @@ rs6000_savres_strategy (rs6000_stack_t *
+ /* Define cutoff for using out-of-line functions to save registers. */
+ if (DEFAULT_ABI == ABI_V4 || TARGET_ELF)
+ {
+- if (!optimize_size)
++ if (1)
+ {
+ strategy |= SAVE_INLINE_FPRS | REST_INLINE_FPRS;
+ strategy |= SAVE_INLINE_GPRS | REST_INLINE_GPRS;
--- /dev/null
+--- a/libgcc/crtstuff.c
++++ b/libgcc/crtstuff.c
+@@ -152,7 +152,7 @@ call_ ## FUNC (void) \
+ #endif
+
+ #if !defined(USE_TM_CLONE_REGISTRY) && defined(OBJECT_FORMAT_ELF)
+-# define USE_TM_CLONE_REGISTRY 1
++# define USE_TM_CLONE_REGISTRY 0
+ #elif !defined(USE_TM_CLONE_REGISTRY)
+ # define USE_TM_CLONE_REGISTRY 0
+ #endif
--- /dev/null
+--- a/libgcc/config/mips/t-mips16
++++ b/libgcc/config/mips/t-mips16
+@@ -43,3 +43,6 @@ SYNC_CFLAGS = -mno-mips16
+
+ # Version these symbols if building libgcc.so.
+ SHLIB_MAPFILES += $(srcdir)/config/mips/libgcc-mips16.ver
++
++CRTSTUFF_T_CFLAGS += -mno-mips16
++CRTSTUFF_T_CFLAGS_S += -mno-mips16
--- /dev/null
+commit 99368862e44740ff4fd33760893f04e14f9dbdf1
+Author: Felix Fietkau <nbd@openwrt.org>
+Date: Tue Jul 31 00:52:27 2007 +0000
+
+ Port the mbsd_multi patch from freewrt, which adds -fhonour-copts. This will emit warnings in packages that don't use our target cflags properly
+
+ SVN-Revision: 8256
+
+ This patch brings over a feature from MirBSD:
+ * -fhonour-copts
+ If this option is not given, it's warned (depending
+ on environment variables). This is to catch errors
+ of misbuilt packages which override CFLAGS themselves.
+
+ This patch was authored by Thorsten Glaser <tg at mirbsd.de>
+ with copyright assignment to the FSF in effect.
+
+--- a/gcc/c-family/c-opts.cc
++++ b/gcc/c-family/c-opts.cc
+@@ -104,6 +104,9 @@ static size_t include_cursor;
+ /* Whether any standard preincluded header has been preincluded. */
+ static bool done_preinclude;
+
++/* Check if a port honours COPTS. */
++static int honour_copts = 0;
++
+ static void handle_OPT_d (const char *);
+ static void set_std_cxx98 (int);
+ static void set_std_cxx11 (int);
+@@ -475,6 +478,12 @@ c_common_handle_option (size_t scode, co
+ flag_no_builtin = !value;
+ break;
+
++ case OPT_fhonour_copts:
++ if (c_language == clk_c) {
++ honour_copts++;
++ }
++ break;
++
+ case OPT_fconstant_string_class_:
+ constant_string_class_name = arg;
+ break;
+@@ -1228,6 +1237,47 @@ c_common_init (void)
+ return false;
+ }
+
++ if (c_language == clk_c) {
++ char *ev = getenv ("GCC_HONOUR_COPTS");
++ int evv;
++ if (ev == NULL)
++ evv = -1;
++ else if ((*ev == '0') || (*ev == '\0'))
++ evv = 0;
++ else if (*ev == '1')
++ evv = 1;
++ else if (*ev == '2')
++ evv = 2;
++ else if (*ev == 's')
++ evv = -1;
++ else {
++ warning (0, "unknown GCC_HONOUR_COPTS value, assuming 1");
++ evv = 1; /* maybe depend this on something like MIRBSD_NATIVE? */
++ }
++ if (evv == 1) {
++ if (honour_copts == 0) {
++ error ("someone does not honour COPTS at all in lenient mode");
++ return false;
++ } else if (honour_copts != 1) {
++ warning (0, "someone does not honour COPTS correctly, passed %d times",
++ honour_copts);
++ }
++ } else if (evv == 2) {
++ if (honour_copts == 0) {
++ error ("someone does not honour COPTS at all in strict mode");
++ return false;
++ } else if (honour_copts != 1) {
++ error ("someone does not honour COPTS correctly, passed %d times",
++ honour_copts);
++ return false;
++ }
++ } else if (evv == 0) {
++ if (honour_copts != 1)
++ inform (UNKNOWN_LOCATION, "someone does not honour COPTS correctly, passed %d times",
++ honour_copts);
++ }
++ }
++
+ return true;
+ }
+
+--- a/gcc/c-family/c.opt
++++ b/gcc/c-family/c.opt
+@@ -1837,6 +1837,9 @@ C++ ObjC++ Optimization Alias(fexception
+ fhonor-std
+ C++ ObjC++ WarnRemoved
+
++fhonour-copts
++C ObjC C++ ObjC++ RejectNegative
++
+ fhosted
+ C ObjC
+ Assume normal C execution environment.
+--- a/gcc/common.opt
++++ b/gcc/common.opt
+@@ -1801,6 +1801,9 @@ fharden-conditional-branches
+ Common Var(flag_harden_conditional_branches) Optimization
+ Harden conditional branches by checking reversed conditions.
+
++fhonour-copts
++Common RejectNegative
++
+ ; Nonzero means ignore `#ident' directives. 0 means handle them.
+ ; Generate position-independent code for executables if possible
+ ; On SVR4 targets, it also controls whether or not to emit a
+--- a/gcc/doc/invoke.texi
++++ b/gcc/doc/invoke.texi
+@@ -10065,6 +10065,17 @@ This option is only supported for C and
+ @option{-Wall} and by @option{-Wpedantic}, which can be disabled with
+ @option{-Wno-pointer-sign}.
+
++@item -fhonour-copts
++@opindex fhonour-copts
++If @env{GCC_HONOUR_COPTS} is set to 1, abort if this option is not
++given at least once, and warn if it is given more than once.
++If @env{GCC_HONOUR_COPTS} is set to 2, abort if this option is not
++given exactly once.
++If @env{GCC_HONOUR_COPTS} is set to 0 or unset, warn if this option
++is not given exactly once.
++The warning is quelled if @env{GCC_HONOUR_COPTS} is set to @samp{s}.
++This flag and environment variable only affect the C language.
++
+ @opindex Wstack-protector
+ @opindex Wno-stack-protector
+ @item -Wstack-protector
+--- a/gcc/opts.cc
++++ b/gcc/opts.cc
+@@ -2767,6 +2767,9 @@ common_handle_option (struct gcc_options
+ add_comma_separated_to_vector (&opts->x_flag_ignored_attributes, arg);
+ break;
+
++ case OPT_fhonour_copts:
++ break;
++
+ case OPT_Werror:
+ dc->warning_as_error_requested = value;
+ break;
--- /dev/null
+Author: Jo-Philipp Wich <jow@openwrt.org>
+Date: Sat Apr 21 03:02:39 2012 +0000
+
+ gcc: add patch to make the getenv() spec function nonfatal if requested environment variable is unset
+
+ SVN-Revision: 31390
+
+--- a/gcc/gcc.cc
++++ b/gcc/gcc.cc
+@@ -10174,8 +10174,10 @@ getenv_spec_function (int argc, const ch
+ }
+
+ if (!value)
+- fatal_error (input_location,
+- "environment variable %qs not defined", varname);
++ {
++ warning (input_location, "environment variable %qs not defined", varname);
++ value = "";
++ }
+
+ /* We have to escape every character of the environment variable so
+ they are not interpreted as active spec characters. A
--- /dev/null
+From dda6b050cd74a352670787a294596a9c56c21327 Mon Sep 17 00:00:00 2001
+From: Yousong Zhou <yszhou4tech@gmail.com>
+Date: Fri, 4 May 2018 18:20:53 +0800
+Subject: [PATCH] gotools: fix compilation when making cross compiler
+
+libgo is "the runtime support library for the Go programming language.
+This library is intended for use with the Go frontend."
+
+gccgo will link target files with libgo.so which depends on libgcc_s.so.1, but
+the linker will complain that it cannot find it. That's because shared libgcc
+is not present in the install directory yet. libgo.so was made without problem
+because gcc will emit -lgcc_s when compiled with -shared option. When gotools
+were being made, it was supplied with -static-libgcc thus no link option was
+provided. Check LIBGO in gcc/go/gcc-spec.c for how gccgo make a builtin spec
+for linking with libgo.so
+
+- GccgoCrossCompilation, https://github.com/golang/go/wiki/GccgoCrossCompilation
+- Cross-building instructions, http://www.eglibc.org/archives/patches/msg00078.html
+
+When 3-pass GCC compilation is used, shared libgcc runtime libraries will be
+available after gcc pass2 completed and will meet the gotools link requirement
+at gcc pass3
+---
+ gotools/Makefile.am | 4 +++-
+ gotools/Makefile.in | 4 +++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/gotools/Makefile.am
++++ b/gotools/Makefile.am
+@@ -26,6 +26,7 @@ PWD_COMMAND = $${PWDCMD-pwd}
+ STAMP = echo timestamp >
+
+ libgodir = ../$(target_noncanonical)/libgo
++libgccdir = ../$(target_noncanonical)/libgcc
+ LIBGODEP = $(libgodir)/libgo.la
+
+ LIBGOTOOL = $(libgodir)/libgotool.a
+@@ -41,7 +42,8 @@ GOCFLAGS = $(CFLAGS_FOR_TARGET)
+ GOCOMPILE = $(GOCOMPILER) $(GOCFLAGS)
+
+ AM_GOCFLAGS = -I $(libgodir)
+-AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs
++AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs \
++ -L $(libgccdir) -L $(libgccdir)/.libs -lgcc_s
+ GOLINK = $(GOCOMPILER) $(GOCFLAGS) $(AM_GOCFLAGS) $(LDFLAGS) $(AM_LDFLAGS) -o $@
+
+ libgosrcdir = $(srcdir)/../libgo/go
+--- a/gotools/Makefile.in
++++ b/gotools/Makefile.in
+@@ -337,6 +337,7 @@ mkinstalldirs = $(SHELL) $(toplevel_srcd
+ PWD_COMMAND = $${PWDCMD-pwd}
+ STAMP = echo timestamp >
+ libgodir = ../$(target_noncanonical)/libgo
++libgccdir = ../$(target_noncanonical)/libgcc
+ LIBGODEP = $(libgodir)/libgo.la
+ LIBGOTOOL = $(libgodir)/libgotool.a
+ @NATIVE_FALSE@GOCOMPILER = $(GOC)
+@@ -346,7 +347,8 @@ LIBGOTOOL = $(libgodir)/libgotool.a
+ GOCFLAGS = $(CFLAGS_FOR_TARGET)
+ GOCOMPILE = $(GOCOMPILER) $(GOCFLAGS)
+ AM_GOCFLAGS = -I $(libgodir)
+-AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs
++AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs \
++ -L $(libgccdir) -L $(libgccdir)/.libs -lgcc_s
+ GOLINK = $(GOCOMPILER) $(GOCFLAGS) $(AM_GOCFLAGS) $(LDFLAGS) $(AM_LDFLAGS) -o $@
+ libgosrcdir = $(srcdir)/../libgo/go
+ cmdsrcdir = $(libgosrcdir)/cmd
--- /dev/null
+commit 9c6e71079b46ad5433165feaa2001450f2017b56
+Author: Przemysław Buczkowski <prem@prem.moe>
+Date: Mon Aug 16 13:16:21 2021 +0100
+
+ GCC: Patch for Apple Silicon compatibility
+
+ This patch fixes a linker error occuring when compiling
+ the cross-compiler on macOS and ARM64 architecture.
+
+ Adapted from:
+ https://github.com/richfelker/musl-cross-make/issues/116#issuecomment-823612404
+
+ Change-Id: Ia3ee98a163bbb62689f42e2da83a5ef36beb0913
+ Reviewed-on: https://review.haiku-os.org/c/buildtools/+/4329
+ Reviewed-by: John Scipione <jscipione@gmail.com>
+ Reviewed-by: Adrien Destugues <pulkomandy@gmail.com>
+
+--- a/gcc/config/aarch64/aarch64.h
++++ b/gcc/config/aarch64/aarch64.h
+@@ -1185,7 +1185,7 @@ extern enum aarch64_code_model aarch64_c
+
+ /* Extra specs when building a native AArch64-hosted compiler.
+ Option rewriting rules based on host system. */
+-#if defined(__aarch64__)
++#if defined(__aarch64__) && ! defined(__APPLE__)
+ extern const char *host_detect_local_cpu (int argc, const char **argv);
+ #define HAVE_LOCAL_CPU_DETECT
+ # define EXTRA_SPEC_FUNCTIONS \
+--- a/gcc/config/host-darwin.cc
++++ b/gcc/config/host-darwin.cc
+@@ -23,6 +23,8 @@
+ #include "options.h"
+ #include "diagnostic-core.h"
+ #include "config/host-darwin.h"
++#include "hosthooks.h"
++#include "hosthooks-def.h"
+ #include <errno.h>
+
+ /* For Darwin (macOS only) platforms, without ASLR (PIE) enabled on the
+@@ -181,3 +183,5 @@ darwin_gt_pch_use_address (void *&addr,
+
+ return 1;
+ }
++
++const struct host_hooks host_hooks = HOST_HOOKS_INITIALIZER;
--- /dev/null
+commit 81cc26c706b2bc8c8c1eb1a322e5c5157900836e
+Author: Felix Fietkau <nbd@openwrt.org>
+Date: Sun Oct 19 21:45:51 2014 +0000
+
+ gcc: do not assume that the Mac OS X filesystem is case insensitive
+
+ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+
+ SVN-Revision: 42973
+
+--- a/include/filenames.h
++++ b/include/filenames.h
+@@ -43,11 +43,6 @@ extern "C" {
+ # define IS_DIR_SEPARATOR(c) IS_DOS_DIR_SEPARATOR (c)
+ # define IS_ABSOLUTE_PATH(f) IS_DOS_ABSOLUTE_PATH (f)
+ #else /* not DOSish */
+-# if defined(__APPLE__)
+-# ifndef HAVE_CASE_INSENSITIVE_FILE_SYSTEM
+-# define HAVE_CASE_INSENSITIVE_FILE_SYSTEM 1
+-# endif
+-# endif /* __APPLE__ */
+ # define HAS_DRIVE_SPEC(f) (0)
+ # define IS_DIR_SEPARATOR(c) IS_UNIX_DIR_SEPARATOR (c)
+ # define IS_ABSOLUTE_PATH(f) IS_UNIX_ABSOLUTE_PATH (f)
--- /dev/null
+--- a/gcc/real.h
++++ b/gcc/real.h
+@@ -70,8 +70,10 @@ struct GTY(()) real_value {
+ + (REAL_VALUE_TYPE_SIZE%HOST_BITS_PER_WIDE_INT ? 1 : 0)) /* round up */
+
+ /* Verify the guess. */
++#ifndef __LP64__
+ extern char test_real_width
+ [sizeof (REAL_VALUE_TYPE) <= REAL_WIDTH * sizeof (HOST_WIDE_INT) ? 1 : -1];
++#endif
+
+ /* Calculate the format for CONST_DOUBLE. We need as many slots as
+ are necessary to overlay a REAL_VALUE_TYPE on them. This could be
--- /dev/null
+commit 098bd91f5eae625c7d2ee621e10930fc4434e5e2
+Author: Luka Perkov <luka@openwrt.org>
+Date: Tue Feb 26 16:16:33 2013 +0000
+
+ gcc: don't build documentation
+
+ This closes #13039.
+
+ Signed-off-by: Luka Perkov <luka@openwrt.org>
+
+ SVN-Revision: 35807
+
+--- a/gcc/Makefile.in
++++ b/gcc/Makefile.in
+@@ -3204,18 +3204,10 @@ doc/gcc.info: $(TEXI_GCC_FILES)
+ doc/gccint.info: $(TEXI_GCCINT_FILES)
+ doc/cppinternals.info: $(TEXI_CPPINT_FILES)
+
+-doc/%.info: %.texi
+- if [ x$(BUILD_INFO) = xinfo ]; then \
+- $(MAKEINFO) $(MAKEINFOFLAGS) -I . -I $(gcc_docdir) \
+- -I $(gcc_docdir)/include -o $@ $<; \
+- fi
++doc/%.info:
+
+ # Duplicate entry to handle renaming of gccinstall.info
+-doc/gccinstall.info: $(TEXI_GCCINSTALL_FILES)
+- if [ x$(BUILD_INFO) = xinfo ]; then \
+- $(MAKEINFO) $(MAKEINFOFLAGS) -I $(gcc_docdir) \
+- -I $(gcc_docdir)/include -o $@ $<; \
+- fi
++doc/gccinstall.info:
+
+ doc/cpp.dvi: $(TEXI_CPP_FILES)
+ doc/gcc.dvi: $(TEXI_GCC_FILES)
--- /dev/null
+Fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84790.
+MIPS16 functions have a static assembler prologue which clobbers
+registers v0 and v1. Add these register clobbers to function call
+instructions.
+
+--- a/gcc/config/mips/mips.c
++++ b/gcc/config/mips/mips.c
+@@ -3102,6 +3102,12 @@ mips_emit_call_insn (rtx pattern, rtx or
+ emit_insn (gen_update_got_version ());
+ }
+
++ if (TARGET_MIPS16 && TARGET_USE_GOT)
++ {
++ clobber_reg (&CALL_INSN_FUNCTION_USAGE (insn), MIPS16_PIC_TEMP);
++ clobber_reg (&CALL_INSN_FUNCTION_USAGE (insn), MIPS_PROLOGUE_TEMP (word_mode));
++ }
++
+ if (TARGET_MIPS16
+ && TARGET_EXPLICIT_RELOCS
+ && TARGET_CALL_CLOBBERED_GP)
--- /dev/null
+--- a/gcc/gcc.c
++++ b/gcc/gcc.c
+@@ -868,7 +868,9 @@ proper position among the other output f
+ #endif
+
+ #ifndef LINK_SSP_SPEC
+-#ifdef TARGET_LIBC_PROVIDES_SSP
++#if DEFAULT_LIBC == LIBC_MUSL
++#define LINK_SSP_SPEC "-lssp_nonshared"
++#elif defined(TARGET_LIBC_PROVIDES_SSP)
+ #define LINK_SSP_SPEC "%{fstack-protector|fstack-protector-all" \
+ "|fstack-protector-strong|fstack-protector-explicit:}"
+ #else
--- /dev/null
+commit ecf7671b769fe96f7b5134be442089f8bdba55d2
+Author: Felix Fietkau <nbd@nbd.name>
+Date: Thu Aug 4 20:29:45 2016 +0200
+
+gcc: add a patch to generate better code with Os on mips
+
+Also happens to reduce compressed code size a bit
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+
+--- a/gcc/config/mips/mips.c
++++ b/gcc/config/mips/mips.c
+@@ -19847,7 +19847,7 @@ mips_option_override (void)
+ flag_pcc_struct_return = 0;
+
+ /* Decide which rtx_costs structure to use. */
+- if (optimize_size)
++ if (0 && optimize_size)
+ mips_cost = &mips_rtx_cost_optimize_size;
+ else
+ mips_cost = &mips_rtx_cost_data[mips_tune];
--- /dev/null
+--- a/gcc/config/arm/arm.h
++++ b/gcc/config/arm/arm.h
+@@ -155,7 +155,7 @@ extern tree arm_fp16_type_node;
+ /* Thumb-1 only. */
+ #define TARGET_THUMB1_ONLY (TARGET_THUMB1 && !arm_arch_notm)
+
+-#define TARGET_LDRD (arm_arch5e && ARM_DOUBLEWORD_ALIGN \
++#define TARGET_LDRD (arm_arch6 && ARM_DOUBLEWORD_ALIGN \
+ && !TARGET_THUMB1)
+
+ #define TARGET_CRC32 (arm_arch_crc)
--- /dev/null
+commit 8570c4be394cff7282f332f97da2ff569a927ddb
+Author: Imre Kaloz <kaloz@openwrt.org>
+Date: Wed Feb 2 20:06:12 2011 +0000
+
+ fixup arm soft-float symbols
+
+ SVN-Revision: 25325
+
+--- a/libgcc/config/arm/t-linux
++++ b/libgcc/config/arm/t-linux
+@@ -1,6 +1,10 @@
+ LIB1ASMSRC = arm/lib1funcs.S
+ LIB1ASMFUNCS = _udivsi3 _divsi3 _umodsi3 _modsi3 _dvmd_lnx _clzsi2 _clzdi2 \
+- _ctzsi2 _arm_addsubdf3 _arm_addsubsf3
++ _ctzsi2 _arm_addsubdf3 _arm_addsubsf3 \
++ _arm_negdf2 _arm_muldivdf3 _arm_cmpdf2 _arm_unorddf2 \
++ _arm_fixdfsi _arm_fixunsdfsi _arm_truncdfsf2 \
++ _arm_negsf2 _arm_muldivsf3 _arm_cmpsf2 _arm_unordsf2 \
++ _arm_fixsfsi _arm_fixunssfsi
+
+ # Just for these, we omit the frame pointer since it makes such a big
+ # difference.
+--- a/gcc/config/arm/linux-elf.h
++++ b/gcc/config/arm/linux-elf.h
+@@ -58,8 +58,6 @@
+ %{shared:-lc} \
+ %{!shared:%{profile:-lc_p}%{!profile:-lc}}"
+
+-#define LIBGCC_SPEC "%{mfloat-abi=soft*:-lfloat} -lgcc"
+-
+ #define GLIBC_DYNAMIC_LINKER "/lib/ld-linux.so.2"
+
+ #define LINUX_TARGET_LINK_SPEC "%{h*} \
--- /dev/null
+commit c96312958c0621e72c9b32da5bc224ffe2161384
+Author: Felix Fietkau <nbd@openwrt.org>
+Date: Mon Oct 19 23:26:09 2009 +0000
+
+ gcc: create a proper libgcc_pic.a static library for relinking (4.3.3+ for now, backport will follow)
+
+ SVN-Revision: 18086
+
+--- a/libgcc/Makefile.in
++++ b/libgcc/Makefile.in
+@@ -923,11 +923,12 @@ $(libgcov-driver-objects): %$(objext): $
+
+ # Static libraries.
+ libgcc.a: $(libgcc-objects)
++libgcc_pic.a: $(libgcc-s-objects)
+ libgcov.a: $(libgcov-objects)
+ libunwind.a: $(libunwind-objects)
+ libgcc_eh.a: $(libgcc-eh-objects)
+
+-libgcc.a libgcov.a libunwind.a libgcc_eh.a:
++libgcc.a libgcov.a libunwind.a libgcc_eh.a libgcc_pic.a:
+ -rm -f $@
+
+ objects="$(objects)"; \
+@@ -948,7 +949,7 @@ all: libunwind.a
+ endif
+
+ ifeq ($(enable_shared),yes)
+-all: libgcc_eh.a libgcc_s$(SHLIB_EXT)
++all: libgcc_eh.a libgcc_pic.a libgcc_s$(SHLIB_EXT)
+ ifneq ($(LIBUNWIND),)
+ all: libunwind$(SHLIB_EXT)
+ libgcc_s$(SHLIB_EXT): libunwind$(SHLIB_EXT)
+@@ -1154,6 +1155,10 @@ install-shared:
+ chmod 644 $(DESTDIR)$(inst_libdir)/libgcc_eh.a
+ $(RANLIB) $(DESTDIR)$(inst_libdir)/libgcc_eh.a
+
++ $(INSTALL_DATA) libgcc_pic.a $(mapfile) $(DESTDIR)$(inst_libdir)/
++ chmod 644 $(DESTDIR)$(inst_libdir)/libgcc_pic.a
++ $(RANLIB) $(DESTDIR)$(inst_libdir)/libgcc_pic.a
++
+ $(subst @multilib_dir@,$(MULTIDIR),$(subst \
+ @shlib_base_name@,libgcc_s,$(subst \
+ @shlib_slibdir_qual@,$(MULTIOSSUBDIR),$(SHLIB_INSTALL))))
--- /dev/null
+commit 7edc8ca5456d9743dd0075eb3cc5b04f4f24c8cc
+Author: Imre Kaloz <kaloz@openwrt.org>
+Date: Wed Feb 2 19:34:36 2011 +0000
+
+ add armv4 fixup patches
+
+ SVN-Revision: 25322
+
+
+--- a/gcc/config/arm/linux-eabi.h
++++ b/gcc/config/arm/linux-eabi.h
+@@ -88,10 +88,15 @@
+ #define MUSL_DYNAMIC_LINKER \
+ "/lib/ld-musl-arm" MUSL_DYNAMIC_LINKER_E "%{mfloat-abi=hard:hf}.so.1"
+
++/* For armv4 we pass --fix-v4bx to linker to support EABI */
++#undef TARGET_FIX_V4BX_SPEC
++#define TARGET_FIX_V4BX_SPEC " %{mcpu=arm8|mcpu=arm810|mcpu=strongarm*"\
++ "|march=armv4|mcpu=fa526|mcpu=fa626:--fix-v4bx}"
++
+ /* At this point, bpabi.h will have clobbered LINK_SPEC. We want to
+ use the GNU/Linux version, not the generic BPABI version. */
+ #undef LINK_SPEC
+-#define LINK_SPEC EABI_LINK_SPEC \
++#define LINK_SPEC EABI_LINK_SPEC TARGET_FIX_V4BX_SPEC \
+ LINUX_OR_ANDROID_LD (LINUX_TARGET_LINK_SPEC, \
+ LINUX_TARGET_LINK_SPEC " " ANDROID_LINK_SPEC)
+
--- /dev/null
+commit dcfc40358b5a3cae7320c17f8d1cebd5ad5540cd
+Author: Felix Fietkau <nbd@openwrt.org>
+Date: Sun Feb 12 20:25:47 2012 +0000
+
+ gcc 4.6: port over the missing patch 850-use_shared_libgcc.patch to prevent libgcc crap from leaking into every single binary
+
+ SVN-Revision: 30486
+--- a/gcc/config/arm/linux-eabi.h
++++ b/gcc/config/arm/linux-eabi.h
+@@ -126,10 +126,6 @@
+ "%{Ofast|ffast-math|funsafe-math-optimizations:crtfastmath.o%s} " \
+ LINUX_OR_ANDROID_LD (GNU_USER_TARGET_ENDFILE_SPEC, ANDROID_ENDFILE_SPEC)
+
+-/* Use the default LIBGCC_SPEC, not the version in linux-elf.h, as we
+- do not use -lfloat. */
+-#undef LIBGCC_SPEC
+-
+ /* Clear the instruction cache from `beg' to `end'. This is
+ implemented in lib1funcs.S, so ensure an error if this definition
+ is used. */
+--- a/gcc/config/linux.h
++++ b/gcc/config/linux.h
+@@ -53,6 +53,10 @@ see the files COPYING3 and COPYING.RUNTI
+ builtin_assert ("system=posix"); \
+ } while (0)
+
++#ifndef LIBGCC_SPEC
++#define LIBGCC_SPEC "%{static|static-libgcc:-lgcc}%{!static:%{!static-libgcc:-lgcc_s}}"
++#endif
++
+ /* Determine which dynamic linker to use depending on whether GLIBC or
+ uClibc or Bionic or musl is the default C library and whether
+ -muclibc or -mglibc or -mbionic or -mmusl has been passed to change
+--- a/libgcc/mkmap-symver.awk
++++ b/libgcc/mkmap-symver.awk
+@@ -136,5 +136,5 @@ function output(lib) {
+ else if (inherit[lib])
+ printf("} %s;\n", inherit[lib]);
+ else
+- printf ("\n local:\n\t*;\n};\n");
++ printf ("\n\t*;\n};\n");
+ }
+--- a/gcc/config/rs6000/linux.h
++++ b/gcc/config/rs6000/linux.h
+@@ -60,6 +60,9 @@
+ #undef CPP_OS_DEFAULT_SPEC
+ #define CPP_OS_DEFAULT_SPEC "%(cpp_os_linux)"
+
++#undef LIBGCC_SPEC
++#define LIBGCC_SPEC "%{!static:%{!static-libgcc:-lgcc_s}} -lgcc"
++
+ #undef LINK_SHLIB_SPEC
+ #define LINK_SHLIB_SPEC "%{shared:-shared} %{!shared: %{static:-static}} \
+ %{static-pie:-static -pie --no-dynamic-linker -z text}"
--- /dev/null
+commit 64661de100da1ec1061ef3e5e400285dce115e6b
+Author: Felix Fietkau <nbd@openwrt.org>
+Date: Sun May 10 13:16:35 2015 +0000
+
+ gcc: add some size optimization patches
+
+ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+
+ SVN-Revision: 45664
+
+--- a/libgcc/config/t-libunwind
++++ b/libgcc/config/t-libunwind
+@@ -2,8 +2,7 @@
+
+ HOST_LIBGCC2_CFLAGS += -DUSE_GAS_SYMVER
+
+-LIB2ADDEH = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c \
+- $(srcdir)/unwind-compat.c $(srcdir)/unwind-dw2-fde-compat.c
++LIB2ADDEH = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c
+ LIB2ADDEHSTATIC = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c
+
+ # Override the default value from t-slibgcc-elf-ver and mention -lunwind
--- /dev/null
+--- a/gcc/config/rs6000/rs6000.c
++++ b/gcc/config/rs6000/rs6000.c
+@@ -24780,7 +24780,7 @@ rs6000_savres_strategy (rs6000_stack_t *
+ /* Define cutoff for using out-of-line functions to save registers. */
+ if (DEFAULT_ABI == ABI_V4 || TARGET_ELF)
+ {
+- if (!optimize_size)
++ if (1)
+ {
+ strategy |= SAVE_INLINE_FPRS | REST_INLINE_FPRS;
+ strategy |= SAVE_INLINE_GPRS | REST_INLINE_GPRS;
--- /dev/null
+--- a/libgcc/crtstuff.c
++++ b/libgcc/crtstuff.c
+@@ -152,7 +152,7 @@ call_ ## FUNC (void) \
+ #endif
+
+ #if !defined(USE_TM_CLONE_REGISTRY) && defined(OBJECT_FORMAT_ELF)
+-# define USE_TM_CLONE_REGISTRY 1
++# define USE_TM_CLONE_REGISTRY 0
+ #endif
+
+ /* We do not want to add the weak attribute to the declarations of these
--- /dev/null
+--- a/libgcc/config/mips/t-mips16
++++ b/libgcc/config/mips/t-mips16
+@@ -43,3 +43,6 @@ SYNC_CFLAGS = -mno-mips16
+
+ # Version these symbols if building libgcc.so.
+ SHLIB_MAPFILES += $(srcdir)/config/mips/libgcc-mips16.ver
++
++CRTSTUFF_T_CFLAGS += -mno-mips16
++CRTSTUFF_T_CFLAGS_S += -mno-mips16
--- /dev/null
+commit 99368862e44740ff4fd33760893f04e14f9dbdf1
+Author: Felix Fietkau <nbd@openwrt.org>
+Date: Tue Jul 31 00:52:27 2007 +0000
+
+ Port the mbsd_multi patch from freewrt, which adds -fhonour-copts. This will emit warnings in packages that don't use our target cflags properly
+
+ SVN-Revision: 8256
+
+ This patch brings over a feature from MirBSD:
+ * -fhonour-copts
+ If this option is not given, it's warned (depending
+ on environment variables). This is to catch errors
+ of misbuilt packages which override CFLAGS themselves.
+
+ This patch was authored by Thorsten Glaser <tg at mirbsd.de>
+ with copyright assignment to the FSF in effect.
+
+--- a/gcc/c-family/c-opts.c
++++ b/gcc/c-family/c-opts.c
+@@ -107,6 +107,9 @@ static dump_flags_t original_dump_flags;
+ /* Whether any standard preincluded header has been preincluded. */
+ static bool done_preinclude;
+
++/* Check if a port honours COPTS. */
++static int honour_copts = 0;
++
+ static void handle_OPT_d (const char *);
+ static void set_std_cxx98 (int);
+ static void set_std_cxx11 (int);
+@@ -459,6 +462,12 @@ c_common_handle_option (size_t scode, co
+ flag_no_builtin = !value;
+ break;
+
++ case OPT_fhonour_copts:
++ if (c_language == clk_c) {
++ honour_copts++;
++ }
++ break;
++
+ case OPT_fconstant_string_class_:
+ constant_string_class_name = arg;
+ break;
+@@ -1125,6 +1134,47 @@ c_common_init (void)
+ return false;
+ }
+
++ if (c_language == clk_c) {
++ char *ev = getenv ("GCC_HONOUR_COPTS");
++ int evv;
++ if (ev == NULL)
++ evv = -1;
++ else if ((*ev == '0') || (*ev == '\0'))
++ evv = 0;
++ else if (*ev == '1')
++ evv = 1;
++ else if (*ev == '2')
++ evv = 2;
++ else if (*ev == 's')
++ evv = -1;
++ else {
++ warning (0, "unknown GCC_HONOUR_COPTS value, assuming 1");
++ evv = 1; /* maybe depend this on something like MIRBSD_NATIVE? */
++ }
++ if (evv == 1) {
++ if (honour_copts == 0) {
++ error ("someone does not honour COPTS at all in lenient mode");
++ return false;
++ } else if (honour_copts != 1) {
++ warning (0, "someone does not honour COPTS correctly, passed %d times",
++ honour_copts);
++ }
++ } else if (evv == 2) {
++ if (honour_copts == 0) {
++ error ("someone does not honour COPTS at all in strict mode");
++ return false;
++ } else if (honour_copts != 1) {
++ error ("someone does not honour COPTS correctly, passed %d times",
++ honour_copts);
++ return false;
++ }
++ } else if (evv == 0) {
++ if (honour_copts != 1)
++ inform (UNKNOWN_LOCATION, "someone does not honour COPTS correctly, passed %d times",
++ honour_copts);
++ }
++ }
++
+ return true;
+ }
+
+--- a/gcc/c-family/c.opt
++++ b/gcc/c-family/c.opt
+@@ -1469,6 +1469,9 @@ C++ ObjC++ Optimization Alias(fexception
+ fhonor-std
+ C++ ObjC++ Ignore Warn(switch %qs is no longer supported)
+
++fhonour-copts
++C ObjC C++ ObjC++ RejectNegative
++
+ fhosted
+ C ObjC
+ Assume normal C execution environment.
+--- a/gcc/common.opt
++++ b/gcc/common.opt
+@@ -1551,6 +1551,9 @@ fguess-branch-probability
+ Common Report Var(flag_guess_branch_prob) Optimization
+ Enable guessing of branch probabilities.
+
++fhonour-copts
++Common RejectNegative
++
+ ; Nonzero means ignore `#ident' directives. 0 means handle them.
+ ; Generate position-independent code for executables if possible
+ ; On SVR4 targets, it also controls whether or not to emit a
+--- a/gcc/opts.c
++++ b/gcc/opts.c
+@@ -2073,6 +2073,9 @@ common_handle_option (struct gcc_options
+ opts, opts_set, loc, dc);
+ break;
+
++ case OPT_fhonour_copts:
++ break;
++
+ case OPT_Wlarger_than_:
+ opts->x_larger_than_size = value;
+ opts->x_warn_larger_than = value != -1;
+--- a/gcc/doc/invoke.texi
++++ b/gcc/doc/invoke.texi
+@@ -7013,6 +7013,17 @@ This option is only supported for C and
+ @option{-Wall} and by @option{-Wpedantic}, which can be disabled with
+ @option{-Wno-pointer-sign}.
+
++@item -fhonour-copts
++@opindex fhonour-copts
++If @env{GCC_HONOUR_COPTS} is set to 1, abort if this option is not
++given at least once, and warn if it is given more than once.
++If @env{GCC_HONOUR_COPTS} is set to 2, abort if this option is not
++given exactly once.
++If @env{GCC_HONOUR_COPTS} is set to 0 or unset, warn if this option
++is not given exactly once.
++The warning is quelled if @env{GCC_HONOUR_COPTS} is set to @samp{s}.
++This flag and environment variable only affect the C language.
++
+ @item -Wstack-protector
+ @opindex Wstack-protector
+ @opindex Wno-stack-protector
--- /dev/null
+Author: Jo-Philipp Wich <jow@openwrt.org>
+Date: Sat Apr 21 03:02:39 2012 +0000
+
+ gcc: add patch to make the getenv() spec function nonfatal if requested environment variable is unset
+
+ SVN-Revision: 31390
+
+--- a/gcc/gcc.c
++++ b/gcc/gcc.c
+@@ -9347,8 +9347,10 @@ getenv_spec_function (int argc, const ch
+ value = varname;
+
+ if (!value)
+- fatal_error (input_location,
+- "environment variable %qs not defined", varname);
++ {
++ warning (input_location, "environment variable %qs not defined", varname);
++ value = "";
++ }
+
+ /* We have to escape every character of the environment variable so
+ they are not interpreted as active spec characters. A
--- /dev/null
+From da45b3fde60095756f5f6030f6012c23a3d34429 Mon Sep 17 00:00:00 2001
+From: Andrew McDonnell <bugs@andrewmcdonnell.net>
+Date: Fri, 3 Oct 2014 19:09:00 +0930
+Subject: Add .note.GNU-stack section
+
+See http://lists.busybox.net/pipermail/uclibc/2014-October/048671.html
+Below copied from https://gcc.gnu.org/ml/gcc-patches/2014-09/msg02430.html
+
+Re: [Patch, MIPS] Add .note.GNU-stack section
+
+ From: Steve Ellcey <sellcey at mips dot com>
+
+On Wed, 2014-09-10 at 10:15 -0700, Eric Christopher wrote:
+>
+>
+> On Wed, Sep 10, 2014 at 9:27 AM, <pinskia@gmail.com> wrote:
+
+> This works except you did not update the assembly files in
+> libgcc or glibc. We (Cavium) have the same patch in our tree
+> for a few released versions.
+
+> Mind just checking yours in then Andrew?
+
+> Thanks!
+> -eric
+
+I talked to Andrew about what files he changed in GCC and created and
+tested this new patch. Andrew also mentioned changing some assembly
+files in glibc but I don't see any use of '.section .note.GNU-stack' in
+any assembly files in glibc (for any platform) so I wasn't planning on
+creating a glibc to add them to mips glibc assembly language files.
+
+OK to check in this patch?
+
+Steve Ellcey
+sellcey@mips.com
+
+
+
+2014-09-26 Steve Ellcey <sellcey@mips.com>
+---
+ gcc/config/mips/mips.c | 3 +++
+ libgcc/config/mips/crti.S | 4 ++++
+ libgcc/config/mips/crtn.S | 3 +++
+ libgcc/config/mips/mips16.S | 4 ++++
+ libgcc/config/mips/vr4120-div.S | 4 ++++
+ 5 files changed, 18 insertions(+)
+
+--- a/gcc/config/mips/mips.c
++++ b/gcc/config/mips/mips.c
+@@ -22640,6 +22640,9 @@ mips_starting_frame_offset (void)
+ #undef TARGET_STARTING_FRAME_OFFSET
+ #define TARGET_STARTING_FRAME_OFFSET mips_starting_frame_offset
+
++#undef TARGET_ASM_FILE_END
++#define TARGET_ASM_FILE_END file_end_indicate_exec_stack
++
+ struct gcc_target targetm = TARGET_INITIALIZER;
+ \f
+ #include "gt-mips.h"
+--- a/libgcc/config/mips/crti.S
++++ b/libgcc/config/mips/crti.S
+@@ -21,6 +21,10 @@ a copy of the GCC Runtime Library Except
+ see the files COPYING3 and COPYING.RUNTIME respectively. If not, see
+ <http://www.gnu.org/licenses/>. */
+
++
++/* An executable stack is *not* required for these functions. */
++ .section .note.GNU-stack,"",%progbits
++
+ /* 4 slots for argument spill area. 1 for cpreturn, 1 for stack.
+ Return spill offset of 40 and 20. Aligned to 16 bytes for n32. */
+
+--- a/libgcc/config/mips/crtn.S
++++ b/libgcc/config/mips/crtn.S
+@@ -21,6 +21,9 @@ a copy of the GCC Runtime Library Except
+ see the files COPYING3 and COPYING.RUNTIME respectively. If not, see
+ <http://www.gnu.org/licenses/>. */
+
++/* An executable stack is *not* required for these functions. */
++ .section .note.GNU-stack,"",%progbits
++
+ /* 4 slots for argument spill area. 1 for cpreturn, 1 for stack.
+ Return spill offset of 40 and 20. Aligned to 16 bytes for n32. */
+
+--- a/libgcc/config/mips/mips16.S
++++ b/libgcc/config/mips/mips16.S
+@@ -48,6 +48,10 @@ see the files COPYING3 and COPYING.RUNTI
+ values using the soft-float calling convention, but do the actual
+ operation using the hard floating point instructions. */
+
++/* An executable stack is *not* required for these functions. */
++ .section .note.GNU-stack,"",%progbits
++ .previous
++
+ #if defined _MIPS_SIM && (_MIPS_SIM == _ABIO32 || _MIPS_SIM == _ABIO64)
+
+ /* This file contains 32-bit assembly code. */
+--- a/libgcc/config/mips/vr4120-div.S
++++ b/libgcc/config/mips/vr4120-div.S
+@@ -26,6 +26,10 @@ see the files COPYING3 and COPYING.RUNTI
+ -mfix-vr4120. div and ddiv do not give the correct result when one
+ of the operands is negative. */
+
++/* An executable stack is *not* required for these functions. */
++ .section .note.GNU-stack,"",%progbits
++ .previous
++
+ .set nomips16
+
+ #define DIV \
--- /dev/null
+From c0c62fa4256f805389f16ebfc4a60cf789129b50 Mon Sep 17 00:00:00 2001
+From: BangLang Huang <banglang.huang@foxmail.com>
+Date: Wed, 9 Nov 2016 10:36:49 +0800
+Subject: [PATCH] libffi: fix MIPS softfloat build issue
+
+Backported from github.com/libffi/libffi#272
+
+Signed-off-by: BangLang Huang <banglang.huang@foxmail.com>
+Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
+---
+ libffi/src/mips/n32.S | 17 +++++++++++++++++
+ libffi/src/mips/o32.S | 17 +++++++++++++++++
+ 2 files changed, 34 insertions(+)
+
+--- a/libffi/src/mips/n32.S
++++ b/libffi/src/mips/n32.S
+@@ -107,6 +107,16 @@ loadregs:
+
+ REG_L t6, 3*FFI_SIZEOF_ARG($fp) # load the flags word into t6.
+
++#ifdef __mips_soft_float
++ REG_L a0, 0*FFI_SIZEOF_ARG(t9)
++ REG_L a1, 1*FFI_SIZEOF_ARG(t9)
++ REG_L a2, 2*FFI_SIZEOF_ARG(t9)
++ REG_L a3, 3*FFI_SIZEOF_ARG(t9)
++ REG_L a4, 4*FFI_SIZEOF_ARG(t9)
++ REG_L a5, 5*FFI_SIZEOF_ARG(t9)
++ REG_L a6, 6*FFI_SIZEOF_ARG(t9)
++ REG_L a7, 7*FFI_SIZEOF_ARG(t9)
++#else
+ and t4, t6, ((1<<FFI_FLAG_BITS)-1)
+ REG_L a0, 0*FFI_SIZEOF_ARG(t9)
+ beqz t4, arg1_next
+@@ -193,6 +203,7 @@ arg7_next:
+ arg8_doublep:
+ l.d $f19, 7*FFI_SIZEOF_ARG(t9)
+ arg8_next:
++#endif
+
+ callit:
+ # Load the function pointer
+@@ -214,6 +225,7 @@ retint:
+ b epilogue
+
+ retfloat:
++#ifndef __mips_soft_float
+ bne t6, FFI_TYPE_FLOAT, retdouble
+ jal t9
+ REG_L t4, 4*FFI_SIZEOF_ARG($fp)
+@@ -272,6 +284,7 @@ retstruct_f_d:
+ s.s $f0, 0(t4)
+ s.d $f2, 8(t4)
+ b epilogue
++#endif
+
+ retstruct_d_soft:
+ bne t6, FFI_TYPE_STRUCT_D_SOFT, retstruct_f_soft
+@@ -429,6 +442,7 @@ ffi_closure_N32:
+ REG_S a6, A6_OFF2($sp)
+ REG_S a7, A7_OFF2($sp)
+
++#ifndef __mips_soft_float
+ # Store all possible float/double registers.
+ s.d $f12, F12_OFF2($sp)
+ s.d $f13, F13_OFF2($sp)
+@@ -438,6 +452,7 @@ ffi_closure_N32:
+ s.d $f17, F17_OFF2($sp)
+ s.d $f18, F18_OFF2($sp)
+ s.d $f19, F19_OFF2($sp)
++#endif
+
+ # Call ffi_closure_mips_inner_N32 to do the real work.
+ LA t9, ffi_closure_mips_inner_N32
+@@ -458,6 +473,7 @@ cls_retint:
+ b cls_epilogue
+
+ cls_retfloat:
++#ifndef __mips_soft_float
+ bne v0, FFI_TYPE_FLOAT, cls_retdouble
+ l.s $f0, V0_OFF2($sp)
+ b cls_epilogue
+@@ -500,6 +516,7 @@ cls_retstruct_f_d:
+ l.s $f0, V0_OFF2($sp)
+ l.d $f2, V1_OFF2($sp)
+ b cls_epilogue
++#endif
+
+ cls_retstruct_small2:
+ REG_L v0, V0_OFF2($sp)
+--- a/libffi/src/mips/o32.S
++++ b/libffi/src/mips/o32.S
+@@ -82,13 +82,16 @@ sixteen:
+
+ ADDU $sp, 4 * FFI_SIZEOF_ARG # adjust $sp to new args
+
++#ifndef __mips_soft_float
+ bnez t0, pass_d # make it quick for int
++#endif
+ REG_L a0, 0*FFI_SIZEOF_ARG($sp) # just go ahead and load the
+ REG_L a1, 1*FFI_SIZEOF_ARG($sp) # four regs.
+ REG_L a2, 2*FFI_SIZEOF_ARG($sp)
+ REG_L a3, 3*FFI_SIZEOF_ARG($sp)
+ b call_it
+
++#ifndef __mips_soft_float
+ pass_d:
+ bne t0, FFI_ARGS_D, pass_f
+ l.d $f12, 0*FFI_SIZEOF_ARG($sp) # load $fp regs from args
+@@ -130,6 +133,7 @@ pass_f_d:
+ # bne t0, FFI_ARGS_F_D, call_it
+ l.s $f12, 0*FFI_SIZEOF_ARG($sp) # load $fp regs from args
+ l.d $f14, 2*FFI_SIZEOF_ARG($sp) # passing double and float
++#endif
+
+ call_it:
+ # Load the function pointer
+@@ -158,14 +162,23 @@ retfloat:
+ bne t2, FFI_TYPE_FLOAT, retdouble
+ jalr t9
+ REG_L t0, SIZEOF_FRAME + 4*FFI_SIZEOF_ARG($fp)
++#ifndef __mips_soft_float
+ s.s $f0, 0(t0)
++#else
++ REG_S v0, 0(t0)
++#endif
+ b epilogue
+
+ retdouble:
+ bne t2, FFI_TYPE_DOUBLE, noretval
+ jalr t9
+ REG_L t0, SIZEOF_FRAME + 4*FFI_SIZEOF_ARG($fp)
++#ifndef __mips_soft_float
+ s.d $f0, 0(t0)
++#else
++ REG_S v1, 4(t0)
++ REG_S v0, 0(t0)
++#endif
+ b epilogue
+
+ noretval:
+@@ -261,9 +274,11 @@ $LCFI7:
+ li $13, 1 # FFI_O32
+ bne $16, $13, 1f # Skip fp save if FFI_O32_SOFT_FLOAT
+
++#ifndef __mips_soft_float
+ # Store all possible float/double registers.
+ s.d $f12, FA_0_0_OFF2($fp)
+ s.d $f14, FA_1_0_OFF2($fp)
++#endif
+ 1:
+ # Call ffi_closure_mips_inner_O32 to do the work.
+ la t9, ffi_closure_mips_inner_O32
+@@ -281,6 +296,7 @@ $LCFI7:
+ li $13, 1 # FFI_O32
+ bne $16, $13, 1f # Skip fp restore if FFI_O32_SOFT_FLOAT
+
++#ifndef __mips_soft_float
+ li $9, FFI_TYPE_FLOAT
+ l.s $f0, V0_OFF2($fp)
+ beq $8, $9, closure_done
+@@ -288,6 +304,7 @@ $LCFI7:
+ li $9, FFI_TYPE_DOUBLE
+ l.d $f0, V0_OFF2($fp)
+ beq $8, $9, closure_done
++#endif
+ 1:
+ REG_L $3, V1_OFF2($fp)
+ REG_L $2, V0_OFF2($fp)
--- /dev/null
+From dda6b050cd74a352670787a294596a9c56c21327 Mon Sep 17 00:00:00 2001
+From: Yousong Zhou <yszhou4tech@gmail.com>
+Date: Fri, 4 May 2018 18:20:53 +0800
+Subject: [PATCH] gotools: fix compilation when making cross compiler
+
+libgo is "the runtime support library for the Go programming language.
+This library is intended for use with the Go frontend."
+
+gccgo will link target files with libgo.so which depends on libgcc_s.so.1, but
+the linker will complain that it cannot find it. That's because shared libgcc
+is not present in the install directory yet. libgo.so was made without problem
+because gcc will emit -lgcc_s when compiled with -shared option. When gotools
+were being made, it was supplied with -static-libgcc thus no link option was
+provided. Check LIBGO in gcc/go/gcc-spec.c for how gccgo make a builtin spec
+for linking with libgo.so
+
+- GccgoCrossCompilation, https://github.com/golang/go/wiki/GccgoCrossCompilation
+- Cross-building instructions, http://www.eglibc.org/archives/patches/msg00078.html
+
+When 3-pass GCC compilation is used, shared libgcc runtime libraries will be
+available after gcc pass2 completed and will meet the gotools link requirement
+at gcc pass3
+---
+ gotools/Makefile.am | 4 +++-
+ gotools/Makefile.in | 4 +++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/gotools/Makefile.am
++++ b/gotools/Makefile.am
+@@ -26,6 +26,7 @@ PWD_COMMAND = $${PWDCMD-pwd}
+ STAMP = echo timestamp >
+
+ libgodir = ../$(target_noncanonical)/libgo
++libgccdir = ../$(target_noncanonical)/libgcc
+ LIBGODEP = $(libgodir)/libgo.la
+
+ LIBGOTOOL = $(libgodir)/libgotool.a
+@@ -41,7 +42,8 @@ GOCFLAGS = $(CFLAGS_FOR_TARGET)
+ GOCOMPILE = $(GOCOMPILER) $(GOCFLAGS)
+
+ AM_GOCFLAGS = -I $(libgodir)
+-AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs
++AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs \
++ -L $(libgccdir) -L $(libgccdir)/.libs -lgcc_s
+ GOLINK = $(GOCOMPILER) $(GOCFLAGS) $(AM_GOCFLAGS) $(LDFLAGS) $(AM_LDFLAGS) -o $@
+
+ libgosrcdir = $(srcdir)/../libgo/go
+--- a/gotools/Makefile.in
++++ b/gotools/Makefile.in
+@@ -263,6 +263,7 @@ mkinstalldirs = $(SHELL) $(toplevel_srcd
+ PWD_COMMAND = $${PWDCMD-pwd}
+ STAMP = echo timestamp >
+ libgodir = ../$(target_noncanonical)/libgo
++libgccdir = ../$(target_noncanonical)/libgcc
+ LIBGODEP = $(libgodir)/libgo.la
+ LIBGOTOOL = $(libgodir)/libgotool.a
+ @NATIVE_FALSE@GOCOMPILER = $(GOC)
+@@ -271,7 +272,8 @@ LIBGOTOOL = $(libgodir)/libgotool.a
+ @NATIVE_TRUE@GOCOMPILER = $(GOC_FOR_TARGET) $(XGCC_FLAGS_FOR_TARGET)
+ GOCOMPILE = $(GOCOMPILER) $(GOCFLAGS)
+ AM_GOCFLAGS = -I $(libgodir)
+-AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs
++AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs \
++ -L $(libgccdir) -L $(libgccdir)/.libs -lgcc_s
+ GOLINK = $(GOCOMPILER) $(GOCFLAGS) $(AM_GOCFLAGS) $(LDFLAGS) $(AM_LDFLAGS) -o $@
+ libgosrcdir = $(srcdir)/../libgo/go
+ cmdsrcdir = $(libgosrcdir)/cmd
+++ /dev/null
-commit 81cc26c706b2bc8c8c1eb1a322e5c5157900836e
-Author: Felix Fietkau <nbd@openwrt.org>
-Date: Sun Oct 19 21:45:51 2014 +0000
-
- gcc: do not assume that the Mac OS X filesystem is case insensitive
-
- Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-
- SVN-Revision: 42973
-
---- a/include/filenames.h
-+++ b/include/filenames.h
-@@ -44,11 +44,6 @@ extern "C" {
- # define IS_DIR_SEPARATOR(c) IS_DOS_DIR_SEPARATOR (c)
- # define IS_ABSOLUTE_PATH(f) IS_DOS_ABSOLUTE_PATH (f)
- #else /* not DOSish */
--# if defined(__APPLE__)
--# ifndef HAVE_CASE_INSENSITIVE_FILE_SYSTEM
--# define HAVE_CASE_INSENSITIVE_FILE_SYSTEM 1
--# endif
--# endif /* __APPLE__ */
- # define HAS_DRIVE_SPEC(f) (0)
- # define IS_DIR_SEPARATOR(c) IS_UNIX_DIR_SEPARATOR (c)
- # define IS_ABSOLUTE_PATH(f) IS_UNIX_ABSOLUTE_PATH (f)
+++ /dev/null
-diff -u --recursive gcc-10.3.0-vanilla/gcc/real.h gcc-10.3.0/gcc/real.h
---- gcc-10.3.0-vanilla/gcc/real.h 2021-04-08 06:56:28.561746620 -0500
-+++ gcc-10.3.0/gcc/real.h 2022-05-18 17:04:32.076412174 -0500
-@@ -77,8 +77,10 @@
- + (REAL_VALUE_TYPE_SIZE%HOST_BITS_PER_WIDE_INT ? 1 : 0)) /* round up */
-
- /* Verify the guess. */
-+#ifndef __LP64__
- extern char test_real_width
- [sizeof (REAL_VALUE_TYPE) <= REAL_WIDTH * sizeof (HOST_WIDE_INT) ? 1 : -1];
-+#endif
-
- /* Calculate the format for CONST_DOUBLE. We need as many slots as
- are necessary to overlay a REAL_VALUE_TYPE on them. This could be
+++ /dev/null
-commit 098bd91f5eae625c7d2ee621e10930fc4434e5e2
-Author: Luka Perkov <luka@openwrt.org>
-Date: Tue Feb 26 16:16:33 2013 +0000
-
- gcc: don't build documentation
-
- This closes #13039.
-
- Signed-off-by: Luka Perkov <luka@openwrt.org>
-
- SVN-Revision: 35807
-
---- a/gcc/Makefile.in
-+++ b/gcc/Makefile.in
-@@ -3285,18 +3285,10 @@ doc/gcc.info: $(TEXI_GCC_FILES)
- doc/gccint.info: $(TEXI_GCCINT_FILES)
- doc/cppinternals.info: $(TEXI_CPPINT_FILES)
-
--doc/%.info: %.texi
-- if [ x$(BUILD_INFO) = xinfo ]; then \
-- $(MAKEINFO) $(MAKEINFOFLAGS) -I . -I $(gcc_docdir) \
-- -I $(gcc_docdir)/include -o $@ $<; \
-- fi
-+doc/%.info:
-
- # Duplicate entry to handle renaming of gccinstall.info
--doc/gccinstall.info: $(TEXI_GCCINSTALL_FILES)
-- if [ x$(BUILD_INFO) = xinfo ]; then \
-- $(MAKEINFO) $(MAKEINFOFLAGS) -I $(gcc_docdir) \
-- -I $(gcc_docdir)/include -o $@ $<; \
-- fi
-+doc/gccinstall.info:
-
- doc/cpp.dvi: $(TEXI_CPP_FILES)
- doc/gcc.dvi: $(TEXI_GCC_FILES)
+++ /dev/null
-Fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84790.
-MIPS16 functions have a static assembler prologue which clobbers
-registers v0 and v1. Add these register clobbers to function call
-instructions.
-
---- a/gcc/config/mips/mips.c
-+++ b/gcc/config/mips/mips.c
-@@ -3132,6 +3132,12 @@ mips_emit_call_insn (rtx pattern, rtx or
- emit_insn (gen_update_got_version ());
- }
-
-+ if (TARGET_MIPS16 && TARGET_USE_GOT)
-+ {
-+ clobber_reg (&CALL_INSN_FUNCTION_USAGE (insn), MIPS16_PIC_TEMP);
-+ clobber_reg (&CALL_INSN_FUNCTION_USAGE (insn), MIPS_PROLOGUE_TEMP (word_mode));
-+ }
-+
- if (TARGET_MIPS16
- && TARGET_EXPLICIT_RELOCS
- && TARGET_CALL_CLOBBERED_GP)
+++ /dev/null
---- a/gcc/gcc.c
-+++ b/gcc/gcc.c
-@@ -875,7 +875,9 @@ proper position among the other output f
- #endif
-
- #ifndef LINK_SSP_SPEC
--#ifdef TARGET_LIBC_PROVIDES_SSP
-+#if DEFAULT_LIBC == LIBC_MUSL
-+#define LINK_SSP_SPEC "-lssp_nonshared"
-+#elif defined(TARGET_LIBC_PROVIDES_SSP)
- #define LINK_SSP_SPEC "%{fstack-protector|fstack-protector-all" \
- "|fstack-protector-strong|fstack-protector-explicit:}"
- #else
+++ /dev/null
-commit ecf7671b769fe96f7b5134be442089f8bdba55d2
-Author: Felix Fietkau <nbd@nbd.name>
-Date: Thu Aug 4 20:29:45 2016 +0200
-
-gcc: add a patch to generate better code with Os on mips
-
-Also happens to reduce compressed code size a bit
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
-
---- a/gcc/config/mips/mips.c
-+++ b/gcc/config/mips/mips.c
-@@ -20041,7 +20041,7 @@ mips_option_override (void)
- flag_pcc_struct_return = 0;
-
- /* Decide which rtx_costs structure to use. */
-- if (optimize_size)
-+ if (0 && optimize_size)
- mips_cost = &mips_rtx_cost_optimize_size;
- else
- mips_cost = &mips_rtx_cost_data[mips_tune];
+++ /dev/null
-commit 8570c4be394cff7282f332f97da2ff569a927ddb
-Author: Imre Kaloz <kaloz@openwrt.org>
-Date: Wed Feb 2 20:06:12 2011 +0000
-
- fixup arm soft-float symbols
-
- SVN-Revision: 25325
-
---- a/libgcc/config/arm/t-linux
-+++ b/libgcc/config/arm/t-linux
-@@ -1,6 +1,10 @@
- LIB1ASMSRC = arm/lib1funcs.S
- LIB1ASMFUNCS = _udivsi3 _divsi3 _umodsi3 _modsi3 _dvmd_lnx _clzsi2 _clzdi2 \
-- _ctzsi2 _arm_addsubdf3 _arm_addsubsf3
-+ _ctzsi2 _arm_addsubdf3 _arm_addsubsf3 \
-+ _arm_negdf2 _arm_muldivdf3 _arm_cmpdf2 _arm_unorddf2 \
-+ _arm_fixdfsi _arm_fixunsdfsi _arm_truncdfsf2 \
-+ _arm_negsf2 _arm_muldivsf3 _arm_cmpsf2 _arm_unordsf2 \
-+ _arm_fixsfsi _arm_fixunssfsi
-
- # Just for these, we omit the frame pointer since it makes such a big
- # difference.
---- a/gcc/config/arm/linux-elf.h
-+++ b/gcc/config/arm/linux-elf.h
-@@ -58,8 +58,6 @@
- %{shared:-lc} \
- %{!shared:%{profile:-lc_p}%{!profile:-lc}}"
-
--#define LIBGCC_SPEC "%{mfloat-abi=soft*:-lfloat} -lgcc"
--
- #define GLIBC_DYNAMIC_LINKER "/lib/ld-linux.so.2"
-
- #define LINUX_TARGET_LINK_SPEC "%{h*} \
+++ /dev/null
-commit c96312958c0621e72c9b32da5bc224ffe2161384
-Author: Felix Fietkau <nbd@openwrt.org>
-Date: Mon Oct 19 23:26:09 2009 +0000
-
- gcc: create a proper libgcc_pic.a static library for relinking (4.3.3+ for now, backport will follow)
-
- SVN-Revision: 18086
-
---- a/libgcc/Makefile.in
-+++ b/libgcc/Makefile.in
-@@ -929,11 +929,12 @@ $(libgcov-driver-objects): %$(objext): $
-
- # Static libraries.
- libgcc.a: $(libgcc-objects)
-+libgcc_pic.a: $(libgcc-s-objects)
- libgcov.a: $(libgcov-objects)
- libunwind.a: $(libunwind-objects)
- libgcc_eh.a: $(libgcc-eh-objects)
-
--libgcc.a libgcov.a libunwind.a libgcc_eh.a:
-+libgcc.a libgcov.a libunwind.a libgcc_eh.a libgcc_pic.a:
- -rm -f $@
-
- objects="$(objects)"; \
-@@ -957,7 +958,7 @@ all: libunwind.a
- endif
-
- ifeq ($(enable_shared),yes)
--all: libgcc_eh.a libgcc_s$(SHLIB_EXT)
-+all: libgcc_eh.a libgcc_pic.a libgcc_s$(SHLIB_EXT)
- ifneq ($(LIBUNWIND),)
- all: libunwind$(SHLIB_EXT)
- libgcc_s$(SHLIB_EXT): libunwind$(SHLIB_EXT)
-@@ -1163,6 +1164,10 @@ install-shared:
- chmod 644 $(DESTDIR)$(inst_libdir)/libgcc_eh.a
- $(RANLIB) $(DESTDIR)$(inst_libdir)/libgcc_eh.a
-
-+ $(INSTALL_DATA) libgcc_pic.a $(mapfile) $(DESTDIR)$(inst_libdir)/
-+ chmod 644 $(DESTDIR)$(inst_libdir)/libgcc_pic.a
-+ $(RANLIB) $(DESTDIR)$(inst_libdir)/libgcc_pic.a
-+
- $(subst @multilib_dir@,$(MULTIDIR),$(subst \
- @shlib_base_name@,libgcc_s,$(subst \
- @shlib_slibdir_qual@,$(MULTIOSSUBDIR),$(SHLIB_INSTALL))))
+++ /dev/null
-commit 7edc8ca5456d9743dd0075eb3cc5b04f4f24c8cc
-Author: Imre Kaloz <kaloz@openwrt.org>
-Date: Wed Feb 2 19:34:36 2011 +0000
-
- add armv4 fixup patches
-
- SVN-Revision: 25322
-
-
---- a/gcc/config/arm/linux-eabi.h
-+++ b/gcc/config/arm/linux-eabi.h
-@@ -91,10 +91,15 @@
- #define MUSL_DYNAMIC_LINKER \
- "/lib/ld-musl-arm" MUSL_DYNAMIC_LINKER_E "%{mfloat-abi=hard:hf}%{mfdpic:-fdpic}.so.1"
-
-+/* For armv4 we pass --fix-v4bx to linker to support EABI */
-+#undef TARGET_FIX_V4BX_SPEC
-+#define TARGET_FIX_V4BX_SPEC " %{mcpu=arm8|mcpu=arm810|mcpu=strongarm*"\
-+ "|march=armv4|mcpu=fa526|mcpu=fa626:--fix-v4bx}"
-+
- /* At this point, bpabi.h will have clobbered LINK_SPEC. We want to
- use the GNU/Linux version, not the generic BPABI version. */
- #undef LINK_SPEC
--#define LINK_SPEC EABI_LINK_SPEC \
-+#define LINK_SPEC EABI_LINK_SPEC TARGET_FIX_V4BX_SPEC \
- LINUX_OR_ANDROID_LD (LINUX_TARGET_LINK_SPEC, \
- LINUX_TARGET_LINK_SPEC " " ANDROID_LINK_SPEC)
-
+++ /dev/null
-commit dcfc40358b5a3cae7320c17f8d1cebd5ad5540cd
-Author: Felix Fietkau <nbd@openwrt.org>
-Date: Sun Feb 12 20:25:47 2012 +0000
-
- gcc 4.6: port over the missing patch 850-use_shared_libgcc.patch to prevent libgcc crap from leaking into every single binary
-
- SVN-Revision: 30486
---- a/gcc/config/arm/linux-eabi.h
-+++ b/gcc/config/arm/linux-eabi.h
-@@ -132,10 +132,6 @@
- "%{Ofast|ffast-math|funsafe-math-optimizations:crtfastmath.o%s} " \
- LINUX_OR_ANDROID_LD (GNU_USER_TARGET_ENDFILE_SPEC, ANDROID_ENDFILE_SPEC)
-
--/* Use the default LIBGCC_SPEC, not the version in linux-elf.h, as we
-- do not use -lfloat. */
--#undef LIBGCC_SPEC
--
- /* Clear the instruction cache from `beg' to `end'. This is
- implemented in lib1funcs.S, so ensure an error if this definition
- is used. */
---- a/gcc/config/linux.h
-+++ b/gcc/config/linux.h
-@@ -66,6 +66,10 @@ see the files COPYING3 and COPYING.RUNTI
- builtin_version ("CRuntime_Musl"); \
- } while (0)
-
-+#ifndef LIBGCC_SPEC
-+#define LIBGCC_SPEC "%{static|static-libgcc:-lgcc}%{!static:%{!static-libgcc:-lgcc_s}}"
-+#endif
-+
- /* Determine which dynamic linker to use depending on whether GLIBC or
- uClibc or Bionic or musl is the default C library and whether
- -muclibc or -mglibc or -mbionic or -mmusl has been passed to change
---- a/libgcc/mkmap-symver.awk
-+++ b/libgcc/mkmap-symver.awk
-@@ -136,5 +136,5 @@ function output(lib) {
- else if (inherit[lib])
- printf("} %s;\n", inherit[lib]);
- else
-- printf ("\n local:\n\t*;\n};\n");
-+ printf ("\n\t*;\n};\n");
- }
---- a/gcc/config/rs6000/linux.h
-+++ b/gcc/config/rs6000/linux.h
-@@ -62,6 +62,9 @@
- #undef CPP_OS_DEFAULT_SPEC
- #define CPP_OS_DEFAULT_SPEC "%(cpp_os_linux)"
-
-+#undef LIBGCC_SPEC
-+#define LIBGCC_SPEC "%{!static:%{!static-libgcc:-lgcc_s}} -lgcc"
-+
- #undef LINK_SHLIB_SPEC
- #define LINK_SHLIB_SPEC "%{shared:-shared} %{!shared: %{static:-static}} \
- %{static-pie:-static -pie --no-dynamic-linker -z text}"
+++ /dev/null
-commit 64661de100da1ec1061ef3e5e400285dce115e6b
-Author: Felix Fietkau <nbd@openwrt.org>
-Date: Sun May 10 13:16:35 2015 +0000
-
- gcc: add some size optimization patches
-
- Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-
- SVN-Revision: 45664
-
---- a/libgcc/config/t-libunwind
-+++ b/libgcc/config/t-libunwind
-@@ -2,8 +2,7 @@
-
- HOST_LIBGCC2_CFLAGS += -DUSE_GAS_SYMVER
-
--LIB2ADDEH = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c \
-- $(srcdir)/unwind-compat.c $(srcdir)/unwind-dw2-fde-compat.c
-+LIB2ADDEH = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c
- LIB2ADDEHSTATIC = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c
-
- # Override the default value from t-slibgcc-elf-ver and mention -lunwind
+++ /dev/null
---- a/gcc/config/rs6000/rs6000-logue.c
-+++ b/gcc/config/rs6000/rs6000-logue.c
-@@ -348,7 +348,7 @@ rs6000_savres_strategy (rs6000_stack_t *
- /* Define cutoff for using out-of-line functions to save registers. */
- if (DEFAULT_ABI == ABI_V4 || TARGET_ELF)
- {
-- if (!optimize_size)
-+ if (1)
- {
- strategy |= SAVE_INLINE_FPRS | REST_INLINE_FPRS;
- strategy |= SAVE_INLINE_GPRS | REST_INLINE_GPRS;
+++ /dev/null
---- a/libgcc/crtstuff.c
-+++ b/libgcc/crtstuff.c
-@@ -152,7 +152,7 @@ call_ ## FUNC (void) \
- #endif
-
- #if !defined(USE_TM_CLONE_REGISTRY) && defined(OBJECT_FORMAT_ELF)
--# define USE_TM_CLONE_REGISTRY 1
-+# define USE_TM_CLONE_REGISTRY 0
- #elif !defined(USE_TM_CLONE_REGISTRY)
- # define USE_TM_CLONE_REGISTRY 0
- #endif
+++ /dev/null
---- a/libgcc/config/mips/t-mips16
-+++ b/libgcc/config/mips/t-mips16
-@@ -43,3 +43,6 @@ SYNC_CFLAGS = -mno-mips16
-
- # Version these symbols if building libgcc.so.
- SHLIB_MAPFILES += $(srcdir)/config/mips/libgcc-mips16.ver
-+
-+CRTSTUFF_T_CFLAGS += -mno-mips16
-+CRTSTUFF_T_CFLAGS_S += -mno-mips16
+++ /dev/null
-commit 99368862e44740ff4fd33760893f04e14f9dbdf1
-Author: Felix Fietkau <nbd@openwrt.org>
-Date: Tue Jul 31 00:52:27 2007 +0000
-
- Port the mbsd_multi patch from freewrt, which adds -fhonour-copts. This will emit warnings in packages that don't use our target cflags properly
-
- SVN-Revision: 8256
-
- This patch brings over a feature from MirBSD:
- * -fhonour-copts
- If this option is not given, it's warned (depending
- on environment variables). This is to catch errors
- of misbuilt packages which override CFLAGS themselves.
-
- This patch was authored by Thorsten Glaser <tg at mirbsd.de>
- with copyright assignment to the FSF in effect.
-
---- a/gcc/c-family/c-opts.c
-+++ b/gcc/c-family/c-opts.c
-@@ -107,6 +107,9 @@ static dump_flags_t original_dump_flags;
- /* Whether any standard preincluded header has been preincluded. */
- static bool done_preinclude;
-
-+/* Check if a port honours COPTS. */
-+static int honour_copts = 0;
-+
- static void handle_OPT_d (const char *);
- static void set_std_cxx98 (int);
- static void set_std_cxx11 (int);
-@@ -455,6 +458,12 @@ c_common_handle_option (size_t scode, co
- flag_no_builtin = !value;
- break;
-
-+ case OPT_fhonour_copts:
-+ if (c_language == clk_c) {
-+ honour_copts++;
-+ }
-+ break;
-+
- case OPT_fconstant_string_class_:
- constant_string_class_name = arg;
- break;
-@@ -1168,6 +1177,47 @@ c_common_init (void)
- return false;
- }
-
-+ if (c_language == clk_c) {
-+ char *ev = getenv ("GCC_HONOUR_COPTS");
-+ int evv;
-+ if (ev == NULL)
-+ evv = -1;
-+ else if ((*ev == '0') || (*ev == '\0'))
-+ evv = 0;
-+ else if (*ev == '1')
-+ evv = 1;
-+ else if (*ev == '2')
-+ evv = 2;
-+ else if (*ev == 's')
-+ evv = -1;
-+ else {
-+ warning (0, "unknown GCC_HONOUR_COPTS value, assuming 1");
-+ evv = 1; /* maybe depend this on something like MIRBSD_NATIVE? */
-+ }
-+ if (evv == 1) {
-+ if (honour_copts == 0) {
-+ error ("someone does not honour COPTS at all in lenient mode");
-+ return false;
-+ } else if (honour_copts != 1) {
-+ warning (0, "someone does not honour COPTS correctly, passed %d times",
-+ honour_copts);
-+ }
-+ } else if (evv == 2) {
-+ if (honour_copts == 0) {
-+ error ("someone does not honour COPTS at all in strict mode");
-+ return false;
-+ } else if (honour_copts != 1) {
-+ error ("someone does not honour COPTS correctly, passed %d times",
-+ honour_copts);
-+ return false;
-+ }
-+ } else if (evv == 0) {
-+ if (honour_copts != 1)
-+ inform (UNKNOWN_LOCATION, "someone does not honour COPTS correctly, passed %d times",
-+ honour_copts);
-+ }
-+ }
-+
- return true;
- }
-
---- a/gcc/c-family/c.opt
-+++ b/gcc/c-family/c.opt
-@@ -1590,6 +1590,9 @@ C++ ObjC++ Optimization Alias(fexception
- fhonor-std
- C++ ObjC++ WarnRemoved
-
-+fhonour-copts
-+C ObjC C++ ObjC++ RejectNegative
-+
- fhosted
- C ObjC
- Assume normal C execution environment.
---- a/gcc/common.opt
-+++ b/gcc/common.opt
-@@ -1660,6 +1660,9 @@ fguess-branch-probability
- Common Report Var(flag_guess_branch_prob) Optimization
- Enable guessing of branch probabilities.
-
-+fhonour-copts
-+Common RejectNegative
-+
- ; Nonzero means ignore `#ident' directives. 0 means handle them.
- ; Generate position-independent code for executables if possible
- ; On SVR4 targets, it also controls whether or not to emit a
---- a/gcc/doc/invoke.texi
-+++ b/gcc/doc/invoke.texi
-@@ -8171,6 +8171,17 @@ This option is only supported for C and
- @option{-Wall} and by @option{-Wpedantic}, which can be disabled with
- @option{-Wno-pointer-sign}.
-
-+@item -fhonour-copts
-+@opindex fhonour-copts
-+If @env{GCC_HONOUR_COPTS} is set to 1, abort if this option is not
-+given at least once, and warn if it is given more than once.
-+If @env{GCC_HONOUR_COPTS} is set to 2, abort if this option is not
-+given exactly once.
-+If @env{GCC_HONOUR_COPTS} is set to 0 or unset, warn if this option
-+is not given exactly once.
-+The warning is quelled if @env{GCC_HONOUR_COPTS} is set to @samp{s}.
-+This flag and environment variable only affect the C language.
-+
- @item -Wstack-protector
- @opindex Wstack-protector
- @opindex Wno-stack-protector
---- a/gcc/opts.c
-+++ b/gcc/opts.c
-@@ -2318,6 +2318,9 @@ common_handle_option (struct gcc_options
- /* Currently handled in a prescan. */
- break;
-
-+ case OPT_fhonour_copts:
-+ break;
-+
- case OPT_Werror:
- dc->warning_as_error_requested = value;
- break;
+++ /dev/null
-Author: Jo-Philipp Wich <jow@openwrt.org>
-Date: Sat Apr 21 03:02:39 2012 +0000
-
- gcc: add patch to make the getenv() spec function nonfatal if requested environment variable is unset
-
- SVN-Revision: 31390
-
---- a/gcc/gcc.c
-+++ b/gcc/gcc.c
-@@ -9396,8 +9396,10 @@ getenv_spec_function (int argc, const ch
- }
-
- if (!value)
-- fatal_error (input_location,
-- "environment variable %qs not defined", varname);
-+ {
-+ warning (input_location, "environment variable %qs not defined", varname);
-+ value = "";
-+ }
-
- /* We have to escape every character of the environment variable so
- they are not interpreted as active spec characters. A
+++ /dev/null
-From da45b3fde60095756f5f6030f6012c23a3d34429 Mon Sep 17 00:00:00 2001
-From: Andrew McDonnell <bugs@andrewmcdonnell.net>
-Date: Fri, 3 Oct 2014 19:09:00 +0930
-Subject: Add .note.GNU-stack section
-
-See http://lists.busybox.net/pipermail/uclibc/2014-October/048671.html
-Below copied from https://gcc.gnu.org/ml/gcc-patches/2014-09/msg02430.html
-
-Re: [Patch, MIPS] Add .note.GNU-stack section
-
- From: Steve Ellcey <sellcey at mips dot com>
-
-On Wed, 2014-09-10 at 10:15 -0700, Eric Christopher wrote:
->
->
-> On Wed, Sep 10, 2014 at 9:27 AM, <pinskia@gmail.com> wrote:
-
-> This works except you did not update the assembly files in
-> libgcc or glibc. We (Cavium) have the same patch in our tree
-> for a few released versions.
-
-> Mind just checking yours in then Andrew?
-
-> Thanks!
-> -eric
-
-I talked to Andrew about what files he changed in GCC and created and
-tested this new patch. Andrew also mentioned changing some assembly
-files in glibc but I don't see any use of '.section .note.GNU-stack' in
-any assembly files in glibc (for any platform) so I wasn't planning on
-creating a glibc to add them to mips glibc assembly language files.
-
-OK to check in this patch?
-
-Steve Ellcey
-sellcey@mips.com
-
-
-
-2014-09-26 Steve Ellcey <sellcey@mips.com>
----
- gcc/config/mips/mips.c | 3 +++
- libgcc/config/mips/crti.S | 4 ++++
- libgcc/config/mips/crtn.S | 3 +++
- libgcc/config/mips/mips16.S | 4 ++++
- libgcc/config/mips/vr4120-div.S | 4 ++++
- 5 files changed, 18 insertions(+)
-
---- a/gcc/config/mips/mips.c
-+++ b/gcc/config/mips/mips.c
-@@ -22881,6 +22881,9 @@ mips_asm_file_end (void)
- #define TARGET_ASM_FILE_END mips_asm_file_end
-
-
-+#undef TARGET_ASM_FILE_END
-+#define TARGET_ASM_FILE_END file_end_indicate_exec_stack
-+
- struct gcc_target targetm = TARGET_INITIALIZER;
- \f
- #include "gt-mips.h"
---- a/libgcc/config/mips/crti.S
-+++ b/libgcc/config/mips/crti.S
-@@ -24,6 +24,10 @@ see the files COPYING3 and COPYING.RUNTI
- /* An executable stack is *not* required for these functions. */
- #include "gnustack.h"
-
-+
-+/* An executable stack is *not* required for these functions. */
-+ .section .note.GNU-stack,"",%progbits
-+
- /* 4 slots for argument spill area. 1 for cpreturn, 1 for stack.
- Return spill offset of 40 and 20. Aligned to 16 bytes for n32. */
-
---- a/libgcc/config/mips/crtn.S
-+++ b/libgcc/config/mips/crtn.S
-@@ -24,6 +24,9 @@ see the files COPYING3 and COPYING.RUNTI
- /* An executable stack is *not* required for these functions. */
- #include "gnustack.h"
-
-+/* An executable stack is *not* required for these functions. */
-+ .section .note.GNU-stack,"",%progbits
-+
- /* 4 slots for argument spill area. 1 for cpreturn, 1 for stack.
- Return spill offset of 40 and 20. Aligned to 16 bytes for n32. */
-
---- a/libgcc/config/mips/mips16.S
-+++ b/libgcc/config/mips/mips16.S
-@@ -51,6 +51,10 @@ see the files COPYING3 and COPYING.RUNTI
- values using the soft-float calling convention, but do the actual
- operation using the hard floating point instructions. */
-
-+/* An executable stack is *not* required for these functions. */
-+ .section .note.GNU-stack,"",%progbits
-+ .previous
-+
- #if defined _MIPS_SIM && (_MIPS_SIM == _ABIO32 || _MIPS_SIM == _ABIO64)
-
- /* This file contains 32-bit assembly code. */
---- a/libgcc/config/mips/vr4120-div.S
-+++ b/libgcc/config/mips/vr4120-div.S
-@@ -29,6 +29,10 @@ see the files COPYING3 and COPYING.RUNTI
- -mfix-vr4120. div and ddiv do not give the correct result when one
- of the operands is negative. */
-
-+/* An executable stack is *not* required for these functions. */
-+ .section .note.GNU-stack,"",%progbits
-+ .previous
-+
- .set nomips16
-
- #define DIV \
+++ /dev/null
-From c0c62fa4256f805389f16ebfc4a60cf789129b50 Mon Sep 17 00:00:00 2001
-From: BangLang Huang <banglang.huang@foxmail.com>
-Date: Wed, 9 Nov 2016 10:36:49 +0800
-Subject: [PATCH] libffi: fix MIPS softfloat build issue
-
-Backported from github.com/libffi/libffi#272
-
-Signed-off-by: BangLang Huang <banglang.huang@foxmail.com>
-Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
----
- libffi/src/mips/n32.S | 17 +++++++++++++++++
- libffi/src/mips/o32.S | 17 +++++++++++++++++
- 2 files changed, 34 insertions(+)
-
---- a/libffi/src/mips/n32.S
-+++ b/libffi/src/mips/n32.S
-@@ -107,6 +107,16 @@ loadregs:
-
- REG_L t6, 3*FFI_SIZEOF_ARG($fp) # load the flags word into t6.
-
-+#ifdef __mips_soft_float
-+ REG_L a0, 0*FFI_SIZEOF_ARG(t9)
-+ REG_L a1, 1*FFI_SIZEOF_ARG(t9)
-+ REG_L a2, 2*FFI_SIZEOF_ARG(t9)
-+ REG_L a3, 3*FFI_SIZEOF_ARG(t9)
-+ REG_L a4, 4*FFI_SIZEOF_ARG(t9)
-+ REG_L a5, 5*FFI_SIZEOF_ARG(t9)
-+ REG_L a6, 6*FFI_SIZEOF_ARG(t9)
-+ REG_L a7, 7*FFI_SIZEOF_ARG(t9)
-+#else
- and t4, t6, ((1<<FFI_FLAG_BITS)-1)
- REG_L a0, 0*FFI_SIZEOF_ARG(t9)
- beqz t4, arg1_next
-@@ -193,6 +203,7 @@ arg7_next:
- arg8_doublep:
- l.d $f19, 7*FFI_SIZEOF_ARG(t9)
- arg8_next:
-+#endif
-
- callit:
- # Load the function pointer
-@@ -214,6 +225,7 @@ retint:
- b epilogue
-
- retfloat:
-+#ifndef __mips_soft_float
- bne t6, FFI_TYPE_FLOAT, retdouble
- jal t9
- REG_L t4, 4*FFI_SIZEOF_ARG($fp)
-@@ -272,6 +284,7 @@ retstruct_f_d:
- s.s $f0, 0(t4)
- s.d $f2, 8(t4)
- b epilogue
-+#endif
-
- retstruct_d_soft:
- bne t6, FFI_TYPE_STRUCT_D_SOFT, retstruct_f_soft
-@@ -429,6 +442,7 @@ ffi_closure_N32:
- REG_S a6, A6_OFF2($sp)
- REG_S a7, A7_OFF2($sp)
-
-+#ifndef __mips_soft_float
- # Store all possible float/double registers.
- s.d $f12, F12_OFF2($sp)
- s.d $f13, F13_OFF2($sp)
-@@ -438,6 +452,7 @@ ffi_closure_N32:
- s.d $f17, F17_OFF2($sp)
- s.d $f18, F18_OFF2($sp)
- s.d $f19, F19_OFF2($sp)
-+#endif
-
- # Call ffi_closure_mips_inner_N32 to do the real work.
- LA t9, ffi_closure_mips_inner_N32
-@@ -458,6 +473,7 @@ cls_retint:
- b cls_epilogue
-
- cls_retfloat:
-+#ifndef __mips_soft_float
- bne v0, FFI_TYPE_FLOAT, cls_retdouble
- l.s $f0, V0_OFF2($sp)
- b cls_epilogue
-@@ -500,6 +516,7 @@ cls_retstruct_f_d:
- l.s $f0, V0_OFF2($sp)
- l.d $f2, V1_OFF2($sp)
- b cls_epilogue
-+#endif
-
- cls_retstruct_small2:
- REG_L v0, V0_OFF2($sp)
---- a/libffi/src/mips/o32.S
-+++ b/libffi/src/mips/o32.S
-@@ -82,13 +82,16 @@ sixteen:
-
- ADDU $sp, 4 * FFI_SIZEOF_ARG # adjust $sp to new args
-
-+#ifndef __mips_soft_float
- bnez t0, pass_d # make it quick for int
-+#endif
- REG_L a0, 0*FFI_SIZEOF_ARG($sp) # just go ahead and load the
- REG_L a1, 1*FFI_SIZEOF_ARG($sp) # four regs.
- REG_L a2, 2*FFI_SIZEOF_ARG($sp)
- REG_L a3, 3*FFI_SIZEOF_ARG($sp)
- b call_it
-
-+#ifndef __mips_soft_float
- pass_d:
- bne t0, FFI_ARGS_D, pass_f
- l.d $f12, 0*FFI_SIZEOF_ARG($sp) # load $fp regs from args
-@@ -130,6 +133,7 @@ pass_f_d:
- # bne t0, FFI_ARGS_F_D, call_it
- l.s $f12, 0*FFI_SIZEOF_ARG($sp) # load $fp regs from args
- l.d $f14, 2*FFI_SIZEOF_ARG($sp) # passing double and float
-+#endif
-
- call_it:
- # Load the function pointer
-@@ -158,14 +162,23 @@ retfloat:
- bne t2, FFI_TYPE_FLOAT, retdouble
- jalr t9
- REG_L t0, SIZEOF_FRAME + 4*FFI_SIZEOF_ARG($fp)
-+#ifndef __mips_soft_float
- s.s $f0, 0(t0)
-+#else
-+ REG_S v0, 0(t0)
-+#endif
- b epilogue
-
- retdouble:
- bne t2, FFI_TYPE_DOUBLE, noretval
- jalr t9
- REG_L t0, SIZEOF_FRAME + 4*FFI_SIZEOF_ARG($fp)
-+#ifndef __mips_soft_float
- s.d $f0, 0(t0)
-+#else
-+ REG_S v1, 4(t0)
-+ REG_S v0, 0(t0)
-+#endif
- b epilogue
-
- noretval:
-@@ -261,9 +274,11 @@ $LCFI7:
- li $13, 1 # FFI_O32
- bne $16, $13, 1f # Skip fp save if FFI_O32_SOFT_FLOAT
-
-+#ifndef __mips_soft_float
- # Store all possible float/double registers.
- s.d $f12, FA_0_0_OFF2($fp)
- s.d $f14, FA_1_0_OFF2($fp)
-+#endif
- 1:
- # Call ffi_closure_mips_inner_O32 to do the work.
- la t9, ffi_closure_mips_inner_O32
-@@ -281,6 +296,7 @@ $LCFI7:
- li $13, 1 # FFI_O32
- bne $16, $13, 1f # Skip fp restore if FFI_O32_SOFT_FLOAT
-
-+#ifndef __mips_soft_float
- li $9, FFI_TYPE_FLOAT
- l.s $f0, V0_OFF2($fp)
- beq $8, $9, closure_done
-@@ -288,6 +304,7 @@ $LCFI7:
- li $9, FFI_TYPE_DOUBLE
- l.d $f0, V0_OFF2($fp)
- beq $8, $9, closure_done
-+#endif
- 1:
- REG_L $3, V1_OFF2($fp)
- REG_L $2, V0_OFF2($fp)
+++ /dev/null
-From dda6b050cd74a352670787a294596a9c56c21327 Mon Sep 17 00:00:00 2001
-From: Yousong Zhou <yszhou4tech@gmail.com>
-Date: Fri, 4 May 2018 18:20:53 +0800
-Subject: [PATCH] gotools: fix compilation when making cross compiler
-
-libgo is "the runtime support library for the Go programming language.
-This library is intended for use with the Go frontend."
-
-gccgo will link target files with libgo.so which depends on libgcc_s.so.1, but
-the linker will complain that it cannot find it. That's because shared libgcc
-is not present in the install directory yet. libgo.so was made without problem
-because gcc will emit -lgcc_s when compiled with -shared option. When gotools
-were being made, it was supplied with -static-libgcc thus no link option was
-provided. Check LIBGO in gcc/go/gcc-spec.c for how gccgo make a builtin spec
-for linking with libgo.so
-
-- GccgoCrossCompilation, https://github.com/golang/go/wiki/GccgoCrossCompilation
-- Cross-building instructions, http://www.eglibc.org/archives/patches/msg00078.html
-
-When 3-pass GCC compilation is used, shared libgcc runtime libraries will be
-available after gcc pass2 completed and will meet the gotools link requirement
-at gcc pass3
----
- gotools/Makefile.am | 4 +++-
- gotools/Makefile.in | 4 +++-
- 2 files changed, 6 insertions(+), 2 deletions(-)
-
---- a/gotools/Makefile.am
-+++ b/gotools/Makefile.am
-@@ -26,6 +26,7 @@ PWD_COMMAND = $${PWDCMD-pwd}
- STAMP = echo timestamp >
-
- libgodir = ../$(target_noncanonical)/libgo
-+libgccdir = ../$(target_noncanonical)/libgcc
- LIBGODEP = $(libgodir)/libgo.la
-
- LIBGOTOOL = $(libgodir)/libgotool.a
-@@ -41,7 +42,8 @@ GOCFLAGS = $(CFLAGS_FOR_TARGET)
- GOCOMPILE = $(GOCOMPILER) $(GOCFLAGS)
-
- AM_GOCFLAGS = -I $(libgodir)
--AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs
-+AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs \
-+ -L $(libgccdir) -L $(libgccdir)/.libs -lgcc_s
- GOLINK = $(GOCOMPILER) $(GOCFLAGS) $(AM_GOCFLAGS) $(LDFLAGS) $(AM_LDFLAGS) -o $@
-
- libgosrcdir = $(srcdir)/../libgo/go
---- a/gotools/Makefile.in
-+++ b/gotools/Makefile.in
-@@ -337,6 +337,7 @@ mkinstalldirs = $(SHELL) $(toplevel_srcd
- PWD_COMMAND = $${PWDCMD-pwd}
- STAMP = echo timestamp >
- libgodir = ../$(target_noncanonical)/libgo
-+libgccdir = ../$(target_noncanonical)/libgcc
- LIBGODEP = $(libgodir)/libgo.la
- LIBGOTOOL = $(libgodir)/libgotool.a
- @NATIVE_FALSE@GOCOMPILER = $(GOC)
-@@ -346,7 +347,8 @@ LIBGOTOOL = $(libgodir)/libgotool.a
- GOCFLAGS = $(CFLAGS_FOR_TARGET)
- GOCOMPILE = $(GOCOMPILER) $(GOCFLAGS)
- AM_GOCFLAGS = -I $(libgodir)
--AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs
-+AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs \
-+ -L $(libgccdir) -L $(libgccdir)/.libs -lgcc_s
- GOLINK = $(GOCOMPILER) $(GOCFLAGS) $(AM_GOCFLAGS) $(LDFLAGS) $(AM_LDFLAGS) -o $@
- libgosrcdir = $(srcdir)/../libgo/go
- cmdsrcdir = $(libgosrcdir)/cmd
+++ /dev/null
-commit 81cc26c706b2bc8c8c1eb1a322e5c5157900836e
-Author: Felix Fietkau <nbd@openwrt.org>
-Date: Sun Oct 19 21:45:51 2014 +0000
-
- gcc: do not assume that the Mac OS X filesystem is case insensitive
-
- Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-
- SVN-Revision: 42973
-
---- a/include/filenames.h
-+++ b/include/filenames.h
-@@ -44,11 +44,6 @@ extern "C" {
- # define IS_DIR_SEPARATOR(c) IS_DOS_DIR_SEPARATOR (c)
- # define IS_ABSOLUTE_PATH(f) IS_DOS_ABSOLUTE_PATH (f)
- #else /* not DOSish */
--# if defined(__APPLE__)
--# ifndef HAVE_CASE_INSENSITIVE_FILE_SYSTEM
--# define HAVE_CASE_INSENSITIVE_FILE_SYSTEM 1
--# endif
--# endif /* __APPLE__ */
- # define HAS_DRIVE_SPEC(f) (0)
- # define IS_DIR_SEPARATOR(c) IS_UNIX_DIR_SEPARATOR (c)
- # define IS_ABSOLUTE_PATH(f) IS_UNIX_ABSOLUTE_PATH (f)
+++ /dev/null
---- a/gcc/real.h
-+++ b/gcc/real.h
-@@ -77,8 +77,10 @@ struct GTY(()) real_value {
- + (REAL_VALUE_TYPE_SIZE%HOST_BITS_PER_WIDE_INT ? 1 : 0)) /* round up */
-
- /* Verify the guess. */
-+#ifndef __LP64__
- extern char test_real_width
- [sizeof (REAL_VALUE_TYPE) <= REAL_WIDTH * sizeof (HOST_WIDE_INT) ? 1 : -1];
-+#endif
-
- /* Calculate the format for CONST_DOUBLE. We need as many slots as
- are necessary to overlay a REAL_VALUE_TYPE on them. This could be
+++ /dev/null
-commit 098bd91f5eae625c7d2ee621e10930fc4434e5e2
-Author: Luka Perkov <luka@openwrt.org>
-Date: Tue Feb 26 16:16:33 2013 +0000
-
- gcc: don't build documentation
-
- This closes #13039.
-
- Signed-off-by: Luka Perkov <luka@openwrt.org>
-
- SVN-Revision: 35807
-
---- a/gcc/Makefile.in
-+++ b/gcc/Makefile.in
-@@ -3348,18 +3348,10 @@ doc/gcc.info: $(TEXI_GCC_FILES)
- doc/gccint.info: $(TEXI_GCCINT_FILES)
- doc/cppinternals.info: $(TEXI_CPPINT_FILES)
-
--doc/%.info: %.texi
-- if [ x$(BUILD_INFO) = xinfo ]; then \
-- $(MAKEINFO) $(MAKEINFOFLAGS) -I . -I $(gcc_docdir) \
-- -I $(gcc_docdir)/include -o $@ $<; \
-- fi
-+doc/%.info:
-
- # Duplicate entry to handle renaming of gccinstall.info
--doc/gccinstall.info: $(TEXI_GCCINSTALL_FILES)
-- if [ x$(BUILD_INFO) = xinfo ]; then \
-- $(MAKEINFO) $(MAKEINFOFLAGS) -I $(gcc_docdir) \
-- -I $(gcc_docdir)/include -o $@ $<; \
-- fi
-+doc/gccinstall.info:
-
- doc/cpp.dvi: $(TEXI_CPP_FILES)
- doc/gcc.dvi: $(TEXI_GCC_FILES)
+++ /dev/null
-From ea650cae26da4a8fc04f0c4666f4dd776d0b5fc0 Mon Sep 17 00:00:00 2001
-From: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
-Date: Sun, 14 Nov 2021 21:54:25 -0800
-Subject: [PATCH] configure: define TARGET_LIBC_GNUSTACK on musl
-
-musl only uses PT_GNU_STACK to set default thread stack size and has no
-executable stack support[0], so there is no reason not to emit the
-.note.GNU-stack section on musl builds.
-
-[0]: https://lore.kernel.org/all/20190423192534.GN23599@brightrain.aerifal.cx/T/#u
-
-gcc/ChangeLog:
-
- * configure: Regenerate.
- * configure.ac: define TARGET_LIBC_GNUSTACK on musl
-
-Signed-off-by: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
----
- gcc/configure | 3 +++
- gcc/configure.ac | 3 +++
- 2 files changed, 6 insertions(+)
-
---- a/gcc/configure
-+++ b/gcc/configure
-@@ -31533,6 +31533,9 @@ fi
- # Check if the target LIBC handles PT_GNU_STACK.
- gcc_cv_libc_gnustack=unknown
- case "$target" in
-+ mips*-*-linux-musl*)
-+ gcc_cv_libc_gnustack=yes
-+ ;;
- mips*-*-linux*)
-
- if test $glibc_version_major -gt 2 \
---- a/gcc/configure.ac
-+++ b/gcc/configure.ac
-@@ -7023,6 +7023,9 @@ fi
- # Check if the target LIBC handles PT_GNU_STACK.
- gcc_cv_libc_gnustack=unknown
- case "$target" in
-+ mips*-*-linux-musl*)
-+ gcc_cv_libc_gnustack=yes
-+ ;;
- mips*-*-linux*)
- GCC_GLIBC_VERSION_GTE_IFELSE([2], [31], [gcc_cv_libc_gnustack=yes], )
- ;;
+++ /dev/null
-Fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84790.
-MIPS16 functions have a static assembler prologue which clobbers
-registers v0 and v1. Add these register clobbers to function call
-instructions.
-
---- a/gcc/config/mips/mips.c
-+++ b/gcc/config/mips/mips.c
-@@ -3132,6 +3132,12 @@ mips_emit_call_insn (rtx pattern, rtx or
- emit_insn (gen_update_got_version ());
- }
-
-+ if (TARGET_MIPS16 && TARGET_USE_GOT)
-+ {
-+ clobber_reg (&CALL_INSN_FUNCTION_USAGE (insn), MIPS16_PIC_TEMP);
-+ clobber_reg (&CALL_INSN_FUNCTION_USAGE (insn), MIPS_PROLOGUE_TEMP (word_mode));
-+ }
-+
- if (TARGET_MIPS16
- && TARGET_EXPLICIT_RELOCS
- && TARGET_CALL_CLOBBERED_GP)
+++ /dev/null
---- a/gcc/gcc.c
-+++ b/gcc/gcc.c
-@@ -978,7 +978,9 @@ proper position among the other output f
- #endif
-
- #ifndef LINK_SSP_SPEC
--#ifdef TARGET_LIBC_PROVIDES_SSP
-+#if DEFAULT_LIBC == LIBC_MUSL
-+#define LINK_SSP_SPEC "-lssp_nonshared"
-+#elif defined(TARGET_LIBC_PROVIDES_SSP)
- #define LINK_SSP_SPEC "%{fstack-protector|fstack-protector-all" \
- "|fstack-protector-strong|fstack-protector-explicit:}"
- #else
+++ /dev/null
-commit ecf7671b769fe96f7b5134be442089f8bdba55d2
-Author: Felix Fietkau <nbd@nbd.name>
-Date: Thu Aug 4 20:29:45 2016 +0200
-
-gcc: add a patch to generate better code with Os on mips
-
-Also happens to reduce compressed code size a bit
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
-
---- a/gcc/config/mips/mips.c
-+++ b/gcc/config/mips/mips.c
-@@ -20041,7 +20041,7 @@ mips_option_override (void)
- flag_pcc_struct_return = 0;
-
- /* Decide which rtx_costs structure to use. */
-- if (optimize_size)
-+ if (0 && optimize_size)
- mips_cost = &mips_rtx_cost_optimize_size;
- else
- mips_cost = &mips_rtx_cost_data[mips_tune];
+++ /dev/null
-commit 8570c4be394cff7282f332f97da2ff569a927ddb
-Author: Imre Kaloz <kaloz@openwrt.org>
-Date: Wed Feb 2 20:06:12 2011 +0000
-
- fixup arm soft-float symbols
-
- SVN-Revision: 25325
-
---- a/libgcc/config/arm/t-linux
-+++ b/libgcc/config/arm/t-linux
-@@ -1,6 +1,10 @@
- LIB1ASMSRC = arm/lib1funcs.S
- LIB1ASMFUNCS = _udivsi3 _divsi3 _umodsi3 _modsi3 _dvmd_lnx _clzsi2 _clzdi2 \
-- _ctzsi2 _arm_addsubdf3 _arm_addsubsf3
-+ _ctzsi2 _arm_addsubdf3 _arm_addsubsf3 \
-+ _arm_negdf2 _arm_muldivdf3 _arm_cmpdf2 _arm_unorddf2 \
-+ _arm_fixdfsi _arm_fixunsdfsi _arm_truncdfsf2 \
-+ _arm_negsf2 _arm_muldivsf3 _arm_cmpsf2 _arm_unordsf2 \
-+ _arm_fixsfsi _arm_fixunssfsi
-
- # Just for these, we omit the frame pointer since it makes such a big
- # difference.
---- a/gcc/config/arm/linux-elf.h
-+++ b/gcc/config/arm/linux-elf.h
-@@ -58,8 +58,6 @@
- %{shared:-lc} \
- %{!shared:%{profile:-lc_p}%{!profile:-lc}}"
-
--#define LIBGCC_SPEC "%{mfloat-abi=soft*:-lfloat} -lgcc"
--
- #define GLIBC_DYNAMIC_LINKER "/lib/ld-linux.so.2"
-
- #define LINUX_TARGET_LINK_SPEC "%{h*} \
+++ /dev/null
-commit c96312958c0621e72c9b32da5bc224ffe2161384
-Author: Felix Fietkau <nbd@openwrt.org>
-Date: Mon Oct 19 23:26:09 2009 +0000
-
- gcc: create a proper libgcc_pic.a static library for relinking (4.3.3+ for now, backport will follow)
-
- SVN-Revision: 18086
-
---- a/libgcc/Makefile.in
-+++ b/libgcc/Makefile.in
-@@ -930,11 +930,12 @@ $(libgcov-driver-objects): %$(objext): $
-
- # Static libraries.
- libgcc.a: $(libgcc-objects)
-+libgcc_pic.a: $(libgcc-s-objects)
- libgcov.a: $(libgcov-objects)
- libunwind.a: $(libunwind-objects)
- libgcc_eh.a: $(libgcc-eh-objects)
-
--libgcc.a libgcov.a libunwind.a libgcc_eh.a:
-+libgcc.a libgcov.a libunwind.a libgcc_eh.a libgcc_pic.a:
- -rm -f $@
-
- objects="$(objects)"; \
-@@ -958,7 +959,7 @@ all: libunwind.a
- endif
-
- ifeq ($(enable_shared),yes)
--all: libgcc_eh.a libgcc_s$(SHLIB_EXT)
-+all: libgcc_eh.a libgcc_pic.a libgcc_s$(SHLIB_EXT)
- ifneq ($(LIBUNWIND),)
- all: libunwind$(SHLIB_EXT)
- libgcc_s$(SHLIB_EXT): libunwind$(SHLIB_EXT)
-@@ -1164,6 +1165,10 @@ install-shared:
- chmod 644 $(DESTDIR)$(inst_libdir)/libgcc_eh.a
- $(RANLIB) $(DESTDIR)$(inst_libdir)/libgcc_eh.a
-
-+ $(INSTALL_DATA) libgcc_pic.a $(mapfile) $(DESTDIR)$(inst_libdir)/
-+ chmod 644 $(DESTDIR)$(inst_libdir)/libgcc_pic.a
-+ $(RANLIB) $(DESTDIR)$(inst_libdir)/libgcc_pic.a
-+
- $(subst @multilib_dir@,$(MULTIDIR),$(subst \
- @shlib_base_name@,libgcc_s,$(subst \
- @shlib_slibdir_qual@,$(MULTIOSSUBDIR),$(SHLIB_INSTALL))))
+++ /dev/null
-commit 7edc8ca5456d9743dd0075eb3cc5b04f4f24c8cc
-Author: Imre Kaloz <kaloz@openwrt.org>
-Date: Wed Feb 2 19:34:36 2011 +0000
-
- add armv4 fixup patches
-
- SVN-Revision: 25322
-
-
---- a/gcc/config/arm/linux-eabi.h
-+++ b/gcc/config/arm/linux-eabi.h
-@@ -91,10 +91,15 @@
- #define MUSL_DYNAMIC_LINKER \
- "/lib/ld-musl-arm" MUSL_DYNAMIC_LINKER_E "%{mfloat-abi=hard:hf}%{mfdpic:-fdpic}.so.1"
-
-+/* For armv4 we pass --fix-v4bx to linker to support EABI */
-+#undef TARGET_FIX_V4BX_SPEC
-+#define TARGET_FIX_V4BX_SPEC " %{mcpu=arm8|mcpu=arm810|mcpu=strongarm*"\
-+ "|march=armv4|mcpu=fa526|mcpu=fa626:--fix-v4bx}"
-+
- /* At this point, bpabi.h will have clobbered LINK_SPEC. We want to
- use the GNU/Linux version, not the generic BPABI version. */
- #undef LINK_SPEC
--#define LINK_SPEC EABI_LINK_SPEC \
-+#define LINK_SPEC EABI_LINK_SPEC TARGET_FIX_V4BX_SPEC \
- LINUX_OR_ANDROID_LD (LINUX_TARGET_LINK_SPEC, \
- LINUX_TARGET_LINK_SPEC " " ANDROID_LINK_SPEC)
-
+++ /dev/null
-commit dcfc40358b5a3cae7320c17f8d1cebd5ad5540cd
-Author: Felix Fietkau <nbd@openwrt.org>
-Date: Sun Feb 12 20:25:47 2012 +0000
-
- gcc 4.6: port over the missing patch 850-use_shared_libgcc.patch to prevent libgcc crap from leaking into every single binary
-
- SVN-Revision: 30486
---- a/gcc/config/arm/linux-eabi.h
-+++ b/gcc/config/arm/linux-eabi.h
-@@ -132,10 +132,6 @@
- "%{Ofast|ffast-math|funsafe-math-optimizations:crtfastmath.o%s} " \
- LINUX_OR_ANDROID_LD (GNU_USER_TARGET_ENDFILE_SPEC, ANDROID_ENDFILE_SPEC)
-
--/* Use the default LIBGCC_SPEC, not the version in linux-elf.h, as we
-- do not use -lfloat. */
--#undef LIBGCC_SPEC
--
- /* Clear the instruction cache from `beg' to `end'. This is
- implemented in lib1funcs.S, so ensure an error if this definition
- is used. */
---- a/gcc/config/linux.h
-+++ b/gcc/config/linux.h
-@@ -66,6 +66,10 @@ see the files COPYING3 and COPYING.RUNTI
- builtin_version ("CRuntime_Musl"); \
- } while (0)
-
-+#ifndef LIBGCC_SPEC
-+#define LIBGCC_SPEC "%{static|static-libgcc:-lgcc}%{!static:%{!static-libgcc:-lgcc_s}}"
-+#endif
-+
- /* Determine which dynamic linker to use depending on whether GLIBC or
- uClibc or Bionic or musl is the default C library and whether
- -muclibc or -mglibc or -mbionic or -mmusl has been passed to change
---- a/libgcc/mkmap-symver.awk
-+++ b/libgcc/mkmap-symver.awk
-@@ -136,5 +136,5 @@ function output(lib) {
- else if (inherit[lib])
- printf("} %s;\n", inherit[lib]);
- else
-- printf ("\n local:\n\t*;\n};\n");
-+ printf ("\n\t*;\n};\n");
- }
---- a/gcc/config/rs6000/linux.h
-+++ b/gcc/config/rs6000/linux.h
-@@ -62,6 +62,9 @@
- #undef CPP_OS_DEFAULT_SPEC
- #define CPP_OS_DEFAULT_SPEC "%(cpp_os_linux)"
-
-+#undef LIBGCC_SPEC
-+#define LIBGCC_SPEC "%{!static:%{!static-libgcc:-lgcc_s}} -lgcc"
-+
- #undef LINK_SHLIB_SPEC
- #define LINK_SHLIB_SPEC "%{shared:-shared} %{!shared: %{static:-static}} \
- %{static-pie:-static -pie --no-dynamic-linker -z text}"
+++ /dev/null
-commit 64661de100da1ec1061ef3e5e400285dce115e6b
-Author: Felix Fietkau <nbd@openwrt.org>
-Date: Sun May 10 13:16:35 2015 +0000
-
- gcc: add some size optimization patches
-
- Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-
- SVN-Revision: 45664
-
---- a/libgcc/config/t-libunwind
-+++ b/libgcc/config/t-libunwind
-@@ -2,8 +2,7 @@
-
- HOST_LIBGCC2_CFLAGS += -DUSE_GAS_SYMVER
-
--LIB2ADDEH = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c \
-- $(srcdir)/unwind-compat.c $(srcdir)/unwind-dw2-fde-compat.c
-+LIB2ADDEH = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c
- LIB2ADDEHSTATIC = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c
-
- # Override the default value from t-slibgcc-elf-ver and mention -lunwind
+++ /dev/null
---- a/gcc/config/rs6000/rs6000-logue.c
-+++ b/gcc/config/rs6000/rs6000-logue.c
-@@ -348,7 +348,7 @@ rs6000_savres_strategy (rs6000_stack_t *
- /* Define cutoff for using out-of-line functions to save registers. */
- if (DEFAULT_ABI == ABI_V4 || TARGET_ELF)
- {
-- if (!optimize_size)
-+ if (1)
- {
- strategy |= SAVE_INLINE_FPRS | REST_INLINE_FPRS;
- strategy |= SAVE_INLINE_GPRS | REST_INLINE_GPRS;
+++ /dev/null
---- a/libgcc/crtstuff.c
-+++ b/libgcc/crtstuff.c
-@@ -152,7 +152,7 @@ call_ ## FUNC (void) \
- #endif
-
- #if !defined(USE_TM_CLONE_REGISTRY) && defined(OBJECT_FORMAT_ELF)
--# define USE_TM_CLONE_REGISTRY 1
-+# define USE_TM_CLONE_REGISTRY 0
- #elif !defined(USE_TM_CLONE_REGISTRY)
- # define USE_TM_CLONE_REGISTRY 0
- #endif
+++ /dev/null
---- a/libgcc/config/mips/t-mips16
-+++ b/libgcc/config/mips/t-mips16
-@@ -43,3 +43,6 @@ SYNC_CFLAGS = -mno-mips16
-
- # Version these symbols if building libgcc.so.
- SHLIB_MAPFILES += $(srcdir)/config/mips/libgcc-mips16.ver
-+
-+CRTSTUFF_T_CFLAGS += -mno-mips16
-+CRTSTUFF_T_CFLAGS_S += -mno-mips16
+++ /dev/null
-commit 99368862e44740ff4fd33760893f04e14f9dbdf1
-Author: Felix Fietkau <nbd@openwrt.org>
-Date: Tue Jul 31 00:52:27 2007 +0000
-
- Port the mbsd_multi patch from freewrt, which adds -fhonour-copts. This will emit warnings in packages that don't use our target cflags properly
-
- SVN-Revision: 8256
-
- This patch brings over a feature from MirBSD:
- * -fhonour-copts
- If this option is not given, it's warned (depending
- on environment variables). This is to catch errors
- of misbuilt packages which override CFLAGS themselves.
-
- This patch was authored by Thorsten Glaser <tg at mirbsd.de>
- with copyright assignment to the FSF in effect.
-
---- a/gcc/c-family/c-opts.c
-+++ b/gcc/c-family/c-opts.c
-@@ -107,6 +107,9 @@ static dump_flags_t original_dump_flags;
- /* Whether any standard preincluded header has been preincluded. */
- static bool done_preinclude;
-
-+/* Check if a port honours COPTS. */
-+static int honour_copts = 0;
-+
- static void handle_OPT_d (const char *);
- static void set_std_cxx98 (int);
- static void set_std_cxx11 (int);
-@@ -469,6 +472,12 @@ c_common_handle_option (size_t scode, co
- flag_no_builtin = !value;
- break;
-
-+ case OPT_fhonour_copts:
-+ if (c_language == clk_c) {
-+ honour_copts++;
-+ }
-+ break;
-+
- case OPT_fconstant_string_class_:
- constant_string_class_name = arg;
- break;
-@@ -1198,6 +1207,47 @@ c_common_init (void)
- return false;
- }
-
-+ if (c_language == clk_c) {
-+ char *ev = getenv ("GCC_HONOUR_COPTS");
-+ int evv;
-+ if (ev == NULL)
-+ evv = -1;
-+ else if ((*ev == '0') || (*ev == '\0'))
-+ evv = 0;
-+ else if (*ev == '1')
-+ evv = 1;
-+ else if (*ev == '2')
-+ evv = 2;
-+ else if (*ev == 's')
-+ evv = -1;
-+ else {
-+ warning (0, "unknown GCC_HONOUR_COPTS value, assuming 1");
-+ evv = 1; /* maybe depend this on something like MIRBSD_NATIVE? */
-+ }
-+ if (evv == 1) {
-+ if (honour_copts == 0) {
-+ error ("someone does not honour COPTS at all in lenient mode");
-+ return false;
-+ } else if (honour_copts != 1) {
-+ warning (0, "someone does not honour COPTS correctly, passed %d times",
-+ honour_copts);
-+ }
-+ } else if (evv == 2) {
-+ if (honour_copts == 0) {
-+ error ("someone does not honour COPTS at all in strict mode");
-+ return false;
-+ } else if (honour_copts != 1) {
-+ error ("someone does not honour COPTS correctly, passed %d times",
-+ honour_copts);
-+ return false;
-+ }
-+ } else if (evv == 0) {
-+ if (honour_copts != 1)
-+ inform (UNKNOWN_LOCATION, "someone does not honour COPTS correctly, passed %d times",
-+ honour_copts);
-+ }
-+ }
-+
- return true;
- }
-
---- a/gcc/c-family/c.opt
-+++ b/gcc/c-family/c.opt
-@@ -1663,6 +1663,9 @@ C++ ObjC++ Optimization Alias(fexception
- fhonor-std
- C++ ObjC++ WarnRemoved
-
-+fhonour-copts
-+C ObjC C++ ObjC++ RejectNegative
-+
- fhosted
- C ObjC
- Assume normal C execution environment.
---- a/gcc/common.opt
-+++ b/gcc/common.opt
-@@ -1698,6 +1698,9 @@ fguess-branch-probability
- Common Var(flag_guess_branch_prob) Optimization
- Enable guessing of branch probabilities.
-
-+fhonour-copts
-+Common RejectNegative
-+
- ; Nonzero means ignore `#ident' directives. 0 means handle them.
- ; Generate position-independent code for executables if possible
- ; On SVR4 targets, it also controls whether or not to emit a
---- a/gcc/doc/invoke.texi
-+++ b/gcc/doc/invoke.texi
-@@ -9058,6 +9058,17 @@ This option is only supported for C and
- @option{-Wall} and by @option{-Wpedantic}, which can be disabled with
- @option{-Wno-pointer-sign}.
-
-+@item -fhonour-copts
-+@opindex fhonour-copts
-+If @env{GCC_HONOUR_COPTS} is set to 1, abort if this option is not
-+given at least once, and warn if it is given more than once.
-+If @env{GCC_HONOUR_COPTS} is set to 2, abort if this option is not
-+given exactly once.
-+If @env{GCC_HONOUR_COPTS} is set to 0 or unset, warn if this option
-+is not given exactly once.
-+The warning is quelled if @env{GCC_HONOUR_COPTS} is set to @samp{s}.
-+This flag and environment variable only affect the C language.
-+
- @item -Wstack-protector
- @opindex Wstack-protector
- @opindex Wno-stack-protector
---- a/gcc/opts.c
-+++ b/gcc/opts.c
-@@ -2448,6 +2448,9 @@ common_handle_option (struct gcc_options
- /* Currently handled in a prescan. */
- break;
-
-+ case OPT_fhonour_copts:
-+ break;
-+
- case OPT_Werror:
- dc->warning_as_error_requested = value;
- break;
+++ /dev/null
-Author: Jo-Philipp Wich <jow@openwrt.org>
-Date: Sat Apr 21 03:02:39 2012 +0000
-
- gcc: add patch to make the getenv() spec function nonfatal if requested environment variable is unset
-
- SVN-Revision: 31390
-
---- a/gcc/gcc.c
-+++ b/gcc/gcc.c
-@@ -10106,8 +10106,10 @@ getenv_spec_function (int argc, const ch
- }
-
- if (!value)
-- fatal_error (input_location,
-- "environment variable %qs not defined", varname);
-+ {
-+ warning (input_location, "environment variable %qs not defined", varname);
-+ value = "";
-+ }
-
- /* We have to escape every character of the environment variable so
- they are not interpreted as active spec characters. A
+++ /dev/null
-From c0c62fa4256f805389f16ebfc4a60cf789129b50 Mon Sep 17 00:00:00 2001
-From: BangLang Huang <banglang.huang@foxmail.com>
-Date: Wed, 9 Nov 2016 10:36:49 +0800
-Subject: [PATCH] libffi: fix MIPS softfloat build issue
-
-Backported from github.com/libffi/libffi#272
-
-Signed-off-by: BangLang Huang <banglang.huang@foxmail.com>
-Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
----
- libffi/src/mips/n32.S | 17 +++++++++++++++++
- libffi/src/mips/o32.S | 17 +++++++++++++++++
- 2 files changed, 34 insertions(+)
-
---- a/libffi/src/mips/n32.S
-+++ b/libffi/src/mips/n32.S
-@@ -107,6 +107,16 @@ loadregs:
-
- REG_L t6, 3*FFI_SIZEOF_ARG($fp) # load the flags word into t6.
-
-+#ifdef __mips_soft_float
-+ REG_L a0, 0*FFI_SIZEOF_ARG(t9)
-+ REG_L a1, 1*FFI_SIZEOF_ARG(t9)
-+ REG_L a2, 2*FFI_SIZEOF_ARG(t9)
-+ REG_L a3, 3*FFI_SIZEOF_ARG(t9)
-+ REG_L a4, 4*FFI_SIZEOF_ARG(t9)
-+ REG_L a5, 5*FFI_SIZEOF_ARG(t9)
-+ REG_L a6, 6*FFI_SIZEOF_ARG(t9)
-+ REG_L a7, 7*FFI_SIZEOF_ARG(t9)
-+#else
- and t4, t6, ((1<<FFI_FLAG_BITS)-1)
- REG_L a0, 0*FFI_SIZEOF_ARG(t9)
- beqz t4, arg1_next
-@@ -193,6 +203,7 @@ arg7_next:
- arg8_doublep:
- l.d $f19, 7*FFI_SIZEOF_ARG(t9)
- arg8_next:
-+#endif
-
- callit:
- # Load the function pointer
-@@ -214,6 +225,7 @@ retint:
- b epilogue
-
- retfloat:
-+#ifndef __mips_soft_float
- bne t6, FFI_TYPE_FLOAT, retdouble
- jal t9
- REG_L t4, 4*FFI_SIZEOF_ARG($fp)
-@@ -272,6 +284,7 @@ retstruct_f_d:
- s.s $f0, 0(t4)
- s.d $f2, 8(t4)
- b epilogue
-+#endif
-
- retstruct_d_soft:
- bne t6, FFI_TYPE_STRUCT_D_SOFT, retstruct_f_soft
-@@ -429,6 +442,7 @@ ffi_closure_N32:
- REG_S a6, A6_OFF2($sp)
- REG_S a7, A7_OFF2($sp)
-
-+#ifndef __mips_soft_float
- # Store all possible float/double registers.
- s.d $f12, F12_OFF2($sp)
- s.d $f13, F13_OFF2($sp)
-@@ -438,6 +452,7 @@ ffi_closure_N32:
- s.d $f17, F17_OFF2($sp)
- s.d $f18, F18_OFF2($sp)
- s.d $f19, F19_OFF2($sp)
-+#endif
-
- # Call ffi_closure_mips_inner_N32 to do the real work.
- LA t9, ffi_closure_mips_inner_N32
-@@ -458,6 +473,7 @@ cls_retint:
- b cls_epilogue
-
- cls_retfloat:
-+#ifndef __mips_soft_float
- bne v0, FFI_TYPE_FLOAT, cls_retdouble
- l.s $f0, V0_OFF2($sp)
- b cls_epilogue
-@@ -500,6 +516,7 @@ cls_retstruct_f_d:
- l.s $f0, V0_OFF2($sp)
- l.d $f2, V1_OFF2($sp)
- b cls_epilogue
-+#endif
-
- cls_retstruct_small2:
- REG_L v0, V0_OFF2($sp)
---- a/libffi/src/mips/o32.S
-+++ b/libffi/src/mips/o32.S
-@@ -82,13 +82,16 @@ sixteen:
-
- ADDU $sp, 4 * FFI_SIZEOF_ARG # adjust $sp to new args
-
-+#ifndef __mips_soft_float
- bnez t0, pass_d # make it quick for int
-+#endif
- REG_L a0, 0*FFI_SIZEOF_ARG($sp) # just go ahead and load the
- REG_L a1, 1*FFI_SIZEOF_ARG($sp) # four regs.
- REG_L a2, 2*FFI_SIZEOF_ARG($sp)
- REG_L a3, 3*FFI_SIZEOF_ARG($sp)
- b call_it
-
-+#ifndef __mips_soft_float
- pass_d:
- bne t0, FFI_ARGS_D, pass_f
- l.d $f12, 0*FFI_SIZEOF_ARG($sp) # load $fp regs from args
-@@ -130,6 +133,7 @@ pass_f_d:
- # bne t0, FFI_ARGS_F_D, call_it
- l.s $f12, 0*FFI_SIZEOF_ARG($sp) # load $fp regs from args
- l.d $f14, 2*FFI_SIZEOF_ARG($sp) # passing double and float
-+#endif
-
- call_it:
- # Load the function pointer
-@@ -158,14 +162,23 @@ retfloat:
- bne t2, FFI_TYPE_FLOAT, retdouble
- jalr t9
- REG_L t0, SIZEOF_FRAME + 4*FFI_SIZEOF_ARG($fp)
-+#ifndef __mips_soft_float
- s.s $f0, 0(t0)
-+#else
-+ REG_S v0, 0(t0)
-+#endif
- b epilogue
-
- retdouble:
- bne t2, FFI_TYPE_DOUBLE, noretval
- jalr t9
- REG_L t0, SIZEOF_FRAME + 4*FFI_SIZEOF_ARG($fp)
-+#ifndef __mips_soft_float
- s.d $f0, 0(t0)
-+#else
-+ REG_S v1, 4(t0)
-+ REG_S v0, 0(t0)
-+#endif
- b epilogue
-
- noretval:
-@@ -261,9 +274,11 @@ $LCFI7:
- li $13, 1 # FFI_O32
- bne $16, $13, 1f # Skip fp save if FFI_O32_SOFT_FLOAT
-
-+#ifndef __mips_soft_float
- # Store all possible float/double registers.
- s.d $f12, FA_0_0_OFF2($fp)
- s.d $f14, FA_1_0_OFF2($fp)
-+#endif
- 1:
- # Call ffi_closure_mips_inner_O32 to do the work.
- la t9, ffi_closure_mips_inner_O32
-@@ -281,6 +296,7 @@ $LCFI7:
- li $13, 1 # FFI_O32
- bne $16, $13, 1f # Skip fp restore if FFI_O32_SOFT_FLOAT
-
-+#ifndef __mips_soft_float
- li $9, FFI_TYPE_FLOAT
- l.s $f0, V0_OFF2($fp)
- beq $8, $9, closure_done
-@@ -288,6 +304,7 @@ $LCFI7:
- li $9, FFI_TYPE_DOUBLE
- l.d $f0, V0_OFF2($fp)
- beq $8, $9, closure_done
-+#endif
- 1:
- REG_L $3, V1_OFF2($fp)
- REG_L $2, V0_OFF2($fp)
+++ /dev/null
-From dda6b050cd74a352670787a294596a9c56c21327 Mon Sep 17 00:00:00 2001
-From: Yousong Zhou <yszhou4tech@gmail.com>
-Date: Fri, 4 May 2018 18:20:53 +0800
-Subject: [PATCH] gotools: fix compilation when making cross compiler
-
-libgo is "the runtime support library for the Go programming language.
-This library is intended for use with the Go frontend."
-
-gccgo will link target files with libgo.so which depends on libgcc_s.so.1, but
-the linker will complain that it cannot find it. That's because shared libgcc
-is not present in the install directory yet. libgo.so was made without problem
-because gcc will emit -lgcc_s when compiled with -shared option. When gotools
-were being made, it was supplied with -static-libgcc thus no link option was
-provided. Check LIBGO in gcc/go/gcc-spec.c for how gccgo make a builtin spec
-for linking with libgo.so
-
-- GccgoCrossCompilation, https://github.com/golang/go/wiki/GccgoCrossCompilation
-- Cross-building instructions, http://www.eglibc.org/archives/patches/msg00078.html
-
-When 3-pass GCC compilation is used, shared libgcc runtime libraries will be
-available after gcc pass2 completed and will meet the gotools link requirement
-at gcc pass3
----
- gotools/Makefile.am | 4 +++-
- gotools/Makefile.in | 4 +++-
- 2 files changed, 6 insertions(+), 2 deletions(-)
-
---- a/gotools/Makefile.am
-+++ b/gotools/Makefile.am
-@@ -26,6 +26,7 @@ PWD_COMMAND = $${PWDCMD-pwd}
- STAMP = echo timestamp >
-
- libgodir = ../$(target_noncanonical)/libgo
-+libgccdir = ../$(target_noncanonical)/libgcc
- LIBGODEP = $(libgodir)/libgo.la
-
- LIBGOTOOL = $(libgodir)/libgotool.a
-@@ -41,7 +42,8 @@ GOCFLAGS = $(CFLAGS_FOR_TARGET)
- GOCOMPILE = $(GOCOMPILER) $(GOCFLAGS)
-
- AM_GOCFLAGS = -I $(libgodir)
--AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs
-+AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs \
-+ -L $(libgccdir) -L $(libgccdir)/.libs -lgcc_s
- GOLINK = $(GOCOMPILER) $(GOCFLAGS) $(AM_GOCFLAGS) $(LDFLAGS) $(AM_LDFLAGS) -o $@
-
- libgosrcdir = $(srcdir)/../libgo/go
---- a/gotools/Makefile.in
-+++ b/gotools/Makefile.in
-@@ -337,6 +337,7 @@ mkinstalldirs = $(SHELL) $(toplevel_srcd
- PWD_COMMAND = $${PWDCMD-pwd}
- STAMP = echo timestamp >
- libgodir = ../$(target_noncanonical)/libgo
-+libgccdir = ../$(target_noncanonical)/libgcc
- LIBGODEP = $(libgodir)/libgo.la
- LIBGOTOOL = $(libgodir)/libgotool.a
- @NATIVE_FALSE@GOCOMPILER = $(GOC)
-@@ -346,7 +347,8 @@ LIBGOTOOL = $(libgodir)/libgotool.a
- GOCFLAGS = $(CFLAGS_FOR_TARGET)
- GOCOMPILE = $(GOCOMPILER) $(GOCFLAGS)
- AM_GOCFLAGS = -I $(libgodir)
--AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs
-+AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs \
-+ -L $(libgccdir) -L $(libgccdir)/.libs -lgcc_s
- GOLINK = $(GOCOMPILER) $(GOCFLAGS) $(AM_GOCFLAGS) $(LDFLAGS) $(AM_LDFLAGS) -o $@
- libgosrcdir = $(srcdir)/../libgo/go
- cmdsrcdir = $(libgosrcdir)/cmd
+++ /dev/null
-commit 9c6e71079b46ad5433165feaa2001450f2017b56
-Author: Przemysław Buczkowski <prem@prem.moe>
-Date: Mon Aug 16 13:16:21 2021 +0100
-
- GCC: Patch for Apple Silicon compatibility
-
- This patch fixes a linker error occuring when compiling
- the cross-compiler on macOS and ARM64 architecture.
-
- Adapted from:
- https://github.com/richfelker/musl-cross-make/issues/116#issuecomment-823612404
-
- Change-Id: Ia3ee98a163bbb62689f42e2da83a5ef36beb0913
- Reviewed-on: https://review.haiku-os.org/c/buildtools/+/4329
- Reviewed-by: John Scipione <jscipione@gmail.com>
- Reviewed-by: Adrien Destugues <pulkomandy@gmail.com>
-
---- a/gcc/config/aarch64/aarch64.h
-+++ b/gcc/config/aarch64/aarch64.h
-@@ -1236,7 +1236,7 @@ extern const char *aarch64_rewrite_mcpu
- #define MCPU_TO_MARCH_SPEC_FUNCTIONS \
- { "rewrite_mcpu", aarch64_rewrite_mcpu },
-
--#if defined(__aarch64__)
-+#if defined(__aarch64__) && ! defined(__APPLE__)
- extern const char *host_detect_local_cpu (int argc, const char **argv);
- #define HAVE_LOCAL_CPU_DETECT
- # define EXTRA_SPEC_FUNCTIONS \
---- a/gcc/config/host-darwin.c
-+++ b/gcc/config/host-darwin.c
-@@ -22,6 +22,8 @@
- #include "coretypes.h"
- #include "diagnostic-core.h"
- #include "config/host-darwin.h"
-+#include "hosthooks.h"
-+#include "hosthooks-def.h"
-
- /* Yes, this is really supposed to work. */
- /* This allows for a pagesize of 16384, which we have on Darwin20, but should
-@@ -79,3 +81,5 @@ darwin_gt_pch_use_address (void *addr, s
-
- return ret;
- }
-+
-+const struct host_hooks host_hooks = HOST_HOOKS_INITIALIZER;
+++ /dev/null
-commit 81cc26c706b2bc8c8c1eb1a322e5c5157900836e
-Author: Felix Fietkau <nbd@openwrt.org>
-Date: Sun Oct 19 21:45:51 2014 +0000
-
- gcc: do not assume that the Mac OS X filesystem is case insensitive
-
- Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-
- SVN-Revision: 42973
-
---- a/include/filenames.h
-+++ b/include/filenames.h
-@@ -44,11 +44,6 @@ extern "C" {
- # define IS_DIR_SEPARATOR(c) IS_DOS_DIR_SEPARATOR (c)
- # define IS_ABSOLUTE_PATH(f) IS_DOS_ABSOLUTE_PATH (f)
- #else /* not DOSish */
--# if defined(__APPLE__)
--# ifndef HAVE_CASE_INSENSITIVE_FILE_SYSTEM
--# define HAVE_CASE_INSENSITIVE_FILE_SYSTEM 1
--# endif
--# endif /* __APPLE__ */
- # define HAS_DRIVE_SPEC(f) (0)
- # define IS_DIR_SEPARATOR(c) IS_UNIX_DIR_SEPARATOR (c)
- # define IS_ABSOLUTE_PATH(f) IS_UNIX_ABSOLUTE_PATH (f)
+++ /dev/null
---- a/gcc/real.h
-+++ b/gcc/real.h
-@@ -77,8 +77,10 @@ struct GTY(()) real_value {
- + (REAL_VALUE_TYPE_SIZE%HOST_BITS_PER_WIDE_INT ? 1 : 0)) /* round up */
-
- /* Verify the guess. */
-+#ifndef __LP64__
- extern char test_real_width
- [sizeof (REAL_VALUE_TYPE) <= REAL_WIDTH * sizeof (HOST_WIDE_INT) ? 1 : -1];
-+#endif
-
- /* Calculate the format for CONST_DOUBLE. We need as many slots as
- are necessary to overlay a REAL_VALUE_TYPE on them. This could be
+++ /dev/null
-commit 098bd91f5eae625c7d2ee621e10930fc4434e5e2
-Author: Luka Perkov <luka@openwrt.org>
-Date: Tue Feb 26 16:16:33 2013 +0000
-
- gcc: don't build documentation
-
- This closes #13039.
-
- Signed-off-by: Luka Perkov <luka@openwrt.org>
-
- SVN-Revision: 35807
-
---- a/gcc/Makefile.in
-+++ b/gcc/Makefile.in
-@@ -3366,18 +3366,10 @@ doc/gcc.info: $(TEXI_GCC_FILES)
- doc/gccint.info: $(TEXI_GCCINT_FILES)
- doc/cppinternals.info: $(TEXI_CPPINT_FILES)
-
--doc/%.info: %.texi
-- if [ x$(BUILD_INFO) = xinfo ]; then \
-- $(MAKEINFO) $(MAKEINFOFLAGS) -I . -I $(gcc_docdir) \
-- -I $(gcc_docdir)/include -o $@ $<; \
-- fi
-+doc/%.info:
-
- # Duplicate entry to handle renaming of gccinstall.info
--doc/gccinstall.info: $(TEXI_GCCINSTALL_FILES)
-- if [ x$(BUILD_INFO) = xinfo ]; then \
-- $(MAKEINFO) $(MAKEINFOFLAGS) -I $(gcc_docdir) \
-- -I $(gcc_docdir)/include -o $@ $<; \
-- fi
-+doc/gccinstall.info:
-
- doc/cpp.dvi: $(TEXI_CPP_FILES)
- doc/gcc.dvi: $(TEXI_GCC_FILES)
+++ /dev/null
-Fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84790.
-MIPS16 functions have a static assembler prologue which clobbers
-registers v0 and v1. Add these register clobbers to function call
-instructions.
-
---- a/gcc/config/mips/mips.cc
-+++ b/gcc/config/mips/mips.cc
-@@ -3134,6 +3134,12 @@ mips_emit_call_insn (rtx pattern, rtx or
- emit_insn (gen_update_got_version ());
- }
-
-+ if (TARGET_MIPS16 && TARGET_USE_GOT)
-+ {
-+ clobber_reg (&CALL_INSN_FUNCTION_USAGE (insn), MIPS16_PIC_TEMP);
-+ clobber_reg (&CALL_INSN_FUNCTION_USAGE (insn), MIPS_PROLOGUE_TEMP (word_mode));
-+ }
-+
- if (TARGET_MIPS16
- && TARGET_EXPLICIT_RELOCS
- && TARGET_CALL_CLOBBERED_GP)
+++ /dev/null
---- a/gcc/gcc.cc
-+++ b/gcc/gcc.cc
-@@ -987,7 +987,9 @@ proper position among the other output f
- #endif
-
- #ifndef LINK_SSP_SPEC
--#ifdef TARGET_LIBC_PROVIDES_SSP
-+#if DEFAULT_LIBC == LIBC_MUSL
-+#define LINK_SSP_SPEC "-lssp_nonshared"
-+#elif defined(TARGET_LIBC_PROVIDES_SSP)
- #define LINK_SSP_SPEC "%{fstack-protector|fstack-protector-all" \
- "|fstack-protector-strong|fstack-protector-explicit:}"
- #else
+++ /dev/null
-commit ecf7671b769fe96f7b5134be442089f8bdba55d2
-Author: Felix Fietkau <nbd@nbd.name>
-Date: Thu Aug 4 20:29:45 2016 +0200
-
-gcc: add a patch to generate better code with Os on mips
-
-Also happens to reduce compressed code size a bit
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
-
---- a/gcc/config/mips/mips.cc
-+++ b/gcc/config/mips/mips.cc
-@@ -20216,7 +20216,7 @@ mips_option_override (void)
- flag_pcc_struct_return = 0;
-
- /* Decide which rtx_costs structure to use. */
-- if (optimize_size)
-+ if (0 && optimize_size)
- mips_cost = &mips_rtx_cost_optimize_size;
- else
- mips_cost = &mips_rtx_cost_data[mips_tune];
+++ /dev/null
-commit 8570c4be394cff7282f332f97da2ff569a927ddb
-Author: Imre Kaloz <kaloz@openwrt.org>
-Date: Wed Feb 2 20:06:12 2011 +0000
-
- fixup arm soft-float symbols
-
- SVN-Revision: 25325
-
---- a/libgcc/config/arm/t-linux
-+++ b/libgcc/config/arm/t-linux
-@@ -1,6 +1,10 @@
- LIB1ASMSRC = arm/lib1funcs.S
- LIB1ASMFUNCS = _udivsi3 _divsi3 _umodsi3 _modsi3 _dvmd_lnx _clzsi2 _clzdi2 \
-- _ctzsi2 _arm_addsubdf3 _arm_addsubsf3
-+ _ctzsi2 _arm_addsubdf3 _arm_addsubsf3 \
-+ _arm_negdf2 _arm_muldivdf3 _arm_cmpdf2 _arm_unorddf2 \
-+ _arm_fixdfsi _arm_fixunsdfsi _arm_truncdfsf2 \
-+ _arm_negsf2 _arm_muldivsf3 _arm_cmpsf2 _arm_unordsf2 \
-+ _arm_fixsfsi _arm_fixunssfsi
-
- # Just for these, we omit the frame pointer since it makes such a big
- # difference.
---- a/gcc/config/arm/linux-elf.h
-+++ b/gcc/config/arm/linux-elf.h
-@@ -58,8 +58,6 @@
- %{shared:-lc} \
- %{!shared:%{profile:-lc_p}%{!profile:-lc}}"
-
--#define LIBGCC_SPEC "%{mfloat-abi=soft*:-lfloat} -lgcc"
--
- #define GLIBC_DYNAMIC_LINKER "/lib/ld-linux.so.2"
-
- #define LINUX_TARGET_LINK_SPEC "%{h*} \
+++ /dev/null
-commit c96312958c0621e72c9b32da5bc224ffe2161384
-Author: Felix Fietkau <nbd@openwrt.org>
-Date: Mon Oct 19 23:26:09 2009 +0000
-
- gcc: create a proper libgcc_pic.a static library for relinking (4.3.3+ for now, backport will follow)
-
- SVN-Revision: 18086
-
---- a/libgcc/Makefile.in
-+++ b/libgcc/Makefile.in
-@@ -930,11 +930,12 @@ $(libgcov-driver-objects): %$(objext): $
-
- # Static libraries.
- libgcc.a: $(libgcc-objects)
-+libgcc_pic.a: $(libgcc-s-objects)
- libgcov.a: $(libgcov-objects)
- libunwind.a: $(libunwind-objects)
- libgcc_eh.a: $(libgcc-eh-objects)
-
--libgcc.a libgcov.a libunwind.a libgcc_eh.a:
-+libgcc.a libgcov.a libunwind.a libgcc_eh.a libgcc_pic.a:
- -rm -f $@
-
- objects="$(objects)"; \
-@@ -958,7 +959,7 @@ all: libunwind.a
- endif
-
- ifeq ($(enable_shared),yes)
--all: libgcc_eh.a libgcc_s$(SHLIB_EXT)
-+all: libgcc_eh.a libgcc_pic.a libgcc_s$(SHLIB_EXT)
- ifneq ($(LIBUNWIND),)
- all: libunwind$(SHLIB_EXT)
- libgcc_s$(SHLIB_EXT): libunwind$(SHLIB_EXT)
-@@ -1164,6 +1165,10 @@ install-shared:
- chmod 644 $(DESTDIR)$(inst_libdir)/libgcc_eh.a
- $(RANLIB) $(DESTDIR)$(inst_libdir)/libgcc_eh.a
-
-+ $(INSTALL_DATA) libgcc_pic.a $(mapfile) $(DESTDIR)$(inst_libdir)/
-+ chmod 644 $(DESTDIR)$(inst_libdir)/libgcc_pic.a
-+ $(RANLIB) $(DESTDIR)$(inst_libdir)/libgcc_pic.a
-+
- $(subst @multilib_dir@,$(MULTIDIR),$(subst \
- @shlib_base_name@,libgcc_s,$(subst \
- @shlib_slibdir_qual@,$(MULTIOSSUBDIR),$(SHLIB_INSTALL))))
+++ /dev/null
-commit 7edc8ca5456d9743dd0075eb3cc5b04f4f24c8cc
-Author: Imre Kaloz <kaloz@openwrt.org>
-Date: Wed Feb 2 19:34:36 2011 +0000
-
- add armv4 fixup patches
-
- SVN-Revision: 25322
-
-
---- a/gcc/config/arm/linux-eabi.h
-+++ b/gcc/config/arm/linux-eabi.h
-@@ -91,10 +91,15 @@
- #define MUSL_DYNAMIC_LINKER \
- "/lib/ld-musl-arm" MUSL_DYNAMIC_LINKER_E "%{mfloat-abi=hard:hf}%{mfdpic:-fdpic}.so.1"
-
-+/* For armv4 we pass --fix-v4bx to linker to support EABI */
-+#undef TARGET_FIX_V4BX_SPEC
-+#define TARGET_FIX_V4BX_SPEC " %{mcpu=arm8|mcpu=arm810|mcpu=strongarm*"\
-+ "|march=armv4|mcpu=fa526|mcpu=fa626:--fix-v4bx}"
-+
- /* At this point, bpabi.h will have clobbered LINK_SPEC. We want to
- use the GNU/Linux version, not the generic BPABI version. */
- #undef LINK_SPEC
--#define LINK_SPEC EABI_LINK_SPEC \
-+#define LINK_SPEC EABI_LINK_SPEC TARGET_FIX_V4BX_SPEC \
- LINUX_OR_ANDROID_LD (LINUX_TARGET_LINK_SPEC, \
- LINUX_TARGET_LINK_SPEC " " ANDROID_LINK_SPEC)
-
+++ /dev/null
-commit dcfc40358b5a3cae7320c17f8d1cebd5ad5540cd
-Author: Felix Fietkau <nbd@openwrt.org>
-Date: Sun Feb 12 20:25:47 2012 +0000
-
- gcc 4.6: port over the missing patch 850-use_shared_libgcc.patch to prevent libgcc crap from leaking into every single binary
-
- SVN-Revision: 30486
---- a/gcc/config/arm/linux-eabi.h
-+++ b/gcc/config/arm/linux-eabi.h
-@@ -132,10 +132,6 @@
- "%{Ofast|ffast-math|funsafe-math-optimizations:crtfastmath.o%s} " \
- LINUX_OR_ANDROID_LD (GNU_USER_TARGET_ENDFILE_SPEC, ANDROID_ENDFILE_SPEC)
-
--/* Use the default LIBGCC_SPEC, not the version in linux-elf.h, as we
-- do not use -lfloat. */
--#undef LIBGCC_SPEC
--
- /* Clear the instruction cache from `beg' to `end'. This is
- implemented in lib1funcs.S, so ensure an error if this definition
- is used. */
---- a/gcc/config/linux.h
-+++ b/gcc/config/linux.h
-@@ -71,6 +71,10 @@ see the files COPYING3 and COPYING.RUNTI
- builtin_version ("CRuntime_Musl"); \
- } while (0)
-
-+#ifndef LIBGCC_SPEC
-+#define LIBGCC_SPEC "%{static|static-libgcc:-lgcc}%{!static:%{!static-libgcc:-lgcc_s}}"
-+#endif
-+
- /* Determine which dynamic linker to use depending on whether GLIBC or
- uClibc or Bionic or musl is the default C library and whether
- -muclibc or -mglibc or -mbionic or -mmusl has been passed to change
---- a/libgcc/mkmap-symver.awk
-+++ b/libgcc/mkmap-symver.awk
-@@ -136,5 +136,5 @@ function output(lib) {
- else if (inherit[lib])
- printf("} %s;\n", inherit[lib]);
- else
-- printf ("\n local:\n\t*;\n};\n");
-+ printf ("\n\t*;\n};\n");
- }
---- a/gcc/config/rs6000/linux.h
-+++ b/gcc/config/rs6000/linux.h
-@@ -67,6 +67,9 @@
- #undef CPP_OS_DEFAULT_SPEC
- #define CPP_OS_DEFAULT_SPEC "%(cpp_os_linux)"
-
-+#undef LIBGCC_SPEC
-+#define LIBGCC_SPEC "%{!static:%{!static-libgcc:-lgcc_s}} -lgcc"
-+
- #undef LINK_SHLIB_SPEC
- #define LINK_SHLIB_SPEC "%{shared:-shared} %{!shared: %{static:-static}} \
- %{static-pie:-static -pie --no-dynamic-linker -z text}"
+++ /dev/null
-commit 64661de100da1ec1061ef3e5e400285dce115e6b
-Author: Felix Fietkau <nbd@openwrt.org>
-Date: Sun May 10 13:16:35 2015 +0000
-
- gcc: add some size optimization patches
-
- Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-
- SVN-Revision: 45664
-
---- a/libgcc/config/t-libunwind
-+++ b/libgcc/config/t-libunwind
-@@ -2,8 +2,7 @@
-
- HOST_LIBGCC2_CFLAGS += -DUSE_GAS_SYMVER
-
--LIB2ADDEH = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c \
-- $(srcdir)/unwind-compat.c $(srcdir)/unwind-dw2-fde-compat.c
-+LIB2ADDEH = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c
- LIB2ADDEHSTATIC = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c
-
- # Override the default value from t-slibgcc-elf-ver and mention -lunwind
+++ /dev/null
---- a/gcc/config/rs6000/rs6000-logue.cc
-+++ b/gcc/config/rs6000/rs6000-logue.cc
-@@ -348,7 +348,7 @@ rs6000_savres_strategy (rs6000_stack_t *
- /* Define cutoff for using out-of-line functions to save registers. */
- if (DEFAULT_ABI == ABI_V4 || TARGET_ELF)
- {
-- if (!optimize_size)
-+ if (1)
- {
- strategy |= SAVE_INLINE_FPRS | REST_INLINE_FPRS;
- strategy |= SAVE_INLINE_GPRS | REST_INLINE_GPRS;
+++ /dev/null
---- a/libgcc/crtstuff.c
-+++ b/libgcc/crtstuff.c
-@@ -152,7 +152,7 @@ call_ ## FUNC (void) \
- #endif
-
- #if !defined(USE_TM_CLONE_REGISTRY) && defined(OBJECT_FORMAT_ELF)
--# define USE_TM_CLONE_REGISTRY 1
-+# define USE_TM_CLONE_REGISTRY 0
- #elif !defined(USE_TM_CLONE_REGISTRY)
- # define USE_TM_CLONE_REGISTRY 0
- #endif
+++ /dev/null
---- a/libgcc/config/mips/t-mips16
-+++ b/libgcc/config/mips/t-mips16
-@@ -43,3 +43,6 @@ SYNC_CFLAGS = -mno-mips16
-
- # Version these symbols if building libgcc.so.
- SHLIB_MAPFILES += $(srcdir)/config/mips/libgcc-mips16.ver
-+
-+CRTSTUFF_T_CFLAGS += -mno-mips16
-+CRTSTUFF_T_CFLAGS_S += -mno-mips16
+++ /dev/null
-commit 99368862e44740ff4fd33760893f04e14f9dbdf1
-Author: Felix Fietkau <nbd@openwrt.org>
-Date: Tue Jul 31 00:52:27 2007 +0000
-
- Port the mbsd_multi patch from freewrt, which adds -fhonour-copts. This will emit warnings in packages that don't use our target cflags properly
-
- SVN-Revision: 8256
-
- This patch brings over a feature from MirBSD:
- * -fhonour-copts
- If this option is not given, it's warned (depending
- on environment variables). This is to catch errors
- of misbuilt packages which override CFLAGS themselves.
-
- This patch was authored by Thorsten Glaser <tg at mirbsd.de>
- with copyright assignment to the FSF in effect.
-
---- a/gcc/c-family/c-opts.cc
-+++ b/gcc/c-family/c-opts.cc
-@@ -107,6 +107,9 @@ static dump_flags_t original_dump_flags;
- /* Whether any standard preincluded header has been preincluded. */
- static bool done_preinclude;
-
-+/* Check if a port honours COPTS. */
-+static int honour_copts = 0;
-+
- static void handle_OPT_d (const char *);
- static void set_std_cxx98 (int);
- static void set_std_cxx11 (int);
-@@ -478,6 +481,12 @@ c_common_handle_option (size_t scode, co
- flag_no_builtin = !value;
- break;
-
-+ case OPT_fhonour_copts:
-+ if (c_language == clk_c) {
-+ honour_copts++;
-+ }
-+ break;
-+
- case OPT_fconstant_string_class_:
- constant_string_class_name = arg;
- break;
-@@ -1218,6 +1227,47 @@ c_common_init (void)
- return false;
- }
-
-+ if (c_language == clk_c) {
-+ char *ev = getenv ("GCC_HONOUR_COPTS");
-+ int evv;
-+ if (ev == NULL)
-+ evv = -1;
-+ else if ((*ev == '0') || (*ev == '\0'))
-+ evv = 0;
-+ else if (*ev == '1')
-+ evv = 1;
-+ else if (*ev == '2')
-+ evv = 2;
-+ else if (*ev == 's')
-+ evv = -1;
-+ else {
-+ warning (0, "unknown GCC_HONOUR_COPTS value, assuming 1");
-+ evv = 1; /* maybe depend this on something like MIRBSD_NATIVE? */
-+ }
-+ if (evv == 1) {
-+ if (honour_copts == 0) {
-+ error ("someone does not honour COPTS at all in lenient mode");
-+ return false;
-+ } else if (honour_copts != 1) {
-+ warning (0, "someone does not honour COPTS correctly, passed %d times",
-+ honour_copts);
-+ }
-+ } else if (evv == 2) {
-+ if (honour_copts == 0) {
-+ error ("someone does not honour COPTS at all in strict mode");
-+ return false;
-+ } else if (honour_copts != 1) {
-+ error ("someone does not honour COPTS correctly, passed %d times",
-+ honour_copts);
-+ return false;
-+ }
-+ } else if (evv == 0) {
-+ if (honour_copts != 1)
-+ inform (UNKNOWN_LOCATION, "someone does not honour COPTS correctly, passed %d times",
-+ honour_copts);
-+ }
-+ }
-+
- return true;
- }
-
---- a/gcc/c-family/c.opt
-+++ b/gcc/c-family/c.opt
-@@ -1755,6 +1755,9 @@ C++ ObjC++ Optimization Alias(fexception
- fhonor-std
- C++ ObjC++ WarnRemoved
-
-+fhonour-copts
-+C ObjC C++ ObjC++ RejectNegative
-+
- fhosted
- C ObjC
- Assume normal C execution environment.
---- a/gcc/common.opt
-+++ b/gcc/common.opt
-@@ -1770,6 +1770,9 @@ fharden-conditional-branches
- Common Var(flag_harden_conditional_branches) Optimization
- Harden conditional branches by checking reversed conditions.
-
-+fhonour-copts
-+Common RejectNegative
-+
- ; Nonzero means ignore `#ident' directives. 0 means handle them.
- ; Generate position-independent code for executables if possible
- ; On SVR4 targets, it also controls whether or not to emit a
---- a/gcc/doc/invoke.texi
-+++ b/gcc/doc/invoke.texi
-@@ -9596,6 +9596,17 @@ This option is only supported for C and
- @option{-Wall} and by @option{-Wpedantic}, which can be disabled with
- @option{-Wno-pointer-sign}.
-
-+@item -fhonour-copts
-+@opindex fhonour-copts
-+If @env{GCC_HONOUR_COPTS} is set to 1, abort if this option is not
-+given at least once, and warn if it is given more than once.
-+If @env{GCC_HONOUR_COPTS} is set to 2, abort if this option is not
-+given exactly once.
-+If @env{GCC_HONOUR_COPTS} is set to 0 or unset, warn if this option
-+is not given exactly once.
-+The warning is quelled if @env{GCC_HONOUR_COPTS} is set to @samp{s}.
-+This flag and environment variable only affect the C language.
-+
- @item -Wstack-protector
- @opindex Wstack-protector
- @opindex Wno-stack-protector
---- a/gcc/opts.cc
-+++ b/gcc/opts.cc
-@@ -2699,6 +2699,9 @@ common_handle_option (struct gcc_options
- add_comma_separated_to_vector (&opts->x_flag_ignored_attributes, arg);
- break;
-
-+ case OPT_fhonour_copts:
-+ break;
-+
- case OPT_Werror:
- dc->warning_as_error_requested = value;
- break;
+++ /dev/null
-Author: Jo-Philipp Wich <jow@openwrt.org>
-Date: Sat Apr 21 03:02:39 2012 +0000
-
- gcc: add patch to make the getenv() spec function nonfatal if requested environment variable is unset
-
- SVN-Revision: 31390
-
---- a/gcc/gcc.cc
-+++ b/gcc/gcc.cc
-@@ -10186,8 +10186,10 @@ getenv_spec_function (int argc, const ch
- }
-
- if (!value)
-- fatal_error (input_location,
-- "environment variable %qs not defined", varname);
-+ {
-+ warning (input_location, "environment variable %qs not defined", varname);
-+ value = "";
-+ }
-
- /* We have to escape every character of the environment variable so
- they are not interpreted as active spec characters. A
+++ /dev/null
-From dda6b050cd74a352670787a294596a9c56c21327 Mon Sep 17 00:00:00 2001
-From: Yousong Zhou <yszhou4tech@gmail.com>
-Date: Fri, 4 May 2018 18:20:53 +0800
-Subject: [PATCH] gotools: fix compilation when making cross compiler
-
-libgo is "the runtime support library for the Go programming language.
-This library is intended for use with the Go frontend."
-
-gccgo will link target files with libgo.so which depends on libgcc_s.so.1, but
-the linker will complain that it cannot find it. That's because shared libgcc
-is not present in the install directory yet. libgo.so was made without problem
-because gcc will emit -lgcc_s when compiled with -shared option. When gotools
-were being made, it was supplied with -static-libgcc thus no link option was
-provided. Check LIBGO in gcc/go/gcc-spec.c for how gccgo make a builtin spec
-for linking with libgo.so
-
-- GccgoCrossCompilation, https://github.com/golang/go/wiki/GccgoCrossCompilation
-- Cross-building instructions, http://www.eglibc.org/archives/patches/msg00078.html
-
-When 3-pass GCC compilation is used, shared libgcc runtime libraries will be
-available after gcc pass2 completed and will meet the gotools link requirement
-at gcc pass3
----
- gotools/Makefile.am | 4 +++-
- gotools/Makefile.in | 4 +++-
- 2 files changed, 6 insertions(+), 2 deletions(-)
-
---- a/gotools/Makefile.am
-+++ b/gotools/Makefile.am
-@@ -26,6 +26,7 @@ PWD_COMMAND = $${PWDCMD-pwd}
- STAMP = echo timestamp >
-
- libgodir = ../$(target_noncanonical)/libgo
-+libgccdir = ../$(target_noncanonical)/libgcc
- LIBGODEP = $(libgodir)/libgo.la
-
- LIBGOTOOL = $(libgodir)/libgotool.a
-@@ -41,7 +42,8 @@ GOCFLAGS = $(CFLAGS_FOR_TARGET)
- GOCOMPILE = $(GOCOMPILER) $(GOCFLAGS)
-
- AM_GOCFLAGS = -I $(libgodir)
--AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs
-+AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs \
-+ -L $(libgccdir) -L $(libgccdir)/.libs -lgcc_s
- GOLINK = $(GOCOMPILER) $(GOCFLAGS) $(AM_GOCFLAGS) $(LDFLAGS) $(AM_LDFLAGS) -o $@
-
- libgosrcdir = $(srcdir)/../libgo/go
---- a/gotools/Makefile.in
-+++ b/gotools/Makefile.in
-@@ -337,6 +337,7 @@ mkinstalldirs = $(SHELL) $(toplevel_srcd
- PWD_COMMAND = $${PWDCMD-pwd}
- STAMP = echo timestamp >
- libgodir = ../$(target_noncanonical)/libgo
-+libgccdir = ../$(target_noncanonical)/libgcc
- LIBGODEP = $(libgodir)/libgo.la
- LIBGOTOOL = $(libgodir)/libgotool.a
- @NATIVE_FALSE@GOCOMPILER = $(GOC)
-@@ -346,7 +347,8 @@ LIBGOTOOL = $(libgodir)/libgotool.a
- GOCFLAGS = $(CFLAGS_FOR_TARGET)
- GOCOMPILE = $(GOCOMPILER) $(GOCFLAGS)
- AM_GOCFLAGS = -I $(libgodir)
--AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs
-+AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs \
-+ -L $(libgccdir) -L $(libgccdir)/.libs -lgcc_s
- GOLINK = $(GOCOMPILER) $(GOCFLAGS) $(AM_GOCFLAGS) $(LDFLAGS) $(AM_LDFLAGS) -o $@
- libgosrcdir = $(srcdir)/../libgo/go
- cmdsrcdir = $(libgosrcdir)/cmd
+++ /dev/null
-commit 9c6e71079b46ad5433165feaa2001450f2017b56
-Author: Przemysław Buczkowski <prem@prem.moe>
-Date: Mon Aug 16 13:16:21 2021 +0100
-
- GCC: Patch for Apple Silicon compatibility
-
- This patch fixes a linker error occuring when compiling
- the cross-compiler on macOS and ARM64 architecture.
-
- Adapted from:
- https://github.com/richfelker/musl-cross-make/issues/116#issuecomment-823612404
-
- Change-Id: Ia3ee98a163bbb62689f42e2da83a5ef36beb0913
- Reviewed-on: https://review.haiku-os.org/c/buildtools/+/4329
- Reviewed-by: John Scipione <jscipione@gmail.com>
- Reviewed-by: Adrien Destugues <pulkomandy@gmail.com>
-
---- a/gcc/config/aarch64/aarch64.h
-+++ b/gcc/config/aarch64/aarch64.h
-@@ -1293,7 +1293,7 @@ extern const char *aarch64_rewrite_mcpu
- #define MCPU_TO_MARCH_SPEC_FUNCTIONS \
- { "rewrite_mcpu", aarch64_rewrite_mcpu },
-
--#if defined(__aarch64__)
-+#if defined(__aarch64__) && ! defined(__APPLE__)
- extern const char *host_detect_local_cpu (int argc, const char **argv);
- #define HAVE_LOCAL_CPU_DETECT
- # define EXTRA_SPEC_FUNCTIONS \
---- a/gcc/config/host-darwin.cc
-+++ b/gcc/config/host-darwin.cc
-@@ -23,6 +23,8 @@
- #include "options.h"
- #include "diagnostic-core.h"
- #include "config/host-darwin.h"
-+#include "hosthooks.h"
-+#include "hosthooks-def.h"
- #include <errno.h>
-
- /* For Darwin (macOS only) platforms, without ASLR (PIE) enabled on the
-@@ -181,3 +183,5 @@ darwin_gt_pch_use_address (void *&addr,
-
- return 1;
- }
-+
-+const struct host_hooks host_hooks = HOST_HOOKS_INITIALIZER;
+++ /dev/null
-commit 81cc26c706b2bc8c8c1eb1a322e5c5157900836e
-Author: Felix Fietkau <nbd@openwrt.org>
-Date: Sun Oct 19 21:45:51 2014 +0000
-
- gcc: do not assume that the Mac OS X filesystem is case insensitive
-
- Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-
- SVN-Revision: 42973
-
---- a/include/filenames.h
-+++ b/include/filenames.h
-@@ -43,11 +43,6 @@ extern "C" {
- # define IS_DIR_SEPARATOR(c) IS_DOS_DIR_SEPARATOR (c)
- # define IS_ABSOLUTE_PATH(f) IS_DOS_ABSOLUTE_PATH (f)
- #else /* not DOSish */
--# if defined(__APPLE__)
--# ifndef HAVE_CASE_INSENSITIVE_FILE_SYSTEM
--# define HAVE_CASE_INSENSITIVE_FILE_SYSTEM 1
--# endif
--# endif /* __APPLE__ */
- # define HAS_DRIVE_SPEC(f) (0)
- # define IS_DIR_SEPARATOR(c) IS_UNIX_DIR_SEPARATOR (c)
- # define IS_ABSOLUTE_PATH(f) IS_UNIX_ABSOLUTE_PATH (f)
+++ /dev/null
-diff -u --recursive gcc-8.4.0-vanilla/gcc/real.h gcc-8.4.0/gcc/real.h
---- gcc-8.4.0-vanilla/gcc/real.h 2020-03-04 02:30:01.000000000 -0600
-+++ gcc-8.4.0/gcc/real.h 2022-05-18 17:02:22.708820427 -0500
-@@ -70,8 +70,10 @@
- + (REAL_VALUE_TYPE_SIZE%HOST_BITS_PER_WIDE_INT ? 1 : 0)) /* round up */
-
- /* Verify the guess. */
-+#ifndef __LP64__
- extern char test_real_width
- [sizeof (REAL_VALUE_TYPE) <= REAL_WIDTH * sizeof (HOST_WIDE_INT) ? 1 : -1];
-+#endif
-
- /* Calculate the format for CONST_DOUBLE. We need as many slots as
- are necessary to overlay a REAL_VALUE_TYPE on them. This could be
+++ /dev/null
-commit 098bd91f5eae625c7d2ee621e10930fc4434e5e2
-Author: Luka Perkov <luka@openwrt.org>
-Date: Tue Feb 26 16:16:33 2013 +0000
-
- gcc: don't build documentation
-
- This closes #13039.
-
- Signed-off-by: Luka Perkov <luka@openwrt.org>
-
- SVN-Revision: 35807
-
---- a/gcc/Makefile.in
-+++ b/gcc/Makefile.in
-@@ -3204,18 +3204,10 @@ doc/gcc.info: $(TEXI_GCC_FILES)
- doc/gccint.info: $(TEXI_GCCINT_FILES)
- doc/cppinternals.info: $(TEXI_CPPINT_FILES)
-
--doc/%.info: %.texi
-- if [ x$(BUILD_INFO) = xinfo ]; then \
-- $(MAKEINFO) $(MAKEINFOFLAGS) -I . -I $(gcc_docdir) \
-- -I $(gcc_docdir)/include -o $@ $<; \
-- fi
-+doc/%.info:
-
- # Duplicate entry to handle renaming of gccinstall.info
--doc/gccinstall.info: $(TEXI_GCCINSTALL_FILES)
-- if [ x$(BUILD_INFO) = xinfo ]; then \
-- $(MAKEINFO) $(MAKEINFOFLAGS) -I $(gcc_docdir) \
-- -I $(gcc_docdir)/include -o $@ $<; \
-- fi
-+doc/gccinstall.info:
-
- doc/cpp.dvi: $(TEXI_CPP_FILES)
- doc/gcc.dvi: $(TEXI_GCC_FILES)
+++ /dev/null
-Fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84790.
-MIPS16 functions have a static assembler prologue which clobbers
-registers v0 and v1. Add these register clobbers to function call
-instructions.
-
---- a/gcc/config/mips/mips.c
-+++ b/gcc/config/mips/mips.c
-@@ -3102,6 +3102,12 @@ mips_emit_call_insn (rtx pattern, rtx or
- emit_insn (gen_update_got_version ());
- }
-
-+ if (TARGET_MIPS16 && TARGET_USE_GOT)
-+ {
-+ clobber_reg (&CALL_INSN_FUNCTION_USAGE (insn), MIPS16_PIC_TEMP);
-+ clobber_reg (&CALL_INSN_FUNCTION_USAGE (insn), MIPS_PROLOGUE_TEMP (word_mode));
-+ }
-+
- if (TARGET_MIPS16
- && TARGET_EXPLICIT_RELOCS
- && TARGET_CALL_CLOBBERED_GP)
+++ /dev/null
---- a/gcc/gcc.c
-+++ b/gcc/gcc.c
-@@ -868,7 +868,9 @@ proper position among the other output f
- #endif
-
- #ifndef LINK_SSP_SPEC
--#ifdef TARGET_LIBC_PROVIDES_SSP
-+#if DEFAULT_LIBC == LIBC_MUSL
-+#define LINK_SSP_SPEC "-lssp_nonshared"
-+#elif defined(TARGET_LIBC_PROVIDES_SSP)
- #define LINK_SSP_SPEC "%{fstack-protector|fstack-protector-all" \
- "|fstack-protector-strong|fstack-protector-explicit:}"
- #else
+++ /dev/null
-commit ecf7671b769fe96f7b5134be442089f8bdba55d2
-Author: Felix Fietkau <nbd@nbd.name>
-Date: Thu Aug 4 20:29:45 2016 +0200
-
-gcc: add a patch to generate better code with Os on mips
-
-Also happens to reduce compressed code size a bit
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
-
---- a/gcc/config/mips/mips.c
-+++ b/gcc/config/mips/mips.c
-@@ -19847,7 +19847,7 @@ mips_option_override (void)
- flag_pcc_struct_return = 0;
-
- /* Decide which rtx_costs structure to use. */
-- if (optimize_size)
-+ if (0 && optimize_size)
- mips_cost = &mips_rtx_cost_optimize_size;
- else
- mips_cost = &mips_rtx_cost_data[mips_tune];
+++ /dev/null
---- a/gcc/config/arm/arm.h
-+++ b/gcc/config/arm/arm.h
-@@ -155,7 +155,7 @@ extern tree arm_fp16_type_node;
- /* Thumb-1 only. */
- #define TARGET_THUMB1_ONLY (TARGET_THUMB1 && !arm_arch_notm)
-
--#define TARGET_LDRD (arm_arch5e && ARM_DOUBLEWORD_ALIGN \
-+#define TARGET_LDRD (arm_arch6 && ARM_DOUBLEWORD_ALIGN \
- && !TARGET_THUMB1)
-
- #define TARGET_CRC32 (arm_arch_crc)
+++ /dev/null
-commit 8570c4be394cff7282f332f97da2ff569a927ddb
-Author: Imre Kaloz <kaloz@openwrt.org>
-Date: Wed Feb 2 20:06:12 2011 +0000
-
- fixup arm soft-float symbols
-
- SVN-Revision: 25325
-
---- a/libgcc/config/arm/t-linux
-+++ b/libgcc/config/arm/t-linux
-@@ -1,6 +1,10 @@
- LIB1ASMSRC = arm/lib1funcs.S
- LIB1ASMFUNCS = _udivsi3 _divsi3 _umodsi3 _modsi3 _dvmd_lnx _clzsi2 _clzdi2 \
-- _ctzsi2 _arm_addsubdf3 _arm_addsubsf3
-+ _ctzsi2 _arm_addsubdf3 _arm_addsubsf3 \
-+ _arm_negdf2 _arm_muldivdf3 _arm_cmpdf2 _arm_unorddf2 \
-+ _arm_fixdfsi _arm_fixunsdfsi _arm_truncdfsf2 \
-+ _arm_negsf2 _arm_muldivsf3 _arm_cmpsf2 _arm_unordsf2 \
-+ _arm_fixsfsi _arm_fixunssfsi
-
- # Just for these, we omit the frame pointer since it makes such a big
- # difference.
---- a/gcc/config/arm/linux-elf.h
-+++ b/gcc/config/arm/linux-elf.h
-@@ -58,8 +58,6 @@
- %{shared:-lc} \
- %{!shared:%{profile:-lc_p}%{!profile:-lc}}"
-
--#define LIBGCC_SPEC "%{mfloat-abi=soft*:-lfloat} -lgcc"
--
- #define GLIBC_DYNAMIC_LINKER "/lib/ld-linux.so.2"
-
- #define LINUX_TARGET_LINK_SPEC "%{h*} \
+++ /dev/null
-commit c96312958c0621e72c9b32da5bc224ffe2161384
-Author: Felix Fietkau <nbd@openwrt.org>
-Date: Mon Oct 19 23:26:09 2009 +0000
-
- gcc: create a proper libgcc_pic.a static library for relinking (4.3.3+ for now, backport will follow)
-
- SVN-Revision: 18086
-
---- a/libgcc/Makefile.in
-+++ b/libgcc/Makefile.in
-@@ -923,11 +923,12 @@ $(libgcov-driver-objects): %$(objext): $
-
- # Static libraries.
- libgcc.a: $(libgcc-objects)
-+libgcc_pic.a: $(libgcc-s-objects)
- libgcov.a: $(libgcov-objects)
- libunwind.a: $(libunwind-objects)
- libgcc_eh.a: $(libgcc-eh-objects)
-
--libgcc.a libgcov.a libunwind.a libgcc_eh.a:
-+libgcc.a libgcov.a libunwind.a libgcc_eh.a libgcc_pic.a:
- -rm -f $@
-
- objects="$(objects)"; \
-@@ -948,7 +949,7 @@ all: libunwind.a
- endif
-
- ifeq ($(enable_shared),yes)
--all: libgcc_eh.a libgcc_s$(SHLIB_EXT)
-+all: libgcc_eh.a libgcc_pic.a libgcc_s$(SHLIB_EXT)
- ifneq ($(LIBUNWIND),)
- all: libunwind$(SHLIB_EXT)
- libgcc_s$(SHLIB_EXT): libunwind$(SHLIB_EXT)
-@@ -1154,6 +1155,10 @@ install-shared:
- chmod 644 $(DESTDIR)$(inst_libdir)/libgcc_eh.a
- $(RANLIB) $(DESTDIR)$(inst_libdir)/libgcc_eh.a
-
-+ $(INSTALL_DATA) libgcc_pic.a $(mapfile) $(DESTDIR)$(inst_libdir)/
-+ chmod 644 $(DESTDIR)$(inst_libdir)/libgcc_pic.a
-+ $(RANLIB) $(DESTDIR)$(inst_libdir)/libgcc_pic.a
-+
- $(subst @multilib_dir@,$(MULTIDIR),$(subst \
- @shlib_base_name@,libgcc_s,$(subst \
- @shlib_slibdir_qual@,$(MULTIOSSUBDIR),$(SHLIB_INSTALL))))
+++ /dev/null
-commit 7edc8ca5456d9743dd0075eb3cc5b04f4f24c8cc
-Author: Imre Kaloz <kaloz@openwrt.org>
-Date: Wed Feb 2 19:34:36 2011 +0000
-
- add armv4 fixup patches
-
- SVN-Revision: 25322
-
-
---- a/gcc/config/arm/linux-eabi.h
-+++ b/gcc/config/arm/linux-eabi.h
-@@ -88,10 +88,15 @@
- #define MUSL_DYNAMIC_LINKER \
- "/lib/ld-musl-arm" MUSL_DYNAMIC_LINKER_E "%{mfloat-abi=hard:hf}.so.1"
-
-+/* For armv4 we pass --fix-v4bx to linker to support EABI */
-+#undef TARGET_FIX_V4BX_SPEC
-+#define TARGET_FIX_V4BX_SPEC " %{mcpu=arm8|mcpu=arm810|mcpu=strongarm*"\
-+ "|march=armv4|mcpu=fa526|mcpu=fa626:--fix-v4bx}"
-+
- /* At this point, bpabi.h will have clobbered LINK_SPEC. We want to
- use the GNU/Linux version, not the generic BPABI version. */
- #undef LINK_SPEC
--#define LINK_SPEC EABI_LINK_SPEC \
-+#define LINK_SPEC EABI_LINK_SPEC TARGET_FIX_V4BX_SPEC \
- LINUX_OR_ANDROID_LD (LINUX_TARGET_LINK_SPEC, \
- LINUX_TARGET_LINK_SPEC " " ANDROID_LINK_SPEC)
-
+++ /dev/null
-commit dcfc40358b5a3cae7320c17f8d1cebd5ad5540cd
-Author: Felix Fietkau <nbd@openwrt.org>
-Date: Sun Feb 12 20:25:47 2012 +0000
-
- gcc 4.6: port over the missing patch 850-use_shared_libgcc.patch to prevent libgcc crap from leaking into every single binary
-
- SVN-Revision: 30486
---- a/gcc/config/arm/linux-eabi.h
-+++ b/gcc/config/arm/linux-eabi.h
-@@ -126,10 +126,6 @@
- "%{Ofast|ffast-math|funsafe-math-optimizations:crtfastmath.o%s} " \
- LINUX_OR_ANDROID_LD (GNU_USER_TARGET_ENDFILE_SPEC, ANDROID_ENDFILE_SPEC)
-
--/* Use the default LIBGCC_SPEC, not the version in linux-elf.h, as we
-- do not use -lfloat. */
--#undef LIBGCC_SPEC
--
- /* Clear the instruction cache from `beg' to `end'. This is
- implemented in lib1funcs.S, so ensure an error if this definition
- is used. */
---- a/gcc/config/linux.h
-+++ b/gcc/config/linux.h
-@@ -53,6 +53,10 @@ see the files COPYING3 and COPYING.RUNTI
- builtin_assert ("system=posix"); \
- } while (0)
-
-+#ifndef LIBGCC_SPEC
-+#define LIBGCC_SPEC "%{static|static-libgcc:-lgcc}%{!static:%{!static-libgcc:-lgcc_s}}"
-+#endif
-+
- /* Determine which dynamic linker to use depending on whether GLIBC or
- uClibc or Bionic or musl is the default C library and whether
- -muclibc or -mglibc or -mbionic or -mmusl has been passed to change
---- a/libgcc/mkmap-symver.awk
-+++ b/libgcc/mkmap-symver.awk
-@@ -136,5 +136,5 @@ function output(lib) {
- else if (inherit[lib])
- printf("} %s;\n", inherit[lib]);
- else
-- printf ("\n local:\n\t*;\n};\n");
-+ printf ("\n\t*;\n};\n");
- }
---- a/gcc/config/rs6000/linux.h
-+++ b/gcc/config/rs6000/linux.h
-@@ -60,6 +60,9 @@
- #undef CPP_OS_DEFAULT_SPEC
- #define CPP_OS_DEFAULT_SPEC "%(cpp_os_linux)"
-
-+#undef LIBGCC_SPEC
-+#define LIBGCC_SPEC "%{!static:%{!static-libgcc:-lgcc_s}} -lgcc"
-+
- #undef LINK_SHLIB_SPEC
- #define LINK_SHLIB_SPEC "%{shared:-shared} %{!shared: %{static:-static}} \
- %{static-pie:-static -pie --no-dynamic-linker -z text}"
+++ /dev/null
-commit 64661de100da1ec1061ef3e5e400285dce115e6b
-Author: Felix Fietkau <nbd@openwrt.org>
-Date: Sun May 10 13:16:35 2015 +0000
-
- gcc: add some size optimization patches
-
- Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-
- SVN-Revision: 45664
-
---- a/libgcc/config/t-libunwind
-+++ b/libgcc/config/t-libunwind
-@@ -2,8 +2,7 @@
-
- HOST_LIBGCC2_CFLAGS += -DUSE_GAS_SYMVER
-
--LIB2ADDEH = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c \
-- $(srcdir)/unwind-compat.c $(srcdir)/unwind-dw2-fde-compat.c
-+LIB2ADDEH = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c
- LIB2ADDEHSTATIC = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c
-
- # Override the default value from t-slibgcc-elf-ver and mention -lunwind
+++ /dev/null
---- a/gcc/config/rs6000/rs6000.c
-+++ b/gcc/config/rs6000/rs6000.c
-@@ -24780,7 +24780,7 @@ rs6000_savres_strategy (rs6000_stack_t *
- /* Define cutoff for using out-of-line functions to save registers. */
- if (DEFAULT_ABI == ABI_V4 || TARGET_ELF)
- {
-- if (!optimize_size)
-+ if (1)
- {
- strategy |= SAVE_INLINE_FPRS | REST_INLINE_FPRS;
- strategy |= SAVE_INLINE_GPRS | REST_INLINE_GPRS;
+++ /dev/null
---- a/libgcc/crtstuff.c
-+++ b/libgcc/crtstuff.c
-@@ -152,7 +152,7 @@ call_ ## FUNC (void) \
- #endif
-
- #if !defined(USE_TM_CLONE_REGISTRY) && defined(OBJECT_FORMAT_ELF)
--# define USE_TM_CLONE_REGISTRY 1
-+# define USE_TM_CLONE_REGISTRY 0
- #endif
-
- /* We do not want to add the weak attribute to the declarations of these
+++ /dev/null
---- a/libgcc/config/mips/t-mips16
-+++ b/libgcc/config/mips/t-mips16
-@@ -43,3 +43,6 @@ SYNC_CFLAGS = -mno-mips16
-
- # Version these symbols if building libgcc.so.
- SHLIB_MAPFILES += $(srcdir)/config/mips/libgcc-mips16.ver
-+
-+CRTSTUFF_T_CFLAGS += -mno-mips16
-+CRTSTUFF_T_CFLAGS_S += -mno-mips16
+++ /dev/null
-commit 99368862e44740ff4fd33760893f04e14f9dbdf1
-Author: Felix Fietkau <nbd@openwrt.org>
-Date: Tue Jul 31 00:52:27 2007 +0000
-
- Port the mbsd_multi patch from freewrt, which adds -fhonour-copts. This will emit warnings in packages that don't use our target cflags properly
-
- SVN-Revision: 8256
-
- This patch brings over a feature from MirBSD:
- * -fhonour-copts
- If this option is not given, it's warned (depending
- on environment variables). This is to catch errors
- of misbuilt packages which override CFLAGS themselves.
-
- This patch was authored by Thorsten Glaser <tg at mirbsd.de>
- with copyright assignment to the FSF in effect.
-
---- a/gcc/c-family/c-opts.c
-+++ b/gcc/c-family/c-opts.c
-@@ -107,6 +107,9 @@ static dump_flags_t original_dump_flags;
- /* Whether any standard preincluded header has been preincluded. */
- static bool done_preinclude;
-
-+/* Check if a port honours COPTS. */
-+static int honour_copts = 0;
-+
- static void handle_OPT_d (const char *);
- static void set_std_cxx98 (int);
- static void set_std_cxx11 (int);
-@@ -459,6 +462,12 @@ c_common_handle_option (size_t scode, co
- flag_no_builtin = !value;
- break;
-
-+ case OPT_fhonour_copts:
-+ if (c_language == clk_c) {
-+ honour_copts++;
-+ }
-+ break;
-+
- case OPT_fconstant_string_class_:
- constant_string_class_name = arg;
- break;
-@@ -1125,6 +1134,47 @@ c_common_init (void)
- return false;
- }
-
-+ if (c_language == clk_c) {
-+ char *ev = getenv ("GCC_HONOUR_COPTS");
-+ int evv;
-+ if (ev == NULL)
-+ evv = -1;
-+ else if ((*ev == '0') || (*ev == '\0'))
-+ evv = 0;
-+ else if (*ev == '1')
-+ evv = 1;
-+ else if (*ev == '2')
-+ evv = 2;
-+ else if (*ev == 's')
-+ evv = -1;
-+ else {
-+ warning (0, "unknown GCC_HONOUR_COPTS value, assuming 1");
-+ evv = 1; /* maybe depend this on something like MIRBSD_NATIVE? */
-+ }
-+ if (evv == 1) {
-+ if (honour_copts == 0) {
-+ error ("someone does not honour COPTS at all in lenient mode");
-+ return false;
-+ } else if (honour_copts != 1) {
-+ warning (0, "someone does not honour COPTS correctly, passed %d times",
-+ honour_copts);
-+ }
-+ } else if (evv == 2) {
-+ if (honour_copts == 0) {
-+ error ("someone does not honour COPTS at all in strict mode");
-+ return false;
-+ } else if (honour_copts != 1) {
-+ error ("someone does not honour COPTS correctly, passed %d times",
-+ honour_copts);
-+ return false;
-+ }
-+ } else if (evv == 0) {
-+ if (honour_copts != 1)
-+ inform (UNKNOWN_LOCATION, "someone does not honour COPTS correctly, passed %d times",
-+ honour_copts);
-+ }
-+ }
-+
- return true;
- }
-
---- a/gcc/c-family/c.opt
-+++ b/gcc/c-family/c.opt
-@@ -1469,6 +1469,9 @@ C++ ObjC++ Optimization Alias(fexception
- fhonor-std
- C++ ObjC++ Ignore Warn(switch %qs is no longer supported)
-
-+fhonour-copts
-+C ObjC C++ ObjC++ RejectNegative
-+
- fhosted
- C ObjC
- Assume normal C execution environment.
---- a/gcc/common.opt
-+++ b/gcc/common.opt
-@@ -1551,6 +1551,9 @@ fguess-branch-probability
- Common Report Var(flag_guess_branch_prob) Optimization
- Enable guessing of branch probabilities.
-
-+fhonour-copts
-+Common RejectNegative
-+
- ; Nonzero means ignore `#ident' directives. 0 means handle them.
- ; Generate position-independent code for executables if possible
- ; On SVR4 targets, it also controls whether or not to emit a
---- a/gcc/opts.c
-+++ b/gcc/opts.c
-@@ -2073,6 +2073,9 @@ common_handle_option (struct gcc_options
- opts, opts_set, loc, dc);
- break;
-
-+ case OPT_fhonour_copts:
-+ break;
-+
- case OPT_Wlarger_than_:
- opts->x_larger_than_size = value;
- opts->x_warn_larger_than = value != -1;
---- a/gcc/doc/invoke.texi
-+++ b/gcc/doc/invoke.texi
-@@ -7013,6 +7013,17 @@ This option is only supported for C and
- @option{-Wall} and by @option{-Wpedantic}, which can be disabled with
- @option{-Wno-pointer-sign}.
-
-+@item -fhonour-copts
-+@opindex fhonour-copts
-+If @env{GCC_HONOUR_COPTS} is set to 1, abort if this option is not
-+given at least once, and warn if it is given more than once.
-+If @env{GCC_HONOUR_COPTS} is set to 2, abort if this option is not
-+given exactly once.
-+If @env{GCC_HONOUR_COPTS} is set to 0 or unset, warn if this option
-+is not given exactly once.
-+The warning is quelled if @env{GCC_HONOUR_COPTS} is set to @samp{s}.
-+This flag and environment variable only affect the C language.
-+
- @item -Wstack-protector
- @opindex Wstack-protector
- @opindex Wno-stack-protector
+++ /dev/null
-Author: Jo-Philipp Wich <jow@openwrt.org>
-Date: Sat Apr 21 03:02:39 2012 +0000
-
- gcc: add patch to make the getenv() spec function nonfatal if requested environment variable is unset
-
- SVN-Revision: 31390
-
---- a/gcc/gcc.c
-+++ b/gcc/gcc.c
-@@ -9347,8 +9347,10 @@ getenv_spec_function (int argc, const ch
- value = varname;
-
- if (!value)
-- fatal_error (input_location,
-- "environment variable %qs not defined", varname);
-+ {
-+ warning (input_location, "environment variable %qs not defined", varname);
-+ value = "";
-+ }
-
- /* We have to escape every character of the environment variable so
- they are not interpreted as active spec characters. A
+++ /dev/null
-From da45b3fde60095756f5f6030f6012c23a3d34429 Mon Sep 17 00:00:00 2001
-From: Andrew McDonnell <bugs@andrewmcdonnell.net>
-Date: Fri, 3 Oct 2014 19:09:00 +0930
-Subject: Add .note.GNU-stack section
-
-See http://lists.busybox.net/pipermail/uclibc/2014-October/048671.html
-Below copied from https://gcc.gnu.org/ml/gcc-patches/2014-09/msg02430.html
-
-Re: [Patch, MIPS] Add .note.GNU-stack section
-
- From: Steve Ellcey <sellcey at mips dot com>
-
-On Wed, 2014-09-10 at 10:15 -0700, Eric Christopher wrote:
->
->
-> On Wed, Sep 10, 2014 at 9:27 AM, <pinskia@gmail.com> wrote:
-
-> This works except you did not update the assembly files in
-> libgcc or glibc. We (Cavium) have the same patch in our tree
-> for a few released versions.
-
-> Mind just checking yours in then Andrew?
-
-> Thanks!
-> -eric
-
-I talked to Andrew about what files he changed in GCC and created and
-tested this new patch. Andrew also mentioned changing some assembly
-files in glibc but I don't see any use of '.section .note.GNU-stack' in
-any assembly files in glibc (for any platform) so I wasn't planning on
-creating a glibc to add them to mips glibc assembly language files.
-
-OK to check in this patch?
-
-Steve Ellcey
-sellcey@mips.com
-
-
-
-2014-09-26 Steve Ellcey <sellcey@mips.com>
----
- gcc/config/mips/mips.c | 3 +++
- libgcc/config/mips/crti.S | 4 ++++
- libgcc/config/mips/crtn.S | 3 +++
- libgcc/config/mips/mips16.S | 4 ++++
- libgcc/config/mips/vr4120-div.S | 4 ++++
- 5 files changed, 18 insertions(+)
-
---- a/gcc/config/mips/mips.c
-+++ b/gcc/config/mips/mips.c
-@@ -22640,6 +22640,9 @@ mips_starting_frame_offset (void)
- #undef TARGET_STARTING_FRAME_OFFSET
- #define TARGET_STARTING_FRAME_OFFSET mips_starting_frame_offset
-
-+#undef TARGET_ASM_FILE_END
-+#define TARGET_ASM_FILE_END file_end_indicate_exec_stack
-+
- struct gcc_target targetm = TARGET_INITIALIZER;
- \f
- #include "gt-mips.h"
---- a/libgcc/config/mips/crti.S
-+++ b/libgcc/config/mips/crti.S
-@@ -21,6 +21,10 @@ a copy of the GCC Runtime Library Except
- see the files COPYING3 and COPYING.RUNTIME respectively. If not, see
- <http://www.gnu.org/licenses/>. */
-
-+
-+/* An executable stack is *not* required for these functions. */
-+ .section .note.GNU-stack,"",%progbits
-+
- /* 4 slots for argument spill area. 1 for cpreturn, 1 for stack.
- Return spill offset of 40 and 20. Aligned to 16 bytes for n32. */
-
---- a/libgcc/config/mips/crtn.S
-+++ b/libgcc/config/mips/crtn.S
-@@ -21,6 +21,9 @@ a copy of the GCC Runtime Library Except
- see the files COPYING3 and COPYING.RUNTIME respectively. If not, see
- <http://www.gnu.org/licenses/>. */
-
-+/* An executable stack is *not* required for these functions. */
-+ .section .note.GNU-stack,"",%progbits
-+
- /* 4 slots for argument spill area. 1 for cpreturn, 1 for stack.
- Return spill offset of 40 and 20. Aligned to 16 bytes for n32. */
-
---- a/libgcc/config/mips/mips16.S
-+++ b/libgcc/config/mips/mips16.S
-@@ -48,6 +48,10 @@ see the files COPYING3 and COPYING.RUNTI
- values using the soft-float calling convention, but do the actual
- operation using the hard floating point instructions. */
-
-+/* An executable stack is *not* required for these functions. */
-+ .section .note.GNU-stack,"",%progbits
-+ .previous
-+
- #if defined _MIPS_SIM && (_MIPS_SIM == _ABIO32 || _MIPS_SIM == _ABIO64)
-
- /* This file contains 32-bit assembly code. */
---- a/libgcc/config/mips/vr4120-div.S
-+++ b/libgcc/config/mips/vr4120-div.S
-@@ -26,6 +26,10 @@ see the files COPYING3 and COPYING.RUNTI
- -mfix-vr4120. div and ddiv do not give the correct result when one
- of the operands is negative. */
-
-+/* An executable stack is *not* required for these functions. */
-+ .section .note.GNU-stack,"",%progbits
-+ .previous
-+
- .set nomips16
-
- #define DIV \
+++ /dev/null
-From c0c62fa4256f805389f16ebfc4a60cf789129b50 Mon Sep 17 00:00:00 2001
-From: BangLang Huang <banglang.huang@foxmail.com>
-Date: Wed, 9 Nov 2016 10:36:49 +0800
-Subject: [PATCH] libffi: fix MIPS softfloat build issue
-
-Backported from github.com/libffi/libffi#272
-
-Signed-off-by: BangLang Huang <banglang.huang@foxmail.com>
-Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
----
- libffi/src/mips/n32.S | 17 +++++++++++++++++
- libffi/src/mips/o32.S | 17 +++++++++++++++++
- 2 files changed, 34 insertions(+)
-
---- a/libffi/src/mips/n32.S
-+++ b/libffi/src/mips/n32.S
-@@ -107,6 +107,16 @@ loadregs:
-
- REG_L t6, 3*FFI_SIZEOF_ARG($fp) # load the flags word into t6.
-
-+#ifdef __mips_soft_float
-+ REG_L a0, 0*FFI_SIZEOF_ARG(t9)
-+ REG_L a1, 1*FFI_SIZEOF_ARG(t9)
-+ REG_L a2, 2*FFI_SIZEOF_ARG(t9)
-+ REG_L a3, 3*FFI_SIZEOF_ARG(t9)
-+ REG_L a4, 4*FFI_SIZEOF_ARG(t9)
-+ REG_L a5, 5*FFI_SIZEOF_ARG(t9)
-+ REG_L a6, 6*FFI_SIZEOF_ARG(t9)
-+ REG_L a7, 7*FFI_SIZEOF_ARG(t9)
-+#else
- and t4, t6, ((1<<FFI_FLAG_BITS)-1)
- REG_L a0, 0*FFI_SIZEOF_ARG(t9)
- beqz t4, arg1_next
-@@ -193,6 +203,7 @@ arg7_next:
- arg8_doublep:
- l.d $f19, 7*FFI_SIZEOF_ARG(t9)
- arg8_next:
-+#endif
-
- callit:
- # Load the function pointer
-@@ -214,6 +225,7 @@ retint:
- b epilogue
-
- retfloat:
-+#ifndef __mips_soft_float
- bne t6, FFI_TYPE_FLOAT, retdouble
- jal t9
- REG_L t4, 4*FFI_SIZEOF_ARG($fp)
-@@ -272,6 +284,7 @@ retstruct_f_d:
- s.s $f0, 0(t4)
- s.d $f2, 8(t4)
- b epilogue
-+#endif
-
- retstruct_d_soft:
- bne t6, FFI_TYPE_STRUCT_D_SOFT, retstruct_f_soft
-@@ -429,6 +442,7 @@ ffi_closure_N32:
- REG_S a6, A6_OFF2($sp)
- REG_S a7, A7_OFF2($sp)
-
-+#ifndef __mips_soft_float
- # Store all possible float/double registers.
- s.d $f12, F12_OFF2($sp)
- s.d $f13, F13_OFF2($sp)
-@@ -438,6 +452,7 @@ ffi_closure_N32:
- s.d $f17, F17_OFF2($sp)
- s.d $f18, F18_OFF2($sp)
- s.d $f19, F19_OFF2($sp)
-+#endif
-
- # Call ffi_closure_mips_inner_N32 to do the real work.
- LA t9, ffi_closure_mips_inner_N32
-@@ -458,6 +473,7 @@ cls_retint:
- b cls_epilogue
-
- cls_retfloat:
-+#ifndef __mips_soft_float
- bne v0, FFI_TYPE_FLOAT, cls_retdouble
- l.s $f0, V0_OFF2($sp)
- b cls_epilogue
-@@ -500,6 +516,7 @@ cls_retstruct_f_d:
- l.s $f0, V0_OFF2($sp)
- l.d $f2, V1_OFF2($sp)
- b cls_epilogue
-+#endif
-
- cls_retstruct_small2:
- REG_L v0, V0_OFF2($sp)
---- a/libffi/src/mips/o32.S
-+++ b/libffi/src/mips/o32.S
-@@ -82,13 +82,16 @@ sixteen:
-
- ADDU $sp, 4 * FFI_SIZEOF_ARG # adjust $sp to new args
-
-+#ifndef __mips_soft_float
- bnez t0, pass_d # make it quick for int
-+#endif
- REG_L a0, 0*FFI_SIZEOF_ARG($sp) # just go ahead and load the
- REG_L a1, 1*FFI_SIZEOF_ARG($sp) # four regs.
- REG_L a2, 2*FFI_SIZEOF_ARG($sp)
- REG_L a3, 3*FFI_SIZEOF_ARG($sp)
- b call_it
-
-+#ifndef __mips_soft_float
- pass_d:
- bne t0, FFI_ARGS_D, pass_f
- l.d $f12, 0*FFI_SIZEOF_ARG($sp) # load $fp regs from args
-@@ -130,6 +133,7 @@ pass_f_d:
- # bne t0, FFI_ARGS_F_D, call_it
- l.s $f12, 0*FFI_SIZEOF_ARG($sp) # load $fp regs from args
- l.d $f14, 2*FFI_SIZEOF_ARG($sp) # passing double and float
-+#endif
-
- call_it:
- # Load the function pointer
-@@ -158,14 +162,23 @@ retfloat:
- bne t2, FFI_TYPE_FLOAT, retdouble
- jalr t9
- REG_L t0, SIZEOF_FRAME + 4*FFI_SIZEOF_ARG($fp)
-+#ifndef __mips_soft_float
- s.s $f0, 0(t0)
-+#else
-+ REG_S v0, 0(t0)
-+#endif
- b epilogue
-
- retdouble:
- bne t2, FFI_TYPE_DOUBLE, noretval
- jalr t9
- REG_L t0, SIZEOF_FRAME + 4*FFI_SIZEOF_ARG($fp)
-+#ifndef __mips_soft_float
- s.d $f0, 0(t0)
-+#else
-+ REG_S v1, 4(t0)
-+ REG_S v0, 0(t0)
-+#endif
- b epilogue
-
- noretval:
-@@ -261,9 +274,11 @@ $LCFI7:
- li $13, 1 # FFI_O32
- bne $16, $13, 1f # Skip fp save if FFI_O32_SOFT_FLOAT
-
-+#ifndef __mips_soft_float
- # Store all possible float/double registers.
- s.d $f12, FA_0_0_OFF2($fp)
- s.d $f14, FA_1_0_OFF2($fp)
-+#endif
- 1:
- # Call ffi_closure_mips_inner_O32 to do the work.
- la t9, ffi_closure_mips_inner_O32
-@@ -281,6 +296,7 @@ $LCFI7:
- li $13, 1 # FFI_O32
- bne $16, $13, 1f # Skip fp restore if FFI_O32_SOFT_FLOAT
-
-+#ifndef __mips_soft_float
- li $9, FFI_TYPE_FLOAT
- l.s $f0, V0_OFF2($fp)
- beq $8, $9, closure_done
-@@ -288,6 +304,7 @@ $LCFI7:
- li $9, FFI_TYPE_DOUBLE
- l.d $f0, V0_OFF2($fp)
- beq $8, $9, closure_done
-+#endif
- 1:
- REG_L $3, V1_OFF2($fp)
- REG_L $2, V0_OFF2($fp)
+++ /dev/null
-From dda6b050cd74a352670787a294596a9c56c21327 Mon Sep 17 00:00:00 2001
-From: Yousong Zhou <yszhou4tech@gmail.com>
-Date: Fri, 4 May 2018 18:20:53 +0800
-Subject: [PATCH] gotools: fix compilation when making cross compiler
-
-libgo is "the runtime support library for the Go programming language.
-This library is intended for use with the Go frontend."
-
-gccgo will link target files with libgo.so which depends on libgcc_s.so.1, but
-the linker will complain that it cannot find it. That's because shared libgcc
-is not present in the install directory yet. libgo.so was made without problem
-because gcc will emit -lgcc_s when compiled with -shared option. When gotools
-were being made, it was supplied with -static-libgcc thus no link option was
-provided. Check LIBGO in gcc/go/gcc-spec.c for how gccgo make a builtin spec
-for linking with libgo.so
-
-- GccgoCrossCompilation, https://github.com/golang/go/wiki/GccgoCrossCompilation
-- Cross-building instructions, http://www.eglibc.org/archives/patches/msg00078.html
-
-When 3-pass GCC compilation is used, shared libgcc runtime libraries will be
-available after gcc pass2 completed and will meet the gotools link requirement
-at gcc pass3
----
- gotools/Makefile.am | 4 +++-
- gotools/Makefile.in | 4 +++-
- 2 files changed, 6 insertions(+), 2 deletions(-)
-
---- a/gotools/Makefile.am
-+++ b/gotools/Makefile.am
-@@ -26,6 +26,7 @@ PWD_COMMAND = $${PWDCMD-pwd}
- STAMP = echo timestamp >
-
- libgodir = ../$(target_noncanonical)/libgo
-+libgccdir = ../$(target_noncanonical)/libgcc
- LIBGODEP = $(libgodir)/libgo.la
-
- LIBGOTOOL = $(libgodir)/libgotool.a
-@@ -41,7 +42,8 @@ GOCFLAGS = $(CFLAGS_FOR_TARGET)
- GOCOMPILE = $(GOCOMPILER) $(GOCFLAGS)
-
- AM_GOCFLAGS = -I $(libgodir)
--AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs
-+AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs \
-+ -L $(libgccdir) -L $(libgccdir)/.libs -lgcc_s
- GOLINK = $(GOCOMPILER) $(GOCFLAGS) $(AM_GOCFLAGS) $(LDFLAGS) $(AM_LDFLAGS) -o $@
-
- libgosrcdir = $(srcdir)/../libgo/go
---- a/gotools/Makefile.in
-+++ b/gotools/Makefile.in
-@@ -263,6 +263,7 @@ mkinstalldirs = $(SHELL) $(toplevel_srcd
- PWD_COMMAND = $${PWDCMD-pwd}
- STAMP = echo timestamp >
- libgodir = ../$(target_noncanonical)/libgo
-+libgccdir = ../$(target_noncanonical)/libgcc
- LIBGODEP = $(libgodir)/libgo.la
- LIBGOTOOL = $(libgodir)/libgotool.a
- @NATIVE_FALSE@GOCOMPILER = $(GOC)
-@@ -271,7 +272,8 @@ LIBGOTOOL = $(libgodir)/libgotool.a
- @NATIVE_TRUE@GOCOMPILER = $(GOC_FOR_TARGET) $(XGCC_FLAGS_FOR_TARGET)
- GOCOMPILE = $(GOCOMPILER) $(GOCFLAGS)
- AM_GOCFLAGS = -I $(libgodir)
--AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs
-+AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs \
-+ -L $(libgccdir) -L $(libgccdir)/.libs -lgcc_s
- GOLINK = $(GOCOMPILER) $(GOCFLAGS) $(AM_GOCFLAGS) $(LDFLAGS) $(AM_LDFLAGS) -o $@
- libgosrcdir = $(srcdir)/../libgo/go
- cmdsrcdir = $(libgosrcdir)/cmd
define KernelPackage/macremapper
SUBMENU:=Network Support
URL:=https://www.edgewaterwireless.com
- VERSION:=$(LINUX_VERSION)-$(BOARD)-$(PKG_RELEASE)
TITLE:=Dual Channel Wi-Fi macremapper Module
DEPENDS:= +kmod-cfg80211 +kmod-br-netfilter
FILES:=$(PKG_BUILD_DIR)/kernelmod/$(PKG_NAME).$(LINUX_KMOD_SUFFIX)
include $(INCLUDE_DIR)/kernel.mk
PKG_NAME:=mtd-rw
-PKG_VERSION:=git-20160214
-PKG_RELEASE:=2
+PKG_RELEASE:=1
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_MIRROR_HASH:=c44db17c3e05079116a1704f277642c9ce6f5ca4fa380c60f7e6d44509dc16be
-PKG_SOURCE_URL:=https://github.com/jclehner/mtd-rw.git
PKG_SOURCE_PROTO:=git
-PKG_SOURCE_SUBDIR=$(PKG_NAME)-$(PKG_VERSION)
-PKG_SOURCE_VERSION:=7e8562067d6a366c8cbaa8084396c33b7e12986b
+PKG_SOURCE_URL:=https://github.com/jclehner/mtd-rw
+PKG_SOURCE_DATE:=2021-02-28
+PKG_SOURCE_VERSION:=e87767395a6d27380196702f5f7bf98e92774f3f
+PKG_MIRROR_HASH:=984218d7a8e1252419c45ef313f23fb6e5edfa83088f68a4a356b795444ab381
PKG_MAINTAINER:=Joseph C. Lehner <joseph.c.lehner@gmail.com>
PKG_LICENSE=GPL-2.0
+++ /dev/null
---- a/mtd-rw.c
-+++ b/mtd-rw.c
-@@ -54,7 +54,11 @@ MODULE_PARM_DESC(i_want_a_brick, "Make a
-
- static int set_writeable(unsigned n, bool w)
- {
-+#ifndef CONFIG_MTD
-+ struct mtd_info *mtd = -ENOSYS;
-+#else
- struct mtd_info *mtd = get_mtd_device(NULL, n);
-+#endif
- int err;
-
- if (IS_ERR(mtd)) {
-@@ -76,7 +80,9 @@ static int set_writeable(unsigned n, boo
- err = 0;
- }
-
-+#ifdef CONFIG_MTD
- put_mtd_device(mtd);
-+#endif
- return err;
- }
-
include $(INCLUDE_DIR)/kernel.mk
PKG_NAME:=ovpn-dco
-PKG_VERSION:=0.2.20230426
+PKG_VERSION:=0.2.20240320
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL=https://codeload.github.com/OpenVPN/ovpn-dco/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=f8ba335026d7d0d73e9ee121fd1a3b4b6f5e8ad5b604d4cc16f943ae46784a85
+PKG_HASH:=83a02dc3e6e40b0ef128cd32ce7f47da7fccd759af68657f44925d64a88db37b
PKG_MAINTAINER:=Jianhui Zhao <zhaojh329@gmail.com>
PKG_LICENSE:=GPL-2.0-only
NOSTDINC_FLAGS += \
$(KERNEL_NOSTDINC_FLAGS) \
-I$(PKG_BUILD_DIR)/include \
+ -I$(PKG_BUILD_DIR)/compat-include \
-include $(PKG_BUILD_DIR)/linux-compat.h
EXTRA_KCONFIG:= \
include $(TOPDIR)/rules.mk
PKG_NAME:=erlang
-PKG_VERSION:=26.2.3
+PKG_VERSION:=26.2.4
PKG_RELEASE:=1
PKG_SOURCE:=otp_src_$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://github.com/erlang/otp/releases/download/OTP-$(PKG_VERSION)
-PKG_HASH:=2c4e61b24fb1c131d9f30cfe2415320899180debdb71fb59195c72bd9a4ab625
+PKG_HASH:=b51ad69f57e2956dff4c893bcb09ad68fee23a7f8f6bba7d58449516b696de95
PKG_LICENSE:=Apache-2.0
PKG_LICENSE_FILES:=LICENSE.txt
define Package/erlang
$(call Package/erlang/Default)
DEPENDS+= +libncurses +librt +zlib +libstdcpp
- PROVIDES:= erlang-erts=14.2.3 erlang-kernel=9.2.2 erlang-sasl=4.2.1 erlang-stdlib=5.2.1
+ PROVIDES:= erlang-erts=14.2.4 erlang-kernel=9.2.3 erlang-sasl=4.2.1 erlang-stdlib=5.2.2
endef
define Package/erlang/description
define Package/erlang-asn1
$(call Package/erlang/Default)
TITLE:=Abstract Syntax Notation One (ASN.1) support
- VERSION:=5.2.1
+ VERSION:=5.2.2
DEPENDS+= +erlang +erlang-syntax-tools
endef
define Package/erlang-compiler
$(call Package/erlang/Default)
TITLE:=Byte code compiler
- VERSION:=8.4.2
+ VERSION:=8.4.3
DEPENDS+= +erlang
endef
define Package/erlang-crypto
$(call Package/erlang/Default)
TITLE:=Cryptography support
- VERSION:=5.4.1
+ VERSION:=5.4.2
DEPENDS+= +erlang +libopenssl
endef
define Package/erlang-ssh
$(call Package/erlang/Default)
TITLE:=Secure Shell (SSH) support
- VERSION:=5.1.3
+ VERSION:=5.1.4
DEPENDS+= +erlang +erlang-crypto
endef
define Package/erlang-ssl
$(call Package/erlang/Default)
TITLE:=Secure Sockets Layer (SSL) support
- VERSION:=11.1.2
+ VERSION:=11.1.3
DEPENDS+= +erlang +erlang-crypto
endef
include $(TOPDIR)/rules.mk
GO_VERSION_MAJOR_MINOR:=1.22
-GO_VERSION_PATCH:=1
+GO_VERSION_PATCH:=2
PKG_NAME:=golang
PKG_VERSION:=$(GO_VERSION_MAJOR_MINOR)$(if $(GO_VERSION_PATCH),.$(GO_VERSION_PATCH))
PKG_SOURCE:=go$(PKG_VERSION).src.tar.gz
PKG_SOURCE_URL:=$(GO_SOURCE_URLS)
-PKG_HASH:=79c9b91d7f109515a25fc3ecdaad125d67e6bdb54f6d4d98580f46799caea321
+PKG_HASH:=374ea82b289ec738e968267cac59c7d5ff180f9492250254784b2044e90df5a9
PKG_MAINTAINER:=Jeffery To <jeffery.to@gmail.com>
PKG_LICENSE:=BSD-3-Clause
include $(TOPDIR)/rules.mk
PKG_NAME:=lua-eco
-PKG_VERSION:=3.3.0
+PKG_VERSION:=3.4.1
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL=https://github.com/zhaojh329/lua-eco/releases/download/v$(PKG_VERSION)
-PKG_HASH:=597c3edbb20c35f638b26b4fa7a02638c48f96f0330758a7ac1c44079b2170a3
+PKG_HASH:=6b28cf832d7427dd5106750814de65b2d9796669e6efacdfa14277c85fcb3b01
PKG_MAINTAINER:=Jianhui Zhao <zhaojh329@gmail.com>
PKG_LICENSE:=MIT
--- /dev/null
+#
+# Copyright (C) 2006-2023 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=lua
+PKG_VERSION:=5.4.6
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://www.lua.org/ftp/ \
+ https://www.tecgraf.puc-rio.br/lua/ftp/
+PKG_HASH:=7d5ea1b9cb6aa0b59ca3dde1c6adcb57ef83a1ba8e5432c0ecd06bf439b3ad88
+PKG_BUILD_PARALLEL:=1
+
+PKG_MAINTAINER:=Christian Marangi <ansuelsmth@gmail.com>
+
+PKG_LICENSE:=MIT
+PKG_LICENSE_FILES:=COPYRIGHT
+PKG_CPE_ID:=cpe:/a:lua:lua
+
+HOST_PATCH_DIR := ./patches-host
+
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/host-build.mk
+
+define Package/lua5.4/Default
+ SUBMENU:=Lua
+ SECTION:=lang
+ CATEGORY:=Languages
+ TITLE:=Lua programming language (version 5.4)
+ URL:=https://www.lua.org/
+endef
+
+define Package/lua5.4/Default/description
+ Lua is a powerful, efficient, lightweight, embeddable scripting language. It
+ supports procedural programming, object-oriented programming, functional
+ programming, data-driven programming, and data description.
+endef
+
+define Package/liblua5.4
+$(call Package/lua5.4/Default)
+ SUBMENU:=
+ SECTION:=libs
+ CATEGORY:=Libraries
+ TITLE+= (libraries)
+ ABI_VERSION:=5.4
+endef
+
+define Package/liblua5.4/description
+$(call Package/lua5.4/Default/description)
+ This package contains the Lua shared libraries, needed by other programs.
+endef
+
+define Package/lua5.4
+$(call Package/lua5.4/Default)
+ DEPENDS:=+liblua5.4
+ TITLE+= (interpreter)
+endef
+
+define Package/lua5.4/description
+$(call Package/lua5.4/Default/description)
+ This package contains the Lua language interpreter.
+endef
+
+define Package/luac5.4
+$(call Package/lua5.4/Default)
+ DEPENDS:=+liblua5.4
+ TITLE+= (compiler)
+endef
+
+define Package/luac5.4/description
+$(call Package/lua5.4/Default/description)
+ This package contains the Lua language compiler.
+endef
+
+define Build/Prepare
+ $(call Build/Prepare/Default)
+ mv $(PKG_BUILD_DIR)/doc/lua.1 $(PKG_BUILD_DIR)/doc/lua5.4.1
+ mv $(PKG_BUILD_DIR)/doc/luac.1 $(PKG_BUILD_DIR)/doc/luac5.4.1
+endef
+
+TARGET_CFLAGS += -DLUA_USE_LINUX $(FPIC) -std=gnu99
+
+define Build/Compile
+ $(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR) \
+ CC="$(TARGET_CROSS)gcc" \
+ AR="$(TARGET_CROSS)ar rcu" \
+ RANLIB="$(TARGET_CROSS)ranlib" \
+ INSTALL_ROOT=/usr \
+ CFLAGS="$(TARGET_CPPFLAGS) $(TARGET_CFLAGS)" \
+ PKG_VERSION=$(PKG_VERSION) \
+ linux
+ rm -rf $(PKG_INSTALL_DIR)
+ mkdir -p $(PKG_INSTALL_DIR)
+ $(MAKE) -C $(PKG_BUILD_DIR) \
+ INSTALL_TOP="$(PKG_INSTALL_DIR)/usr" \
+ install
+endef
+
+define Host/Prepare
+ $(call Host/Prepare/Default)
+ mv $(HOST_BUILD_DIR)/doc/lua.1 $(HOST_BUILD_DIR)/doc/lua5.4.1
+ mv $(HOST_BUILD_DIR)/doc/luac.1 $(HOST_BUILD_DIR)/doc/luac5.4.1
+endef
+
+define Host/Configure
+ $(SED) 's,"/usr/local/","$(STAGING_DIR_HOSTPKG)/",' $(HOST_BUILD_DIR)/src/luaconf.h
+endef
+
+ifeq ($(HOST_OS),Darwin)
+ LUA_OS:=macosx
+else
+ ifeq ($(HOST_OS),FreeBSD)
+ LUA_OS:=freebsd
+ else
+ LUA_OS:=linux
+ endif
+endif
+
+define Host/Compile
+ $(MAKE) -C $(HOST_BUILD_DIR) \
+ CC="$(HOSTCC) $(HOST_FPIC) -std=gnu99" \
+ $(LUA_OS)
+endef
+
+define Host/Install
+ $(MAKE) -C $(HOST_BUILD_DIR) \
+ INSTALL_TOP="$(STAGING_DIR_HOSTPKG)" \
+ install
+endef
+
+define Build/InstallDev
+ $(INSTALL_DIR) $(1)/usr/include/lua5.4 $(1)/usr/lib
+ $(CP) $(PKG_INSTALL_DIR)/usr/include/lua5.4/lua{,lib,conf}.h $(1)/usr/include/lua5.4/
+ $(CP) $(PKG_INSTALL_DIR)/usr/include/lua5.4/lua.hpp $(1)/usr/include/lua5.4/
+ $(CP) $(PKG_INSTALL_DIR)/usr/include/lua5.4/lauxlib.h $(1)/usr/include/lua5.4/
+ $(INSTALL_DIR) $(1)/usr/lib
+ $(CP) $(PKG_INSTALL_DIR)/usr/lib/liblua5.4.{a,so*} $(1)/usr/lib/
+ $(LN) liblua5.4.so.0.0.0 $(1)/usr/lib/liblualib5.4.so
+endef
+
+define Package/liblua5.4/install
+ $(INSTALL_DIR) $(1)/usr/lib
+ $(CP) $(PKG_INSTALL_DIR)/usr/lib/liblua5.4.so* $(1)/usr/lib/
+endef
+
+define Package/lua5.4/install
+ $(INSTALL_DIR) $(1)/usr/bin
+ $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/lua5.4 $(1)/usr/bin/
+endef
+
+define Package/luac5.4/install
+ $(INSTALL_DIR) $(1)/usr/bin
+ $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/luac5.4 $(1)/usr/bin/
+endef
+
+$(eval $(call BuildPackage,liblua5.4))
+$(eval $(call BuildPackage,lua5.4))
+$(eval $(call BuildPackage,luac5.4))
+$(eval $(call HostBuild))
--- /dev/null
+From 96576b44a1b368bd6590eb0778ae45cc9ccede3f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 21 Jun 2019 14:08:38 +0200
+Subject: [PATCH] include version number
+
+Including it allows multiple lua versions to coexist.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+
+--- a/Makefile
++++ b/Makefile
+@@ -12,7 +12,7 @@ PLAT= guess
+ # LUA_ROOT, LUA_LDIR, and LUA_CDIR in luaconf.h.
+ INSTALL_TOP= /usr/local
+ INSTALL_BIN= $(INSTALL_TOP)/bin
+-INSTALL_INC= $(INSTALL_TOP)/include
++INSTALL_INC= $(INSTALL_TOP)/include/lua$V
+ INSTALL_LIB= $(INSTALL_TOP)/lib
+ INSTALL_MAN= $(INSTALL_TOP)/man/man1
+ INSTALL_LMOD= $(INSTALL_TOP)/share/lua/$V
+@@ -39,10 +39,10 @@ RM= rm -f
+ PLATS= guess aix bsd c89 freebsd generic ios linux linux-readline macosx mingw posix solaris
+
+ # What to install.
+-TO_BIN= lua luac
++TO_BIN= lua$V luac$V
+ TO_INC= lua.h luaconf.h lualib.h lauxlib.h lua.hpp
+-TO_LIB= liblua.a
+-TO_MAN= lua.1 luac.1
++TO_LIB= liblua$V.a
++TO_MAN= lua$V.1 luac$V.1
+
+ # Lua version and release.
+ V= 5.4
+@@ -52,7 +52,7 @@ R= $V.6
+ all: $(PLAT)
+
+ $(PLATS) help test clean:
+- @cd src && $(MAKE) $@
++ @cd src && $(MAKE) $@ V=$V
+
+ install: dummy
+ cd src && $(MKDIR) $(INSTALL_BIN) $(INSTALL_INC) $(INSTALL_LIB) $(INSTALL_MAN) $(INSTALL_LMOD) $(INSTALL_CMOD)
+--- a/src/Makefile
++++ b/src/Makefile
+@@ -32,15 +32,15 @@ CMCFLAGS=
+
+ PLATS= guess aix bsd c89 freebsd generic ios linux linux-readline macosx mingw posix solaris
+
+-LUA_A= liblua.a
++LUA_A= liblua$V.a
+ CORE_O= lapi.o lcode.o lctype.o ldebug.o ldo.o ldump.o lfunc.o lgc.o llex.o lmem.o lobject.o lopcodes.o lparser.o lstate.o lstring.o ltable.o ltm.o lundump.o lvm.o lzio.o
+ LIB_O= lauxlib.o lbaselib.o lcorolib.o ldblib.o liolib.o lmathlib.o loadlib.o loslib.o lstrlib.o ltablib.o lutf8lib.o linit.o
+ BASE_O= $(CORE_O) $(LIB_O) $(MYOBJS)
+
+-LUA_T= lua
++LUA_T= lua$V
+ LUA_O= lua.o
+
+-LUAC_T= luac
++LUAC_T= luac$V
+ LUAC_O= luac.o
+
+ ALL_O= $(BASE_O) $(LUA_O) $(LUAC_O)
--- /dev/null
+--- a/src/Makefile
++++ b/src/Makefile
+@@ -126,7 +126,7 @@ c89:
+ @echo ''
+
+ FreeBSD NetBSD OpenBSD freebsd:
+- $(MAKE) $(ALL) SYSCFLAGS="-DLUA_USE_LINUX -DLUA_USE_READLINE -I/usr/include/edit" SYSLIBS="-Wl,-E -ledit" CC="cc"
++ $(MAKE) $(ALL) SYSCFLAGS="-DLUA_USE_LINUX $(if $(USE_READLINE), -DLUA_USE_READLINE) -I/usr/include/edit" SYSLIBS="-Wl,-E -ledit" CC="cc"
+
+ generic: $(ALL)
+
+@@ -136,13 +136,13 @@ ios:
+ Linux linux: linux-noreadline
+
+ linux-noreadline:
+- $(MAKE) $(ALL) SYSCFLAGS="-DLUA_USE_LINUX" SYSLIBS="-Wl,-E -ldl"
++ $(MAKE) $(ALL) SYSCFLAGS="-DLUA_USE_LINUX $(if $(USE_READLINE), -DLUA_USE_READLINE)" SYSLIBS="-Wl,-E -ldl $(if $(USE_READLINE), -lreadline)"
+
+ linux-readline:
+ $(MAKE) $(ALL) SYSCFLAGS="-DLUA_USE_LINUX -DLUA_USE_READLINE" SYSLIBS="-Wl,-E -ldl -lreadline"
+
+ Darwin macos macosx:
+- $(MAKE) $(ALL) SYSCFLAGS="-DLUA_USE_MACOSX -DLUA_USE_READLINE" SYSLIBS="-lreadline"
++ $(MAKE) $(ALL) SYSCFLAGS="-DLUA_USE_MACOSX $(if $(USE_READLINE), -DLUA_USE_READLINE)" SYSLIBS="$(if $(USE_READLINE), -lreadline)"
+
+ mingw:
+ $(MAKE) "LUA_A=lua54.dll" "LUA_T=lua.exe" \
--- /dev/null
+From 96576b44a1b368bd6590eb0778ae45cc9ccede3f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 21 Jun 2019 14:08:38 +0200
+Subject: [PATCH] include version number
+
+Including it allows multiple lua versions to coexist.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+
+--- a/Makefile
++++ b/Makefile
+@@ -12,7 +12,7 @@ PLAT= guess
+ # LUA_ROOT, LUA_LDIR, and LUA_CDIR in luaconf.h.
+ INSTALL_TOP= /usr/local
+ INSTALL_BIN= $(INSTALL_TOP)/bin
+-INSTALL_INC= $(INSTALL_TOP)/include
++INSTALL_INC= $(INSTALL_TOP)/include/lua$V
+ INSTALL_LIB= $(INSTALL_TOP)/lib
+ INSTALL_MAN= $(INSTALL_TOP)/man/man1
+ INSTALL_LMOD= $(INSTALL_TOP)/share/lua/$V
+@@ -39,10 +39,10 @@ RM= rm -f
+ PLATS= guess aix bsd c89 freebsd generic ios linux linux-readline macosx mingw posix solaris
+
+ # What to install.
+-TO_BIN= lua luac
++TO_BIN= lua$V luac$V
+ TO_INC= lua.h luaconf.h lualib.h lauxlib.h lua.hpp
+-TO_LIB= liblua.a
+-TO_MAN= lua.1 luac.1
++TO_LIB= liblua$V.a
++TO_MAN= lua$V.1 luac$V.1
+
+ # Lua version and release.
+ V= 5.4
+@@ -52,7 +52,7 @@ R= $V.6
+ all: $(PLAT)
+
+ $(PLATS) help test clean:
+- @cd src && $(MAKE) $@
++ @cd src && $(MAKE) $@ V=$V
+
+ install: dummy
+ cd src && $(MKDIR) $(INSTALL_BIN) $(INSTALL_INC) $(INSTALL_LIB) $(INSTALL_MAN) $(INSTALL_LMOD) $(INSTALL_CMOD)
+--- a/src/Makefile
++++ b/src/Makefile
+@@ -32,15 +32,15 @@ CMCFLAGS=
+
+ PLATS= guess aix bsd c89 freebsd generic ios linux linux-readline macosx mingw posix solaris
+
+-LUA_A= liblua.a
++LUA_A= liblua$V.a
+ CORE_O= lapi.o lcode.o lctype.o ldebug.o ldo.o ldump.o lfunc.o lgc.o llex.o lmem.o lobject.o lopcodes.o lparser.o lstate.o lstring.o ltable.o ltm.o lundump.o lvm.o lzio.o
+ LIB_O= lauxlib.o lbaselib.o lcorolib.o ldblib.o liolib.o lmathlib.o loadlib.o loslib.o lstrlib.o ltablib.o lutf8lib.o linit.o
+ BASE_O= $(CORE_O) $(LIB_O) $(MYOBJS)
+
+-LUA_T= lua
++LUA_T= lua$V
+ LUA_O= lua.o
+
+-LUAC_T= luac
++LUAC_T= luac$V
+ LUAC_O= luac.o
+
+ ALL_O= $(BASE_O) $(LUA_O) $(LUAC_O)
--- /dev/null
+--- a/Makefile
++++ b/Makefile
+@@ -41,7 +41,7 @@ PLATS= guess aix bsd c89 freebsd generic
+ # What to install.
+ TO_BIN= lua$V luac$V
+ TO_INC= lua.h luaconf.h lualib.h lauxlib.h lua.hpp
+-TO_LIB= liblua$V.a
++TO_LIB= liblua$V.a liblua$V.so.0.0.0
+ TO_MAN= lua$V.1 luac$V.1
+
+ # Lua version and release.
+@@ -59,6 +59,9 @@ install: dummy
+ cd src && $(INSTALL_EXEC) $(TO_BIN) $(INSTALL_BIN)
+ cd src && $(INSTALL_DATA) $(TO_INC) $(INSTALL_INC)
+ cd src && $(INSTALL_DATA) $(TO_LIB) $(INSTALL_LIB)
++ ln -s liblua$V.so.0.0.0 $(INSTALL_LIB)/liblua$V.so.0.0
++ ln -s liblua$V.so.0.0.0 $(INSTALL_LIB)/liblua$V.so.0
++ ln -s liblua$V.so.0.0.0 $(INSTALL_LIB)/liblua$V.so
+ cd doc && $(INSTALL_DATA) $(TO_MAN) $(INSTALL_MAN)
+
+ uninstall:
+--- a/src/ldebug.h
++++ b/src/ldebug.h
+@@ -36,7 +36,7 @@
+ #endif
+
+
+-LUAI_FUNC int luaG_getfuncline (const Proto *f, int pc);
++LUA_API int luaG_getfuncline (const Proto *f, int pc);
+ LUAI_FUNC const char *luaG_findlocal (lua_State *L, CallInfo *ci, int n,
+ StkId *pos);
+ LUAI_FUNC l_noret luaG_typeerror (lua_State *L, const TValue *o,
+--- a/src/lstring.h
++++ b/src/lstring.h
+@@ -50,7 +50,7 @@ LUAI_FUNC void luaS_init (lua_State *L);
+ LUAI_FUNC void luaS_remove (lua_State *L, TString *ts);
+ LUAI_FUNC Udata *luaS_newudata (lua_State *L, size_t s, int nuvalue);
+ LUAI_FUNC TString *luaS_newlstr (lua_State *L, const char *str, size_t l);
+-LUAI_FUNC TString *luaS_new (lua_State *L, const char *str);
++LUA_API TString *luaS_new (lua_State *L, const char *str);
+ LUAI_FUNC TString *luaS_createlngstrobj (lua_State *L, size_t l);
+
+
+--- a/src/lundump.h
++++ b/src/lundump.h
+@@ -30,7 +30,7 @@
+ LUAI_FUNC LClosure* luaU_undump (lua_State* L, ZIO* Z, const char* name);
+
+ /* dump one chunk; from ldump.c */
+-LUAI_FUNC int luaU_dump (lua_State* L, const Proto* f, lua_Writer w,
++LUA_API int luaU_dump (lua_State* L, const Proto* f, lua_Writer w,
+ void* data, int strip);
+
+ #endif
+--- a/src/lzio.h
++++ b/src/lzio.h
+@@ -44,7 +44,7 @@ typedef struct Mbuffer {
+ #define luaZ_freebuffer(L, buff) luaZ_resizebuffer(L, buff, 0)
+
+
+-LUAI_FUNC void luaZ_init (lua_State *L, ZIO *z, lua_Reader reader,
++LUA_API void luaZ_init (lua_State *L, ZIO *z, lua_Reader reader,
+ void *data);
+ LUAI_FUNC size_t luaZ_read (ZIO* z, void *b, size_t n); /* read next n bytes */
+
+--- a/src/Makefile
++++ b/src/Makefile
+@@ -33,6 +33,7 @@ CMCFLAGS=
+ PLATS= guess aix bsd c89 freebsd generic ios linux linux-readline macosx mingw posix solaris
+
+ LUA_A= liblua$V.a
++LUA_SO= liblua$V.so.0.0.0
+ CORE_O= lapi.o lcode.o lctype.o ldebug.o ldo.o ldump.o lfunc.o lgc.o llex.o lmem.o lobject.o lopcodes.o lparser.o lstate.o lstring.o ltable.o ltm.o lundump.o lvm.o lzio.o
+ LIB_O= lauxlib.o lbaselib.o lcorolib.o ldblib.o liolib.o lmathlib.o loadlib.o loslib.o lstrlib.o ltablib.o lutf8lib.o linit.o
+ BASE_O= $(CORE_O) $(LIB_O) $(MYOBJS)
+@@ -44,8 +45,9 @@ LUAC_T= luac$V
+ LUAC_O= luac.o
+
+ ALL_O= $(BASE_O) $(LUA_O) $(LUAC_O)
+-ALL_T= $(LUA_A) $(LUA_T) $(LUAC_T)
++ALL_T= $(LUA_A) $(LUA_SO) $(LUA_T) $(LUAC_T)
+ ALL_A= $(LUA_A)
++ALL_SO= $(LUA_SO)
+
+ # Targets start here.
+ default: $(PLAT)
+@@ -56,14 +58,25 @@ o: $(ALL_O)
+
+ a: $(ALL_A)
+
++so: $(ALL_SO)
++
+ $(LUA_A): $(BASE_O)
+ $(AR) $@ $(BASE_O)
+ $(RANLIB) $@
+
+-$(LUA_T): $(LUA_O) $(LUA_A)
+- $(CC) -o $@ $(LDFLAGS) $(LUA_O) $(LUA_A) $(LIBS)
++$(LUA_SO): $(CORE_O) $(LIB_O)
++ $(CC) -o $@ -Wl,-Bsymbolic-functions -shared -Wl,-soname="$@" $?
++ ln -fs $@ liblua$V.so.0.0
++ ln -fs $@ liblua$V.so.0
++ ln -fs $@ liblua$V.so
++
++$(LUA_T): $(LUA_O) $(LUA_SO)
++ $(CC) -o $@ -L. -llua$V $(MYLDFLAGS) $(LUA_O) $(LIBS)
++
++$(LUAC_T): $(LUAC_O) $(LUA_SO)
++ $(CC) -o $@ -L. -llua$V $(MYLDFLAGS) $(LUAC_O) $(LIBS)
+
+-$(LUAC_T): $(LUAC_O) $(LUA_A)
++$(LUAC_T)-host: $(LUAC_O) $(LUA_A)
+ $(CC) -o $@ $(LDFLAGS) $(LUAC_O) $(LUA_A) $(LIBS)
+
+ test:
--- /dev/null
+--- a/src/Makefile
++++ b/src/Makefile
+@@ -126,7 +126,7 @@ c89:
+ @echo ''
+
+ FreeBSD NetBSD OpenBSD freebsd:
+- $(MAKE) $(ALL) SYSCFLAGS="-DLUA_USE_LINUX -DLUA_USE_READLINE -I/usr/include/edit" SYSLIBS="-Wl,-E -ledit" CC="cc"
++ $(MAKE) $(ALL) SYSCFLAGS="-DLUA_USE_LINUX $(if $(USE_READLINE), -DLUA_USE_READLINE) -I/usr/include/edit" SYSLIBS="-Wl,-E -ledit" CC="cc"
+
+ generic: $(ALL)
+
+@@ -136,13 +136,13 @@ ios:
+ Linux linux: linux-noreadline
+
+ linux-noreadline:
+- $(MAKE) $(ALL) SYSCFLAGS="-DLUA_USE_LINUX" SYSLIBS="-Wl,-E -ldl"
++ $(MAKE) $(ALL) SYSCFLAGS="-DLUA_USE_LINUX $(if $(USE_READLINE), -DLUA_USE_READLINE)" SYSLIBS="-Wl,-E -ldl $(if $(USE_READLINE), -lreadline)"
+
+ linux-readline:
+ $(MAKE) $(ALL) SYSCFLAGS="-DLUA_USE_LINUX -DLUA_USE_READLINE" SYSLIBS="-Wl,-E -ldl -lreadline"
+
+ Darwin macos macosx:
+- $(MAKE) $(ALL) SYSCFLAGS="-DLUA_USE_MACOSX -DLUA_USE_READLINE" SYSLIBS="-lreadline"
++ $(MAKE) $(ALL) SYSCFLAGS="-DLUA_USE_MACOSX $(if $(USE_READLINE), -DLUA_USE_READLINE)" SYSLIBS="$(if $(USE_READLINE), -lreadline)"
+
+ mingw:
+ $(MAKE) "LUA_A=lua54.dll" "LUA_T=lua.exe" \
PKG_VERSION:=1.5.1
PKG_RELEASE:=1
-PKG_SOURCE:=$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://github.com/lunarmodules/luaexpat/archive/refs/tags
-PKG_HASH:=7d455f154de59eb0b073c3620bc8b873f7f697b3f21a112e6ff8dc9fca6d0826
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_VERSION:=$(PKG_VERSION)
+PKG_SOURCE_URL:=https://github.com/lunarmodules/luaexpat
+PKG_MIRROR_HASH:=7e370d47e947a1acfeb4d00df012f47116fe7971f5b12033e92666e37a9312a1
PKG_CPE_ID:=cpe:/a:matthewwild:luaexpat
PKG_VERSION:=3.1.0
PKG_RELEASE:=1
-PKG_SOURCE:=v$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://github.com/lunarmodules/luasocket/archive/refs/tags
-PKG_HASH:=bf033aeb9e62bcaa8d007df68c119c966418e8c9ef7e4f2d7e96bddeca9cca6e
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_VERSION:=v$(PKG_VERSION)
+PKG_SOURCE_URL:=https://github.com/lunarmodules/luasocket
+PKG_MIRROR_HASH:=1ee81f1f5a63d0d14c8c8571e8940604cbf1443c3b18ee7d3d1bac6791f853fc
PKG_MAINTAINER:=W. Michael Petullo <mike@flyn.org>
PKG_LICENSE:=MIT
include $(TOPDIR)/rules.mk
PKG_NAME:=node
-PKG_VERSION:=v20.12.1
+PKG_VERSION:=v20.12.2
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://nodejs.org/dist/$(PKG_VERSION)
-PKG_HASH:=b9bef0314e12773ef004368ee56a2db509a948d4170b9efb07441bac1f1407a0
+PKG_HASH:=bc57ee721a12cc8be55bb90b4a9a2f598aed5581d5199ec3bd171a4781bfecda
PKG_MAINTAINER:=Hirokazu MORIKAWA <morikw2@gmail.com>, Adrian Panella <ianchi74@outlook.com>
PKG_LICENSE:=MIT
PKG_NAME:=perl
PKG_VERSION:=$(PERL_VERSION)
-PKG_RELEASE:=1
+PKG_RELEASE:=2
PKG_SOURCE_URL:=https://www.cpan.org/src/5.0
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
--- /dev/null
+From 002d6666a3ed5bc9c360c1f91116ebbf0c5ef57c Mon Sep 17 00:00:00 2001
+From: Georgi Valkov <gvalkov@gmail.com>
+Date: Sat, 20 Apr 2024 16:18:37 +0300
+Subject: [PATCH] revert 88efce38149481334db7ddb932f9b74eaaa9765b
+
+Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
+---
+ Makefile.SH | 35 ++---------------------------------
+ installperl | 25 -------------------------
+ 2 files changed, 2 insertions(+), 58 deletions(-)
+
+--- a/Makefile.SH
++++ b/Makefile.SH
+@@ -61,16 +61,8 @@ true)
+ -compatibility_version \
+ ${api_revision}.${api_version}.${api_subversion} \
+ -current_version \
+- ${revision}.${patchlevel}.${subversion}"
+- case "$osvers" in
+- 1[5-9]*|[2-9]*)
+- shrpldflags="$shrpldflags -install_name `pwd`/\$@ -Xlinker -headerpad_max_install_names"
+- exeldflags="-Xlinker -headerpad_max_install_names"
+- ;;
+- *)
+- shrpldflags="$shrpldflags -install_name \$(shrpdir)/\$@"
+- ;;
+- esac
++ ${revision}.${patchlevel}.${subversion} \
++ -install_name \$(shrpdir)/\$@"
+ ;;
+ cygwin*)
+ shrpldflags="$shrpldflags -Wl,--out-implib=libperl.dll.a"
+@@ -353,14 +345,6 @@ MANIFEST_SRT = MANIFEST.srt
+
+ !GROK!THIS!
+
+-case "$useshrplib$osname" in
+-truedarwin)
+- $spitshell >>$Makefile <<!GROK!THIS!
+-PERL_EXE_LDFLAGS=$exeldflags
+-!GROK!THIS!
+- ;;
+-esac
+-
+ $spitshell >>$Makefile <<!GROK!THIS!
+ # Macros to invoke a copy of our fully operational perl during the build.
+ PERL_EXE = perl\$(EXE_EXT)
+@@ -1040,20 +1024,6 @@ $(PERL_EXE): $& $(perlmain_dep) $(LIBPER
+ $(SHRPENV) $(CC) -o perl $(CLDFLAGS) $(CCDLFLAGS) $(perlmain_objs) $(LLIBPERL) $(static_ext) `cat ext.libs` $(libs)
+ !NO!SUBS!
+ ;;
+-
+- darwin)
+- case "$useshrplib$osvers" in
+- true1[5-9]*|true[2-9]*) $spitshell >>$Makefile <<'!NO!SUBS!'
+- $(SHRPENV) $(CC) -o perl $(PERL_EXE_LDFLAGS) $(CLDFLAGS) $(CCDLFLAGS) $(perlmain_objs) $(static_ext) $(LLIBPERL) `cat ext.libs` $(libs)
+-!NO!SUBS!
+- ;;
+- *) $spitshell >>$Makefile <<'!NO!SUBS!'
+- $(SHRPENV) $(CC) -o perl $(CLDFLAGS) $(CCDLFLAGS) $(perlmain_objs) $(static_ext) $(LLIBPERL) `cat ext.libs` $(libs)
+-!NO!SUBS!
+- ;;
+- esac
+- ;;
+-
+ *) $spitshell >>$Makefile <<'!NO!SUBS!'
+ $(SHRPENV) $(CC) -o perl $(CLDFLAGS) $(CCDLFLAGS) $(perlmain_objs) $(static_ext) $(LLIBPERL) `cat ext.libs` $(libs)
+ !NO!SUBS!
+--- a/installperl
++++ b/installperl
+@@ -282,7 +282,6 @@ else {
+ safe_unlink("$installbin/$perl_verbase$ver$exe_ext");
+ copy("perl$exe_ext", "$installbin/$perl_verbase$ver$exe_ext");
+ strip("$installbin/$perl_verbase$ver$exe_ext");
+- fix_dep_names("$installbin/$perl_verbase$ver$exe_ext");
+ chmod(0755, "$installbin/$perl_verbase$ver$exe_ext");
+ `chtag -r "$installbin/$perl_verbase$ver$exe_ext"` if ($^O eq 'os390');
+ }
+@@ -350,7 +349,6 @@ foreach my $file (@corefiles) {
+ if (copy_if_diff($file,"$installarchlib/CORE/$file")) {
+ if ($file =~ /\.(\Q$so\E|\Q$dlext\E)$/) {
+ strip("-S", "$installarchlib/CORE/$file") if $^O eq 'darwin';
+- fix_dep_names("$installarchlib/CORE/$file");
+ chmod($SO_MODE, "$installarchlib/CORE/$file");
+ } else {
+ chmod($NON_SO_MODE, "$installarchlib/CORE/$file");
+@@ -749,27 +747,4 @@ sub strip
+ }
+ }
+
+-sub fix_dep_names {
+- my $file = shift;
+-
+- $^O eq "darwin" && $Config{osvers} =~ /^(1[5-9]|[2-9])/
+- && $Config{useshrplib}
+- or return;
+-
+- my @opts;
+- my $so = $Config{so};
+- my $libperl = "$Config{archlibexp}/CORE/libperl.$Config{so}";
+- if ($file =~ /\blibperl.\Q$Config{so}\E$/a) {
+- push @opts, -id => $libperl;
+- }
+- else {
+- push @opts, -change => getcwd . "/libperl.$so", $libperl;
+- }
+- push @opts, $file;
+-
+- $opts{verbose} and print " install_name_tool @opts\n";
+- system "install_name_tool", @opts
+- and die "Cannot update $file dependency paths\n";
+-}
+-
+ # ex: set ts=8 sts=4 sw=4 et:
include $(TOPDIR)/rules.mk
PKG_NAME:=php
-PKG_VERSION:=8.3.4
+PKG_VERSION:=8.3.6
PKG_RELEASE:=1
PKG_MAINTAINER:=Michael Heimpold <mhei@heimpold.de>
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
PKG_SOURCE_URL:=https://www.php.net/distributions/
-PKG_HASH:=39a337036a546e5c28aea76cf424ac172db5156bd8a8fd85252e389409a5ba63
+PKG_HASH:=53c8386b2123af97626d3438b3e4058e0c5914cb74b048a6676c57ac647f5eae
PKG_BUILD_PARALLEL:=1
PKG_BUILD_FLAGS:=no-mips16
include $(TOPDIR)/rules.mk
PKG_NAME:=django-restframework
-PKG_VERSION:=3.14.0
+PKG_VERSION:=3.15.1
PKG_RELEASE:=1
PYPI_NAME:=djangorestframework
-PKG_HASH:=579a333e6256b09489cbe0a067e66abe55c6595d8926be6b99423786334350c8
+PKG_HASH:=f88fad74183dfc7144b2756d0d2ac716ea5b4c7c9840995ac3bfd8ec034333c1
PKG_MAINTAINER:=Alexandru Ardelean <ardeleanalex@gmail.com>
PKG_LICENSE:=BSD-3-Clause
include $(TOPDIR)/rules.mk
PKG_NAME:=django
-PKG_VERSION:=5.0.3
+PKG_VERSION:=5.0.4
PKG_RELEASE:=1
PYPI_NAME:=Django
-PKG_HASH:=5fb37580dcf4a262f9258c1f4373819aacca906431f505e4688e37f3a99195df
+PKG_HASH:=4bd01a8c830bb77a8a3b0e7d8b25b887e536ad17a81ba2dce5476135c73312bd
PKG_MAINTAINER:=Alexandru Ardelean <ardeleanalex@gmail.com>, Peter Stadler <peter.stadler@student.uibk.ac.at>
PKG_LICENSE:=BSD-3-Clause
include $(TOPDIR)/rules.mk
PKG_NAME:=numpy
-PKG_VERSION:=1.26.3
+PKG_VERSION:=1.26.4
PKG_RELEASE:=1
PYPI_NAME:=$(PKG_NAME)
-PKG_HASH:=697df43e2b6310ecc9d95f05d5ef20eacc09c7c4ecc9da3f235d39e71b7da1e4
+PKG_HASH:=2a02aba9ed12e4ac4eb3ea9421c420301a0c6460d9830d74a9df87efa4912010
PKG_MAINTAINER:=Alexandru Ardelean <ardeleanalex@gmail.com>
--- a/pyproject.toml
+++ b/pyproject.toml
-@@ -1,6 +1,6 @@
+@@ -1,8 +1,8 @@
[build-system]
-build-backend = "mesonpy"
--backend-path = ['./vendored-meson/meson-python']
+#build-backend = "mesonpy"
-+#backend-path = ['./vendored-meson/meson-python']
requires = [
"Cython>=0.29.34,<3.1",
- # All dependencies of the vendored meson-python (except for meson, because
-@@ -194,8 +194,8 @@ repair-wheel-command = ""
+- "meson-python>=0.15.0,<0.16.0",
++# "meson-python>=0.15.0,<0.16.0",
+ ]
+
+ [project]
+@@ -181,14 +181,14 @@ environment = {PKG_CONFIG_PATH="/opt/32/
+ config-settings = "setup-args=--vsenv setup-args=-Dallow-noblas=true"
+ repair-wheel-command = ""
+
+-[tool.meson-python]
+-meson = 'vendored-meson/meson/meson.py'
++#[tool.meson-python]
++#meson = 'vendored-meson/meson/meson.py'
+
[tool.spin]
package = 'numpy'
include $(TOPDIR)/rules.mk
PKG_NAME:=python-cython
-PKG_VERSION:=3.0.7
+PKG_VERSION:=3.0.10
PKG_RELEASE:=1
PYPI_NAME:=Cython
-PKG_HASH:=fb299acf3a578573c190c858d49e0cf9d75f4bc49c3f24c5a63804997ef09213
+PKG_HASH:=dcc96739331fb854dcf503f94607576cfe8488066c61ca50dfd55836f132de99
PKG_LICENSE:=Apache-2.0
PKG_LICENSE_FILES:=LICENSE.txt
PKG_LICENSE:=BSD-3-Clause
PKG_LICENSE_FILES:=LICENSE.rst
PKG_CPE_ID:=cpe:/a:pocoo:jinja2
+HOST_BUILD_DEPENDS:= python-markupsafe/host
include ../pypi.mk
include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/host-build.mk
include ../python3-package.mk
+include ../python3-host-build.mk
define Package/python3-jinja2
SECTION:=lang
$(eval $(call Py3Package,python3-jinja2))
$(eval $(call BuildPackage,python3-jinja2))
$(eval $(call BuildPackage,python3-jinja2-src))
+$(eval $(call HostBuild))
include $(TOPDIR)/rules.mk
PKG_NAME:=python-lxml
-PKG_VERSION:=5.1.0
+PKG_VERSION:=5.2.1
PKG_RELEASE:=1
PYPI_NAME:=lxml
-PKG_HASH:=3eea6ed6e6c918e468e693c41ef07f3c3acc310b70ddd9cc72d9ef84bc9564ca
+PKG_HASH:=3f7765e69bbce0906a7c74d5fe46d2c7a7596147318dbc08e4a2431f3060e306
PKG_LICENSE:=BSD-3-Clause
PKG_LICENSE_FILES:=LICENSES.txt
PKG_MAINTAINER:=Alexandru Ardelean <ardeleanalex@gmail.com>
PKG_CPE_ID:=cpe:/a:lxml:lxml
+PKG_BUILD_DEPENDS:=python-cython/host
+
include ../pypi.mk
include $(INCLUDE_DIR)/package.mk
include ../python3-package.mk
PKG_CPE_ID:=cpe:/a:pyyaml:pyyaml
PKG_BUILD_DEPENDS:=python-cython/host
+HOST_BUILD_DEPENDS:=python-cython/host
include ../pypi.mk
include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/host-build.mk
include ../python3-package.mk
+include ../python3-host-build.mk
define Package/python3-yaml
SECTION:=lang
$(eval $(call Py3Package,python3-yaml))
$(eval $(call BuildPackage,python3-yaml))
$(eval $(call BuildPackage,python3-yaml-src))
+$(eval $(call HostBuild))
include $(TOPDIR)/rules.mk
PKG_NAME:=c-ares
-PKG_VERSION:=1.27.0
+PKG_VERSION:=1.28.1
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://c-ares.org/download
-PKG_HASH:=0a72be66959955c43e2af2fbd03418e82a2bd5464604ec9a62147e37aceb420b
+PKG_HASH:=675a69fc54ddbf42e6830bc671eeb6cd89eeca43828eb413243fd2c0a760809d
PKG_LICENSE:=MIT
PKG_LICENSE_FILES:=LICENSE.md
PKG_NAME:=glib2
PKG_VERSION:=2.74.7
-PKG_RELEASE:=2
+PKG_RELEASE:=3
PKG_SOURCE:=glib-$(PKG_VERSION).tar.xz
PKG_SOURCE_URL:=@GNOME/glib/$(basename $(PKG_VERSION))
PKG_BUILD_FLAGS:=gc-sections
HOST_BUILD_DIR:=$(BUILD_DIR_HOST)/glib-$(PKG_VERSION)
-HOST_BUILD_DEPENDS:=pcre2/host libffi/host
+HOST_BUILD_DEPENDS:=pcre2/host libffi/host libiconv-full/host
include $(INCLUDE_DIR)/host-build.mk
include $(INCLUDE_DIR)/package.mk
PKG_SOURCE_URL:=https://github.com/vathpela/gnu-efi.git
PKG_SOURCE_DATE:=2023-06-11
PKG_SOURCE_VERSION:=64027ee9864d8a8685ae187eb91ddc519d18cedb
-PKG_MIRROR_HASH:=738addbaba775ca1fc8d31a4bb2cbea1b8a0ac9aa888434f36264b2b0ce1dc5b
+PKG_MIRROR_HASH:=db730ab78f501b2f324edc9a91307eab1f1c5027f9c8fe63bd72364eddaf4553
PKG_BUILD_PARALLEL:=1
PKG_MAINTAINER:=Oskari Rauta <oskari.rauta@gmail.com>
PKG_NAME:=gost_engine
PKG_VERSION:=3.0.3
-PKG_HASH:=8cf888333d08b8bbcc12e4e8c0d8b258c74dbd67941286ffbcc648c6d3d66735
-PKG_LICENSE:=Apache-2.0
-PKG_RELEASE:=9
+PKG_RELEASE:=10
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://github.com/gost-engine/engine/archive/v$(PKG_VERSION)
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_VERSION:=v$(PKG_VERSION)
+PKG_SOURCE_URL:=https://github.com/gost-engine/engine
+PKG_MIRROR_HASH:=ad88b0bc4ede265bc91757f0bb9777a381f8e271faa43992a054ddd5f435ad88
PKG_MAINTAINER:=Artur Petrov <github@phpchain.ru>
+PKG_LICENSE:=Apache-2.0
+PKG_LICENSE_FILES:=LICENSE
include $(INCLUDE_DIR)/package.mk
include $(INCLUDE_DIR)/cmake.mk
-PKG_UNPACK:=$(HOST_TAR) -C "$(PKG_BUILD_DIR)" --strip-components=1 -xzf "$(DL_DIR)/$(PKG_SOURCE)"
-PKG_INSTALL:=
-
define Package/gost_engine/Default
$(call Package/openssl/engine/Default)
TITLE:=GOST engine for OpenSSL
$(call Package/gost_engine/Default)
SECTION:=utils
CATEGORY:=Utilities
- DEPENDS:=libopenssl-gost_engine
+ DEPENDS:=+libopenssl-gost_engine
TITLE+= (utilities)
endef
CMAKE_OPTIONS += -DOPENSSL_ENGINES_DIR=/usr/lib/$(ENGINES_DIR)
define Package/libopenssl-gost_engine/install
- $(INSTALL_DIR) $(1)/usr/lib/$(ENGINES_DIR) $(1)/etc/ssl/engines.cnf.d
- $(INSTALL_DATA) $(PKG_BUILD_DIR)/bin/gost.so \
+ $(INSTALL_DIR) $(1)/usr/lib $(1)/usr/lib/$(ENGINES_DIR) $(1)/etc/ssl/engines.cnf.d
+ $(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/lib/libgost.so \
+ $(1)/usr/lib/
+ $(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/lib/$(ENGINES_DIR)/gost.so \
$(1)/usr/lib/$(ENGINES_DIR)/
$(INSTALL_DATA) ./files/gost.cnf $(1)/etc/ssl/engines.cnf.d/
endef
define Package/gost_engine-util/install
$(INSTALL_DIR) $(1)/usr/bin
- $(INSTALL_BIN) $(PKG_BUILD_DIR)/bin/{gost12sum,gostsum} \
+ $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/{gost12sum,gostsum} \
$(1)/usr/bin/
endef
SECTION:=libs
TITLE:=Gperftools Headers
URL:=https://github.com/gperftools/gperftools
- DEPENDS:= @!mips @!mipsel @!powerpc
+ DEPENDS:= @!(mips||mips64||mipsel||powerpc)
endef
define Package/gperftools-runtime
CATEGORY:=Libraries
TITLE:=Gperftools Runtime
URL:=https://github.com/gperftools/gperftools
- DEPENDS:= +libunwind +libstdcpp @!mips @!mipsel @!powerpc
+ DEPENDS:= +libunwind +libstdcpp @!(mips||mips64||mipsel||powerpc)
endef
define Package/gperftools-headers/description
PKG_NAME:=ibrcommon
PKG_VERSION:=1.0.1
-PKG_RELEASE:=9
+PKG_RELEASE:=10
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=http://www.ibr.cs.tu-bs.de/projects/ibr-dtn/releases
--- a/ibrcommon/data/File.cpp
+++ b/ibrcommon/data/File.cpp
-@@ -35,9 +35,7 @@
+@@ -35,10 +35,6 @@
#include <cerrno>
#include <fstream>
-#if !defined(HAVE_FEATURES_H) || defined(ANDROID)
- #include <libgen.h>
+-#include <libgen.h>
-#endif
-
+-
#ifdef __WIN32__
#include <io.h>
-@@ -226,7 +224,7 @@ namespace ibrcommon
+ #define FILE_DELIMITER_CHAR '\\'
+@@ -225,14 +221,11 @@ namespace ibrcommon
+
std::string File::getBasename() const
{
- #if !defined(ANDROID) && defined(HAVE_FEATURES_H)
+-#if !defined(ANDROID) && defined(HAVE_FEATURES_H)
- return std::string(basename(_path.c_str()));
-+ return std::string(basename((char *)_path.c_str()));
- #else
- char path[_path.length()+1];
- ::memcpy(&path, _path.c_str(), _path.length()+1);
+-#else
+- char path[_path.length()+1];
+- ::memcpy(&path, _path.c_str(), _path.length()+1);
+-
+- return std::string(basename(path));
+-#endif
++ size_t found = _path.find_last_of('/');
++ if (found != std::string::npos)
++ return _path.substr(found + 1);
++ else
++ return _path;
+ }
+
+ File File::get(const std::string &filename) const
include $(TOPDIR)/rules.mk
PKG_NAME:=libarchive
-PKG_VERSION:=3.7.2
+PKG_VERSION:=3.7.3
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
PKG_SOURCE_URL:=https://www.libarchive.org/downloads
-PKG_HASH:=04357661e6717b6941682cde02ad741ae4819c67a260593dfb2431861b251acb
+PKG_HASH:=63e7a7174638fc7d6b79b4c8b0ad954e0f4f45abe7239c1ecb200232aa9a43d2
PKG_MAINTAINER:=Johannes Morgenroth <morgenroth@ibr.cs.tu-bs.de>
PKG_LICENSE:=BSD-2-Clause
include $(TOPDIR)/rules.mk
PKG_NAME:=libdeflate
-PKG_VERSION:=1.19
+PKG_VERSION:=1.20
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://github.com/ebiggers/libdeflate/releases/download/v$(PKG_VERSION)
-PKG_HASH:=d9bb9bdd8cc5a8c1f7f6226fa0053dd72861e15f366e7ff7d0d191eac16d66f3
+PKG_HASH:=c52cf0239fd644d71c9e88613dd7431a5306ebee1280c5791c71ca264869250a
PKG_LICENSE:=COPYING
PKG_LICENSE_FILES:=MIT
include $(TOPDIR)/rules.mk
PKG_NAME:=libdrm
-PKG_VERSION:=2.4.115
+PKG_VERSION:=2.4.120
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
PKG_SOURCE_URL:=https://dri.freedesktop.org/libdrm
-PKG_HASH:=554cfbfe0542bddb391b4e3e05bfbbfc3e282b955bd56218d21c0616481f65eb
+PKG_HASH:=3bf55363f76c7250946441ab51d3a6cc0ae518055c0ff017324ab76cdefb327a
PKG_MAINTAINER:=Lucian Cristian <lucian.cristian@gmail.com>
PKG_LICENSE:=BSD-3-Clause
include $(TOPDIR)/rules.mk
PKG_NAME:=libevdev
-PKG_VERSION:=1.13.0
+PKG_VERSION:=1.13.1
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
PKG_SOURCE_URL:=https://www.freedesktop.org/software/libevdev/
-PKG_HASH:=9edf2006cc86a5055279647c38ec923d11a821ee4dc2c3033e8d20e8ee237cd9
+PKG_HASH:=06a77bf2ac5c993305882bc1641017f5bec1592d6d1b64787bad492ab34f2f36
PKG_MAINTAINER:=Daniel Golle <daniel@makrotopia.org>
PKG_LICENSE:=MIT
include $(TOPDIR)/rules.mk
PKG_NAME:=libmbim
-PKG_SOURCE_VERSION:=1.30.0
-PKG_RELEASE:=1
+PKG_VERSION:=1.30.0
+PKG_RELEASE:=2
PKG_SOURCE_PROTO:=git
PKG_SOURCE_URL:=https://gitlab.freedesktop.org/mobile-broadband/libmbim.git
+PKG_SOURCE_VERSION:=$(PKG_VERSION)
PKG_MIRROR_HASH:=792c2310290ac3a2ee690e25eda7c79c1e982aa41b3bff2be7454f3505a09827
PKG_BUILD_FLAGS:=gc-sections
--- /dev/null
+From 47c3850cddd63cebd9dc48e411963314449118f1 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Sun, 31 Dec 2023 19:16:35 -0800
+Subject: [PATCH] mraa: Use posix basename
+
+Musl has removed the declaration from string.h [1] which exposes the
+problem especially with clang-17+ compiler where implicit function
+declaration is flagged as error. Use posix basename and make a copy of
+string to operate on to emulate GNU basename behaviour.
+
+[1] https://git.musl-libc.org/cgit/musl/commit/?id=725e17ed6dff4d0cd22487bb64470881e86a92e7
+
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ src/mraa.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/src/mraa.c
++++ b/src/mraa.c
+@@ -12,6 +12,7 @@
+ #endif
+
+ #include <dlfcn.h>
++#include <libgen.h>
+ #include <pwd.h>
+ #include <sched.h>
+ #include <stddef.h>
+@@ -338,9 +339,11 @@ static int
+ mraa_count_iio_devices(const char* path, const struct stat* sb, int flag, struct FTW* ftwb)
+ {
+ // we are only interested in files with specific names
+- if (fnmatch(IIO_DEVICE_WILDCARD, basename(path), 0) == 0) {
++ char* tmp = strdup(path);
++ if (fnmatch(IIO_DEVICE_WILDCARD, basename(tmp), 0) == 0) {
+ num_iio_devices++;
+ }
++ free(tmp);
+ return 0;
+ }
+
include $(TOPDIR)/rules.mk
PKG_NAME:=libpciaccess
-PKG_VERSION:=0.17
+PKG_VERSION:=0.18.1
PKG_RELEASE:=1
PKG_SOURCE_URL:=https://www.x.org/releases/individual/lib/
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
-PKG_HASH:=74283ba3c974913029e7a547496a29145b07ec51732bbb5b5c58d5025ad95b73
+PKG_HASH:=4af43444b38adb5545d0ed1c2ce46d9608cc47b31c2387fc5181656765a6fa76
PKG_MAINTAINER:= Lucian Cristian <lucian.cristian@gmail.com>
PKG_LICENSE:=MIT
PKG_BUILD_PARALLEL:=1
include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/meson.mk
define Package/libpciaccess
SECTION:=libs
CATEGORY:=Libraries
TITLE:=Generic PCI access library
- URL:=https://xorg.freedesktop.org/
+ URL:=https://gitlab.freedesktop.org/xorg/lib/libpciaccess
endef
-CONFIGURE_ARGS += \
- --prefix=/usr
-
-TARGET_LDFLAGS += -Wl,--gc-sections,--as-needed
+MESON_ARGS += -Dzlib=disabled
define Build/InstallDev
$(INSTALL_DIR) \
+++ /dev/null
-From 833c86ce15cee2a84a37ae71015f236fd32615d9 Mon Sep 17 00:00:00 2001
-From: Khem Raj <raj.khem@gmail.com>
-Date: Fri, 11 Nov 2022 11:15:58 -0800
-Subject: [PATCH] linux_sysfs: Use pwrite/pread instead of 64bit versions
-
-pread64/pwrite64 are aliased to pread/pwrite when largefile support is
-enabled e.g. using _FILE_OFFSET_BITS=64 macro
-
-This helps it compile on latest musl C library based systems where these
-functions are put under _LARGEFILE64_SOURCE which is to be removed once
-all packages start using 64bit off_t, it works with glibc becuase
-_GNU_SOURCE feature macro also defines _LARGEFILE64_SOURCE, thats not
-the case with musl
-
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
----
- src/linux_sysfs.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/src/linux_sysfs.c
-+++ b/src/linux_sysfs.c
-@@ -462,7 +462,7 @@ pci_device_linux_sysfs_read( struct pci_
-
-
- while ( temp_size > 0 ) {
-- const ssize_t bytes = pread64( fd, data_bytes, temp_size, offset );
-+ const ssize_t bytes = pread( fd, data_bytes, temp_size, offset );
-
- /* If zero bytes were read, then we assume it's the end of the
- * config file.
-@@ -522,7 +522,7 @@ pci_device_linux_sysfs_write( struct pci
-
-
- while ( temp_size > 0 ) {
-- const ssize_t bytes = pwrite64( fd, data_bytes, temp_size, offset );
-+ const ssize_t bytes = pwrite( fd, data_bytes, temp_size, offset );
-
- /* If zero bytes were written, then we assume it's the end of the
- * config file.
include $(TOPDIR)/rules.mk
PKG_NAME:=libpng
-PKG_VERSION:=1.6.42
+PKG_VERSION:=1.6.43
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
PKG_SOURCE_URL:=@SF/libpng
-PKG_HASH:=c919dbc11f4c03b05aba3f8884d8eb7adfe3572ad228af972bb60057bdb48450
+PKG_HASH:=6a5ca0652392a2d7c9db2ae5b40210843c0bbc081cbd410825ab00cc59f14a6c
PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
PKG_LICENSE:=Libpng GPL-2.0-or-later BSD-3-Clause
include $(TOPDIR)/rules.mk
PKG_NAME:=libqmi
-PKG_SOURCE_VERSION:=1.34.0
-PKG_RELEASE:=1
+PKG_VERSION:=1.34.0
+PKG_RELEASE:=2
PKG_SOURCE_PROTO:=git
PKG_SOURCE_URL:=https://gitlab.freedesktop.org/mobile-broadband/libqmi.git
+PKG_SOURCE_VERSION:=$(PKG_VERSION)
PKG_MIRROR_HASH:=05211a43de53b7bf967fe29ca62dbe8332f42748dbfc8d32880cda765d00020c
PKG_BUILD_FLAGS:=gc-sections
include $(TOPDIR)/rules.mk
PKG_NAME:=libssh
-PKG_VERSION:=0.10.4
-PKG_RELEASE:=2
+PKG_VERSION:=0.10.6
+PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
PKG_SOURCE_URL:=https://www.libssh.org/files/0.10/
-PKG_HASH:=07392c54ab61476288d1c1f0a7c557b50211797ad00c34c3af2bbc4dbc4bd97d
+PKG_HASH:=1861d498f5b6f1741b6abc73e608478491edcf9c9d4b6630eef6e74596de9dc1
PKG_MAINTAINER:=Mislav Novakovic <mislav.novakovic@sartura.hr>
PKG_LICENSE:=LGPL-2.1-or-later BSD-2-Clause
--- /dev/null
+--- a/cmake/Modules/FindMbedTLS.cmake
++++ b/cmake/Modules/FindMbedTLS.cmake
+@@ -34,7 +34,7 @@ set(_MBEDTLS_ROOT_HINTS_AND_PATHS
+
+ find_path(MBEDTLS_INCLUDE_DIR
+ NAMES
+- mbedtls/config.h
++ mbedtls/version.h
+ HINTS
+ ${_MBEDTLS_ROOT_HINTS_AND_PATHS}
+ PATH_SUFFIXES
+@@ -72,7 +72,13 @@ find_library(MBEDTLS_X509_LIBRARY
+ set(MBEDTLS_LIBRARIES ${MBEDTLS_SSL_LIBRARY} ${MBEDTLS_CRYPTO_LIBRARY}
+ ${MBEDTLS_X509_LIBRARY})
+
+-if (MBEDTLS_INCLUDE_DIR AND EXISTS "${MBEDTLS_INCLUDE_DIR}/mbedtls/version.h")
++if (MBEDTLS_INCLUDE_DIR AND EXISTS "${MBEDTLS_INCLUDE_DIR}/mbedtls/build_info.h")
++ file(STRINGS "${MBEDTLS_INCLUDE_DIR}/mbedtls/build_info.h" _mbedtls_version_str REGEX
++ "^#[\t ]*define[\t ]+MBEDTLS_VERSION_STRING[\t ]+\"[0-9]+.[0-9]+.[0-9]+\"")
++
++ string(REGEX REPLACE "^.*MBEDTLS_VERSION_STRING.*([0-9]+.[0-9]+.[0-9]+).*"
++ "\\1" MBEDTLS_VERSION "${_mbedtls_version_str}")
++elseif (MBEDTLS_INCLUDE_DIR AND EXISTS "${MBEDTLS_INCLUDE_DIR}/mbedtls/version.h")
+ file(STRINGS "${MBEDTLS_INCLUDE_DIR}/mbedtls/version.h" _mbedtls_version_str REGEX
+ "^#[\t ]*define[\t ]+MBEDTLS_VERSION_STRING[\t ]+\"[0-9]+.[0-9]+.[0-9]+\"")
+
+@@ -93,7 +99,7 @@ if (MBEDTLS_VERSION)
+ in the system variable MBEDTLS_ROOT_DIR"
+ )
+ else (MBEDTLS_VERSION)
+- find_package_handle_standard_args(MBedTLS
++ find_package_handle_standard_args(MbedTLS
+ "Could NOT find mbedTLS, try to set the path to mbedLS root folder in
+ the system variable MBEDTLS_ROOT_DIR"
+ MBEDTLS_INCLUDE_DIR
+--- a/src/libmbedcrypto.c
++++ b/src/libmbedcrypto.c
+@@ -118,8 +118,14 @@ int hmac_update(HMACCTX c, const void *d
+
+ int hmac_final(HMACCTX c, unsigned char *hashmacbuf, size_t *len)
+ {
++ const mbedtls_md_info_t *md_info;
+ int rc;
+- *len = (unsigned int)mbedtls_md_get_size(c->md_info);
++#if MBEDTLS_VERSION_MAJOR >= 3
++ md_info = mbedtls_md_info_from_ctx(c);
++#else
++ md_info = c->md_info;
++#endif
++ *len = (unsigned int)mbedtls_md_get_size(md_info);
+ rc = !mbedtls_md_hmac_finish(c, hashmacbuf);
+ mbedtls_md_free(c);
+ SAFE_FREE(c);
include $(TOPDIR)/rules.mk
PKG_NAME:=libwebp
-PKG_VERSION:=1.3.2
+PKG_VERSION:=1.4.0
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://storage.googleapis.com/downloads.webmproject.org/releases/webp
-PKG_HASH:=2a499607df669e40258e53d0ade8035ba4ec0175244869d1025d460562aa09b4
+PKG_HASH:=61f873ec69e3be1b99535634340d5bde750b2e4447caa1db9f61be3fd49ab1e5
PKG_MAINTAINER:=Alexandru Ardelean <ardeleanalex@gmail.com>
PKG_LICENSE:=BSD-3-Clause
PKG_SOURCE_PROTO:=git
PKG_SOURCE_URL:=https://code.videolan.org/videolan/x264.git
PKG_SOURCE_VERSION:=4815ccadb1890572f2bf8b9d9553d56f6c9122ad
-PKG_MIRROR_HASH:=6a8179183bdd88f2d7032342c23670e66571724ad774f96a6abac19f8eb7aad4
+PKG_MIRROR_HASH:=50ab1157a4a026e44f551ea9d62c82626c88711f033a171e5031f2bf87b06eab
PKG_MAINTAINER:=Adrian Panella <ianchi74@outlook.com>
PKG_LICENSE:=GPL-2.0-or-later
include $(TOPDIR)/rules.mk
PKG_NAME:=mtdev
-PKG_VERSION:=1.1.6
-PKG_RELEASE:=2
+PKG_VERSION:=1.1.7
+PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
PKG_SOURCE_URL:=http://bitmath.org/code/mtdev/
-PKG_HASH:=15d7b28da8ac71d8bc8c9287c2045fd174267bc740bec10cfda332dc1204e0e0
+PKG_HASH:=a107adad2101fecac54ac7f9f0e0a0dd155d954193da55c2340c97f2ff1d814e
PKG_MAINTAINER:=Daniel Golle <daniel@makrotopia.org>
PKG_LICENSE:=MIT
include $(TOPDIR)/rules.mk
PKG_NAME:=nghttp2
-PKG_VERSION:=1.57.0
+PKG_VERSION:=1.61.0
PKG_RELEASE:=1
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://github.com/nghttp2/nghttp2/releases/download/v$(PKG_VERSION)
-PKG_HASH:=9210b0113109f43be526ac5835d58a701411821a4d39e155c40d67c40f47a958
+PKG_HASH:=aa7594c846e56a22fbf3d6e260e472268808d3b49d5e0ed339f589e9cc9d484c
PKG_MAINTAINER:=Hans Dedecker <dedeckeh@gmail.com>
PKG_LICENSE:=MIT
PKG_NAME:=nghttp3
PKG_VERSION:=1.2.0
-PKG_RELEASE:=r1
+PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
PKG_SOURCE_URL:=https://github.com/ngtcp2/$(PKG_NAME)/releases/download/v$(PKG_VERSION)/
PKG_NAME:=ngtcp2
PKG_VERSION:=1.4.0
-PKG_RELEASE:=r1
+PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
PKG_SOURCE_URL:=https://github.com/ngtcp2/$(PKG_NAME)/releases/download/v$(PKG_VERSION)/
include $(TOPDIR)/rules.mk
PKG_NAME:=OpenBLAS
-PKG_VERSION:=0.3.26
-PKG_RELEASE:=2
+PKG_VERSION:=0.3.27
+PKG_RELEASE:=1
PKG_SOURCE:=OpenBLAS-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://github.com/xianyi/OpenBLAS/releases/download/v$(PKG_VERSION)/
-PKG_HASH:=4e6e4f5cb14c209262e33e6816d70221a2fe49eb69eaf0a06f065598ac602c68
+PKG_HASH:=aa2d68b1564fe2b13bc292672608e9cdeeeb6dc34995512e65c3b10f4599e897
PKG_LICENSE:=BSD-3-Clause
PKG_CPE_ID:=cpe:/a:openblas_project:openblas
PKG_MAINTAINER:=Alexandru Ardelean <ardeleanalex@gmail.com>
NUM_THREADS=2 \
PREFIX=/usr \
COMMON_OPT="" \
+ ONLY_CBLAS=1 \
TARGET=$(call qstrip,$(OPENBLAS_TARGET))
ifneq ($(CONFIG_INSTALL_GFORTRAN),y)
include $(TOPDIR)/rules.mk
PKG_NAME:=pixman
-PKG_VERSION:=0.40.0
+PKG_VERSION:=0.43.4
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://www.cairographics.org/releases
-PKG_HASH:=6d200dec3740d9ec4ec8d1180e25779c00bc749f94278c8b9021f5534db223fc
+PKG_HASH:=a0624db90180c7ddb79fc7a9151093dc37c646d8c38d3f232f767cf64b85a226
PKG_MAINTAINER:=Yousong Zhou <yszhou4tech@gmail.com>
PKG_LICENSE:=MIT
SECTION:=libs
CATEGORY:=Libraries
TITLE:=a low-level software library for pixel manipulation
- URL:=http://www.pixman.org/
+ URL:=https://www.pixman.org/
endef
define Package/pixman/description
+++ /dev/null
---- a/configure.ac
-+++ b/configure.ac
-@@ -735,7 +735,6 @@ dnl Check if assembler is gas compatible
- have_mips_dspr2=no
- AC_MSG_CHECKING(whether to use MIPS DSPr2 assembler)
- xserver_save_CFLAGS=$CFLAGS
--CFLAGS="-mdspr2 $CFLAGS"
-
- AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
- #if !(defined(__mips__) && __mips_isa_rev >= 2)
PKG_NAME:=protobuf
PKG_VERSION:=3.17.3
-PKG_RELEASE:=1
+PKG_RELEASE:=2
PKG_SOURCE:=$(PKG_NAME)-cpp-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://github.com/google/protobuf/releases/download/v$(PKG_VERSION)
CMAKE_HOST_OPTIONS += \
-Dprotobuf_BUILD_PROTOC_BINARIES=ON \
-Dprotobuf_BUILD_TESTS=OFF \
- -DBUILD_SHARED_LIBS=ON \
- -DCMAKE_SKIP_RPATH=OFF \
- -DCMAKE_INSTALL_LIBDIR=lib \
- -DCMAKE_INSTALL_RPATH="${STAGING_DIR_HOSTPKG}/lib"
+ -DBUILD_SHARED_LIBS=OFF \
+ -DCMAKE_INSTALL_LIBDIR=lib
CMAKE_OPTIONS += \
-Dprotobuf_BUILD_PROTOC_BINARIES=ON \
-Dprotobuf_WITH_ZLIB=ON \
-DBUILD_SHARED_LIBS=ON
-TARGET_LDFLAGS += -latomic $(if $(CONFIG_USE_GLIBC),-lm)
+TARGET_LDFLAGS += -latomic
define Build/InstallDev
$(call Build/InstallDev/cmake,$(1))
include $(TOPDIR)/rules.mk
PKG_NAME:=exim
-PKG_VERSION:=4.96.2
+PKG_VERSION:=4.97.1
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
PKG_SOURCE_URL:=https://ftp.exim.org/pub/exim/exim4/
-PKG_HASH:=038e327e8d1e93d005bac9bb06fd22aec44d5028930d6dbe8817ad44bbfc1de6
+PKG_HASH:=bd782057509a793593508528590626d185ea160ce32cb34beda262e99cefdfa9
PKG_MAINTAINER:=Daniel Golle <daniel@makrotopia.org>
PKG_LICENSE:=GPL-2.0-or-later
endef
HOST_CFLAGS += -std=c99
-TARGET_CFLAGS += $(FPIC) -DNO_IP_OPTIONS -D_FILE_OFFSET_BITS=64
+TARGET_CFLAGS += $(FPIC) -DNO_IP_OPTIONS -D_FILE_OFFSET_BITS=64 -DNO_EXECINFO
MAKE_VARS += build=Linux-$$(ARCH)
MAKE_FLAGS += AR="$$(TARGET_AR) r"
$(SED) 's%# EXIM_GROUP=.*%EXIM_GROUP=42%' $(PKG_BUILD_DIR)/Local/Makefile
$(SED) 's%# EXIM_USER=.*%EXIM_USER=42%' $(PKG_BUILD_DIR)/Local/Makefile
$(SED) 's%# INCLUDE=.*%INCLUDE=-I$(STAGING_DIR)/usr/include -I$(STAGING_DIR)/usr/include%' $(PKG_BUILD_DIR)/Local/Makefile
- $(SED) 's%# HAVE_IPV6=YES%HAVE_IPV6=YES%' $(PKG_BUILD_DIR)/Local/Makefile
+ $(SED) 's%# HAVE_IPV6=yes%HAVE_IPV6=yes%' $(PKG_BUILD_DIR)/Local/Makefile
$(SED) 's%# WITH_CONTENT_SCAN=yes%WITH_CONTENT_SCAN=yes%' $(PKG_BUILD_DIR)/Local/Makefile
$(SED) 's%# SUPPORT_MAILDIR=yes%SUPPORT_MAILDIR=yes%' $(PKG_BUILD_DIR)/Local/Makefile
$(SED) 's%# SUPPORT_MAILSTORE=yes%SUPPORT_MAILSTORE=yes%' $(PKG_BUILD_DIR)/Local/Makefile
--- a/src/drtables.c
+++ b/src/drtables.c
-@@ -662,7 +662,7 @@ addlookupmodule(NULL, &ibase_lookup_modu
+@@ -663,7 +663,7 @@ addlookupmodule(NULL, &ibase_lookup_modu
addlookupmodule(NULL, &ldap_lookup_module_info);
#endif
}
--- a/src/pdkim/signing.c
+++ b/src/pdkim/signing.c
-@@ -703,7 +703,6 @@ return NULL;
+@@ -704,7 +704,6 @@ return NULL;
void
exim_dkim_init(void)
{
--- a/src/tls-openssl.c
+++ b/src/tls-openssl.c
-@@ -22,7 +22,10 @@ functions from the OpenSSL library. */
+@@ -23,7 +23,10 @@ functions from the OpenSSL library. */
#include <openssl/lhash.h>
#include <openssl/ssl.h>
#include <openssl/err.h>
#ifndef OPENSSL_NO_ECDH
# include <openssl/ec.h>
#endif
-@@ -885,8 +888,9 @@ pkey = EVP_RSA_gen(2048);
+@@ -944,8 +947,9 @@ pkey = EVP_RSA_gen(2048);
X509_set_version(x509, 2); /* N+1 - version 3 */
ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);
X509_set_pubkey(x509, pkey);
name = X509_get_subject_name(x509);
-@@ -4670,8 +4674,8 @@ return string_fmt_append(g,
+@@ -4979,8 +4983,8 @@ return string_fmt_append(g,
" Runtime: %s\n"
" : %s\n",
OPENSSL_VERSION_TEXT,
/* third line is 38 characters for the %s and the line is 73 chars long;
the OpenSSL output includes a "built on: " prefix already. */
}
-@@ -4713,8 +4717,6 @@ if (pidnow != pidlast)
+@@ -5022,8 +5026,6 @@ if (pidnow != pidlast)
is unique for each thread", this doesn't apparently apply across processes,
so our own warning from vaguely_random_number_fallback() applies here too.
Fix per PostgreSQL. */
--- a/src/tlscert-openssl.c
+++ b/src/tlscert-openssl.c
-@@ -218,13 +218,13 @@ return mod ? tls_field_from_dn(cp, mod)
+@@ -219,13 +219,13 @@ return mod ? tls_field_from_dn(cp, mod)
uschar *
tls_cert_not_before(void * cert, uschar * mod)
{
--- a/src/EDITME
+++ b/src/EDITME
-@@ -873,6 +873,21 @@ HEADERS_CHARSET="ISO-8859-1"
+@@ -904,6 +904,21 @@ HEADERS_CHARSET="ISO-8859-1"
#------------------------------------------------------------------------------
#define CONFIGURE_FILE
--- a/src/globals.c
+++ b/src/globals.c
-@@ -117,6 +117,10 @@ int dsn_ret = 0;
+@@ -118,6 +118,10 @@ int dsn_ret = 0;
const pcre2_code *regex_DSN = NULL;
uschar *dsn_advertise_hosts = NULL;
BOOL gnutls_allow_auto_pkcs11 = FALSE;
--- a/src/globals.h
+++ b/src/globals.h
-@@ -155,6 +155,9 @@ extern int dsn_ret; /
+@@ -157,6 +157,9 @@ extern int dsn_ret; /
extern const pcre2_code *regex_DSN; /* For recognizing DSN settings */
extern uschar *dsn_advertise_hosts; /* host for which TLS is advertised */
--- a/src/local_scan.c
+++ b/src/local_scan.c
-@@ -7,58 +7,133 @@
- /* See the file NOTICE for conditions of use and distribution. */
+@@ -8,58 +8,133 @@
+ /* SPDX-License-Identifier: GPL-2.0-or-later */
-/******************************************************************************
/* End of local_scan.c */
--- a/src/local_scan.h
+++ b/src/local_scan.h
-@@ -27,6 +27,7 @@ settings, and the store functions. */
+@@ -28,6 +28,7 @@ settings, and the store functions. */
#include <stdarg.h>
#include <sys/types.h>
#include "config.h"
#include "mytypes.h"
#include "store.h"
-@@ -166,6 +167,9 @@ extern header_line *header_list; /
+@@ -177,6 +178,9 @@ extern header_line *header_list; /
extern BOOL host_checking; /* Set when checking a host */
extern uschar *interface_address; /* Interface for incoming call */
extern int interface_port; /* Port number for incoming call */
extern uschar *message_id; /* Internal id of message being handled */
extern uschar *received_protocol; /* Name of incoming protocol */
extern int recipients_count; /* Number of recipients */
-@@ -236,4 +240,6 @@ extern pid_t child_open_exim2_functio
+@@ -247,4 +251,6 @@ extern pid_t child_open_exim2_functio
extern pid_t child_open_function(uschar **, uschar **, int, int *, int *, BOOL, const uschar *);
#endif
/* End of local_scan.h */
--- a/src/readconf.c
+++ b/src/readconf.c
-@@ -212,6 +212,9 @@ static optionlist optionlist_config[] =
+@@ -216,6 +216,9 @@ static optionlist optionlist_config[] =
{ "local_from_prefix", opt_stringptr, {&local_from_prefix} },
{ "local_from_suffix", opt_stringptr, {&local_from_suffix} },
{ "local_interfaces", opt_stringptr, {&local_interfaces} },
#endif
--- a/src/string.c
+++ b/src/string.c
-@@ -428,6 +428,7 @@ return ss;
+@@ -453,6 +453,7 @@ return ss;
#if (defined(HAVE_LOCAL_SCAN) || defined(EXPAND_DLFUNC)) \
&& !defined(MACRO_PREDEF) && !defined(COMPILE_UTILITY)
/*************************************************
* Copy and save string *
*************************************************/
-@@ -473,6 +474,7 @@ string_copyn_function(const uschar * s,
+@@ -498,6 +499,7 @@ string_copyn_function(const uschar * s,
{
return string_copyn(s, n);
}
---- a/src/drtables.c
-+++ b/src/drtables.c
-@@ -736,7 +736,7 @@ else
- {
- char * name = ent->d_name;
- int len = (int)strlen(name);
-- if (regex_match(regex_islookupmod, US name, len, NUL))
-+ if (regex_match(regex_islookupmod, US name, len, NULL))
- {
- int pathnamelen = len + (int)strlen(LOOKUP_MODULE_DIR) + 2;
- void *dl;
--- a/src/exim.c
+++ b/src/exim.c
-@@ -636,13 +636,15 @@ exim_nullstd(void)
+@@ -642,13 +642,15 @@ exim_nullstd(void)
{
int devnull = -1;
struct stat statbuf;
}
--- a/src/local_scan.h
+++ b/src/local_scan.h
-@@ -26,6 +26,7 @@ store.c
+@@ -27,6 +27,7 @@ store.c
settings, and the store functions. */
#include <stdarg.h>
--- /dev/null
+--- a/OS/Makefile-Base
++++ b/OS/Makefile-Base
+@@ -253,7 +253,7 @@ utils: $(EXIM_MONITOR) exicyclog exinext
+ transport-filter.pl convert4r3 convert4r4 \
+ exim_checkaccess \
+ exim_dbmbuild exim_dumpdb exim_fixdb exim_tidydb \
+- exim_lock exim_msgdate exim_id_update
++ exim_lock exim_msgdate
+
+
+ # Targets for special-purpose configuration header builders
--- /dev/null
+--- a/src/transports/smtp.c
++++ b/src/transports/smtp.c
+@@ -938,7 +938,7 @@ if ( sx->early_pipe_active
+ if (!(er = dbfn_read_enforce_length(dbm_file, ehlo_resp_key, sizeof(dbdata_ehlo_resp))))
+ debug_printf("no ehlo-resp record!\n");
+ else
+- debug_printf("ehlo-resp record is %d seconds old\n", time(NULL) - er->time_stamp);
++ debug_printf("ehlo-resp record is %.0f seconds old\n", difftime(time(NULL), er->time_stamp));
+ }
+
+ dbfn_delete(dbm_file, ehlo_resp_key);
include $(TOPDIR)/rules.mk
PKG_NAME:=graphicsmagick
-PKG_VERSION:=1.3.42
+PKG_VERSION:=1.3.43
PKG_RELEASE:=1
PKG_BUILD_DIR:=$(BUILD_DIR)/GraphicsMagick-$(PKG_VERSION)
PKG_SOURCE:=GraphicsMagick-$(PKG_VERSION).tar.xz
PKG_SOURCE_URL:=@SF/graphicsmagick
-PKG_HASH:=484fccfd2b2faf6c2ba9151469ece5072bcb91ba4ed73e75ed3d8e46c759d557
+PKG_HASH:=2b88580732cd7e409d9e22c6116238bef4ae06fcda11451bf33d259f9cbf399f
PKG_LICENSE:=MIT
PKG_LICENSE_FILES:=Copyright.txt
SECTION:=multimedia
CATEGORY:=Multimedia
TITLE:=Graphics manipulation tools
- URL:=https://www.graphicsmagick.org/
+ URL:=http://www.graphicsmagick.org/
DEPENDS:=graphicsmagick
endef
include $(TOPDIR)/rules.mk
PKG_NAME:=imagemagick
-PKG_VERSION:=7.1.1.29
+PKG_VERSION:=7.1.1.31
PKG_RELEASE:=1
PKG_MAINTAINER:=Aleksey Vasilenko <aleksey.vasilenko@gmail.com>
PKG_SOURCE:=ImageMagick-$(_PKGREV).tar.xz
PKG_SOURCE_URL:=https://imagemagick.org/archive
-PKG_HASH:=f140465fbeb0b4724cba4394bc6f6fb32715731c1c62572d586f4f1c8b9b0685
+PKG_HASH:=7e5c8db53dd90a0cfc5cc7ca6d34728ed86054b4bc86e9787902285fec1107a8
PKG_BUILD_DIR:=$(BUILD_DIR)/ImageMagick-$(_PKGREV)
PKG_FIXUP:=autoreconf
-# Copyright 2023 MOSSDeF, Stan Grishin (stangri@melmac.ca)
-# TLD optimization written by Dirk Brenken (dev@brenken.org)
-# This is free software, licensed under the GNU General Public License v3.
+# Copyright 2023-2024 MOSSDeF, Stan Grishin (stangri@melmac.ca).
+# TLD optimization written by Dirk Brenken (dev@brenken.org).
+# This is free software, licensed under AGPL-3.0-or-later.
include $(TOPDIR)/rules.mk
PKG_NAME:=adblock-fast
PKG_VERSION:=1.1.1
-PKG_RELEASE:=r7
+PKG_RELEASE:=11
PKG_MAINTAINER:=Stan Grishin <stangri@melmac.ca>
-PKG_LICENSE:=GPL-3.0-or-later
+PKG_LICENSE:=AGPL-3.0-or-later
include $(INCLUDE_DIR)/package.mk
#!/bin/sh
# check if we are on real system
if [ -z "$${IPKG_INSTROOT}" ]; then
- echo "Stopping service and removing rc.d symlink for adblock-fast"
- /etc/init.d/adblock-fast stop || true
- /etc/init.d/adblock-fast killcache || true
- /etc/init.d/adblock-fast disable || true
+ echo -n "Stopping adblock-fast service... "
+ { /etc/init.d/adblock-fast stop && \
+ /etc/init.d/adblock-fast killcache; } >/dev/null 2>&1 && echo "OK" || echo "FAIL"
+ echo -n "Removing rc.d symlink for adblock-fast... "
+ /etc/init.d/adblock-fast disable >/dev/null 2>&1 && echo "OK" || echo "FAIL"
fi
exit 0
endef
readonly unboundFile="/var/lib/unbound/adb_list.${packageName}"
readonly unboundCache="/var/run/${packageName}/unbound.cache"
readonly unboundGzip="${packageName}.unbound.gz"
-readonly unboundFilter='s|^|local-zone: "|;s|$|" static|'
+readonly unboundFilter='s|^|local-zone: "|;s|$|." always_nxdomain|'
readonly A_TMP="/var/${packageName}.a.tmp"
readonly B_TMP="/var/${packageName}.b.tmp"
readonly SED_TMP="/var/${packageName}.sed.tmp"
outputFilter="$unboundFilter"
outputFile="$unboundFile"
outputCache="$unboundCache"
- outputGzip="$unboundGzip"
+ outputGzip="${compressed_cache_dir}/${unboundGzip}"
;;
esac
}
[ "$dns" = 'smartdns.domainset' ] || rm -f "$smartdnsDomainSetFile" "$smartdnsDomainSetCache" "${compressed_cache_dir}/${smartdnsDomainSetGzip}" "$smartdnsDomainSetConfig"
[ "$dns" = 'smartdns.ipset' ] || rm -f "$smartdnsIpsetFile" "$smartdnsIpsetCache" "${compressed_cache_dir}/${smartdnsIpsetGzip}" "$smartdnsIpsetConfig"
[ "$dns" = 'smartdns.nftset' ] || rm -f "$smartdnsNftsetFile" "$smartdnsNftsetCache" "${compressed_cache_dir}/${smartdnsNftsetGzip}" "$smartdnsNftsetConfig"
- [ "$dns" = 'unbound.adb_list' ] || rm -f "$unboundFile" "$unboundCache" "$unboundGzip"
+ [ "$dns" = 'unbound.adb_list' ] || rm -f "$unboundFile" "$unboundCache" "${compressed_cache_dir}/${unboundGzip}"
for i in "$runningConfigFile" "$runningErrorFile" "$runningStatusFile" "$outputFile" "$outputCache" "$outputGzip" "$outputConfig"; do
[ -n "$i" ] || continue
rm -f "$smartdnsDomainSetFile" "$smartdnsDomainSetCache" "${compressed_cache_dir}/${smartdnsDomainSetGzip}" "$smartdnsDomainSetConfig"
rm -f "$smartdnsIpsetFile" "$smartdnsIpsetCache" "${compressed_cache_dir}/${smartdnsIpsetGzip}" "$smartdnsIpsetConfig"
rm -f "$smartdnsNftsetFile" "$smartdnsNftsetCache" "${compressed_cache_dir}/${smartdnsNftsetGzip}" "$smartdnsNftsetConfig"
- rm -f "$unboundFile" "$unboundCache" "$unboundGzip"
+ rm -f "$unboundFile" "$unboundCache" "${compressed_cache_dir}/${unboundGzip}"
if [ -s "/etc/config/dhcp" ]; then
config_load 'dhcp'
config_foreach _dnsmasq_instance_config 'dnsmasq' 'cleanup'
case "$dns" in
dnsmasq.*)
chmod 660 "$outputFile"
- chown root:dnsmasq "$outputFile"
+ chown root:dnsmasq "$outputFile" >/dev/null 2>/dev/null
param='dnsmasq_restart'
output_text='Restarting dnsmasq'
;;
smartdns.*)
chmod 660 "$outputFile" "$outputConfig"
- chown root:root "$outputFile" "$outputConfig"
+ chown root:root "$outputFile" "$outputConfig" >/dev/null 2>/dev/null
param='smartdns_restart'
output_text='Restarting SmartDNS'
;;
unbound.*)
chmod 660 "$outputFile"
- chown root:unbound "$outputFile"
+ chown root:unbound "$outputFile" >/dev/null 2>/dev/null
param='unbound_restart'
output_text='Restarting Unbound'
;;
return $?
;;
test_gzip)
- [ -s "$outputGzip" ] && gzip -t -c "$outputGzip"
+ [ -s "$outputGzip" ] && gzip -t -c "$outputGzip" >/dev/null 2>/dev/null
return $?
;;
create_gzip)
output_failn
json add error 'errorMovingDataFile'
fi
+ case "$dns" in
+ unbound.adb_list)
+ sed -i '1 i\server:' "$outputFile"
+ ;;
+ esac
if [ "$compressed_cache" -gt 0 ]; then
output 2 'Creating compressed cache '
json set message "$(get_text 'statusProcessing'): creating compressed cache"
smartdns.*)
grep "$string" "$outputFile";;
unbound.adb_list)
- grep "$string" "$outputFile" | sed 's|^local-zone: "||;s|" static$||;';;
+ grep "$string" "$outputFile" | sed 's|^local-zone: "||;s|." always_nxdomain$||;';;
esac
fi
else
include $(TOPDIR)/rules.mk
PKG_NAME:=adguardhome
-PKG_VERSION:=0.107.42
+PKG_VERSION:=0.107.48
PKG_RELEASE:=1
PKG_SOURCE_PROTO:=git
PKG_SOURCE_VERSION:=v$(PKG_VERSION)
PKG_SOURCE_URL:=https://github.com/AdguardTeam/AdGuardHome
-PKG_MIRROR_HASH:=9bcca421f5069d73cf2b5b8b70b0f3768b8757de42dca461f9ea6f25d01b5c56
+PKG_MIRROR_HASH:=74d53a1fffeb5c24db536efadc92eeab2d8978277e513a98e630d2a3f7d142f6
PKG_LICENSE:=GPL-3.0-only
PKG_LICENSE_FILES:=LICENSE.txt
include $(TOPDIR)/rules.mk
PKG_NAME:=banip
-PKG_VERSION:=0.9.4
+PKG_VERSION:=0.9.5
PKG_RELEASE:=3
PKG_LICENSE:=GPL-3.0-or-later
PKG_MAINTAINER:=Dirk Brenken <dev@brenken.org>
| adguard | adguard IPs | | | x | tcp: 80, 443 | [Link](https://github.com/dibdot/banIP-IP-blocklists) |
| adguardtrackers | adguardtracker IPs | | | x | tcp: 80, 443 | [Link](https://github.com/dibdot/banIP-IP-blocklists) |
| antipopads | antipopads IPs | | | x | tcp: 80, 443 | [Link](https://github.com/dibdot/banIP-IP-blocklists) |
-| asn | ASN segments | | | x | tcp: 80, 443 | [Link](https://asn.ipinfo.app) |
+| asn | ASN segments | x | x | x | | [Link](https://asn.ipinfo.app) |
| backscatterer | backscatterer IPs | x | x | | | [Link](https://www.uceprotect.net/en/index.php) |
+| becyber | malicious attacker IPs | x | x | | | [Link](https://github.com/duggytuxy/malicious_ip_addresses) |
| binarydefense | binary defense banlist | x | x | | | [Link](https://iplists.firehol.org/?ipset=bds_atif) |
| bogon | bogon prefixes | x | x | | | [Link](https://team-cymru.com) |
| bruteforceblock | bruteforceblocker IPs | x | x | | | [Link](https://danger.rulez.sk/index.php/bruteforceblocker/) |
| country | country blocks | x | x | | | [Link](https://www.ipdeny.com/ipblocks) |
| cinsscore | suspicious attacker IPs | x | x | | | [Link](https://cinsscore.com/#list) |
-| darklist | blocks suspicious attacker IPs | x | x | | | [Link](https://darklist.de) |
| debl | fail2ban IP blacklist | x | x | | | [Link](https://www.blocklist.de) |
| doh | public DoH-Provider | | | x | tcp: 80, 443 | [Link](https://github.com/dibdot/DoH-IP-blocklists) |
| drop | spamhaus drop compilation | x | x | | | [Link](https://www.spamhaus.org) |
| greensnow | suspicious server IPs | x | x | | | [Link](https://greensnow.co) |
| iblockads | Advertising IPs | | | x | tcp: 80, 443 | [Link](https://www.iblocklist.com) |
| iblockspy | Malicious spyware IPs | | | x | tcp: 80, 443 | [Link](https://www.iblocklist.com) |
-| ipblackhole | blackhole IPs | x | x | | | [Link](https://ip.blackhole.monster) |
+| ipsum | malicious IPs | x | x | | | [Link](https://github.com/stamparm/ipsum) |
| ipthreat | hacker and botnet TPs | x | x | | | [Link](https://ipthreat.net) |
| myip | real-time IP blocklist | x | x | | | [Link](https://myip.ms) |
| nixspam | iX spam protection | x | x | | | [Link](http://www.nixspam.org) |
| oisdbig | OISD-big IPs | | | x | tcp: 80, 443 | [Link](https://github.com/dibdot/banIP-IP-blocklists) |
| oisdnsfw | OISD-nsfw IPs | | | x | tcp: 80, 443 | [Link](https://github.com/dibdot/banIP-IP-blocklists) |
| oisdsmall | OISD-small IPs | | | x | tcp: 80, 443 | [Link](https://github.com/dibdot/banIP-IP-blocklists) |
-| proxy | open proxies | x | | | | [Link](https://iplists.firehol.org/?ipset=proxylists) |
+| pallebone | curated IP blocklist | x | x | | | [Link](https://github.com/pallebone/StrictBlockPAllebone) |
+| proxy | open proxies | x | x | | | [Link](https://iplists.firehol.org/?ipset=proxylists) |
| ssbl | SSL botnet IPs | x | x | | | [Link](https://sslbl.abuse.ch) |
| stevenblack | stevenblack IPs | | | x | tcp: 80, 443 | [Link](https://github.com/dibdot/banIP-IP-blocklists) |
| talos | talos IPs | x | x | | | [Link](https://talosintelligence.com/reputation_center) |
* Full IPv4 and IPv6 support
* Supports nft atomic Set loading
* Supports blocking by ASN numbers and by iso country codes
+* Block countries dynamically by Regional Internet Registry (RIR), e.g. all countries related to ARIN. Supported service regions are: AFRINIC, ARIN, APNIC, LACNIC and RIPE
* Supports local allow- and blocklist with MAC/IPv4/IPv6 addresses or domain names
* Supports concatenation of local MAC addresses with IPv4/IPv6 addresses, e.g. to enforce dhcp assignments
* All local input types support ranges in CIDR notation
* Auto-add the uplink subnet or uplink IP to the local allowlist
+* Prevent common ICMP, UDP and SYN flood attacks and drop spoofed tcp flags & invalid conntrack packets (DDoS attacks) in an additional prerouting chain
* Provides a small background log monitor to ban unsuccessful login attempts in real-time (like fail2ban, crowdsec etc.)
* Auto-add unsuccessful LuCI, nginx, Asterisk or ssh login attempts to the local blocklist
* Auto-add entire subnets to the blocklist Sets based on an additional RDAP request with the monitored suspicious IP
* Provides HTTP ETag support to download only ressources that have been updated on the server side, to speed up banIP reloads and to save bandwith
* Supports an 'allowlist only' mode, this option skips all blocklists and restricts the internet access only to specific, explicitly allowed IP segments
* Supports external allowlist URLs to reference additional IPv4/IPv6 feeds
+* Optionally always allow certain protocols/destination ports in wan-input and wan-forward chains
* Deduplicate IPs accross all Sets (single IPs only, no intervals)
* Provides comprehensive runtime information
* Provides a detailed Set report
* It's strongly recommended to use the LuCI frontend to easily configure all aspects of banIP, the application is located in LuCI under the 'Services' menu
* If you're using a complex network setup, e.g. special tunnel interfaces, than untick the 'Auto Detection' option under the 'General Settings' tab and set the required options manually
* Start the service with '/etc/init.d/banip start' and check everything is working by running '/etc/init.d/banip status' and also check the 'Firewall Log' and 'Processing Log' tabs
-* If you're going to configure banIP via CLI, edit the config file '/etc/config/banip' and enable the service (set ban\_enabled to '1'), then add pre-configured feeds via 'ban\_feed' (see the feed list above) and add/change other options to your needs (see the options reference below)
+* If you're going to configure banIP via CLI, edit the config file '/etc/config/banip' and enable the service (set ban\_enabled to '1'), then add pre-configured feeds via 'ban\_feed' (see the feed list above) and add/change other options to your needs, see the options reference table below
## banIP CLI interface
* All important banIP functions are accessible via CLI.
| ban_logreadfile | option | /var/log/messages | alternative location for parsing the log file, e.g. via syslog-ng, to deactivate the standard parsing via logread |
| ban_autodetect | option | 1 | auto-detect wan interfaces, devices and subnets |
| ban_debug | option | 0 | enable banIP related debug logging |
-| ban_loginput | option | 1 | log drops in the wan-input chain |
-| ban_logforwardwan | option | 1 | log drops in the wan-forward chain |
-| ban_logforwardlan | option | 0 | log rejects in the lan-forward chain |
+| ban_icmplimit | option | 10 | treshold in number of packets to detect icmp DDoS in prerouting chain |
+| ban_synlimit | option | 10 | treshold in number of packets to detect syn DDoS in prerouting chain |
+| ban_udplimit | option | 100 | treshold in number of packets to detect udp DDoS in prerouting chain |
+| ban_logprerouting | option | 0 | log supsicious packets in the prerouting chain |
+| ban_loginput | option | 0 | log supsicious packets in the wan-input chain |
+| ban_logforwardwan | option | 0 | log supsicious packets in the wan-forward chain |
+| ban_logforwardlan | option | 0 | log supsicious packets in the lan-forward chain |
| ban_autoallowlist | option | 1 | add wan IPs/subnets and resolved domains automatically to the local allowlist (not only to the Sets) |
| ban_autoblocklist | option | 1 | add suspicious attacker IPs and resolved domains automatically to the local blocklist (not only to the Sets) |
| ban_autoblocksubnet | option | 0 | add entire subnets to the blocklist Sets based on an additional RDAP request with the suspicious IP |
| ban_autoallowuplink | option | subnet | limit the uplink autoallow function to: 'subnet', 'ip' or 'disable' it at all |
| ban_allowlistonly | option | 0 | skip all blocklists and restrict the internet access only to specific, explicitly allowed IP segments |
+| ban_allowflag | option | - | always allow certain protocols(tcp or udp) plus destination ports or port ranges, e.g.: 'tcp 80 443-445' |
| ban_allowurl | list | - | external allowlist feed URLs, one or more references to simple remote IP lists |
| ban_basedir | option | /tmp | base working directory while banIP processing |
| ban_reportdir | option | /tmp/banIP-report | directory where banIP stores the report files |
| ban_splitsize | option | 0 | split ext. Sets after every n lines/members (saves RAM) |
| ban_cores | option | - / autodetect | limit the cpu cores used by banIP (saves RAM) |
| ban_nftloglevel | option | warn | nft loglevel, values: emerg, alert, crit, err, warn, notice, info, debug |
-| ban_nftpriority | option | -200 | nft priority for the banIP table (default is the prerouting table priority) |
+| ban_nftpriority | option | -100 | nft priority for the banIP table (the prerouting table is fixed to priority -150) |
| ban_nftpolicy | option | memory | nft policy for banIP-related Sets, values: memory, performance |
| ban_nftexpiry | option | - | expiry time for auto added blocklist members, e.g. '5m', '2h' or '1d' |
| ban_feed | list | - | external download feeds, e.g. 'yoyo', 'doh', 'country' or 'talos' (see feed table) |
| ban_asn | list | - | ASNs for the 'asn' feed, e.g.'32934' |
+| ban_region | list | - | Regional Internet Registry (RIR) country selection. Supported regions are: AFRINIC, ARIN, APNIC, LACNIC and RIPE |
| ban_country | list | - | country iso codes for the 'country' feed, e.g. 'ru' |
| ban_blockpolicy | option | - | limit the default block policy to a certain chain, e.g. 'input', 'forwardwan' or 'forwardlan' |
| ban_blocktype | option | drop | 'drop' packets silently on input and forwardwan chains or actively 'reject' the traffic |
:::
::: banIP Set Statistics
:::
- Timestamp: 2024-03-02 07:38:28
+ Timestamp: 2024-04-17 23:02:15
------------------------------
- auto-added to allowlist today: 0
- auto-added to blocklist today: 0
+ blocked syn-flood packets in prerouting : 5
+ blocked udp-flood packets in prerouting : 11
+ blocked icmp-flood packets in prerouting : 6
+ blocked invalid ct packets in prerouting : 277
+ blocked invalid tcp packets in prerouting: 0
+ ----------
+ auto-added IPs to allowlist today: 0
+ auto-added IPs to blocklist today: 0
Set | Elements | WAN-Input (packets) | WAN-Forward (packets) | LAN-Forward (packets) | Port/Protocol Limit
---------------------+--------------+-----------------------+-----------------------+-----------------------+------------------------
- allowlistv4MAC | 0 | - | - | OK: 0 | -
- allowlistv6MAC | 0 | - | - | OK: 0 | -
- allowlistv4 | 1 | OK: 0 | OK: 0 | OK: 0 | -
- allowlistv6 | 2 | OK: 0 | OK: 0 | OK: 0 | -
- adguardtrackersv6 | 74 | - | - | OK: 0 | tcp: 80, 443
- adguardtrackersv4 | 883 | - | - | OK: 0 | tcp: 80, 443
- cinsscorev4 | 12053 | OK: 25 | OK: 0 | - | -
- countryv4 | 37026 | OK: 14 | OK: 0 | - | -
- deblv4 | 13592 | OK: 0 | OK: 0 | - | -
- countryv6 | 38139 | OK: 0 | OK: 0 | - | -
- deblv6 | 82 | OK: 0 | OK: 0 | - | -
- dohv6 | 837 | - | - | OK: 0 | tcp: 80, 443
- dohv4 | 1240 | - | - | OK: 0 | tcp: 80, 443
- dropv6 | 51 | OK: 0 | OK: 0 | - | -
- dropv4 | 592 | OK: 0 | OK: 0 | - | -
- firehol1v4 | 906 | OK: 1 | OK: 0 | - | -
- firehol2v4 | 2105 | OK: 0 | OK: 0 | OK: 0 | -
- threatv4 | 55 | OK: 0 | OK: 0 | - | -
- ipthreatv4 | 2042 | OK: 0 | OK: 0 | - | -
- turrisv4 | 6433 | OK: 0 | OK: 0 | - | -
- blocklistv4MAC | 0 | - | - | OK: 0 | -
- blocklistv6MAC | 0 | - | - | OK: 0 | -
- blocklistv4 | 0 | OK: 0 | OK: 0 | OK: 0 | -
- blocklistv6 | 0 | OK: 0 | OK: 0 | OK: 0 | -
+ allowlistv4MAC | 0 | - | - | ON: 0 | -
+ allowlistv6MAC | 0 | - | - | ON: 0 | -
+ allowlistv4 | 1 | ON: 0 | ON: 0 | ON: 0 | -
+ allowlistv6 | 2 | ON: 0 | ON: 0 | ON: 0 | -
+ adguardtrackersv6 | 105 | - | - | ON: 0 | tcp: 80, 443
+ adguardtrackersv4 | 816 | - | - | ON: 0 | tcp: 80, 443
+ becyberv4 | 229006 | ON: 2254 | ON: 0 | - | -
+ cinsscorev4 | 7135 | ON: 1630 | ON: 2 | - | -
+ deblv4 | 10191 | ON: 23 | ON: 0 | - | -
+ countryv6 | 38233 | ON: 7 | ON: 0 | - | -
+ countryv4 | 37169 | ON: 2323 | ON: 0 | - | -
+ deblv6 | 65 | ON: 0 | ON: 0 | - | -
+ dropv6 | 66 | ON: 0 | ON: 0 | - | -
+ dohv4 | 1219 | - | - | ON: 0 | tcp: 80, 443
+ dropv4 | 895 | ON: 75 | ON: 0 | - | -
+ dohv6 | 832 | - | - | ON: 0 | tcp: 80, 443
+ threatv4 | 20 | ON: 0 | ON: 0 | - | -
+ firehol1v4 | 753 | ON: 1 | ON: 0 | - | -
+ ipthreatv4 | 1369 | ON: 20 | ON: 0 | - | -
+ firehol2v4 | 2216 | ON: 1 | ON: 0 | - | -
+ turrisv4 | 5613 | ON: 179 | ON: 0 | - | -
+ blocklistv4MAC | 0 | - | - | ON: 0 | -
+ blocklistv6MAC | 0 | - | - | ON: 0 | -
+ blocklistv4 | 0 | ON: 0 | ON: 0 | ON: 0 | -
+ blocklistv6 | 0 | ON: 0 | ON: 0 | ON: 0 | -
---------------------+--------------+-----------------------+-----------------------+-----------------------+------------------------
- 24 | 116113 | 16 (40) | 16 (0) | 13 (0)
+ 25 | 335706 | 17 (6513) | 17 (2) | 12 (0)
```
**banIP runtime information**
~# /etc/init.d/banip status
::: banIP runtime information
+ status : active (nft: ✔, monitor: ✔)
- + version : 0.9.4-1
- + element_count : 116113
- + active_feeds : allowlistv4MAC, allowlistv6MAC, allowlistv4, allowlistv6, adguardtrackersv6, adguardtrackersv4, cinsscorev4, countryv4, deblv4, countryv6, deblv6, dohv6, dohv4, dropv6, dropv4, firehol1v4, firehol2v4, threatv4, ipthreatv4, turrisv4, blocklistv4MAC, blocklistv6MAC, blocklistv4, blocklistv6
+ + version : 0.9.5-r1
+ + element_count : 335706
+ + active_feeds : allowlistv4MAC, allowlistv6MAC, allowlistv4, allowlistv6, adguardtrackersv6, adguardtrackersv4, becyberv4, cinsscorev4, deblv4, countryv6, countryv4, deblv6, dropv6, dohv4, dropv4, dohv6, threatv4, firehol1v4, ipthreatv4, firehol2v4, turrisv4, blocklistv4MAC, blocklistv6MAC, blocklistv4, blocklistv6
+ active_devices : wan: pppoe-wan / wan-if: wan, wan_6 / vlan-allow: - / vlan-block: -
- + active_uplink : 217.89.211.113, fe80::2c35:fb80:e78c:cf71, 2003:ed:b5ff:2338:2c15:fb80:e78c:cf71
- + nft_info : priority: -200, policy: performance, loglevel: warn, expiry: 2h
+ + active_uplink : 217.83.205.130, fe80::9cd6:12e9:c4df:75d3, 2003:ed:b5ff:43bd:9cd5:12e7:c3ef:75d8
+ + nft_info : priority: 0, policy: performance, loglevel: warn, expiry: 2h
+ run_info : base: /mnt/data/banIP, backup: /mnt/data/banIP/backup, report: /mnt/data/banIP/report
- + run_flags : auto: ✔, proto (4/6): ✔/✔, log (wan-inp/wan-fwd/lan-fwd): ✔/✔/✔, dedup: ✔, split: ✘, custom feed: ✘, allowed only: ✘
- + last_run : action: reload, log: logread, fetch: curl, duration: 0m 50s, date: 2024-03-02 07:35:01
- + system_info : cores: 4, memory: 1685, device: Bananapi BPI-R3, OpenWrt SNAPSHOT r25356-09be63de70
+ + run_flags : auto: ✔, proto (4/6): ✔/✔, log (pre/inp/fwd/lan): ✔/✘/✘/✘, dedup: ✔, split: ✘, custom feed: ✘, allowed only: ✘
+ + last_run : action: reload, log: logread, fetch: curl, duration: 2m 33s, date: 2024-04-17 05:57:56
+ + system_info : cores: 4, memory: 1573, device: Bananapi BPI-R3, OpenWrt SNAPSHOT r25932-338b463e1e
```
**banIP search information**
banIP supports an "allowlist only" mode. This option skips all blocklists and restricts the internet access only to specific, explicitly allowed IP segments - and block access to the rest of the internet. All IPs which are _not_ listed in the allowlist (plus the external Allowlist URLs) are blocked.
**MAC/IP-binding**
-banIP supports concatenation of local MAC addresses with IPv4/IPv6 addresses, e.g. to enforce dhcp assignments. Following notations in the local allow and block lists are allowed:
+banIP supports concatenation of local MAC addresses/ranges with IPv4/IPv6 addresses, e.g. to enforce dhcp assignments. Following notations in the local allow and block lists are allowed:
```
MAC-address only:
C8:C2:9B:F7:80:12 => this will be populated to the v4MAC- and v6MAC-Sets with the IP-wildcards 0.0.0.0/0 and ::/0
+MAC-address range:
+C8:C2:9B:F7:80:12/24 => this populate the MAC-range C8:C2:9B:00:00:00", "C8:C2:9B:FF:FF:FF to the v4MAC- and v6MAC-Sets with the IP-wildcards 0.0.0.0/0 and ::/0
+
MAC-address with IPv4 concatenation:
C8:C2:9B:F7:80:12 192.168.1.10 => this will be populated only to v4MAC-Set with the certain IP, no entry in the v6MAC-Set
C8:C2:9B:F7:80:12 192.168.1.10 => this will be populated to v4MAC-Set with the certain IP
C8:C2:9B:F7:80:12 => this will be populated to v6MAC-Set with the IP-wildcard ::/0
```
+
**enable the cgi interface to receive remote logging events**
banIP ships a basic cgi interface in '/www/cgi-bin/banip' to receive remote logging events (disabled by default). The cgi interface evaluates logging events via GET or POST request (see examples below). To enable the cgi interface set the following options:
"rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
"rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)$/{printf \"%s,\\n\",$1}",
"descr": "tor exit nodes",
- "flag": "80-89 443 tcp"
+ "flag": "gz tcp 80-88 udp 50000"
},
[...]
```
Add an unique feed name (no spaces, no special chars) and make the required changes: adapt at least the URL, the regex and the description for a new feed.
-Please note: the flag field is optional, it's a space separated list of options: supported are 'gz' as an archive format, port numbers (plus ranges) for destination port limitations with 'tcp' (default) or 'udp' as protocol variants.
+Please note: the flag field is optional, it's a space separated list of options: supported are 'gz' as an archive format, protocols 'tcp' or 'udp' with port numbers/port ranges for destination port limitations - multiple definitions are possible.
## Support
Please join the banIP discussion in this [forum thread](https://forum.openwrt.org/t/banip-support-thread/16985) or contact me by mail <dev@brenken.org>
ban_backupdir="/tmp/banIP-backup"
ban_reportdir="/tmp/banIP-report"
ban_feedfile="/etc/banip/banip.feeds"
+ban_countryfile="/etc/banip/banip.countries"
ban_customfeedfile="/etc/banip/banip.custom.feeds"
ban_allowlist="/etc/banip/banip.allowlist"
ban_blocklist="/etc/banip/banip.blocklist"
ban_remotelog="0"
ban_remotetoken=""
ban_nftloglevel="warn"
-ban_nftpriority="-200"
+ban_nftpriority="-100"
ban_nftpolicy="memory"
ban_nftexpiry=""
ban_loglimit="100"
+ban_icmplimit="10"
+ban_synlimit="10"
+ban_udplimit="100"
ban_logcount="1"
ban_logterm=""
+ban_region=""
ban_country=""
ban_asn=""
-ban_loginput="1"
-ban_logforwardwan="1"
+ban_logprerouting="0"
+ban_loginput="0"
+ban_logforwardwan="0"
ban_logforwardlan="0"
ban_allowurl=""
+ban_allowflag=""
ban_allowlistonly="0"
ban_autoallowlist="1"
ban_autoallowuplink="subnet"
[ "${cpu}" = "0" ] && cpu="1"
[ "${core}" = "0" ] && core="1"
ban_cores="$((cpu * core))"
+ [ "${ban_cores}" -gt "16" ] && ban_cores="16"
fi
}
kill -INT "${pid}" >/dev/null 2>&1
done
fi
- : >"${ban_rdapfile}"
- : >"${ban_pidfile}"
+ : >"${ban_rdapfile}" >"${ban_pidfile}"
}
# write log messages
# load config
#
f_conf() {
- unset ban_dev ban_vlanallow ban_vlanblock ban_ifv4 ban_ifv6 ban_feed ban_allowurl ban_blockinput ban_blockforwardwan ban_blockforwardlan ban_logterm ban_country ban_asn
+ local rir ccode region country
+
+ unset ban_dev ban_vlanallow ban_vlanblock ban_ifv4 ban_ifv6 ban_feed ban_allowurl ban_blockinput ban_blockforwardwan ban_blockforwardlan ban_logterm ban_region ban_country ban_asn
config_cb() {
option_cb() {
local option="${1}"
"ban_logterm")
eval "${option}=\"$(printf "%s" "${ban_logterm}")${value}\\|\""
;;
+ "ban_region")
+ eval "${option}=\"$(printf "%s" "${ban_region}")${value} \""
+ ;;
"ban_country")
eval "${option}=\"$(printf "%s" "${ban_country}")${value} \""
;;
}
config_load banip
[ -f "${ban_logreadfile}" ] && ban_logreadcmd="$(command -v tail)" || ban_logreadcmd="$(command -v logread)"
+
+ for rir in ${ban_region}; do
+ while read -r ccode region country; do
+ if [ "${rir}" = "${region}" ] && ! printf "%s" "${ban_country}" | "${ban_grepcmd}" -qw "${ccode}"; then
+ ban_country="${ban_country} ${ccode}"
+ fi
+ done < "${ban_countryfile}"
+ done
}
# get nft/monitor actuals
# build initial nft file with base table, chains and rules
#
f_nftinit() {
- local wan_dev vlan_allow vlan_block feed_log feed_rc file="${1}"
+ local wan_dev vlan_allow vlan_block log_ct log_icmp log_syn log_udp log_tcp feed_log feed_rc flag tmp_proto tmp_port allow_dport file="${1}"
wan_dev="$(printf "%s" "${ban_dev}" | "${ban_sedcmd}" 's/^/\"/;s/$/\"/;s/ /\", \"/g')"
[ -n "${ban_vlanallow}" ] && vlan_allow="$(printf "%s" "${ban_vlanallow%%?}" | "${ban_sedcmd}" 's/^/\"/;s/$/\"/;s/ /\", \"/g')"
[ -n "${ban_vlanblock}" ] && vlan_block="$(printf "%s" "${ban_vlanblock%%?}" | "${ban_sedcmd}" 's/^/\"/;s/$/\"/;s/ /\", \"/g')"
+ for flag in ${ban_allowflag}; do
+ if [ "${flag}" = "tcp" ] || [ "${flag}" = "udp" ]; then
+ if [ -z "${tmp_proto}" ]; then
+ tmp_proto="${flag}"
+ elif ! printf "%s" "${tmp_proto}" | "${ban_grepcmd}" -qw "${flag}"; then
+ tmp_proto="${tmp_proto}, ${flag}"
+ fi
+ elif [ -n "${flag//[![:digit]-]/}" ]; then
+ if [ -z "${tmp_port}" ]; then
+ tmp_port="${flag}"
+ elif ! printf "%s" "${tmp_port}" | "${ban_grepcmd}" -qw "${flag}"; then
+ tmp_port="${tmp_port}, ${flag}"
+ fi
+ fi
+ done
+ if [ -n "${tmp_proto}" ] && [ -n "${tmp_port}" ]; then
+ allow_dport="meta l4proto { ${tmp_proto} } th dport { ${tmp_port} }"
+ fi
+
+ if [ "${ban_logprerouting}" = "1" ]; then
+ log_icmp="log level ${ban_nftloglevel} prefix \"banIP/pre-icmp/drop: \""
+ log_syn="log level ${ban_nftloglevel} prefix \"banIP/pre-syn/drop: \""
+ log_udp="log level ${ban_nftloglevel} prefix \"banIP/pre-udp/drop: \""
+ log_tcp="log level ${ban_nftloglevel} prefix \"banIP/pre-tcp/drop: \""
+ log_ct="log level ${ban_nftloglevel} prefix \"banIP/pre-ct/drop: \""
+ fi
+
{
# nft header (tables and chains)
#
printf "%s\n" "delete table inet banIP"
fi
printf "%s\n" "add table inet banIP"
+ printf "%s\n" "add counter inet banIP cnt-icmpflood"
+ printf "%s\n" "add counter inet banIP cnt-udpflood"
+ printf "%s\n" "add counter inet banIP cnt-synflood"
+ printf "%s\n" "add counter inet banIP cnt-tcpinvalid"
+ printf "%s\n" "add counter inet banIP cnt-ctinvalid"
+ printf "%s\n" "add chain inet banIP pre-routing { type filter hook prerouting priority -150; policy accept; }"
printf "%s\n" "add chain inet banIP wan-input { type filter hook input priority ${ban_nftpriority}; policy accept; }"
printf "%s\n" "add chain inet banIP wan-forward { type filter hook forward priority ${ban_nftpriority}; policy accept; }"
printf "%s\n" "add chain inet banIP lan-forward { type filter hook forward priority ${ban_nftpriority}; policy accept; }"
printf "%s\n" "add chain inet banIP reject-chain"
- # default reject rules
+ # default reject chain rules
#
printf "%s\n" "add rule inet banIP reject-chain meta l4proto tcp reject with tcp reset"
printf "%s\n" "add rule inet banIP reject-chain reject"
+ # default pre-routing rules
+ #
+ printf "%s\n" "add rule inet banIP pre-routing iifname != { ${wan_dev} } counter accept"
+ printf "%s\n" "add rule inet banIP pre-routing ct state invalid ${log_ct} counter name cnt-ctinvalid drop"
+ printf "%s\n" "add rule inet banIP pre-routing ip protocol icmp limit rate over ${ban_icmplimit}/second ${log_icmp} counter name cnt-icmpflood drop"
+ printf "%s\n" "add rule inet banIP pre-routing ip6 nexthdr icmpv6 limit rate over ${ban_icmplimit}/second ${log_icmp} counter name cnt-icmpflood drop"
+ printf "%s\n" "add rule inet banIP pre-routing meta l4proto udp ct state new limit rate over ${ban_udplimit}/second ${log_udp} counter name cnt-udpflood drop"
+ printf "%s\n" "add rule inet banIP pre-routing tcp flags & (fin|syn|rst|ack) == syn limit rate over ${ban_synlimit}/second ${log_syn} counter name cnt-synflood drop"
+ printf "%s\n" "add rule inet banIP pre-routing tcp flags & (fin|syn) == (fin|syn) ${log_tcp} counter name cnt-tcpinvalid drop"
+ printf "%s\n" "add rule inet banIP pre-routing tcp flags & (syn|rst) == (syn|rst) ${log_tcp} counter name cnt-tcpinvalid drop"
+ printf "%s\n" "add rule inet banIP pre-routing tcp flags & (fin|syn|rst|psh|ack|urg) < (fin) ${log_tcp} counter name cnt-tcpinvalid drop"
+ printf "%s\n" "add rule inet banIP pre-routing tcp flags & (fin|syn|rst|psh|ack|urg) == (fin|psh|urg) ${log_tcp} counter name cnt-tcpinvalid drop"
+
# default wan-input rules
#
- printf "%s\n" "add rule inet banIP wan-input ct state established,related counter accept"
printf "%s\n" "add rule inet banIP wan-input iifname != { ${wan_dev} } counter accept"
+ printf "%s\n" "add rule inet banIP wan-input ct state established,related counter accept"
printf "%s\n" "add rule inet banIP wan-input meta nfproto ipv4 udp sport 67-68 udp dport 67-68 counter accept"
printf "%s\n" "add rule inet banIP wan-input meta nfproto ipv6 udp sport 547 udp dport 546 counter accept"
- printf "%s\n" "add rule inet banIP wan-input meta nfproto ipv4 icmp type { echo-request } limit rate 1000/second counter accept"
- printf "%s\n" "add rule inet banIP wan-input meta nfproto ipv6 icmpv6 type { echo-request } limit rate 1000/second counter accept"
- printf "%s\n" "add rule inet banIP wan-input meta nfproto ipv6 icmpv6 type { nd-neighbor-advert, nd-neighbor-solicit, nd-router-advert} limit rate 1000/second ip6 hoplimit 1 counter accept"
- printf "%s\n" "add rule inet banIP wan-input meta nfproto ipv6 icmpv6 type { nd-neighbor-advert, nd-neighbor-solicit, nd-router-advert} limit rate 1000/second ip6 hoplimit 255 counter accept"
+ printf "%s\n" "add rule inet banIP wan-input meta nfproto ipv6 icmpv6 type { nd-neighbor-advert, nd-neighbor-solicit, nd-router-advert} ip6 hoplimit 1 counter accept"
+ printf "%s\n" "add rule inet banIP wan-input meta nfproto ipv6 icmpv6 type { nd-neighbor-advert, nd-neighbor-solicit, nd-router-advert} ip6 hoplimit 255 counter accept"
+ [ -n "${allow_dport}" ] && printf "%s\n" "add rule inet banIP wan-input ${allow_dport} counter accept"
# default wan-forward rules
#
- printf "%s\n" "add rule inet banIP wan-forward ct state established,related counter accept"
printf "%s\n" "add rule inet banIP wan-forward iifname != { ${wan_dev} } counter accept"
+ printf "%s\n" "add rule inet banIP wan-forward ct state established,related counter accept"
+ [ -n "${allow_dport}" ] && printf "%s\n" "add rule inet banIP wan-forward ${allow_dport} counter accept"
# default lan-forward rules
#
- printf "%s\n" "add rule inet banIP lan-forward ct state established,related counter accept"
printf "%s\n" "add rule inet banIP lan-forward oifname != { ${wan_dev} } counter accept"
+ printf "%s\n" "add rule inet banIP lan-forward ct state established,related counter accept"
[ -n "${vlan_allow}" ] && printf "%s\n" "add rule inet banIP lan-forward iifname { ${vlan_allow} } counter accept"
[ -n "${vlan_block}" ] && printf "%s\n" "add rule inet banIP lan-forward iifname { ${vlan_block} } counter goto reject-chain"
} >"${file}"
feed_log="$("${ban_nftcmd}" -f "${file}" 2>&1)"
feed_rc="${?}"
- f_log "debug" "f_nftinit ::: wan_dev: ${wan_dev}, vlan_allow: ${vlan_allow:-"-"}, vlan_block: ${vlan_block:-"-"}, priority: ${ban_nftpriority}, policy: ${ban_nftpolicy}, loglevel: ${ban_nftloglevel}, rc: ${feed_rc:-"-"}, log: ${feed_log:-"-"}"
+ f_log "debug" "f_nftinit ::: wan_dev: ${wan_dev}, vlan_allow: ${vlan_allow:-"-"}, vlan_block: ${vlan_block:-"-"}, allowed_dports: ${allow_dport:-"-"}, priority: ${ban_nftpriority}, policy: ${ban_nftpolicy}, loglevel: ${ban_nftloglevel}, rc: ${feed_rc:-"-"}, log: ${feed_log:-"-"}"
+ : >"${file}"
return "${feed_rc}"
}
#
f_down() {
local log_input log_forwardwan log_forwardlan start_ts end_ts tmp_raw tmp_load tmp_file split_file ruleset_raw handle rc etag_rc
- local expr cnt_set cnt_dl restore_rc feed_direction feed_rc feed_log feed_comp feed_proto feed_dport flag
+ local expr cnt_set cnt_dl restore_rc feed_direction feed_rc feed_log feed_comp feed_target feed_dport tmp_proto tmp_port flag
local feed="${1}" proto="${2}" feed_url="${3}" feed_rule="${4}" feed_flag="${5}"
start_ts="$(date +%s)"
[ "${ban_logforwardwan}" = "1" ] && log_forwardwan="log level ${ban_nftloglevel} prefix \"banIP/fwd-wan/${ban_blocktype}/${feed}: \""
[ "${ban_logforwardlan}" = "1" ] && log_forwardlan="log level ${ban_nftloglevel} prefix \"banIP/fwd-lan/reject/${feed}: \""
+ # set feed target
+ #
+ if [ "${ban_blocktype}" = "reject" ]; then
+ feed_target="goto reject-chain"
+ else
+ feed_target="drop"
+ fi
+
# set feed block direction
#
if [ "${ban_blockpolicy}" = "input" ]; then
# prepare feed flags
#
for flag in ${feed_flag}; do
- if [ "${flag}" = "gz" ] && ! printf "%s" "${feed_comp}" | "${ban_grepcmd}" -qw "${flag}"; then
+ if [ "${flag}" = "gz" ]; then
feed_comp="${flag}"
- elif { [ "${flag}" = "tcp" ] || [ "${flag}" = "udp" ]; } && ! printf "%s" "${feed_proto}" | "${ban_grepcmd}" -qw "${flag}"; then
- feed_proto="${flag}"
- elif [ -n "${flag//[![:digit]]/}" ] && ! printf "%s" "${feed_dport}" | "${ban_grepcmd}" -qw "${flag}"; then
- if [ -z "${feed_dport}" ]; then
- feed_dport="${flag}"
- else
- feed_dport="${feed_dport}, ${flag}"
+ elif [ "${flag}" = "tcp" ] || [ "${flag}" = "udp" ]; then
+ if [ -z "${tmp_proto}" ]; then
+ tmp_proto="${flag}"
+ elif ! printf "%s" "${tmp_proto}" | "${ban_grepcmd}" -qw "${flag}"; then
+ tmp_proto="${tmp_proto}, ${flag}"
+ fi
+ elif [ -n "${flag//[![:digit]-]/}" ]; then
+ if [ -z "${tmp_port}" ]; then
+ tmp_port="${flag}"
+ elif ! printf "%s" "${tmp_port}" | "${ban_grepcmd}" -qw "${flag}"; then
+ tmp_port="${tmp_port}, ${flag}"
fi
fi
done
- [ -n "${feed_dport}" ] && feed_dport="${feed_proto:-"tcp"} dport { ${feed_dport} }"
+ if [ -n "${tmp_proto}" ] && [ -n "${tmp_port}" ]; then
+ feed_dport="meta l4proto { ${tmp_proto} } th dport { ${tmp_port} }"
+ fi
# chain/rule maintenance
#
done
elif [ "${feed%v*}" = "asn" ]; then
for asn in ${ban_asn}; do
- f_etag "${feed}" "${feed_url}AS${asn}" ".{asn}"
+ f_etag "${feed}" "${feed_url}AS${asn}" ".${asn}"
rc="${?}"
[ "${rc}" = "4" ] && break
etag_rc="$((etag_rc + rc))"
break
fi
done
+
if [ "${feed_rc}" = "0" ]; then
f_backup "allowlist" "${tmp_allow}"
elif [ -z "${restore_rc}" ] && [ "${feed_rc}" != "0" ]; then
printf "%s\n" "add set inet banIP ${feed} { type ipv4_addr; flags interval; auto-merge; policy ${ban_nftpolicy}; $(f_getelements "${tmp_file}") }"
if [ -z "${feed_direction##*input*}" ]; then
if [ "${ban_allowlistonly}" = "1" ]; then
- if [ "${ban_blocktype}" = "reject" ]; then
- printf "%s\n" "add rule inet banIP wan-input ip saddr != @${feed} ${log_input} counter goto reject-chain"
- else
- printf "%s\n" "add rule inet banIP wan-input ip saddr != @${feed} ${log_input} counter drop"
- fi
+ printf "%s\n" "add rule inet banIP wan-input ip saddr != @${feed} ${log_input} counter ${feed_target}"
else
printf "%s\n" "add rule inet banIP wan-input ip saddr @${feed} counter accept"
fi
fi
if [ -z "${feed_direction##*forwardwan*}" ]; then
if [ "${ban_allowlistonly}" = "1" ]; then
- if [ "${ban_blocktype}" = "reject" ]; then
- printf "%s\n" "add rule inet banIP wan-forward ip saddr != @${feed} ${log_forwardwan} counter goto reject-chain"
- else
- printf "%s\n" "add rule inet banIP wan-forward ip saddr != @${feed} ${log_forwardwan} counter drop"
- fi
+ printf "%s\n" "add rule inet banIP wan-forward ip saddr != @${feed} ${log_forwardwan} counter ${feed_target}"
else
printf "%s\n" "add rule inet banIP wan-forward ip saddr @${feed} counter accept"
fi
printf "%s\n" "add set inet banIP ${feed} { type ipv6_addr; flags interval; auto-merge; policy ${ban_nftpolicy}; $(f_getelements "${tmp_file}") }"
if [ -z "${feed_direction##*input*}" ]; then
if [ "${ban_allowlistonly}" = "1" ]; then
- if [ "${ban_blocktype}" = "reject" ]; then
- printf "%s\n" "add rule inet banIP wan-input ip6 saddr != @${feed} ${log_input} counter goto reject-chain"
- else
- printf "%s\n" "add rule inet banIP wan-input ip6 saddr != @${feed} ${log_input} counter drop"
- fi
+ printf "%s\n" "add rule inet banIP wan-input ip6 saddr != @${feed} ${log_input} counter ${feed_target}"
else
printf "%s\n" "add rule inet banIP wan-input ip6 saddr @${feed} counter accept"
fi
fi
if [ -z "${feed_direction##*forwardwan*}" ]; then
if [ "${ban_allowlistonly}" = "1" ]; then
- if [ "${ban_blocktype}" = "reject" ]; then
- printf "%s\n" "add rule inet banIP wan-forward ip6 saddr != @${feed} ${log_forwardwan} counter goto reject-chain"
- else
- printf "%s\n" "add rule inet banIP wan-forward ip6 saddr != @${feed} ${log_forwardwan} counter drop"
- fi
+ printf "%s\n" "add rule inet banIP wan-forward ip6 saddr != @${feed} ${log_forwardwan} counter ${feed_target}"
else
printf "%s\n" "add rule inet banIP wan-forward ip6 saddr @${feed} counter accept"
fi
fi
if [ -z "${feed_direction##*forwardlan*}" ]; then
if [ "${ban_allowlistonly}" = "1" ]; then
- printf "%s\n" "add rule inet banIP lan-forward ip6 daddr != @${feed} ${log_forwardlan} counter goto reject-chain"
+ printf "%s\n" "add rule inet banIP lan-forward ip6 daddr != @${feed} ${log_forwardlan} counter ${feed_target}"
else
printf "%s\n" "add rule inet banIP lan-forward ip6 daddr @${feed} counter accept"
fi
fi
fi
} >"${tmp_nft}"
+ : >"${tmp_flush}" >"${tmp_raw}" >"${tmp_file}"
feed_rc="0"
elif [ "${feed%v*}" = "blocklist" ]; then
{
fi
"${ban_awkcmd}" '{ORS=" ";print}' "${tmp_split}" 2>/dev/null >"${tmp_file}"
printf "%s\n" "add set inet banIP ${feed} { type ipv4_addr; flags interval, timeout; auto-merge; policy ${ban_nftpolicy}; $(f_getelements "${tmp_file}") }"
- if [ "${ban_blocktype}" = "reject" ]; then
- [ -z "${feed_direction##*input*}" ] && printf "%s\n" "add rule inet banIP wan-input ip saddr @${feed} ${log_input} counter goto reject-chain"
- [ -z "${feed_direction##*forwardwan*}" ] && printf "%s\n" "add rule inet banIP wan-forward ip saddr @${feed} ${log_forwardwan} counter goto reject-chain"
- else
- [ -z "${feed_direction##*input*}" ] && printf "%s\n" "add rule inet banIP wan-input ip saddr @${feed} ${log_input} counter drop"
- [ -z "${feed_direction##*forwardwan*}" ] && printf "%s\n" "add rule inet banIP wan-forward ip saddr @${feed} ${log_forwardwan} counter drop"
- fi
+ [ -z "${feed_direction##*input*}" ] && printf "%s\n" "add rule inet banIP wan-input ip saddr @${feed} ${log_input} counter ${feed_target}"
+ [ -z "${feed_direction##*forwardwan*}" ] && printf "%s\n" "add rule inet banIP wan-forward ip saddr @${feed} ${log_forwardwan} counter ${feed_target}"
[ -z "${feed_direction##*forwardlan*}" ] && printf "%s\n" "add rule inet banIP lan-forward ip daddr @${feed} ${log_forwardlan} counter goto reject-chain"
elif [ "${proto}" = "6" ]; then
if [ "${ban_deduplicate}" = "1" ]; then
fi
"${ban_awkcmd}" '{ORS=" ";print}' "${tmp_split}" 2>/dev/null >"${tmp_file}"
printf "%s\n" "add set inet banIP ${feed} { type ipv6_addr; flags interval, timeout; auto-merge; policy ${ban_nftpolicy}; $(f_getelements "${tmp_file}") }"
- if [ "${ban_blocktype}" = "reject" ]; then
- [ -z "${feed_direction##*input*}" ] && printf "%s\n" "add rule inet banIP wan-input ip6 saddr @${feed} ${log_input} counter goto reject-chain"
- [ -z "${feed_direction##*forwardwan*}" ] && printf "%s\n" "add rule inet banIP wan-forward ip6 saddr @${feed} ${log_forwardwan} counter goto reject-chain"
- else
- [ -z "${feed_direction##*input*}" ] && printf "%s\n" "add rule inet banIP wan-input ip6 saddr @${feed} ${log_input} counter drop"
- [ -z "${feed_direction##*forwardwan*}" ] && printf "%s\n" "add rule inet banIP wan-forward ip6 saddr @${feed} ${log_forwardwan} counter drop"
- fi
+ [ -z "${feed_direction##*input*}" ] && printf "%s\n" "add rule inet banIP wan-input ip6 saddr @${feed} ${log_input} counter ${feed_target}"
+ [ -z "${feed_direction##*forwardwan*}" ] && printf "%s\n" "add rule inet banIP wan-forward ip6 saddr @${feed} ${log_forwardwan} counter ${feed_target}"
[ -z "${feed_direction##*forwardlan*}" ] && printf "%s\n" "add rule inet banIP lan-forward ip6 daddr @${feed} ${log_forwardlan} counter goto reject-chain"
fi
} >"${tmp_nft}"
+ : >"${tmp_flush}" >"${tmp_raw}" >"${tmp_file}"
feed_rc="0"
# handle external feeds
feed_rc="${?}"
[ "${feed_rc}" = "0" ] && "${ban_catcmd}" "${tmp_raw}" 2>/dev/null >>"${tmp_load}"
done
- rm -f "${tmp_raw}"
+ : >"${tmp_raw}"
# handle asn downloads
#
feed_rc="${?}"
[ "${feed_rc}" = "0" ] && "${ban_catcmd}" "${tmp_raw}" 2>/dev/null >>"${tmp_load}"
done
- rm -f "${tmp_raw}"
+ : >"${tmp_raw}"
# handle compressed downloads
#
feed_log="$("${ban_fetchcmd}" ${ban_fetchparm} "${tmp_raw}" "${feed_url}" 2>&1)"
feed_rc="${?}"
[ "${feed_rc}" = "0" ] && "${ban_zcatcmd}" "${tmp_raw}" 2>/dev/null >"${tmp_load}"
- rm -f "${tmp_raw}"
+ : >"${tmp_raw}"
# handle normal downloads
#
# deduplicate Sets
#
if [ "${ban_deduplicate}" = "1" ] && [ "${feed_url}" != "local" ]; then
- "${ban_awkcmd}" "${feed_rule}" "${tmp_load}" 2>/dev/null >"${tmp_raw}"
+ "${ban_awkcmd}" '{sub("\r$", ""); print}' "${tmp_load}" 2>/dev/null | "${ban_awkcmd}" "${feed_rule}" 2>/dev/null >"${tmp_raw}"
"${ban_awkcmd}" 'NR==FNR{member[$0];next}!($0 in member)' "${ban_tmpfile}.deduplicate" "${tmp_raw}" 2>/dev/null | tee -a "${ban_tmpfile}.deduplicate" >"${tmp_split}"
else
- "${ban_awkcmd}" "${feed_rule}" "${tmp_load}" 2>/dev/null >"${tmp_split}"
+ "${ban_awkcmd}" '{sub("\r$", ""); print}' "${tmp_load}" 2>/dev/null | "${ban_awkcmd}" "${feed_rule}" 2>/dev/null >"${tmp_split}"
fi
feed_rc="${?}"
# split Sets
#
if [ "${feed_rc}" = "0" ]; then
- if [ -n "${ban_splitsize//[![:digit]]/}" ] && [ "${ban_splitsize//[![:digit]]/}" -gt "0" ]; then
+ if [ -n "${ban_splitsize//[![:digit]]/}" ] && [ "${ban_splitsize//[![:digit]]/}" -gt "512" ]; then
if ! "${ban_awkcmd}" "NR%${ban_splitsize//[![:digit]]/}==1{file=\"${tmp_file}.\"++i;}{ORS=\" \";print > file}" "${tmp_split}" 2>/dev/null; then
- rm -f "${tmp_file}".*
f_log "info" "can't split Set '${feed}' to size '${ban_splitsize//[![:digit]]/}'"
+ rm -f "${tmp_file}".*
fi
else
"${ban_awkcmd}" '{ORS=" ";print}' "${tmp_split}" 2>/dev/null >"${tmp_file}.1"
fi
feed_rc="${?}"
fi
- rm -f "${tmp_raw}" "${tmp_load}"
+ : >"${tmp_raw}" >"${tmp_load}"
+
if [ "${feed_rc}" = "0" ] && [ "${proto}" = "4" ]; then
{
# nft header (IPv4 Set)
# input and forward rules
#
- if [ "${ban_blocktype}" = "reject" ]; then
- [ -z "${feed_direction##*input*}" ] && printf "%s\n" "add rule inet banIP wan-input ${feed_dport} ip saddr @${feed} ${log_input} counter goto reject-chain"
- [ -z "${feed_direction##*forwardwan*}" ] && printf "%s\n" "add rule inet banIP wan-forward ${feed_dport} ip saddr @${feed} ${log_forwardwan} counter goto reject-chain"
- else
- [ -z "${feed_direction##*input*}" ] && printf "%s\n" "add rule inet banIP wan-input ${feed_dport} ip saddr @${feed} ${log_input} counter drop"
- [ -z "${feed_direction##*forwardwan*}" ] && printf "%s\n" "add rule inet banIP wan-forward ${feed_dport} ip saddr @${feed} ${log_forwardwan} counter drop"
- fi
+ [ -z "${feed_direction##*input*}" ] && printf "%s\n" "add rule inet banIP wan-input ${feed_dport} ip saddr @${feed} ${log_input} counter ${feed_target}"
+ [ -z "${feed_direction##*forwardwan*}" ] && printf "%s\n" "add rule inet banIP wan-forward ${feed_dport} ip saddr @${feed} ${log_forwardwan} counter ${feed_target}"
[ -z "${feed_direction##*forwardlan*}" ] && printf "%s\n" "add rule inet banIP lan-forward ${feed_dport} ip daddr @${feed} ${log_forwardlan} counter goto reject-chain"
} >"${tmp_nft}"
elif [ "${feed_rc}" = "0" ] && [ "${proto}" = "6" ]; then
# input and forward rules
#
- if [ "${ban_blocktype}" = "reject" ]; then
- [ -z "${feed_direction##*input*}" ] && printf "%s\n" "add rule inet banIP wan-input ${feed_dport} ip6 saddr @${feed} ${log_input} counter goto reject-chain"
- [ -z "${feed_direction##*forwardwan*}" ] && printf "%s\n" "add rule inet banIP wan-forward ${feed_dport} ip6 saddr @${feed} ${log_forwardwan} counter goto reject-chain"
- else
- [ -z "${feed_direction##*input*}" ] && printf "%s\n" "add rule inet banIP wan-input ${feed_dport} ip6 saddr @${feed} ${log_input} counter drop"
- [ -z "${feed_direction##*forwardwan*}" ] && printf "%s\n" "add rule inet banIP wan-forward ${feed_dport} ip6 saddr @${feed} ${log_forwardwan} counter drop"
- fi
+ [ -z "${feed_direction##*input*}" ] && printf "%s\n" "add rule inet banIP wan-input ${feed_dport} ip6 saddr @${feed} ${log_input} counter ${feed_target}"
+ [ -z "${feed_direction##*forwardwan*}" ] && printf "%s\n" "add rule inet banIP wan-forward ${feed_dport} ip6 saddr @${feed} ${log_forwardwan} counter ${feed_target}"
[ -z "${feed_direction##*forwardlan*}" ] && printf "%s\n" "add rule inet banIP lan-forward ${feed_dport} ip6 daddr @${feed} ${log_forwardlan} counter goto reject-chain"
} >"${tmp_nft}"
fi
+ : >"${tmp_flush}" >"${tmp_file}.1"
fi
# load generated nft file in banIP table
cnt_dl="$("${ban_awkcmd}" 'END{printf "%d",NR}' "${tmp_allow}" 2>/dev/null)"
else
cnt_dl="$("${ban_awkcmd}" 'END{printf "%d",NR}' "${tmp_split}" 2>/dev/null)"
+ : >"${tmp_split}"
fi
if [ "${cnt_dl:-"0"}" -gt "0" ] || [ "${feed_url}" = "local" ] || [ "${feed%v*}" = "allowlist" ] || [ "${feed%v*}" = "blocklist" ]; then
feed_log="$("${ban_nftcmd}" -f "${tmp_nft}" 2>&1)"
#
if [ "${feed_rc}" = "0" ]; then
for split_file in "${tmp_file}".*; do
- [ ! -f "${split_file}" ] && break
- if [ "${split_file##*.}" = "1" ]; then
- rm -f "${split_file}"
- continue
- fi
- if ! "${ban_nftcmd}" add element inet banIP "${feed}" "{ $("${ban_catcmd}" "${split_file}") }" >/dev/null 2>&1; then
+ [ ! -s "${split_file}" ] && continue
+ "${ban_sedcmd}" -i "1 i #!/usr/sbin/nft -f\nadd element inet banIP "${feed}" { " "${split_file}"
+ printf "%s\n" "}" >> "${split_file}"
+ if ! "${ban_nftcmd}" -f "${split_file}" >/dev/null 2>&1; then
f_log "info" "can't add split file '${split_file##*.}' to Set '${feed}'"
fi
- rm -f "${split_file}"
+ : >"${split_file}"
done
if [ "${ban_debug}" = "1" ] && [ "${ban_reportelements}" = "1" ]; then
cnt_set="$("${ban_nftcmd}" -j list set inet banIP "${feed}" 2>/dev/null | "${ban_jsoncmd}" -qe '@.nftables[*].set.elem[*]' | wc -l 2>/dev/null)"
f_log "info" "skip empty feed '${feed}'"
fi
fi
- rm -f "${tmp_split}" "${tmp_nft}"
+ : >"${tmp_nft}"
end_ts="$(date +%s)"
f_log "debug" "f_down ::: feed: ${feed}, cnt_dl: ${cnt_dl:-"-"}, cnt_set: ${cnt_set:-"-"}, split_size: ${ban_splitsize:-"-"}, time: $((end_ts - start_ts)), rc: ${feed_rc:-"-"}, log: ${feed_log:-"-"}"
json_get_keys feedlist
tmp_del="${ban_tmpfile}.final.delete"
ruleset_raw="$("${ban_nftcmd}" -tj list ruleset 2>/dev/null)"
- table_sets="$(printf "%s\n" "${ruleset_raw}" | "${ban_jsoncmd}" -qe '@.nftables[@.set.table="banIP"].set.name')"
+ table_sets="$(printf "%s\n" "${ruleset_raw}" | "${ban_jsoncmd}" -qe '@.nftables[@.set.table="banIP"&&@.set.family="inet"].set.name')"
{
printf "%s\n\n" "#!/usr/sbin/nft -f"
for item in ${table_sets}; do
feed_log="$("${ban_nftcmd}" -f "${tmp_del}" 2>&1)"
feed_rc="${?}"
fi
- rm -f "${tmp_del}"
+ : >"${tmp_del}"
f_log "debug" "f_rmset ::: sets: ${del_set:-"-"}, rc: ${feed_rc:-"-"}, log: ${feed_log:-"-"}"
}
end_time="$(date "+%s")"
duration="$(((end_time - ban_starttime) / 60))m $(((end_time - ban_starttime) % 60))s"
fi
- table_sets="$("${ban_nftcmd}" -tj list ruleset 2>/dev/null | "${ban_jsoncmd}" -qe '@.nftables[@.set.table="banIP"].set.name')"
+ table_sets="$("${ban_nftcmd}" -tj list ruleset 2>/dev/null | "${ban_jsoncmd}" -qe '@.nftables[@.set.table="banIP"&&@.set.family="inet"].set.name')"
if [ "${ban_reportelements}" = "1" ]; then
for object in ${table_sets}; do
cnt_elements="$((cnt_elements + $("${ban_nftcmd}" -j list set inet banIP "${object}" 2>/dev/null | "${ban_jsoncmd}" -qe '@.nftables[*].set.elem[*]' | wc -l 2>/dev/null)))"
json_close_array
json_add_string "nft_info" "priority: ${ban_nftpriority}, policy: ${ban_nftpolicy}, loglevel: ${ban_nftloglevel}, expiry: ${ban_nftexpiry:-"-"}"
json_add_string "run_info" "base: ${ban_basedir}, backup: ${ban_backupdir}, report: ${ban_reportdir}"
- json_add_string "run_flags" "auto: $(f_char ${ban_autodetect}), proto (4/6): $(f_char ${ban_protov4})/$(f_char ${ban_protov6}), log (wan-inp/wan-fwd/lan-fwd): $(f_char ${ban_loginput})/$(f_char ${ban_logforwardwan})/$(f_char ${ban_logforwardlan}), dedup: $(f_char ${ban_deduplicate}), split: $(f_char ${split}), custom feed: $(f_char ${custom_feed}), allowed only: $(f_char ${ban_allowlistonly})"
+ json_add_string "run_flags" "auto: $(f_char ${ban_autodetect}), proto (4/6): $(f_char ${ban_protov4})/$(f_char ${ban_protov6}), log (pre/inp/fwd/lan): $(f_char ${ban_logprerouting})/$(f_char ${ban_loginput})/$(f_char ${ban_logforwardwan})/$(f_char ${ban_logforwardlan}), dedup: $(f_char ${ban_deduplicate}), split: $(f_char ${split}), custom feed: $(f_char ${custom_feed}), allowed only: $(f_char ${ban_allowlistonly})"
json_add_string "last_run" "${runtime:-"-"}"
json_add_string "system_info" "cores: ${ban_cores}, memory: ${ban_memory}, device: ${ban_sysver}"
json_dump >"${ban_rtfile}"
cnt_domain="$((cnt_domain + 1))"
done
if [ -n "${elementsv4}" ]; then
- if ! "${ban_nftcmd}" add element inet banIP "${feed}v4" "{ ${elementsv4} }" >/dev/null 2>&1; then
+ if ! "${ban_nftcmd}" add element inet banIP "${feed}v4" { ${elementsv4} } >/dev/null 2>&1; then
f_log "info" "can't add lookup file to Set '${feed}v4'"
fi
fi
if [ -n "${elementsv6}" ]; then
- if ! "${ban_nftcmd}" add element inet banIP "${feed}v6" "{ ${elementsv6} }" >/dev/null 2>&1; then
+ if ! "${ban_nftcmd}" add element inet banIP "${feed}v6" { ${elementsv6} } >/dev/null 2>&1; then
f_log "info" "can't add lookup file to Set '${feed}v6'"
fi
fi
#
f_report() {
local report_jsn report_txt tmp_val ruleset_raw item table_sets set_cnt set_input set_forwardwan set_forwardlan set_cntinput set_cntforwardwan set_cntforwardlan set_proto set_dport set_details
- local expr detail jsnval timestamp autoadd_allow autoadd_block sum_sets sum_setinput sum_setforwardwan sum_setforwardlan sum_setelements sum_cntinput sum_cntforwardwan sum_cntforwardlan output="${1}"
-
+ local expr detail jsnval timestamp autoadd_allow autoadd_block sum_sets sum_setinput sum_setforwardwan sum_setforwardlan sum_setelements sum_cntinput sum_cntforwardwan sum_cntforwardlan
+ local sum_synflood sum_udpflood sum_icmpflood sum_ctinvalid sum_tcpinvalid output="${1}"
[ -z "${ban_dev}" ] && f_conf
f_mkdir "${ban_reportdir}"
report_jsn="${ban_reportdir}/ban_report.jsn"
# json output preparation
#
ruleset_raw="$("${ban_nftcmd}" -tj list ruleset 2>/dev/null)"
- table_sets="$(printf "%s" "${ruleset_raw}" | "${ban_jsoncmd}" -qe '@.nftables[@.set.table="banIP"].set.name')"
+ table_sets="$(printf "%s" "${ruleset_raw}" | "${ban_jsoncmd}" -qe '@.nftables[@.set.table="banIP"&&@.set.family="inet"].set.name')"
sum_sets="0"
sum_setinput="0"
sum_setforwardwan="0"
sum_cntinput="0"
sum_cntforwardwan="0"
sum_cntforwardlan="0"
+ sum_synflood="$(printf "%s" "${ruleset_raw}" | "${ban_jsoncmd}" -qe '@.nftables[@.counter.name="cnt-synflood"].*.packets')"
+ sum_udpflood="$(printf "%s" "${ruleset_raw}" | "${ban_jsoncmd}" -qe '@.nftables[@.counter.name="cnt-udpflood"].*.packets')"
+ sum_icmpflood="$(printf "%s" "${ruleset_raw}" | "${ban_jsoncmd}" -qe '@.nftables[@.counter.name="cnt-icmpflood"].*.packets')"
+ sum_ctinvalid="$(printf "%s" "${ruleset_raw}" | "${ban_jsoncmd}" -qe '@.nftables[@.counter.name="cnt-ctinvalid"].*.packets')"
+ sum_tcpinvalid="$(printf "%s" "${ruleset_raw}" | "${ban_jsoncmd}" -qe '@.nftables[@.counter.name="cnt-tcpinvalid"].*.packets')"
timestamp="$(date "+%Y-%m-%d %H:%M:%S")"
: >"${report_jsn}"
{
[ "${expr}" = "1" ] && [ -z "${set_dport}" ] && set_dport="$(printf "%s" "${ruleset_raw}" | "${ban_jsoncmd}" -ql1 -e "@.nftables[@.rule.table=\"banIP\"&&@.rule.chain=\"lan-forward\"][@.expr[${expr}].match.right=\"@${item}\"].expr[*].match.right.set")"
[ "${expr}" = "1" ] && [ -z "${set_proto}" ] && set_proto="$(printf "%s" "${ruleset_raw}" | "${ban_jsoncmd}" -ql1 -e "@.nftables[@.rule.table=\"banIP\"&&@.rule.chain=\"lan-forward\"][@.expr[${expr}].match.right=\"@${item}\"].expr[*].match.left.payload.protocol")"
done
- if [ -n "${set_dport}" ]; then
- set_dport="${set_dport//[\{\}\":]/}"
- set_dport="${set_dport#\[ *}"
- set_dport="${set_dport%* \]}"
- set_dport="${set_proto}: $(f_trim "${set_dport}")"
- fi
if [ "${ban_reportelements}" = "1" ]; then
set_cnt="$("${ban_nftcmd}" -j list set inet banIP "${item}" 2>/dev/null | "${ban_jsoncmd}" -qe '@.nftables[*].set.elem[*]' | wc -l 2>/dev/null)"
sum_setelements="$((sum_setelements + set_cnt))"
set_cnt=""
sum_setelements="n/a"
fi
+ if [ -n "${set_dport}" ]; then
+ set_dport="${set_dport//[\{\}\":]/}"
+ set_dport="${set_dport#\[ *}"
+ set_dport="${set_dport%* \]}"
+ set_dport="${set_proto}: $(f_trim "${set_dport}")"
+ fi
if [ -n "${set_cntinput}" ]; then
- set_input="OK"
+ set_input="ON"
sum_setinput="$((sum_setinput + 1))"
sum_cntinput="$((sum_cntinput + set_cntinput))"
else
set_cntinput=""
fi
if [ -n "${set_cntforwardwan}" ]; then
- set_forwardwan="OK"
+ set_forwardwan="ON"
sum_setforwardwan="$((sum_setforwardwan + 1))"
sum_cntforwardwan="$((sum_cntforwardwan + set_cntforwardwan))"
else
set_cntforwardwan=""
fi
if [ -n "${set_cntforwardlan}" ]; then
- set_forwardlan="OK"
+ set_forwardlan="ON"
sum_setforwardlan="$((sum_setforwardlan + 1))"
sum_cntforwardlan="$((sum_cntforwardlan + set_cntforwardlan))"
else
printf "\t%s\n" "\"timestamp\": \"${timestamp}\","
printf "\t%s\n" "\"autoadd_allow\": \"$("${ban_grepcmd}" -c "added on ${timestamp% *}" "${ban_allowlist}")\","
printf "\t%s\n" "\"autoadd_block\": \"$("${ban_grepcmd}" -c "added on ${timestamp% *}" "${ban_blocklist}")\","
+ printf "\t%s\n" "\"sum_synflood\": \"${sum_synflood}\","
+ printf "\t%s\n" "\"sum_udpflood\": \"${sum_udpflood}\","
+ printf "\t%s\n" "\"sum_icmpflood\": \"${sum_icmpflood}\","
+ printf "\t%s\n" "\"sum_ctinvalid\": \"${sum_ctinvalid}\","
+ printf "\t%s\n" "\"sum_tcpinvalid\": \"${sum_tcpinvalid}\","
printf "\t%s\n" "\"sum_sets\": \"${sum_sets}\","
printf "\t%s\n" "\"sum_setinput\": \"${sum_setinput}\","
printf "\t%s\n" "\"sum_setforwardwan\": \"${sum_setforwardwan}\","
json_get_var timestamp "timestamp" >/dev/null 2>&1
json_get_var autoadd_allow "autoadd_allow" >/dev/null 2>&1
json_get_var autoadd_block "autoadd_block" >/dev/null 2>&1
+ json_get_var sum_synflood "sum_synflood" >/dev/null 2>&1
+ json_get_var sum_udpflood "sum_udpflood" >/dev/null 2>&1
+ json_get_var sum_icmpflood "sum_icmpflood" >/dev/null 2>&1
+ json_get_var sum_ctinvalid "sum_ctinvalid" >/dev/null 2>&1
+ json_get_var sum_tcpinvalid "sum_tcpinvalid" >/dev/null 2>&1
json_get_var sum_sets "sum_sets" >/dev/null 2>&1
json_get_var sum_setinput "sum_setinput" >/dev/null 2>&1
json_get_var sum_setforwardwan "sum_setforwardwan" >/dev/null 2>&1
printf "%s\n%s\n%s\n" ":::" "::: banIP Set Statistics" ":::"
printf "%s\n" " Timestamp: ${timestamp}"
printf "%s\n" " ------------------------------"
- printf "%s\n" " auto-added to allowlist today: ${autoadd_allow}"
- printf "%s\n\n" " auto-added to blocklist today: ${autoadd_block}"
+ printf "%s\n" " blocked syn-flood packets : ${sum_synflood}"
+ printf "%s\n" " blocked udp-flood packets : ${sum_udpflood}"
+ printf "%s\n" " blocked icmp-flood packets : ${sum_icmpflood}"
+ printf "%s\n" " blocked invalid ct packets : ${sum_ctinvalid}"
+ printf "%s\n" " blocked invalid tcp packets: ${sum_tcpinvalid}"
+ printf "%s\n" " ----------"
+ printf "%s\n" " auto-added IPs to allowlist: ${autoadd_allow}"
+ printf "%s\n\n" " auto-added IPs to blocklist: ${autoadd_block}"
json_select "sets" >/dev/null 2>&1
json_get_keys table_sets >/dev/null 2>&1
if [ -n "${table_sets}" ]; then
local item table_sets ip proto hold cnt result_flag="/var/run/banIP.search" input="${1}"
if [ -n "${input}" ]; then
- ip="$(printf "%s" "${input}" | "${ban_awkcmd}" 'BEGIN{RS="(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\/(1?[0-9]|2?[0-9]|3?[0-2]))?[[:space:]]*$)"}{printf "%s",RT}')"
+ ip="$(printf "%s" "${input}" | "${ban_awkcmd}" 'BEGIN{RS="(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?[[:space:]]*$)"}{printf "%s",RT}')"
[ -n "${ip}" ] && proto="v4"
if [ -z "${proto}" ]; then
- ip="$(printf "%s" "${input}" | "${ban_awkcmd}" 'BEGIN{RS="(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\/(1?[0-2][0-8]|[0-9][0-9]))?)([[:space:]].*|$)"}{printf "%s",RT}')"
+ ip="$(printf "%s" "${input}" | "${ban_awkcmd}" 'BEGIN{RS="(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)([[:space:]].*|$)"}{printf "%s",RT}')"
[ -n "${ip}" ] && proto="v6"
fi
fi
printf "%s\n%s\n%s\n" ":::" "::: no valid search input" ":::"
return
fi
- printf "%s\n%s\n%s\n" ":::" "::: banIP Search" ":::"
- printf " %s\n" "Looking for IP '${ip}' on $(date "+%Y-%m-%d %H:%M:%S")"
- printf " %s\n" "---"
cnt="1"
for item in ${table_sets}; do
[ -f "${result_flag}" ] && break
(
if "${ban_nftcmd}" get element inet banIP "${item}" "{ ${ip} }" >/dev/null 2>&1; then
+ printf "%s\n%s\n%s\n" ":::" "::: banIP Search" ":::"
+ printf " %s\n" "Looking for IP '${ip}' on $(date "+%Y-%m-%d %H:%M:%S")"
+ printf " %s\n" "---"
printf " %s\n" "IP found in Set '${item}'"
: >"${result_flag}"
fi
cnt="$((cnt + 1))"
done
wait
- [ -f "${result_flag}" ] && rm -f "${result_flag}" || printf " %s\n" "IP not found"
+ if [ -f "${result_flag}" ]; then
+ rm -f "${result_flag}"
+ else
+ printf "%s\n%s\n%s\n" ":::" "::: banIP Search" ":::"
+ printf " %s\n" "Looking for IP '${ip}' on $(date "+%Y-%m-%d %H:%M:%S")"
+ printf " %s\n" "---"
+ printf " %s\n" "IP not found"
+ fi
}
# Set survey
# log monitor
#
f_monitor() {
- local daemon logread_cmd loglimit_cmd nft_expiry line proto ip log_raw log_count rdap_log rdap_rc rdap_elements rdap_info
+ local daemon logread_cmd loglimit_cmd nft_expiry line proto ip log_raw log_count rdap_log rdap_rc rdap_prefix rdap_length rdap_info
if [ -f "${ban_logreadfile}" ]; then
logread_cmd="${ban_logreadcmd} -qf ${ban_logreadfile} 2>/dev/null | ${ban_grepcmd} -e \"${ban_logterm%%??}\" 2>/dev/null"
rdap_log="$("${ban_fetchcmd}" ${ban_rdapparm} "${ban_rdapfile}" "${ban_rdapurl}${ip}" 2>&1)"
rdap_rc="${?}"
if [ "${rdap_rc}" = "0" ] && [ -s "${ban_rdapfile}" ]; then
- rdap_elements="$(jsonfilter -i "${ban_rdapfile}" -qe '@.cidr0_cidrs.*' | awk 'BEGIN{FS="[\" ]"}{printf "%s/%s, ",$6,$11}')"
- rdap_info="$(jsonfilter -i "${ban_rdapfile}" -qe '@.country' -qe '@.notices[@.title="Source"].description[1]' | awk 'BEGIN{RS="";FS="\n"}{printf "%s, %s",$1,$2}')"
- if [ -n "${rdap_elements//\/*/}" ]; then
- if "${ban_nftcmd}" add element inet banIP "blocklist${proto}" "{ ${rdap_elements%%??} ${nft_expiry} }" >/dev/null 2>&1; then
- f_log "info" "add IP range '${rdap_elements%%??}' (source: ${rdap_info:-"-"} ::: expiry: ${ban_nftexpiry:-"-"}) to blocklist${proto} set"
+ [ "${proto}" = "v4" ] && rdap_prefix="$(jsonfilter -l1 -i "${ban_rdapfile}" -qe '@.cidr0_cidrs.*.v4prefix')"
+ [ "${proto}" = "v6" ] && rdap_prefix="$(jsonfilter -l1 -i "${ban_rdapfile}" -qe '@.cidr0_cidrs.*.v6prefix')"
+ rdap_length="$(jsonfilter -l1 -i "${ban_rdapfile}" -qe '@.cidr0_cidrs.*.length')"
+ rdap_info="$(jsonfilter -l1 -i "${ban_rdapfile}" -qe '@.country' -qe '@.notices[@.title="Source"].description[1]' | awk 'BEGIN{RS="";FS="\n"}{printf "%s, %s",$1,$2}')"
+ [ -z "${rdap_info}" ] && rdap_info="$(jsonfilter -l1 -i "${ban_rdapfile}" -qe '@.notices[0].links[0].value' | awk 'BEGIN{FS="[/.]"}{printf"%s, %s","n/a",toupper($4)}')"
+ if [ -n "${rdap_prefix}" ] && [ -n "${rdap_length}" ]; then
+ if "${ban_nftcmd}" add element inet banIP "blocklist${proto}" { ${rdap_prefix}/${rdap_length} ${nft_expiry} } >/dev/null 2>&1; then
+ f_log "info" "add IP range '${rdap_prefix}/${rdap_length}' (source: ${rdap_info:-"n/a"} ::: expiry: ${ban_nftexpiry:-"-"}) to blocklist${proto} set"
fi
fi
else
f_log "info" "rdap request failed (rc: ${rdap_rc:-"-"}/log: ${rdap_log})"
fi
fi
- if [ "${ban_autoblocksubnet}" = "0" ] || [ "${rdap_rc}" != "0" ] || [ ! -s "${ban_rdapfile}" ] || [ -z "${rdap_elements//\/*/}" ]; then
- if "${ban_nftcmd}" add element inet banIP "blocklist${proto}" "{ ${ip} ${nft_expiry} }" >/dev/null 2>&1; then
+ if [ "${ban_autoblocksubnet}" = "0" ] || [ "${rdap_rc}" != "0" ] || [ ! -s "${ban_rdapfile}" ] || [ -z "${rdap_prefix}" ] || [ -z "${rdap_length}" ]; then
+ if "${ban_nftcmd}" add element inet banIP "blocklist${proto}" { ${ip} ${nft_expiry} } >/dev/null 2>&1; then
f_log "info" "add IP '${ip}' (expiry: ${ban_nftexpiry:-"-"}) to blocklist${proto} set"
fi
fi
#!/bin/sh
# banIP main service script - ban incoming and outgoing IPs via named nftables Sets
-# Copyright (c) 2018-2023 Dirk Brenken (dev@brenken.org)
+# Copyright (c) 2018-2024 Dirk Brenken (dev@brenken.org)
# This is free software, licensed under the GNU General Public License v3.
# (s)hellcheck exceptions
f_getdev
f_getuplink
f_mkdir "${ban_backupdir}"
-f_mkfile "${ban_blocklist}"
f_mkfile "${ban_allowlist}"
+f_mkfile "${ban_blocklist}"
# firewall check
#
fi
fi
-# init nft namespace
+# init banIP nftables namespace
#
if [ "${ban_action}" != "reload" ] || ! "${ban_nftcmd}" -t list set inet banIP allowlistv4MAC >/dev/null 2>&1; then
if f_nftinit "${ban_tmpfile}".init.nft; then
- f_log "info" "initialize nft namespace"
+ f_log "info" "initialize banIP nftables namespace"
else
- f_log "err" "can't initialize nft namespace"
+ f_log "err" "can't initialize banIP nftables namespace"
fi
fi
continue
fi
- # handle IPv4/IPv6 feeds with the same/single download URL
+ # handle IPv4/IPv6 feeds with a single download URL
#
if [ "${feed_url_4}" = "${feed_url_6}" ]; then
if [ "${ban_protov4}" = "1" ] && [ -n "${feed_url_4}" ] && [ -n "${feed_rule_4}" ]; then
fi
continue
fi
- # handle IPv4/IPv6 feeds with separated download URLs
+
+ # handle IPv4/IPv6 feeds with separate download URLs
#
if [ "${ban_protov4}" = "1" ] && [ -n "${feed_url_4}" ] && [ -n "${feed_rule_4}" ]; then
(f_down "${feed}" "4" "${feed_url_4}" "${feed_rule_4}" "${feed_flag}") &
-af;Afghanistan
-ax;Åland Islands
-al;Albania
-dz;Algeria
-as;American Samoa
-ad;Andorra
-ao;Angola
-ai;Anguilla
-aq;Antarctica
-ag;Antigua & Barbuda
-ar;Argentina
-am;Armenia
-aw;Aruba
-au;Australia
-at;Austria
-az;Azerbaijan
-bs;Bahamas
-bh;Bahrain
-bd;Bangladesh
-bb;Barbados
-by;Belarus
-be;Belgium
-bz;Belize
-bj;Benin
-bm;Bermuda
-bt;Bhutan
-bo;Bolivia
-ba;Bosnia
-bw;Botswana
-bv;Bouvet Island
-br;Brazil
-io;British Indian Ocean Territory
-vg;British Virgin Islands
-bn;Brunei
-bg;Bulgaria
-bf;Burkina Faso
-bi;Burundi
-kh;Cambodia
-cm;Cameroon
-ca;Canada
-cv;Cape Verde
-bq;Caribbean Netherlands
-ky;Cayman Islands
-cf;Central African Republic
-td;Chad
-cl;Chile
-cn;China
-cx;Christmas Island
-cc;Cocos (Keeling) Islands
-co;Colombia
-km;Comoros
-cg;Congo - Brazzaville
-cd;Congo - Kinshasa
-ck;Cook Islands
-cr;Costa Rica
-ci;Côte d’Ivoire
-hr;Croatia
-cu;Cuba
-cw;Curaçao
-cy;Cyprus
-cz;Czechia
-dk;Denmark
-dj;Djibouti
-dm;Dominica
-do;Dominican Republic
-ec;Ecuador
-eg;Egypt
-sv;El Salvador
-gq;Equatorial Guinea
-er;Eritrea
-ee;Estonia
-sz;Eswatini
-et;Ethiopia
-fk;Falkland Islands
-fo;Faroe Islands
-fj;Fiji
-fi;Finland
-fr;France
-gf;French Guiana
-pf;French Polynesia
-tf;French Southern Territories
-ga;Gabon
-gm;Gambia
-ge;Georgia
-de;Germany
-gh;Ghana
-gi;Gibraltar
-gr;Greece
-gl;Greenland
-gd;Grenada
-gp;Guadeloupe
-gu;Guam
-gt;Guatemala
-gg;Guernsey
-gn;Guinea
-gw;Guinea-Bissau
-gy;Guyana
-ht;Haiti
-hm;Heard & McDonald Islands
-hn;Honduras
-hk;Hong Kong
-hu;Hungary
-is;Iceland
-in;India
-id;Indonesia
-ir;Iran
-iq;Iraq
-ie;Ireland
-im;Isle of Man
-il;Israel
-it;Italy
-jm;Jamaica
-jp;Japan
-je;Jersey
-jo;Jordan
-kz;Kazakhstan
-ke;Kenya
-ki;Kiribati
-kw;Kuwait
-kg;Kyrgyzstan
-la;Laos
-lv;Latvia
-lb;Lebanon
-ls;Lesotho
-lr;Liberia
-ly;Libya
-li;Liechtenstein
-lt;Lithuania
-lu;Luxembourg
-mo;Macau
-mg;Madagascar
-mw;Malawi
-my;Malaysia
-mv;Maldives
-ml;Mali
-mt;Malta
-mh;Marshall Islands
-mq;Martinique
-mr;Mauritania
-mu;Mauritius
-yt;Mayotte
-mx;Mexico
-fm;Micronesia
-md;Moldova
-mc;Monaco
-mn;Mongolia
-me;Montenegro
-ms;Montserrat
-ma;Morocco
-mz;Mozambique
-mm;Myanmar
-na;Namibia
-nr;Nauru
-np;Nepal
-nl;Netherlands
-nc;New Caledonia
-nz;New Zealand
-ni;Nicaragua
-ne;Niger
-ng;Nigeria
-nu;Niue
-nf;Norfolk Island
-mp;Northern Mariana Islands
-kp;North Korea
-mk;North Macedonia
-no;Norway
-om;Oman
-pk;Pakistan
-pw;Palau
-ps;Palestine
-pa;Panama
-pg;Papua New Guinea
-py;Paraguay
-pe;Peru
-ph;Philippines
-pn;Pitcairn Islands
-pl;Poland
-pt;Portugal
-pr;Puerto Rico
-qa;Qatar
-re;Réunion
-ro;Romania
-ru;Russia
-rw;Rwanda
-ws;Samoa
-sm;San Marino
-st;São Tomé & Príncipe
-sa;Saudi Arabia
-sn;Senegal
-rs;Serbia
-sc;Seychelles
-sl;Sierra Leone
-sg;Singapore
-sx;Sint Maarten
-sk;Slovakia
-si;Slovenia
-sb;Solomon Islands
-so;Somalia
-za;South Africa
-gs;South Georgia & South Sandwich Islands
-kr;South Korea
-ss;South Sudan
-es;Spain
-lk;Sri Lanka
-bl;St. Barthélemy
-sh;St. Helena
-kn;St. Kitts & Nevis
-lc;St. Lucia
-mf;St. Martin
-pm;St. Pierre & Miquelon
-vc;St. Vincent & Grenadines
-sd;Sudan
-sr;Suriname
-sj;Svalbard & Jan Mayen
-se;Sweden
-ch;Switzerland
-sy;Syria
-tw;Taiwan
-tj;Tajikistan
-tz;Tanzania
-th;Thailand
-tl;Timor-Leste
-tg;Togo
-tk;Tokelau
-to;Tonga
-tt;Trinidad & Tobago
-tn;Tunisia
-tr;Turkey
-tm;Turkmenistan
-tc;Turks & Caicos Islands
-tv;Tuvalu
-ug;Uganda
-ua;Ukraine
-ae;United Arab Emirates
-gb;United Kingdom
-us;United States
-uy;Uruguay
-um;U.S. Outlying Islands
-vi;U.S. Virgin Islands
-uz;Uzbekistan
-vu;Vanuatu
-va;Vatican City
-ve;Venezuela
-vn;Vietnam
-wf;Wallis & Futuna
-eh;Western Sahara
-ye;Yemen
-zm;Zambia
-zw;Zimbabwe
+af APNIC Afghanistan
+ax RIPE Åland Islands
+al RIPE Albania
+dz AFRINIC Algeria
+as APNIC American Samoa
+ad RIPE Andorra
+ao AFRINIC Angola
+ai ARIN Anguilla
+aq ARIN Antarctica
+ag ARIN Antigua & Barbuda
+ar LACNIC Argentina
+am RIPE Armenia
+aw LACNIC Aruba
+au APNIC Australia
+at RIPE Austria
+az RIPE Azerbaijan
+bs ARIN Bahamas
+bh RIPE Bahrain
+bd APNIC Bangladesh
+bb ARIN Barbados
+by RIPE Belarus
+be RIPE Belgium
+bz LACNIC Belize
+bj AFRINIC Benin
+bm ARIN Bermuda
+bt APNIC Bhutan
+bo LACNIC Bolivia
+bq LACNIC Bonaire
+ba RIPE Bosnia & Herzegowina
+bw AFRINIC Botswana
+bv ARIN Bouvet Island
+br LACNIC Brazil
+io APNIC British Indian Ocean Territory
+bn APNIC Brunei
+bg RIPE Bulgaria
+bf AFRINIC Burkina Faso
+bi AFRINIC Burundi
+kh APNIC Cambodia
+cm AFRINIC Cameroon
+ca ARIN Canada
+cv AFRINIC Cape Verde
+ky ARIN Cayman Islands
+cf AFRINIC Central African Republic
+td AFRINIC Chad
+cl LACNIC Chile
+cn APNIC China
+cx APNIC Christmas Island
+cc APNIC Cocos Islands
+co LACNIC Colombia
+km AFRINIC Comoros
+cg AFRINIC Congo - Brazzaville
+cd AFRINIC Congo - Kinshasa
+ck APNIC Cook Islands
+cr LACNIC Costa Rica
+ci AFRINIC Côte D'ivoire
+hr RIPE Croatia
+cu LACNIC Cuba
+cw LACNIC Curaçao
+cy RIPE Cyprus
+cz RIPE Czechia
+dk RIPE Denmark
+dj AFRINIC Djibouti
+dm ARIN Dominica
+do LACNIC Dominican Republic
+ec LACNIC Ecuador
+eg AFRINIC Egypt
+sv LACNIC El Salvador
+gq AFRINIC Equatorial Guinea
+er AFRINIC Eritrea
+ee RIPE Estonia
+sz AFRINIC Eswatini
+et AFRINIC Ethiopia
+fk LACNIC Falkland Islands
+fo RIPE Faroe Islands
+fj APNIC Fiji
+fi RIPE Finland
+fr RIPE France
+gf LACNIC French Guiana
+pf APNIC French Polynesia
+tf APNIC French Southern Territories
+ga AFRINIC Gabon
+gm AFRINIC Gambia
+ge RIPE Georgia
+de RIPE Germany
+gh AFRINIC Ghana
+gi RIPE Gibraltar
+gr RIPE Greece
+gl RIPE Greenland
+gd ARIN Grenada
+gp ARIN Guadeloupe
+gu APNIC Guam
+gt LACNIC Guatemala
+gg RIPE Guernsey
+gn AFRINIC Guinea
+gw AFRINIC Guinea-Bissau
+gy LACNIC Guyana
+ht LACNIC Haiti
+hm ARIN Heard & McDonald Islands
+hn LACNIC Honduras
+hk APNIC Hong Kong
+hu RIPE Hungary
+is RIPE Iceland
+in APNIC India
+id APNIC Indonesia
+ir RIPE Iran
+iq RIPE Iraq
+ie RIPE Ireland
+im RIPE Isle of Man
+il RIPE Israel
+it RIPE Italy
+jm ARIN Jamaica
+jp APNIC Japan
+je RIPE Jersey
+jo RIPE Jordan
+kz RIPE Kazakhstan
+ke AFRINIC Kenya
+ki APNIC Kiribati
+kw RIPE Kuwait
+kg RIPE Kyrgyzstan
+la APNIC Lao
+lv RIPE Latvia
+lb RIPE Lebanon
+ls AFRINIC Lesotho
+lr AFRINIC Liberia
+ly AFRINIC Libya
+li RIPE Liechtenstein
+lt RIPE Lithuania
+lu RIPE Luxembourg
+mo APNIC Macao
+mg AFRINIC Madagascar
+mw AFRINIC Malawi
+my APNIC Malaysia
+mv APNIC Maldives
+ml AFRINIC Mali
+mt RIPE Malta
+mh APNIC Marshall Islands
+ma AFRINIC Marocco
+mq ARIN Martinique
+mr AFRINIC Mauritania
+mu AFRINIC Mauritius
+yt AFRINIC Mayotte
+mx LACNIC Mexico
+fm APNIC Micronesia
+md RIPE Moldova
+mc RIPE Monaco
+mn APNIC Mongolia
+me RIPE Montenegro
+ms ARIN Montserrat
+mz AFRINIC Mozambique
+mm APNIC Myanmar
+na AFRINIC Namibia
+nr APNIC Nauru
+np APNIC Nepal
+nl RIPE Netherlands
+nc APNIC New Caledonia
+nz APNIC New Zealand
+ni LACNIC Nicaragua
+ne AFRINIC Niger
+ng AFRINIC Nigeria
+nu APNIC Niue
+nf APNIC Norfolk Island
+kp APNIC North Korea
+mk RIPE North Macedonia
+mp APNIC Northern Mariana Islands
+no RIPE Norway
+om RIPE Oman
+pk APNIC Pakistan
+pw APNIC Palau
+ps RIPE Palestine
+pa LACNIC Panama
+pg APNIC Papua New Guinea
+py LACNIC Paraguay
+pe LACNIC Peru
+ph APNIC Philippines
+pn APNIC Pitcairn
+pl RIPE Poland
+pt RIPE Portugal
+pr ARIN Puerto Rico
+qa RIPE Qatar
+re AFRINIC Reunion
+ro RIPE Romania
+ru RIPE Russian Federation
+rw AFRINIC Rwanda
+sh ARIN Saint Helena
+bl ARIN Saint Barthélemy
+kn ARIN Saint Kitts & Nevis
+lc ARIN Saint Lucia
+mf ARIN Saint Martin
+pm ARIN Saint Pierre & Miquelon
+vc ARIN Saint Vincent & the Grenadines
+ws APNIC Samoa
+sm RIPE San Marino
+st AFRINIC Sao Tome & Principe
+sa RIPE Saudi Arabia
+sn AFRINIC Senegal
+rs RIPE Serbia
+sc AFRINIC Seychelles
+sl AFRINIC Sierra Leone
+sg APNIC Singapore
+sx LACNIC Sint Maarten
+sk RIPE Slovakia
+si RIPE Slovenia
+sb APNIC Solomon Islands
+so AFRINIC Somalia
+za AFRINIC South Africa
+gs LACNIC South Georgia
+kr APNIC South Korea
+ss AFRINIC South Sudan
+es RIPE Spain
+lk APNIC Sri Lanka
+sd AFRINIC Sudan
+sr LACNIC Suriname
+sj RIPE Svalbard & Jan Mayen Islands
+se RIPE Sweden
+ch RIPE Switzerland
+sy RIPE Syrian
+tw APNIC Taiwan
+tj RIPE Tajikistan
+tz AFRINIC Tanzania
+th APNIC Thailand
+tl APNIC Timor-Leste
+tg AFRINIC Togo
+tk APNIC Tokelau
+to APNIC Tonga
+tt LACNIC Trinidad & Tobago
+tn AFRINIC Tunisia
+tr RIPE Türkey
+tm RIPE Turkmenistan
+tc ARIN Turks & Caicos Islands
+tv APNIC Tuvalu
+ug AFRINIC Uganda
+ua RIPE Ukraine
+ae RIPE United Arab Emirates
+gb RIPE United Kingdom
+us ARIN United States
+um ARIN United States Minor Outlying Islands
+uy LACNIC Uruguay
+uz RIPE Uzbekistan
+vu APNIC Vanuatu
+va RIPE Vatikan City
+ve LACNIC Venezuela
+vn APNIC Vietnam
+vg ARIN Virgin Islands (British)
+vi ARIN Virgin Islands (U.S.)
+wf APNIC Wallis & Futuna Islands
+eh AFRINIC Western Sahara
+ye RIPE Yemen
+zm AFRINIC Zambia
+zw AFRINIC Zimbabwe
"rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
"rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
"descr": "adaway IPs",
- "flag": "80 443"
+ "flag": "tcp 80 443"
},
"adguard":{
"url_4": "https://raw.githubusercontent.com/dibdot/banIP-IP-blocklists/main/adguard-ipv4.txt",
"rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
"rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
"descr": "adguard IPs",
- "flag": "80 443"
+ "flag": "tcp 80 443"
},
"adguardtrackers":{
"url_4": "https://raw.githubusercontent.com/dibdot/banIP-IP-blocklists/main/adguardtrackers-ipv4.txt",
"rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
"rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
"descr": "adguardtracker IPs",
- "flag": "80 443"
+ "flag": "tcp 80 443"
},
"antipopads":{
"url_4": "https://raw.githubusercontent.com/dibdot/banIP-IP-blocklists/main/antipopads-ipv4.txt",
"rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
"rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
"descr": "antipopads IPs",
- "flag": "80 443"
+ "flag": "tcp 80 443"
},
"asn":{
"url_4": "https://asn.ipinfo.app/api/text/list/",
"url_6": "https://asn.ipinfo.app/api/text/list/",
"rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
"rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)$/{printf \"%s,\\n\",$1}",
- "descr": "ASN IP segments",
- "flag": "80 443"
+ "descr": "ASN IP segments"
},
"backscatterer":{
"url_4": "http://wget-mirrors.uceprotect.net/rbldnsd-all/ips.backscatterer.org.gz",
"descr": "backscatterer IPs",
"flag": "gz"
},
+ "becyber":{
+ "url_4": "https://raw.githubusercontent.com/duggytuxy/malicious_ip_addresses/main/botnets_zombies_scanner_spam_ips.txt",
+ "url_6": "https://raw.githubusercontent.com/duggytuxy/malicious_ip_addresses/main/botnets_zombies_scanner_spam_ips_ipv6.txt",
+ "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
+ "rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)$/{printf \"%s,\\n\",$1}",
+ "descr": "malicious attacker IPs"
+ },
"binarydefense":{
"url_4": "https://iplists.firehol.org/files/bds_atif.ipset",
"rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
"rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)$/{printf \"%s,\\n\",$1}",
"descr": "country blocks"
},
- "darklist":{
- "url_4": "https://darklist.de/raw.php",
- "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
- "descr": "suspicious attacker IPs"
- },
"debl":{
- "url_4": "https://www.blocklist.de/downloads/export-ips_all.txt",
- "url_6": "https://www.blocklist.de/downloads/export-ips_all.txt",
+ "url_4": "https://lists.blocklist.de/lists/all.txt",
+ "url_6": "https://lists.blocklist.de/lists/all.txt",
"rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
"rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)$/{printf \"%s,\\n\",$1}",
"descr": "fail2ban IP blocklist"
"rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
"rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
"descr": "public DoH-Provider",
- "flag": "80 443"
+ "flag": "tcp 80 443"
},
"drop":{
"url_4": "https://www.spamhaus.org/drop/drop.txt",
"rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)[[:space:]]/{printf \"%s/%s,\\n\",$1,$3}",
"descr": "dshield IP blocklist"
},
- "edrop":{
- "url_4": "https://www.spamhaus.org/drop/edrop.txt",
- "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
- "descr": "spamhaus edrop compilation"
- },
"etcompromised":{
"url_4": "https://iplists.firehol.org/files/et_compromised.ipset",
"rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
"url_4": "https://list.iblocklist.com/?list=dgxtneitpuvgqqcpfulq&fileformat=cidr&archiveformat=gz",
"rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
"descr": "advertising IPs",
- "flag": "gz 80 443"
+ "flag": "gz tcp 80 443"
},
"iblockspy":{
"url_4": "https://list.iblocklist.com/?list=llvtlsjyoyiczbkjsxpf&fileformat=cidr&archiveformat=gz",
"rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
"descr": "malicious spyware IPs",
- "flag": "gz 80 443"
+ "flag": "gz tcp 80 443"
},
- "ipblackhole":{
- "url_4": "https://ip.blackhole.monster/blackhole-today",
- "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
- "descr": "blackhole IP blocklist"
+ "ipsum":{
+ "url_4": "https://raw.githubusercontent.com/stamparm/ipsum/master/levels/3.txt",
+ "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)[-[:space:]]?/{printf \"%s,\\n\",$1}",
+ "descr": "malicious IPs"
},
"ipthreat":{
"url_4": "https://lists.ipthreat.net/file/ipthreat-lists/threat/threat-30.txt.gz",
"rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
"rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
"descr": "OISD-big IPs",
- "flag": "80 443"
+ "flag": "tcp 80 443"
},
"oisdnsfw":{
"url_4": "https://raw.githubusercontent.com/dibdot/banIP-IP-blocklists/main/oisdnsfw-ipv4.txt",
"rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
"rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
"descr": "OISD-nsfw IPs",
- "flag": "80 443"
+ "flag": "tcp 80 443"
},
"oisdsmall":{
"url_4": "https://raw.githubusercontent.com/dibdot/banIP-IP-blocklists/main/oisdsmall-ipv4.txt",
"rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
"rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
"descr": "OISD-small IPs",
- "flag": "80 443"
+ "flag": "tcp 80 443"
+ },
+ "pallebone":{
+ "url_4": "https://raw.githubusercontent.com/pallebone/StrictBlockPAllebone/master/BlockIP.txt",
+ "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
+ "descr": "curated IP blocklist"
},
"proxy":{
"url_4": "https://iplists.firehol.org/files/proxylists.ipset",
"rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
"rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
"descr": "stevenblack IPs",
- "flag": "80 443"
+ "flag": "tcp 80 443"
},
"talos":{
"url_4": "https://www.talosintelligence.com/documents/ip-blacklist",
"rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
"rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
"descr": "yoyo IPs",
- "flag": "80 443"
+ "flag": "tcp 80 443"
}
}
[ "${action}" = "boot" ] && "${ban_init}" running && exit 0
{ [ "${action}" = "stop" ] || [ "${action}" = "report" ] || [ "${action}" = "search" ] || [ "${action}" = "survey" ] || [ "${action}" = "lookup" ]; } && ! "${ban_init}" running && exit 0
[ ! -r "${ban_funlib}" ] && { [ "${action}" = "boot" ] || [ "${action}" = "start" ] || [ "${action}" = "restart" ] || [ "${action}" = "reload" ] || [ "${action}" = "stop" ] || [ "${action}" = "report" ] || [ "${action}" = "search" ] || [ "${action}" = "survey" ] || [ "${action}" = "lookup" ] || [ "${action}" = "status" ]; } && exit 1
-[ -d "${ban_lock}" ] && { [ "${action}" = "boot" ] || [ "${action}" = "start" ] || [ "${action}" = "restart" ] || [ "${action}" = "reload" ] || [ "${action}" = "lookup" ]; } && exit 1
-[ ! -d "${ban_lock}" ] && { [ "${action}" = "boot" ] || [ "${action}" = "start" ] || [ "${action}" = "restart" ] || [ "${action}" = "reload" ] || [ "${action}" = "lookup" ]; } && mkdir -p "${ban_lock}"
+[ -d "${ban_lock}" ] && { [ "${action}" = "boot" ] || [ "${action}" = "start" ] || [ "${action}" = "restart" ] || [ "${action}" = "reload" ] || [ "${action}" = "lookup" ] || [ "${action}" = "search" ]; } && exit 1
+[ ! -d "${ban_lock}" ] && { [ "${action}" = "boot" ] || [ "${action}" = "start" ] || [ "${action}" = "restart" ] || [ "${action}" = "reload" ] || [ "${action}" = "lookup" ] || [ "${action}" = "search" ]; } && mkdir -p "${ban_lock}"
{ [ "${action}" = "boot" ] || [ "${action}" = "start" ] || [ "${action}" = "restart" ] || [ "${action}" = "reload" ] || [ "${action}" = "stop" ] || [ "${action}" = "report" ] || [ "${action}" = "search" ] || [ "${action}" = "survey" ] || [ "${action}" = "lookup" ] || [ "${action}" = "status" ]; } && . "${ban_funlib}"
-[ ! -d "${ban_lock}" ] && { [ "${action}" = "boot" ] || [ "${action}" = "start" ] || [ "${action}" = "restart" ] || [ "${action}" = "reload" ] || [ "${action}" = "lookup" ]; } && exit 1
+[ ! -d "${ban_lock}" ] && { [ "${action}" = "boot" ] || [ "${action}" = "start" ] || [ "${action}" = "restart" ] || [ "${action}" = "reload" ] || [ "${action}" = "lookup" ] || [ "${action}" = "search" ]; } && exit 1
boot() {
: >"${ban_pidfile}"
search() {
f_search "${1}"
+ rm -rf "${ban_lock}"
}
survey() {
proto_init_update "$link" 1
- # For static configuration we _MUST_ have an IP address
- [ -z "$ipaddr" ] && {
- echo "$cfg" "No local IP address defined"
- proto_notify_error "$cfg" INVALID_LOCAL_ADDRESS
- proto_block_restart "$cfg"
- return
- }
-
- proto_add_ipv4_address "$ipaddr" "$netmask"
+ # If ipaddr is configured, configure the ip to the interface
+ [ -n "$ipaddr" ] && proto_add_ipv4_address "$ipaddr" "$netmask"
proto_send_update "$cfg"
}
include $(TOPDIR)/rules.mk
PKG_NAME:=cloudflared
-PKG_VERSION:=2024.3.0
+PKG_VERSION:=2024.4.1
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://codeload.github.com/cloudflare/cloudflared/tar.gz/$(PKG_VERSION)?
-PKG_HASH:=6e5fda072d81b2d40208a0d244b44aaf607f26709711e157e23f44f812594e93
+PKG_HASH:=11bed2bd793cc03775aa6270797ed328434bc982e09fd3597e267590f28d2436
PKG_LICENSE:=Apache-2.0
PKG_LICENSE_FILES:=LICENSE
PKG_NAME:=curl
PKG_VERSION:=8.7.1
-PKG_RELEASE:=r1
+PKG_RELEASE:=2
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
PKG_SOURCE_URL:=https://github.com/curl/curl/releases/download/curl-$(subst .,_,$(PKG_VERSION))/ \
SECTION:=net
CATEGORY:=Network
URL:=http://curl.se/
- MAINTAINER:=Stan Grishin <stangri@melmac.ca>
+ MAINTAINER:=
endef
define Package/curl
--- /dev/null
+From: Kailun Qin <kailun.qin@intel.com>
+Date: Mon, 8 Apr 2024 05:13:56 -0400
+Subject: [PATCH] mbedtls: call mbedtls_ssl_setup() after RNG callback is set
+
+Since mbedTLS v3.6.0, the RNG check added in ssl_conf_check() will fail
+if no RNG is provided when calling mbedtls_ssl_setup().
+
+Therefore, mbedtls_ssl_conf_rng() needs to be called before the SSL
+context is passed to mbedtls_ssl_setup().
+
+Ref: https://github.com/Mbed-TLS/mbedtls/commit/b422cab052b51ec84758638d6783d6ba4fc60613
+
+Signed-off-by: Kailun Qin <kailun.qin@intel.com>
+Closes #13314
+---
+
+--- a/lib/vtls/mbedtls.c
++++ b/lib/vtls/mbedtls.c
+@@ -602,10 +602,6 @@ mbed_connect_step1(struct Curl_cfilter *
+ }
+
+ mbedtls_ssl_init(&backend->ssl);
+- if(mbedtls_ssl_setup(&backend->ssl, &backend->config)) {
+- failf(data, "mbedTLS: ssl_init failed");
+- return CURLE_SSL_CONNECT_ERROR;
+- }
+
+ /* new profile with RSA min key len = 1024 ... */
+ mbedtls_ssl_conf_cert_profile(&backend->config,
+@@ -639,6 +635,15 @@ mbed_connect_step1(struct Curl_cfilter *
+
+ mbedtls_ssl_conf_rng(&backend->config, mbedtls_ctr_drbg_random,
+ &backend->ctr_drbg);
++
++ ret = mbedtls_ssl_setup(&backend->ssl, &backend->config);
++ if(ret) {
++ mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
++ failf(data, "ssl_setup failed - mbedTLS: (-0x%04X) %s",
++ -ret, errorbuf);
++ return CURLE_SSL_CONNECT_ERROR;
++ }
++
+ mbedtls_ssl_set_bio(&backend->ssl, cf,
+ mbedtls_bio_cf_write,
+ mbedtls_bio_cf_read,
include $(TOPDIR)/rules.mk
PKG_NAME:=dnsdist
-PKG_VERSION:=1.9.1
+PKG_VERSION:=1.9.3
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
PKG_SOURCE_URL:=https://downloads.powerdns.com/releases/
-PKG_HASH:=4b1db4fae2917e54a804440580a602db3300aed7801f6c986bf03ba7768bc01a
+PKG_HASH:=f05b68806dc6c4d207b1fadb7ec715c3e0d28d893a8b3b92d58297c4ceb56c3f
PKG_MAINTAINER:=Peter van Dijk <peter.van.dijk@powerdns.com>, Remi Gacogne <remi.gacogne@powerdns.com>
PKG_LICENSE:=GPL-2.0-only
include $(TOPDIR)/rules.mk
PKG_NAME:=dnsproxy
-PKG_VERSION:=0.66.0
+PKG_VERSION:=0.70.0
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://codeload.github.com/AdguardTeam/dnsproxy/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=6928b109fb1080fec2aadc0cad20d0c08d13b5ff5db1a7c82ecfe200eec21326
+PKG_HASH:=a78ce398f2019e7a3a57e7ffcb06ecfb6d08e36e0a07c58ada4ac4871cecd677
PKG_MAINTAINER:=Tianling Shen <cnsztl@immortalwrt.org>
PKG_LICENSE:=Apache-2.0
--- /dev/null
+## **Prelude**
+- This document only covers scripts installed on OpenWrt systems and only options available on OpenWrt.
+- geoip-shell supports a numer of different use cases, many different platforms, and 2 backend firewall utilities (nftables and iptables). For this reason I designed it to be modular rather than monolithic. In this design, the functionality is split between few main scripts. Each main script performs specific tasks and utilizes library scripts which are required for the task with the given platform and firewall utility.
+- This document provides some info on the purpose and core options of the main scripts and how they work in tandem.
+- The main scripts display "usage" when called with the "-h" option. You can find out about some additional options specific to each script by running it with that option.
+
+## **Overview**
+
+### Main Scripts
+- geoip-shell-manage.sh
+- geoip-shell-run.sh
+- geoip-shell-fetch.sh
+- geoip-shell-apply.sh
+- geoip-shell-backup.sh
+- geoip-shell-cronsetup.sh
+
+### Helper Scripts
+**geoip-shell-geoinit.sh**
+- This script is sourced from all main scripts. It sets some essential variables, checks for compatible shell, then sources the -lib-common script, then sources the /etc/geoip-shell/geoip-shell.const file which stores some system-specific constants.
+
+**geoip-shell-detect-lan.sh**
+This script is only used under specific conditions:
+- During initial setup, with whitelist mode, and only if wan interfaces were set to 'all', and LAN subnets were not specified via command line args. geoip-shell then assumes that it is being configured on a host behind a router and firewall, uses this script to detect the LAN subnets and offers the user to add them to the whitelist, and to enable automatic detection of LAN subnets in the future.
+- At the time of creating/updating firewall rules, and only if LAN subnets automatic detection is enabled. geoip-shell then re-detects LAN subnets automatically.
+
+### Library Scripts
+- lib/geoip-shell-lib-common.sh
+- lib/geoip-shell-lib-setup.sh
+- lib/geoip-shell-lib-ipt.sh
+- lib/geoip-shell-lib-nft.sh
+- lib/geoip-shell-lib-status.sh
+- lib/geoip-shell-lib-arrays.sh
+- lib/geoip-shell-lib-uninstall.sh
+
+The -lib-common script includes a large number of functions used throughout the suite, and assigns some essential variables.
+
+The lib-setup script implements CLI interactive and noninteractive setup and arguments parsing. It is used in the -manage script.
+
+The -lib-status script implements the status report which you can get by issuing the `geoip-shell status` command.
+
+The -ipt and -nft scripts implement support for iptables and nftables, respectively. They are sourced from other scripts which need to interact with the firewall utility directly.
+
+
+The -lib-arrays script implements a minimal subset of functions emulating the functionality of associative arrays in POSIX-compliant shell. It is used in the -fetch script. It is a part of a larger project implementing much more of the arrays functionality. You can check my other repositories if you are interested.
+
+The -lib-uninstall script has some functions which are used both for uninstallation and for reset if required.
+
+### OpenWrt-specific scripts
+- geoip-shell-lib-owrt-common.sh
+- geoip-shell-init
+- geoip-shell-mk-fw-include.sh
+- geoip-shell-fw-include.sh
+- geoip-shell-owrt-uninstall.sh
+
+For more information about integration with OpenWrt, read [OpenWrt-README.md](OpenWrt-README.md)
+
+### User interface
+After installation, the user interface is provided by running "geoip-shell", which is a symlink to the -manage script.
+
+## **Main scripts in detail**
+**geoip-shell-manage.sh**: serves as the main user interface to configure geoip after installation. You can also call it by simply typing `geoip-shell`. As most scripts in this suite, it requires root privileges because it needs to interact with the netfilter kernel component and access the data folder which is only readable and writable by root. Since it serves as the main user interface, it contains a lot of logic to generate a report, parse, validate and initiate actions requested by the user (by calling other scripts as required), check for possible remote machine lockout and warn the user about it, check actions result, update the config and take corrective actions in case of an error. Describing all this is beyond the scope of this document but you can read the code. Sources the lib-status script when generating a status report. Sources lib-setup for some of the arguments parsing logic and interactive dialogs implementation.
+
+`geoip-shell <on|off>` : Enable or disable the geoip blocking chain (via a rule in the base geoip chain)
+
+`geoip-shell <add|remove> [-c <"country_codes">]` :
+* Adds or removes the specified country codes to/from the config file.
+* Calls the -run script to fetch the ip lists for specified countries and apply them to the firewall (or to remove them).
+
+`geoip-shell status`
+* Displays information on the current state of geoip blocking
+* For a list of all firewall rules in the geoip chain and for detailed count of ip ranges, run `geoip-shell status -v`.
+
+`geoip-shell restore` : re-fetches and re-applies geoip firewall rules and ip lists as per the config.
+
+`geoip-shell showconfig` : prints the contents of the config file.
+
+`geoip-shell configure [options]` : changes geoip-shell configuration.
+
+Initial configuration is possible either fully interactively (the -manage script gathers all important config via dialog with the user), partially interactively (you provide some command line arguments, the -manage script processes them and if needed, asks you additional questions), or completely non-interactively by calling the -manage script with the `-z` option which will force setup to fail if any required options are missing or invalid. Any sensible combination of the following options is allowed in one command.
+
+**Options for the `geoip-shell configure` command:**
+
+`-m [whitelist|blacklist]`: Change geoip blocking mode.
+
+`-c <"country codes">`: Change which country codes are included in the whitelist/blacklist (this command replaces all country codes with newly specified ones).
+
+`-f <ipv4|ipv6|"ipv4 ipv6">`: Families (defaults to 'ipv4 ipv6'). Use double quotes for multiple families.
+
+`-u [ripe|ipdeny]`: Change ip lists source.
+
+`-i <[ifaces]|auto|all>`: Change which network interfaces geoip firewall rules are applied to. `auto` will attempt to automatically detect WAN network interfaces. `auto` works correctly in **most** cases but not in **every** case. Don't use `auto` if the machine has no dedicated WAN network interfaces. The automatic detection occurs only when manually triggered by the user via this command.
+
+`-l <"[lan_ips]"|auto|none>`: Specify LAN ip's or subnets to exclude from blocking (both ipv4 and ipv6). `auto` will trigger LAN subnets re-detection at every update of the ip lists. When specifying custom ip's or subnets, automatic detection is disabled. This option is only avaiable when using geoip-shell in whitelist mode.
+
+`-t <"[trusted_ips]|none">`: Specify trusted ip's or subnets (anywhere on the Internet) to exclude from geoip blocking (both ipv4 and ipv6).
+
+`-p <[tcp|udp]:[allow|block]:[all|<ports>]>`: Specify ports geoip blocking will apply (or not apply) to, for tcp or udp. To specify ports for both tcp and udp, use the `-p` option twice. For more details, read [NOTES.md](NOTES.md), sections 9-11.
+
+`-r <[user_country_code]|none>` : Specify user's country code. Used to prevent accidental lockout of a remote machine. `none` disables this feature.
+
+`-s <"schedule_expression"|disable>` : Enables automatic ip lists updates and configures the schedule for the periodic cron job which implements this feature. `disable` disables automatic ip lists updates.
+
+`-o <true|false>` : No backup. If set to 'true', geoip-shell will not create a backup of ip lists and firewall rules after applying changes, and will automatically re-fetch ip lists after each reboot. Default is 'true' for OpenWrt, 'false' for all other systems.
+
+`-a <path>` : Set custom path to directory where backups and the status file will be stored. Default is '/tmp/geoip-shell-data' for OpenWrt, '/var/lib/geoip-shell' for all other systems.
+
+
+`-O <memory|performance>`: Specify optimization policy for nftables sets. By default optimizes for low memory consumption if system RAM is less than 2GiB, otherwise optimizes for performance. This option doesn't work with iptables.
+
+`-z`: Non-interactive setup.
+
+
+**geoip-shell-run.sh**: Serves as a proxy to call the -fetch, -apply and -backup scripts with arguments required for each action. Executes the requested actions, depending on the config and the command line options, and writes to system log when starting and on action completion (or if any errors encountered). If persistence or autoupdates are enabled, the cron jobs (or on OpenWrt, the firewall include script) call this script with the necessary options. If a non-fatal error is encountered during an automatic update function, the script enters sort of a temporary daemon mode where it will re-try the action (up to a certain number of retries) with increasing time intervals. It also implements some logic to account for unexpected issues encountered during the 'restore' action which runs after system reboot to impelement persistnece, such as a missing backup, and in this situation will automatically change its action from 'restore' to 'update' and try to re-fetch and re-apply the ip lists.
+
+`geoip-shell-run.sh add -l <"list_id [list_id] ... [list_id]">` : Fetches ip lists, loads them into ip sets and applies firewall rules for specified list id's.
+A list id has the format of `<country_code>_<family>`. For example, **US_ipv4** and **GB_ipv6** are valid list id's.
+
+`geoip-shell-run.sh remove -l <"list_ids">` : Removes iplists and firewall rules for specified list id's.
+
+`geoip-shell-run.sh update` : Updates the ip sets for list id's that had been previously configured. Intended for triggering from periodic cron jobs.
+
+`geoip-shell-run.sh restore` : Restore previously downloaded lists from backup (skip fetching). Used by the reboot cron job (or by the firewall include on OpenWrt) to implement persistence.
+
+**geoip-shell-fetch.sh**
+- Fetches ip lists for given list id's from RIPE or from ipdeny.
+- Parses, validates, compiles the downloaded lists, and saves each one to a separate file.
+- Implements extensive sanity checks at each stage (fetching, parsing, validating and saving) and handles errors if they occur.
+
+Options:
+
+`-l <"list_ids">` : ip list id's in the format <country_code>_<family> (if specifying multiple list id's, use double quotes)
+
+`-p <path>` : Path to directory where downloaded and compiled subnet lists will be stored.
+
+`-o <output_file>` : Path to output file where fetched list will be stored.
+
+`-s <status_file>` : Path to a status file to register fetch results in.
+
+`-u <ripe|ipdeny>` : Use this ip list source for download. Supported sources: ripe, ipdeny.
+
+Extra options:
+
+`-r` : Raw mode (outputs newline-delimited ip lists rather than nftables-ready ones).
+
+`-f` : Force using fetched lists even if list timestamp didn't change compared to existing list.
+
+
+**geoip-shell-apply.sh**: directly interfaces with the firewall. Creates or removes ip sets and firewall rules for specified list id's. Sources the lib-ipt or lib-nft library script.
+
+`geoip-shell-apply.sh add -l <"list_ids">` :
+- Loads ip list files for specified list id's into ip sets and applies firewall rules required for geoip blocking.
+
+List id has the format of `<country_code>_<family>`. For example, **US_ipv4** and **GB_ipv6** are valid list id's.
+
+`geoip-shell-apply.sh remove -l <"list_ids">` :
+- removes ip sets and geoip firewall rules for specified list id's.
+
+**geoip-shell-cronsetup.sh** manages all the cron-related logic and actions. Called by the -manage script. Cron jobs are created based on the settings stored in the config file. Also used to validate cron schedule specified by the user.
+
+**geoip-shell-backup.sh**: Creates backup of current geoip-shell firewall rules and ip sets and current geoip-shell config, or restores them from backup. By default (if you didn't configure geoip-shell with the '-o' option), backup will be created after every change to ip sets in the firewall. Backups are automatically compressed and de-compressed with the best utility available to the system, in this order "bzip2, xz, gzip", or simply "cat" as a fallback if neither is available (which generally should never happen on Linux). Only one backup copy is kept. Sources the lib-ipt or the lib-nft library script.
+
+`geoip-shell-backup.sh create-backup` : Creates backup of geoip-shell ip sets and config.
+
+`geoip-shell-backup.sh restore` : Restores geoip-shell state and config from backup. Used by the *run script to implement persistence. Can be manually used for recovery from fault conditions. If run with option `-n`, does not restore the config and the status files.
+
--- /dev/null
+# Copyright 2024 friendly-bits, antonk (antonk.d3v@gmail.com)
+# This is free software, licensed under the GNU General Public License v3.
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=geoip-shell
+PKG_VERSION:=0.5.2
+PKG_RELEASE:=1
+PKG_LICENSE:=GPL-3.0-or-later
+PKG_MAINTAINER:=antonk <antonk.d3v@gmail.com>
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_VERSION:=db8bbf4ce04094843beea1b1aa4fbceb0d35688d
+PKG_SOURCE_URL:=https://github.com/friendly-bits/geoip-shell-openwrt.git
+PKG_MIRROR_HASH:=4b0b90a936b8e9b476a0b85bd2100fcc4d1da25cd6929c0bcc282ae7ff137e9f
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/geoip-shell/Default
+ CATEGORY:=Network
+ TITLE:=Flexible geoip blocker
+ URL:=https://github.com/friendly-bits/geoip-shell
+ MAINTAINER:=antonk <antonk.d3v@gmail.com>
+ DEPENDS:=+ca-bundle
+ PROVIDES:=geoip-shell
+ PKGARCH:=all
+endef
+
+define Package/geoip-shell
+$(call Package/geoip-shell/Default)
+ TITLE+= with nftables support
+ DEPENDS+= +kmod-nft-core +nftables +firewall4
+ DEFAULT_VARIANT:=1
+ VARIANT:=nftables
+endef
+
+define Package/geoip-shell-iptables
+$(call Package/geoip-shell/Default)
+ TITLE+= with iptables support
+ DEPENDS+= +kmod-ipt-ipset +IPV6:ip6tables +iptables +ipset
+ VARIANT:=iptables
+ CONFLICTS:=geoip-shell firewall4
+endef
+
+define Package/geoip-shell/description/Default
+ Flexible geoip blocker with a user-friendly command line interface (currently no LuCi interface).
+ For readme, please see
+ https://github.com/openwrt/packages/blob/master/net/geoip-shell/OpenWrt-README.md
+endef
+
+define Package/geoip-shell/description
+$(call Package/geoip-shell/description/Default)
+endef
+
+define Package/geoip-shell-iptables/description
+$(call Package/geoip-shell/description/Default)
+endef
+
+define Package/geoip-shell/postinst/Default
+ #!/bin/sh
+ rm "/usr/bin/geoip-shell" 2>/dev/null
+ ln -s "/usr/bin/geoip-shell-manage.sh" "/usr/bin/geoip-shell"
+ [ -s "/etc/geoip-shell/geoip-shell.conf" ] && /usr/bin/geoip-shell configure -z && exit 0
+ logger -s -t "geoip-shell" "Please run 'geoip-shell configure' to complete the setup."
+ exit 0
+endef
+
+define Package/geoip-shell/postinst
+$(call Package/geoip-shell/postinst/Default)
+endef
+
+define Package/geoip-shell-iptables/postinst
+$(call Package/geoip-shell/postinst/Default)
+endef
+
+define Package/geoip-shell/prerm/Default
+ #!/bin/sh
+ sh /usr/lib/geoip-shell/geoip-shell-owrt-uninstall.sh
+ exit 0
+endef
+
+define Package/geoip-shell/prerm
+$(call Package/geoip-shell/prerm/Default)
+endef
+
+define Package/geoip-shell-iptables/prerm
+$(call Package/geoip-shell/prerm/Default)
+endef
+
+define Package/geoip-shell/postrm
+ #!/bin/sh
+ sleep 1
+ echo "Reloading the firewall..."
+ fw4 -q reload
+ exit 0
+endef
+
+define Package/geoip-shell-iptables/postrm
+ #!/bin/sh
+ sleep 1
+ echo "Reloading the firewall..."
+ fw3 -q reload
+ exit 0
+endef
+
+define Build/Configure
+endef
+
+define Build/Compile
+endef
+
+define Package/geoip-shell/install/Default
+
+ $(INSTALL_DIR) $(1)/etc/init.d
+ $(INSTALL_BIN) $(PKG_BUILD_DIR)/etc/init.d/geoip-shell-init $(1)/etc/init.d
+
+ $(INSTALL_DIR) $(1)/etc/geoip-shell
+ $(INSTALL_CONF) $(PKG_BUILD_DIR)/etc/geoip-shell/cca2.list $(1)/etc/geoip-shell
+ $(INSTALL_CONF) $(PKG_BUILD_DIR)/etc/geoip-shell/geoip-shell.const $(1)/etc/geoip-shell
+
+ $(INSTALL_DIR) $(1)/usr/bin
+ $(INSTALL_BIN) $(PKG_BUILD_DIR)/usr/bin/geoip-shell-fetch.sh $(1)/usr/bin
+ $(INSTALL_BIN) $(PKG_BUILD_DIR)/usr/bin/geoip-shell-fw-include.sh $(1)/usr/bin
+ $(INSTALL_BIN) $(PKG_BUILD_DIR)/usr/bin/geoip-shell-backup.sh $(1)/usr/bin
+ $(INSTALL_BIN) $(PKG_BUILD_DIR)/usr/bin/geoip-shell-geoinit.sh $(1)/usr/bin
+ $(INSTALL_BIN) $(PKG_BUILD_DIR)/usr/bin/geoip-shell-run.sh $(1)/usr/bin
+ $(INSTALL_BIN) $(PKG_BUILD_DIR)/usr/bin/geoip-shell-mk-fw-include.sh $(1)/usr/bin
+ $(INSTALL_BIN) $(PKG_BUILD_DIR)/usr/bin/geoip-shell-manage.sh $(1)/usr/bin
+ $(INSTALL_BIN) $(PKG_BUILD_DIR)/usr/bin/geoip-shell-apply.sh $(1)/usr/bin
+ $(INSTALL_BIN) $(PKG_BUILD_DIR)/usr/bin/geoip-shell-detect-lan.sh $(1)/usr/bin
+ $(INSTALL_BIN) $(PKG_BUILD_DIR)/usr/bin/geoip-shell-cronsetup.sh $(1)/usr/bin
+
+ $(INSTALL_DIR) $(1)/usr/lib/geoip-shell
+ $(INSTALL_CONF) $(PKG_BUILD_DIR)/usr/lib/geoip-shell/geoip-shell-lib-status.sh $(1)/usr/lib/geoip-shell
+ $(INSTALL_CONF) $(PKG_BUILD_DIR)/usr/lib/geoip-shell/geoip-shell-lib-owrt-common.sh $(1)/usr/lib/geoip-shell
+ $(INSTALL_CONF) $(PKG_BUILD_DIR)/usr/lib/geoip-shell/geoip-shell-lib-common.sh $(1)/usr/lib/geoip-shell
+ $(INSTALL_CONF) $(PKG_BUILD_DIR)/usr/lib/geoip-shell/geoip-shell-owrt-uninstall.sh $(1)/usr/lib/geoip-shell
+ $(INSTALL_CONF) $(PKG_BUILD_DIR)/usr/lib/geoip-shell/geoip-shell-lib-arrays.sh $(1)/usr/lib/geoip-shell
+ $(INSTALL_CONF) $(PKG_BUILD_DIR)/usr/lib/geoip-shell/geoip-shell-lib-setup.sh $(1)/usr/lib/geoip-shell
+ $(INSTALL_CONF) $(PKG_BUILD_DIR)/usr/lib/geoip-shell/geoip-shell-lib-uninstall.sh $(1)/usr/lib/geoip-shell
+
+endef
+
+
+define Package/geoip-shell/install
+$(call Package/geoip-shell/install/Default,$(1))
+ $(INSTALL_DIR) $(1)/usr/lib/geoip-shell
+ $(INSTALL_CONF) $(PKG_BUILD_DIR)/usr/lib/geoip-shell/geoip-shell-lib-nft.sh $(1)/usr/lib/geoip-shell
+
+endef
+
+
+define Package/geoip-shell-iptables/install
+$(call Package/geoip-shell/install/Default,$(1))
+ $(INSTALL_DIR) $(1)/usr/lib/geoip-shell
+ $(INSTALL_CONF) $(PKG_BUILD_DIR)/usr/lib/geoip-shell/geoip-shell-lib-ipt.sh $(1)/usr/lib/geoip-shell
+
+endef
+
+$(eval $(call BuildPackage,geoip-shell))
+$(eval $(call BuildPackage,geoip-shell-iptables))
+
+
--- /dev/null
+## **Notes**
+1) On OpenWrt, geoip-shell expects that the default shell (called by the `sh` command) is _ash_, and the automatic shell detection feature implemented for other platforms is disabled on OpenWrt.
+
+2) Firewall rules structure created by geoip-shell:
+ <details> <summary>Read more:</summary>
+
+ ### **iptables**
+ - With **iptables**, all firewall rules created by geoip-shell are in the table `mangle`. The reason to use `mangle` is that this table has a built-in chain called `PREROUTING` which is attached to the `prerouting` hook in the netfilter kernel component. Via a rule in this chain, geoip-shell creates one set of rules which applies to all ingress traffic for a given ip family, rather than having to create and maintain separate rules for chains INPUT and FORWARDING which would be possible in the default `filter` table.
+ - This also means that any rules you might have in the `filter` table will only see traffic which is allowed by geoip-shell rules, which may reduce the CPU load as a side-effect.
+ - Note that **iptables** features separate tables for ipv4 and ipv6, hence geoip-shell creates separate rules for each family (unless the user restricts geoip-shell to a certain family during installation).
+ - Inside the table `mangle`, geoip-shell creates the custom chain `GEOIP-SHELL` and redirects traffic to it via a rule in the `PREROUTING` chain. geoip-shell calls that rule the "enable" rule which can be removed or re-added on-demand with the commands `geoip-shell on` and `geoip-shell off`. If the "enable" rule is not present, system firewall will act as if all other geoip-shell rules (for a given ip family) are not present.
+ - If specific network interfaces were set during installation, the "enable" rule directs traffic to a 2nd custom chain `GEOIP-SHELL_WAN` rather than to the `GEOIP-SHELL` chain. geoip-shell creates rules in the `GEOIP-SHELL_WAN` chain which selectively direct traffic only from the specified network interfaces to the `GEOIP-SHELL` chain.
+ - With iptables, geoip-shell removes the "enable" rule before making any changes to the ip sets and rules, and re-adds it once the changes have been successfully made. This is a precaution measure intended to minimize any chance of potential problems. Typically ip list updates do not take more than a few seconds, and on reasonably fast systems less than a second, so the time when geoip blocking is not enabled is typically very brief.
+
+ ### **nftables**
+ - With **nftables**, all firewall rules created by geoip-shell are in the table named `geoip-shell`, family "inet", which is a term nftables uses for tables applying to both ip families. The `geoip-shell` table includes rules for both ip families and any nftables sets geoip-shell creates. geoip-shell creates 2 chains in that table: `GEOIP-BASE` and `GEOIP-SHELL`. The base chain attaches to netfilter's `prerouting` hook and has a rule which directs traffic to the `GEOIP-SHELL` chain. That rule is the geoip-shell "enable" rule for nftables-based systems which acts exactly like the "enable" rule in the iptables-based systems, except it applies to both ip families.
+ - **nftables** allows for more control over which network interfaces each rule applies to, so when certain network interfaces are specified during initial setup, geoip-shell specifies these interfaces directly in the rules inside the `GEOIP-SHELL` chain, and so (contrary to iptables-based systems) there is no need in an additional chain.
+ - **nftables** features atomic rules updates, meaning that when issuing multiple nftables commands at once, if any command fails, all changes get cancelled and the system remains in the same state as before. geoip-shell utilizes this feature for fault-tolerance and to completely eliminate time when geoip blocking is disabled during an update of the sets or rules.
+ - **nftables** current version (up to 1.0.8 and probably 1.0.9) has some bugs related to unnecessarily high transient memory consumption when performing certain actions, including adding new sets. These bugs are known and for the most part, already have patches implemented which should eventually roll out to the distributions. This mostly matters for embedded hardware with less than 512MB of memory. geoip-shell works around these bugs as much as possible. One of the workarounds is to avoid using the atomic replacement feature for nftables sets. Instead, when updating sets, geoip-shell first adds new sets one by one, then atomically applies all other changes, including rules changes and removing the old sets. In case of an error during any stage of this process, all changes get cancelled, old rules and sets remain in place and geoip-shell then destroys the new sets. This is less efficient but with current versions of nftables, this actually lowers the minimum memory bar for the embedded devices. Once a new version of nftables will be rolled out to the distros, geoip-shell will adapt the algorithm accordingly.
+
+ ### **nftables and iptables**
+ - With both **nftables** and **iptables**, geoip-shell goes a long way to make sure that firewall rules and ip sets are correct and matching the user-defined config. Automatic corrective mechanisms are implemented which should restore geoip-shell firewall rules in case they do not match the config (which normally should never happen).
+ - geoip-shell implements rules and ip sets "tagging" to distinguish between its own rules and other rules and sets. This way, geoip-shell never makes any changes to any rules or sets which geoip-shell did not create.
+ - When uninstalling, geoip-shell removes all its rules, chains and ip sets.
+
+ </details>
+
+3) geoip-shell uses RIPE as the default source for ip lists. RIPE is a regional registry, and as such, is expected to stay online and free for the foreseeable future. However, RIPE may be fairly slow in some regions. For that reason, I implemented support for fetching ip lists from ipdeny. ipdeny provides aggregated ip lists, meaning in short that there are less entries for same effective geoip blocking, so the machine which these lists are installed on has to do less work when processing incoming connection requests. All ip lists the suite fetches from ipdeny are aggregated lists.
+
+4) The script intended as user interface is **geoip-shell-manage.sh** (also called by running **geoip-shell**).
+
+5) How to manually check firewall rules created by geoip-shell:
+ - With nftables: `nft -t list table inet geoip-shell`. This will display all geoip-shell rules and sets.
+ - With iptables: `iptables -vL -t mangle` and `ip6tables -vL -t mangle`. This will report all geoip-shell rules. To check ipsets created by geoip-shell, use `ipset list -n | grep geoip-shell`. For a more detailed view, use this command: `ipset list -t`.
+
+6) The run, fetch and apply scripts write to syslog in case an error occurs. The run and fetch scripts also write to syslog upon success. To verify that cron jobs ran successfully, on Debian and derivatives run `cat /var/log/syslog | grep geoip-shell`. On other distributions, you may need to figure out how to access the syslog.
+
+7) These scripts will not run in the background consuming resources (except for a short time when triggered by the cron jobs). All the actual blocking is done by the netfilter component in the kernel. The scripts offer an easy and relatively fool-proof interface with netfilter, config persistence, automated ip lists fetching and auto-update.
+
+8) Sometimes ip list source servers are temporarily unavailable and if you're unlucky enough to attempt installation during that time frame, the fetch script will fail which will cause the installation to fail as well. Try again after some time or use another source. Once the installation succeeds, an occasional fetch failure during autoupdate won't cause any issues as last successfully fetched ip list will be used until the next autoupdate cycle succeeds.
+
+9) How to geoblock or allow specific ports (applies to the _-install_ and _-manage_ scripts).
+ The general syntax is: `-p <[tcp|udp]:[allow|block]:[all|<ports>]>`
+ Where `ports` may be any combination of comma-separated individual ports or port ranges (for example: `125-130` or `5,6` or `3,140-145,8`).
+ You can use the `-p` option twice to cover both tcp and udp, for example: `-p tcp:allow:22,23 -p udp:block:128-256,3`
+
+ Examples with the -install script:
+
+ `sh geoip-shell-install -c de -m whitelist -p tcp:allow:125-135,7` - for tcp, allow incoming traffic on ports 125-135 and 7, geoblock incoming traffic on other tcp ports (doesn't affect UDP traffic)
+
+ `sh geoip-shell-install -c de -m blacklist -p udp:allow:3,15-20,1024-2048` - for udp, allow incoming traffic on ports 15-20 and 3, geoblock all other incoming udp traffic (doesn't affect TCP traffic)
+
+ Examples with the -manage script (also called via 'geoip-shell' after installation) :
+
+ `geoip-shell configure -p tcp:block:all` - for tcp, geoblock all ports (default behavior)
+
+ `geoip-shell configure -p udp:allow:all` - for udp, don't geoblock any ports (completely disables geoblocking for udp)
+
+ `geoip-shell configure -p tcp:block:125-135,7` - for tcp, only geoblock incoming traffic on ports 125-135 and 7, allow incoming traffic on all other tcp ports
+
+10) How to remove specific ports assignment:
+
+ use `-p [tcp|udp]:block:all`.
+
+ Example: `geoip-shell configure -p tcp:block:all` will remove prior port-specific rules for the tcp protocol. All tcp packets on all ports will now go through geoip filter.
+
+11) How to make all packets for a specific protocol bypass geoip blocking:
+
+ use `p [tcp|udp]:allow:all`
+
+ Example: `geoip-shell configure -p udp:allow:all` will allow all udp packets on all ports to bypass the geoip filter.
+
+12) Firewall rules persistence, as well as automatic list updates, is implemented via cron jobs: a periodic job running by default on a daily schedule, and a job that runs at system reboot (after 30 seconds delay). Either or both cron jobs can be disabled (run the *install script with the -h option to find out how, or read [DETAILS.md](DETAILS.md)). On OpenWrt, persistence is implemented via an init script and a firewall include rather than via a cron job.
+
+13) You can specify a custom schedule for the periodic cron job by passing an argument to the install script. Run it with the '-h' option for more info.
+
+14) If you want to change the autoumatic update schedule but you don't know the crontab expression syntax, check out https://crontab.guru/ (no affiliation). geoip-shell includes a script which validates cron expressions you request, so don't worry about making a mistake.
+
+15) Note that cron jobs will be run as root.
+
+16) If you have nftables installed but for some reason you are using iptables rules (via the nft_compat kernel module which is provided by packages like nft-iptables etc), you can and probably should install geoip-shell with the option `-w ipt` which will force it to use iptables+ipset. For example: `geoip-shell install -w ipt`.
+
+17) If you upgrade your system from iptables to nftables, you can either re-install geoip-shell and it will then automatically use nftables, or you can use this command without reinstalling: `geoip-shell configure -w nft`, which will remove all iptables rules and ipsets and re-create nftables rules and sets based on your existing config. If you are on OpenWrt, this does not apply: instead, you will need to install the geoip-shell package for nftables-based OpenWrt.
+
+18) To test before deployment:
+ <details> <summary>Read more:</summary>
+
+ - You can run the install script with the "-N true" (N stands for noblock) option to apply all actions and create all firewall rules except the geoip-shell "enable" rule. This way you can make sure that no errors are encountered and check the resulting firewall rules before committing to actual blocking. To enable blocking later, use the command `geoip-shell on`.
+ - You can run the install script with the "-n true" (n stands for nopersistence) option to skip creating the reboot cron job which implements persistence and with the '-s disable' option to skip creating the autoupdate cron job. This way, a simple machine restart should undo all changes made to the firewall (unless you have some software which restores firewall settings after reboot). For example: `sh geoip-shell-install -c <country_code> -m whitelist -n true -s disable`. To enable persistence and automatic updates later, reinstall without both options.
+
+ </details>
+
+19) How to get yourself locked out of your remote server and how to prevent this:
+ <details> <summary>Read more:</summary>
+
+ There are 4 scenarios where you can lock yourself out of your remote server with this suite:
+ - install in whitelist mode without including your country in the whitelist
+ - install in whitelist mode and later remove your country from the whitelist
+ - blacklist your country (either during installation or later)
+ - your remote machine has no dedicated WAN interfaces (it is behind a router) and you incorrectly specified LAN subnets the machine belongs to
+
+ As to the first 3 scenarios, the -manage script will warn you in each of these situations and wait for your input (you can press Y and do it anyway), but that depends on you correctly specifying your country code during installation. The -install script will ask you about it. If you prefer, you can skip by pressing Enter - that will disable this feature. If you do provide the -install script your country code, it will be added to the config file on your machine and the -manage script will read the value and perform the necessary checks, during installation or later when you want to make changes to the blacklist/whitelist.
+
+ As to the 4th scenario, geoip-shell implements LAN subnets automatic detection and asks you to verify that the detected LAN subnets are correct. If you are not sure how to verify this, reading the [SETUP.md](SETUP.md) file should help. Read the documentation, follow it and you should be fine. If you specify your own LAN ip addresses or subnets (rather than using the automatically detected ones), geoip-shell validates them, meaning it makes sure that they appear to be valid by checking them with regex, and asking the kernel. This does not prevent a situation where you provide technically valid ip's/subnets which however are not actually used in the LAN your machine belongs to. So double-check. Also note that LAN subnets **may** change in the future, for example if someone changes some config in the router or replaces the router etc. For this reason, when installing the suite for **all** network interfaces, the -install script offers to enable automatic detection of LAN subnets at each periodic update. If for some reason you do not enable this feature, you will need to make the necessary precautions when changing LAN subnets your remote machine belongs to.
+
+ As an additional measure, during installation you can specify trusted ip addresses anywhere on the Internet which will not be geoblocked, so in case something goes very wrong, you will be able to regain access to the remote machine. This does require to have a known static public ip address or subnet. To specify ip's, call the install script with this option: `-t <"[trusted_ips]">`.
+
+ </details>
--- /dev/null
+## geoip-shell on OpenWrt
+
+Currently geoip-shell fully supports OpenWrt, both with firewall3 + iptables and with firewall4 + nftables, while providing the same user interface and features as on any other Linux system. So usage is the same as described in the main [README.md](README.md) file, while some parts of the backend (namely persistence implementation), some defaults and the location of the data directory are different.
+
+The _geoip-shell-iptables_ package is for firewall3+iptables OpenWrt systems, while the _geoip-shell_ package is for firewall4+nftables OpenWrt systems.
+
+A LuCi interface has not been implemented (yet). As on any other Linux system, all user interface is via a command line (but my goal is to make this an easy experience regardless). If this discourages you from using geoip-shell, please let me know. A few people asking for this feature may motivate me to prioritize it.
+
+## Usage after installation via ipk
+After installing the ipk package, geoip-shell will be inactive until you configure it. To do so, run `geoip-shell configure` and follow the interactive setup. You can also run `geoip-shell -h` before that to find out about configuration options and then append certain options after the `configure` action, for example: `geoip-shell configure -c "de nl" -m whitelist` to configure geoip-shell in whitelist mode for countries Germany and Netherlands. The interactive setup will ask you about all the important options but some niche options are only available non-interactively (for example if you want to configure geoblocking for certain selection of ports). You can always change these settings after initial configuration via the same `geoip-shell configure` command.
+
+## Uninstallation of geoip-shell if installed via ipk
+- For nftables-based systems: `opkg remove geoip-shell`
+- For iptables-based systems: `opkg remove geoip-shell-iptables`
+
+## Resources management on OpenWrt
+Because OpenWrt typically runs on embedded devices with limited memory and very small flash storage, geoip-shell implements some techniques to conserve these resources as much as possible:
+- During installation on OpenWrt, comments and the debug code are stripped from the scripts to reduce their size.
+- Only the required modules are installed, depending on the system (iptables- or nftables- based).
+- I've researched the most memory-efficient way for loading ip lists into nftables sets. Currently, nftables has some bugs related to this process which may cause unnecessarily high memory consumption. geoip-shell works around these bugs as much as possible.
+- To avoid unnecessary flash storage wear, all filesystem-related tasks geoip-shell does which do not require permanent storage are done in the /tmp directory which in the typical OpenWrt installation is mounted on the ramdisk.
+- Some defaults on OpenWrt are different to further minimize flash storage wear (read below).
+
+### Scripts size
+Typical geoip-shell installation on an OpenWrt system currently consumes around 120kB. The distribution folder itself weighs quite a bit more (mainly because of documentation) but you can install via an ipk which doesn't remain in storage after installation, or if installing via the -install script, delete the distribution folder and free up space taken by it. geoip-shell does not install its documentation into the system.
+I have some plans to reduce that size by compressing certain scripts which provide user interface and implementing automatic extraction to /tmp when the user wants to access them, but this is not yet implemented.
+
+To view all installed geoip-shell scripts in your system and their sizes, run `ls -lh /usr/bin/geoip-shell-* /usr/lib/geoip-shell/*`.
+
+## Persistence on OpenWrt
+- Persistence of geoip firewall rules and ip sets works differenetly on OpenWrt than on other Linuxes, since geoip-shell has an OpenWrt-specific procd init script.
+- The cron job which implements persistence on other Linuxes and runs at reboot is not created on OpenWrt.
+- geoip-shell integrates into firewall3 or firewall4 via what's called a "firewall include". On OpenWrt, a firewall include is a setting which tells firewall3 or firewall4 to do something specific in response to certain events.
+- The only task of the init script for geoip-shell is to call the geoip-shell-mk-fw-include.sh script, which makes sure that the firewall include exists and is correct, if not then creates the include.
+- The firewall include is what does the actual persistence work. geoip-shell firewall include triggers on firewall reload (which happens either at reboot or when the system decides that a reload of the firewall is necessary, or when initiated by the user).
+- When triggered, the include script calls the -run script with the "restore" action.
+- The -run script verifies that geoip nftables/iptables rules and ip sets exist, and if not then it restores them from backup, or (if backup doesn't exist) initiates re-fetch of the ip lists and then re-creates the rules and the ip sets.
+- By default, geoip-shell does not create backups on OpenWrt because typically the permanent storage is very small and prone to wear.
+- Automatic updates of ip lists on OpenWrt are triggered from a cron job like on other Linuxes.
+
+## Defaults for OpenWrt
+Generally the defaults are the same as for other systems, except:
+- the data directory which geoip-shell uses to store the status file and the backups is by default in `/tmp/geoip-shell-data`, rather than in `/var/lib/geoip-shell` as on other Linux systems. This is to avoid flash wear. You can change this by running the install script with the `-a <path>` option, or after installation via the command `geoip-shell configure -a <path>`.
+- the 'nobackup' option is set to 'true', which configures geoip-shell to not create backups of the ip lists. With this option, geoip-shell will work as usual, except after reboot (and for iptables-based systems, after firewall restart) it will re-fetch the ip lists, rather than loading them from backup. You can change this by running the -install script with the `-o false` option (`-o` stands for nobackup), or after installation via the command `geoip-shell configure -o false`. To have persistent ip list backups, you will also need to change the data directory path as explained above.
+- if using geoip-shell on a router with just a few MB of embedded flash storage, consider either leaving the nobackup and datadir path defaults as is, or connecting an external storage device to your router (preferably formatted to ext4) and configuring a directory on it as your geoip-shell data directory, then enabling automatic backups. For example, if your external storage device is mounted on _/mnt/somedevice_, you can do all this via this command: `geoip-shell configure -a /mnt/somedevice/geoip-shell-data -o false`.
+- the default ip lists source for OpenWrt is ipdeny (rather than ripe). While ipdeny is a 3rd party, they provide aggregated lists which consume less memory (on nftables-based systems the ip lists are automatically optimized after loading into memory, so there the source does not matter, but a smaller initial ip lists size will cause a smaller memory consumption spike while loading the ip list).
+
+This is about it for this document. Much more information is available in the main [README.md](README.md) and in the extra _.md_ files inside the Documentation directory. If you have any questions, contact me in this thread:
+https://forum.openwrt.org/t/geoip-shell-flexible-geoip-blocker-for-linux-now-supports-openwrt/189611
+
+If you use this project, I will be happy to hear about your experience in the above thread. If for some reason geoip-shell is not working for you, I will want to know that as well so I can improve it.
+
--- /dev/null
+# **geoip-shell**
+Geoip blocker for Linux. Supports both **nftables** and **iptables** firewall management utilities.
+
+The idea of this project is making geoip blocking easy on (almost) any Linux system, no matter which hardware, including desktop, server, VPS or router, while also being reliable and providing flexible configuration options for the advanced users.
+
+Supports running on OpenWrt. Supports ipv4 and ipv6.
+
+## Table of contents
+- [Main Features](#main-features)
+- [Usage](#usage)
+- [Pre-requisites](#pre-requisites)
+- [Notes](#notes)
+- [In detail](#in-detail)
+- [OpenWrt](#openwrt)
+- [Privacy](#privacy)
+
+## **Main Features**
+* Core functionality is creating either a whitelist or a blacklist in the firewall using automatically downloaded ip lists for user-specified countries.
+
+* ip lists are fetched either from **RIPE** (regional Internet registry for Europe, the Middle East and parts of Central Asia) or from **ipdeny**. Both sources provide updated ip lists for all regions.
+
+* All firewall rules and ip sets required for geoip blocking to work are created automatically during installation or setup.
+
+* Implements optional (enabled by default) persistence of geoip blocking across system reboots and automatic updates of the ip lists.
+
+* After installation, a utility is provided to check geoip status and firewall rules or change country codes and geoip-related config.
+
+### **Reliability**:
+- Downloaded ip lists go through validation which safeguards against application of corrupted or incomplete lists to the firewall.
+
+<details> <summary>Read more:</summary>
+
+- With nftables, utilizes nftables atomic rules replacement to make the interaction with the system firewall fault-tolerant and to completely eliminate time when geoip is disabled during an automatic update.
+- All scripts perform extensive error detection and handling.
+- All user input is validated to reduce the chance of accidental mistakes.
+- Verifies firewall rules coherence after each action.
+- Automatic backup of geoip-shell state (optional, enabled by default except on OpenWrt).
+- Automatic recovery of geoip-shell firewall rules after a reboot (a.k.a persistence) or in case of unexpected errors.
+- Supports specifying trusted ip addresses anywhere on the Internet which will bypass geoip blocking to make it easier to regain access to the machine if something goes wrong.
+</details>
+
+### **Efficiency**:
+- Utilizes the native nftables sets (or, with iptables, the ipset utility) which allows to create efficient firewall rules with thousands of ip ranges.
+
+<details><summary>Read more:</summary>
+
+- With nftables, optimizes geoip blocking for low memory consumption or for performance, depending on the RAM capacity of the machine and on user preference. With iptables, automatic optimization is implemented.
+- Ip list parsing and validation are implemented through efficient regex processing which is very quick even on slow embedded CPU's.
+- Implements smart update of ip lists via data timestamp checks, which avoids unnecessary downloads and reconfiguration of the firewall.
+- Uses the "prerouting" hook in kernel's netfilter component which shortens the path unwanted packets travel in the system and may reduce the CPU load if any additional firewall rules process incoming traffic down the line.
+- Supports the 'ipdeny' source which provides aggregated ip lists (useful for embedded devices with limited memory).
+- Scripts are only active for a short time when invoked either directly by the user or by the init script/reboot cron job/update cron job.
+
+</details>
+
+### **User-friendliness**:
+- Good command line interface and useful console messages.
+
+<details><summary>Read more:</summary>
+
+- Extensive and (usually) up-to-date documentation.
+- Sane settings are applied during installation by default, but also lots of command-line options for advanced users or for special corner cases are provided.
+- Provides a utility (symlinked to _'geoip-shell'_) for the user to change geoip config (turn geoip on or off, change country codes, change geoip blocking mode, change ip lists source, change the cron schedule etc).
+- Provides a command _('geoip-shell status')_ to check geoip blocking status, which also reports if there are any issues.
+- In case of an error or invalid user input, provides useful error messages to help with troubleshooting.
+- All main scripts display detailed 'usage' info when executed with the '-h' option.
+- The code should be fairly easy to read and includes a healthy amount of comments.
+</details>
+
+### **Compatibility**:
+- Since the project is written in POSIX-compliant shell code, it is compatible with virtually every Linux system (as long as it has the [pre-requisites](#pre-requisites)). It even works well on simple embedded routers with 8MB of flash storage and 128MB of memory (for nftables, 256MB is recommended if using large ip lists such as the one for US until the nftables team releases a fix reducing memory consumption).
+
+<details><summary>Read more:</summary>
+
+- Supports running on OpenWrt.
+- The project avoids using non-common utilities by implementing their functionality in custom shell code, which makes it faster and compatible with a wider range of systems.
+</details>
+
+## **Usage**
+
+If you want to change geoip blocking config or check geoip blocking status, you can do that via the provided utilities.
+A selection of options is given here, for additional options run `geoip-shell -h` or read [NOTES.md](NOTES.md)and [DETAILS.md](DETAILS.md).
+
+**To check current geoip blocking status:** `geoip-shell status`. For a list of all firewall rules in the geoip chain and for a detailed count of ip ranges in each ip list: `geoip-shell status -v`.
+
+**To add or remove ip lists for countries:** `geoip-shell <add|remove> -c <"country_codes">`
+
+_<details><summary>Examples:</summary>_
+- example (to add ip lists for Germany and Netherlands): `geoip-shell add -c "DE NL"`
+- example (to remove the ip list for Germany): `geoip-shell remove -c DE`
+</details>
+
+**To enable or disable geoip blocking:** `geoip-shell <on|off>`
+
+**To change ip lists source:** `geoip-shell configure -u <ripe|ipdeny>`
+
+**To change geoip blocking mode:** `geoip-shell configure -m <whitelist|blacklist>`
+
+**To have certain trusted ip addresses or subnets bypass geoip blocking:** `geoip-shell configure -t <["ip_addresses"]|none>`. `none` removes previously set trusted ip addresses.
+
+**To have certain LAN ip addresses or subnets bypass geoip blocking:** `geoip-shell configure -l <["ip_addresses"]|auto|none>`. `auto` will automatically detect LAN subnets (only use this if the machine has no dedicated WAN interfaces). `none` removes previously set LAN ip addresses. This is only needed when using geoip-shell in whitelist mode, and typically only if the machine has no dedicated WAN network interfaces. Otherwise you should apply geoip blocking only to those WAN interfaces, so traffic from your LAN to the machine will bypass the geoip filter.
+
+**To change protocols and ports geoblocking applies to:** `geoip-shell configure -p <[tcp|udp]:[allow|block]:[all|<ports>]>`
+
+_(for detailed description of this feature, read [NOTES.md](NOTES.md), sections 9-11)_
+
+**To enable or change the automatic update schedule:** `geoip-shell configure -s <"schedule_expression">`
+
+_<details><summary>Example</summary>_
+
+`geoip-shell configure -s "1 4 * * *"`
+
+</details>
+
+**To disable automatic updates of ip lists:** `geoip-shell configure -s disable`
+
+**To update or re-install geoip-shell:** run the -install script from the (updated) distribution directory. It will first run the -uninstall script of the older/existing version, then install the new version.
+
+On OpenWrt, if installed via an ipk package: `opkg uninstall <geoip-shell|geoip-shell-iptables>`
+
+## **Pre-requisites**
+- **Linux**. Tested on Debian-like systems and on OPENWRT, should work on any desktop/server distribution and possibly on some other embedded distributions.
+- **POSIX-compliant shell**. Works on most relatively modern shells, including **bash**, **dash**, **ksh93**, **yash** and **ash** (including Busybox **ash**). Likely works on **mksh** and **lksh**. Other flavors of **ksh** may or may not work _(please let me know if you try them)_. Does **not** work on **tcsh** and **zsh**.
+
+- **nftables** - firewall management utility. Supports nftables 1.0.2 and higher (may work with earlier versions but I do not test with them).
+- OR **iptables** - firewall management utility. Should work with any relatively modern version.
+- for **iptables**, requires the **ipset** utility - install it using your distribution's package manager
+- standard Unix utilities including **tr**, **cut**, **sort**, **wc**, **awk**, **sed**, **grep**, **pgrep**, **pidof** and **logger** which are included with every server/desktop linux distribution (and with OpenWrt). Both GNU and non-GNU versions are supported, including BusyBox implementation.
+- **wget** or **curl** or **uclient-fetch** (OpenWRT-specific utility).
+- for the autoupdate functionality, requires the **cron** service to be enabled.
+
+## **Notes**
+For some helpful notes about using this suite, read [NOTES.md](NOTES.md).
+
+## **In detail**
+For specifics about each script, read [DETAILS.md](DETAILS.md).
+
+## **OpenWrt**
+For information about OpenWrt support, read the [OpenWrt README](OpenWrt-README.md).
+
+## **Privacy**
+geoip-shell does not share your data with anyone.
+If you are using the ipdeny source then note that they are a 3rd party which has its own data privacy policy.
+
--- /dev/null
+## Notes about questions asked during the initial setup
+
+
+### **'Please enter your country code':**
+
+If you answer this question, the _-manage_ script will check that changes in ip lists which you request to make will not block your own country and warn you if they will. This applies both to the initial setup, and to any subsequent changes to the ip lists which you may want to make in the future. The idea behind this is to make this tool as fool-proof as possible. This information is written to the geoip-shell config file (only readable by root) on your device and geoip-shell does not send it anywhere. You can remove this config entry any time via the command `geoip-shell configure -r none`. You can skip the question by pressing Enter if you wish.
+
+### **'Does this machine have dedicated WAN interface(s)? [y|n]':**
+
+Answering this question is mandatory because the firewall is configured differently, depending on the answer. Answering it incorrectly may cause unexpected results, including having no geoip blocking or losing remote access to your machine.
+
+A machine may have dedicated WAN network interfaces if it's a router or in certain cases a VPS (virtual private server). When geoip-shell is configured to work with certain network interfaces, geoip firewall rules are applied only to traffic arriving from these interfaces, and all other traffic is left alone.
+
+Otherwise, geoip rules are applied to traffic arriving from all network interfaces, except the loopback interface. Besides that, when geoip-shell is installed in whitelist mode and you picked `n` in this question, additional firewall rules may be created which add LAN subnets or ip's to the whitelist in order to avoid blocking them (you can approve or configure that on the next step of the installation). This does not guarantee that your LAN subnets will not be blocked by another rule in another table, and in fact, if you prefer to block some of them then having them in whitelist will not matter. This is because while the 'drop' verdict is final, the 'accept' verdict is not.
+
+### **'Autodetected ipvX LAN subnets: ... [c]onfirm, c[h]ange, [s]kip or [a]bort?'**
+
+You will see this question if installing the suite in whitelist mode and you chose `n` in the previous question. The reason why under these conditions this question is asked is to avoid blocking your LAN from accessing your machine.
+
+If you are absolutely sure that you will not need to access the machine from the LAN then you can type in 's' to skip.
+Otherwise I recommend to add LAN subnets to the whitelist. You can either confirm the automatically detected subnets, or specify any combination of ip's and subnets on your LAN which you wish to allow connections from.
+
+The autodetection code should, in most cases, detect correct LAN subnets. However, it is up to you to verify that it's done its job correctly.
+
+One way to do that is by typing in 'c' to confirm and once installation completes, verifying that you can still access the machine from LAN (note that if you have an active connection to that machine, for example through SSH, it will likely continue to work until disconnection even if autodetection of LAN subnets did not work out correctly).
+Of course, this is risky in cases where you do not have physical access to the machine.
+
+Another way to do that is by checking which ip address you need to access the machine from, and then verifying that said ip address is included in one of the autodetected subnets. For example, if your other machine's ip is `192.168.1.5` and one of the autodetected subnets is `192.168.1.0/24` then you will want to check that `192.168.1.5` is included in subnet `192.168.1.0/24`. Provided you don't know how to make this calculation manually, you can use the `grepcidr` tool this way:
+`echo "192.168.1.5" | grepcidr "192.168.1.0/24"`
+
+The syntax to check in multiple subnets (note the double quotes):
+`echo "[ip]" | grepcidr "[subnet1] [subnet2] ... [subnetN]"`
+
+(also works for ipv6 addresses)
+
+If the ip address is in range, grepcidr will print it, otherwise it will not. You may need to install grepcidr using your distribution's package manager.
+
+Alternatively, you can use an online service which will do the same check for you. There are multiple services providing this functionality. To find them, look up 'IP Address In CIDR Range Check' in your preferred online search engine.
+
+A third way to do that is by examining your network configuration (in your router) and making sure that the autodetected subnets match those in the configuration.
+
+If you find out that the subnets were detected incorrectly, you can type in 'h' and manually enter the correct subnets or ip addresses which you want to allow connections from.
+
+### **'A[u]to-detect LAN subnets when updating ip lists or keep this config c[o]nstant?'**
+
+As the above question, you will see this one if installing the suite in whitelist mode and you answered `n` to the question about WAN interfaces. You will not see this question if you specified custom subnets or ips in the previous question.
+
+The rationale for this question is that network configuration may change, and if it does then previously correctly configured LAN subnets may become irrelevant.
+
+If you type in 'a', each time geoip firewall rules are initialized or updated, LAN subnets will be re-detected.
+
+If you type in 'c' then whatever subnets have been detected during installation will be kept forever (until you re-install geoip-shell).
+
+Generally if automatic detection worked as expected during initial setup, most likely it will work correctly every time, so it is a good idea to allow auto-detection with each update. If not then, well, not.
+
+### **Extra options**
+
+- geoip-shell supports an additional setting: trusted ip's or subnets. Currently this is only configurable by running the -install script with the option `-t <"[trusted_ips]">` (or after installation via the `geoip-shell configure -t <"[trusted_ips]">` command). You can specify trusted ip addresses or subnets anywhere on the LAN or on the Internet. To remove this setting later, run `geoip-shell configure -t none`.
+
+- geoip-shell supports lots of additional command-line options. You can find out more by running `geoip-shell -h`, or by reading [NOTES.md](NOTES.md) and [DETAILS.md](DETAILS.md).
\ No newline at end of file
include $(TOPDIR)/rules.mk
PKG_NAME:=hcxdumptool
-PKG_VERSION:=6.3.2
+PKG_VERSION:=6.3.4
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://codeload.github.com/zerbea/hcxdumptool/tar.gz/$(PKG_VERSION)?
-PKG_HASH:=1f6fe2b4757a5f20adeb6cc469693b4d0e8c49ba290450e10a37699d9f9a2a42
+PKG_HASH:=a45140960bd5de28085d549e1a9ccf2c08af143984a138c28ac4092c6a52a5d2
PKG_MAINTAINER:=Andreas Nilsen <adde88@gmail.com>
PKG_LICENSE:=MIT
--- /dev/null
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=hev-socks5-server
+PKG_VERSION:=2.6.5
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://github.com/heiher/hev-socks5-server/releases/download/$(PKG_VERSION)
+PKG_HASH:=07d3297483cc624464eec424f7dd27f2028f4f56c70c2c9d0b6902e181a32ccb
+
+PKG_MAINTAINER:=Ray Wang <r@hev.cc>
+PKG_LICENSE:=GPL-3.0-only
+PKG_LICENSE_FILES:=License
+
+PKG_BUILD_FLAGS:=no-mips16
+PKG_BUILD_PARALLEL:=1
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/hev-socks5-server
+ SECTION:=net
+ CATEGORY:=Network
+ TITLE:=A high-performance socks5 server for Unix
+ URL:=https://github.com/heiher/hev-socks5-server
+endef
+
+MAKE_FLAGS += REV_ID="$(PKG_VERSION)"
+
+define Package/hev-socks5-server/conffiles
+/etc/config/hev-socks5-server
+/etc/hev-socks5-server/
+endef
+
+define Package/hev-socks5-server/install
+ $(INSTALL_DIR) $(1)/usr/bin
+ $(INSTALL_BIN) $(PKG_BUILD_DIR)/bin/hev-socks5-server $(1)/usr/bin/
+
+ $(INSTALL_DIR) $(1)/etc/hev-socks5-server/
+ $(INSTALL_CONF) $(PKG_BUILD_DIR)/conf/main.yml $(1)/etc/hev-socks5-server/main.yml
+ $(INSTALL_CONF) $(PKG_BUILD_DIR)/conf/auth.txt $(1)/etc/hev-socks5-server/auth.txt
+
+ $(INSTALL_DIR) $(1)/etc/config/
+ $(INSTALL_CONF) ./files/hev-socks5-server.config $(1)/etc/config/hev-socks5-server
+
+ $(INSTALL_DIR) $(1)/etc/init.d/
+ $(INSTALL_BIN) ./files/hev-socks5-server.init $(1)/etc/init.d/hev-socks5-server
+endef
+
+$(eval $(call BuildPackage,hev-socks5-server))
--- /dev/null
+config hev-socks5-server 'config'
+ option enabled '0'
+ option conffile '/etc/hev-socks5-server/main.yml'
--- /dev/null
+#!/bin/sh /etc/rc.common
+
+USE_PROCD=1
+START=99
+
+CONF="hev-socks5-server"
+PROG="/usr/bin/hev-socks5-server"
+
+start_service() {
+ config_load "$CONF"
+
+ local enabled
+ config_get_bool enabled "config" "enabled" "0"
+ [ "$enabled" -eq "1" ] || return 1
+
+ local conffile
+ config_get conffile "config" "conffile"
+
+ procd_open_instance "$CONF"
+ procd_set_param command "$PROG" "$conffile"
+ procd_set_param file "$conffile"
+
+ procd_set_param limits core="unlimited"
+ procd_set_param limits nofile="1000000 1000000"
+ procd_set_param stdout 1
+ procd_set_param stderr 1
+ procd_set_param respawn
+
+ procd_close_instance
+}
+
+service_triggers() {
+ procd_add_reload_trigger "$CONF"
+}
--- /dev/null
+#!/bin/sh
+
+"$1" 2>&1 | grep "$2"
-# [Jool](https://www.jool.mx)
+# [Jool](https://nicmx.github.io/Jool/en/index.html)
## Documentation
-[See here](https://www.jool.mx/en/documentation.html).
+[See here](https://nicmx.github.io/Jool/en/documentation.html).
-You might also want to see [contact info](https://www.jool.mx/en/contact.html).
+You might also want to see [contact info](https://nicmx.github.io/Jool/en/contact.html).
## Usage
### Start script
This package includes a start script that will:
- 1. Read the configuration file `/etc/config/jool`
- 2. Determine what services are active
- 3. Run jool with procd
-
-For now this means that:
- * The services will be disabled by default in the uci config `(/etc/config/jool)`
- * The only uci configuration support available for the package is to enable or disable each instance or the entire deamon
- * There is no uci support and configuration will be saved at `/etc/jool/*
- * Only one instance of jool(nat64) can run with the boot script
- * Only one instance of jool(siit) can run with the boot script
- * For now there is no way of overriding of the configuration file's paths
-
-The configuration files the startup script useses for each jool instance are:
- * jool(nat64): `/etc/jool/jool-nat64.conf.json`
- * jool(siit): `/etc/jool/jool-siit.conf.json`
+
+ 1. Read the configuration file `/etc/config/jool`
+ 2. Determine what services are active
+ 3. Run `jool` with procd
+
+### For now this means that
+
+- The services will be disabled by default in the uci config `(/etc/config/jool)`
+- The only uci configuration support available for the package is to enable or disable each instance or the entire deamon
+- There is no uci support and configuration will be saved at `/etc/jool/`
+- Only one instance of jool(nat64) can run with the boot script
+- Only one instance of jool(siit) can run with the boot script
+- For now there is no way of overriding of the configuration file's paths
+
+The configuration files the startup script uses for each jool instance are:
+
+- jool(nat64): `/etc/jool/jool-nat64.conf.json`
+- jool(siit): `/etc/jool/jool-siit.conf.json`
+
+### OpenWrt tutorial
+
+For a more detailed tutorial refer to this [wiki page](https://openwrt.org/docs/guide-user/network/ipv6/nat64).
PKG_NAME:=keepalived
PKG_VERSION:=2.2.8
-PKG_RELEASE:=5
+PKG_RELEASE:=6
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://www.keepalived.org/software
+++ /dev/null
-#!/bin/sh
-
-# shellcheck source=/dev/null
-. /lib/functions/keepalived/hotplug.sh
-
-set_service_name ucitrack
-
-set_reload_if_sync
-
-add_sync_file /etc/config/ucitrack
-
-keepalived_hotplug
PKG_NAME:=librespeed-go
PKG_VERSION:=1.1.5
-PKG_RELEASE:=3
+PKG_RELEASE:=4
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://codeload.github.com/librespeed/speedtest-go/tar.gz/v$(PKG_VERSION)?
endef
define Package/librespeed-go/description
- No Flash, No Java, No WebSocket, No Bullshit.
-
This is a very lightweight speed test implemented in JavaScript,
using XMLHttpRequest and Web Workers.
+
+ No Flash, No Java, No WebSocket, No Bullshit.
endef
define Package/librespeed-go/conffiles
include $(TOPDIR)/rules.mk
PKG_NAME:=lighttpd
-PKG_VERSION:=1.4.75
+PKG_VERSION:=1.4.76
PKG_RELEASE:=1
# release candidate ~rcX testing; remove for release
#PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
PKG_SOURCE_URL:=https://download.lighttpd.net/lighttpd/releases-1.4.x
-PKG_HASH:=8b721ca939d312afaa6ef31dcbd6afb5161ed385ac828e6fccd4c5b76be189d6
+PKG_HASH:=8cbf4296e373cfd0cedfe9d978760b5b05c58fdc4048b4e2bcaf0a61ac8f5011
PKG_MAINTAINER:=Glenn Strauss <gstrauss@gluelogic.com>
PKG_LICENSE:=BSD-3-Clause
include $(TOPDIR)/rules.mk
PKG_NAME:=modemmanager
-PKG_SOURCE_VERSION:=1.22.0
-PKG_RELEASE:=12
+PKG_VERSION:=1.22.0
+PKG_RELEASE:=13
PKG_SOURCE_PROTO:=git
PKG_SOURCE_URL:=https://gitlab.freedesktop.org/mobile-broadband/ModemManager.git
+PKG_SOURCE_VERSION:=$(PKG_VERSION)
PKG_MIRROR_HASH:=cd67d0833481146cc630299ffd2e7afdedb2c90f9d8ce3cc348af1fffacc87de
PKG_MAINTAINER:=Nicholas Smith <nicholas@nbembedded.com>
PKG_NAME:=mosquitto
PKG_VERSION:=2.0.18
-PKG_RELEASE:=2
+PKG_RELEASE:=3
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://mosquitto.org/files/source/
append_if "$1" tls_engine_kpass_sha1
append_if "$1" tls_keyform
append_if "$1" tls_version
+ append_if "$1" allow_anonymous
append_optional_bool "$1" use_identity_as_username
append_optional_bool "$1" use_subject_as_username
append_if "$1" psk_hint
PKG_NAME:=natmap
PKG_VERSION:=20240303
-PKG_RELEASE:=1
+PKG_RELEASE:=2
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://github.com/heiher/natmap/releases/download/$(PKG_VERSION)
option forward_target ''
option forward_port ''
option notify_script ''
+ option log_stdout '1'
+ option log_stderr '1'
'port:port' \
'forward_target:host' \
'forward_port:port' \
- 'notify_script:file'
+ 'notify_script:file' \
+ 'log_stdout:bool:1' \
+ 'log_stderr:bool:1'
}
natmap_instance() {
procd_append_param command -e /usr/lib/natmap/update.sh
procd_set_param respawn
- procd_set_param stdout 1
- procd_set_param stderr 1
+ procd_set_param stdout "${log_stdout}"
+ procd_set_param stderr "${log_stderr}"
procd_close_instance
}
PKG_NAME:=nebula
PKG_VERSION:=1.8.2
-PKG_RELEASE:=r2
+PKG_RELEASE:=2
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://codeload.github.com/slackhq/nebula/tar.gz/v$(PKG_VERSION)?
include $(TOPDIR)/rules.mk
PKG_NAME:=netbird
-PKG_VERSION:=0.26.6
+PKG_VERSION:=0.27.3
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://codeload.github.com/netbirdio/netbird/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=009656248dba9b0e9969c7658178c50ebef7866e96de75b79b9b15d8c2ba1a47
+PKG_HASH:=f172798f164b7484b231adc656eaf1090b6f7d9e7d7c3753f1e611bdf82ae738
PKG_MAINTAINER:=Oskari Rauta <oskari.rauta@gmail.com>
PKG_LICENSE:=BSD-3-Clause
include $(TOPDIR)/rules.mk
PKG_NAME:=nextdns
-PKG_VERSION:=1.42.0
+PKG_VERSION:=1.43.1
PKG_RELEASE:=1
PKG_SOURCE:=nextdns-$(PKG_VERSION).tar.gz
PKG_SOURCE_VERSION:=v$(PKG_VERSION)
PKG_SOURCE_URL:=https://codeload.github.com/nextdns/nextdns/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=893692bea9015116d6ce610c94dccf744f3aa29aeb716a15cca17dd6e6b837c1
+PKG_HASH:=39d6073dc89b2bb91d03c2e9a4b5d6717ed8d6435232c02b18301ea9dfc5a6ad
PKG_MAINTAINER:=Olivier Poitrey <rs@nextdns.io>
PKG_LICENSE:=MIT
include $(TOPDIR)/rules.mk
PKG_NAME:=nginx
-PKG_VERSION:=1.25.4
-PKG_RELEASE:=2
+PKG_VERSION:=1.25.5
+PKG_RELEASE:=1
PKG_SOURCE:=nginx-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://nginx.org/download/
-PKG_HASH:=760729901acbaa517996e681ee6ea259032985e37c2768beef80df3a877deed9
+PKG_HASH:=2fe2294f8af4144e7e842eaea884182a84ee7970e11046ba98194400902bbec0
PKG_MAINTAINER:=Thomas Heil <heil@terminal-consulting.de> \
Christian Marangi <ansuelsmth@gmail.com>
Support file for LuCI in nginx. Include custom nginx configuration, autostart script for uwsgi.
endef
+define Package/nginx-mod-luci/preinst
+#!/bin/sh
+grep -r -l ngx_http_ubus_module.so /etc/nginx/module.d | grep -v ngx_http_ubus.module | while read file; do
+ echo "Removing old LuCI module load file for 'ngx_http_ubus.so' in $$file."
+ rm -f $$file
+done
+exit 0
+endef
+
define Package/nginx-mod-luci/install
$(INSTALL_DIR) $(1)/etc/nginx/conf.d
$(INSTALL_CONF) ./files-luci-support/luci.locations $(1)/etc/nginx/conf.d/
endef
define Download/nginx-mod-geoip2
+ SOURCE_DATE:=2020-01-22
VERSION:=1cabd8a1f68ea3998f94e9f3504431970f848fbf
URL:=https://github.com/leev/ngx_http_geoip2_module.git
- MIRROR_HASH:=b4bd8517f6595f28e9cea5370045df476e0f7fa9ca3611d71ba85c518f1a7eda
+ MIRROR_HASH:=f3d2a1af5c34812b5a34453457ba6a4d8093c92085aa7f76c46a1c4185c9735c
PROTO:=git
endef
endef
define Download/nginx-mod-headers-more
+ SOURCE_DATE:=2022-07-17
VERSION:=bea1be3bbf6af28f6aa8cf0c01c07ee1637e2bd0
URL:=https://github.com/openresty/headers-more-nginx-module.git
- MIRROR_HASH:=3617bbf7a935208a1d8d5f86a8f9b770f6987e4d2b5663a9ab1b777217e3066b
+ MIRROR_HASH:=569abadc137b5b52bdcc33b00aa21f6d266cb84fb891795da2c4e101c4898abe
PROTO:=git
endef
define Download/nginx-mod-brotli
+ SOURCE_DATE:=2020-04-23
VERSION:=25f86f0bac1101b6512135eac5f93c49c63609e3
URL:=https://github.com/google/ngx_brotli.git
- MIRROR_HASH:=c85cdcfd76703c95aa4204ee4c2e619aa5b075cac18f428202f65552104add3b
+ MIRROR_HASH:=680c56be79e7327cb8df271646119333d2f6965a3472bc7043721625fa4488f5
PROTO:=git
endef
define Download/nginx-mod-rtmp
+ SOURCE_DATE:=2018-12-07
VERSION:=f0ea62342a4eca504b311cd5df910d026c3ea4cf
URL:=https://github.com/ut0mt8/nginx-rtmp-module.git
- MIRROR_HASH:=d3f58066f0f858ed79f7f2b0c9b89de2ccc512c94ab3d0625f6dcff3df0b72c1
+ MIRROR_HASH:=9c98d886ae4ea3708bb0bca55f8df803418a407e0ffc6df56341bd76ad39cba8
PROTO:=git
endef
define Download/nginx-mod-ts
+ SOURCE_DATE:=2017-12-04
VERSION:=ef2f874d95cc75747eb625a292524a702aefb0fd
URL:=https://github.com/arut/nginx-ts-module.git
- MIRROR_HASH:=73938950bb286d40d9e54b0994d1a63827340c1156c72eb04d7041b25b20ec18
+ MIRROR_HASH:=3f144d4615a4aaa1215435cd06ae4054ea12206d5b38306321420f7acc62aca8
PROTO:=git
endef
define Download/nginx-mod-naxsi
+ SOURCE_DATE:=2022-09-14
VERSION:=d714f1636ea49a9a9f4f06dba14aee003e970834
URL:=https://github.com/nbs-system/naxsi.git
- MIRROR_HASH:=bd006686721a68d43f052f0a4f00e9ff99fb2abfbc4dcf8194a3562fe4e5c08b
+ MIRROR_HASH:=b0cef5fbf842f283eb5f0686ddd1afcd07d83abd7027c8cfb3e84a2223a34797
PROTO:=git
endef
define Download/nginx-mod-lua
+ SOURCE_DATE:=2023-08-19
VERSION:=c89469e920713d17d703a5f3736c9335edac22bf
URL:=https://github.com/openresty/lua-nginx-module.git
- MIRROR_HASH:=dd66465f65c094a1ddfff2035bff4da870b7c6b7e033d307a9806a6df290a1a5
+ MIRROR_HASH:=c3bdf1b23f0a63991b5dcbd1f8ee150e6f893b43278e8600e4e0bb42a6572db4
PROTO:=git
endef
define Download/nginx-mod-lua-resty-core
+ SOURCE_DATE:=2023-09-09
VERSION:=2e2b2adaa61719972fe4275fa4c3585daa0dcd84
URL:=https://github.com/openresty/lua-resty-core.git
- MIRROR_HASH:=4bfc267fd027161f88fcbeacce38e6bd13ba894a581c2d6dfe78ee270b1a473c
+ MIRROR_HASH:=c5f3df92fd72eac5b54497c039aca0f0d9ea1d87223f1e3a54365ba565991874
PROTO:=git
endef
define Download/nginx-mod-lua-resty-lrucache
+ SOURCE_DATE:=2023-08-06
VERSION:=52f5d00403c8b7aa8a4d4f3779681976b10a18c1
URL:=https://github.com/openresty/lua-resty-lrucache.git
- MIRROR_HASH:=618a972574b6b1db1eebf4046d9a471ac03ec092bb825136ba975928d4af2351
+ MIRROR_HASH:=0833e0114948af4edb216c5c34b3f1919f534b298f4fa29739544f7c9bb8a08d
PROTO:=git
endef
define Download/nginx-mod-dav-ext
+ SOURCE_DATE:=2018-12-17
VERSION:=f5e30888a256136d9c550bf1ada77d6ea78a48af
URL:=https://github.com/arut/nginx-dav-ext-module.git
- MIRROR_HASH:=70bb4c3907f4b783605500ba494e907aede11f8505702e370012abb3c177dc5b
+ MIRROR_HASH:=c574e60ffab5f6e5d8bea18aab0799c19cd9a84f3d819b787e9af4f0e7867b52
PROTO:=git
endef
define Download/nginx-mod-ubus
+ SOURCE_DATE:=2020-09-06
VERSION:=b2d7260dcb428b2fb65540edb28d7538602b4a26
URL:=https://github.com/Ansuel/nginx-ubus-module.git
- MIRROR_HASH:=472cef416d25effcac66c85417ab6596e634a7a64d45b709bb090892d567553c
+ MIRROR_HASH:=515bb9d355ad80916f594046a45c190a68fb6554d6795a54ca15cab8bdd12fda
PROTO:=git
endef
define Download/nginx-mod-$(1) +=
SUBDIR:=nginx-mod-$(1)
- FILE:=nginx-mod-$(1)-$$$$(VERSION).tar.xz
+ FILE:=nginx-mod-$(1)-$$$$(subst -,.,$$$$(SOURCE_DATE))~$$$$(call version_abbrev,$$$$(VERSION)).tar.zst
endef
endef
$(foreach m,$(PKG_MOD_EXTRA),$(eval $(call Module/Download,$(m))))
$(eval $(call Download,nginx-mod-$(1)))
$(eval $(Download/nginx-mod-$(1)))
mkdir -p $(PKG_BUILD_DIR)/nginx-mod-$(1)
- xzcat $(DL_DIR)/$(FILE) | tar -C $(PKG_BUILD_DIR)/nginx-mod-$(1) $(TAR_OPTIONS) --strip-components 1
+ zstdcat $(DL_DIR)/$(FILE) | tar -C $(PKG_BUILD_DIR)/nginx-mod-$(1) $(TAR_OPTIONS) --strip-components 1
endef
define Build/Prepare
define Package/nginx-mod-$(1)/install
$(INSTALL_DIR) $$(1)/usr/lib/nginx/modules
+ $(INSTALL_DIR) $$(1)/etc/nginx/module.d
$(foreach m,$(3),
- $(CP) $$(PKG_INSTALL_DIR)/usr/lib/nginx/modules/$(m)_module.so $$(1)/usr/lib/nginx/modules
+ $(CP) $$(PKG_INSTALL_DIR)/usr/lib/nginx/modules/$(m)_module.so $$(1)/usr/lib/nginx/modules && \
+ echo "load_module /usr/lib/nginx/modules/$(m)_module.so;" > $$(1)/etc/nginx/module.d/$(m).module
)
$(call Module/nginx-mod-$(1)/install,$$(1))
endef
Add support for brotli compression module.))
$(eval $(call BuildModule,naxsi,,ngx_http_naxsi, \
Enable NAXSI module.))
-$(eval $(call BuildModule,geoip2,+@NGINX_STREAM_CORE_MODULE +libmaxminddb,ngx_http_geoip2 ngx_stream_geoip2, \
+$(eval $(call BuildModule,geoip2,+@NGINX_STREAM_CORE_MODULE +nginx-mod-stream +libmaxminddb,ngx_http_geoip2 ngx_stream_geoip2, \
Enable MaxMind GeoIP2 module.))
# TODO: remove after a transition period (together with pkg nginx-util):
EOT
fi
- if [ ! -f "/etc/nginx/module.d/luci.module" ]; then
- cat <<EOT >> /etc/nginx/module.d/luci.module
+ if [ ! -f "/etc/nginx/module.d/ngx_http_ubus.module" ]; then
+ cat <<EOT > /etc/nginx/module.d/ngx_http_ubus.module
load_module /usr/lib/nginx/modules/ngx_http_ubus_module.so;
EOT
fi
--- a/auto/options
+++ b/auto/options
-@@ -411,8 +411,7 @@ $0: warning: the \"--with-sha1-asm\" opt
+@@ -413,8 +413,7 @@ $0: warning: the \"--with-sha1-asm\" opt
--test-build-solaris-sendfilev) NGX_TEST_BUILD_SOLARIS_SENDFILEV=YES ;;
*)
include $(TOPDIR)/rules.mk
PKG_NAME:=nmap
-PKG_VERSION:=7.93
-PKG_RELEASE:=4
+PKG_VERSION:=7.95
+PKG_RELEASE:=1
PKG_MAINTAINER:=Nuno Gonçalves <nunojpg@gmail.com>
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
PKG_SOURCE_URL:=https://nmap.org/dist/
-PKG_HASH:=55bcfe4793e25acc96ba4274d8c4228db550b8e8efd72004b38ec55a2dd16651
+PKG_HASH:=e14ab530e47b5afd88f1c8a2bac7f89cd8fe6b478e22d255c5b9bddb7a1c5778
+
PKG_LICENSE:=NPSL-0.94-or-NPSL-0.95
PKG_LICENSE_FILES:=LICENSE
PKG_CPE_ID:=cpe:/a:nmap:nmap
include $(INCLUDE_DIR)/package.mk
include ../../lang/python/python3-package.mk
-NMAP_DEPENDS:=+libpcap +libstdcpp +zlib +libpcre
+NMAP_DEPENDS:=+libpcap +libstdcpp +zlib +libpcre2
NCAT_DEPENDS:=+libpcap
NPING_DEPENDS:=+libpcap +libpthread +libstdcpp
SSL_DEPENDS:=+libopenssl +ca-certs
define Package/nmap-full
$(call Package/nmap/default)
- DEPENDS:=$(NMAP_DEPENDS) $(SSL_DEPENDS) +liblua5.3 +libssh2
+ DEPENDS:=$(NMAP_DEPENDS) $(SSL_DEPENDS) +liblua5.4 +libssh2
VARIANT:=full
TITLE:=Nmap (with OpenSSL and scripting support)
endef
define Package/ncat-full
$(call Package/nmap/default)
- DEPENDS:=$(NCAT_DEPENDS) $(SSL_DEPENDS) +liblua5.3
+ DEPENDS:=$(NCAT_DEPENDS) $(SSL_DEPENDS) +liblua5.4
VARIANT:=full
TITLE:=Ncat (with OpenSSL and scripting support)
endef
+++ /dev/null
-From d6bea8dcdee36a3902cece14097993350306f1b6 Mon Sep 17 00:00:00 2001
-From: dmiller <dmiller@e0a8ed71-7df4-0310-8962-fdc924857419>
-Date: Tue, 6 Sep 2022 22:39:34 +0000
-Subject: [PATCH] Build based on OpenSSL version, not API level. Fixes #2516
-
----
- ncat/http_digest.c | 2 +-
- ncat/ncat_connect.c | 4 ++--
- ncat/ncat_ssl.c | 6 +++---
- ncat/ncat_ssl.h | 12 ------------
- ncat/test/test-wildcard.c | 4 ++--
- nse_openssl.cc | 28 +++++++---------------------
- nse_ssl_cert.cc | 24 ++++++------------------
- nsock/src/nsock_ssl.c | 4 ++--
- nsock/src/nsock_ssl.h | 15 +--------------
- 9 files changed, 24 insertions(+), 75 deletions(-)
-
---- a/ncat/http_digest.c
-+++ b/ncat/http_digest.c
-@@ -133,7 +133,7 @@ int http_digest_init_secret(void)
- return 0;
- }
-
--#if OPENSSL_API_LEVEL < 10100
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- #define EVP_MD_CTX_new EVP_MD_CTX_create
- #define EVP_MD_CTX_free EVP_MD_CTX_destroy
- #endif
---- a/ncat/ncat_connect.c
-+++ b/ncat/ncat_connect.c
-@@ -82,8 +82,8 @@
- #include <openssl/err.h>
-
- /* Deprecated in OpenSSL 3.0 */
--#if OPENSSL_API_LEVEL >= 30000
--#define SSL_get_peer_certificate SSL_get1_peer_certificate
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+# define SSL_get_peer_certificate SSL_get1_peer_certificate
- #endif
- #endif
-
---- a/ncat/ncat_ssl.c
-+++ b/ncat/ncat_ssl.c
-@@ -80,7 +80,7 @@
- #define FUNC_ASN1_STRING_data ASN1_STRING_data
- #endif
-
--#if OPENSSL_API_LEVEL >= 30000
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
- #include <openssl/provider.h>
- /* Deprecated in OpenSSL 3.0 */
- #define SSL_get_peer_certificate SSL_get1_peer_certificate
-@@ -117,7 +117,7 @@ SSL_CTX *setup_ssl_listen(void)
- OpenSSL_add_all_algorithms();
- ERR_load_crypto_strings();
- SSL_load_error_strings();
--#elif OPENSSL_API_LEVEL >= 30000
-+#elif OPENSSL_VERSION_NUMBER >= 0x30000000L
- if (NULL == OSSL_PROVIDER_load(NULL, "legacy"))
- {
- loguser("OpenSSL legacy provider failed to load.\n");
-@@ -477,7 +477,7 @@ static int ssl_gen_cert(X509 **cert, EVP
- const char *commonName = "localhost";
- char dNSName[128];
- int rc;
--#if OPENSSL_API_LEVEL < 30000
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
- int ret = 0;
- RSA *rsa = NULL;
- BIGNUM *bne = NULL;
---- a/ncat/ncat_ssl.h
-+++ b/ncat/ncat_ssl.h
-@@ -67,18 +67,6 @@
- #include <openssl/ssl.h>
- #include <openssl/err.h>
-
--/* OPENSSL_API_LEVEL per OpenSSL 3.0: decimal MMmmpp */
--#ifndef OPENSSL_API_LEVEL
--# if OPENSSL_API_COMPAT < 0x900000L
--# define OPENSSL_API_LEVEL (OPENSSL_API_COMPAT)
--# else
--# define OPENSSL_API_LEVEL \
-- (((OPENSSL_API_COMPAT >> 28) & 0xF) * 10000 \
-- + ((OPENSSL_API_COMPAT >> 20) & 0xFF) * 100 \
-- + ((OPENSSL_API_COMPAT >> 12) & 0xFF))
--# endif
--#endif
--
- #define NCAT_CA_CERTS_FILE "ca-bundle.crt"
-
- enum {
---- a/ncat/test/test-wildcard.c
-+++ b/ncat/test/test-wildcard.c
-@@ -20,7 +20,7 @@ are rejected. The SSL transactions happe
-
- #include "ncat_core.h"
- #include "ncat_ssl.h"
--#if OPENSSL_API_LEVEL < 30000
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
- #include <openssl/bn.h>
- #endif
-
-@@ -294,7 +294,7 @@ stack_err:
- static int gen_cert(X509 **cert, EVP_PKEY **key,
- const struct lstr commonNames[], const struct lstr dNSNames[])
- {
--#if OPENSSL_API_LEVEL < 30000
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
- int rc, ret=0;
- RSA *rsa = NULL;
- BIGNUM *bne = NULL;
---- a/nse_openssl.cc
-+++ b/nse_openssl.cc
-@@ -20,6 +20,9 @@
- #define FUNC_EVP_CIPHER_CTX_init EVP_CIPHER_CTX_reset
- #define FUNC_EVP_CIPHER_CTX_cleanup EVP_CIPHER_CTX_reset
- #define PASS_EVP_CTX(ctx) (ctx)
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+# include <openssl/provider.h>
-+#endif
- #else
- #define FUNC_EVP_MD_CTX_init EVP_MD_CTX_init
- #define FUNC_EVP_MD_CTX_cleanup EVP_MD_CTX_cleanup
-@@ -37,23 +40,6 @@ extern NmapOps o;
-
- #include "nse_openssl.h"
-
--/* OPENSSL_API_LEVEL per OpenSSL 3.0: decimal MMmmpp */
--#ifndef OPENSSL_API_LEVEL
--# if OPENSSL_API_COMPAT < 0x900000L
--# define OPENSSL_API_LEVEL (OPENSSL_API_COMPAT)
--# else
--# define OPENSSL_API_LEVEL \
-- (((OPENSSL_API_COMPAT >> 28) & 0xF) * 10000 \
-- + ((OPENSSL_API_COMPAT >> 20) & 0xFF) * 100 \
-- + ((OPENSSL_API_COMPAT >> 12) & 0xFF))
--# endif
--#endif
--
--
--#if OPENSSL_API_LEVEL >= 30000
--#include <openssl/provider.h>
--#endif
--
- #define NSE_SSL_LUA_ERR(_L) \
- luaL_error(_L, "OpenSSL error: %s", ERR_error_string(ERR_get_error(), NULL))
-
-@@ -184,7 +170,7 @@ static int l_bignum_is_prime( lua_State
- bignum_data_t * p = (bignum_data_t *) luaL_checkudata( L, 1, "BIGNUM" );
- BN_CTX * ctx = BN_CTX_new();
- int is_prime =
--#if OPENSSL_API_LEVEL < 30000
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
- BN_is_prime_ex( p->bn, BN_prime_checks, ctx, NULL );
- #else
- BN_check_prime( p->bn, ctx, NULL );
-@@ -199,7 +185,7 @@ static int l_bignum_is_safe_prime( lua_S
- bignum_data_t * p = (bignum_data_t *) luaL_checkudata( L, 1, "BIGNUM" );
- BN_CTX * ctx = BN_CTX_new();
- int is_prime =
--#if OPENSSL_API_LEVEL < 30000
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
- BN_is_prime_ex( p->bn, BN_prime_checks, ctx, NULL );
- #else
- BN_check_prime( p->bn, ctx, NULL );
-@@ -210,7 +196,7 @@ static int l_bignum_is_safe_prime( lua_S
- BN_sub_word( n, (BN_ULONG)1 );
- BN_div_word( n, (BN_ULONG)2 );
- is_safe =
--#if OPENSSL_API_LEVEL < 30000
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
- BN_is_prime_ex( n, BN_prime_checks, ctx, NULL );
- #else
- BN_check_prime( n, ctx, NULL );
-@@ -582,7 +568,7 @@ LUALIB_API int luaopen_openssl(lua_State
- #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined LIBRESSL_VERSION_NUMBER
- OpenSSL_add_all_algorithms();
- ERR_load_crypto_strings();
--#elif OPENSSL_API_LEVEL >= 30000
-+#elif OPENSSL_VERSION_NUMBER >= 0x30000000L
- if (NULL == OSSL_PROVIDER_load(NULL, "legacy") && o.debugging > 1)
- {
- // Legacy provider may not be available.
---- a/nse_ssl_cert.cc
-+++ b/nse_ssl_cert.cc
-@@ -89,19 +89,7 @@
- #define X509_get0_notAfter X509_get_notAfter
- #endif
-
--/* OPENSSL_API_LEVEL per OpenSSL 3.0: decimal MMmmpp */
--#ifndef OPENSSL_API_LEVEL
--# if OPENSSL_API_COMPAT < 0x900000L
--# define OPENSSL_API_LEVEL (OPENSSL_API_COMPAT)
--# else
--# define OPENSSL_API_LEVEL \
-- (((OPENSSL_API_COMPAT >> 28) & 0xF) * 10000 \
-- + ((OPENSSL_API_COMPAT >> 20) & 0xFF) * 100 \
-- + ((OPENSSL_API_COMPAT >> 12) & 0xFF))
--# endif
--#endif
--
--#if OPENSSL_API_LEVEL >= 30000
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
- #include <openssl/core_names.h>
- /* Deprecated in OpenSSL 3.0 */
- #define SSL_get_peer_certificate SSL_get1_peer_certificate
-@@ -459,7 +447,7 @@ static const char *pkey_type_to_string(i
- }
-
- int lua_push_ecdhparams(lua_State *L, EVP_PKEY *pubkey) {
--#if OPENSSL_API_LEVEL >= 30000
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
- char tmp[64] = {0};
- size_t len = 0;
- /* This structure (ecdhparams.curve_params) comes from tls.lua */
-@@ -634,7 +622,7 @@ static int parse_ssl_cert(lua_State *L,
- else
- #endif
- if (pkey_type == EVP_PKEY_RSA) {
--#if OPENSSL_API_LEVEL < 30000
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
- RSA *rsa = EVP_PKEY_get1_RSA(pubkey);
- if (rsa) {
- #endif
-@@ -643,7 +631,7 @@ static int parse_ssl_cert(lua_State *L,
- luaL_getmetatable( L, "BIGNUM" );
- lua_setmetatable( L, -2 );
- #if HAVE_OPAQUE_STRUCTS
--#if OPENSSL_API_LEVEL < 30000
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
- const BIGNUM *n = NULL, *e = NULL;
- data->should_free = false;
- RSA_get0_key(rsa, &n, &e, NULL);
-@@ -663,7 +651,7 @@ static int parse_ssl_cert(lua_State *L,
- luaL_getmetatable( L, "BIGNUM" );
- lua_setmetatable( L, -2 );
- #if HAVE_OPAQUE_STRUCTS
--#if OPENSSL_API_LEVEL < 30000
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
- data->should_free = false;
- #else
- data->should_free = true;
-@@ -673,7 +661,7 @@ static int parse_ssl_cert(lua_State *L,
- data->bn = rsa->n;
- #endif
- lua_setfield(L, -2, "modulus");
--#if OPENSSL_API_LEVEL < 30000
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
- RSA_free(rsa);
- }
- #endif
---- a/nsock/src/nsock_ssl.c
-+++ b/nsock/src/nsock_ssl.c
-@@ -64,7 +64,7 @@
- #include "netutils.h"
-
- #if HAVE_OPENSSL
--#if OPENSSL_API_LEVEL >= 30000
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
- #include <openssl/provider.h>
- #endif
-
-@@ -120,7 +120,7 @@ static SSL_CTX *ssl_init_helper(const SS
- SSL_library_init();
- #else
- OPENSSL_atexit(nsock_ssl_atexit);
--#if OPENSSL_API_LEVEL >= 30000
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
- if (NULL == OSSL_PROVIDER_load(NULL, "legacy"))
- {
- nsock_log_error("OpenSSL legacy provider failed to load.\n");
---- a/nsock/src/nsock_ssl.h
-+++ b/nsock/src/nsock_ssl.h
-@@ -69,20 +69,7 @@
- #include <openssl/err.h>
- #include <openssl/rand.h>
-
--/* OPENSSL_API_LEVEL per OpenSSL 3.0: decimal MMmmpp */
--#ifndef OPENSSL_API_LEVEL
--# if OPENSSL_API_COMPAT < 0x900000L
--# define OPENSSL_API_LEVEL (OPENSSL_API_COMPAT)
--# else
--# define OPENSSL_API_LEVEL \
-- (((OPENSSL_API_COMPAT >> 28) & 0xF) * 10000 \
-- + ((OPENSSL_API_COMPAT >> 20) & 0xFF) * 100 \
-- + ((OPENSSL_API_COMPAT >> 12) & 0xFF))
--# endif
--#endif
--
--
--#if OPENSSL_API_LEVEL >= 30000
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
- /* Deprecated in OpenSSL 3.0 */
- #define SSL_get_peer_certificate SSL_get1_peer_certificate
- #endif
+++ /dev/null
-From: Bryan Quigley <bryan.quigley@canonical.com>
-Date: Sat, 2 Nov 2019 21:06:44 -0700
-Subject: Python3 port of ndiff
-
-Ported all python scrips in ndiff/ except setup.py
-
-Some hints on cmp taken from #1484
-
-Minor tweaks to Makefile to support python3, but unsure if
-there is a better way to do that.
-
-Seperated .travis.yml commands for easier debugging where it breaks.
-
-This closes the easy half of #1176
-
-Resolves: #1484
----
- .travis.yml | 8 +-
- Makefile.in | 6 +-
- ndiff/ndiff.py | 503 +++++++++++++++++++++---------------------
- ndiff/ndifftest.py | 94 ++++----
- ndiff/scripts/ndiff | 14 +-
- ndiff/setup.py | 44 ++--
- ndiff/test-scans/anonymize.py | 18 +-
- 7 files changed, 346 insertions(+), 341 deletions(-)
- mode change 100644 => 100755 ndiff/setup.py
-
---- a/.travis.yml
-+++ b/.travis.yml
-@@ -4,7 +4,13 @@ compiler:
- - clang
- # Change this to your needs
- sudo: false
--script: mkdir /tmp/n && ./configure $SSL_FLAG $LUA_FLAG --prefix=/tmp/n && make && make check && make install && /tmp/n/bin/nmap -A localhost
-+script:
-+ - "mkdir /tmp/n"
-+ - "./configure $SSL_FLAG $LUA_FLAG --prefix=/tmp/n"
-+ - "make"
-+ - "make check"
-+ - "make install"
-+ - "/tmp/n/bin/nmap -A localhost"
-
- env:
- - SSL_FLAG="--without-openssl" LUA_FLAG="--without-liblua"
---- a/Makefile.in
-+++ b/Makefile.in
-@@ -34,6 +34,7 @@ ZENMAPDIR = @ZENMAPDIR@
- NDIFFDIR = @NDIFFDIR@
- NPINGDIR = @NPINGDIR@
- PYTHON = @PYTHON@
-+PYTHON3 = /usr/bin/env python3
- DEFS = @DEFS@ -DNMAP_PLATFORM=\"$(NMAP_PLATFORM)\" -DNMAPDATADIR=\"$(nmapdatadir)\"
- # With GCC, add extra security checks to source code.
- # http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html
-@@ -361,6 +362,7 @@ tests/check_dns: $(OBJS)
- # this as the location of the interpreter whenever we're not doing a
- # local installation.
- DEFAULT_PYTHON_PATH = /usr/bin/env python
-+DEFAULT_PYTHON3_PATH = /usr/bin/env python3
-
- build-zenmap: $(ZENMAPDIR)/setup.py $(ZENMAPDIR)/zenmapCore/Version.py
- # When DESTDIR is defined, assume we're building an executable
-@@ -381,7 +383,7 @@ install-zenmap: $(ZENMAPDIR)/setup.py
- ln -sf zenmap $(DESTDIR)$(bindir)/xnmap
-
- build-ndiff:
-- cd $(NDIFFDIR) && $(PYTHON) setup.py build $(if $(DESTDIR),--executable "$(DEFAULT_PYTHON_PATH)")
-+ cd $(NDIFFDIR) && $(PYTHON) setup.py build $(if $(DESTDIR),--executable "$(DEFAULT_PYTHON3_PATH)")
-
- build-nping: $(NPINGDIR)/Makefile build-nbase build-nsock build-netutil $(NPINGDIR)/nping.h @DNET_BUILD@ @PCAP_BUILD@
- @cd $(NPINGDIR) && $(MAKE)
-@@ -451,7 +453,7 @@ check-ncat:
- @cd $(NCATDIR) && $(MAKE) check
-
- check-ndiff:
-- @cd $(NDIFFDIR) && $(PYTHON) ndifftest.py
-+ @cd $(NDIFFDIR) && $(PYTHON3) ndifftest.py
-
- check-nsock:
- @cd $(NSOCKDIR)/src && $(MAKE) check
---- a/ndiff/ndiff.py
-+++ b/ndiff/ndiff.py
-@@ -1,4 +1,4 @@
--#!/usr/bin/env python
-+#!/usr/bin/env python3
-
- # Ndiff
- #
-@@ -25,11 +25,11 @@ xml.__path__ = [x for x in xml.__path__
- import xml.sax
- import xml.sax.saxutils
- import xml.dom.minidom
--from StringIO import StringIO
-+from io import StringIO
-
- verbose = False
-
--NDIFF_XML_VERSION = u"1"
-+NDIFF_XML_VERSION = "1"
-
-
- class OverrideEntityResolver(xml.sax.handler.EntityResolver):
-@@ -74,35 +74,35 @@ class Scan(object):
- def write_nmaprun_open(self, writer):
- attrs = {}
- if self.scanner is not None:
-- attrs[u"scanner"] = self.scanner
-+ attrs["scanner"] = self.scanner
- if self.args is not None:
-- attrs[u"args"] = self.args
-+ attrs["args"] = self.args
- if self.start_date is not None:
-- attrs[u"start"] = "%d" % time.mktime(self.start_date.timetuple())
-- attrs[u"startstr"] = self.start_date.strftime(
-+ attrs["start"] = "%d" % time.mktime(self.start_date.timetuple())
-+ attrs["startstr"] = self.start_date.strftime(
- "%a %b %d %H:%M:%S %Y")
- if self.version is not None:
-- attrs[u"version"] = self.version
-- writer.startElement(u"nmaprun", attrs)
-+ attrs["version"] = self.version
-+ writer.startElement("nmaprun", attrs)
-
- def write_nmaprun_close(self, writer):
-- writer.endElement(u"nmaprun")
-+ writer.endElement("nmaprun")
-
- def nmaprun_to_dom_fragment(self, document):
- frag = document.createDocumentFragment()
-- elem = document.createElement(u"nmaprun")
-+ elem = document.createElement("nmaprun")
- if self.scanner is not None:
-- elem.setAttribute(u"scanner", self.scanner)
-+ elem.setAttribute("scanner", self.scanner)
- if self.args is not None:
-- elem.setAttribute(u"args", self.args)
-+ elem.setAttribute("args", self.args)
- if self.start_date is not None:
- elem.setAttribute(
-- u"start", "%d" % time.mktime(self.start_date.timetuple()))
-+ "start", "%d" % time.mktime(self.start_date.timetuple()))
- elem.setAttribute(
-- u"startstr",
-+ "startstr",
- self.start_date.strftime("%a %b %d %H:%M:%S %Y"))
- if self.version is not None:
-- elem.setAttribute(u"version", self.version)
-+ elem.setAttribute("version", self.version)
- frag.appendChild(elem)
- return frag
-
-@@ -132,17 +132,17 @@ class Host(object):
-
- def format_name(self):
- """Return a human-readable identifier for this host."""
-- address_s = u", ".join(a.s for a in sorted(self.addresses))
-- hostname_s = u", ".join(sorted(self.hostnames))
-+ address_s = ", ".join(a.s for a in sorted(self.addresses))
-+ hostname_s = ", ".join(sorted(self.hostnames))
- if len(hostname_s) > 0:
- if len(address_s) > 0:
-- return u"%s (%s)" % (hostname_s, address_s)
-+ return "%s (%s)" % (hostname_s, address_s)
- else:
- return hostname_s
- elif len(address_s) > 0:
- return address_s
- else:
-- return u"<no name>"
-+ return "<no name>"
-
- def add_port(self, port):
- self.ports[port.spec] = port
-@@ -159,46 +159,46 @@ class Host(object):
- return state is None or state in self.extraports
-
- def extraports_string(self):
-- list = [(count, state) for (state, count) in self.extraports.items()]
-+ locallist = [(count, state) for (state, count) in list(self.extraports.items())]
- # Reverse-sort by count.
-- list.sort(reverse=True)
-- return u", ".join(
-- [u"%d %s ports" % (count, state) for (count, state) in list])
-+ locallist.sort(reverse=True)
-+ return ", ".join(
-+ ["%d %s ports" % (count, state) for (count, state) in locallist])
-
- def state_to_dom_fragment(self, document):
- frag = document.createDocumentFragment()
- if self.state is not None:
-- elem = document.createElement(u"status")
-- elem.setAttribute(u"state", self.state)
-+ elem = document.createElement("status")
-+ elem.setAttribute("state", self.state)
- frag.appendChild(elem)
- return frag
-
- def hostname_to_dom_fragment(self, document, hostname):
- frag = document.createDocumentFragment()
-- elem = document.createElement(u"hostname")
-- elem.setAttribute(u"name", hostname)
-+ elem = document.createElement("hostname")
-+ elem.setAttribute("name", hostname)
- frag.appendChild(elem)
- return frag
-
- def extraports_to_dom_fragment(self, document):
- frag = document.createDocumentFragment()
-- for state, count in self.extraports.items():
-- elem = document.createElement(u"extraports")
-- elem.setAttribute(u"state", state)
-- elem.setAttribute(u"count", unicode(count))
-+ for state, count in list(self.extraports.items()):
-+ elem = document.createElement("extraports")
-+ elem.setAttribute("state", state)
-+ elem.setAttribute("count", str(count))
- frag.appendChild(elem)
- return frag
-
- def os_to_dom_fragment(self, document, os):
- frag = document.createDocumentFragment()
-- elem = document.createElement(u"osmatch")
-- elem.setAttribute(u"name", os)
-+ elem = document.createElement("osmatch")
-+ elem.setAttribute("name", os)
- frag.appendChild(elem)
- return frag
-
- def to_dom_fragment(self, document):
- frag = document.createDocumentFragment()
-- elem = document.createElement(u"host")
-+ elem = document.createElement("host")
-
- if self.state is not None:
- elem.appendChild(self.state_to_dom_fragment(document))
-@@ -207,13 +207,13 @@ class Host(object):
- elem.appendChild(addr.to_dom_fragment(document))
-
- if len(self.hostnames) > 0:
-- hostnames_elem = document.createElement(u"hostnames")
-+ hostnames_elem = document.createElement("hostnames")
- for hostname in self.hostnames:
- hostnames_elem.appendChild(
- self.hostname_to_dom_fragment(document, hostname))
- elem.appendChild(hostnames_elem)
-
-- ports_elem = document.createElement(u"ports")
-+ ports_elem = document.createElement("ports")
- ports_elem.appendChild(self.extraports_to_dom_fragment(document))
- for port in sorted(self.ports.values()):
- if not self.is_extraports(port.state):
-@@ -222,13 +222,13 @@ class Host(object):
- elem.appendChild(ports_elem)
-
- if len(self.os) > 0:
-- os_elem = document.createElement(u"os")
-+ os_elem = document.createElement("os")
- for os in self.os:
- os_elem.appendChild(self.os_to_dom_fragment(document, os))
- elem.appendChild(os_elem)
-
- if len(self.script_results) > 0:
-- hostscript_elem = document.createElement(u"hostscript")
-+ hostscript_elem = document.createElement("hostscript")
- for sr in self.script_results:
- hostscript_elem.appendChild(sr.to_dom_fragment(document))
- elem.appendChild(hostscript_elem)
-@@ -242,7 +242,7 @@ class Address(object):
- self.s = s
-
- def __eq__(self, other):
-- return self.__cmp__(other) == 0
-+ return self.sort_key() == other.sort_key()
-
- def __ne__(self, other):
- return not self.__eq__(other)
-@@ -250,8 +250,8 @@ class Address(object):
- def __hash__(self):
- return hash(self.sort_key())
-
-- def __cmp__(self, other):
-- return cmp(self.sort_key(), other.sort_key())
-+ def __lt__(self, other):
-+ return self.sort_key() < other.sort_key()
-
- def __str__(self):
- return str(self.s)
-@@ -260,21 +260,21 @@ class Address(object):
- return self.s
-
- def new(type, s):
-- if type == u"ipv4":
-+ if type == "ipv4":
- return IPv4Address(s)
-- elif type == u"ipv6":
-+ elif type == "ipv6":
- return IPv6Address(s)
-- elif type == u"mac":
-+ elif type == "mac":
- return MACAddress(s)
- else:
-- raise ValueError(u"Unknown address type %s." % type)
-+ raise ValueError("Unknown address type %s." % type)
- new = staticmethod(new)
-
- def to_dom_fragment(self, document):
- frag = document.createDocumentFragment()
-- elem = document.createElement(u"address")
-- elem.setAttribute(u"addr", self.s)
-- elem.setAttribute(u"addrtype", self.type)
-+ elem = document.createElement("address")
-+ elem.setAttribute("addr", self.s)
-+ elem.setAttribute("addrtype", self.type)
- frag.appendChild(elem)
- return frag
-
-@@ -283,21 +283,21 @@ class Address(object):
-
-
- class IPv4Address(Address):
-- type = property(lambda self: u"ipv4")
-+ type = property(lambda self: "ipv4")
-
- def sort_key(self):
- return (0, self.s)
-
-
- class IPv6Address(Address):
-- type = property(lambda self: u"ipv6")
-+ type = property(lambda self: "ipv6")
-
- def sort_key(self):
- return (1, self.s)
-
-
- class MACAddress(Address):
-- type = property(lambda self: u"mac")
-+ type = property(lambda self: "mac")
-
- def sort_key(self):
- return (2, self.s)
-@@ -316,31 +316,28 @@ class Port(object):
-
- def state_string(self):
- if self.state is None:
-- return u"unknown"
-+ return "unknown"
- else:
-- return unicode(self.state)
-+ return str(self.state)
-
- def spec_string(self):
-- return u"%d/%s" % self.spec
-+ return "%d/%s" % self.spec
-
- def __hash__(self):
- return hash(self.spec)
-
-- def __cmp__(self, other):
-- d = cmp(self.spec, other.spec)
-- if d != 0:
-- return d
-- return cmp((self.spec, self.service, self.script_results),
-- (other.spec, other.service, other.script_results))
-+ def __lt__(self, other):
-+ return (self.spec, self.service, self.script_results) < (
-+ other.spec, other.service, other.script_results)
-
- def to_dom_fragment(self, document):
- frag = document.createDocumentFragment()
-- elem = document.createElement(u"port")
-- elem.setAttribute(u"portid", unicode(self.spec[0]))
-- elem.setAttribute(u"protocol", self.spec[1])
-+ elem = document.createElement("port")
-+ elem.setAttribute("portid", str(self.spec[0]))
-+ elem.setAttribute("protocol", self.spec[1])
- if self.state is not None:
-- state_elem = document.createElement(u"state")
-- state_elem.setAttribute(u"state", self.state)
-+ state_elem = document.createElement("state")
-+ state_elem.setAttribute("state", self.state)
- elem.appendChild(state_elem)
- elem.appendChild(self.service.to_dom_fragment(document))
- for sr in self.script_results:
-@@ -384,7 +381,7 @@ class Service(object):
- if len(parts) == 0:
- return None
- else:
-- return u"/".join(parts)
-+ return "/".join(parts)
-
- def version_string(self):
- """Get a string like in the VERSION column of Nmap output."""
-@@ -394,17 +391,17 @@ class Service(object):
- if self.version is not None:
- parts.append(self.version)
- if self.extrainfo is not None:
-- parts.append(u"(%s)" % self.extrainfo)
-+ parts.append("(%s)" % self.extrainfo)
-
- if len(parts) == 0:
- return None
- else:
-- return u" ".join(parts)
-+ return " ".join(parts)
-
- def to_dom_fragment(self, document):
- frag = document.createDocumentFragment()
-- elem = document.createElement(u"service")
-- for attr in (u"name", u"product", u"version", u"extrainfo", u"tunnel"):
-+ elem = document.createElement("service")
-+ for attr in ("name", "product", "version", "extrainfo", "tunnel"):
- v = getattr(self, attr)
- if v is None:
- continue
-@@ -434,53 +431,53 @@ class ScriptResult(object):
- result = []
- lines = self.output.splitlines()
- if len(lines) > 0:
-- lines[0] = self.id + u": " + lines[0]
-+ lines[0] = self.id + ": " + lines[0]
- for line in lines[:-1]:
-- result.append(u"| " + line)
-+ result.append("| " + line)
- if len(lines) > 0:
-- result.append(u"|_ " + lines[-1])
-+ result.append("|_ " + lines[-1])
- return result
-
- def to_dom_fragment(self, document):
- frag = document.createDocumentFragment()
-- elem = document.createElement(u"script")
-- elem.setAttribute(u"id", self.id)
-- elem.setAttribute(u"output", self.output)
-+ elem = document.createElement("script")
-+ elem.setAttribute("id", self.id)
-+ elem.setAttribute("output", self.output)
- frag.appendChild(elem)
- return frag
-
-
- def format_banner(scan):
- """Format a startup banner more or less like Nmap does."""
-- scanner = u"Nmap"
-- if scan.scanner is not None and scan.scanner != u"nmap":
-+ scanner = "Nmap"
-+ if scan.scanner is not None and scan.scanner != "nmap":
- scanner = scan.scanner
- parts = [scanner]
- if scan.version is not None:
- parts.append(scan.version)
-- parts.append(u"scan")
-+ parts.append("scan")
- if scan.start_date is not None:
-- parts.append(u"initiated %s" % scan.start_date.strftime(
-+ parts.append("initiated %s" % scan.start_date.strftime(
- "%a %b %d %H:%M:%S %Y"))
- if scan.args is not None:
-- parts.append(u"as: %s" % scan.args)
-- return u" ".join(parts)
-+ parts.append("as: %s" % scan.args)
-+ return " ".join(parts)
-
-
- def print_script_result_diffs_text(title, script_results_a, script_results_b,
- script_result_diffs, f=sys.stdout):
-- table = Table(u"*")
-+ table = Table("*")
- for sr_diff in script_result_diffs:
- sr_diff.append_to_port_table(table)
- if len(table) > 0:
-- print >> f
-+ print(file=f)
- if len(script_results_b) == 0:
-- print >> f, u"-%s:" % title
-+ print("-%s:" % title, file=f)
- elif len(script_results_a) == 0:
-- print >> f, u"+%s:" % title
-+ print("+%s:" % title, file=f)
- else:
-- print >> f, u" %s:" % title
-- print >> f, table
-+ print(" %s:" % title, file=f)
-+ print(table, file=f)
-
-
- def script_result_diffs_to_dom_fragment(elem, script_results_a,
-@@ -488,13 +485,13 @@ def script_result_diffs_to_dom_fragment(
- if len(script_results_a) == 0 and len(script_results_b) == 0:
- return document.createDocumentFragment()
- elif len(script_results_b) == 0:
-- a_elem = document.createElement(u"a")
-+ a_elem = document.createElement("a")
- for sr in script_results_a:
- elem.appendChild(sr.to_dom_fragment(document))
- a_elem.appendChild(elem)
- return a_elem
- elif len(script_results_a) == 0:
-- b_elem = document.createElement(u"b")
-+ b_elem = document.createElement("b")
- for sr in script_results_b:
- elem.appendChild(sr.to_dom_fragment(document))
- b_elem.appendChild(elem)
-@@ -579,10 +576,10 @@ class ScanDiffText(ScanDiff):
- banner_a = format_banner(self.scan_a)
- banner_b = format_banner(self.scan_b)
- if banner_a != banner_b:
-- print >> self.f, u"-%s" % banner_a
-- print >> self.f, u"+%s" % banner_b
-+ print("-%s" % banner_a, file=self.f)
-+ print("+%s" % banner_b, file=self.f)
- elif verbose:
-- print >> self.f, u" %s" % banner_a
-+ print(" %s" % banner_a, file=self.f)
-
- def output_pre_scripts(self, pre_script_result_diffs):
- print_script_result_diffs_text("Pre-scan script results",
-@@ -595,7 +592,7 @@ class ScanDiffText(ScanDiff):
- post_script_result_diffs, self.f)
-
- def output_host_diff(self, h_diff):
-- print >> self.f
-+ print(file=self.f)
- h_diff.print_text(self.f)
-
- def output_ending(self):
-@@ -620,8 +617,8 @@ class ScanDiffXML(ScanDiff):
-
- def output_beginning(self):
- self.writer.startDocument()
-- self.writer.startElement(u"nmapdiff", {u"version": NDIFF_XML_VERSION})
-- self.writer.startElement(u"scandiff", {})
-+ self.writer.startElement("nmapdiff", {"version": NDIFF_XML_VERSION})
-+ self.writer.startElement("scandiff", {})
-
- if self.nmaprun_differs():
- self.writer.frag_a(
-@@ -634,7 +631,7 @@ class ScanDiffXML(ScanDiff):
-
- def output_pre_scripts(self, pre_script_result_diffs):
- if len(pre_script_result_diffs) > 0 or verbose:
-- prescript_elem = self.document.createElement(u"prescript")
-+ prescript_elem = self.document.createElement("prescript")
- frag = script_result_diffs_to_dom_fragment(
- prescript_elem, self.scan_a.pre_script_results,
- self.scan_b.pre_script_results, pre_script_result_diffs,
-@@ -644,7 +641,7 @@ class ScanDiffXML(ScanDiff):
-
- def output_post_scripts(self, post_script_result_diffs):
- if len(post_script_result_diffs) > 0 or verbose:
-- postscript_elem = self.document.createElement(u"postscript")
-+ postscript_elem = self.document.createElement("postscript")
- frag = script_result_diffs_to_dom_fragment(
- postscript_elem, self.scan_a.post_script_results,
- self.scan_b.post_script_results, post_script_result_diffs,
-@@ -658,8 +655,8 @@ class ScanDiffXML(ScanDiff):
- frag.unlink()
-
- def output_ending(self):
-- self.writer.endElement(u"scandiff")
-- self.writer.endElement(u"nmapdiff")
-+ self.writer.endElement("scandiff")
-+ self.writer.endElement("nmapdiff")
- self.writer.endDocument()
-
-
-@@ -717,9 +714,9 @@ class HostDiff(object):
- self.cost += os_cost
-
- extraports_a = tuple((count, state)
-- for (state, count) in self.host_a.extraports.items())
-+ for (state, count) in list(self.host_a.extraports.items()))
- extraports_b = tuple((count, state)
-- for (state, count) in self.host_b.extraports.items())
-+ for (state, count) in list(self.host_b.extraports.items()))
- if extraports_a != extraports_b:
- self.extraports_changed = True
- self.cost += 1
-@@ -745,69 +742,69 @@ class HostDiff(object):
- # Names and addresses.
- if self.id_changed:
- if host_a.state is not None:
-- print >> f, u"-%s:" % host_a.format_name()
-+ print("-%s:" % host_a.format_name(), file=f)
- if self.host_b.state is not None:
-- print >> f, u"+%s:" % host_b.format_name()
-+ print("+%s:" % host_b.format_name(), file=f)
- else:
-- print >> f, u" %s:" % host_a.format_name()
-+ print(" %s:" % host_a.format_name(), file=f)
-
- # State.
- if self.state_changed:
- if host_a.state is not None:
-- print >> f, u"-Host is %s." % host_a.state
-+ print("-Host is %s." % host_a.state, file=f)
- if host_b.state is not None:
-- print >> f, u"+Host is %s." % host_b.state
-+ print("+Host is %s." % host_b.state, file=f)
- elif verbose:
-- print >> f, u" Host is %s." % host_b.state
-+ print(" Host is %s." % host_b.state, file=f)
-
- # Extraports.
- if self.extraports_changed:
- if len(host_a.extraports) > 0:
-- print >> f, u"-Not shown: %s" % host_a.extraports_string()
-+ print("-Not shown: %s" % host_a.extraports_string(), file=f)
- if len(host_b.extraports) > 0:
-- print >> f, u"+Not shown: %s" % host_b.extraports_string()
-+ print("+Not shown: %s" % host_b.extraports_string(), file=f)
- elif verbose:
- if len(host_a.extraports) > 0:
-- print >> f, u" Not shown: %s" % host_a.extraports_string()
-+ print(" Not shown: %s" % host_a.extraports_string(), file=f)
-
- # Port table.
-- port_table = Table(u"** * * *")
-+ port_table = Table("** * * *")
- if host_a.state is None:
-- mark = u"+"
-+ mark = "+"
- elif host_b.state is None:
-- mark = u"-"
-+ mark = "-"
- else:
-- mark = u" "
-- port_table.append((mark, u"PORT", u"STATE", u"SERVICE", u"VERSION"))
-+ mark = " "
-+ port_table.append((mark, "PORT", "STATE", "SERVICE", "VERSION"))
-
- for port in self.ports:
- port_diff = self.port_diffs[port]
- port_diff.append_to_port_table(port_table, host_a, host_b)
-
- if len(port_table) > 1:
-- print >> f, port_table
-+ print(port_table, file=f)
-
- # OS changes.
- if self.os_changed or verbose:
- if len(host_a.os) > 0:
- if len(host_b.os) > 0:
-- print >> f, u" OS details:"
-+ print(" OS details:", file=f)
- else:
-- print >> f, u"-OS details:"
-+ print("-OS details:", file=f)
- elif len(host_b.os) > 0:
-- print >> f, u"+OS details:"
-+ print("+OS details:", file=f)
- # os_diffs is a list of 5-tuples returned by
- # difflib.SequenceMatcher.
- for op, i1, i2, j1, j2 in self.os_diffs:
- if op == "replace" or op == "delete":
- for i in range(i1, i2):
-- print >> f, "- %s" % host_a.os[i]
-+ print("- %s" % host_a.os[i], file=f)
- if op == "replace" or op == "insert":
- for i in range(j1, j2):
-- print >> f, "+ %s" % host_b.os[i]
-+ print("+ %s" % host_b.os[i], file=f)
- if op == "equal":
- for i in range(i1, i2):
-- print >> f, " %s" % host_a.os[i]
-+ print(" %s" % host_a.os[i], file=f)
-
- print_script_result_diffs_text("Host script results",
- host_a.script_results, host_b.script_results,
-@@ -818,32 +815,32 @@ class HostDiff(object):
- host_b = self.host_b
-
- frag = document.createDocumentFragment()
-- hostdiff_elem = document.createElement(u"hostdiff")
-+ hostdiff_elem = document.createElement("hostdiff")
- frag.appendChild(hostdiff_elem)
-
- if host_a.state is None or host_b.state is None:
- # The host is missing in one scan. Output the whole thing.
- if host_a.state is not None:
-- a_elem = document.createElement(u"a")
-+ a_elem = document.createElement("a")
- a_elem.appendChild(host_a.to_dom_fragment(document))
- hostdiff_elem.appendChild(a_elem)
- elif host_b.state is not None:
-- b_elem = document.createElement(u"b")
-+ b_elem = document.createElement("b")
- b_elem.appendChild(host_b.to_dom_fragment(document))
- hostdiff_elem.appendChild(b_elem)
- return frag
-
-- host_elem = document.createElement(u"host")
-+ host_elem = document.createElement("host")
-
- # State.
- if host_a.state == host_b.state:
- if verbose:
- host_elem.appendChild(host_a.state_to_dom_fragment(document))
- else:
-- a_elem = document.createElement(u"a")
-+ a_elem = document.createElement("a")
- a_elem.appendChild(host_a.state_to_dom_fragment(document))
- host_elem.appendChild(a_elem)
-- b_elem = document.createElement(u"b")
-+ b_elem = document.createElement("b")
- b_elem.appendChild(host_b.state_to_dom_fragment(document))
- host_elem.appendChild(b_elem)
-
-@@ -852,31 +849,31 @@ class HostDiff(object):
- addrset_b = set(host_b.addresses)
- for addr in sorted(addrset_a.intersection(addrset_b)):
- host_elem.appendChild(addr.to_dom_fragment(document))
-- a_elem = document.createElement(u"a")
-+ a_elem = document.createElement("a")
- for addr in sorted(addrset_a - addrset_b):
- a_elem.appendChild(addr.to_dom_fragment(document))
- if a_elem.hasChildNodes():
- host_elem.appendChild(a_elem)
-- b_elem = document.createElement(u"b")
-+ b_elem = document.createElement("b")
- for addr in sorted(addrset_b - addrset_a):
- b_elem.appendChild(addr.to_dom_fragment(document))
- if b_elem.hasChildNodes():
- host_elem.appendChild(b_elem)
-
- # Host names.
-- hostnames_elem = document.createElement(u"hostnames")
-+ hostnames_elem = document.createElement("hostnames")
- hostnameset_a = set(host_a.hostnames)
- hostnameset_b = set(host_b.hostnames)
- for hostname in sorted(hostnameset_a.intersection(hostnameset_b)):
- hostnames_elem.appendChild(
- host_a.hostname_to_dom_fragment(document, hostname))
-- a_elem = document.createElement(u"a")
-+ a_elem = document.createElement("a")
- for hostname in sorted(hostnameset_a - hostnameset_b):
- a_elem.appendChild(
- host_a.hostname_to_dom_fragment(document, hostname))
- if a_elem.hasChildNodes():
- hostnames_elem.appendChild(a_elem)
-- b_elem = document.createElement(u"b")
-+ b_elem = document.createElement("b")
- for hostname in sorted(hostnameset_b - hostnameset_a):
- b_elem.appendChild(
- host_b.hostname_to_dom_fragment(document, hostname))
-@@ -885,15 +882,15 @@ class HostDiff(object):
- if hostnames_elem.hasChildNodes():
- host_elem.appendChild(hostnames_elem)
-
-- ports_elem = document.createElement(u"ports")
-+ ports_elem = document.createElement("ports")
- # Extraports.
- if host_a.extraports == host_b.extraports:
- ports_elem.appendChild(host_a.extraports_to_dom_fragment(document))
- else:
-- a_elem = document.createElement(u"a")
-+ a_elem = document.createElement("a")
- a_elem.appendChild(host_a.extraports_to_dom_fragment(document))
- ports_elem.appendChild(a_elem)
-- b_elem = document.createElement(u"b")
-+ b_elem = document.createElement("b")
- b_elem.appendChild(host_b.extraports_to_dom_fragment(document))
- ports_elem.appendChild(b_elem)
- # Port list.
-@@ -909,18 +906,18 @@ class HostDiff(object):
-
- # OS changes.
- if self.os_changed or verbose:
-- os_elem = document.createElement(u"os")
-+ os_elem = document.createElement("os")
- # os_diffs is a list of 5-tuples returned by
- # difflib.SequenceMatcher.
- for op, i1, i2, j1, j2 in self.os_diffs:
- if op == "replace" or op == "delete":
-- a_elem = document.createElement(u"a")
-+ a_elem = document.createElement("a")
- for i in range(i1, i2):
- a_elem.appendChild(host_a.os_to_dom_fragment(
- document, host_a.os[i]))
- os_elem.appendChild(a_elem)
- if op == "replace" or op == "insert":
-- b_elem = document.createElement(u"b")
-+ b_elem = document.createElement("b")
- for i in range(j1, j2):
- b_elem.appendChild(host_b.os_to_dom_fragment(
- document, host_b.os[i]))
-@@ -934,7 +931,7 @@ class HostDiff(object):
-
- # Host script changes.
- if len(self.script_result_diffs) > 0 or verbose:
-- hostscript_elem = document.createElement(u"hostscript")
-+ hostscript_elem = document.createElement("hostscript")
- host_elem.appendChild(script_result_diffs_to_dom_fragment(
- hostscript_elem, host_a.script_results,
- host_b.script_results, self.script_result_diffs,
-@@ -987,38 +984,38 @@ class PortDiff(object):
- self.port_b.service.version_string()]
- if a_columns == b_columns:
- if verbose or self.script_result_diffs > 0:
-- table.append([u" "] + a_columns)
-+ table.append([" "] + a_columns)
- else:
- if not host_a.is_extraports(self.port_a.state):
-- table.append([u"-"] + a_columns)
-+ table.append(["-"] + a_columns)
- if not host_b.is_extraports(self.port_b.state):
-- table.append([u"+"] + b_columns)
-+ table.append(["+"] + b_columns)
-
- for sr_diff in self.script_result_diffs:
- sr_diff.append_to_port_table(table)
-
- def to_dom_fragment(self, document):
- frag = document.createDocumentFragment()
-- portdiff_elem = document.createElement(u"portdiff")
-+ portdiff_elem = document.createElement("portdiff")
- frag.appendChild(portdiff_elem)
- if (self.port_a.spec == self.port_b.spec and
- self.port_a.state == self.port_b.state):
-- port_elem = document.createElement(u"port")
-- port_elem.setAttribute(u"portid", unicode(self.port_a.spec[0]))
-- port_elem.setAttribute(u"protocol", self.port_a.spec[1])
-+ port_elem = document.createElement("port")
-+ port_elem.setAttribute("portid", str(self.port_a.spec[0]))
-+ port_elem.setAttribute("protocol", self.port_a.spec[1])
- if self.port_a.state is not None:
-- state_elem = document.createElement(u"state")
-- state_elem.setAttribute(u"state", self.port_a.state)
-+ state_elem = document.createElement("state")
-+ state_elem.setAttribute("state", self.port_a.state)
- port_elem.appendChild(state_elem)
- if self.port_a.service == self.port_b.service:
- port_elem.appendChild(
- self.port_a.service.to_dom_fragment(document))
- else:
-- a_elem = document.createElement(u"a")
-+ a_elem = document.createElement("a")
- a_elem.appendChild(
- self.port_a.service.to_dom_fragment(document))
- port_elem.appendChild(a_elem)
-- b_elem = document.createElement(u"b")
-+ b_elem = document.createElement("b")
- b_elem.appendChild(
- self.port_b.service.to_dom_fragment(document))
- port_elem.appendChild(b_elem)
-@@ -1026,10 +1023,10 @@ class PortDiff(object):
- port_elem.appendChild(sr_diff.to_dom_fragment(document))
- portdiff_elem.appendChild(port_elem)
- else:
-- a_elem = document.createElement(u"a")
-+ a_elem = document.createElement("a")
- a_elem.appendChild(self.port_a.to_dom_fragment(document))
- portdiff_elem.appendChild(a_elem)
-- b_elem = document.createElement(u"b")
-+ b_elem = document.createElement("b")
- b_elem.appendChild(self.port_b.to_dom_fragment(document))
- portdiff_elem.appendChild(b_elem)
-
-@@ -1084,13 +1081,13 @@ class ScriptResultDiff(object):
- for op, i1, i2, j1, j2 in diffs.get_opcodes():
- if op == "replace" or op == "delete":
- for k in range(i1, i2):
-- table.append_raw(u"-" + a_lines[k])
-+ table.append_raw("-" + a_lines[k])
- if op == "replace" or op == "insert":
- for k in range(j1, j2):
-- table.append_raw(u"+" + b_lines[k])
-+ table.append_raw("+" + b_lines[k])
- if op == "equal":
- for k in range(i1, i2):
-- table.append_raw(u" " + a_lines[k])
-+ table.append_raw(" " + a_lines[k])
-
- def to_dom_fragment(self, document):
- frag = document.createDocumentFragment()
-@@ -1100,11 +1097,11 @@ class ScriptResultDiff(object):
- frag.appendChild(self.sr_a.to_dom_fragment(document))
- else:
- if self.sr_a is not None:
-- a_elem = document.createElement(u"a")
-+ a_elem = document.createElement("a")
- a_elem.appendChild(self.sr_a.to_dom_fragment(document))
- frag.appendChild(a_elem)
- if self.sr_b is not None:
-- b_elem = document.createElement(u"b")
-+ b_elem = document.createElement("b")
- b_elem.appendChild(self.sr_b.to_dom_fragment(document))
- frag.appendChild(b_elem)
- return frag
-@@ -1118,7 +1115,7 @@ class Table(object):
- copied to the output."""
- self.widths = []
- self.rows = []
-- self.prefix = u""
-+ self.prefix = ""
- self.padding = []
- j = 0
- while j < len(template) and template[j] != "*":
-@@ -1143,7 +1140,7 @@ class Table(object):
-
- for i in range(len(row)):
- if row[i] is None:
-- s = u""
-+ s = ""
- else:
- s = str(row[i])
- if i == len(self.widths):
-@@ -1165,7 +1162,7 @@ class Table(object):
- for row in self.rows:
- parts = [self.prefix]
- i = 0
-- if isinstance(row, basestring):
-+ if isinstance(row, str):
- # A raw string.
- lines.append(row)
- else:
-@@ -1174,13 +1171,13 @@ class Table(object):
- if i < len(self.padding):
- parts.append(self.padding[i])
- i += 1
-- lines.append(u"".join(parts).rstrip())
-- return u"\n".join(lines)
-+ lines.append("".join(parts).rstrip())
-+ return "\n".join(lines)
-
-
- def warn(str):
- """Print a warning to stderr."""
-- print >> sys.stderr, str
-+ print(str, file=sys.stderr)
-
-
- class NmapContentHandler(xml.sax.handler.ContentHandler):
-@@ -1200,24 +1197,24 @@ class NmapContentHandler(xml.sax.handler
- self.skip_over = False
-
- self._start_elem_handlers = {
-- u"nmaprun": self._start_nmaprun,
-- u"host": self._start_host,
-- u"hosthint": self._start_hosthint,
-- u"status": self._start_status,
-- u"address": self._start_address,
-- u"hostname": self._start_hostname,
-- u"extraports": self._start_extraports,
-- u"port": self._start_port,
-- u"state": self._start_state,
-- u"service": self._start_service,
-- u"script": self._start_script,
-- u"osmatch": self._start_osmatch,
-- u"finished": self._start_finished,
-+ "nmaprun": self._start_nmaprun,
-+ "host": self._start_host,
-+ "hosthint": self._start_hosthint,
-+ "status": self._start_status,
-+ "address": self._start_address,
-+ "hostname": self._start_hostname,
-+ "extraports": self._start_extraports,
-+ "port": self._start_port,
-+ "state": self._start_state,
-+ "service": self._start_service,
-+ "script": self._start_script,
-+ "osmatch": self._start_osmatch,
-+ "finished": self._start_finished,
- }
- self._end_elem_handlers = {
-- u'host': self._end_host,
-- u"hosthint": self._end_hosthint,
-- u'port': self._end_port,
-+ 'host': self._end_host,
-+ "hosthint": self._end_hosthint,
-+ 'port': self._end_port,
- }
-
- def parent_element(self):
-@@ -1247,72 +1244,72 @@ class NmapContentHandler(xml.sax.handler
- def _start_nmaprun(self, name, attrs):
- assert self.parent_element() is None
- if "start" in attrs:
-- start_timestamp = int(attrs.get(u"start"))
-+ start_timestamp = int(attrs.get("start"))
- self.scan.start_date = datetime.datetime.fromtimestamp(
- start_timestamp)
-- self.scan.scanner = attrs.get(u"scanner")
-- self.scan.args = attrs.get(u"args")
-- self.scan.version = attrs.get(u"version")
-+ self.scan.scanner = attrs.get("scanner")
-+ self.scan.args = attrs.get("args")
-+ self.scan.version = attrs.get("version")
-
- def _start_host(self, name, attrs):
-- assert self.parent_element() == u"nmaprun"
-+ assert self.parent_element() == "nmaprun"
- self.current_host = Host()
- self.scan.hosts.append(self.current_host)
-
- def _start_hosthint(self, name, attrs):
-- assert self.parent_element() == u"nmaprun"
-+ assert self.parent_element() == "nmaprun"
- self.skip_over = True
-
- def _start_status(self, name, attrs):
-- assert self.parent_element() == u"host"
-+ assert self.parent_element() == "host"
- assert self.current_host is not None
-- state = attrs.get(u"state")
-+ state = attrs.get("state")
- if state is None:
-- warn(u'%s element of host %s is missing the "state" attribute; '
-- 'assuming \unknown\.' % (
-+ warn('%s element of host %s is missing the "state" attribute; '
-+ r'assuming \unknown\.' % (
- name, self.current_host.format_name()))
- return
- self.current_host.state = state
-
- def _start_address(self, name, attrs):
-- assert self.parent_element() == u"host"
-+ assert self.parent_element() == "host"
- assert self.current_host is not None
-- addr = attrs.get(u"addr")
-+ addr = attrs.get("addr")
- if addr is None:
-- warn(u'%s element of host %s is missing the "addr" '
-+ warn('%s element of host %s is missing the "addr" '
- 'attribute; skipping.' % (
- name, self.current_host.format_name()))
- return
-- addrtype = attrs.get(u"addrtype", u"ipv4")
-+ addrtype = attrs.get("addrtype", "ipv4")
- self.current_host.add_address(Address.new(addrtype, addr))
-
- def _start_hostname(self, name, attrs):
-- assert self.parent_element() == u"hostnames"
-+ assert self.parent_element() == "hostnames"
- assert self.current_host is not None
-- hostname = attrs.get(u"name")
-+ hostname = attrs.get("name")
- if hostname is None:
-- warn(u'%s element of host %s is missing the "name" '
-+ warn('%s element of host %s is missing the "name" '
- 'attribute; skipping.' % (
- name, self.current_host.format_name()))
- return
- self.current_host.add_hostname(hostname)
-
- def _start_extraports(self, name, attrs):
-- assert self.parent_element() == u"ports"
-+ assert self.parent_element() == "ports"
- assert self.current_host is not None
-- state = attrs.get(u"state")
-+ state = attrs.get("state")
- if state is None:
-- warn(u'%s element of host %s is missing the "state" '
-+ warn('%s element of host %s is missing the "state" '
- 'attribute; assuming "unknown".' % (
- name, self.current_host.format_name()))
- state = None
- if state in self.current_host.extraports:
-- warn(u'Duplicate extraports state "%s" in host %s.' % (
-+ warn('Duplicate extraports state "%s" in host %s.' % (
- state, self.current_host.format_name()))
-
-- count = attrs.get(u"count")
-+ count = attrs.get("count")
- if count is None:
-- warn(u'%s element of host %s is missing the "count" '
-+ warn('%s element of host %s is missing the "count" '
- 'attribute; assuming 0.' % (
- name, self.current_host.format_name()))
- count = 0
-@@ -1320,99 +1317,99 @@ class NmapContentHandler(xml.sax.handler
- try:
- count = int(count)
- except ValueError:
-- warn(u"Can't convert extraports count \"%s\" "
-+ warn("Can't convert extraports count \"%s\" "
- "to an integer in host %s; assuming 0." % (
-- attrs[u"count"], self.current_host.format_name()))
-+ attrs["count"], self.current_host.format_name()))
- count = 0
- self.current_host.extraports[state] = count
-
- def _start_port(self, name, attrs):
-- assert self.parent_element() == u"ports"
-+ assert self.parent_element() == "ports"
- assert self.current_host is not None
-- portid_str = attrs.get(u"portid")
-+ portid_str = attrs.get("portid")
- if portid_str is None:
-- warn(u'%s element of host %s missing the "portid" '
-+ warn('%s element of host %s missing the "portid" '
- 'attribute; skipping.' % (
- name, self.current_host.format_name()))
- return
- try:
- portid = int(portid_str)
- except ValueError:
-- warn(u"Can't convert portid \"%s\" to an integer "
-+ warn("Can't convert portid \"%s\" to an integer "
- "in host %s; skipping port." % (
- portid_str, self.current_host.format_name()))
- return
-- protocol = attrs.get(u"protocol")
-+ protocol = attrs.get("protocol")
- if protocol is None:
-- warn(u'%s element of host %s missing the "protocol" '
-+ warn('%s element of host %s missing the "protocol" '
- 'attribute; skipping.' % (
- name, self.current_host.format_name()))
- return
- self.current_port = Port((portid, protocol))
-
- def _start_state(self, name, attrs):
-- assert self.parent_element() == u"port"
-+ assert self.parent_element() == "port"
- assert self.current_host is not None
- if self.current_port is None:
- return
- if "state" not in attrs:
-- warn(u'%s element of port %s is missing the "state" '
-+ warn('%s element of port %s is missing the "state" '
- 'attribute; assuming "unknown".' % (
- name, self.current_port.spec_string()))
- return
-- self.current_port.state = attrs[u"state"]
-+ self.current_port.state = attrs["state"]
- self.current_host.add_port(self.current_port)
-
- def _start_service(self, name, attrs):
-- assert self.parent_element() == u"port"
-+ assert self.parent_element() == "port"
- assert self.current_host is not None
- if self.current_port is None:
- return
-- self.current_port.service.name = attrs.get(u"name")
-- self.current_port.service.product = attrs.get(u"product")
-- self.current_port.service.version = attrs.get(u"version")
-- self.current_port.service.extrainfo = attrs.get(u"extrainfo")
-- self.current_port.service.tunnel = attrs.get(u"tunnel")
-+ self.current_port.service.name = attrs.get("name")
-+ self.current_port.service.product = attrs.get("product")
-+ self.current_port.service.version = attrs.get("version")
-+ self.current_port.service.extrainfo = attrs.get("extrainfo")
-+ self.current_port.service.tunnel = attrs.get("tunnel")
-
- def _start_script(self, name, attrs):
- result = ScriptResult()
-- result.id = attrs.get(u"id")
-+ result.id = attrs.get("id")
- if result.id is None:
-- warn(u'%s element missing the "id" attribute; skipping.' % name)
-+ warn('%s element missing the "id" attribute; skipping.' % name)
- return
-
-- result.output = attrs.get(u"output")
-+ result.output = attrs.get("output")
- if result.output is None:
-- warn(u'%s element missing the "output" attribute; skipping.'
-+ warn('%s element missing the "output" attribute; skipping.'
- % name)
- return
-- if self.parent_element() == u"prescript":
-+ if self.parent_element() == "prescript":
- self.scan.pre_script_results.append(result)
-- elif self.parent_element() == u"postscript":
-+ elif self.parent_element() == "postscript":
- self.scan.post_script_results.append(result)
-- elif self.parent_element() == u"hostscript":
-+ elif self.parent_element() == "hostscript":
- self.current_host.script_results.append(result)
-- elif self.parent_element() == u"port":
-+ elif self.parent_element() == "port":
- self.current_port.script_results.append(result)
- else:
-- warn(u"%s element not inside prescript, postscript, hostscript, "
-+ warn("%s element not inside prescript, postscript, hostscript, "
- "or port element; ignoring." % name)
- return
-
- def _start_osmatch(self, name, attrs):
-- assert self.parent_element() == u"os"
-+ assert self.parent_element() == "os"
- assert self.current_host is not None
- if "name" not in attrs:
-- warn(u'%s element of host %s is missing the "name" '
-+ warn('%s element of host %s is missing the "name" '
- 'attribute; skipping.' % (
- name, self.current_host.format_name()))
- return
-- self.current_host.os.append(attrs[u"name"])
-+ self.current_host.os.append(attrs["name"])
-
- def _start_finished(self, name, attrs):
-- assert self.parent_element() == u"runstats"
-+ assert self.parent_element() == "runstats"
- if "time" in attrs:
-- end_timestamp = int(attrs.get(u"time"))
-+ end_timestamp = int(attrs.get("time"))
- self.scan.end_date = datetime.datetime.fromtimestamp(end_timestamp)
-
- def _end_host(self, name):
-@@ -1434,23 +1431,23 @@ class XMLWriter (xml.sax.saxutils.XMLGen
-
- def frag(self, frag):
- for node in frag.childNodes:
-- node.writexml(self.f, newl=u"\n")
-+ node.writexml(self.f, newl="\n")
-
- def frag_a(self, frag):
-- self.startElement(u"a", {})
-+ self.startElement("a", {})
- for node in frag.childNodes:
-- node.writexml(self.f, newl=u"\n")
-- self.endElement(u"a")
-+ node.writexml(self.f, newl="\n")
-+ self.endElement("a")
-
- def frag_b(self, frag):
-- self.startElement(u"b", {})
-+ self.startElement("b", {})
- for node in frag.childNodes:
-- node.writexml(self.f, newl=u"\n")
-- self.endElement(u"b")
-+ node.writexml(self.f, newl="\n")
-+ self.endElement("b")
-
-
- def usage():
-- print u"""\
-+ print("""\
- Usage: %s [option] FILE1 FILE2
- Compare two Nmap XML files and display a list of their differences.
- Differences include host state changes, port state changes, and changes to
-@@ -1460,7 +1457,7 @@ service and OS detection.
- -v, --verbose also show hosts and ports that haven't changed.
- --text display output in text format (default)
- --xml display output in XML format\
--""" % sys.argv[0]
-+""" % sys.argv[0])
-
- EXIT_EQUAL = 0
- EXIT_DIFFERENT = 1
-@@ -1468,8 +1465,8 @@ EXIT_ERROR = 2
-
-
- def usage_error(msg):
-- print >> sys.stderr, u"%s: %s" % (sys.argv[0], msg)
-- print >> sys.stderr, u"Try '%s -h' for help." % sys.argv[0]
-+ print("%s: %s" % (sys.argv[0], msg), file=sys.stderr)
-+ print("Try '%s -h' for help." % sys.argv[0], file=sys.stderr)
- sys.exit(EXIT_ERROR)
-
-
-@@ -1480,7 +1477,7 @@ def main():
- try:
- opts, input_filenames = getopt.gnu_getopt(
- sys.argv[1:], "hv", ["help", "text", "verbose", "xml"])
-- except getopt.GetoptError, e:
-+ except getopt.GetoptError as e:
- usage_error(e.msg)
- for o, a in opts:
- if o == "-h" or o == "--help":
-@@ -1490,15 +1487,15 @@ def main():
- verbose = True
- elif o == "--text":
- if output_format is not None and output_format != "text":
-- usage_error(u"contradictory output format options.")
-+ usage_error("contradictory output format options.")
- output_format = "text"
- elif o == "--xml":
- if output_format is not None and output_format != "xml":
-- usage_error(u"contradictory output format options.")
-+ usage_error("contradictory output format options.")
- output_format = "xml"
-
- if len(input_filenames) != 2:
-- usage_error(u"need exactly two input filenames.")
-+ usage_error("need exactly two input filenames.")
-
- if output_format is None:
- output_format = "text"
-@@ -1511,8 +1508,8 @@ def main():
- scan_a.load_from_file(filename_a)
- scan_b = Scan()
- scan_b.load_from_file(filename_b)
-- except IOError, e:
-- print >> sys.stderr, u"Can't open file: %s" % str(e)
-+ except IOError as e:
-+ print("Can't open file: %s" % str(e), file=sys.stderr)
- sys.exit(EXIT_ERROR)
-
- if output_format == "text":
---- a/ndiff/ndifftest.py
-+++ b/ndiff/ndifftest.py
-@@ -1,4 +1,4 @@
--#!/usr/bin/env python
-+#!/usr/bin/env python3
-
- # Unit tests for Ndiff.
-
-@@ -22,7 +22,7 @@ for x in dir(ndiff):
- sys.dont_write_bytecode = dont_write_bytecode
- del dont_write_bytecode
-
--import StringIO
-+import io
-
-
- class scan_test(unittest.TestCase):
-@@ -52,7 +52,7 @@ class scan_test(unittest.TestCase):
- scan.load_from_file("test-scans/single.xml")
- host = scan.hosts[0]
- self.assertEqual(len(host.ports), 5)
-- self.assertEqual(host.extraports.items(), [("filtered", 95)])
-+ self.assertEqual(list(host.extraports.items()), [("filtered", 95)])
-
- def test_extraports_multi(self):
- """Test that the correct number of known ports is returned when there
-@@ -68,9 +68,9 @@ class scan_test(unittest.TestCase):
- """Test that nmaprun information is recorded."""
- scan = Scan()
- scan.load_from_file("test-scans/empty.xml")
-- self.assertEqual(scan.scanner, u"nmap")
-- self.assertEqual(scan.version, u"4.90RC2")
-- self.assertEqual(scan.args, u"nmap -oX empty.xml -p 1-100")
-+ self.assertEqual(scan.scanner, "nmap")
-+ self.assertEqual(scan.version, "4.90RC2")
-+ self.assertEqual(scan.args, "nmap -oX empty.xml -p 1-100")
-
- def test_addresses(self):
- """Test that addresses are recorded."""
-@@ -84,7 +84,7 @@ class scan_test(unittest.TestCase):
- scan = Scan()
- scan.load_from_file("test-scans/simple.xml")
- host = scan.hosts[0]
-- self.assertEqual(host.hostnames, [u"scanme.nmap.org"])
-+ self.assertEqual(host.hostnames, ["scanme.nmap.org"])
-
- def test_os(self):
- """Test that OS information is recorded."""
-@@ -99,7 +99,7 @@ class scan_test(unittest.TestCase):
- scan.load_from_file("test-scans/complex.xml")
- host = scan.hosts[0]
- self.assertTrue(len(host.script_results) > 0)
-- self.assertTrue(len(host.ports[(22, u"tcp")].script_results) > 0)
-+ self.assertTrue(len(host.ports[(22, "tcp")].script_results) > 0)
-
- # This test is commented out because Nmap XML doesn't store any information
- # about down hosts, not even the fact that they are down. Recovering the list
-@@ -128,16 +128,16 @@ class host_test(unittest.TestCase):
-
- def test_format_name(self):
- h = Host()
-- self.assertTrue(isinstance(h.format_name(), basestring))
-- h.add_address(IPv4Address(u"127.0.0.1"))
-- self.assertTrue(u"127.0.0.1" in h.format_name())
-+ self.assertTrue(isinstance(h.format_name(), str))
-+ h.add_address(IPv4Address("127.0.0.1"))
-+ self.assertTrue("127.0.0.1" in h.format_name())
- h.add_address(IPv6Address("::1"))
-- self.assertTrue(u"127.0.0.1" in h.format_name())
-- self.assertTrue(u"::1" in h.format_name())
-- h.add_hostname(u"localhost")
-- self.assertTrue(u"127.0.0.1" in h.format_name())
-- self.assertTrue(u"::1" in h.format_name())
-- self.assertTrue(u"localhost" in h.format_name())
-+ self.assertTrue("127.0.0.1" in h.format_name())
-+ self.assertTrue("::1" in h.format_name())
-+ h.add_hostname("localhost")
-+ self.assertTrue("127.0.0.1" in h.format_name())
-+ self.assertTrue("::1" in h.format_name())
-+ self.assertTrue("localhost" in h.format_name())
-
- def test_empty_get_port(self):
- h = Host()
-@@ -197,8 +197,8 @@ class host_test(unittest.TestCase):
- h = s.hosts[0]
- self.assertEqual(len(h.ports), 5)
- self.assertEqual(len(h.extraports), 1)
-- self.assertEqual(h.extraports.keys()[0], u"filtered")
-- self.assertEqual(h.extraports.values()[0], 95)
-+ self.assertEqual(list(h.extraports.keys())[0], "filtered")
-+ self.assertEqual(list(h.extraports.values())[0], 95)
- self.assertEqual(h.state, "up")
-
-
-@@ -241,13 +241,13 @@ class port_test(unittest.TestCase):
- """Test the Port class."""
- def test_spec_string(self):
- p = Port((10, "tcp"))
-- self.assertEqual(p.spec_string(), u"10/tcp")
-+ self.assertEqual(p.spec_string(), "10/tcp")
- p = Port((100, "ip"))
-- self.assertEqual(p.spec_string(), u"100/ip")
-+ self.assertEqual(p.spec_string(), "100/ip")
-
- def test_state_string(self):
- p = Port((10, "tcp"))
-- self.assertEqual(p.state_string(), u"unknown")
-+ self.assertEqual(p.state_string(), "unknown")
-
-
- class service_test(unittest.TestCase):
-@@ -255,47 +255,47 @@ class service_test(unittest.TestCase):
- def test_compare(self):
- """Test that services with the same contents compare equal."""
- a = Service()
-- a.name = u"ftp"
-- a.product = u"FooBar FTP"
-- a.version = u"1.1.1"
-- a.tunnel = u"ssl"
-+ a.name = "ftp"
-+ a.product = "FooBar FTP"
-+ a.version = "1.1.1"
-+ a.tunnel = "ssl"
- self.assertEqual(a, a)
- b = Service()
-- b.name = u"ftp"
-- b.product = u"FooBar FTP"
-- b.version = u"1.1.1"
-- b.tunnel = u"ssl"
-+ b.name = "ftp"
-+ b.product = "FooBar FTP"
-+ b.version = "1.1.1"
-+ b.tunnel = "ssl"
- self.assertEqual(a, b)
-- b.name = u"http"
-+ b.name = "http"
- self.assertNotEqual(a, b)
- c = Service()
- self.assertNotEqual(a, c)
-
- def test_tunnel(self):
- serv = Service()
-- serv.name = u"http"
-- serv.tunnel = u"ssl"
-- self.assertEqual(serv.name_string(), u"ssl/http")
-+ serv.name = "http"
-+ serv.tunnel = "ssl"
-+ self.assertEqual(serv.name_string(), "ssl/http")
-
- def test_version_string(self):
- serv = Service()
-- serv.product = u"FooBar"
-+ serv.product = "FooBar"
- self.assertTrue(len(serv.version_string()) > 0)
- serv = Service()
-- serv.version = u"1.2.3"
-+ serv.version = "1.2.3"
- self.assertTrue(len(serv.version_string()) > 0)
- serv = Service()
-- serv.extrainfo = u"misconfigured"
-+ serv.extrainfo = "misconfigured"
- self.assertTrue(len(serv.version_string()) > 0)
- serv = Service()
-- serv.product = u"FooBar"
-- serv.version = u"1.2.3"
-+ serv.product = "FooBar"
-+ serv.version = "1.2.3"
- # Must match Nmap output.
- self.assertEqual(serv.version_string(),
-- u"%s %s" % (serv.product, serv.version))
-- serv.extrainfo = u"misconfigured"
-+ "%s %s" % (serv.product, serv.version))
-+ serv.extrainfo = "misconfigured"
- self.assertEqual(serv.version_string(),
-- u"%s %s (%s)" % (serv.product, serv.version, serv.extrainfo))
-+ "%s %s (%s)" % (serv.product, serv.version, serv.extrainfo))
-
-
- class ScanDiffSub(ScanDiff):
-@@ -703,7 +703,7 @@ class scan_diff_xml_test(unittest.TestCa
- a.load_from_file("test-scans/empty.xml")
- b = Scan()
- b.load_from_file("test-scans/simple.xml")
-- f = StringIO.StringIO()
-+ f = io.StringIO()
- self.scan_diff = ScanDiffXML(a, b, f)
- self.scan_diff.output()
- self.xml = f.getvalue()
-@@ -712,8 +712,8 @@ class scan_diff_xml_test(unittest.TestCa
- def test_well_formed(self):
- try:
- document = xml.dom.minidom.parseString(self.xml)
-- except Exception, e:
-- self.fail(u"Parsing XML diff output caused the exception: %s"
-+ except Exception as e:
-+ self.fail("Parsing XML diff output caused the exception: %s"
- % str(e))
-
-
-@@ -739,8 +739,8 @@ def host_apply_diff(host, diff):
- host.os = diff.host_b.os[:]
-
- if diff.extraports_changed:
-- for state in host.extraports.keys():
-- for port in host.ports.values():
-+ for state in list(host.extraports.keys()):
-+ for port in list(host.ports.values()):
- if port.state == state:
- del host.ports[port.spec]
- host.extraports = diff.host_b.extraports.copy()
---- a/ndiff/scripts/ndiff
-+++ b/ndiff/scripts/ndiff
-@@ -1,4 +1,4 @@
--#!/usr/bin/env python
-+#!/usr/bin/env python3
-
- # Ndiff
- #
-@@ -66,15 +66,15 @@ if INSTALL_LIB is not None and is_secure
-
- try:
- import ndiff
--except ImportError, e:
-- print >> sys.stderr, """\
-+except ImportError as e:
-+ print("""\
- Could not import the ndiff module: %s.
--I checked in these directories:""" % repr(e.message)
-+I checked in these directories:""" % repr(e), file=sys.stderr)
- for dir in sys.path:
-- print >> sys.stderr, " %s" % dir
-- print >> sys.stderr, """\
-+ print(" %s" % dir, file=sys.stderr)
-+ print("""\
- If you installed Ndiff in another directory, you may have to add the
--modules directory to the PYTHONPATH environment variable."""
-+modules directory to the PYTHONPATH environment variable.""", file=sys.stderr)
- sys.exit(1)
-
- import ndiff
---- a/ndiff/setup.py
-+++ b/ndiff/setup.py
-@@ -1,4 +1,4 @@
--#!/usr/bin/env python
-+#!/usr/bin/env python3
-
- import errno
- import sys
-@@ -94,7 +94,7 @@ class checked_install(distutils.command.
- self.saved_prefix = sys.prefix
- try:
- distutils.command.install.install.finalize_options(self)
-- except distutils.errors.DistutilsPlatformError, e:
-+ except distutils.errors.DistutilsPlatformError as e:
- raise distutils.errors.DistutilsPlatformError(str(e) + """
- Installing your distribution's python-dev package may solve this problem.""")
-
-@@ -152,16 +152,16 @@ Installing your distribution's python-de
- self.install_scripts, "uninstall_" + APP_NAME)
-
- uninstaller = """\
--#!/usr/bin/env python
-+#!/usr/bin/env python3
- import errno, os, os.path, sys
-
--print 'Uninstall %(name)s'
-+print('Uninstall %(name)s')
-
- answer = raw_input('Are you sure that you want to uninstall '
- '%(name)s (yes/no) ')
-
- if answer != 'yes' and answer != 'y':
-- print 'Not uninstalling.'
-+ print('Not uninstalling.')
- sys.exit(0)
-
- """ % {'name': APP_NAME}
-@@ -177,8 +177,8 @@ if answer != 'yes' and answer != 'y':
- # This should never happen (everything gets installed
- # inside the root), but if it does, be safe and don't
- # delete anything.
-- uninstaller += ("print '%s was not installed inside "
-- "the root %s; skipping.'\n" % (output, self.root))
-+ uninstaller += ("print('%s was not installed inside "
-+ "the root %s; skipping.')\n" % (output, self.root))
- continue
- output = path_strip_prefix(output, self.root)
- assert os.path.isabs(output)
-@@ -202,24 +202,24 @@ for path in INSTALLED_FILES:
- dirs.append(path)
- # Delete the files.
- for file in files:
-- print "Removing '%s'." % file
-+ print("Removing '%s'." % file)
- try:
- os.remove(file)
-- except OSError, e:
-- print >> sys.stderr, ' Error: %s.' % str(e)
-+ except OSError as e:
-+ print(' Error: %s.' % str(e), file=sys.stderr)
- # Delete the directories. First reverse-sort the normalized paths by
- # length so that child directories are deleted before their parents.
- dirs = [os.path.normpath(dir) for dir in dirs]
- dirs.sort(key = len, reverse = True)
- for dir in dirs:
- try:
-- print "Removing the directory '%s'." % dir
-+ print("Removing the directory '%s'." % dir)
- os.rmdir(dir)
-- except OSError, e:
-+ except OSError as e:
- if e.errno == errno.ENOTEMPTY:
-- print "Directory '%s' not empty; not removing." % dir
-+ print("Directory '%s' not empty; not removing." % dir)
- else:
-- print >> sys.stderr, str(e)
-+ print(str(e), file=sys.stderr)
- """
-
- uninstaller_file = open(uninstaller_filename, 'w')
-@@ -227,7 +227,7 @@ for dir in dirs:
- uninstaller_file.close()
-
- # Set exec bit for uninstaller
-- mode = ((os.stat(uninstaller_filename)[ST_MODE]) | 0555) & 07777
-+ mode = ((os.stat(uninstaller_filename)[ST_MODE]) | 0o555) & 0o7777
- os.chmod(uninstaller_filename, mode)
-
- def write_installed_files(self):
-@@ -241,7 +241,7 @@ for dir in dirs:
- with open(INSTALLED_FILES_NAME, "w") as f:
- for output in self.get_installed_files():
- assert "\n" not in output
-- print >> f, output
-+ print(output, file=f)
-
-
- class my_uninstall(distutils.cmd.Command):
-@@ -263,7 +263,7 @@ class my_uninstall(distutils.cmd.Command
- # Read the list of installed files.
- try:
- f = open(INSTALLED_FILES_NAME, "r")
-- except IOError, e:
-+ except IOError as e:
- if e.errno == errno.ENOENT:
- log.error("Couldn't open the installation record '%s'. "
- "Have you installed yet?" % INSTALLED_FILES_NAME)
-@@ -286,7 +286,7 @@ class my_uninstall(distutils.cmd.Command
- try:
- if not self.dry_run:
- os.remove(file)
-- except OSError, e:
-+ except OSError as e:
- log.error(str(e))
- # Delete the directories. First reverse-sort the normalized paths by
- # length so that child directories are deleted before their parents.
-@@ -297,16 +297,16 @@ class my_uninstall(distutils.cmd.Command
- log.info("Removing the directory '%s'." % dir)
- if not self.dry_run:
- os.rmdir(dir)
-- except OSError, e:
-+ except OSError as e:
- if e.errno == errno.ENOTEMPTY:
- log.info("Directory '%s' not empty; not removing." % dir)
- else:
- log.error(str(e))
-
-
--distutils.core.setup(name=u"ndiff", scripts=[u"scripts/ndiff"],
-- py_modules=[u"ndiff"],
-- data_files=[(u"share/man/man1", [u"docs/ndiff.1"])],
-+distutils.core.setup(name="ndiff", scripts=["scripts/ndiff"],
-+ py_modules=["ndiff"],
-+ data_files=[("share/man/man1", ["docs/ndiff.1"])],
- cmdclass={
- "install_egg_info": null_command,
- "install": checked_install,
---- a/ndiff/test-scans/anonymize.py
-+++ b/ndiff/test-scans/anonymize.py
-@@ -1,4 +1,4 @@
--#!/usr/bin/env python
-+#!/usr/bin/env python3
-
- # Anonymize an Nmap XML file, replacing host name and IP addresses with random
- # anonymous ones. Anonymized names will be consistent between runs of the
-@@ -20,20 +20,20 @@ r = random.Random()
-
-
- def hash(s):
-- digest = hashlib.sha512(s).hexdigest()
-+ digest = hashlib.sha512(s.encode()).hexdigest()
- return int(digest, 16)
-
-
- def anonymize_mac_address(addr):
- r.seed(hash(addr))
- nums = (0, 0, 0) + tuple(r.randrange(256) for i in range(3))
-- return u":".join(u"%02X" % x for x in nums)
-+ return ":".join("%02X" % x for x in nums)
-
-
- def anonymize_ipv4_address(addr):
- r.seed(hash(addr))
- nums = (10,) + tuple(r.randrange(256) for i in range(3))
-- return u".".join(unicode(x) for x in nums)
-+ return ".".join(str(x) for x in nums)
-
-
- def anonymize_ipv6_address(addr):
-@@ -41,7 +41,7 @@ def anonymize_ipv6_address(addr):
- # RFC 4193.
- nums = (0xFD00 + r.randrange(256),)
- nums = nums + tuple(r.randrange(65536) for i in range(7))
-- return u":".join("%04X" % x for x in nums)
-+ return ":".join("%04X" % x for x in nums)
-
- # Maps to memoize address and host name conversions.
- hostname_map = {}
-@@ -54,11 +54,11 @@ def anonymize_hostname(name):
- LETTERS = "acbdefghijklmnopqrstuvwxyz"
- r.seed(hash(name))
- length = r.randrange(5, 10)
-- prefix = u"".join(r.sample(LETTERS, length))
-+ prefix = "".join(r.sample(LETTERS, length))
- num = r.randrange(1000)
-- hostname_map[name] = u"%s-%d.example.com" % (prefix, num)
-+ hostname_map[name] = "%s-%d.example.com" % (prefix, num)
- if VERBOSE:
-- print >> sys.stderr, "Replace %s with %s" % (name, hostname_map[name])
-+ print("Replace %s with %s" % (name, hostname_map[name]), file=sys.stderr)
- return hostname_map[name]
-
- mac_re = re.compile(r'\b([0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2}\b')
-@@ -78,7 +78,7 @@ def anonymize_address(addr):
- else:
- assert False
- if VERBOSE:
-- print >> sys.stderr, "Replace %s with %s" % (addr, address_map[addr])
-+ print("Replace %s with %s" % (addr, address_map[addr]), file=sys.stderr)
- return address_map[addr]
-
-
ifneq ($(NOLUA),yes)
--- a/ncat/ncat_posix.c
+++ b/ncat/ncat_posix.c
-@@ -347,28 +347,17 @@ void set_lf_mode(void)
+@@ -357,28 +357,17 @@ void set_lf_mode(void)
#ifdef HAVE_OPENSSL
#endif
--- a/ncat/ncat_ssl.h
+++ b/ncat/ncat_ssl.h
-@@ -67,8 +67,6 @@
+@@ -66,8 +66,6 @@
#include <openssl/ssl.h>
#include <openssl/err.h>
--- /dev/null
+From 707812db69cc5fdb8b6b4417d3a6b18405116d9f Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Sun, 28 Apr 2024 12:00:02 +0200
+Subject: [PATCH] nsock: Fix compilation error with OPENSSL_NO_DTLS
+
+Commit ba26cc78f207 ("Replace check for DTLS_client_method with
+OPENSSL_NO_DTLS") made DTLS support depend on the openssl define
+directly but leave some use of dtlsctx not guarded by ifdef.
+
+Fix this by adding to the remaining use of dtlsctx ifdef guard and
+return fatal print for running function with unsupported OpenSSL
+feature.
+
+Fixes: ba26cc78f207 ("Replace check for DTLS_client_method with OPENSSL_NO_DTLS")
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ nsock/src/nsock_connect.c | 4 ++++
+ nsock/src/nsock_core.c | 9 ++++++++-
+ nsock/src/nsock_pool.c | 2 ++
+ 3 files changed, 14 insertions(+), 1 deletion(-)
+
+--- a/nsock/src/nsock_connect.c
++++ b/nsock/src/nsock_connect.c
+@@ -472,8 +472,12 @@ nsock_event_id nsock_connect_ssl(nsock_p
+
+ if (proto == IPPROTO_UDP)
+ {
++#ifndef OPENSSL_NO_DTLS
+ if (!ms->dtlsctx)
+ nsock_pool_dtls_init(ms, 0);
++#else
++ fatal("%s called with no OpenSSL DTLS support", __func__);
++#endif
+ }
+ else
+ {
+--- a/nsock/src/nsock_core.c
++++ b/nsock/src/nsock_core.c
+@@ -364,7 +364,14 @@ void handle_connect_result(struct npool
+ if (nse->type == NSE_TYPE_CONNECT_SSL &&
+ nse->status == NSE_STATUS_SUCCESS) {
+ #if HAVE_OPENSSL
+- sslctx = iod->lastproto == IPPROTO_UDP ? ms->dtlsctx : ms->sslctx;
++ if (iod->lastproto == IPPROTO_UDP)
++#ifndef OPENSSL_NO_DTLS
++ sslctx = ms->dtlsctx;
++#else
++ fatal("%s called with no OpenSSL DTLS support", __func__);
++#endif
++ else
++ sslctx = ms->sslctx;
+ assert(sslctx != NULL);
+ /* Reuse iod->ssl if present. If set, this is the second try at connection
+ without the SSL_OP_NO_SSLv2 option set. */
+--- a/nsock/src/nsock_pool.c
++++ b/nsock/src/nsock_pool.c
+@@ -178,8 +178,10 @@ nsock_pool nsock_pool_new(void *userdata
+
+ #if HAVE_OPENSSL
+ nsp->sslctx = NULL;
++#ifndef OPENSSL_NO_DTLS
+ nsp->dtlsctx = NULL;
+ #endif
++#endif
+
+ nsp->px_chain = NULL;
+
include $(TOPDIR)/rules.mk
PKG_NAME:=ntp
-PKG_VERSION:=4.2.8p15
-PKG_RELEASE:=4
+PKG_VERSION:=4.2.8p17
+PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=http://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ntp-4.2/
-PKG_HASH:=f65840deab68614d5d7ceb2d0bb9304ff70dcdedd09abb79754a87536b849c19
+PKG_HASH:=103dd272e6a66c5b8df07dce5e9a02555fcd6f1397bdfb782237328e89d3a866
PKG_LICENSE:=NTP
PKG_LICENSE_FILES:=COPYRIGHT html/copyright.html
reference NTP servers by the local daemon. At least one is required,
and two or more are recommended (unless you have an extremely available
local server). They should be picked to be geographically divergent,
-and preferrably reachable via different network carriers to protect
+and preferably reachable via different network carriers to protect
against network partitions, etc. They should also be high-quality
time providers (i.e. having stable, accurate clock sources).
often of unknown/unverified quality, and you use them at your own
risk.
-Early millenial versions of Windows (2000, XP, etc) used NTP only
+Early millennial versions of Windows (2000, XP, etc) used NTP only
to _initially set_ the clock to approximately 100ms accuracy (and
-not maintain sychronization), so the bar wasn't set very high.
-Since then, requirements for higher-qualty timekeeping have
+not maintain synchronization), so the bar wasn't set very high.
+Since then, requirements for higher-quality timekeeping have
arisen (e.g. multi-master SQL database replication), but most ISPs
have not kept up with the needs of their users.
+++ /dev/null
-From 082a504cfcc046c3d8adaae1164268bc94e5108a Mon Sep 17 00:00:00 2001
-From: Khem Raj <raj.khem@gmail.com>
-Date: Sat, 31 Jul 2021 10:51:41 -0700
-Subject: [PATCH] libntp: Do not use PTHREAD_STACK_MIN on glibc
-
-In glibc 2.34+ PTHREAD_STACK_MIN is not a compile-time constant which
-could mean different stack sizes at runtime on different architectures
-and it also causes compile failure. Default glibc thread stack size
-or 64Kb set by ntp should be good in glibc these days.
-
-Upstream-Status: Pending
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
----
- libntp/work_thread.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/libntp/work_thread.c
-+++ b/libntp/work_thread.c
-@@ -41,7 +41,7 @@
- #ifndef THREAD_MINSTACKSIZE
- # define THREAD_MINSTACKSIZE (64U * 1024)
- #endif
--#ifndef __sun
-+#if !defined(__sun) && !defined(__GLIBC__)
- #if defined(PTHREAD_STACK_MIN) && THREAD_MINSTACKSIZE < PTHREAD_STACK_MIN
- # undef THREAD_MINSTACKSIZE
- # define THREAD_MINSTACKSIZE PTHREAD_STACK_MIN
include $(TOPDIR)/rules.mk
PKG_NAME:=ola
-PKG_VERSION:=0.10.8
-PKG_RELEASE:=4
+PKG_VERSION:=0.10.9
+PKG_RELEASE:=1
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://codeload.github.com/OpenLightingProject/ola/tar.gz/$(PKG_VERSION)?
-PKG_HASH:=45bc101d1ddcc1c6320c063eb25a9345e5820a4233acfa5b29f2dfd99f7452e1
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_VERSION:=$(PKG_VERSION)
+PKG_SOURCE_URL:=https://github.com/OpenLightingProject/ola
+PKG_MIRROR_HASH:=55b9c82dec4133c3895a9af99a3245764ece14fc5b0a4e0841686903b1d6f365
PKG_MAINTAINER:=Christian Beier <dontmind@freeshell.org>
PKG_LICENSE:=LGPL-2.1-or-later
--disable-examples \
--disable-unittests \
--disable-doxygen-html \
- --disable-doxygen-doc
-
-HOST_LDFLAGS += -Wl,-rpath$(comma)$(STAGING_DIR_HOSTPKG)/lib
-TARGET_LDFLAGS += $(if $(CONFIG_USE_GLIBC),-lm)
+ --disable-doxygen-doc \
+ --with-protoc=$(STAGING_DIR_HOSTPKG)/bin/protoc
# only build the ola_protoc thingy
define Host/Compile
--- /dev/null
+--- a/config/ola.m4
++++ b/config/ola.m4
+@@ -84,7 +84,7 @@ else
+ [],
+ AC_MSG_ERROR([Cannot find the protoc header files]))
+ SAVED_LIBS=$LIBS
+- LIBS="$LIBS -lprotoc"
++ LIBS="$LIBS -lprotoc -lprotobuf"
+ AC_LINK_IFELSE(
+ [AC_LANG_PROGRAM([#include <google/protobuf/compiler/command_line_interface.h>],
+ [google::protobuf::compiler::CommandLineInterface cli])],
+++ /dev/null
-https://github.com/OpenLightingProject/ola/commit/30fe936a885c8a364bdda507a692c8e259576621
-
-From 30fe936a885c8a364bdda507a692c8e259576621 Mon Sep 17 00:00:00 2001
-From: Peter Newman <peterjnewman@gmail.com>
-Date: Mon, 13 Aug 2018 00:53:51 +0100
-Subject: [PATCH] Extend configure so we switch to C++11 if necessary for
- Protobuf 3.6 or above too
-
-(cherry picked from commit 5286a6925f5f9dc1a045d13632d08cef7f818536)
----
- configure.ac | 28 +++++++++++++++++-----------
- 1 file changed, 17 insertions(+), 11 deletions(-)
-
---- a/configure.ac
-+++ b/configure.ac
-@@ -103,23 +103,29 @@ AS_IF([test "x$ac_cv_gnu_plus_plus_11" =
- # force us into gnu++98 mode if necessary
- # If gnu++11 and gnu++98 then
- # If random works with gnu++98
--# If no unit tests, force to gnu++98
--# If unittests and cppunit < 1.14.0, force to gnu++98
--# Else turn off deprecation messages for std::auto_ptr and run gnu++11
--# Else run gnu++11
-+# If protobuf < 3.6
-+# If no unit tests, force to gnu++98
-+# Else we have unit tests
-+# If cppunit < 1.14.0, force to gnu++98
-+# Else turn off deprecation messages for std::auto_ptr and run gnu++11
-+# Else assume we have protobuf >= 3.6 (later checks will confirm that for certain), turn off deprecation messages for std::auto_ptr and run gnu++11
-+# Else turn off deprecation messages for std::auto_ptr and run gnu++11
- require_gnu_plus_plus_11="no"
- AS_IF([test "x$ac_cv_gnu_plus_plus_11" = xyes],
- [AS_IF([test "x$ac_cv_gnu_plus_plus_98" = xyes],
- [AS_IF([test "x$ac_cv_header_random_98" = xyes],
-- [AS_IF([test "x$enable_unittests" = xno],
-- [CXXFLAGS="$CXXFLAGS -std=gnu++98"],
-- [PKG_CHECK_MODULES([CPPUNIT1], [cppunit < 1.14.0],
-+ [PKG_CHECK_MODULES([PROTOBUF1], [protobuf < 3.6],
-+ [AS_IF([test "x$enable_unittests" = xno],
- [CXXFLAGS="$CXXFLAGS -std=gnu++98"],
-- [PKG_CHECK_MODULES([CPPUNIT2], [cppunit >= 1.14.0],
-- [require_gnu_plus_plus_11="yes"],
-- [AC_MSG_WARN([OLA requires std::auto_ptr support.])])
-+ [PKG_CHECK_MODULES([CPPUNIT1], [cppunit < 1.14.0],
-+ [CXXFLAGS="$CXXFLAGS -std=gnu++98"],
-+ [PKG_CHECK_MODULES([CPPUNIT2], [cppunit >= 1.14.0],
-+ [require_gnu_plus_plus_11="yes"],
-+ [AC_MSG_WARN([OLA requires std::auto_ptr support.])])
-+ ])
- ])
-- ])
-+ ],
-+ [require_gnu_plus_plus_11="yes"])
- ],
- [require_gnu_plus_plus_11="yes"])
- ])
--- a/configure.ac
+++ b/configure.ac
-@@ -434,8 +434,7 @@ ACX_PTHREAD([
+@@ -439,8 +439,7 @@ ACX_PTHREAD([
LIBS="$PTHREAD_LIBS $LIBS"
CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
CXXFLAGS="$CXXFLAGS $PTHREAD_CXXFLAGS"
PKG_NAME:=p910nd
PKG_VERSION:=0.97
-PKG_RELEASE:=13
+PKG_RELEASE:=14
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
PKG_SOURCE_URL:=@SF/p910nd
[ "$DEBUG" ] && echo ${MFG:+MFG=$MFG} ${MDL:+MDL=$MDL} ${CMD:+CMD=$CMD} ${CLS:+CLS=$CLS} ${DES:+DES=$DES} ${SN:+SN=$SN}
[ "$DEBUG" ] && echo 'uci set' for UCI_DEV_CFG_NUMBER: $UCI_DEV_CFG_NUMBER
- # Take the USB info as fact: set bidir regardless. It seems to be a source of confusion.
- eval "$uqsddu_cmd.bidirectional='$BIDIR'"
+ [ -z "$(eval "$uqgddu_cmd".bidirectional)" ] && eval "$uqsddu_cmd.bidirectional='$BIDIR'"
[ -z "$(eval "$uqgddu_cmd".port)" ] && eval "$uqsddu_cmd.port='0'"
[ -z "$(eval "$uqgddu_cmd".enabled)" ] && eval "$uqsddu_cmd.enabled='1'"
[ -z "$(eval "$uqgddu_cmd".usbvidpid)" ] && [ -n "$THIS_USB_VIDPID" ] && eval "$uqsddu_cmd.usbvidpid='$THIS_USB_VIDPID'"
PKG_NAME:=pbr
PKG_VERSION:=1.1.4
-PKG_RELEASE:=r7
-PKG_LICENSE:=GPL-3.0-or-later
+PKG_RELEASE:=16
+PKG_LICENSE:=AGPL-3.0-or-later
PKG_MAINTAINER:=Stan Grishin <stangri@melmac.ca>
include $(INCLUDE_DIR)/package.mk
-define Package/pbr-service/Default
+define Package/pbr/default
SECTION:=net
CATEGORY:=Network
SUBMENU:=Routing and Redirection
DEPENDS+=+!BUSYBOX_DEFAULT_AWK:gawk
DEPENDS+=+!BUSYBOX_DEFAULT_GREP:grep
DEPENDS+=+!BUSYBOX_DEFAULT_SED:sed
- PROVIDES:=pbr-service
CONFLICTS:=vpnbypass vpn-policy-routing
+ PROVIDES:=pbr
PKGARCH:=all
endef
define Package/pbr
-$(call Package/pbr-service/Default)
+$(call Package/pbr/default)
TITLE+= with nft/nft set support
DEPENDS+=+kmod-nft-core +kmod-nft-nat +nftables-json
- DEFAULT_VARIANT:=1
VARIANT:=nftables
- PROVIDES+=pbr vpnbypass vpn-policy-routing
+ DEFAULT_VARIANT:=1
+ PROVIDES+=vpnbypass vpn-policy-routing
endef
define Package/pbr-iptables
-$(call Package/pbr-service/Default)
+$(call Package/pbr/default)
TITLE+= with iptables/ipset support
DEPENDS+=+ipset +iptables +kmod-ipt-ipset +iptables-mod-ipopt
VARIANT:=iptables
endef
define Package/pbr-netifd
-$(call Package/pbr-service/Default)
+$(call Package/pbr/default)
TITLE+= with netifd support
VARIANT:=netifd
endef
-define Package/pbr-service/description
+define Package/pbr/default/description
This service enables policy-based routing for WAN interfaces and various VPN tunnels.
endef
define Package/pbr/description
- $(call Package/pbr-service/description)
+ $(call Package/pbr/default/description)
This version supports OpenWrt with both firewall3/ipset/iptables and firewall4/nft.
endef
define Package/pbr-iptables/description
- $(call Package/pbr-service/description)
+ $(call Package/pbr/default/description)
This version supports OpenWrt with firewall3/ipset/iptables.
endef
define Package/pbr-netifd/description
- $(call Package/pbr-service/description)
+ $(call Package/pbr/default/description)
This version supports OpenWrt with both firewall3/ipset/iptables and firewall4/nft.
This version uses OpenWrt native netifd/tables to set up interfaces. This is WIP.
endef
-define Package/pbr-service/conffiles
+define Package/pbr/default/conffiles
/etc/config/pbr
endef
-Package/pbr/conffiles = $(Package/pbr-service/conffiles)
-Package/pbr-iptables/conffiles = $(Package/pbr-service/conffiles)
-Package/pbr-netifd/conffiles = $(Package/pbr-service/conffiles)
+Package/pbr/conffiles = $(Package/pbr/default/conffiles)
+Package/pbr-iptables/conffiles = $(Package/pbr/default/conffiles)
+Package/pbr-netifd/conffiles = $(Package/pbr/default/conffiles)
define Build/Configure
endef
define Build/Compile
endef
-define Package/pbr-service/install
+define Package/pbr/default/install
$(INSTALL_DIR) $(1)/etc/init.d
$(INSTALL_BIN) ./files/etc/init.d/pbr $(1)/etc/init.d/pbr
$(SED) "s|^\(readonly PKG_VERSION\).*|\1='$(PKG_VERSION)-$(PKG_RELEASE)'|" $(1)/etc/init.d/pbr
# $(INSTALL_DATA) ./files/etc/hotplug.d/iface/70-pbr $(1)/etc/hotplug.d/iface/70-pbr
define Package/pbr/install
-$(call Package/pbr-service/install,$(1))
+$(call Package/pbr/default/install,$(1))
$(INSTALL_DIR) $(1)/etc/config
$(INSTALL_CONF) ./files/etc/config/pbr $(1)/etc/config/pbr
$(INSTALL_DIR) $(1)/usr/share/pbr
$(INSTALL_DATA) ./files/usr/share/pbr/firewall.include $(1)/usr/share/pbr/firewall.include
$(INSTALL_DIR) $(1)/usr/share/nftables.d
$(CP) ./files/usr/share/nftables.d/* $(1)/usr/share/nftables.d/
+ $(INSTALL_DIR) $(1)/etc/uci-defaults
+ $(INSTALL_BIN) ./files/etc/uci-defaults/91-pbr-nft $(1)/etc/uci-defaults/91-pbr-nft
endef
define Package/pbr-iptables/install
-$(call Package/pbr-service/install,$(1))
+$(call Package/pbr/default/install,$(1))
$(INSTALL_DIR) $(1)/etc/hotplug.d/firewall
$(INSTALL_DATA) ./files/etc/hotplug.d/firewall/70-pbr $(1)/etc/hotplug.d/firewall/70-pbr
$(INSTALL_DIR) $(1)/etc/config
$(INSTALL_CONF) ./files/etc/config/pbr.iptables $(1)/etc/config/pbr
+ $(INSTALL_DIR) $(1)/etc/uci-defaults
+ $(INSTALL_BIN) ./files/etc/uci-defaults/91-pbr-iptables $(1)/etc/uci-defaults/91-pbr-iptables
endef
define Package/pbr-netifd/install
-$(call Package/pbr-service/install,$(1))
+$(call Package/pbr/default/install,$(1))
$(INSTALL_DIR) $(1)/etc/config
$(INSTALL_CONF) ./files/etc/config/pbr $(1)/etc/config/pbr
$(INSTALL_DIR) $(1)/etc/uci-defaults
- $(INSTALL_BIN) ./files/etc/uci-defaults/91-pbr $(1)/etc/uci-defaults/91-pbr
+ $(INSTALL_BIN) ./files/etc/uci-defaults/91-pbr-netifd $(1)/etc/uci-defaults/91-pbr-netifd
endef
define Package/pbr/postinst
# check if we are on real system
if [ -z "$${IPKG_INSTROOT}" ]; then
uci -q delete firewall.pbr || true
- echo "Stopping pbr service... "
- /etc/init.d/pbr stop quiet && echo "OK" || echo "FAIL"
+ echo -n "Stopping pbr service... "
+ /etc/init.d/pbr stop quiet >/dev/null 2>&1 && echo "OK" || echo "FAIL"
echo -n "Removing rc.d symlink for pbr... "
/etc/init.d/pbr disable && echo "OK" || echo "FAIL"
fi
# check if we are on real system
if [ -z "$${IPKG_INSTROOT}" ]; then
uci -q delete firewall.pbr || true
- echo "Stopping pbr-iptables service... "
- /etc/init.d/pbr stop quiet && echo "OK" || echo "FAIL"
+ echo -n "Stopping pbr-iptables service... "
+ /etc/init.d/pbr stop quiet >/dev/null 2>&1 && echo "OK" || echo "FAIL"
echo -n "Removing rc.d symlink for pbr-iptables... "
/etc/init.d/pbr disable && echo "OK" || echo "FAIL"
fi
# check if we are on real system
if [ -z "$${IPKG_INSTROOT}" ]; then
uci -q delete firewall.pbr || true
- echo "Stopping pbr-netifd service... "
- /etc/init.d/pbr stop quiet && echo "OK" || echo "FAIL"
+ echo -n "Stopping pbr-netifd service... "
+ /etc/init.d/pbr stop quiet >/dev/null 2>&1 && echo "OK" || echo "FAIL"
echo -n "Removing rc.d symlink for pbr... "
/etc/init.d/pbr disable && echo "OK" || echo "FAIL"
+ echo -n "Cleaning up /etc/iproute2/rt_tables... "
+ if sed -i '/pbr_/d' /etc/iproute2/rt_tables; then
+ echo "OK"
+ else
+ echo "FAIL"
+ fi
+ echo -n "Cleaning up /etc/config/network... "
+ if sed -i '/ip.table.*pbr_/d' /etc/config/network; then
+ echo "OK"
+ else
+ echo "FAIL"
+ fi
+ echo -n "Restarting Network... "
+ if /etc/init.d/network restart >/dev/null 2>&1; then
+ echo "OK"
+ else
+ echo "FAIL"
+ fi
+
fi
exit 0
endef
readonly packageLockFile="/var/run/${packageName}.lock"
readonly dnsmasqFileDefault="/var/dnsmasq.d/${packageName}"
readonly _OK_='\033[0;32m\xe2\x9c\x93\033[0m'
-readonly _FAIL_='\033[0;31m\xe2\x9c\x97\033[0m'
readonly __OK__='\033[0;32m[\xe2\x9c\x93]\033[0m'
+readonly _OKB_='\033[1;34m\xe2\x9c\x93\033[0m'
+readonly __OKB__='\033[1;34m[\xe2\x9c\x93]\033[0m'
+readonly _FAIL_='\033[0;31m\xe2\x9c\x97\033[0m'
readonly __FAIL__='\033[0;31m[\xe2\x9c\x97]\033[0m'
readonly _ERROR_='\033[0;31mERROR\033[0m'
readonly _WARNING_='\033[0;33mWARNING\033[0m'
readonly ssConfigFile='/etc/shadowsocks'
readonly torConfigFile='/etc/tor/torrc'
readonly xrayIfacePrefix='xray_'
+readonly rtTablesFile='/etc/iproute2/rt_tables'
# package config options
procd_boot_timeout=
output_ok() { output 1 "$_OK_"; output 2 "$__OK__\\n"; }
output_okn() { output 1 "$_OK_\\n"; output 2 "$__OK__\\n"; }
+output_okb() { output 1 "$_OKB_"; output 2 "$__OKB__\\n"; }
+output_okbn() { output 1 "$_OKB_\\n"; output 2 "$__OKB__\\n"; }
output_fail() { output 1 "$_FAIL_"; output 2 "$__FAIL__\\n"; }
output_failn() { output 1 "$_FAIL_\\n"; output 2 "$__FAIL__\\n"; }
# shellcheck disable=SC2317
esac
eval "$1"='${iface}'
}
-pbr_get_gateway() {
+pbr_get_gateway4() {
local iface="$2" dev="$3" gw
network_get_gateway gw "$iface" true
if [ -z "$gw" ] || [ "$gw" = '0.0.0.0' ]; then
is_lan() { local d; network_get_device d "$1"; str_contains "$d" 'br-lan'; }
is_l2tp() { local p; network_get_protocol p "$1"; [ "${p:0:4}" = "l2tp" ]; }
is_mac_address() { expr "$1" : '[0-9a-fA-F][0-9a-fA-F]:[0-9a-fA-F][0-9a-fA-F]:[0-9a-fA-F][0-9a-fA-F]:[0-9a-fA-F][0-9a-fA-F]:[0-9a-fA-F][0-9a-fA-F]:[0-9a-fA-F][0-9a-fA-F]$' >/dev/null; }
-is_netifd_table() { local iface="$1"; [ "$(uci_get 'network' "$iface" 'ip4table')" = "${packageName}_${iface%6}" ]; }
+is_netifd_table() { grep -q "ip.table.*$1" /etc/config/network; }
+is_netifd_table_interface() { local iface="$1"; [ "$(uci_get 'network' "$iface" 'ip4table')" = "${packageName}_${iface%6}" ]; }
is_oc() { local p; network_get_protocol p "$1"; [ "${p:0:11}" = "openconnect" ]; }
is_ovpn() { local d; uci_get_device d "$1"; [ "${d:0:3}" = "tun" ] || [ "${d:0:3}" = "tap" ] || [ -f "/sys/devices/virtual/net/${d}/tun_flags" ]; }
is_ovpn_valid() { local dev_net dev_ovpn; uci_get_device dev_net "$1"; dev_ovpn="$(uci_get 'openvpn' "$1" 'dev')"; [ -n "$dev_net" ] && [ -n "$dev_ovpn" ] && [ "$dev_net" = "$dev_ovpn" ]; }
# shellcheck disable=SC2155
get_tor_traffic_port() { local i="$(grep -m1 TransPort "$torConfigFile" | awk -F: '{print $2}')"; echo "${i:-9040}"; }
get_xray_traffic_port() { local i="${1//$xrayIfacePrefix}"; [ "$i" = "$1" ] && unset i; echo "$i"; }
-get_rt_tables_id() { local iface="$1"; grep "${ipTablePrefix}_${iface}\$" '/etc/iproute2/rt_tables' | awk '{print $1;}'; }
-get_rt_tables_next_id() { echo "$(($(sort -r -n '/etc/iproute2/rt_tables' | grep -o -E -m 1 "^[0-9]+")+1))"; }
-get_rt_tables_non_pbr_next_id() { echo "$(($(grep -v "${ipTablePrefix}_" '/etc/iproute2/rt_tables' | sort -r -n | grep -o -E -m 1 "^[0-9]+")+1))"; }
+get_rt_tables_id() { local iface="$1"; grep "${ipTablePrefix}_${iface}\$" "$rtTablesFile" | awk '{print $1;}'; }
+get_rt_tables_next_id() { echo "$(($(sort -r -n "$rtTablesFile" | grep -o -E -m 1 "^[0-9]+")+1))"; }
+get_rt_tables_non_pbr_next_id() { echo "$(($(grep -v "${ipTablePrefix}_" "$rtTablesFile" | sort -r -n | grep -o -E -m 1 "^[0-9]+")+1))"; }
# shellcheck disable=SC2016
resolveip_to_ipt() { resolveip "$@" | sed -n 'H;${x;s/\n/,/g;s/^,//;p;};d'; }
resolveip_to_ipt4() { resolveip_to_ipt -4 "$@"; }
errorResolverNotSupported) r="Resolver set (${resolver_set}) is not supported on this system!";;
errorServiceDisabled) r="The ${packageName} service is currently disabled!";;
errorNoWanGateway) r="The ${serviceName} service failed to discover WAN gateway!";;
+ errorNoWanInterface) r="The %s inteface not found, you need to set the 'pbr.config.procd_wan_interface' option!";;
+ errorNoWanInterfaceHint) r="Refer to https://docs.openwrt.melmac.net/pbr/#procd_wan_interface.";;
errorIpsetNameTooLong) r="The ipset name '%s' is longer than allowed 31 characters!";;
errorNftsetNameTooLong) r="The nft set name '%s' is longer than allowed 255 characters!";;
errorUnexpectedExit) r="Unexpected exit or service termination: '%s'!";;
errorPolicyProcessInsertionFailedIpv4) r="Insertion failed for IPv4 for policy '%s'!";;
errorInterfaceRoutingEmptyValues) r="Received empty tid/mark or interface name when setting up routing!";;
errorFailedToResolve) r="Failed to resolve '%s'!";;
+ errorTryFailed) r="Command failed: %s";;
errorNftFileInstall) r="Failed to install fw4 nft file '%s'!";;
errorDownloadUrlNoHttps) r="Failed to download '%s', HTTPS is not supported!";;
errorDownloadUrl) r="Failed to download '%s'!";;
_build_ifaces_supported() { is_supported_interface "$1" && ! str_contains "$ifacesSupported" "$1" && ifacesSupported="${ifacesSupported}${1} "; }
_find_firewall_wan_zone() { [ "$(uci_get 'firewall' "$1" 'name')" = "wan" ] && firewallWanZone="$1"; }
local i param="$1"
+ local dev4 dev6
if [ -z "$ifacesSupported" ]; then
config_load 'firewall'
config_foreach _find_firewall_wan_zone 'zone'
config_foreach _build_ifaces_supported 'interface'
fi
wanIface4="$procd_wan_interface"
- [ -z "$wanGW4" ] && network_get_gateway wanGW4 "$wanIface4"
+ network_get_device dev4 "$wanIface4"
+ [ -z "$dev4" ] && network_get_physdev dev4 "$wanIface4"
+ [ -z "$wanGW4" ] && pbr_get_gateway4 wanGW4 "$wanIface4" "$dev4"
if [ -n "$ipv6_enabled" ]; then
wanIface6="$procd_wan6_interface"
- [ -z "$wanGW6" ] && network_get_gateway6 wanGW6 "$wanIface6"
+ network_get_device dev6 "$wanIface6"
+ [ -z "$dev6" ] && network_get_physdev dev6 "$wanIface6"
+ [ -z "$wanGW6" ] && pbr_get_gateway6 wanGW6 "$wanIface6" "$dev6"
fi
+
case "$param" in
on_boot|on_start)
[ -n "$wanIface4" ] && output 2 "Using wan interface (${param}): $wanIface4 \\n"
load_network "$param"
[ "$procd_wan_ignore_status" -eq '0' ] || return 0
[ "$param" = 'on_boot' ] || procd_boot_timeout='1'
+ if [ -z "$(uci_get network "$procd_wan_interface")" ]; then
+ state add 'errorSummary' 'errorNoWanInterface' "$procd_wan_interface"
+ state add 'errorSummary' 'errorNoWanInterfaceHint'
+ return 1
+ fi
while [ -z "$wanGW" ] ; do
load_network "$param"
if [ $((sleepCount)) -gt $((procd_boot_timeout)) ] || [ -n "$wanGW" ]; then break; fi
fi
}
-cleanup_rt_tables() { sed -i "/${ipTablePrefix}_/d" '/etc/iproute2/rt_tables'; sync; }
+cleanup_rt_tables() {
+ local i
+# shellcheck disable=SC2013
+ for i in $(grep -oh "${ipTablePrefix}_.*" $rtTablesFile); do
+ ! is_netifd_table "$i" && sed -i "/${i}/d" "$rtTablesFile"
+ done
+ sync
+}
cleanup_main_chains() {
local i
fi
}
+try() {
+ if ! "$@"; then
+ state add 'errorSummary' 'errorTryFailed' "$*"
+ return 1
+ fi
+}
+
interface_routing() {
local action="$1" tid="$2" mark="$3" iface="$4" gw4="$5" dev="$6" gw6="$7" dev6="$8" priority="$9"
local dscp s=0 i ipv4_error=1 ipv6_error=1
fi
case "$action" in
create)
- if is_netifd_table "$iface"; then
+ if is_netifd_table_interface "$iface"; then
ipv4_error=0
- $ip_bin rule del table "$tid" >/dev/null 2>&1
- $ip_bin -4 rule add fwmark "${mark}/${fw_mask}" table "$tid" priority "$priority" || ipv4_error=1
+ $ip_bin -4 rule del table "$tid" >/dev/null 2>&1
+ try "$ip_bin" -4 rule add fwmark "${mark}/${fw_mask}" table "$tid" priority "$priority" || ipv4_error=1
if is_nft_mode; then
- nft add chain inet "$nftTable" "${nftPrefix}_mark_${mark}" || ipv4_error=1
- nft add rule inet "$nftTable" "${nftPrefix}_mark_${mark} counter mark set mark and ${fw_maskXor} xor ${mark}" || ipv4_error=1
- nft add rule inet "$nftTable" "${nftPrefix}_mark_${mark} return" || ipv4_error=1
+ try nft add chain inet "$nftTable" "${nftPrefix}_mark_${mark}" || ipv4_error=1
+ try nft add rule inet "$nftTable" "${nftPrefix}_mark_${mark} counter mark set mark and ${fw_maskXor} xor ${mark}" || ipv4_error=1
+ try nft add rule inet "$nftTable" "${nftPrefix}_mark_${mark} return" || ipv4_error=1
else
ipt -t mangle -N "${iptPrefix}_MARK_${mark}" || ipv4_error=1
ipt -t mangle -A "${iptPrefix}_MARK_${mark}" -j MARK --set-xmark "${mark}/${fw_mask}" || ipv4_error=1
fi
if [ -n "$ipv6_enabled" ]; then
ipv6_error=0
- $ip_bin -6 rule add fwmark "${mark}/${fw_mask}" table "$tid" priority "$priority" || ipv6_error=1
+ $ip_bin -6 rule del table "$tid" >/dev/null 2>&1
+ try "$ip_bin" -6 rule add fwmark "${mark}/${fw_mask}" table "$tid" priority "$((priority-1))" || ipv6_error=1
fi
else
- if ! grep -q "$tid ${ipTablePrefix}_${iface}" '/etc/iproute2/rt_tables'; then
- sed -i "/${ipTablePrefix}_${iface}/d" '/etc/iproute2/rt_tables'
+ if ! grep -q "$tid ${ipTablePrefix}_${iface}" "$rtTablesFile"; then
+ sed -i "/${ipTablePrefix}_${iface}/d" "$rtTablesFile"
sync
- echo "$tid ${ipTablePrefix}_${iface}" >> '/etc/iproute2/rt_tables'
+ echo "$tid ${ipTablePrefix}_${iface}" >> "$rtTablesFile"
sync
fi
- $ip_bin rule del table "$tid" >/dev/null 2>&1
- $ip_bin route flush table "$tid" >/dev/null 2>&1
+ $ip_bin -4 rule del table "$tid" >/dev/null 2>&1
+ $ip_bin -4 route flush table "$tid" >/dev/null 2>&1
if [ -n "$gw4" ] || [ "$strict_enforcement" -ne 0 ]; then
ipv4_error=0
if [ -z "$gw4" ]; then
- $ip_bin -4 route add unreachable default table "$tid" >/dev/null 2>&1 || ipv4_error=1
+ try "$ip_bin" -4 route add unreachable default table "$tid" >/dev/null 2>&1 || ipv4_error=1
else
- $ip_bin -4 route add default via "$gw4" dev "$dev" table "$tid" >/dev/null 2>&1 || ipv4_error=1
+ try "$ip_bin" -4 route add default via "$gw4" dev "$dev" table "$tid" >/dev/null 2>&1 || ipv4_error=1
fi
# shellcheck disable=SC2086
while read -r i; do
i="$(echo "$i" | sed 's/ onlink$//')"
idev="$(echo "$i" | grep -Eso 'dev [^ ]*' | awk '{print $2}')"
if ! is_supported_iface_dev "$idev"; then
- $ip_bin -4 route add $i table "$tid" >/dev/null 2>&1 || ipv4_error=1
+ try "$ip_bin" -4 route add $i table "$tid" >/dev/null 2>&1 || ipv4_error=1
fi
done << EOF
$($ip_bin -4 route list table main)
EOF
- $ip_bin -4 rule add fwmark "${mark}/${fw_mask}" table "$tid" priority "$priority" || ipv4_error=1
+ try "$ip_bin" -4 rule add fwmark "${mark}/${fw_mask}" table "$tid" priority "$priority" || ipv4_error=1
if is_nft_mode; then
- nft add chain inet "$nftTable" "${nftPrefix}_mark_${mark}" || ipv4_error=1
- nft add rule inet "$nftTable" "${nftPrefix}_mark_${mark} counter mark set mark and ${fw_maskXor} xor ${mark}" || ipv4_error=1
- nft add rule inet "$nftTable" "${nftPrefix}_mark_${mark} return" || ipv4_error=1
+ try nft add chain inet "$nftTable" "${nftPrefix}_mark_${mark}" || ipv4_error=1
+ try nft add rule inet "$nftTable" "${nftPrefix}_mark_${mark} counter mark set mark and ${fw_maskXor} xor ${mark}" || ipv4_error=1
+ try nft add rule inet "$nftTable" "${nftPrefix}_mark_${mark} return" || ipv4_error=1
else
ipt -t mangle -N "${iptPrefix}_MARK_${mark}" || ipv4_error=1
ipt -t mangle -A "${iptPrefix}_MARK_${mark}" -j MARK --set-xmark "${mark}/${fw_mask}" || ipv4_error=1
fi
if [ -n "$ipv6_enabled" ]; then
ipv6_error=0
+ $ip_bin -6 rule del table "$tid" >/dev/null 2>&1
+ $ip_bin -6 route flush table "$tid" >/dev/null 2>&1
if { [ -n "$gw6" ] && [ "$gw6" != "::/0" ]; } || [ "$strict_enforcement" -ne 0 ]; then
if [ -z "$gw6" ] || [ "$gw6" = "::/0" ]; then
- $ip_bin -6 route add unreachable default table "$tid" >/dev/null 2>&1 || ipv6_error=1
- elif $ip_bin -6 route list table main | grep -q " dev $dev6 "; then
- $ip_bin -6 route add default via "$gw6" dev "$dev6" table "$tid" >/dev/null 2>&1 || ipv6_error=1
+ try "$ip_bin" -6 route add unreachable default table "$tid" >/dev/null 2>&1 || ipv6_error=1
+ elif "$ip_bin" -6 route list table main | grep -q " dev $dev6 "; then
+ "$ip_bin" -6 route add default via "$gw6" dev "$dev6" table "$tid" >/dev/null 2>&1 || ipv6_error=1
while read -r i; do
i="$(echo "$i" | sed 's/ linkdown$//')"
i="$(echo "$i" | sed 's/ onlink$//')"
# shellcheck disable=SC2086
- $ip_bin -6 route add $i table "$tid" >/dev/null 2>&1 || ipv6_error=1
+ try "$ip_bin" -6 route add $i table "$tid" >/dev/null 2>&1 || ipv6_error=1
done << EOF
$($ip_bin -6 route list table main | grep " dev $dev6 ")
EOF
else
- $ip_bin -6 route add "$($ip_bin -6 -o a show "$dev6" | awk '{print $4}')" dev "$dev6" table "$tid" >/dev/null 2>&1 || ipv6_error=1
- $ip_bin -6 route add default dev "$dev6" table "$tid" >/dev/null 2>&1 || ipv6_error=1
+ try "$ip_bin" -6 route add "$($ip_bin -6 -o a show "$dev6" | awk '{print $4}')" dev "$dev6" table "$tid" >/dev/null 2>&1 || ipv6_error=1
+ try "$ip_bin" -6 route add default dev "$dev6" table "$tid" >/dev/null 2>&1 || ipv6_error=1
fi
fi
- $ip_bin -6 rule add fwmark "${mark}/${fw_mask}" table "$tid" priority "$priority" >/dev/null 2>&1 || ipv6_error=1
+ try "$ip_bin" -6 rule add fwmark "${mark}/${fw_mask}" table "$tid" priority "$((priority-1))" >/dev/null 2>&1 || ipv6_error=1
fi
fi
if [ "$ipv4_error" -eq 0 ] || [ "$ipv6_error" -eq 0 ]; then
dscp="$(uci_get "$packageName" 'config' "${iface}_dscp")"
if is_nft_mode; then
if [ "${dscp:-0}" -ge 1 ] && [ "${dscp:-0}" -le 63 ]; then
- nft add rule inet "$nftTable" "${nftPrefix}_prerouting ${nftIPv4Flag} dscp ${dscp} goto ${nftPrefix}_mark_${mark}" || s=1
+ try nft add rule inet "$nftTable" "${nftPrefix}_prerouting ${nftIPv4Flag} dscp ${dscp} goto ${nftPrefix}_mark_${mark}" || s=1
if [ -n "$ipv6_enabled" ]; then
- nft add rule inet "$nftTable" "${nftPrefix}_prerouting ${nftIPv6Flag} dscp ${dscp} goto ${nftPrefix}_mark_${mark}" || s=1
+ try nft add rule inet "$nftTable" "${nftPrefix}_prerouting ${nftIPv6Flag} dscp ${dscp} goto ${nftPrefix}_mark_${mark}" || s=1
fi
fi
if [ "$iface" = "$icmp_interface" ]; then
- nft add rule inet "$nftTable" "${nftPrefix}_output ${nftIPv4Flag} protocol icmp goto ${nftPrefix}_mark_${mark}" || s=1
+ try nft add rule inet "$nftTable" "${nftPrefix}_output ${nftIPv4Flag} protocol icmp goto ${nftPrefix}_mark_${mark}" || s=1
if [ -n "$ipv6_enabled" ]; then
- nft add rule inet "$nftTable" "${nftPrefix}_output ${nftIPv6Flag} protocol icmp goto ${nftPrefix}_mark_${mark}" || s=1
+ try nft add rule inet "$nftTable" "${nftPrefix}_output ${nftIPv6Flag} protocol icmp goto ${nftPrefix}_mark_${mark}" || s=1
fi
fi
else
;;
delete|destroy)
$ip_bin rule del table "$tid" >/dev/null 2>&1
- if ! is_netifd_table "$iface"; then
+ if ! is_netifd_table_interface "$iface"; then
$ip_bin route flush table "$tid" >/dev/null 2>&1
- sed -i "/${ipTablePrefix}_${iface}\$/d" '/etc/iproute2/rt_tables'
+ sed -i "/${ipTablePrefix}_${iface}\$/d" "$rtTablesFile"
sync
fi
return "$s"
;;
reload_interface)
- is_netifd_table "$iface" && return 0;
+ is_netifd_table_interface "$iface" && return 0;
ipv4_error=0
$ip_bin rule del table "$tid" >/dev/null 2>&1
- if ! is_netifd_table "$iface"; then
+ if ! is_netifd_table_interface "$iface"; then
$ip_bin route flush table "$tid" >/dev/null 2>&1
fi
if [ -n "$gw4" ] || [ "$strict_enforcement" -ne 0 ]; then
if [ -z "$gw4" ]; then
- $ip_bin -4 route add unreachable default table "$tid" >/dev/null 2>&1 || ipv4_error=1
+ try "$ip_bin" -4 route add unreachable default table "$tid" >/dev/null 2>&1 || ipv4_error=1
else
- $ip_bin -4 route add default via "$gw4" dev "$dev" table "$tid" >/dev/null 2>&1 || ipv4_error=1
+ try "$ip_bin" -4 route add default via "$gw4" dev "$dev" table "$tid" >/dev/null 2>&1 || ipv4_error=1
fi
- $ip_bin rule add fwmark "${mark}/${fw_mask}" table "$tid" priority "$priority" || ipv4_error=1
+ try "$ip_bin" rule add fwmark "${mark}/${fw_mask}" table "$tid" priority "$priority" || ipv4_error=1
fi
if [ -n "$ipv6_enabled" ]; then
ipv6_error=0
if { [ -n "$gw6" ] && [ "$gw6" != "::/0" ]; } || [ "$strict_enforcement" -ne 0 ]; then
if [ -z "$gw6" ] || [ "$gw6" = "::/0" ]; then
- $ip_bin -6 route add unreachable default table "$tid" || ipv6_error=1
+ try "$ip_bin" -6 route add unreachable default table "$tid" || ipv6_error=1
elif $ip_bin -6 route list table main | grep -q " dev $dev6 "; then
while read -r i; do
# shellcheck disable=SC2086
- $ip_bin -6 route add $i table "$tid" >/dev/null 2>&1 || ipv6_error=1
+ try "$ip_bin" -6 route add $i table "$tid" >/dev/null 2>&1 || ipv6_error=1
done << EOF
$($ip_bin -6 route list table main | grep " dev $dev6 ")
EOF
else
- $ip_bin -6 route add "$($ip_bin -6 -o a show "$dev6" | awk '{print $4}')" dev "$dev6" table "$tid" >/dev/null 2>&1 || ipv6_error=1
- $ip_bin -6 route add default dev "$dev6" table "$tid" >/dev/null 2>&1 || ipv6_error=1
+ try "$ip_bin" -6 route add "$($ip_bin -6 -o a show "$dev6" | awk '{print $4}')" dev "$dev6" table "$tid" >/dev/null 2>&1 || ipv6_error=1
+ try "$ip_bin" -6 route add default dev "$dev6" table "$tid" >/dev/null 2>&1 || ipv6_error=1
fi
fi
- $ip_bin -6 rule add fwmark "${mark}/${fw_mask}" table "$tid" priority "$priority" || ipv6_error=1
+ try "$ip_bin" -6 rule add fwmark "${mark}/${fw_mask}" table "$tid" priority "$priority" || ipv6_error=1
fi
if [ "$ipv4_error" -eq 0 ] || [ "$ipv6_error" -eq 0 ]; then
s=0
[ -z "$ifaceMark" ] && ifaceMark="$(printf '0x%06x' "$wan_mark")"
[ -z "$ifacePriority" ] && ifacePriority="$wan_ip_rules_priority"
- if [ "$action" = 'pre-init' ]; then
- pbr_get_gateway6 gw6 "$iface" "$dev6"
- [ -n "$gw6" ] && ipv6_enabled=1
- [ -z "$ifaceTableID" ] && ifaceTableID="$(get_rt_tables_non_pbr_next_id)"
- eval "pre_init_mark_${iface//-/_}"='$ifaceMark'
- eval "pre_init_priority_${iface//-/_}"='$ifacePriority'
- eval "pre_init_tid_${iface//-/_}"='$ifaceTableID'
- ifaceMark="$(printf '0x%06x' $((ifaceMark + wan_mark)))"
- ifacePriority="$((ifacePriority + 1))"
- ifaceTableID="$((ifaceTableID + 1))"
- return 0
- fi
-
-# TODO: if interfaces are started out of order the rt_tables ID may be incorrect
-# use the expected_tid_${iface} ???
- ifaceTableID="$(get_rt_tables_id "$iface")"
- [ -z "$ifaceTableID" ] && ifaceTableID="$(get_rt_tables_next_id)"
- eval "mark_${iface//-/_}"='$ifaceMark'
- eval "tid_${iface//-/_}"='$ifaceTableID'
- pbr_get_gateway gw4 "$iface" "$dev"
- pbr_get_gateway6 gw6 "$iface" "$dev6"
- dispGw4="${gw4:-0.0.0.0}"
- dispGw6="${gw6:-::/0}"
- [ "$iface" != "$dev" ] && dispDev="$dev"
- if is_default_dev "$dev"; then
- [ "$verbosity" = '1' ] && dispStatus="$_OK_" || dispStatus="$__OK__"
- fi
- displayText="${iface}/${dispDev:+$dispDev/}${dispGw4}${ipv6_enabled:+/$dispGw6}"
-
case "$action" in
+ pre_init)
+ [ -z "$ifaceTableID" ] && ifaceTableID="$(get_rt_tables_non_pbr_next_id)"
+ eval "pre_init_mark_${iface//-/_}"='$ifaceMark'
+ eval "pre_init_priority_${iface//-/_}"='$ifacePriority'
+ eval "pre_init_tid_${iface//-/_}"='$ifaceTableID'
+ ifaceMark="$(printf '0x%06x' $((ifaceMark + wan_mark)))"
+ ifacePriority="$((ifacePriority - 1))"
+ ifaceTableID="$((ifaceTableID + 1))"
+ return 0
+ ;;
create)
+ ifaceTableID="$(get_rt_tables_id "$iface")"
+ [ -z "$ifaceTableID" ] && ifaceTableID="$(get_rt_tables_next_id)"
+ eval "mark_${iface//-/_}"='$ifaceMark'
+ eval "tid_${iface//-/_}"='$ifaceTableID'
+ pbr_get_gateway4 gw4 "$iface" "$dev"
+ pbr_get_gateway6 gw6 "$iface" "$dev6"
+ dispGw4="${gw4:-0.0.0.0}"
+ dispGw6="${gw6:-::/0}"
+ [ "$iface" != "$dev" ] && dispDev="$dev"
+ if is_default_dev "$dev"; then
+ [ "$verbosity" = '1' ] && dispStatus="$_OK_" || dispStatus="$__OK__"
+ fi
+ displayText="${iface}/${dispDev:+$dispDev/}${dispGw4}${ipv6_enabled:+/$dispGw6}"
output 2 "Setting up routing for '$displayText' "
if interface_routing 'create' "$ifaceTableID" "$ifaceMark" "$iface" "$gw4" "$dev" "$gw6" "$dev6" "$ifacePriority"; then
json_add_gateway 'create' "$ifaceTableID" "$ifaceMark" "$iface" "$gw4" "$dev" "$gw6" "$dev6" "$ifacePriority" "$dispStatus"
gatewaySummary="${gatewaySummary}${displayText}${dispStatus:+ $dispStatus}\\n"
- output_ok
+ if is_netifd_table_interface "$iface"; then output_okb; else output_ok; fi
else
state add 'errorSummary' 'errorFailedSetup' "$displayText"
output_fail
fi
;;
create_user_set)
+ ifaceTableID="$(get_rt_tables_id "$iface")"
+ [ -z "$ifaceTableID" ] && ifaceTableID="$(get_rt_tables_next_id)"
+ eval "mark_${iface//-/_}"='$ifaceMark'
+ eval "tid_${iface//-/_}"='$ifaceTableID'
+ pbr_get_gateway4 gw4 "$iface" "$dev"
+ pbr_get_gateway6 gw6 "$iface" "$dev6"
+ dispGw4="${gw4:-0.0.0.0}"
+ dispGw6="${gw6:-::/0}"
+ [ "$iface" != "$dev" ] && dispDev="$dev"
+ if is_default_dev "$dev"; then
+ [ "$verbosity" = '1' ] && dispStatus="$_OK_" || dispStatus="$__OK__"
+ fi
+ displayText="${iface}/${dispDev:+$dispDev/}${dispGw4}${ipv6_enabled:+/$dispGw6}"
interface_routing 'create_user_set' "$ifaceTableID" "$ifaceMark" "$iface" "$gw4" "$dev" "$gw6" "$dev6" "$ifacePriority"
;;
destroy)
+ ifaceTableID="$(get_rt_tables_id "$iface")"
+ [ -z "$ifaceTableID" ] && ifaceTableID="$(get_rt_tables_next_id)"
+ eval "mark_${iface//-/_}"='$ifaceMark'
+ eval "tid_${iface//-/_}"='$ifaceTableID'
+ pbr_get_gateway4 gw4 "$iface" "$dev"
+ pbr_get_gateway6 gw6 "$iface" "$dev6"
+ dispGw4="${gw4:-0.0.0.0}"
+ dispGw6="${gw6:-::/0}"
+ [ "$iface" != "$dev" ] && dispDev="$dev"
+ if is_default_dev "$dev"; then
+ [ "$verbosity" = '1' ] && dispStatus="$_OK_" || dispStatus="$__OK__"
+ fi
+ displayText="${iface}/${dispDev:+$dispDev/}${dispGw4}${ipv6_enabled:+/$dispGw6}"
displayText="${iface}/${dispDev:+$dispDev/}${dispGw4}${ipv6_enabled:+/$dispGw6}"
output 2 "Removing routing for '$displayText' "
interface_routing 'destroy' "${ifaceTableID}" "${ifaceMark}" "${iface}"
- output_ok
+ if is_netifd_table_interface "$iface"; then output_okb; else output_ok; fi
;;
reload)
+ ifaceTableID="$(get_rt_tables_id "$iface")"
+ [ -z "$ifaceTableID" ] && ifaceTableID="$(get_rt_tables_next_id)"
+ eval "mark_${iface//-/_}"='$ifaceMark'
+ eval "tid_${iface//-/_}"='$ifaceTableID'
+ pbr_get_gateway4 gw4 "$iface" "$dev"
+ pbr_get_gateway6 gw6 "$iface" "$dev6"
+ dispGw4="${gw4:-0.0.0.0}"
+ dispGw6="${gw6:-::/0}"
+ [ "$iface" != "$dev" ] && dispDev="$dev"
+ if is_default_dev "$dev"; then
+ [ "$verbosity" = '1' ] && dispStatus="$_OK_" || dispStatus="$__OK__"
+ fi
+ displayText="${iface}/${dispDev:+$dispDev/}${dispGw4}${ipv6_enabled:+/$dispGw6}"
gatewaySummary="${gatewaySummary}${displayText}${dispStatus:+ $dispStatus}\\n"
;;
reload_interface)
+ ifaceTableID="$(get_rt_tables_id "$iface")"
+ [ -z "$ifaceTableID" ] && ifaceTableID="$(get_rt_tables_next_id)"
+ eval "mark_${iface//-/_}"='$ifaceMark'
+ eval "tid_${iface//-/_}"='$ifaceTableID'
+ pbr_get_gateway4 gw4 "$iface" "$dev"
+ pbr_get_gateway6 gw6 "$iface" "$dev6"
+ dispGw4="${gw4:-0.0.0.0}"
+ dispGw6="${gw6:-::/0}"
+ [ "$iface" != "$dev" ] && dispDev="$dev"
+ if is_default_dev "$dev"; then
+ [ "$verbosity" = '1' ] && dispStatus="$_OK_" || dispStatus="$__OK__"
+ fi
+ displayText="${iface}/${dispDev:+$dispDev/}${dispGw4}${ipv6_enabled:+/$dispGw6}"
if [ "$iface" = "$reloadedIface" ]; then
output 2 "Reloading routing for '$displayText' "
if interface_routing 'reload_interface' "$ifaceTableID" "$ifaceMark" "$iface" "$gw4" "$dev" "$gw6" "$dev6" "$ifacePriority"; then
json_add_gateway 'reload_interface' "$ifaceTableID" "$ifaceMark" "$iface" "$gw4" "$dev" "$gw6" "$dev6" "$ifacePriority" "$dispStatus"
gatewaySummary="${gatewaySummary}${displayText}${dispStatus:+ $dispStatus}\\n"
- output_ok
+ if is_netifd_table_interface "$iface"; then output_okb; else output_ok; fi
else
state add 'errorSummary' 'errorFailedReload' "$displayText"
output_fail
esac
# ifaceTableID="$((ifaceTableID + 1))"
ifaceMark="$(printf '0x%06x' $((ifaceMark + wan_mark)))"
- ifacePriority="$((ifacePriority + 1))"
+ ifacePriority="$((ifacePriority - 2))"
return $s
}
is_wan_up "$param" || return 1
interface_process 'all' 'prepare'
- config_foreach interface_process 'interface' 'pre-init'
+ config_foreach interface_process 'interface' 'pre_init'
case "$param" in
on_boot)
# echo "$_SEPARATOR_"
# ip rule list | grep "${packageName}_"
echo "$_SEPARATOR_"
- tableCount="$(grep -c "${packageName}_" /etc/iproute2/rt_tables)" || tableCount=0
+ tableCount="$(grep -c "${packageName}_" $rtTablesFile)" || tableCount=0
wan_tid=$(($(get_rt_tables_next_id)-tableCount))
i=0; while [ $i -lt "$tableCount" ]; do
echo "IPv4 table $((wan_tid + i)) route: $($ip_bin -4 route show table $((wan_tid + i)) | grep default)"
echo "$_SEPARATOR_"
echo "Routes/IP Rules"
- tableCount="$(grep -c "${packageName}_" /etc/iproute2/rt_tables)" || tableCount=0
+ tableCount="$(grep -c "${packageName}_" $rtTablesFile)" || tableCount=0
if [ -n "$set_d" ]; then route; else route | grep '^default'; fi
if [ -n "$set_d" ]; then ip rule list; fi
wan_tid=$(($(get_rt_tables_next_id)-tableCount))
+++ /dev/null
-#!/bin/sh /etc/rc.common
-# Copyright 2020-2022 Stan Grishin (stangri@melmac.ca)
-# shellcheck disable=SC1091,SC2018,SC2019,SC3043,SC3057,SC3060
-
-# sysctl net.ipv4.conf.default.rp_filter=1
-# sysctl net.ipv4.conf.all.rp_filter=1
-
-# shellcheck disable=SC2034
-START=94
-# shellcheck disable=SC2034
-USE_PROCD=1
-
-if type extra_command >/dev/null 2>&1; then
- extra_command 'status' "Generates output required to troubleshoot routing issues
- Use '-d' option for more detailed output
- Use '-p' option to automatically upload data under VPR paste.ee account
- WARNING: while paste.ee uploads are unlisted, they are still publicly available
- List domain names after options to include their lookup in report"
- extra_command 'version' 'Show version information'
- extra_command 'on_firewall_reload' ' Run service on firewall reload'
- extra_command 'on_interface_reload' ' Run service on indicated interface reload'
-else
-# shellcheck disable=SC2034
- EXTRA_COMMANDS='on_firewall_reload on_interface_reload status version'
-# shellcheck disable=SC2034
- EXTRA_HELP=" status Generates output required to troubleshoot routing issues
- Use '-d' option for more detailed output
- Use '-p' option to automatically upload data under VPR paste.ee account
- WARNING: while paste.ee uploads are unlisted, they are still publicly available
- List domain names after options to include their lookup in report"
-fi
-
-readonly PKG_VERSION='dev-test'
-readonly packageName='pbr'
-readonly serviceName="$packageName $PKG_VERSION"
-readonly serviceTrapSignals='exit SIGHUP SIGQUIT SIGKILL'
-readonly packageConfigFile="/etc/config/${packageName}"
-readonly packageLockFile="/var/run/${packageName}.lock"
-readonly nftTempFile="/var/run/${packageName}.nft"
-#readonly nftPermFile="/etc/nftables.d/table-post/30-pbr.nft"
-readonly dnsmasqFile="/var/dnsmasq.d/${packageName}"
-readonly _OK_='\033[0;32m\xe2\x9c\x93\033[0m'
-readonly _FAIL_='\033[0;31m\xe2\x9c\x97\033[0m'
-readonly __OK__='\033[0;32m[\xe2\x9c\x93]\033[0m'
-readonly __FAIL__='\033[0;31m[\xe2\x9c\x97]\033[0m'
-readonly _ERROR_='\033[0;31mERROR\033[0m'
-readonly _WARNING_='\033[0;33mWARNING\033[0m'
-readonly ip_full='/usr/libexec/ip-full'
-# shellcheck disable=SC2155
-readonly ip_bin="$(command -v ip)"
-readonly ipTablePrefix='pbr'
-# shellcheck disable=SC2155
-readonly iptables="$(command -v iptables)"
-# shellcheck disable=SC2155
-readonly ip6tables="$(command -v ip6tables)"
-# shellcheck disable=SC2155
-readonly ipset="$(command -v ipset)"
-readonly ipsPrefix='pbr'
-readonly iptPrefix='PBR'
-# shellcheck disable=SC2155
-readonly agh="$(command -v AdGuardHome)"
-readonly aghConfigFile='/etc/adguardhome.yaml'
-readonly aghIpsetFile="/var/run/${packageName}.adguardhome.ipsets"
-# shellcheck disable=SC2155
-readonly nft="$(command -v nft)"
-readonly nftTable="fw4"
-readonly nftPrefix='pbr'
-readonly chainsList='forward input output postrouting prerouting'
-
-# package config options
-boot_timeout=
-enabled=
-fw_mask=
-icmp_interface=
-ignored_interface=
-ipv6_enabled=
-nft_user_set_policy=
-nft_user_set_counter=
-procd_boot_delay=
-procd_reload_delay=
-resolver_set=
-rule_create_option=
-secure_reload=
-strict_enforcement=
-supported_interface=
-verbosity=
-wan_ip_rules_priority=
-wan_mark=
-
-# run-time
-gatewaySummary=
-errorSummary=
-warningSummary=
-wanIface4=
-wanIface6=
-ifaceMark=
-ifaceTableID=
-ifacePriority=
-ifacesAll=
-ifacesSupported=
-firewallWanZone=
-wanGW4=
-wanGW6=
-serviceStartTrigger=
-processPolicyError=
-processPolicyWarning=
-resolver_set_supported=
-nftPrevParam4=
-nftPrevParam6=
-
-get_text() {
- local r
- case "$1" in
- errorConfigValidation) r="Config ($packageConfigFile) validation failure!";;
- errorNoIpFull) r="ip-full binary cannot be found!";;
- errorNoIptables) r="iptables binary cannot be found!";;
- errorNoIpset) r="Resolver set support (${resolver_set}) requires ipset, but ipset binary cannot be found!";;
- errorNoNft) r="Resolver set support (${resolver_set}) requires nftables, but nft binary cannot be found!";;
- errorResolverNotSupported) r="Resolver set (${resolver_set}) is not supported on this system!";;
- errorServiceDisabled) r="The ${packageName} service is currently disabled!";;
- errorNoWanGateway) r="The ${serviceName} service failed to discover WAN gateway!";;
- errorIpsetNameTooLong) r="The ipset name '%s' is longer than allowed 31 characters!";;
- errorNftsetNameTooLong) r="The nft set name '%s' is longer than allowed 31 characters!";;
- errorUnexpectedExit) r="Unexpected exit or service termination: '%s'!";;
- errorPolicyNoSrcDest) r="Policy '%s' has no source/destination parameters!";;
- errorPolicyNoInterface) r="Policy '%s' has no assigned interface!";;
- errorPolicyUnknownInterface) r="Policy '%s' has an unknown interface!";;
- errorPolicyProcessCMD) r="'%s'!";;
- errorFailedSetup) r="Failed to set up '%s'!";;
- errorFailedReload) r="Failed to reload '%s'!";;
- errorUserFileNotFound) r="Custom user file '%s' not found or empty!";;
- errorUserFileSyntax) r="Syntax error in custom user file '%s'!";;
- errorUserFileRunning) r="Error running custom user file '%s'!";;
- errorUserFileNoCurl) r="Use of 'curl' is detected in custom user file '%s', but 'curl' isn't installed!";;
- errorNoGateways) r="Failed to set up any gateway!";;
- errorResolver) r="Resolver '%s'!";;
- errorPolicyProcessNoIpv6) r="Skipping IPv6 policy '%s' as IPv6 support is disabled!";;
- errorPolicyProcessUnknownFwmark) r="Unknown packet mark for interface '%s'!";;
- errorPolicyProcessMismatchFamily) r="Mismatched IP family between in policy '%s'!";;
- errorPolicyProcessUnknownProtocol) r="Unknown protocol in policy '%s'!";;
- errorPolicyProcessInsertionFailed) r="Insertion failed for both IPv4 and IPv6 for policy '%s'!";;
- errorPolicyProcessInsertionFailedIpv4) r="Insertion failed for IPv4 for policy '%s'!";;
- errorInterfaceRoutingEmptyValues) r="Received empty tid/mark or interface name when setting up routing!";;
- errorFailedToResolve) r="Failed to resolve '%s'!";;
- warningInvalidOVPNConfig) r="Invalid OpenVPN config for '%s' interface.";;
- warningResolverNotSupported) r="Resolver set (${resolver_set}) is not supported on this system.";;
- warningAGHVersionTooLow) r="Installed AdGuardHome ('%s') doesn't support 'ipset_file' option.";;
- warningPolicyProcessCMD) r="'%s'";;
- warningTorUnsetParams) r="Please unset 'src_addr', 'src_port' and 'dest_port' for policy '%s'.";;
- warningTorUnsetProto) r="Please unset 'proto' or set 'proto' to 'all' for policy '%s'.";;
- warningTorUnsetChainIpt) r="Please unset 'chain' or set 'chain' to 'PREROUTING' for policy '%s'.";;
- warningTorUnsetChainNft) r="Please unset 'chain' or set 'chain' to 'prerouting' for policy '%s'.";;
- warningOutdatedWebUIApp) r="The WebUI application is outdated (version %s), please update it.";;
- esac
- echo "$r"
-}
-
-version() { echo "$PKG_VERSION"; }
-output_ok() { output 1 "$_OK_"; output 2 "$__OK__\\n"; }
-output_okn() { output 1 "$_OK_\\n"; output 2 "$__OK__\\n"; }
-output_fail() { s=1; output 1 "$_FAIL_"; output 2 "$__FAIL__\\n"; }
-output_failn() { output 1 "$_FAIL_\\n"; output 2 "$__FAIL__\\n"; }
-# shellcheck disable=SC2317
-str_replace() { printf "%b" "$1" | sed -e "s/$(printf "%b" "$2")/$(printf "%b" "$3")/g"; }
-str_replace() { echo "${1//$2/$3}"; }
-str_contains() { [ -n "$1" ] && [ -n "$2" ] && [ "${1//$2}" != "$1" ]; }
-is_greater() { test "$(printf '%s\n' "$@" | sort -V | head -n 1)" != "$1"; }
-is_greater_or_equal() { test "$(printf '%s\n' "$@" | sort -V | head -n 1)" = "$2"; }
-str_contains_word() { echo "$1" | grep -q -w "$2"; }
-str_to_lower() { echo "$1" | tr 'A-Z' 'a-z'; }
-str_to_upper() { echo "$1" | tr 'a-z' 'A-Z'; }
-str_extras_to_underscore() { echo "$1" | tr '[\. ~`!@#$%^&*()\+/,<>?//;:]' '_'; }
-str_extras_to_space() { echo "$1" | tr ';{}' ' '; }
-debug() { local i j; for i in "$@"; do eval "j=\$$i"; echo "${i}: ${j} "; done; }
-output() {
-# Can take a single parameter (text) to be output at any verbosity
-# Or target verbosity level and text to be output at specifc verbosity
- local msg memmsg logmsg
- local sharedMemoryOutput="/dev/shm/$packageName-output"
- verbosity="${verbosity:-2}"
- if [ "$#" -ne 1 ]; then
- if [ $((verbosity & $1)) -gt 0 ] || [ "$verbosity" = "$1" ]; then shift; else return 0; fi
- fi
- [ -t 1 ] && printf "%b" "$1"
- msg="${1//$serviceName /service }";
- if [ "$(printf "%b" "$msg" | wc -l)" -gt 0 ]; then
- [ -s "$sharedMemoryOutput" ] && memmsg="$(cat "$sharedMemoryOutput")"
- logmsg="$(printf "%b" "${memmsg}${msg}" | sed 's/\x1b\[[0-9;]*m//g')"
- logger -t "${packageName:-service}" "$(printf "%b" "$logmsg")"
- rm -f "$sharedMemoryOutput"
- else
- printf "%b" "$msg" >> "$sharedMemoryOutput"
- fi
-}
-is_present() { command -v "$1" >/dev/null 2>&1; }
-is_installed() { [ -s "/usr/lib/opkg/info/${1}.control" ]; }
-is_variant_installed() { [ "$(echo /usr/lib/opkg/info/"${1}"*.control)" != "/usr/lib/opkg/info/${1}*.control" ]; }
-is_nft() { [ -x "$nft" ] && ! str_contains "$resolver_set" 'ipset' && "$nft" list chains inet | grep -q "${nftPrefix}_prerouting"; }
-_find_firewall_wan_zone() { [ "$(uci -q get "firewall.${1}.name")" = "wan" ] && firewallWanZone="$1"; }
-_build_ifaces_all() { ifacesAll="${ifacesAll}${1} "; }
-_build_ifaces_supported() { is_supported_interface "$1" && ! str_contains "$ifacesSupported" "$1" && ifacesSupported="${ifacesSupported}${1} "; }
-pbr_find_iface() {
- local iface i param="$2"
- [ "$param" = 'wan6' ] || param='wan'
- "network_find_${param}" iface
- is_tunnel "$iface" && unset iface
- if [ -z "$iface" ]; then
- for i in $ifacesAll; do
- if "is_${param}" "$i"; then break; else unset i; fi
- done
- fi
- eval "$1"='${iface:-$i}'
-}
-pbr_get_gateway() {
- local iface="$2" dev="$3" gw
- network_get_gateway gw "$iface" true
- if [ -z "$gw" ] || [ "$gw" = '0.0.0.0' ]; then
-# gw="$(ubus call "network.interface.${iface}" status | jsonfilter -e "@.route[0].nexthop")"
- gw="$($ip_bin -4 a list dev "$dev" 2>/dev/null | grep inet | awk '{print $2}' | awk -F "/" '{print $1}')"
- fi
- eval "$1"='$gw'
-}
-pbr_get_gateway6() {
- local iface="$2" dev="$3" gw
- network_get_gateway6 gw "$iface" true
- if [ -z "$gw" ] || [ "$gw" = '::/0' ] || [ "$gw" = '::0/0' ] || [ "$gw" = '::' ]; then
- gw="$($ip_bin -6 a list dev "$dev" 2>/dev/null | grep inet6 | grep 'scope global' | awk '{print $2}')"
- fi
- eval "$1"='$gw'
-}
-is_dslite() { local proto; proto=$(uci -q get network."$1".proto); [ "${proto:0:6}" = "dslite" ]; }
-is_l2tp() { local proto; proto=$(uci -q get network."$1".proto); [ "${proto:0:4}" = "l2tp" ]; }
-is_oc() { local proto; proto=$(uci -q get network."$1".proto); [ "${proto:0:11}" = "openconnect" ]; }
-# is_ovpn() { local dev; network_get_device dev "$1"; [ "${dev:0:3}" = "tun" ] || [ "${dev:0:3}" = "tap" ] || [ -f "/sys/devices/virtual/net/${dev}/tun_flags" ]; }
-is_ovpn() { local dev; dev="$(uci -q get "network.${1}.device")"; [ -z "$dev" ] && dev="$(uci -q get "network.${1}.dev")"; [ "${dev:0:3}" = "tun" ] || [ "${dev:0:3}" = "tap" ] || [ -f "/sys/devices/virtual/net/${dev}/tun_flags" ]; }
-is_valid_ovpn() { local dev_net dev_ovpn; dev_net="$(uci -q get "network.${1}.device")"; [ -z "$dev_net" ] && dev_net="$(uci -q get "network.${1}.dev")"; dev_ovpn="$(uci -q get "openvpn.${1}.dev")"; [ -n "$dev_net" ] && [ -n "$dev_ovpn" ] && [ "$dev_net" = "$dev_ovpn" ]; }
-is_pptp() { local proto; proto=$(uci -q get network."$1".proto); [ "${proto:0:4}" = "pptp" ]; }
-is_softether() { local dev; network_get_device dev "$1"; [ "${dev:0:4}" = "vpn_" ]; }
-is_tor() { [ "$(str_to_lower "$1")" = "tor" ]; }
-is_tor_running() {
- local ret=0
- if [ -s "/etc/tor/torrc" ]; then
- json_load "$(ubus call service list "{ 'name': 'tor' }")"
- json_select 'tor'; json_select 'instances'; json_select 'instance1';
- json_get_var ret 'running'; json_cleanup
- fi
- if [ "$ret" = "0" ]; then return 1; else return 0; fi
-}
-is_wg() { local proto; proto=$(uci -q get network."$1".proto); [ "${proto:0:9}" = "wireguard" ]; }
-is_tunnel() { is_dslite "$1" || is_l2tp "$1" || is_oc "$1" || is_ovpn "$1" || is_pptp "$1" || is_softether "$1" || is_tor "$1" || is_wg "$1"; }
-is_wan() { [ "$1" = "$wanIface4" ] || { [ "${1##wan}" != "$1" ] && [ "${1##wan6}" = "$1" ]; } || [ "${1%%wan}" != "$1" ]; }
-is_wan6() { [ -n "$wanIface6" ] && [ "$1" = "$wanIface6" ] || [ "${1/#wan6}" != "$1" ] || [ "${1/%wan6}" != "$1" ]; }
-is_ignored_interface() { str_contains_word "$ignored_interface" "$1"; }
-is_supported_interface() { str_contains_word "$supported_interface" "$1" || { ! is_ignored_interface "$1" && { is_wan "$1" || is_wan6 "$1" || is_tunnel "$1"; }; } || is_ignore_target "$1"; }
-is_ignore_target() { [ "$(str_to_lower "$1")" = 'ignore' ]; }
-is_mac_address() { expr "$1" : '[0-9a-fA-F][0-9a-fA-F]:[0-9a-fA-F][0-9a-fA-F]:[0-9a-fA-F][0-9a-fA-F]:[0-9a-fA-F][0-9a-fA-F]:[0-9a-fA-F][0-9a-fA-F]:[0-9a-fA-F][0-9a-fA-F]$' >/dev/null; }
-is_ipv4() { expr "$1" : '[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*$' >/dev/null; }
-is_ipv6() { ! is_mac_address "$1" && str_contains "$1" ":"; }
-is_family_mismatch() { ( is_netmask "${1//!}" && is_ipv6 "${2//!}" ) || ( is_ipv6 "${1//!}" && is_netmask "${2//!}" ); }
-is_ipv6_link_local() { [ "${1:0:4}" = "fe80" ]; }
-is_ipv6_unique_local() { [ "${1:0:2}" = "fc" ] || [ "${1:0:2}" = "fd" ]; }
-is_ipv6_global() { [ "${1:0:4}" = "2001" ]; }
-# is_ipv6_global() { is_ipv6 "$1" && ! is_ipv6_link_local "$1" && ! is_ipv6_link_local "$1"; }
-is_list() { str_contains "$1" "," || str_contains "$1" " "; }
-is_netmask() { local ip="${1%/*}"; [ "$ip" != "$1" ] && is_ipv4 "$ip"; }
-is_domain() { ! is_ipv6 "$1" && str_contains "$1" '[a-zA-Z]'; }
-is_phys_dev() { [ "${1:0:1}" = "@" ] && ip l show | grep -E -q "^\\d+\\W+${1:1}"; }
-dnsmasq_kill() { killall -q -s HUP dnsmasq; }
-dnsmasq_restart() { output 3 'Restarting dnsmasq '; if /etc/init.d/dnsmasq restart >/dev/null 2>&1; then output_okn; else output_failn; fi; }
-is_default_dev() { [ "$1" = "$($ip_bin -4 r | grep -m1 'dev' | grep -Eso 'dev [^ ]*' | awk '{print $2}')" ]; }
-is_supported_iface_dev() { local n dev; for n in $ifacesSupported; do network_get_device dev "$n"; [ "$1" = "$dev" ] && return 0; done; return 1; }
-is_supported_protocol() { grep -o '^[^#]*' /etc/protocols | grep -w -v '0' | grep . | awk '{print $1}' | grep -q "$1"; }
-is_service_running_iptables() { [ -x "$iptables" ] && "$iptables" -t mangle -L | grep -q "${iptPrefix}_PREROUTING" >/dev/null 2>&1; }
-is_service_running_nft() { [ -x "$nft" ] && [ -n "$(get_mark_nft_chains)" ]; }
-# atomic
-# is_service_running_nft() { [ -x "$nft" ] && [ -s "$nftPermFile" ]; }
-is_service_running() { if is_nft; then is_service_running_nft; else is_service_running_iptables; fi; }
-is_netifd_table() { local iface="$1"; [ "$(uci -q get "network.${iface}.ip4table")" = "${packageName}_${iface%6}" ]; }
-get_rt_tables_id() { local iface="$1"; grep "${ipTablePrefix}_${iface}\$" '/etc/iproute2/rt_tables' | awk '{print $1;}'; }
-get_rt_tables_next_id() { echo "$(($(sort -r -n '/etc/iproute2/rt_tables' | grep -o -E -m 1 "^[0-9]+")+1))"; }
-_check_config() { local en; config_get_bool en "$1" 'enabled' 1; [ "$en" -gt 0 ] && _cfg_enabled=0; }
-is_config_enabled() {
- local cfg="$1" _cfg_enabled=1
- [ -n "$1" ] || return 1
- config_load "$packageName"
- config_foreach _check_config "$cfg"
- return "$_cfg_enabled"
-}
-# shellcheck disable=SC2016
-resolveip_to_ipt() { resolveip "$@" | sed -n 'H;${x;s/\n/,/g;s/^,//;p;};d'; }
-resolveip_to_ipt4() { resolveip_to_ipt -4 "$@"; }
-resolveip_to_ipt6() { [ -n "$ipv6_enabled" ] && resolveip_to_ipt -6 "$@"; }
-# shellcheck disable=SC2016
-resolveip_to_nftset() { resolveip "$@" | sed -n 'H;${x;s/\n/,/g;s/^,//;p;};d' | tr '\n' ' '; }
-resolveip_to_nftset4() { resolveip_to_nftset -4 "$@"; }
-resolveip_to_nftset6() { [ -n "$ipv6_enabled" ] && resolveip_to_nftset -6 "$@"; }
-# shellcheck disable=SC2016
-ipv4_leases_to_nftset() { [ -s '/tmp/dhcp.leases' ] || return 1; grep "$1" '/tmp/dhcp.leases' | awk '{print $3}' | sed -n 'H;${x;s/\n/,/g;s/^,//;p;};d' | tr '\n' ' '; }
-# shellcheck disable=SC2016
-ipv6_leases_to_nftset() { [ -s '/tmp/hosts/odhcpd' ] || return 1; grep -v '^\#' '/tmp/hosts/odhcpd' | grep "$1" | awk '{print $1}' | sed -n 'H;${x;s/\n/,/g;s/^,//;p;};d' | tr '\n' ' '; }
-# shellcheck disable=SC3037
-ports_to_nftset() { echo -ne "$value"; }
-get_mark_ipt_chains() { [ -n "$(command -v iptables-save)" ] && iptables-save | grep ":${iptPrefix}_MARK_" | awk '{ print $1 }' | sed 's/://'; }
-get_mark_nft_chains() { [ -x "$nft" ] && "$nft" list table inet "$nftTable" 2>/dev/null | grep chain | grep "${nftPrefix}_mark_" | awk '{ print $2 }'; }
-get_ipsets() { [ -x "$(command -v ipset)" ] && ipset list | grep "${ipsPrefix}_" | awk '{ print $2 }'; }
-get_nft_sets() { [ -x "$nft" ] && "$nft" list table inet "$nftTable" 2>/dev/null | grep 'set' | grep "${nftPrefix}_" | awk '{ print $2 }'; }
-is_ipset_type_supported() { ipset help hash:"$1" >/dev/null 2>&1; }
-ubus_get_status() { ubus call service list "{ 'name': '$packageName' }" | jsonfilter -e "@.${packageName}.instances.main.data.status.${1}"; }
-ubus_get_iface() { ubus call service list "{ 'name': '$packageName' }" | jsonfilter -e "@.${packageName}.instances.main.data.interfaces[@.name='${1}']${2:+.$2}"; }
-opkg_get_version() { grep -m1 -A1 "Package: $1$" '/usr/lib/opkg/status' | grep -m1 'Version: ' | sed 's|Version: \(.*\)|\1|'; }
-
-load_package_config() {
- config_load "$packageName"
- config_get boot_timeout 'config' 'boot_timeout' '30'
- config_get_bool enabled 'config' 'enabled' '0'
- config_get fw_mask 'config' 'fw_mask' 'ff0000'
- config_get icmp_interface 'config' 'icmp_interface'
- config_get ignored_interface 'config' 'ignored_interface'
- config_get_bool ipv6_enabled 'config' 'ipv6_enabled' '0'
- config_get nft_user_set_policy 'config' 'nft_user_set_policy' 'memory'
- config_get_bool nft_user_set_counter 'config' 'nft_user_set_counter' '0'
- config_get procd_boot_delay 'config' 'procd_boot_delay' '0'
- config_get resolver_set 'config' 'resolver_set'
- config_get rule_create_option 'config' 'rule_create_option' 'add'
- config_get_bool secure_reload 'config' 'secure_reload' '1'
- config_get_bool strict_enforcement 'config' 'strict_enforcement' '0'
- config_get supported_interface 'config' 'supported_interface'
- config_get verbosity 'config' 'verbosity' '2'
- config_get wan_ip_rules_priority 'config' 'wan_ip_rules_priority' '30000'
- config_get wan_mark 'config' 'wan_mark' '010000'
- fw_mask="0x${fw_mask}"
- wan_mark="0x${wan_mark}"
- [ -n "$ipv6_enabled" ] && [ "$ipv6_enabled" -eq 0 ] && unset ipv6_enabled
- . /lib/functions/network.sh
- . /usr/share/libubox/jshn.sh
- mkdir -p "${dnsmasqFile%/*}"
- if is_nft; then
- fw_maskXor="$(printf '%#x' "$((fw_mask ^ 0xffffffff))")"
- fw_maskXor="${fw_maskXor:-0xff00ffff}"
- if [ "$nft_user_set_counter" -eq '0' ]; then
- unset nft_user_set_counter
- fi
- else
- case $rule_create_option in
- insert|-i|-I) rule_create_option='-I';;
- add|-a|-A|*) rule_create_option='-A';;
- esac
- fi
-}
-
-load_environment() {
- local param="$1" validation_result="$2"
- load_package_config
- case "$param" in
- on_start)
- if [ -n "$validation_result" ] && [ "$validation_result" != '0' ]; then
- output "${_ERROR_}: The $packageName config validation failed!\\n"
- output "Please check if the '$packageConfigFile' contains correct values for config options.\\n"
- state add 'errorSummary' 'errorConfigValidation'
- return 1
- fi
- if [ "$enabled" -eq 0 ]; then
- state add 'errorSummary' 'errorServiceDisabled'
- return 1
- fi
- if [ ! -x "$ip_bin" ]; then
- state add 'errorSummary' 'errorNoIpFull'
- return 1
- fi
- if ! is_nft; then
- if [ -z "$iptables" ] || [ ! -x "$iptables" ]; then
- state add 'errorSummary' 'errorNoIptables'
- return 1
- fi
- fi
- rm -f "$packageLockFile"
- resolver 'check_support'
- ;;
- on_stop)
- touch "$packageLockFile"
- ;;
- esac
- load_network "$param"
-}
-
-load_network() {
- local i
- config_load 'network'
- [ -z "$ifacesAll" ] && config_foreach _build_ifaces_all 'interface'
- if [ -z "$ifacesSupported" ]; then
- config_load 'firewall'
- config_foreach _find_firewall_wan_zone 'zone'
- for i in $(uci -q get "firewall.${firewallWanZone}.network"); do
- is_supported_interface "$i" && ! str_contains "$ifacesSupported" "$1" && ifacesSupported="${ifacesSupported}${i} "
- done
- config_load 'network'
- config_foreach _build_ifaces_supported 'interface'
- fi
- pbr_find_iface wanIface4 'wan'
- [ -n "$ipv6_enabled" ] && pbr_find_iface wanIface6 'wan6'
- [ -n "$wanIface4" ] && network_get_gateway wanGW4 "$wanIface4"
- [ -n "$wanIface6" ] && network_get_gateway6 wanGW6 "$wanIface6"
- wanGW="${wanGW4:-$wanGW6}"
-}
-
-is_wan_up() {
- local sleepCount='1'
- load_network
- while [ -z "$wanGW" ] ; do
- load_network
- if [ $((sleepCount)) -gt $((boot_timeout)) ] || [ -n "$wanGW" ]; then break; fi
- output "$serviceName waiting for wan gateway...\\n"
- sleep 1
- network_flush_cache
- sleepCount=$((sleepCount+1))
- done
- if [ -n "$wanGW" ]; then
- return 0
- else
- state add 'errorSummary' 'errorNoWanGateway'
- return 1
- fi
-}
-
-# shellcheck disable=SC2086
-ipt4() {
- local d
- [ -x "$iptables" ] || return 1
- for d in "${*//-A/-D}" "${*//-I/-D}" "${*//-N/-F}" "${*//-N/-X}"; do
- [ "$d" != "$*" ] && "$iptables" $d >/dev/null 2>&1
- done
- d="$*"; "$iptables" $d >/dev/null 2>&1
-}
-
-# shellcheck disable=SC2086
-ipt6() {
- local d
- [ -n "$ipv6_enabled" ] || return 0
- [ -x "$ip6tables" ] || return 1
- for d in "${*//-A/-D}" "${*//-I/-D}" "${*//-N/-F}" "${*//-N/-X}"; do
- [ "$d" != "$*" ] && "$ip6tables" $d >/dev/null 2>&1
- done
- d="$*"
- "$ip6tables" $d >/dev/null 2>&1
-}
-
-# shellcheck disable=SC2086
-ipt() {
- local d failFlagIpv4=1 failFlagIpv6=1
- [ -x "$iptables" ] || return 1
- for d in "${*//-A/-D}" "${*//-I/-D}" "${*//-N/-F}" "${*//-N/-X}"; do
- if [ "$d" != "$*" ]; then
- "$iptables" $d >/dev/null 2>&1
- [ -x "$ip6tables" ] && "$ip6tables" $d >/dev/null 2>&1
- fi
- done
- d="$*"; "$iptables" $d >/dev/null 2>&1 && failFlagIpv4=0;
- if [ -n "$ipv6_enabled" ] && [ -x "$ip6tables" ]; then
- "$ip6tables" $d >/dev/null 2>&1 && failFlagIpv6=0
- fi
- [ "$failFlagIpv4" -eq 0 ] || [ "$failFlagIpv6" -eq 0 ]
-}
-
-# shellcheck disable=SC2086
-ips4() { [ -x "$ipset" ] && "$ipset" "$@" >/dev/null 2>&1; }
-ips6() { [ -x "$ipset" ] && { if [ -n "$ipv6_enabled" ] && [ -n "$*" ]; then "$ipset" "$@" >/dev/null 2>&1; else return 1; fi; }; }
-ips() {
- local command="$1" iface="$2" target="${3:-dst}" type="${4:-ip}" uid="$5" comment="$6" param="$7" mark="$7"
- local ipset4 ipset6 i
- local ipv4_error=1 ipv6_error=1
- ipset4="${ipsPrefix}${iface:+_$iface}_4${target:+_$target}${type:+_$type}${uid:+_$uid}"
- ipset6="${ipsPrefix}${iface:+_$iface}_6${target:+_$target}${type:+_$type}${uid:+_$uid}"
-
- [ -x "$ipset" ] || return 1
-
- if [ "${#ipset4}" -gt 31 ]; then
- state add 'errorSummary' 'errorIpsetNameTooLong' "$ipset4"
- return 1
- fi
-
- case "$command" in
- add)
- ips4 -q -! add "$ipset4" ["$param"] comment "$comment" && ipv4_error=0
- ips6 -q -! add "$ipset6" ["$param"] comment "$comment" && ipv6_error=0
- ;;
- add_agh_element)
- [ -n "$ipv6_enabled" ] || unset ipset6
- echo "${param}/${ipset4}${ipset6:+,$ipset6}" >> "$aghIpsetFile" && ipv4_error=0
- ;;
- add_dnsmasq_element)
- [ -n "$ipv6_enabled" ] || unset ipset6
- echo "ipset=/${param}/${ipset4}${ipset6:+,$ipset6} # $comment" >> "$dnsmasqFile" && ipv4_error=0
- ;;
- create)
- ips4 -q -! create "$ipset4" "hash:$type" comment && ipv4_error=0
- ips6 -q -! create "$ipset6" "hash:$type" comment family inet6 && ipv6_error=0
- ;;
- create_agh_set)
- ips4 -q -! create "$ipset4" "hash:$type" comment && ipv4_error=0
- ips6 -q -! create "$ipset6" "hash:$type" comment family inet6 && ipv6_error=0
- ;;
- create_dnsmasq_set)
- ips4 -q -! create "$ipset4" "hash:$type" comment && ipv4_error=0
- ips6 -q -! create "$ipset6" "hash:$type" comment family inet6 && ipv6_error=0
- ;;
- create_user_set)
- case "$type" in
- ip|net)
- ips4 -q -! create "$ipset4" "hash:$type" comment && ipv4_error=0
- ips6 -q -! create "$ipset6" "hash:$type" comment family inet6 && ipv6_error=0
- case "$target" in
- dst)
- ipt4 -t mangle -A "${iptPrefix}_PREROUTING" -m set --match-set "$ipset4" dst -g "${iptPrefix}_MARK_${mark}" && ipv4_error=0
- ipt6 -t mangle -A "${iptPrefix}_PREROUTING" -m set --match-set "$ipset6" dst -g "${iptPrefix}_MARK_${mark}" && ipv6_error=0
- ;;
- src)
- ipt4 -t mangle -A "${iptPrefix}_PREROUTING" -m set --match-set "$ipset4" src -g "${iptPrefix}_MARK_${mark}" && ipv4_error=0
- ipt6 -t mangle -A "${iptPrefix}_PREROUTING" -m set --match-set "$ipset6" src -g "${iptPrefix}_MARK_${mark}" && ipv6_error=0
- ;;
- esac
- ;;
- mac)
- ips4 -q -! create "$ipset4" "hash:$type" comment && ipv4_error=0
- ips6 -q -! create "$ipset6" "hash:$type" comment family inet6 && ipv4_error=0
- ipt4 -t mangle -A "${iptPrefix}_PREROUTING" -m set --match-set "$ipset4" src -g "${iptPrefix}_MARK_${mark}" && ipv4_error=0
- ipt6 -t mangle -A "${iptPrefix}_PREROUTING" -m set --match-set "$ipset6" src -g "${iptPrefix}_MARK_${mark}" && ipv6_error=0
- ;;
- esac
- ;;
- delete|destroy)
- ips4 -q -! destroy "$ipset4" && ipv4_error=0
- ips6 -q -! destroy "$ipset6" && ipv6_error=0
- ;;
- delete_user_set)
- ips4 -q -! destroy "$ipset4" && ipv4_error=0
- ips6 -q -! destroy "$ipset6" family inet6 && ipv6_error=0
- case "$type" in
- ip|net)
- case "$target" in
- dst)
- ipt4 -t mangle -D "${iptPrefix}_PREROUTING" -m set --match-set "$ipset4" dst -g "${iptPrefix}_MARK_${mark}" && ipv4_error=0
- ipt6 -t mangle -D "${iptPrefix}_PREROUTING" -m set --match-set "$ipset6" dst -g "${iptPrefix}_MARK_${mark}" && ipv6_error=0
- ;;
- src)
- ipt4 -t mangle -D "${iptPrefix}_PREROUTING" -m set --match-set "$ipset4" src -g "${iptPrefix}_MARK_${mark}" && ipv4_error=0
- ipt6 -t mangle -D "${iptPrefix}_PREROUTING" -m set --match-set "$ipset6" src -g "${iptPrefix}_MARK_${mark}" && ipv6_error=0
- ;;
- esac
- ;;
- mac)
- ipt4 -t mangle -D "${iptPrefix}_PREROUTING" -m set --match-set "$ipset4" src -g "${iptPrefix}_MARK_${mark}" && ipv4_error=0
- ipt6 -t mangle -D "${iptPrefix}_PREROUTING" -m set --match-set "$ipset6" src -g "${iptPrefix}_MARK_${mark}" && ipv6_error=0
- ;;
- esac
- ;;
- flush|flush_user_set)
- ips4 -q -! flush "$ipset4" && ipv4_error=0
- ips6 -q -! flush "$ipset6" && ipv6_error=0
- ;;
- esac
- if [ "$ipv4_error" -eq '0' ] || [ "$ipv6_error" -eq '0' ]; then
- return 0
- else
- return 1
- fi
-}
-
-# atomic
-#nfta() { echo "$@" >> "$nftTempFile"; }
-#nfta4() { echo "$@" >> "$nftTempFile"; }
-#nfta6() { [ -z "$ipv6_enabled" ] || echo "$@" >> "$nftTempFile"; }
-#nft() { nfta "$@"; [ -x "$nft" ] && "$nft" "$@" >/dev/null 2>&1; }
-#nft4() { nfta "$@"; [ -x "$nft" ] && "$nft" "$@" >/dev/null 2>&1; }
-#nft6() { nfta "$@"; [ -n "$ipv6_enabled" ] || return 0; [ -x "$nft" ] && [ -n "$*" ] && "$nft" "$@" >/dev/null 2>&1; }
-nft() { [ -x "$nft" ] && "$nft" "$@" >/dev/null 2>&1; }
-nft4() { [ -x "$nft" ] && "$nft" "$@" >/dev/null 2>&1; }
-nft6() { [ -n "$ipv6_enabled" ] || return 0; [ -x "$nft" ] && [ -n "$*" ] && "$nft" "$@" >/dev/null 2>&1; }
-nftset() {
- local command="$1" iface="$2" target="${3:-dst}" type="${4:-ip}" uid="$5" comment="$6" param="$7" mark="$7"
- local nftset4 nftset6 i param4 param6
- local ipv4_error=1 ipv6_error=1
- nftset4="${nftPrefix}${iface:+_$iface}_4${target:+_$target}${type:+_$type}${uid:+_$uid}"
- nftset6="${nftPrefix}${iface:+_$iface}_6${target:+_$target}${type:+_$type}${uid:+_$uid}"
-
- [ -x "$nft" ] || return 1
-
- if [ "${#nftset4}" -gt 255 ]; then
- state add 'errorSummary' 'errorNftsetNameTooLong' "$nftset4"
- return 1
- fi
-
- case "$command" in
- add)
- if is_netmask "$param" || is_ipv4 "$param" || is_ipv6 "$param" \
- || is_mac_address "$param" || is_list "$param"; then
- nft4 add element inet "$nftTable" "$nftset4" "{ $param }" && ipv4_error=0
- nft6 add element inet "$nftTable" "$nftset6" "{ $param }" && ipv6_error=0
- else
- if [ "$target" = 'src' ]; then
- param4="$(ipv4_leases_to_nftset "$param")"
- param6="$(ipv6_leases_to_nftset "$param")"
- fi
- [ -z "$param4" ] && param4="$(resolveip_to_nftset4 "$param")"
- [ -z "$param6" ] && param6="$(resolveip_to_nftset6 "$param")"
- if [ -z "$param4" ] && [ -z "$param6" ]; then
- state add 'errorSummary' 'errorFailedToResolve' "$param"
- else
- nft4 add element inet "$nftTable" "$nftset4" "{ $param4 }" && ipv4_error=0
- nft6 add element inet "$nftTable" "$nftset6" "{ $param6 }" && ipv6_error=0
- fi
- fi
- ;;
- add_dnsmasq_element)
- [ -n "$ipv6_enabled" ] || unset nftset6
- echo "nftset=/${param}/4#inet#${nftTable}#${nftset4}${nftset6:+,6#inet#${nftTable}#$nftset6} # $comment" >> "$dnsmasqFile" && ipv4_error=0
- ;;
- create)
- case "$type" in
- ip|net)
- nft4 add set inet "$nftTable" "$nftset4" "{ type ipv4_addr; counter; flags interval; auto-merge; comment \"$comment\"; }" && ipv4_error=0
- nft6 add set inet "$nftTable" "$nftset6" "{ type ipv6_addr; counter; flags interval; auto-merge; comment \"$comment\"; }" && ipv6_error=0
- ;;
- mac)
- nft4 add set inet "$nftTable" "$nftset4" "{ type ether_addr; counter; flags interval; auto-merge; comment \"$comment\"; }" && ipv4_error=0
- nft6 add set inet "$nftTable" "$nftset6" "{ type ether_addr; counter; flags interval; auto-merge; comment \"$comment\"; }" && ipv6_error=0
- ;;
- esac
- ;;
- create_dnsmasq_set)
- nft4 add set inet "$nftTable" "$nftset4" "{ type ipv4_addr; counter; flags interval; auto-merge; comment \"$comment\"; }" && ipv4_error=0
- nft6 add set inet "$nftTable" "$nftset6" "{ type ipv6_addr; counter; flags interval; auto-merge; comment \"$comment\"; }" && ipv6_error=0
- ;;
- create_user_set)
- case "$type" in
- ip|net)
- nft4 add set inet "$nftTable" "$nftset4" "{ type ipv4_addr; ${nft_user_set_counter:+counter;} flags interval; auto-merge; policy $nft_user_set_policy; comment \"$comment\"; }" && ipv4_error=0
- nft6 add set inet "$nftTable" "$nftset6" "{ type ipv6_addr; ${nft_user_set_counter:+counter;} flags interval; auto-merge; policy $nft_user_set_policy; comment \"$comment\"; }" && ipv6_error=0
- case "$target" in
- dst)
- nft add rule inet "$nftTable" "${nftPrefix}_prerouting" ip daddr "@${nftset4}" goto "${nftPrefix}_mark_${mark}" && ipv4_error=0
- nft add rule inet "$nftTable" "${nftPrefix}_prerouting" ip daddr "@${nftset6}" goto "${nftPrefix}_mark_${mark}" && ipv6_error=0
- ;;
- src)
- nft add rule inet "$nftTable" "${nftPrefix}_prerouting" ip saddr "@${nftset4}" goto "${nftPrefix}_mark_${mark}" && ipv4_error=0
- nft add rule inet "$nftTable" "${nftPrefix}_prerouting" ip saddr "@${nftset6}" goto "${nftPrefix}_mark_${mark}" && ipv6_error=0
- ;;
- esac
- ;;
- mac)
- nft4 add set inet "$nftTable" "$nftset4" "{ type ether_addr; ${nft_user_set_counter:+counter;} flags interval; auto-merge; policy $nft_user_set_policy; comment \"$comment\"; }" && ipv4_error=0
- nft6 add set inet "$nftTable" "$nftset6" "{ type ether_addr; ${nft_user_set_counter:+counter;} flags interval; auto-merge; policy $nft_user_set_policy; comment \"$comment\"; }" && ipv6_error=0
- nft add rule inet "$nftTable" "${nftPrefix}_prerouting" ether saddr "@${nftset4}" goto "${nftPrefix}_mark_${mark}" && ipv4_error=0
- nft add rule inet "$nftTable" "${nftPrefix}_prerouting" ether saddr "@${nftset6}" goto "${nftPrefix}_mark_${mark}" && ipv6_error=0
- ;;
- esac
- ;;
- delete|destroy)
- nft delete set inet "$nftTable" "$nftset4" && ipv4_error=0
- nft delete set inet "$nftTable" "$nftset6" && ipv6_error=0
- ;;
- delete_user_set)
- nft delete set inet "$nftTable" "$nftset4" && ipv4_error=0
- nft delete set inet "$nftTable" "$nftset6" && ipv6_error=0
- case "$type" in
- ip|net)
- case "$target" in
- dst)
- nft delete rule inet "$nftTable" "${nftPrefix}_prerouting" ip daddr "@${nftset4}" goto "${nftPrefix}_mark_${mark}" && ipv4_error=0
- nft delete rule inet "$nftTable" "${nftPrefix}_prerouting" ip daddr "@${nftset6}" goto "${nftPrefix}_mark_${mark}" && ipv6_error=0
- ;;
- src)
- nft delete rule inet "$nftTable" "${nftPrefix}_prerouting" ip saddr "@${nftset4}" goto "${nftPrefix}_mark_${mark}" && ipv4_error=0
- nft delete rule inet "$nftTable" "${nftPrefix}_prerouting" ip saddr "@${nftset6}" goto "${nftPrefix}_mark_${mark}" && ipv6_error=0
- ;;
- esac
- ;;
- mac)
- nft delete rule inet "$nftTable" "${nftPrefix}_prerouting" ether saddr "@${nftset4}" goto "${nftPrefix}_mark_${mark}" && ipv4_error=0
- nft delete rule inet "$nftTable" "${nftPrefix}_prerouting" ether saddr "@${nftset6}" goto "${nftPrefix}_mark_${mark}" && ipv6_error=0
- ;;
- esac
- ;;
- flush|flush_user_set)
- nft flush set inet "$nftTable" "$nftset4" && ipv4_error=0
- nft flush set inet "$nftTable" "$nftset6" && ipv6_error=0
- ;;
- esac
-# nft6 returns true if IPv6 support is not enabled
- [ -z "$ipv6_enabled" ] && ipv6_error='1'
- if [ "$ipv4_error" -eq '0' ] || [ "$ipv6_error" -eq '0' ]; then
- return 0
- else
- return 1
- fi
-}
-
-cleanup_rt_tables() { sed -i '/pbr_/d' '/etc/iproute2/rt_tables'; sync; }
-cleanup_dnsmasq() { [ -s "$dnsmasqFile" ] && resolverStoredHash="$(md5sum $dnsmasqFile | awk '{ print $1; }')" && rm "$dnsmasqFile" >/dev/null 2>&1; }
-
-cleanup_main_chains() {
- local i
- for i in $chainsList; do
- i="$(str_to_lower "$i")"
- nft flush chain inet "$nftTable" "${nftPrefix}_${i}"
- done
- for i in $chainsList; do
- i="$(str_to_upper "$i")"
- ipt -t mangle -D "${i}" -m mark --mark "0x0/${fw_mask}" -j "${iptPrefix}_${i}"
- ipt -t mangle -F "${iptPrefix}_${i}"
- ipt -t mangle -X "${iptPrefix}_${i}"
- done
-}
-
-cleanup_marking_chains() {
- local i
- for i in $(get_mark_nft_chains); do
- nft flush chain inet "$nftTable" "$i"
- nft delete chain inet "$nftTable" "$i"
- done
- for i in $(get_mark_ipt_chains); do
- ipt -t mangle -F "$i"
- ipt -t mangle -X "$i"
- done
-}
-
-cleanup_sets() {
- local i
- for i in $(get_nft_sets); do
- nft flush set inet "$nftTable" "$i"
- nft delete set inet "$nftTable" "$i"
- done
- for i in $(get_ipsets); do
- ipset -q -! flush "$i" >/dev/null 2>&1
- ipset -q -! destroy "$i" >/dev/null 2>&1
- done
-}
-
-state() {
- local action="$1" param="$2" value="${3//#/_}"
- shift 3
-# shellcheck disable=SC2124
- local extras="$@"
- local line error_id error_extra label
- case "$action" in
- add)
- line="$(eval echo "\$$param")"
- eval "$param"='${line:+$line#}${value}${extras:+ $extras}'
- ;;
- json)
- json_init
- json_add_object "$packageName"
- case "$param" in
- errorSummary)
- json_add_array 'errors';;
- warningSummary)
- json_add_array 'warnings';;
- esac
- if [ -n "$(eval echo "\$$param")" ]; then
- while read -r line; do
- if str_contains "$line" ' '; then
- error_id="${line% *}"
- error_extra="${line#* }"
- else
- error_id="$line"
- fi
- json_add_object
- json_add_string 'id' "$error_id"
- json_add_string 'extra' "$error_extra"
- json_close_object
- done <<EOF
-$(eval echo "\$$param" | tr \# \\n)
-EOF
- fi
- json_close_array
- json_close_object
- json_dump
- ;;
- print)
- [ -z "$(eval echo "\$$param")" ] && return 0
- case "$param" in
- errorSummary)
- label="${_ERROR_}:";;
- warningSummary)
- label="${_WARNING_}:";;
- esac
- while read -r line; do
- if str_contains "$line" ' '; then
- error_id="${line% *}"
- error_extra="${line#* }"
- printf "%b $(get_text "$error_id")\\n" "$label" "$error_extra"
- else
- error_id="$line"
- printf "%b $(get_text "$error_id")\\n" "$label"
- fi
- done <<EOF
-$(eval echo "\$$param" | tr \# \\n)
-EOF
- ;;
- set)
- eval "$param"='${value}${extras:+ $extras}'
- ;;
- esac
-}
-
-resolver() {
- local agh_version
- local param="$1"
- shift
-
- if [ "$param" = 'cleanup_all' ]; then
- sed -i "/ipset_file: ${aghIpsetFile}/d" "$aghConfigFile" >/dev/null 2>&1
- rm -f "$aghIpsetFile"
- rm -f "$dnsmasqFile"
- return 0
- fi
-
- case "$resolver_set" in
- ''|none)
- case "$param" in
- add_resolver_element) return 1;;
- create_resolver_set) return 1;;
- check_support) return 0;;
- cleanup) return 0;;
- configure) return 0;;
- init) return 0;;
- init_end) return 0;;
- kill) return 0;;
- reload) return 0;;
- restart) return 0;;
- compare_hash) return 0;;
- store_hash) return 0;;
- esac
- ;;
- adguardhome.ipset)
- case "$param" in
- add_resolver_element)
- [ -n "$resolver_set_supported" ] && ips 'add_agh_element' "$@";;
- create_resolver_set)
- [ -n "$resolver_set_supported" ] && ips 'create_agh_set' "$@";;
- check_support)
- if [ ! -x "$ipset" ]; then
- state add 'errorSummary' 'errorNoIpset'
- return 1
- fi
- if [ -n "$agh" ] && [ -s "$aghConfigFile" ]; then
- agh_version="$($agh --version | sed 's|AdGuard Home, version v\(.*\)|\1|' | sed 's|-.*||')"
- if is_greater_or_equal "$agh_version" '0.107.13'; then
- resolver_set_supported='true'
- return 0
- else
- state add 'warningSummary' 'warningAGHVersionTooLow' "$agh_version"
- return 1
- fi
- else
- state add 'warningSummary' 'warningResolverNotSupported'
- return 1
- fi
- ;;
- cleanup)
- [ -z "$resolver_set_supported" ] && return 0
- rm -f "$aghIpsetFile"
- sed -i "/ipset_file: ${aghIpsetFile}/d" "$aghConfigFile" >/dev/null 2>&1
- ;;
- configure)
- [ -z "$resolver_set_supported" ] && return 1
- mkdir -p "${aghIpsetFile%/*}"
- touch "$aghIpsetFile"
- sed -i '/ipset_file/d' "$aghConfigFile" >/dev/null 2>&1
- sed -i "/ ipset:/a \ \ ipset_file: $aghIpsetFile" "$aghConfigFile"
- ;;
- init) :;;
- init_end) :;;
- kill)
- [ -n "$resolver_set_supported" ] && [ -n "$agh" ] && killall -q -s HUP "$agh";;
- reload)
- [ -z "$resolver_set_supported" ] && return 1
- output 3 'Reloading adguardhome '
- if /etc/init.d/adguardhome reload >/dev/null 2>&1; then
- output_okn
- return 0
- else
- output_failn
- return 1
- fi
- ;;
- restart)
- [ -z "$resolver_set_supported" ] && return 1
- output 3 'Restarting adguardhome '
- if /etc/init.d/adguardhome restart >/dev/null 2>&1; then
- output_okn
- return 0
- else
- output_failn
- return 1
- fi
- ;;
- compare_hash)
- [ -z "$resolver_set_supported" ] && return 1
- local resolverNewHash
- if [ -s "$aghIpsetFile" ]; then
- resolverNewHash="$(md5sum $aghIpsetFile | awk '{ print $1; }')"
- fi
- [ "$resolverNewHash" != "$resolverStoredHash" ]
- ;;
- store_hash)
- [ -s "$aghIpsetFile" ] && resolverStoredHash="$(md5sum $aghIpsetFile | awk '{ print $1; }')";;
- esac
- ;;
- dnsmasq.ipset)
- case "$param" in
- add_resolver_element)
- [ -n "$resolver_set_supported" ] && ips 'add_dnsmasq_element' "$@";;
- create_resolver_set)
- [ -n "$resolver_set_supported" ] && ips 'create_dnsmasq_set' "$@";;
- check_support)
- if [ ! -x "$ipset" ]; then
- state add 'errorSummary' 'errorNoIpset'
- return 1
- fi
- if ! dnsmasq -v 2>/dev/null | grep -q 'no-ipset' && dnsmasq -v 2>/dev/null | grep -q 'ipset'; then
- resolver_set_supported='true'
- return 0
- else
- state add 'warningSummary' 'warningResolverNotSupported'
- return 1
- fi
- ;;
- cleanup)
- [ -n "$resolver_set_supported" ] && rm -f "$dnsmasqFile";;
- configure)
- [ -n "$resolver_set_supported" ] && mkdir -p "${dnsmasqFile%/*}";;
- init) :;;
- init_end) :;;
- kill)
- [ -n "$resolver_set_supported" ] && killall -q -s HUP dnsmasq;;
- reload)
- [ -z "$resolver_set_supported" ] && return 1
- output 3 'Reloading dnsmasq '
- if /etc/init.d/dnsmasq reload >/dev/null 2>&1; then
- output_okn
- return 0
- else
- output_failn
- return 1
- fi
- ;;
- restart)
- [ -z "$resolver_set_supported" ] && return 1
- output 3 'Restarting dnsmasq '
- if /etc/init.d/dnsmasq restart >/dev/null 2>&1; then
- output_okn
- return 0
- else
- output_failn
- return 1
- fi
- ;;
- compare_hash)
- [ -z "$resolver_set_supported" ] && return 1
- local resolverNewHash
- if [ -s "$dnsmasqFile" ]; then
- resolverNewHash="$(md5sum $dnsmasqFile | awk '{ print $1; }')"
- fi
- [ "$resolverNewHash" != "$resolverStoredHash" ]
- ;;
- store_hash)
- [ -s "$dnsmasqFile" ] && resolverStoredHash="$(md5sum $dnsmasqFile | awk '{ print $1; }')";;
- esac
- ;;
- dnsmasq.nftset)
- case "$param" in
- add_resolver_element)
- [ -n "$resolver_set_supported" ] && nftset 'add_dnsmasq_element' "$@";;
- create_resolver_set)
- [ -n "$resolver_set_supported" ] && nftset 'create_dnsmasq_set' "$@";;
- check_support)
- if [ ! -x "$nft" ]; then
- state add 'errorSummary' 'errorNoNft'
- return 1
- fi
- if ! dnsmasq -v 2>/dev/null | grep -q 'no-nftset' && dnsmasq -v 2>/dev/null | grep -q 'nftset'; then
- resolver_set_supported='true'
- return 0
- else
- state add 'warningSummary' 'warningResolverNotSupported'
- return 1
- fi
- ;;
- cleanup)
- [ -n "$resolver_set_supported" ] && rm -f "$dnsmasqFile";;
- configure)
- [ -n "$resolver_set_supported" ] && mkdir -p "${dnsmasqFile%/*}";;
- init) :;;
- init_end) :;;
- kill)
- [ -n "$resolver_set_supported" ] && killall -q -s HUP dnsmasq;;
- reload)
- [ -z "$resolver_set_supported" ] && return 1
- output 3 'Reloading dnsmasq '
- if /etc/init.d/dnsmasq reload >/dev/null 2>&1; then
- output_okn
- return 0
- else
- output_failn
- return 1
- fi
- ;;
- restart)
- [ -z "$resolver_set_supported" ] && return 1
- output 3 'Restarting dnsmasq '
- if /etc/init.d/dnsmasq restart >/dev/null 2>&1; then
- output_okn
- return 0
- else
- output_failn
- return 1
- fi
- ;;
- compare_hash)
- [ -z "$resolver_set_supported" ] && return 1
- local resolverNewHash
- if [ -s "$dnsmasqFile" ]; then
- resolverNewHash="$(md5sum $dnsmasqFile | awk '{ print $1; }')"
- fi
- [ "$resolverNewHash" != "$resolverStoredHash" ]
- ;;
- store_hash)
- [ -s "$dnsmasqFile" ] && resolverStoredHash="$(md5sum $dnsmasqFile | awk '{ print $1; }')";;
- esac
- ;;
- unbound.ipset)
- case "$param" in
- add_resolver_element) :;;
- create_resolver_set) :;;
- check_support) :;;
- cleanup) :;;
- configure) :;;
- init) :;;
- init_end) :;;
- kill) :;;
- reload) :;;
- restart) :;;
- compare_hash) :;;
- store_hash) :;;
- esac
- ;;
- unbound.nftset)
- case "$param" in
- add_resolver_element) :;;
- create_resolver_set) :;;
- check_support) :;;
- cleanup) :;;
- configure) :;;
- init) :;;
- init_end) :;;
- kill) :;;
- reload) :;;
- restart) :;;
- compare_hash) :;;
- store_hash) :;;
- esac
- ;;
- esac
-}
-
-trap_process() {
- output "\\n"
- output "Unexpected exit or service termination: '${1}'!\\n"
- state add 'errorSummary' 'errorUnexpectedExit' "$1"
- traffic_killswitch 'remove'
-}
-
-traffic_killswitch() {
- local s=0
- case "$1" in
- insert)
- local lan_subnet wan_device
- [ "$secure_reload" -ne 0 ] || return 0
- for i in $serviceTrapSignals; do
-# shellcheck disable=SC2064
- trap "trap_process $i" "$i"
- done
- output 3 'Activating traffic killswitch '
- network_get_subnet lan_subnet 'lan'
- network_get_physdev wan_device 'wan'
- if is_nft; then
- nft add chain inet "$nftTable" "${nftPrefix}_killswitch" '{ type filter hook forward priority 0; policy accept; }' || s=1
- nft add rule inet "$nftTable" "${nftPrefix}_killswitch" oifname "$wan_device" ip saddr "$lan_subnet" counter reject || s=1
- else
- ipt -N "${iptPrefix}_KILLSWITCH" || s=1
- ipt -A "${iptPrefix}_KILLSWITCH" -s "$lan_subnet" -o "$wan_device" -j REJECT || s=1
- ipt -I FORWARD -j "${iptPrefix}_KILLSWITCH" || s=1
- fi
- if [ "$s" -eq 0 ]; then
- output_okn
- else
- output_failn
- fi
- ;;
- remove)
- if [ "$secure_reload" -ne 0 ]; then
- output 3 'Deactivating traffic killswitch '
- fi
- if is_nft; then
- nft flush chain inet "$nftTable" "${nftPrefix}_killswitch" || s=1
- nft delete chain inet "$nftTable" "${nftPrefix}_killswitch" || s=1
- else
- ipt -D FORWARD -j "${iptPrefix}_KILLSWITCH" || s=1
- ipt -F "${iptPrefix}_KILLSWITCH" || s=1
- ipt -X "${iptPrefix}_KILLSWITCH" || s=1
- fi
- if [ "$secure_reload" -ne 0 ]; then
- if [ "$s" -eq 0 ]; then
- output_okn
- else
- output_failn
- fi
- fi
-# shellcheck disable=SC2086
- trap - $serviceTrapSignals
- ;;
- esac
-}
-
-policy_routing_tor() { if is_nft; then policy_routing_tor_nft "$@"; else policy_routing_tor_iptables "$@"; fi; }
-policy_routing_tor_iptables() {
- local comment="$1" iface="$2" src_addr="$3" src_port="$4" dest_addr="$5" dest_port="$6" proto chain uid="$9"
- proto="$(str_to_lower "$7")"
- chain="$(str_to_upper "$8")"
- chain="${chain:-PREROUTING}"
- if [ -n "${src_addr}${src_port}${dest_port}" ]; then
- state add 'warningSummary' 'warningTorUnsetParams' "$comment"
- fi
- if [ -n "$proto" ] && [ "$proto" != "all" ]; then
- state add 'warningSummary' 'warningTorUnsetProto' "$comment"
- fi
- if [ "$chain" != "PREROUTING" ]; then
- state add 'warningSummary' 'warningTorUnsetChainIpt' "$comment"
- fi
- if ! resolver 'add_resolver_element' "$iface" 'dst' 'ip' '' "${comment}: $dest_addr" "$dest_addr"; then
- processPolicyError='true'
- state add 'errorSummary' 'errorResolver' "'add_resolver_element' '$iface' 'dst' 'ip' '${comment}: $dest_addr' '$dest_addr'"
- return 1
- fi
- return 0
-}
-policy_routing_tor_nft() {
- local comment="$1" iface="$2" src_addr="$3" src_port="$4" dest_addr="$5" dest_port="$6" proto chain uid="$9"
- proto="$(str_to_lower "$7")"
- chain="$(str_to_lower "$8")"
- chain="${chain:-prerouting}"
- if [ -n "${src_addr}${src_port}${dest_port}" ]; then
- state add 'warningSummary' 'warningTorUnsetParams' "$comment"
- fi
- if [ -n "$proto" ] && [ "$proto" != "all" ]; then
- state add 'warningSummary' 'warningTorUnsetProto' "$comment"
- fi
- if [ "$chain" != "prerouting" ]; then
- state add 'warningSummary' 'warningTorUnsetChainNft' "$comment"
- fi
- if ! resolver 'add_resolver_element' "$iface" 'dst' 'ip' '' "${comment}: $dest_addr" "$dest_addr"; then
- processPolicyError='true'
- state add 'errorSummary' 'errorResolver' "'add_resolver_element' '$iface' 'dst' 'ip' '${comment}: $dest_addr' '$dest_addr'"
- return 1
- fi
- return 0
-}
-
-policy_routing() { if is_nft; then policy_routing_nft "$@"; else policy_routing_iptables "$@"; fi; }
-policy_routing_iptables() {
- local mark param4 param6 i negation value dest ipInsertOption="-A"
- local ip4error='1' ip6error='1'
- local name="$1" iface="$2" laddr="$3" lport="$4" raddr="$5" rport="$6" proto chain uid="$9"
- proto="$(str_to_lower "$7")"
- chain="$(str_to_upper "$8")"
- chain="${chain:-PREROUTING}"
- mark=$(eval echo "\$mark_${iface//-/_}")
-
- if [ -n "$ipv6_enabled" ] && { is_ipv6 "$laddr" || is_ipv6 "$raddr"; }; then
- processPolicyError='true'
- state add 'errorSummary' 'errorPolicyProcessNoIpv6' "$name"
- return 1
- fi
-
- if [ -n "$mark" ]; then
- dest="-g ${iptPrefix}_MARK_${mark}"
- elif [ "$iface" = "ignore" ]; then
- dest="-j RETURN"
- else
- processPolicyError='true'
- state add 'errorSummary' 'errorPolicyProcessUnknownFwmark' "$iface"
- return 1
- fi
-
- if is_family_mismatch "$laddr" "$raddr"; then
- processPolicyError='true'
- state add 'errorSummary' 'errorPolicyProcessMismatchFamily' "${name}: '$laddr' '$raddr'"
- return 1
- fi
-
- if [ -z "$proto" ]; then
- if [ -n "${lport}${rport}" ]; then
- proto='tcp udp'
- else
- proto='all'
- fi
- fi
-
- for i in $proto; do
- if [ "$i" = 'all' ]; then
- param4="-t mangle ${ipInsertOption} ${iptPrefix}_${chain} $dest"
- param6="-t mangle ${ipInsertOption} ${iptPrefix}_${chain} $dest"
- elif ! is_supported_protocol "$i"; then
- processPolicyError='true'
- state add 'errorSummary' 'errorPolicyProcessUnknownProtocol' "${name}: '$i'"
- return 1
- else
- param4="-t mangle ${ipInsertOption} ${iptPrefix}_${chain} $dest -p $i"
- param6="-t mangle ${ipInsertOption} ${iptPrefix}_${chain} $dest -p $i"
- fi
-
- if [ -n "$laddr" ]; then
- if [ "${laddr:0:1}" = "!" ]; then
- negation='!'; value="${laddr:1}"
- else
- unset negation; value="$laddr";
- fi
- if is_phys_dev "$value"; then
- param4="$param4 $negation -m physdev --physdev-in ${value:1}"
- param6="$param6 $negation -m physdev --physdev-in ${value:1}"
- elif is_netmask "$value"; then
- local target='src' type='net'
- if ips 'create' "$iface" "$target" "$type" "$uid" "${name}: $laddr" && \
- ips 'add' "$iface" "$target" "$type" "$uid" "${name}: $laddr" "$value"; then
- param4="$param4 -m set $negation --match-set ${ipsPrefix}_${iface}_4_${target}_${type}_${uid} $target"
- param6="$param6 -m set $negation --match-set ${ipsPrefix}_${iface}_6_${target}_${type}_${uid} $target"
- else
- param4="$param4 $negation -s $value"
- param6="$param6 $negation -s $value"
- fi
- elif is_mac_address "$value"; then
- local target='src' type='mac'
- if ips 'create' "$iface" "$target" "$type" "$uid" "${name}: $laddr" && \
- ips 'add' "$iface" "$target" "$type" "$uid" "${name}: $laddr" "$value"; then
- param4="$param4 -m set $negation --match-set ${ipsPrefix}_${iface}_4_${target}_${type}_${uid} $target"
- param6="$param6 -m set $negation --match-set ${ipsPrefix}_${iface}_6_${target}_${type}_${uid} $target"
- else
- param4="$param4 -m mac $negation --mac-source $value"
- param6="$param6 -m mac $negation --mac-source $value"
- fi
- else
- local target='src' type='ip'
- if ips 'create' "$iface" "$target" "$type" "$uid" "${name}: $laddr" && \
- ips 'add' "$iface" "$target" "$type" "$uid" "${name}: $laddr" "$value"; then
- param4="$param4 -m set $negation --match-set ${ipsPrefix}_${iface}_4_${target}_${type}_${uid} $target"
- param6="$param6 -m set $negation --match-set ${ipsPrefix}_${iface}_6_${target}_${type}_${uid} $target"
- else
- local resolvedIP4 resolvedIP6
- resolvedIP4="$(resolveip_to_ipt4 "$value")"
- resolvedIP6="$(resolveip_to_ipt6 "$value")"
- if [ -z "$resolvedIP4" ] && [ -z "$resolvedIP6" ]; then
- state add 'errorSummary' 'errorFailedToResolve' "$value"
- fi
- param4="$param4 $negation -s $resolvedIP4"
- param6="$param6 $negation -s $resolvedIP6"
- fi
- fi
- fi
-
- if [ -n "$lport" ]; then
- if [ "${lport:0:1}" = "!" ]; then
- negation='!'; value="${lport:1}"
- else
- unset negation; value="$lport";
- fi
- param4="$param4 -m multiport $negation --sport ${value//-/:}"
- param6="$param6 -m multiport $negation --sport ${value//-/:}"
- fi
-
- if [ -n "$raddr" ]; then
- if [ "${raddr:0:1}" = "!" ]; then
- negation='!'; value="${raddr:1}"
- else
- unset negation; value="$raddr";
- fi
- if is_netmask "$value"; then
- local target='dst' type='net'
- if ips 'create' "$iface" "$target" "$type" "$uid" "${name}: $raddr" && \
- ips 'add' "$iface" "$target" "$type" "$uid" "${name}: $raddr" "$value"; then
- param4="$param4 -m set $negation --match-set ${ipsPrefix}_${iface}_4_${target}_${type}_${uid} $target"
- param6="$param6 -m set $negation --match-set ${ipsPrefix}_${iface}_6_${target}_${type}_${uid} $target"
- else
- param4="$param4 $negation -d $value"
- param6="$param6 $negation -d $value"
- fi
- elif is_domain "$value"; then
- local target='dst' type='ip'
- if resolver 'create_resolver_set' "$iface" "$target" "$type" "$uid" "${name}: $raddr" && \
- resolver 'add_resolver_element' "$iface" "$target" "$type" "$uid" "${name}: $raddr" "$value"; then
- param4="$param4 -m set $negation --match-set ${ipsPrefix}_${iface}_4_${target}_${type}_${uid} $target"
- param6="$param6 -m set $negation --match-set ${ipsPrefix}_${iface}_6_${target}_${type}_${uid} $target"
- elif ips 'create' "$iface" "$target" "$type" "$uid" "${name}: $raddr" && \
- ips 'add' "$iface" "$target" "$type" "$uid" "${name}: $raddr" "$value"; then
- param4="$param4 -m set $negation --match-set ${ipsPrefix}_${iface}_4_${target}_${type}_${uid} $target"
- param6="$param6 -m set $negation --match-set ${ipsPrefix}_${iface}_6_${target}_${type}_${uid} $target"
- else
- local resolvedIP4 resolvedIP6
- resolvedIP4="$(resolveip_to_ipt4 "$value")"
- resolvedIP6="$(resolveip_to_ipt6 "$value")"
- if [ -z "$resolvedIP4" ] && [ -z "$resolvedIP6" ]; then
- state add 'errorSummary' 'errorFailedToResolve' "$value"
- fi
- param4="$param4 $negation -d $resolvedIP4"
- param6="$param6 $negation -d $resolvedIP6"
- fi
- else
- local target='dst' type='ip'
- if ips 'create' "$iface" "$target" "$type" "$uid" "${name}: $raddr" && \
- ips 'add' "$iface" "$target" "$type" "$uid" "${name}: $raddr" "$value"; then
- param4="$param4 -m set $negation --match-set ${ipsPrefix}_${iface}_4_${target}_${type}_${uid} $target"
- param6="$param6 -m set $negation --match-set ${ipsPrefix}_${iface}_6_${target}_${type}_${uid} $target"
- else
- param4="$param4 $negation -d $value"
- param6="$param6 $negation -d $value"
- fi
- fi
- fi
-
- if [ -n "$rport" ]; then
- if [ "${rport:0:1}" = "!" ]; then
- negation='!'; value="${rport:1}"
- else
- unset negation; value="$rport";
- fi
- param4="$param4 -m multiport $negation --dport ${value//-/:}"
- param6="$param6 -m multiport $negation --dport ${value//-/:}"
- fi
-
- if [ -n "$name" ]; then
- param4="$param4 -m comment --comment $(str_extras_to_underscore "$name")"
- param6="$param6 -m comment --comment $(str_extras_to_underscore "$name")"
- fi
-
- local ipv4_error='0' ipv6_error='0'
- if [ "$param4" = "$param6" ]; then
- ipt4 "$param4" || ipv4_error='1'
- else
- ipt4 "$param4" || ipv4_error='1'
- ipt6 "$param6" || ipv6_error='1'
- fi
-
- if [ -n "$ipv6_enabled" ] && [ "$ipv4_error" -eq '1' ] && [ "$ipv6_error" -eq '1' ]; then
- processPolicyError='true'
- state add 'errorSummary' 'errorPolicyProcessInsertionFailed' "$name"
- state add 'errorSummary' 'errorPolicyProcessCMD' "iptables $param4"
- state add 'errorSummary' 'errorPolicyProcessCMD' "iptables $param6"
- logger -t "$packageName" "ERROR: iptables $param4"
- logger -t "$packageName" "ERROR: iptables $param6"
- elif [ -z "$ipv6_enabled" ] && [ "$ipv4_error" -eq '1' ]; then
- processPolicyError='true'
- state add 'errorSummary' 'errorPolicyProcessInsertionFailedIpv4' "$name"
- state add 'errorSummary' 'errorPolicyProcessCMD' "iptables $param4"
- logger -t "$packageName" "ERROR: iptables $param4"
- fi
-
- done
-}
-policy_routing_nft() {
- local mark i nftInsertOption='add'
- local param4 param6 proto_i negation value dest
- local ip4Flag='ip' ip6Flag='ip6'
- local name="$1" iface="$2" laddr="$3" lport="$4" raddr="$5" rport="$6" proto chain uid="$9"
- proto="$(str_to_lower "$7")"
- chain="$(str_to_lower "$8")"
- chain="${chain:-prerouting}"
- mark=$(eval echo "\$mark_${iface//-/_}")
-
- if [ -z "$ipv6_enabled" ] && { is_ipv6 "$src_addr" || is_ipv6 "$dest_addr"; }; then
- processPolicyError='true'
- state add 'errorSummary' 'errorPolicyProcessNoIpv6' "$name"
- return 1
- fi
-
- if [ -n "$mark" ]; then
- dest="goto ${nftPrefix}_mark_${mark}"
- elif [ "$iface" = "ignore" ]; then
- dest="return"
- else
- processPolicyError='true'
- state add 'errorSummary' 'errorPolicyProcessUnknownFwmark' "$iface"
- return 1
- fi
-
- if is_family_mismatch "$src_addr" "$dest_addr"; then
- processPolicyError='true'
- state add 'errorSummary' 'errorPolicyProcessMismatchFamily' "${name}: '$laddr' '$raddr'"
- return 1
- fi
-
- if [ -z "$proto" ]; then
- if [ -n "${src_port}${dest_port}" ]; then
- proto='tcp udp'
- else
- proto='all'
- fi
- fi
-
- for proto_i in $proto; do
- unset param4
- unset param6
- if [ "$proto_i" = 'all' ]; then
- unset proto_i
- elif ! is_supported_protocol "$proto_i"; then
- processPolicyError='true'
- state add 'errorSummary' 'errorPolicyProcessUnknownProtocol' "${name}: '$proto_i'"
- return 1
- fi
-
- if [ -n "$src_addr" ]; then
- if [ "${src_addr:0:1}" = "!" ]; then
- negation='!='; value="${src_addr:1}"
- else
- unset negation; value="$src_addr";
- fi
- if is_phys_dev "$value"; then
- param4="$param4 iifname $negation ${value:1}"
- param6="$param6 iifname $negation ${value:1}"
- elif is_mac_address "$value"; then
- local target='src' type='mac'
- if nftset 'create' "$iface" "$target" "$type" "$uid" "$name" && \
- nftset 'add' "$iface" "$target" "$type" "$uid" "$name" "$value"; then
- param4="$param4 ether saddr $negation @${nftPrefix}_${iface}_4_${target}_${type}_${uid}"
- param6="$param6 ether saddr $negation @${nftPrefix}_${iface}_6_${target}_${type}_${uid}"
- else
- param4="$param4 ether saddr $negation $value"
- param6="$param6 ether saddr $negation $value"
- fi
- else
- local target='src' type='ip'
- if nftset 'create' "$iface" "$target" "$type" "$uid" "$name" && \
- nftset 'add' "$iface" "$target" "$type" "$uid" "$name" "$value"; then
- param4="$param4 $ip4Flag saddr $negation @${nftPrefix}_${iface}_4_${target}_${type}_${uid}"
- param6="$param6 $ip6Flag saddr $negation @${nftPrefix}_${iface}_6_${target}_${type}_${uid}"
- else
- param4="$param4 $ip4Flag saddr $negation $value"
- param6="$param6 $ip6Flag saddr $negation $value"
- fi
- fi
- fi
-
- if [ -n "$dest_addr" ]; then
- if [ "${dest_addr:0:1}" = "!" ]; then
- negation='!='; value="${dest_addr:1}"
- else
- unset negation; value="$dest_addr";
- fi
- if is_phys_dev "$value"; then
- param4="$param4 oifname $negation ${value:1}"
- param6="$param6 oifname $negation ${value:1}"
- elif is_domain "$value"; then
- local target='dst' type='ip'
- if resolver 'create_resolver_set' "$iface" "$target" "$type" "$uid" "$name" && \
- resolver 'add_resolver_element' "$iface" "$target" "$type" "$uid" "$name" "$value"; then
- param4="$param4 $ip4Flag daddr $negation @${nftPrefix}_${iface}_4_${target}_${type}_${uid}"
- param6="$param6 $ip6Flag daddr $negation @${nftPrefix}_${iface}_6_${target}_${type}_${uid}"
- elif nftset 'create' "$iface" "$target" "$type" "$uid" "$name" && \
- nftset 'add' "$iface" "$target" "$type" "$uid" "$name" "$value"; then
- param4="$param4 $ip4Flag daddr $negation @${nftPrefix}_${iface}_4_${target}_${type}_${uid}"
- param6="$param6 $ip6Flag daddr $negation @${nftPrefix}_${iface}_6_${target}_${type}_${uid}"
- else
- local resolvedIP4 resolvedIP6
- resolvedIP4="$(resolveip_to_nftset4 "$value")"
- resolvedIP6="$(resolveip_to_nftset6 "$value")"
- if [ -z "$resolvedIP4" ] && [ -z "$resolvedIP6" ]; then
- state add 'errorSummary' 'errorFailedToResolve' "$value"
- fi
- param4="$param4 $ip4Flag daddr $negation { $resolvedIP4 }"
- param6="$param6 $ip6Flag daddr $negation { $resolvedIP6 }"
- fi
- else
- local target='dst' type='ip'
- if nftset 'create' "$iface" "$target" "$type" "$uid" "$name" && \
- nftset 'add' "$iface" "$target" "$type" "$uid" "$name" "$value"; then
- param4="$param4 $ip4Flag daddr $negation @${nftPrefix}_${iface}_4_${target}_${type}_${uid}"
- param6="$param6 $ip6Flag daddr $negation @${nftPrefix}_${iface}_6_${target}_${type}_${uid}"
- else
- param4="$param4 $ip4Flag daddr $negation $value"
- param6="$param6 $ip6Flag daddr $negation $value"
- fi
- fi
- fi
-
- if [ -n "$src_port" ]; then
- if [ "${src_port:0:1}" = "!" ]; then
- negation='!='; value="${src_port:1}"
- else
- unset negation; value="$src_port";
- fi
- param4="$param4 ${proto_i:+$proto_i }sport $negation {$(ports_to_nftset "$value")}"
- param6="$param6 ${proto_i:+$proto_i }sport $negation {$(ports_to_nftset "$value")}"
- fi
-
- if [ -n "$dest_port" ]; then
- if [ "${dest_port:0:1}" = "!" ]; then
- negation='!='; value="${dest_port:1}"
- else
- unset negation; value="$dest_port";
- fi
- param4="$param4 ${proto_i:+$proto_i }dport $negation {$(ports_to_nftset "$value")}"
- param6="$param6 ${proto_i:+$proto_i }dport $negation {$(ports_to_nftset "$value")}"
- fi
-
- param4="$nftInsertOption rule inet $nftTable ${nftPrefix}_${chain} $param4 $dest comment \"$name\""
- param6="$nftInsertOption rule inet $nftTable ${nftPrefix}_${chain} $param6 $dest comment \"$name\""
-
- local ipv4_error='0' ipv6_error='0'
- if [ "$nftPrevParam4" != "$param4" ]; then
- nft4 "$param4" || ipv4_error='1'
- nftPrevParam4="$param4"
- fi
- if [ "$nftPrevParam6" != "$param6" ]; then
- nft6 "$param6" || ipv6_error='1'
- nftPrevParam6="$param6"
- fi
-
- if [ -n "$ipv6_enabled" ] && [ "$ipv4_error" -eq '1' ] && [ "$ipv6_error" -eq '1' ]; then
- processPolicyError='true'
- state add 'errorSummary' 'errorPolicyProcessInsertionFailed' "$name"
- state add 'errorSummary' 'errorPolicyProcessCMD' "nft $param4"
- state add 'errorSummary' 'errorPolicyProcessCMD' "nft $param6"
- logger -t "$packageName" "ERROR: nft $param4"
- logger -t "$packageName" "ERROR: nft $param6"
- elif [ -z "$ipv6_enabled" ] && [ "$ipv4_error" -eq '1' ]; then
- processPolicyError='true'
- state add 'errorSummary' 'errorPolicyProcessInsertionFailedIpv4' "$name"
- state add 'errorSummary' 'errorPolicyProcessCMD' "nft $param4"
- logger -t "$packageName" "ERROR: nft $param4"
- fi
-
- done
-}
-
-policy_process() {
- local i j uid="$9"
- if [ -z "$uid" ]; then # first non-recursive call
- [ "$enabled" -gt 0 ] || return 0
- unset processPolicyError
- uid="$1"
- if is_nft; then
- chain="$(str_to_lower "$chain")"
- else
- chain="$(str_to_upper "$chain")"
- fi
- proto="$(str_to_lower "$proto")"
- [ "$proto" = 'auto' ] && unset proto
- [ "$proto" = 'all' ] && unset proto
- output 2 "Routing '$name' via $interface "
- if [ -z "${src_addr}${src_port}${dest_addr}${dest_port}" ]; then
- state add 'errorSummary' 'errorPolicyNoSrcDest' "$name"
- output_fail; return 1;
- fi
- if [ -z "$interface" ]; then
- state add 'errorSummary' 'errorPolicyNoInterface' "$name"
- output_fail; return 1;
- fi
- if ! is_supported_interface "$interface"; then
- state add 'errorSummary' 'errorPolicyUnknownInterface' "$name"
- output_fail; return 1;
- fi
- src_port="${src_port// / }"; src_port="${src_port// /,}"; src_port="${src_port//,\!/ !}";
- dest_port="${dest_port// / }"; dest_port="${dest_port// /,}"; dest_port="${dest_port//,\!/ !}";
-# if is_nft; then
-# nftset 'flush' "$interface" "dst" "ip" "$uid"
-# nftset 'flush' "$interface" "src" "ip" "$uid"
-# nftset 'flush' "$interface" "src" "mac" "$uid"
-# else
-# ips 'flush' "$interface" "dst" "ip" "$uid"
-# ips 'flush' "$interface" "src" "ip" "$uid"
-# ips 'flush' "$interface" "src" "mac" "$uid"
-# fi
- policy_process "$name" "$interface" "$src_addr" "$src_port" "$dest_addr" "$dest_port" "$proto" "$chain" "$uid"
- if [ -n "$processPolicyError" ]; then
- output_fail
- else
- output_ok
- fi
- else # recursive call, get options from passed variables
- local name="$1" interface="$2" src_addr="$3" src_port="$4" dest_addr="$5" dest_port="$6" proto="$7" chain="$8"
- if str_contains "$src_addr" '[ ;\{\}]'; then
- for i in $(str_extras_to_space "$src_addr"); do [ -n "$i" ] && policy_process "$name" "$interface" "$i" "$src_port" "$dest_addr" "$dest_port" "$proto" "$chain" "$uid"; done
- elif str_contains "$src_port" '[ ;\{\}]'; then
- for i in $(str_extras_to_space "$src_port"); do [ -n "$i" ] && policy_process "$name" "$interface" "$src_addr" "$i" "$dest_addr" "$dest_port" "$proto" "$chain" "$uid"; done
- elif str_contains "$dest_addr" '[ ;\{\}]'; then
- for i in $(str_extras_to_space "$dest_addr"); do [ -n "$i" ] && policy_process "$name" "$interface" "$src_addr" "$src_port" "$i" "$dest_port" "$proto" "$chain" "$uid"; done
- elif str_contains "$dest_port" '[ ;\{\}]'; then
- for i in $(str_extras_to_space "$dest_port"); do [ -n "$i" ] && policy_process "$name" "$interface" "$src_addr" "$src_port" "$dest_addr" "$i" "$proto" "$chain" "$uid"; done
- elif str_contains "$proto" '[ ;\{\}]'; then
- for i in $(str_extras_to_space "$proto"); do [ -n "$i" ] && policy_process "$name" "$interface" "$src_addr" "$src_port" "$dest_addr" "$dest_port" "$i" "$chain" "$uid"; done
- else
- if is_tor "$interface"; then
- policy_routing_tor "$name" "$interface" "$src_addr" "$src_port" "$dest_addr" "$dest_port" "$proto" "$chain" "$uid"
- else
- policy_routing "$name" "$interface" "$src_addr" "$src_port" "$dest_addr" "$dest_port" "$proto" "$chain" "$uid"
- fi
- fi
- fi
-}
-
-interface_process_tor() { if is_nft; then interface_process_tor_nft "$@"; else interface_process_tor_iptables "$@"; fi; }
-interface_process_tor_iptables() {
- local s=0 iface="$1" action="$2"
- local displayText set_name4 set_name6
- local dnsPort trafficPort
- case "$action" in
- reload)
- displayText="${iface}/53->${dnsPort}/80,443->${trafficPort}"
- gatewaySummary="${gatewaySummary}${displayText}\\n"
- ;;
- destroy)
- for i in $chainsList; do
- i="$(str_to_upper "$i")"
- ipt -t nat -D "${i}" -m mark --mark "0x0/${fw_mask}" -j "${iptPrefix}_${i}"
- ipt -t nat -F "${iptPrefix}_${i}"; ipt -t nat -X "${iptPrefix}_${i}";
- done
- ;;
- create)
- output 2 "Creating TOR redirects "
- dnsPort="$(grep -m1 DNSPort /etc/tor/torrc | awk -F: '{print $2}')"
- trafficPort="$(grep -m1 TransPort /etc/tor/torrc | awk -F: '{print $2}')"
- dnsPort="${dnsPort:-9053}"; trafficPort="${trafficPort:-9040}";
- for i in $chainsList; do
- i="$(str_to_upper "$i")"
- ipt -t nat -N "${iptPrefix}_${i}"
- ipt -t nat -A "$i" -m mark --mark "0x0/${fw_mask}" -j "${iptPrefix}_${i}"
- done
- if resolver 'create_resolver_set' "$iface" 'dst' 'ip' && ips 'flush' "$iface" 'dst' 'ip'; then
- set_name4="${ipsPrefix}_${iface}_4_dst_ip"
- for i in $chainsList; do
- i="$(str_to_upper "$i")"
- ipt -t nat -I "${iptPrefix}_${i}" -p udp -m udp --dport 53 -m set --match-set "${set_name4}" dst -j REDIRECT --to-ports "$dnsPort" -m comment --comment "TorDNS-UDP" || s=1
- ipt -t nat -I "${iptPrefix}_${i}" -p tcp -m tcp --dport 80 -m set --match-set "${set_name4}" dst -j REDIRECT --to-ports "$trafficPort" -m comment --comment "TorHTTP-TCP" || s=1
- ipt -t nat -I "${iptPrefix}_${i}" -p udp -m udp --dport 80 -m set --match-set "${set_name4}" dst -j REDIRECT --to-ports "$trafficPort" -m comment --comment "TorHTTP-UDP" || s=1
- ipt -t nat -I "${iptPrefix}_${i}" -p tcp -m tcp --dport 443 -m set --match-set "${set_name4}" dst -j REDIRECT --to-ports "$trafficPort" -m comment --comment "TorHTTPS-TCP" || s=1
- ipt -t nat -I "${iptPrefix}_${i}" -p udp -m udp --dport 443 -m set --match-set "${set_name4}" dst -j REDIRECT --to-ports "$trafficPort" -m comment --comment "TorHTTPS-UDP" || s=1
- done
- else
- s=1
- fi
- displayText="${iface}/53->${dnsPort}/80,443->${trafficPort}"
- if [ "$s" -eq 0 ]; then
- gatewaySummary="${gatewaySummary}${displayText}\\n"
- output_ok
- else
- state add 'errorSummary' 'errorFailedSetup' "$displayText"
- output_fail
- fi
- ;;
- esac
- return $s
-}
-interface_process_tor_nft() {
- local s=0 iface="$1" action="$2"
- local displayText set_name4 set_name6
- local dnsPort trafficPort
- case "$action" in
- reload)
- displayText="${iface}/53->${dnsPort}/80,443->${trafficPort}"
- gatewaySummary="${gatewaySummary}${displayText}\\n"
- ;;
- destroy)
- ;;
- create)
- output 2 "Creating TOR redirects "
- dnsPort="$(grep -m1 DNSPort /etc/tor/torrc | awk -F: '{print $2}')"
- trafficPort="$(grep -m1 TransPort /etc/tor/torrc | awk -F: '{print $2}')"
- dnsPort="${dnsPort:-9053}"; trafficPort="${trafficPort:-9040}";
- if resolver 'create_resolver_set' "$iface" 'dst' 'ip' && nftset 'flush' "$iface" 'dst' 'ip'; then
- set_name4="${nftPrefix}_${iface}_4_dst_ip"
- set_name6="${nftPrefix}_${iface}_6_dst_ip"
- nft add rule inet "$nftTable" dstnat meta nfproto ipv4 ip daddr "@${set_name4}" udp dport 53 counter redirect to :"$dnsPort" comment "Tor-DNS-UDP-ipv4" || s=1
- nft add rule inet "$nftTable" dstnat meta nfproto ipv4 ip daddr "@${set_name4}" tcp dport 80 counter redirect to :"$trafficPort" comment "Tor-HTTP-TCP-ipv4" || s=1
- nft add rule inet "$nftTable" dstnat meta nfproto ipv4 ip daddr "@${set_name4}" udp dport 80 counter redirect to :"$trafficPort" comment "Tor-HTTP-UDP-ipv4" || s=1
- nft add rule inet "$nftTable" dstnat meta nfproto ipv4 ip daddr "@${set_name4}" tcp dport 443 counter redirect to :"$trafficPort" comment "Tor-HTTPS-TCP-ipv4" || s=1
- nft add rule inet "$nftTable" dstnat meta nfproto ipv4 ip daddr "@${set_name4}" udp dport 443 counter redirect to :"$trafficPort" comment "Tor-HTTPS-UDP-ipv4" || s=1
- nft6 add rule inet "$nftTable" dstnat meta nfproto ipv6 ip6 daddr "@${set_name6}" udp dport 53 counter redirect to :"$dnsPort" comment "Tor-DNS-UDP-ipv6" || s=1
- nft6 add rule inet "$nftTable" dstnat meta nfproto ipv6 ip6 daddr "@${set_name6}" tcp dport 80 counter redirect to :"$trafficPort" comment "Tor-HTTP-TCP-ipv6" || s=1
- nft6 add rule inet "$nftTable" dstnat meta nfproto ipv6 ip6 daddr "@${set_name6}" udp dport 80 counter redirect to :"$trafficPort" comment "Tor-HTTP-UDP-ipv6" || s=1
- nft6 add rule inet "$nftTable" dstnat meta nfproto ipv6 ip6 daddr "@${set_name6}" tcp dport 443 counter redirect to :"$trafficPort" comment "Tor-HTTPS-TCP-ipv6" || s=1
- nft6 add rule inet "$nftTable" dstnat meta nfproto ipv6 ip6 daddr "@${set_name6}" udp dport 443 counter redirect to :"$trafficPort" comment "Tor-HTTPS-UDP-ipv6" || s=1
- else
- s=1
- fi
- displayText="${iface}/53->${dnsPort}/80,443->${trafficPort}"
- if [ "$s" -eq 0 ]; then
- gatewaySummary="${gatewaySummary}${displayText}\\n"
- output_ok
- else
- state add 'errorSummary' 'errorFailedSetup' "$displayText"
- output_fail
- fi
- ;;
- esac
- return $s
-}
-
-interface_routing() {
- local action="$1" tid="$2" mark="$3" iface="$4" gw4="$5" dev="$6" gw6="$7" dev6="$8" priority="$9"
- local dscp s=0 i ipv4_error=1 ipv6_error=1
- if [ -z "$tid" ] || [ -z "$mark" ] || [ -z "$iface" ]; then
- state add 'errorSummary' 'errorInterfaceRoutingEmptyValues'
- return 1
- fi
- case "$action" in
- create)
- if is_netifd_table "$iface"; then
- ipv4_error=0
- $ip_bin rule del table "$tid" >/dev/null 2>&1
- $ip_bin -4 rule add fwmark "${mark}/${fw_mask}" table "$tid" priority "$priority" || ipv4_error=1
- if is_nft; then
- nft add chain inet "$nftTable" "${nftPrefix}_mark_${mark}" || ipv4_error=1
- nft add rule inet "$nftTable" "${nftPrefix}_mark_${mark} counter mark set mark and ${fw_maskXor} xor ${mark}" || ipv4_error=1
- nft add rule inet "$nftTable" "${nftPrefix}_mark_${mark} return" || ipv4_error=1
- else
- ipt -t mangle -N "${iptPrefix}_MARK_${mark}" || ipv4_error=1
- ipt -t mangle -A "${iptPrefix}_MARK_${mark}" -j MARK --set-xmark "${mark}/${fw_mask}" || ipv4_error=1
- ipt -t mangle -A "${iptPrefix}_MARK_${mark}" -j RETURN || ipv4_error=1
- fi
- if [ -n "$ipv6_enabled" ]; then
- ipv6_error=0
- $ip_bin -6 rule add fwmark "${mark}/${fw_mask}" table "$tid" priority "$priority" || ipv6_error=1
- fi
- else
- if ! grep -q "$tid ${ipTablePrefix}_${iface}" '/etc/iproute2/rt_tables'; then
- sed -i "/${ipTablePrefix}_${iface}/d" '/etc/iproute2/rt_tables'
- sync
- echo "$tid ${ipTablePrefix}_${iface}" >> '/etc/iproute2/rt_tables'
- sync
- fi
- $ip_bin rule del table "$tid" >/dev/null 2>&1
- $ip_bin route flush table "$tid" >/dev/null 2>&1
- if [ -n "$gw4" ] || [ "$strict_enforcement" -ne 0 ]; then
- ipv4_error=0
- if [ -z "$gw4" ]; then
- $ip_bin -4 route add unreachable default table "$tid" >/dev/null 2>&1 || ipv4_error=1
- else
- $ip_bin -4 route add default via "$gw4" dev "$dev" table "$tid" >/dev/null 2>&1 || ipv4_error=1
- fi
-# shellcheck disable=SC2086
- while read -r i; do
- i="$(echo "$i" | sed 's/ linkdown$//')"
- i="$(echo "$i" | sed 's/ onlink$//')"
- idev="$(echo "$i" | grep -Eso 'dev [^ ]*' | awk '{print $2}')"
- if ! is_supported_iface_dev "$idev"; then
- $ip_bin -4 route add $i table "$tid" >/dev/null 2>&1 || ipv4_error=1
- fi
- done << EOF
- $($ip_bin -4 route list table main)
-EOF
- $ip_bin -4 rule add fwmark "${mark}/${fw_mask}" table "$tid" priority "$priority" || ipv4_error=1
- if is_nft; then
- nft add chain inet "$nftTable" "${nftPrefix}_mark_${mark}" || ipv4_error=1
- nft add rule inet "$nftTable" "${nftPrefix}_mark_${mark} counter mark set mark and ${fw_maskXor} xor ${mark}" || ipv4_error=1
- nft add rule inet "$nftTable" "${nftPrefix}_mark_${mark} return" || ipv4_error=1
- else
- ipt -t mangle -N "${iptPrefix}_MARK_${mark}" || ipv4_error=1
- ipt -t mangle -A "${iptPrefix}_MARK_${mark}" -j MARK --set-xmark "${mark}/${fw_mask}" || ipv4_error=1
- ipt -t mangle -A "${iptPrefix}_MARK_${mark}" -j RETURN || ipv4_error=1
- fi
- fi
- if [ -n "$ipv6_enabled" ]; then
- ipv6_error=0
- if { [ -n "$gw6" ] && [ "$gw6" != "::/0" ]; } || [ "$strict_enforcement" -ne 0 ]; then
- if [ -z "$gw6" ] || [ "$gw6" = "::/0" ]; then
- $ip_bin -6 route add unreachable default table "$tid" >/dev/null 2>&1 || ipv6_error=1
- elif $ip_bin -6 route list table main | grep -q " dev $dev6 "; then
- while read -r i; do
- i="$(echo "$i" | sed 's/ linkdown$//')"
- i="$(echo "$i" | sed 's/ onlink$//')"
- # shellcheck disable=SC2086
- $ip_bin -6 route add $i table "$tid" >/dev/null 2>&1 || ipv6_error=1
- done << EOF
- $($ip_bin -6 route list table main | grep " dev $dev6 ")
-EOF
- else
- $ip_bin -6 route add "$($ip_bin -6 -o a show "$dev6" | awk '{print $4}')" dev "$dev6" table "$tid" >/dev/null 2>&1 || ipv6_error=1
- $ip_bin -6 route add default dev "$dev6" table "$tid" >/dev/null 2>&1 || ipv6_error=1
- fi
- fi
- $ip_bin -6 rule add fwmark "${mark}/${fw_mask}" table "$tid" priority "$priority" >/dev/null 2>&1 || ipv6_error=1
- fi
- fi
- if [ "$ipv4_error" -eq 0 ] || [ "$ipv6_error" -eq 0 ]; then
- dscp="$(uci -q get "${packageName}".config."${iface}"_dscp)"
- if is_nft; then
- if [ "${dscp:-0}" -ge 1 ] && [ "${dscp:-0}" -le 63 ]; then
- nft add rule inet "$nftTable" "${nftPrefix}_prerouting ip dscp ${dscp} goto ${nftPrefix}_mark_${mark}" || s=1
- fi
- if [ "$iface" = "$icmp_interface" ]; then
- nft add rule inet "$nftTable" "${nftPrefix}_output ip protocol icmp goto ${nftPrefix}_mark_${mark}" || s=1
- fi
- else
- if [ "${dscp:-0}" -ge 1 ] && [ "${dscp:-0}" -le 63 ]; then
- ipt -t mangle -I "${iptPrefix}_PREROUTING" -m dscp --dscp "${dscp}" -g "${iptPrefix}_MARK_${mark}" || s=1
- fi
- if [ "$iface" = "$icmp_interface" ]; then
- ipt -t mangle -I "${iptPrefix}_OUTPUT" -p icmp -g "${iptPrefix}_MARK_${mark}" || s=1
- fi
- fi
- else
- s=1
- fi
- return "$s"
- ;;
- create_user_set)
- if is_nft; then
- nftset 'create_user_set' "$iface" 'dst' 'ip' 'user' '' "$mark" || s=1
- nftset 'create_user_set' "$iface" 'src' 'ip' 'user' '' "$mark" || s=1
- nftset 'create_user_set' "$iface" 'src' 'mac' 'user' '' "$mark" || s=1
- else
- ips 'create_user_set' "$iface" 'dst' 'ip' 'user' '' "$mark" || s=1
- ips 'create_user_set' "$iface" 'src' 'ip' 'user' '' "$mark" || s=1
- ips 'create_user_set' "$iface" 'dst' 'net' 'user' '' "$mark" || s=1
- ips 'create_user_set' "$iface" 'src' 'net' 'user' '' "$mark" || s=1
- ips 'create_user_set' "$iface" 'src' 'mac' 'user' '' "$mark" || s=1
- fi
- return "$s"
- ;;
- delete|destroy)
- $ip_bin rule del table "$tid" >/dev/null 2>&1
- if ! is_netifd_table "$iface"; then
- $ip_bin route flush table "$tid" >/dev/null 2>&1
- sed -i "/${ipTablePrefix}_${iface}\$/d" '/etc/iproute2/rt_tables'
- sync
- fi
- return "$s"
- ;;
- reload_interface)
- is_netifd_table "$iface" && return 0;
- ipv4_error=0
- $ip_bin rule del table "$tid" >/dev/null 2>&1
- if ! is_netifd_table "$iface"; then
- $ip_bin route flush table "$tid" >/dev/null 2>&1
- fi
- if [ -n "$gw4" ] || [ "$strict_enforcement" -ne 0 ]; then
- if [ -z "$gw4" ]; then
- $ip_bin -4 route add unreachable default table "$tid" >/dev/null 2>&1 || ipv4_error=1
- else
- $ip_bin -4 route add default via "$gw4" dev "$dev" table "$tid" >/dev/null 2>&1 || ipv4_error=1
- fi
- $ip_bin rule add fwmark "${mark}/${fw_mask}" table "$tid" priority "$priority" || ipv4_error=1
- fi
- if [ -n "$ipv6_enabled" ]; then
- ipv6_error=0
- if { [ -n "$gw6" ] && [ "$gw6" != "::/0" ]; } || [ "$strict_enforcement" -ne 0 ]; then
- if [ -z "$gw6" ] || [ "$gw6" = "::/0" ]; then
- $ip_bin -6 route add unreachable default table "$tid" || ipv6_error=1
- elif $ip_bin -6 route list table main | grep -q " dev $dev6 "; then
- while read -r i; do
- # shellcheck disable=SC2086
- $ip_bin -6 route add $i table "$tid" >/dev/null 2>&1 || ipv6_error=1
- done << EOF
- $($ip_bin -6 route list table main | grep " dev $dev6 ")
-EOF
- else
- $ip_bin -6 route add "$($ip_bin -6 -o a show "$dev6" | awk '{print $4}')" dev "$dev6" table "$tid" >/dev/null 2>&1 || ipv6_error=1
- $ip_bin -6 route add default dev "$dev6" table "$tid" >/dev/null 2>&1 || ipv6_error=1
- fi
- fi
- $ip_bin -6 rule add fwmark "${mark}/${fw_mask}" table "$tid" priority "$priority" || ipv6_error=1
- fi
- if [ "$ipv4_error" -eq 0 ] || [ "$ipv6_error" -eq 0 ]; then
- s=0
- else
- s=1
- fi
- return "$s"
- ;;
- esac
-}
-
-json_add_gateway() {
- local action="$1" tid="$2" mark="$3" iface="$4" gw4="$5" dev4="$6" gw6="$7" dev6="$8" priority="$9" default="${10}"
- json_add_object ''
- json_add_string name "$iface"
- json_add_string device_ipv4 "$dev4"
- json_add_string gateway_ipv4 "$gw4"
- json_add_string device_ipv6 "$dev6"
- json_add_string gateway_ipv6 "$gw6"
- if [ -n "$default" ]; then
- json_add_boolean default true
- else
- json_add_boolean default false
- fi
- json_add_string action "$action"
- json_add_string table_id "$tid"
- json_add_string mark "$mark"
- json_add_string priority "$priority"
- json_close_object
-}
-
-interface_process() {
- local gw4 gw6 dev dev6 s=0 dscp iface="$1" action="$2" reloadedIface="$3"
- local displayText dispDev dispGw4 dispGw6 dispStatus
-
- if [ "$iface" = 'all' ] && [ "$action" = 'prepare' ]; then
- config_load 'network'
- ifaceMark="$(printf '0x%06x' "$wan_mark")"
- ifacePriority="$wan_ip_rules_priority"
- return 0
- fi
-
- is_supported_interface "$iface" || return 0
- is_wan6 "$iface" && return 0
- [ $((ifaceMark)) -gt $((fw_mask)) ] && return 1
-
- if is_ovpn "$iface" && ! is_valid_ovpn "$iface"; then
- : || state add 'warningSummary' 'warningInvalidOVPNConfig' "$iface"
- fi
-
- network_get_device dev "$iface"
- [ -z "$dev" ] && network_get_physdev dev "$iface"
- if is_wan "$iface" && [ -n "$wanIface6" ] && str_contains "$wanIface6" "$iface"; then
- network_get_device dev6 "$wanIface6"
- [ -z "$dev6" ] && network_get_physdev dev6 "$wanIface6"
- fi
-
- [ -z "$dev6" ] && dev6="$dev"
- [ -z "$ifaceMark" ] && ifaceMark="$(printf '0x%06x' "$wan_mark")"
- [ -z "$ifacePriority" ] && ifacePriority="$wan_ip_rules_priority"
-
- ifaceTableID="$(get_rt_tables_id "$iface")"
- [ -z "$ifaceTableID" ] && ifaceTableID="$(get_rt_tables_next_id)"
- eval "mark_${iface//-/_}"='$ifaceMark'
- eval "tid_${iface//-/_}"='$ifaceTableID'
- pbr_get_gateway gw4 "$iface" "$dev"
- pbr_get_gateway6 gw6 "$iface" "$dev6"
- dispGw4="${gw4:-0.0.0.0}"
- dispGw6="${gw6:-::/0}"
- [ "$iface" != "$dev" ] && dispDev="$dev"
- is_default_dev "$dev" && dispStatus="${__OK__}"
- displayText="${iface}/${dispDev:+$dispDev/}${dispGw4}${ipv6_enabled:+/$dispGw6}"
-
- case "$action" in
- create)
- output 2 "Setting up routing for '$displayText' "
- if interface_routing 'create' "$ifaceTableID" "$ifaceMark" "$iface" "$gw4" "$dev" "$gw6" "$dev6" "$ifacePriority"; then
- json_add_gateway 'create' "$ifaceTableID" "$ifaceMark" "$iface" "$gw4" "$dev" "$gw6" "$dev6" "$ifacePriority" "$dispStatus"
- gatewaySummary="${gatewaySummary}${displayText}${dispStatus:+ $dispStatus}\\n"
- output_ok
- else
- state add 'errorSummary' 'errorFailedSetup' "$displayText"
- output_fail
- fi
- ;;
- create_user_set)
- interface_routing 'create_user_set' "$ifaceTableID" "$ifaceMark" "$iface" "$gw4" "$dev" "$gw6" "$dev6" "$ifacePriority"
- ;;
- destroy)
- displayText="${iface}/${dispDev:+$dispDev/}${dispGw4}${ipv6_enabled:+/$dispGw6}"
- output 2 "Removing routing for '$displayText' "
- interface_routing 'destroy' "${ifaceTableID}" "${ifaceMark}" "${iface}"
- output_ok
- ;;
- reload)
- gatewaySummary="${gatewaySummary}${displayText}${dispStatus:+ $dispStatus}\\n"
- ;;
- reload_interface)
- if [ "$iface" = "$reloadedIface" ]; then
- output 2 "Reloading routing for '$displayText' "
- if interface_routing 'reload_interface' "$ifaceTableID" "$ifaceMark" "$iface" "$gw4" "$dev" "$gw6" "$dev6" "$ifacePriority"; then
- json_add_gateway 'reload_interface' "$ifaceTableID" "$ifaceMark" "$iface" "$gw4" "$dev" "$gw6" "$dev6" "$ifacePriority" "$dispStatus"
- gatewaySummary="${gatewaySummary}${displayText}${dispStatus:+ $dispStatus}\\n"
- output_ok
- else
- state add 'errorSummary' 'errorFailedReload' "$displayText"
- output_fail
- fi
- else
- gatewaySummary="${gatewaySummary}${displayText}${dispStatus:+ $dispStatus}\\n"
- fi
- ;;
- esac
-# ifaceTableID="$((ifaceTableID + 1))"
- ifaceMark="$(printf '0x%06x' $((ifaceMark + wan_mark)))"
- ifacePriority="$((ifacePriority + 1))"
- return $s
-}
-
-user_file_process() {
- local shellBin="${SHELL:-/bin/ash}"
- [ "$enabled" -gt 0 ] || return 0
- if [ ! -s "$path" ]; then
- state add 'errorSummary' 'errorUserFileNotFound' "$path"
- output_fail
- return 1
- fi
- if ! $shellBin -n "$path"; then
- state add 'errorSummary' 'errorUserFileSyntax' "$path"
- output_fail
- return 1
- fi
- output 2 "Running $path "
-# shellcheck disable=SC1090
- if ! . "$path"; then
- state add 'errorSummary' 'errorUserFileRunning' "$path"
- if grep -q -w 'curl' "$path" && ! is_present 'curl'; then
- state add 'errorSummary' 'errorUserFileNoCurl' "$path"
- fi
- output_fail
- return 1
- else
- output_ok
- return 0
- fi
-}
-
-boot() {
- ubus -t 30 wait_for network.interface 2>/dev/null
- rc_procd start_service 'on_boot'
-}
-
-on_firewall_reload() {
- if [ -e "$packageLockFile" ]; then # service is stopped, do not start it on firewall reload
- logger -t "$packageName" "Reload on firewall action aborted: service is stopped."
- return 0
- else
- rc_procd start_service 'on_firewall_reload' "$1"
- fi
-}
-on_interface_reload() {
- if [ -e "$packageLockFile" ]; then # service is stopped, do not start it on interface change
- logger -t "$packageName" "Reload on interface change aborted: service is stopped."
- return 0
- else
- rc_procd start_service 'on_interface_reload' "$1"
- fi
-}
-
-start_service() {
- local resolverStoredHash resolverNewHash i param="$1" reloadedIface
-
- load_environment 'on_start' "$(load_validate_config)" || return 1
- is_wan_up || return 1
- rm -f "$nftTempFile"
-
- case "$param" in
- on_boot)
- serviceStartTrigger='on_start'
- ;;
- on_firewall_reload)
- serviceStartTrigger='on_start'
- ;;
- on_interface_reload)
- reloadedIface="$2"
- if is_ovpn "$reloadedIface"; then
- logger -t "$packageName" "Updated interface is an OpenVPN tunnel, restarting."
- serviceStartTrigger='on_start'
- unset reloadedIface
- else
- serviceStartTrigger='on_interface_reload'
- fi
- ;;
- on_reload)
- serviceStartTrigger='on_reload'
- ;;
- on_restart)
- serviceStartTrigger='on_start'
- ;;
- esac
-
- if [ -n "$reloadedIface" ] && ! is_supported_interface "$reloadedIface"; then
- return 0
- fi
-
- if [ -n "$(ubus_get_status error)" ] || [ -n "$(ubus_get_status warning)" ]; then
- serviceStartTrigger='on_start'
- unset reloadedIface
- elif ! is_service_running; then
- serviceStartTrigger='on_start'
- unset reloadedIface
- elif [ -z "$(ubus_get_status gateway)" ]; then
- serviceStartTrigger='on_start'
- unset reloadedIface
- elif [ "$serviceStartTrigger" = 'on_interface_reload' ] && \
- [ -z "$(ubus_get_interface "$reloadedIface" 'gateway_4')" ] && \
- [ -z "$(ubus_get_interface "$reloadedIface" 'gateway_6')" ]; then
- serviceStartTrigger='on_start'
- unset reloadedIface
- else
- serviceStartTrigger="${serviceStartTrigger:-on_start}"
- fi
-
- procd_open_instance "main"
- procd_set_param command /bin/true
- procd_set_param stdout 1
- procd_set_param stderr 1
- procd_open_data
-
- case $serviceStartTrigger in
- on_interface_reload)
- output 1 "Reloading Interface: $reloadedIface "
- json_add_array 'gateways'
- interface_process 'all' 'prepare'
- config_foreach interface_process 'interface' 'reload_interface' "$reloadedIface"
- json_close_array
- output 1 '\n'
- ;;
- on_reload)
- traffic_killswitch 'insert'
- resolver 'store_hash'
- resolver 'cleanup_all'
- resolver 'configure'
- resolver 'init'
- cleanup_main_chains
- cleanup_sets
- if ! is_nft; then
- for i in $chainsList; do
- i="$(str_to_upper "$i")"
- ipt -t mangle -N "${iptPrefix}_${i}"
- ipt -t mangle "$rule_create_option" "$i" -m mark --mark "0x0/${fw_mask}" -j "${iptPrefix}_${i}"
- done
- fi
- json_add_array 'gateways'
- interface_process 'all' 'prepare'
- config_foreach interface_process 'interface' 'reload'
- interface_process_tor 'tor' 'destroy'
- is_tor_running && interface_process_tor 'tor' 'reload'
- json_close_array
- if is_config_enabled 'policy'; then
- output 1 'Processing policies '
- config_load "$packageName"
- config_foreach load_validate_policy 'policy' policy_process
- output 1 '\n'
- fi
- if is_config_enabled 'include'; then
- interface_process 'all' 'prepare'
- config_foreach interface_process 'interface' 'create_user_set'
- output 1 'Processing user file(s) '
- config_load "$packageName"
- config_foreach load_validate_include 'include' user_file_process
- output 1 '\n'
- fi
- resolver 'init_end'
- resolver 'compare_hash' && resolver 'restart'
- traffic_killswitch 'remove'
- ;;
- on_start|*)
- traffic_killswitch 'insert'
- resolver 'store_hash'
- resolver 'cleanup_all'
- resolver 'configure'
- resolver 'init'
- cleanup_main_chains
- cleanup_sets
- cleanup_marking_chains
- cleanup_rt_tables
- if ! is_nft; then
- for i in $chainsList; do
- i="$(str_to_upper "$i")"
- ipt -t mangle -N "${iptPrefix}_${i}"
- ipt -t mangle "$rule_create_option" "$i" -m mark --mark "0x0/${fw_mask}" -j "${iptPrefix}_${i}"
- done
- fi
- output 1 'Processing interfaces '
- json_add_array 'gateways'
- interface_process 'all' 'prepare'
- config_foreach interface_process 'interface' 'create'
- interface_process_tor 'tor' 'destroy'
- is_tor_running && interface_process_tor 'tor' 'create'
- json_close_array
- ip route flush cache
- output 1 '\n'
- if is_config_enabled 'policy'; then
- output 1 'Processing policies '
- config_load "$packageName"
- config_foreach load_validate_policy 'policy' policy_process
- output 1 '\n'
- fi
- if is_config_enabled 'include'; then
- interface_process 'all' 'prepare'
- config_foreach interface_process 'interface' 'create_user_set'
- output 1 'Processing user file(s) '
- config_load "$packageName"
- config_foreach load_validate_include 'include' user_file_process
- output 1 '\n'
- fi
- resolver 'init_end'
- resolver 'compare_hash' && resolver 'restart'
- traffic_killswitch 'remove'
- ;;
- esac
-
- if [ -z "$gatewaySummary" ]; then
- state add 'errorSummary' 'errorNoGateways'
- fi
- json_add_object 'status'
- [ -n "$gatewaySummary" ] && json_add_string 'gateways' "$gatewaySummary"
- [ -n "$errorSummary" ] && json_add_string 'errors' "$errorSummary"
- [ -n "$warningSummary" ] && json_add_string 'warnings' "$warningSummary"
- if [ "$strict_enforcement" -ne 0 ] && str_contains "$gatewaySummary" '0.0.0.0'; then
- json_add_string 'mode' "strict"
- fi
- json_close_object
- procd_close_data
- procd_close_instance
-}
-
-service_started() {
- if is_nft; then
- [ -n "$gatewaySummary" ] && output "$serviceName (nft) started with gateways:\\n${gatewaySummary}"
- else
- [ -n "$gatewaySummary" ] && output "$serviceName (iptables) started with gateways:\\n${gatewaySummary}"
- fi
- state print 'errorSummary'
- state print 'warningSummary'
- if [ -n "$errorSummary" ]; then
- return 2
- elif [ -n "$warningSummary" ]; then
- return 1
- else
- return 0
- fi
-}
-
-service_triggers() {
- local n
- load_environment 'on_triggers'
-# shellcheck disable=SC2034
- PROCD_RELOAD_DELAY=$(( procd_reload_delay * 1000 ))
- procd_open_validate
- load_validate_config
- load_validate_policy
- load_validate_include
- procd_close_validate
- procd_open_trigger
- procd_add_reload_trigger 'openvpn'
- procd_add_config_trigger "config.change" "${packageName}" /etc/init.d/${packageName} reload
- for n in $ifacesSupported; do
- procd_add_interface_trigger "interface.*" "$n" /etc/init.d/${packageName} on_interface_reload "$n"
- done
- procd_close_trigger
- if [ "$serviceStartTrigger" = 'on_start' ]; then
- output 3 "$serviceName monitoring interfaces: ${ifacesSupported}\\n"
- fi
-}
-
-stop_service() {
- local i
- load_environment 'on_stop'
- is_service_running || return 0
- traffic_killswitch 'insert'
- cleanup_main_chains
- cleanup_sets
- cleanup_marking_chains
- output 1 'Resetting interfaces '
- config_load 'network'
- config_foreach interface_process 'interface' 'destroy'
- interface_process_tor 'tor' 'destroy'
- cleanup_rt_tables
- output 1 "\\n"
- ip route flush cache
- unset ifaceMark
- unset ifaceTableID
- resolver 'store_hash'
- resolver 'cleanup_all'
- resolver 'compare_hash' && resolver 'restart'
- traffic_killswitch 'remove'
- if [ "$enabled" -ne 0 ]; then
- if is_nft; then
- output "$serviceName (nft) stopped "; output_okn;
- else
- output "$serviceName (iptables) stopped "; output_okn;
- fi
- fi
-}
-
-status_service() {
- local _SEPARATOR_='============================================================'
- load_environment 'on_status'
- if is_nft; then
- status_service_nft "$@"
- else
- status_service_iptables "$@"
- fi
-}
-
-status_service_nft() {
- local i dev dev6 wan_tid
-
- json_load "$(ubus call system board)"; json_select release; json_get_var dist distribution; json_get_var vers version
- if [ -n "$wanIface4" ]; then
- network_get_gateway wanGW4 "$wanIface4"
- network_get_device dev "$wanIface4"
- fi
- if [ -n "$wanIface6" ]; then
- network_get_device dev6 "$wanIface6"
- wanGW6=$($ip_bin -6 route show | grep -m1 " dev $dev6 " | awk '{print $1}')
- [ "$wanGW6" = "default" ] && wanGW6=$($ip_bin -6 route show | grep -m1 " dev $dev6 " | awk '{print $3}')
- fi
- while [ "${1:0:1}" = "-" ]; do param="${1//-/}"; eval "set_$param=1"; shift; done
- [ -e "/var/${packageName}-support" ] && rm -f "/var/${packageName}-support"
- status="$serviceName running on $dist $vers."
- [ -n "$wanIface4" ] && status="$status WAN (IPv4): ${wanIface4}/${dev}/${wanGW4:-0.0.0.0}."
- [ -n "$wanIface6" ] && status="$status WAN (IPv6): ${wanIface6}/${dev6}/${wanGW6:-::/0}."
-
- echo "$_SEPARATOR_"
- echo "$packageName - environment"
- echo "$status"
- echo "$_SEPARATOR_"
- dnsmasq --version 2>/dev/null | sed '/^$/,$d'
- echo "$_SEPARATOR_"
- echo "$packageName chains - policies"
- for i in forward input output prerouting postrouting; do
- "$nft" -a list table inet "$nftTable" | sed -n "/chain ${nftPrefix}_${i} {/,/\t}/p"
- done
- echo "$_SEPARATOR_"
- echo "$packageName chains - marking"
- for i in $(get_mark_nft_chains); do
- "$nft" -a list table inet "$nftTable" | sed -n "/chain ${i} {/,/\t}/p"
- done
- echo "$_SEPARATOR_"
- echo "$packageName nft sets"
- for i in $(get_nft_sets); do
- "$nft" -a list table inet "$nftTable" | sed -n "/set ${i} {/,/\t}/p"
- done
- if [ -s "$dnsmasqFile" ]; then
- echo "$_SEPARATOR_"
- echo "dnsmasq sets"
- cat "$dnsmasqFile"
- fi
-# echo "$_SEPARATOR_"
-# ip rule list | grep "${packageName}_"
- echo "$_SEPARATOR_"
- tableCount="$(grep -c "${packageName}_" /etc/iproute2/rt_tables)" || tableCount=0
- wan_tid=$(($(get_rt_tables_next_id)-tableCount))
- i=0; while [ $i -lt "$tableCount" ]; do
- echo "IPv4 table $((wan_tid + i)) route: $($ip_bin -4 route show table $((wan_tid + i)) | grep default)"
- echo "IPv4 table $((wan_tid + i)) rule(s):"
- $ip_bin -4 rule list table "$((wan_tid + i))"
- if [ -n "$ipv6_enabled" ]; then
- echo "IPv6 table $((wan_tid + i)) route: $($ip_bin -6 route show table $((wan_tid + i)) | grep default)"
- echo "IPv6 table $((wan_tid + i)) rule(s):"
- $ip_bin -6 route show table $((wan_tid + i))
- fi
- i=$((i + 1))
- done
-}
-
-status_service_iptables() {
- local dist vers out id s param status set_d set_p tableCount i=0 dev dev6 j wan_tid
-
- json_load "$(ubus call system board)"; json_select release; json_get_var dist distribution; json_get_var vers version
- if [ -n "$wanIface4" ]; then
- network_get_gateway wanGW4 "$wanIface4"
- network_get_device dev "$wanIface4"
- fi
- if [ -n "$wanIface6" ]; then
- network_get_device dev6 "$wanIface6"
- wanGW6=$($ip_bin -6 route show | grep -m1 " dev $dev6 " | awk '{print $1}')
- [ "$wanGW6" = "default" ] && wanGW6=$($ip_bin -6 route show | grep -m1 " dev $dev6 " | awk '{print $3}')
- fi
- while [ "${1:0:1}" = "-" ]; do param="${1//-/}"; eval "set_$param=1"; shift; done
- [ -e "/var/${packageName}-support" ] && rm -f "/var/${packageName}-support"
- status="$serviceName running on $dist $vers."
- [ -n "$wanIface4" ] && status="$status WAN (IPv4): ${wanIface4}/${dev}/${wanGW4:-0.0.0.0}."
- [ -n "$wanIface6" ] && status="$status WAN (IPv6): ${wanIface6}/${dev6}/${wanGW6:-::/0}."
- {
- echo "$status"
- echo "$_SEPARATOR_"
- dnsmasq --version 2>/dev/null | sed '/^$/,$d'
- if [ -n "$1" ]; then
- echo "$_SEPARATOR_"
- echo "Resolving domains"
- for i in $1; do
- echo "$i: $(resolveip "$i" | tr '\n' ' ')"
- done
- fi
-
- echo "$_SEPARATOR_"
- echo "Routes/IP Rules"
- tableCount="$(grep -c "${packageName}_" /etc/iproute2/rt_tables)" || tableCount=0
- if [ -n "$set_d" ]; then route; else route | grep '^default'; fi
- if [ -n "$set_d" ]; then ip rule list; fi
- wan_tid=$(($(get_rt_tables_next_id)-tableCount))
- i=0; while [ $i -lt "$tableCount" ]; do
- echo "IPv4 table $((wan_tid + i)) route: $($ip_bin -4 route show table $((wan_tid + i)) | grep default)"
- echo "IPv4 table $((wan_tid + i)) rule(s):"
- $ip_bin -4 rule list table "$((wan_tid + i))"
- i=$((i + 1))
- done
-
- if [ -n "$ipv6_enabled" ]; then
- i=0; while [ $i -lt "$tableCount" ]; do
- $ip_bin -6 route show table $((wan_tid + i)) | while read -r param; do
- echo "IPv6 Table $((wan_tid + i)): $param"
- done
- i=$((i + 1))
- done
- fi
-
- for j in Mangle NAT; do
- if [ -z "$set_d" ]; then
- for i in $chainsList; do
- i="$(str_to_upper "$i")"
- if iptables -v -t "$(str_to_lower $j)" -S "${iptPrefix}_${i}" >/dev/null 2>&1; then
- echo "$_SEPARATOR_"
- echo "$j IP Table: $i"
- iptables -v -t "$(str_to_lower $j)" -S "${iptPrefix}_${i}"
- if [ -n "$ipv6_enabled" ]; then
- echo "$_SEPARATOR_"
- echo "$j IPv6 Table: $i"
- iptables -v -t "$(str_to_lower $j)" -S "${iptPrefix}_${i}"
- fi
- fi
- done
- else
- echo "$_SEPARATOR_"
- echo "$j IP Table"
- iptables -L -t "$(str_to_lower $j)"
- if [ -n "$ipv6_enabled" ]; then
- echo "$_SEPARATOR_"
- echo "$j IPv6 Table"
- iptables -L -t "$(str_to_lower $j)"
- fi
- fi
- i=0; ifaceMark="$wan_mark";
- while [ $i -lt "$tableCount" ]; do
- if iptables -v -t "$(str_to_lower $j)" -S "${iptPrefix}_MARK_${ifaceMark}" >/dev/null 2>&1; then
- echo "$_SEPARATOR_"
- echo "$j IP Table MARK Chain: ${iptPrefix}_MARK_${ifaceMark}"
- iptables -v -t "$(str_to_lower $j)" -S "${iptPrefix}_MARK_${ifaceMark}"
- ifaceMark="$(printf '0x%06x' $((ifaceMark + wan_mark)))";
- fi
- i=$((i + 1))
- done
- done
-
- echo "$_SEPARATOR_"
- echo "Current ipsets"
- ipset save
- if [ -s "$dnsmasqFile" ]; then
- echo "$_SEPARATOR_"
- echo "DNSMASQ sets"
- cat "$dnsmasqFile"
- fi
- if [ -s "$aghIpsetFile" ]; then
- echo "$_SEPARATOR_"
- echo "AdGuardHome sets"
- cat "$aghIpsetFile"
- fi
- echo "$_SEPARATOR_"
- } | tee -a /var/${packageName}-support
- if [ -n "$set_p" ]; then
- printf "%b" "Pasting to paste.ee... "
- if is_present 'curl' && is_variant_installed 'libopenssl' && is_installed 'ca-bundle'; then
- json_init; json_add_string "description" "${packageName}-support"
- json_add_array "sections"; json_add_object '0'
- json_add_string "name" "$(uci -q get system.@system[0].hostname)"
- json_add_string "contents" "$(cat /var/${packageName}-support)"
- json_close_object; json_close_array; payload=$(json_dump)
- out=$(curl -s -k "https://api.paste.ee/v1/pastes" -X "POST" -H "Content-Type: application/json" -H "X-Auth-Token:uVOJt6pNqjcEWu7qiuUuuxWQafpHhwMvNEBviRV2B" -d "$payload")
- json_load "$out"; json_get_var id id; json_get_var s success
- [ "$s" = "1" ] && printf "%b" "https://paste.ee/p/$id $__OK__\\n" || printf "%b" "$__FAIL__\\n"
- [ -e "/var/${packageName}-support" ] && rm -f "/var/${packageName}-support"
- else
- printf "%b" "${__FAIL__}\\n"
- printf "%b" "${_ERROR_}: The curl, libopenssl or ca-bundle packages were not found!\\nRun 'opkg update; opkg install curl libopenssl ca-bundle' to install them.\\n"
- fi
- else
- printf "%b" "Your support details have been logged to '/var/${packageName}-support'. $__OK__\\n"
- fi
-}
-
-# shellcheck disable=SC2120
-load_validate_config() {
- uci_load_validate "$packageName" "$packageName" "$1" "${2}${3:+ $3}" \
- 'enabled:bool:0' \
- 'procd_boot_delay:integer:0' \
- 'strict_enforcement:bool:1' \
- 'secure_reload:bool:0' \
- 'ipv6_enabled:bool:0' \
- 'resolver_set:or("", "none", "dnsmasq.ipset", "dnsmasq.nftset")' \
- 'verbosity:range(0,2):1' \
- "wan_mark:regex('0x[A-Fa-f0-9]{8}'):0x010000" \
- "fw_mask:regex('0x[A-Fa-f0-9]{8}'):0xff0000" \
- 'icmp_interface:or("", "tor", uci("network", "@interface"))' \
- 'ignored_interface:list(or("tor", uci("network", "@interface")))' \
- 'supported_interface:list(or("tor", uci("network", "@interface")))' \
- 'boot_timeout:integer:30' \
- 'wan_ip_rules_priority:uinteger:30000' \
- 'rule_create_option:or("", "add", "insert"):add' \
- 'procd_reload_delay:integer:0' \
- 'webui_supported_protocol:list(string)' \
- 'nft_user_set_policy:or("", "memory", "performance")'\
- 'nft_user_set_counter:bool:0'
-}
-
-# shellcheck disable=SC2120
-load_validate_policy() {
- local name
- local enabled
- local interface
- local proto
- local chain
- local src_addr
- local src_port
- local dest_addr
- local dest_port
- uci_load_validate "$packageName" 'policy' "$1" "${2}${3:+ $3}" \
- 'name:string:Untitled' \
- 'enabled:bool:1' \
- 'interface:or("ignore", "tor", uci("network", "@interface")):wan' \
- 'proto:or(string)' \
- 'chain:or("", "forward", "input", "output", "prerouting", "postrouting", "FORWARD", "INPUT", "OUTPUT", "PREROUTING", "POSTROUTING"):prerouting' \
- 'src_addr:list(neg(or(host,network,macaddr,string)))' \
- 'src_port:list(neg(or(portrange,string)))' \
- 'dest_addr:list(neg(or(host,network,string)))' \
- 'dest_port:list(neg(or(portrange,string)))'
-}
-
-# shellcheck disable=SC2120
-load_validate_include() {
- local path=
- local enabled=
- uci_load_validate "$packageName" 'include' "$1" "${2}${3:+ $3}" \
- 'path:file' \
- 'enabled:bool:0'
-}
--- /dev/null
+#!/bin/sh
+# shellcheck disable=SC2015,SC3037,SC3043
+
+readonly pbrFunctionsFile='/etc/init.d/pbr'
+if [ -s "$pbrFunctionsFile" ]; then
+# shellcheck source=../../etc/init.d/pbr
+ . "$pbrFunctionsFile"
+else
+ printf "%b: pbr init.d file (%s) not found! \n" '\033[0;31mERROR\033[0m' "$pbrFunctionsFile"
+fi
+
+# Transition resolver_set depending on dnsmasq support
+if [ "$(uci_get pbr config resolver_set)" != 'dnsmasq.ipset' ] && [ "$(uci_get pbr config resolver_set)" != 'adguardhome.ipset' ]; then
+ if check_agh_ipset; then
+ output "Setting resolver_set to 'adguardhome.ipset'... "
+ uci_set pbr config resolver_set 'adguardhome.ipset' && output_okn || output_failn
+ elif check_dnsmasq_ipset; then
+ output "Setting resolver_set to 'dnsmasq.ipset'... "
+ uci_set pbr config resolver_set 'dnsmasq.ipset' && output_okn || output_failn
+ else
+ output "Setting resolver_set to 'none'... "
+ uci_set pbr config resolver_set 'none' && output_okn || output_failn
+ fi
+ uci_commit pbr
+fi
+
+exit 0
--- /dev/null
+#!/bin/sh
+# shellcheck disable=SC3037,SC3043
+
+readonly pbrFunctionsFile='/etc/init.d/pbr'
+if [ -s "$pbrFunctionsFile" ]; then
+# shellcheck source=../../etc/init.d/pbr
+ . "$pbrFunctionsFile"
+else
+ printf "%b: pbr init.d file (%s) not found! \n" '\033[0;31mERROR\033[0m' "$pbrFunctionsFile"
+fi
+
+# shellcheck disable=SC2317
+pbr_iface_setup() {
+ local iface="${1}"
+ local proto
+ if is_supported_interface "${iface}"; then
+ output "Setting up ${packageName} routing tables for ${iface}... "
+ uci_set 'network' "${iface}" 'ip4table' "${ipTablePrefix}_${iface%6}"
+ uci_set 'network' "${iface}" 'ip6table' "${ipTablePrefix}_${iface%6}"
+ if ! grep -q -E -e "^[0-9]+\s+${ipTablePrefix}_${iface%6}$" "$rtTablesFile"; then
+ sed -i -e "\$a $(($(sort -r -n "$rtTablesFile" | grep -o -E -m 1 "^[0-9]+")+1))\t${ipTablePrefix}_${iface%6}" \
+ "$rtTablesFile"
+ fi
+ output_okbn
+ fi
+}
+
+sed -i "/${ipTablePrefix}_/d" "$rtTablesFile"
+sync
+config_load network
+config_foreach pbr_iface_setup interface
+uci_commit network
+sync
+output "Restarting network... "
+/etc/init.d/network restart
+output_okn
+
+exit 0
--- /dev/null
+#!/bin/sh
+# shellcheck disable=SC2015,SC3037,SC3043
+
+readonly pbrFunctionsFile='/etc/init.d/pbr'
+if [ -s "$pbrFunctionsFile" ]; then
+# shellcheck source=../../etc/init.d/pbr
+ . "$pbrFunctionsFile"
+else
+ printf "%b: pbr init.d file (%s) not found! \n" '\033[0;31mERROR\033[0m' "$pbrFunctionsFile"
+fi
+
+# Transition resolver_set depending on dnsmasq support
+if [ "$(uci_get pbr config resolver_set)" != 'dnsmasq.nftset' ]; then
+ if check_dnsmasq_nftset; then
+ output "Setting resolver_set to 'dnsmasq.nftset'... "
+ uci_set pbr config resolver_set 'dnsmasq.nftset' && output_okn || output_failn
+ elif check_agh_ipset; then
+ output "Setting resolver_set to 'adguardhome.ipset'... "
+ uci_set pbr config resolver_set 'adguardhome.ipset' && output_okn || output_failn
+ elif check_dnsmasq_ipset; then
+ output "Setting resolver_set to 'dnsmasq.ipset'... "
+ uci_set pbr config resolver_set 'dnsmasq.ipset' && output_okn || output_failn
+ else
+ output "Setting resolver_set to 'none'... "
+ uci_set pbr config resolver_set 'none' && output_okn || output_failn
+ fi
+ uci_commit pbr
+fi
+
+exit 0
PKG_NAME:=pdns
PKG_VERSION:=4.9.0
-PKG_RELEASE:=1
+PKG_RELEASE:=2
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
PKG_SOURCE_URL:=https://downloads.powerdns.com/releases/
--- /dev/null
+commit c6b1e59f3b413493551910a7d0a3e9206d488599
+Author: Chris Hofstaedtler <chris.hofstaedtler@deduktiva.com>
+Date: Sat Apr 6 23:51:35 2024 +0200
+
+ auth dnsproxy: fix build on s390x
+
+--- a/pdns/dnsproxy.cc
++++ b/pdns/dnsproxy.cc
+@@ -240,10 +240,11 @@ void DNSProxy::mainloop()
+ memcpy(&dHead, &buffer[0], sizeof(dHead));
+ {
+ auto conntrack = d_conntrack.lock();
+-#if BYTE_ORDER == BIG_ENDIAN
+- // this is needed because spoof ID down below does not respect the native byteorder
+- d.id = (256 * (uint16_t)buffer[1]) + (uint16_t)buffer[0];
+-#endif
++ if (BYTE_ORDER == BIG_ENDIAN) {
++ // this is needed because spoof ID down below does not respect the native byteorder
++ dHead.id = (256 * (uint16_t)buffer[1]) + (uint16_t)buffer[0];
++ }
++
+ auto iter = conntrack->find(dHead.id ^ d_xor);
+ if (iter == conntrack->end()) {
+ g_log << Logger::Error << "Discarding untracked packet from recursor backend with id " << (dHead.id ^ d_xor) << ". Conntrack table size=" << conntrack->size() << endl;
include $(TOPDIR)/rules.mk
PKG_NAME:=pppossh
-PKG_RELEASE:=3
+PKG_RELEASE:=4
PKG_MAINTAINER:=Yousong Zhou <yszhou4tech@gmail.com>
PKG_LICENSE:=GPLv2
This package will add the so-called `pppossh` protocol support to OpenWrt. The idea is mainly from [`pvpn` project](https://github.com/halhen/pvpn) (poor man's VPN over SSH).
-PPPoSSH is generally not considered a network setup for production use mainly due to the TCP-over-TCP styles of traffic transport, but it can be quite handy for personal use. And with what's already in OpenWrt, it is really easy and takes little extra space to configure it up running.
+PPPoSSH is generally not considered a network setup for production use mainly due to the TCP-over-TCP styles of traffic transport, but it can be quite handy for personal use. And with what's already in OpenWrt, it is really easy and takes little extra space to configure it up and running.
## Prerequisites and dependency.
- `ipaddr`, local ip address to be assigned.
- `peeraddr`, peer ip address to be assigned.
- `ssh_options`, extra options for the ssh client.
+- `peer_pppd_options`, extra options for the pppd command run on the peer side.
- `use_hostdep`, set it to `0` to disable the use of `proto_add_host_dependency`. This is mainly for the case that the appropriate route to `server` is not registered to `netifd` and thus causing a incorrect route being setup.
## Tips
To debug such problems, we can try adding `option pppd_optinos debug` to the interface config. In the above case, it's a LCP CCP configure rej (the CCP options struct is exactly 6 octets in size as indicated in source code `pppd/ccp.h`) and since the internet fee is not charged on the bytes transferred, I will just use `noccp` to disable the negotiation altogether.
-Also to optimize bulk transfer performance, you can try tweaking the ciphers. OpenSSH client does not support `none` cipher by default and you have to patch and install it for by yourself. Another option is to try ciphers like `arcfour` and `blowfish-cbc`. In my case, `arcfour` has the best throughput.
+Also to optimize bulk transfer performance, you can try tweaking the ciphers. OpenSSH client does not support `none` cipher by default and you have to patch and install it by yourself. Another option is to try ciphers like `arcfour` and `blowfish-cbc`. In my case, `arcfour` has the best throughput.
option ssh_options '-o "Ciphers arcfour"'
proto_pppossh_init_config() {
ppp_generic_init_config
- config_add_string server sshuser ipaddr peeraddr ssh_options
+ config_add_string server sshuser ipaddr peeraddr ssh_options peer_pppd_options
config_add_array 'identity:list(string)'
config_add_int port use_hostdep
available=1
local iface="$2"
local user="$(id -nu)"
local home=$(sh -c "echo ~$user")
- local server port sshuser ipaddr peeraddr ssh_options identity use_hostdep
+ local server port sshuser ipaddr peeraddr ssh_options peer_pppd_options identity use_hostdep
local ip fn errmsg opts pty
- json_get_vars port sshuser ipaddr peeraddr ssh_options use_hostdep
+ json_get_vars port sshuser ipaddr peeraddr ssh_options peer_pppd_options use_hostdep
json_get_var server server && {
[ -z "$use_hostdep" ] && use_hostdep=1
for ip in $(resolveip -t 5 "$server"); do
opts="$opts ${port:+-p $port}"
opts="$opts ${ssh_options}"
opts="$opts $sshuser@$server"
- pty="exec env 'HOME=$home' $SSH $opts pppd nodetach notty noauth"
+ pty="exec env 'HOME=$home' $SSH $opts pppd nodetach notty noauth $peer_pppd_options"
ppp_generic_setup "$config" noauth pty "$pty" "$ipaddr:$peeraddr"
}
prompt "Enable zstd stream compression"
default n
+ config RSYNC_lz4
+ bool
+ prompt "Enable lz4, extremely fast compression"
+ default n
+
+ config RSYNC_xxhash
+ bool
+ prompt "Enable xxhash, extremely fast hash"
+ default n
+
endif
include $(TOPDIR)/rules.mk
PKG_NAME:=rsync
-PKG_VERSION:=3.2.7
-PKG_RELEASE:=1
+PKG_VERSION:=3.3.0
+PKG_RELEASE:=2
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://download.samba.org/pub/$(PKG_NAME)/src
-PKG_HASH:=4e7d9d3f6ed10878c58c5fb724a67dacf4b6aac7340b13e488fb2dc41346f2bb
+PKG_HASH:=7399e9a6708c32d678a72a63219e96f23be0be2336e50fd1348498d07041df90
PKG_MAINTAINER:=Maxim Storchak <m.storchak@gmail.com>
PKG_LICENSE:=GPL-3.0-or-later
SECTION:=net
CATEGORY:=Network
SUBMENU:=File Transfer
- TITLE:=Fast remote file copy program (like rcp)
- DEPENDS:=+libpopt +zlib +RSYNC_xattr:libattr +RSYNC_acl:libacl +RSYNC_zstd:libzstd $(ICONV_DEPENDS)
+ TITLE:=an open source utility that provides fast incremental file transfer
+ DEPENDS:=+libpopt +zlib +RSYNC_xattr:libattr +RSYNC_acl:libacl +RSYNC_zstd:libzstd +RSYNC_xxhash:libxxhash +RSYNC_lz4:liblz4 $(ICONV_DEPENDS)
URL:=https://rsync.samba.org/
MENU:=1
endef
--without-included-zlib \
--disable-debug \
--disable-asm \
- --disable-lz4 \
--disable-locale \
--disable-md2man \
--disable-openssl \
--disable-simd \
--disable-roll-simd \
- --disable-xxhash \
--$(if $(CONFIG_BUILD_NLS),en,dis)able-iconv \
--$(if $(CONFIG_BUILD_NLS),en,dis)able-iconv-open \
--$(if $(CONFIG_RSYNC_zstd),en,dis)able-zstd \
+ --$(if $(CONFIG_RSYNC_lz4),en,dis)able-lz4 \
--$(if $(CONFIG_RSYNC_xattr),en,dis)able-xattr-support \
--$(if $(CONFIG_RSYNC_acl),en,dis)able-acl-support \
+ --$(if $(CONFIG_RSYNC_xxhash),en,dis)able-xxhash \
$(if $(CONFIG_IPV6),,--disable-ipv6)
define Package/rsyncd
include $(TOPDIR)/rules.mk
PKG_NAME:=snort3
-PKG_VERSION:=3.1.82.0
+PKG_VERSION:=3.1.84.0
PKG_RELEASE:=2
-PKG_SOURCE:=$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://github.com/snort3/snort3/archive/refs/tags/
-PKG_HASH:=64304315e1c172b80cb9fef8c27fa457357329ecf02ee27a6604a79fd6cfa10f
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_VERSION:=$(PKG_VERSION)
+PKG_SOURCE_URL:=https://github.com/snort3/snort3
+PKG_MIRROR_HASH:=ffa69fdd95c55a943ab4dd782923caf31937dd8ad29e202d7fe781373ed84444
PKG_MAINTAINER:=W. Michael Petullo <mike@flyn.org>, John Audia <therealgraysky@proton.me>
PKG_LICENSE:=GPL-2.0-only
DEPENDS:= \
+(TARGET_x86||TARGET_x86_64):hyperscan-runtime \
+(TARGET_x86||TARGET_x86_64):gperftools-runtime \
- +libstdcpp +libdaq3 +libdnet +libopenssl +libpcap +libpcre +libpthread \
+ +libstdcpp +libdaq3 +libdnet +libopenssl +libpcap +libpcre2 +libpthread \
+libuuid +zlib +libhwloc +libtirpc @HAS_LUAJIT_ARCH +luajit +libatomic \
+kmod-nft-queue +liblzma +ucode +ucode-mod-fs +ucode-mod-uci
TITLE:=Lightweight Network Intrusion Detection System
attacks.
endef
-# Hyperscan and gperftools only builds for x86
-ifdef CONFIG_TARGET_x86_64
- CMAKE_OPTIONS += -DHS_INCLUDE_DIRS=$(STAGING_DIR)/usr/include/hs
-endif
-
# Hyperscan and gperftools only builds for x86
ifdef CONFIG_TARGET_x86_64
CMAKE_OPTIONS += -DHS_INCLUDE_DIRS=$(STAGING_DIR)/usr/include/hs \
wrn(`Invalid item type '${type}', must be one of "enum", "range", "path" or "str".`);
return;
}
+ if (type == "enum") {
+ // Convert values to strings, so 'in' works in 'contains'.
+ values = map(values, function(i) { return "" + i; });
+ }
if (type == "range" && (length(values) != 2 || values[0] > values[1])) {
wrn(`A 'range' type item must have exactly 2 values in ascending order.`);
return;
nft_add_table() {
if [ "$(uci -q get snort.snort.method)" = "nfq" ]; then
- local options
+ local options=''
$VERBOSE && options='-e'
print nftables | nft $options -f $STDIN
$VERBOSE && nft list table inet snort
fi
if [ "$(uci -q get snort.snort.method)" = "nfq" ]; then
- local options
+ local options=''
local test_nft="${CONF_DIR}/test_conf.nft"
print nftables > "${test_nft}" || die "Errors during generation of nftables config"
$VERBOSE && options='-e'
--- a/src/network_inspectors/packet_capture/packet_capture.h
+++ b/src/network_inspectors/packet_capture/packet_capture.h
-@@ -21,6 +21,7 @@
- #define PACKET_CAPTURE_H
+@@ -22,6 +22,7 @@
+ #include <cstdint>
#include <string>
+#include <cstdint>
--- /dev/null
+From a71cca137eb33f659354ce0ebda4951cb26485df Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 6 Nov 2023 22:43:59 +0100
+Subject: [PATCH] core: convert project to PCRE2
+
+Convert project to PCRE2 as PCRE is EOL and won't receive any security
+updates anymore.
+
+PCRE2 changed some API and concept. Mainly there isn't the concept of
+study anymore, replaced by match_context concept and match_data is used
+instead of ovector to handle results. Because of this the scratcher is
+not needed anymore and is replaced by a simple function to setup the max
+ovector size on end module init.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ README.md | 17 +-
+ cmake/FindPCRE.cmake | 32 --
+ cmake/FindPCRE2.cmake | 32 ++
+ cmake/create_pkg_config.cmake | 4 +-
+ cmake/include_libraries.cmake | 2 +-
+ configure_cmake.sh | 16 +-
+ lua/balanced.lua | 2 +-
+ lua/max_detect.lua | 6 +-
+ lua/security.lua | 4 +-
+ snort.pc.in | 4 +-
+ src/CMakeLists.txt | 4 +-
+ src/detection/detection_module.cc | 48 +--
+ src/detection/detection_options.cc | 6 +-
+ src/ips_options/ips_options.cc | 4 +-
+ src/ips_options/ips_pcre.cc | 391 ++++++++----------
+ src/main/shell.cc | 9 +-
+ src/main/snort_config.h | 26 +-
+ .../appid/lua_detector_api.cc | 62 +--
+ src/parser/parse_rule.cc | 4 +-
+ src/parser/parse_stream.cc | 2 +-
+ src/search_engines/test/hyperscan_test.cc | 2 +-
+ src/utils/stats.cc | 6 +-
+ src/utils/stats.h | 6 +-
+ src/utils/util.cc | 8 +-
+ tools/snort2lua/config_states/config_api.cc | 12 +-
+ .../config_states/config_no_option.cc | 14 +-
+ .../config_states/config_one_int_option.cc | 24 +-
+ tools/snort2lua/rule_states/CMakeLists.txt | 2 +-
+ tools/snort2lua/rule_states/rule_api.cc | 4 +-
+ .../{rule_pcre.cc => rule_pcre2.cc} | 40 +-
+ .../snort2lua/rule_states/rule_sd_pattern.cc | 4 +-
+ 31 files changed, 393 insertions(+), 404 deletions(-)
+ delete mode 100644 cmake/FindPCRE.cmake
+ create mode 100644 cmake/FindPCRE2.cmake
+ rename tools/snort2lua/rule_states/{rule_pcre.cc => rule_pcre2.cc} (80%)
+
+--- a/README.md
++++ b/README.md
+@@ -8,13 +8,14 @@ topics:
+
+ ---
+
+-* [Overview](#overview)
+-* [Dependencies](#dependencies)
+-* [Download](#download)
+-* [Build Snort](#build-snort)
+-* [Run Snort](#run-snort)
+-* [Documentation](#documentation)
+-* [Squeal](#squeal)
++- [Snort++](#snort)
++- [OVERVIEW](#overview)
++- [DEPENDENCIES](#dependencies)
++- [DOWNLOAD](#download)
++- [BUILD SNORT](#build-snort)
++- [RUN SNORT](#run-snort)
++- [DOCUMENTATION](#documentation)
++- [SQUEAL](#squeal)
+
+ # OVERVIEW
+
+@@ -61,7 +62,7 @@ the latest:
+ * OpenSSL from https://www.openssl.org/source/ for SHA and MD5 file signatures,
+ the protected_content rule option, and SSL service detection
+ * pcap from http://www.tcpdump.org for tcpdump style logging
+-* pcre from http://www.pcre.org for regular expression pattern matching
++* pcre2 from http://www.pcre.org for regular expression pattern matching
+ * pkgconfig from https://www.freedesktop.org/wiki/Software/pkg-config/ to locate build dependencies
+ * zlib from http://www.zlib.net for decompression
+
+--- a/cmake/FindPCRE.cmake
++++ /dev/null
+@@ -1,32 +0,0 @@
+-# - Find pcre
+-# Find the native PCRE includes and library
+-#
+-# PCRE_INCLUDE_DIR - where to find pcre.h, etc.
+-# PCRE_LIBRARIES - List of libraries when using pcre.
+-# PCRE_FOUND - True if pcre found.
+-
+-set(ERROR_MESSAGE
+- "\n\tERROR! Libpcre library not found.
+- \tGet it from http://www.pcre.org\n"
+-)
+-
+-find_package(PkgConfig)
+-pkg_check_modules(PC_PCRE libpcre)
+-
+-# Use PCRE_INCLUDE_DIR_HINT and PCRE_LIBRARIES_DIR_HINT from configure_cmake.sh as primary hints
+-# and then package config information after that.
+-find_path(PCRE_INCLUDE_DIR pcre.h
+- HINTS ${PCRE_INCLUDE_DIR_HINT} ${PC_PCRE_INCLUDEDIR} ${PC_PCRE_INCLUDE_DIRS})
+-find_library(PCRE_LIBRARIES NAMES pcre
+- HINTS ${PCRE_LIBRARIES_DIR_HINT} ${PC_PCRE_LIBDIR} ${PC_PCRE_LIBRARY_DIRS})
+-
+-include(FindPackageHandleStandardArgs)
+-find_package_handle_standard_args(PCRE
+- REQUIRED_VARS PCRE_INCLUDE_DIR PCRE_LIBRARIES
+- FAIL_MESSAGE "${ERROR_MESSAGE}"
+-)
+-
+-mark_as_advanced(
+- PCRE_LIBRARIES
+- PCRE_INCLUDE_DIR
+-)
+--- /dev/null
++++ b/cmake/FindPCRE2.cmake
+@@ -0,0 +1,32 @@
++# - Find pcre2
++# Find the native PCRE2 includes and library
++#
++# PCRE2_INCLUDE_DIR - where to find pcre2.h, etc.
++# PCRE2_LIBRARIES - List of libraries when using pcre2.
++# PCRE2_FOUND - True if pcre2 found.
++
++set(ERROR_MESSAGE
++ "\n\tERROR! Libpcre2 library not found.
++ \tGet it from http://www.pcre.org\n"
++)
++
++find_package(PkgConfig)
++pkg_check_modules(PC_PCRE2 libpcre2-8)
++
++# Use PCRE2_INCLUDE_DIR_HINT and PCRE_LIBRARIES_DIR_HINT from configure_cmake.sh as primary hints
++# and then package config information after that.
++find_path(PCRE2_INCLUDE_DIR pcre2.h
++ HINTS ${PCRE2_INCLUDE_DIR_HINT} ${PC_PCRE2_INCLUDEDIR} ${PC_PCRE2_INCLUDE_DIRS})
++find_library(PCRE2_LIBRARIES NAMES pcre2-8
++ HINTS ${PCRE2_LIBRARIES_DIR_HINT} ${PC_PCRE2_LIBDIR} ${PC_PCRE2_LIBRARY_DIRS})
++
++include(FindPackageHandleStandardArgs)
++find_package_handle_standard_args(PCRE2-8
++ REQUIRED_VARS PCRE2_INCLUDE_DIR PCRE2_LIBRARIES
++ FAIL_MESSAGE "${ERROR_MESSAGE}"
++)
++
++mark_as_advanced(
++ PCRE2_LIBRARIES
++ PCRE2_INCLUDE_DIR
++)
+--- a/cmake/create_pkg_config.cmake
++++ b/cmake/create_pkg_config.cmake
+@@ -72,8 +72,8 @@ if(PCAP_INCLUDE_DIR)
+ set(PCAP_CPPFLAGS "-I${PCAP_INCLUDE_DIR}")
+ endif()
+
+-if(PCRE_INCLUDE_DIR)
+- set(PCRE_CPPFLAGS "-I${PCRE_INCLUDE_DIR}")
++if(PCRE2_INCLUDE_DIR)
++ set(PCRE2_CPPFLAGS "-I${PCRE2_INCLUDE_DIR}")
+ endif()
+
+ if(UUID_INCLUDE_DIR)
+--- a/cmake/include_libraries.cmake
++++ b/cmake/include_libraries.cmake
+@@ -8,7 +8,7 @@ find_package(HWLOC REQUIRED)
+ find_package(LuaJIT REQUIRED)
+ find_package(OpenSSL 1.1.1 REQUIRED)
+ find_package(PCAP REQUIRED)
+-find_package(PCRE REQUIRED)
++find_package(PCRE2 REQUIRED)
+ find_package(ZLIB REQUIRED)
+ if (ENABLE_UNIT_TESTS)
+ find_package(CppUTest REQUIRED)
+--- a/configure_cmake.sh
++++ b/configure_cmake.sh
+@@ -90,10 +90,10 @@ Optional Packages:
+ luajit include directory
+ --with-luajit-libraries=DIR
+ luajit library directory
+- --with-pcre-includes=DIR
+- libpcre include directory
+- --with-pcre-libraries=DIR
+- libpcre library directory
++ --with-pcre2-includes=DIR
++ libpcre2 include directory
++ --with-pcre2-libraries=DIR
++ libpcre2 library directory
+ --with-dnet-includes=DIR
+ libdnet include directory
+ --with-dnet-libraries=DIR
+@@ -417,11 +417,11 @@ while [ $# -ne 0 ]; do
+ --with-luajit-libraries=*)
+ append_cache_entry LUAJIT_LIBRARIES_DIR_HINT PATH $optarg
+ ;;
+- --with-pcre-includes=*)
+- append_cache_entry PCRE_INCLUDE_DIR_HINT PATH $optarg
++ --with-pcre2-includes=*)
++ append_cache_entry PCRE2_INCLUDE_DIR_HINT PATH $optarg
+ ;;
+- --with-pcre-libraries=*)
+- append_cache_entry PCRE_LIBRARIES_DIR_HINT PATH $optarg
++ --with-pcre2-libraries=*)
++ append_cache_entry PCRE2_LIBRARIES_DIR_HINT PATH $optarg
+ ;;
+ --with-dnet-includes=*)
+ append_cache_entry DNET_INCLUDE_DIR_HINT PATH $optarg
+--- a/lua/balanced.lua
++++ b/lua/balanced.lua
+@@ -5,7 +5,7 @@
+
+ arp_spoof = nil
+
+-detection = { pcre_override = false }
++detection = { pcre2_override = false }
+
+ http_inspect.request_depth = 300
+ http_inspect.response_depth = 500
+--- a/lua/max_detect.lua
++++ b/lua/max_detect.lua
+@@ -10,13 +10,13 @@ ftp_server.check_encrypted = true
+
+ detection =
+ {
+- pcre_match_limit = 3500,
+- pcre_match_limit_recursion = 3500,
++ pcre2_match_limit = 3500,
++ pcre2_match_limit_recursion = 3500,
+
+ -- enable for hyperscan for best throughput
+ -- use multiple packet threads for fast startup
+ --hyperscan_literals = true,
+- --pcre_to_regex = true
++ --pcre2_to_regex = true
+ }
+
+ http_inspect.decompress_pdf = true
+--- a/lua/security.lua
++++ b/lua/security.lua
+@@ -9,8 +9,8 @@ ftp_server.check_encrypted = true
+
+ detection =
+ {
+- pcre_match_limit = 3500,
+- pcre_match_limit_recursion = 3500
++ pcre2_match_limit = 3500,
++ pcre2_match_limit_recursion = 3500
+ }
+
+ http_inspect.decompress_pdf = true
+--- a/snort.pc.in
++++ b/snort.pc.in
+@@ -9,7 +9,7 @@ mandir=@mandir@
+ infodir=@infodir@
+
+ cpp_opts=DAQ LUAJIT
+-cpp_opts_other=DNET HWLOC HYPERSCAN LZMA OPENSSL PCAP PCRE UUID
++cpp_opts_other=DNET HWLOC HYPERSCAN LZMA OPENSSL PCAP PCRE2 UUID
+
+ PCAP_CPPFLAGS=@PCAP_CPPFLAGS@
+ LUAJIT_CPPFLAGS=@LUAJIT_CPPFLAGS@
+@@ -18,7 +18,7 @@ DAQ_CPPFLAGS=@DAQ_CPPFLAGS@
+ FLEX_CPPFLAGS=@FLEX_CPPFLAGS@
+ OPENSSL_CPPFLAGS=@OPENSSL_CPPFLAGS@
+ HWLOC_CPPFLAGS=@HWLOC_CPPFLAGS@
+-PCRE_CPPFLAGS=@PCRE_CPPFLAGS@
++PCRE2_CPPFLAGS=@PCRE2_CPPFLAGS@
+ LZMA_CPPFLAGS=@LZMA_CPPFLAGS@
+ HYPERSCAN_CPPFLAGS=@HYPERSCAN_CPPFLAGS@
+ UUID_CPPFLAGS=@UUID_CPPFLAGS@
+--- a/src/CMakeLists.txt
++++ b/src/CMakeLists.txt
+@@ -10,7 +10,7 @@ set(EXTERNAL_LIBRARIES
+ ${LUAJIT_LIBRARIES}
+ ${OPENSSL_CRYPTO_LIBRARY}
+ ${PCAP_LIBRARIES}
+- ${PCRE_LIBRARIES}
++ ${PCRE2_LIBRARIES}
+ ${ZLIB_LIBRARIES}
+ )
+
+@@ -21,7 +21,7 @@ set(EXTERNAL_INCLUDES
+ ${HWLOC_INCLUDE_DIRS}
+ ${OPENSSL_INCLUDE_DIR}
+ ${PCAP_INCLUDE_DIR}
+- ${PCRE_INCLUDE_DIR}
++ ${PCRE2_INCLUDE_DIR}
+ ${ZLIB_INCLUDE_DIRS}
+ )
+
+--- a/src/detection/detection_module.cc
++++ b/src/detection/detection_module.cc
+@@ -96,21 +96,21 @@ static const Parameter detection_params[
+ { "offload_threads", Parameter::PT_INT, "0:max32", "0",
+ "maximum number of simultaneous offloads (defaults to disabled)" },
+
+- { "pcre_enable", Parameter::PT_BOOL, nullptr, "true",
+- "enable pcre pattern matching" },
++ { "pcre2_enable", Parameter::PT_BOOL, nullptr, "true",
++ "enable pcre2 pattern matching" },
+
+- { "pcre_match_limit", Parameter::PT_INT, "0:max32", "1500",
+- "limit pcre backtracking, 0 = off" },
++ { "pcre2_match_limit", Parameter::PT_INT, "0:max32", "1500",
++ "limit pcre2 backtracking, 0 = off" },
+
+- { "pcre_match_limit_recursion", Parameter::PT_INT, "0:max32", "1500",
+- "limit pcre stack consumption, 0 = off" },
++ { "pcre2_match_limit_recursion", Parameter::PT_INT, "0:max32", "1500",
++ "limit pcre2 stack consumption, 0 = off" },
+
+- { "pcre_override", Parameter::PT_BOOL, nullptr, "true",
+- "enable pcre match limit overrides when pattern matching (ie ignore /O)" },
++ { "pcre2_override", Parameter::PT_BOOL, nullptr, "true",
++ "enable pcre2 match limit overrides when pattern matching (ie ignore /O)" },
+
+ #ifdef HAVE_HYPERSCAN
+- { "pcre_to_regex", Parameter::PT_BOOL, nullptr, "false",
+- "enable the use of regex instead of pcre for compatible expressions" },
++ { "pcre2_to_regex", Parameter::PT_BOOL, nullptr, "false",
++ "enable the use of regex instead of pcre2 for compatible expressions" },
+ #endif
+
+ { "enable_address_anomaly_checks", Parameter::PT_BOOL, nullptr, "false",
+@@ -221,13 +221,13 @@ bool DetectionModule::set(const char*, V
+ else if ( v.is("offload_threads") )
+ sc->offload_threads = v.get_uint32();
+
+- else if ( v.is("pcre_enable") )
+- v.update_mask(sc->run_flags, RUN_FLAG__NO_PCRE, true);
++ else if ( v.is("pcre2_enable") )
++ v.update_mask(sc->run_flags, RUN_FLAG__NO_PCRE2, true);
+
+- else if ( v.is("pcre_match_limit") )
+- sc->pcre_match_limit = v.get_uint32();
++ else if ( v.is("pcre2_match_limit") )
++ sc->pcre2_match_limit = v.get_uint32();
+
+- else if ( v.is("pcre_match_limit_recursion") )
++ else if ( v.is("pcre2_match_limit_recursion") )
+ {
+ // Cap the pcre recursion limit to not exceed the stack size.
+ //
+@@ -252,21 +252,21 @@ bool DetectionModule::set(const char*, V
+ if (max_rec < 0)
+ max_rec = 0;
+
+- sc->pcre_match_limit_recursion = v.get_uint32();
+- if (sc->pcre_match_limit_recursion > max_rec)
++ sc->pcre2_match_limit_recursion = v.get_uint32();
++ if (sc->pcre2_match_limit_recursion > max_rec)
+ {
+- sc->pcre_match_limit_recursion = max_rec;
+- LogMessage("Capping pcre_match_limit_recursion to %ld, thread stack_size %ld.\n",
+- sc->pcre_match_limit_recursion, thread_stack_size);
++ sc->pcre2_match_limit_recursion = max_rec;
++ LogMessage("Capping pcre2_match_limit_recursion to %ld, thread stack_size %llu.\n",
++ sc->pcre2_match_limit_recursion, thread_stack_size);
+ }
+ }
+
+- else if ( v.is("pcre_override") )
+- sc->pcre_override = v.get_bool();
++ else if ( v.is("pcre2_override") )
++ sc->pcre2_override = v.get_bool();
+
+ #ifdef HAVE_HYPERSCAN
+- else if ( v.is("pcre_to_regex") )
+- sc->pcre_to_regex = v.get_bool();
++ else if ( v.is("pcre2_to_regex") )
++ sc->pcre2_to_regex = v.get_bool();
+ #endif
+
+ else if ( v.is("enable_address_anomaly_checks") )
+--- a/src/detection/detection_options.cc
++++ b/src/detection/detection_options.cc
+@@ -595,7 +595,7 @@ int detection_option_node_evaluate(
+ {
+ if ( !child_node->is_relative )
+ {
+- // If it's a non-relative content or pcre, no reason
++ // If it's a non-relative content or pcre2, no reason
+ // to check again. Only increment result once.
+ // Should hit this condition on first loop iteration.
+ if ( loop_count == 1 )
+@@ -661,10 +661,10 @@ int detection_option_node_evaluate(
+ }
+
+ // If all children branches matched, we don't need to reeval any of
+- // the children so don't need to reeval this content/pcre rule
++ // the children so don't need to reeval this content/pcre2 rule
+ // option at a new offset.
+ // Else, reset the DOE ptr to last eval for offset/depth,
+- // distance/within adjustments for this same content/pcre rule option.
++ // distance/within adjustments for this same content/pcre2 rule option.
+ // If the node and its sub-tree propagate MATCH back,
+ // then all its continuations are recalled.
+ if ( result == node->num_children )
+--- a/src/ips_options/ips_options.cc
++++ b/src/ips_options/ips_options.cc
+@@ -72,7 +72,7 @@ extern const BaseApi* ips_ip_proto[];
+ extern const BaseApi* ips_isdataat[];
+ extern const BaseApi* ips_itype[];
+ extern const BaseApi* ips_msg[];
+-extern const BaseApi* ips_pcre[];
++extern const BaseApi* ips_pcre2[];
+ extern const BaseApi* ips_priority[];
+ extern const BaseApi* ips_raw_data[];
+ extern const BaseApi* ips_rem[];
+@@ -146,7 +146,7 @@ void load_ips_options()
+ PluginManager::load_plugins(ips_isdataat);
+ PluginManager::load_plugins(ips_itype);
+ PluginManager::load_plugins(ips_msg);
+- PluginManager::load_plugins(ips_pcre);
++ PluginManager::load_plugins(ips_pcre2);
+ PluginManager::load_plugins(ips_priority);
+ PluginManager::load_plugins(ips_raw_data);
+ PluginManager::load_plugins(ips_rem);
+--- a/src/ips_options/ips_pcre.cc
++++ b/src/ips_options/ips_pcre.cc
+@@ -23,7 +23,8 @@
+ #include "config.h"
+ #endif
+
+-#include <pcre.h>
++#define PCRE2_CODE_UNIT_WIDTH 8
++#include <pcre2.h>
+
+ #include <cassert>
+
+@@ -43,33 +44,31 @@
+
+ using namespace snort;
+
+-#ifndef PCRE_STUDY_JIT_COMPILE
+-#define PCRE_STUDY_JIT_COMPILE 0
++#ifndef PCRE2_STUDY_JIT_COMPILE
++#define PCRE2_STUDY_JIT_COMPILE 0
+ #endif
+
+ //#define NO_JIT // uncomment to disable JIT for Xcode
+
+ #ifdef NO_JIT
+-#define PCRE_STUDY_FLAGS 0
+-#define pcre_release(x) pcre_free(x)
++#define PCRE2_JIT 0
+ #else
+-#define PCRE_STUDY_FLAGS PCRE_STUDY_JIT_COMPILE
+-#define pcre_release(x) pcre_free_study(x)
++#define PCRE2_JIT PCRE2_STUDY_JIT_COMPILE
+ #endif
++#define pcre2_release(x) pcre2_code_free(x)
+
+ #define SNORT_PCRE_RELATIVE 0x00010 // relative to the end of the last match
+ #define SNORT_PCRE_INVERT 0x00020 // invert detect
+ #define SNORT_PCRE_ANCHORED 0x00040
+ #define SNORT_OVERRIDE_MATCH_LIMIT 0x00080 // Override default limits on match & match recursion
+
+-#define s_name "pcre"
++#define s_name "pcre2"
+ #define mod_regex_name "regex"
+
+-struct PcreData
++struct Pcre2Data
+ {
+- pcre* re; /* compiled regex */
+- pcre_extra* pe; /* studied regex foo */
+- bool free_pe;
++ pcre2_code* re; /* compiled regex */
++ pcre2_match_context* match_context; /* match_context for limits */
+ int options; /* sp_pcre specific options (relative & inverse) */
+ char* expression;
+ };
+@@ -83,36 +82,32 @@ struct PcreData
+ // by verify; search uses the value in snort conf
+ static int s_ovector_max = -1;
+
+-static unsigned scratch_index;
+-static ScratchAllocator* scratcher = nullptr;
+-
+-static THREAD_LOCAL ProfileStats pcrePerfStats;
++static THREAD_LOCAL ProfileStats pcre2PerfStats;
+
+ //-------------------------------------------------------------------------
+ // implementation foo
+ //-------------------------------------------------------------------------
+
+-static void pcre_capture(
+- const void* code, const void* extra)
++static void pcre2_capture(const void* code)
+ {
+ int tmp_ovector_size = 0;
+
+- pcre_fullinfo((const pcre*)code, (const pcre_extra*)extra,
+- PCRE_INFO_CAPTURECOUNT, &tmp_ovector_size);
++ pcre2_pattern_info((const pcre2_code *)code,
++ PCRE2_INFO_CAPTURECOUNT, &tmp_ovector_size);
+
+ if (tmp_ovector_size > s_ovector_max)
+ s_ovector_max = tmp_ovector_size;
+ }
+
+-static void pcre_check_anchored(PcreData* pcre_data)
++static void pcre2_check_anchored(Pcre2Data* pcre2_data)
+ {
+ int rc;
+ unsigned long int options = 0;
+
+- if ((pcre_data == nullptr) || (pcre_data->re == nullptr) || (pcre_data->pe == nullptr))
++ if ((pcre2_data == nullptr) || (pcre2_data->re == nullptr))
+ return;
+
+- rc = pcre_fullinfo(pcre_data->re, pcre_data->pe, PCRE_INFO_OPTIONS, (void*)&options);
++ rc = pcre2_pattern_info(pcre2_data->re, PCRE2_INFO_ARGOPTIONS, (void*)&options);
+ switch (rc)
+ {
+ /* pcre_fullinfo fails for the following:
+@@ -127,40 +122,41 @@ static void pcre_check_anchored(PcreData
+ /* This is the success code */
+ break;
+
+- case PCRE_ERROR_NULL:
+- ParseError("pcre_fullinfo: code and/or where were null.");
++ case PCRE2_ERROR_NULL:
++ ParseError("pcre2_fullinfo: code and/or where were null.");
+ return;
+
+- case PCRE_ERROR_BADMAGIC:
+- ParseError("pcre_fullinfo: compiled code didn't have correct magic.");
++ case PCRE2_ERROR_BADMAGIC:
++ ParseError("pcre2_fullinfo: compiled code didn't have correct magic.");
+ return;
+
+- case PCRE_ERROR_BADOPTION:
+- ParseError("pcre_fullinfo: option type is invalid.");
++ case PCRE2_ERROR_BADOPTION:
++ ParseError("pcre2_fullinfo: option type is invalid.");
+ return;
+
+ default:
+- ParseError("pcre_fullinfo: Unknown error code.");
++ ParseError("pcre2_fullinfo: Unknown error code.");
+ return;
+ }
+
+- if ((options & PCRE_ANCHORED) && !(options & PCRE_MULTILINE))
++ if ((options & PCRE2_ANCHORED) && !(options & PCRE2_MULTILINE))
+ {
+ /* This means that this pcre rule option shouldn't be EvalStatus
+ * even if any of it's relative children should fail to match.
+ * It is anchored to the cursor set by the previous cursor setting
+ * rule option */
+- pcre_data->options |= SNORT_PCRE_ANCHORED;
++ pcre2_data->options |= SNORT_PCRE_ANCHORED;
+ }
+ }
+
+-static void pcre_parse(const SnortConfig* sc, const char* data, PcreData* pcre_data)
++static void pcre2_parse(const SnortConfig* sc, const char* data, Pcre2Data* pcre2_data)
+ {
+- const char* error;
++ PCRE2_UCHAR error[128];
+ char* re, * free_me;
+ char* opts;
+ char delimit = '/';
+- int erroffset;
++ int errorcode;
++ PCRE2_SIZE erroffset;
+ int compile_flags = 0;
+
+ if (data == nullptr)
+@@ -180,7 +176,7 @@ static void pcre_parse(const SnortConfig
+
+ if (*re == '!')
+ {
+- pcre_data->options |= SNORT_PCRE_INVERT;
++ pcre2_data->options |= SNORT_PCRE_INVERT;
+ re++;
+ while (isspace((int)*re))
+ re++;
+@@ -212,7 +208,7 @@ static void pcre_parse(const SnortConfig
+ else if (*re != delimit)
+ goto syntax;
+
+- pcre_data->expression = snort_strdup(re);
++ pcre2_data->expression = snort_strdup(re);
+
+ /* find ending delimiter, trim delimit chars */
+ opts = strrchr(re, delimit);
+@@ -230,25 +226,25 @@ static void pcre_parse(const SnortConfig
+ {
+ switch (*opts)
+ {
+- case 'i': compile_flags |= PCRE_CASELESS; break;
+- case 's': compile_flags |= PCRE_DOTALL; break;
+- case 'm': compile_flags |= PCRE_MULTILINE; break;
+- case 'x': compile_flags |= PCRE_EXTENDED; break;
++ case 'i': compile_flags |= PCRE2_CASELESS; break;
++ case 's': compile_flags |= PCRE2_DOTALL; break;
++ case 'm': compile_flags |= PCRE2_MULTILINE; break;
++ case 'x': compile_flags |= PCRE2_EXTENDED; break;
+
+ /*
+ * these are pcre specific... don't work with perl
+ */
+- case 'A': compile_flags |= PCRE_ANCHORED; break;
+- case 'E': compile_flags |= PCRE_DOLLAR_ENDONLY; break;
+- case 'G': compile_flags |= PCRE_UNGREEDY; break;
++ case 'A': compile_flags |= PCRE2_ANCHORED; break;
++ case 'E': compile_flags |= PCRE2_DOLLAR_ENDONLY; break;
++ case 'G': compile_flags |= PCRE2_UNGREEDY; break;
+
+ /*
+- * these are snort specific don't work with pcre or perl
++ * these are snort specific don't work with pcre2 or perl
+ */
+- case 'R': pcre_data->options |= SNORT_PCRE_RELATIVE; break;
++ case 'R': pcre2_data->options |= SNORT_PCRE_RELATIVE; break;
+ case 'O':
+- if ( sc->pcre_override )
+- pcre_data->options |= SNORT_OVERRIDE_MATCH_LIMIT;
++ if ( sc->pcre2_override )
++ pcre2_data->options |= SNORT_OVERRIDE_MATCH_LIMIT;
+ break;
+
+ default:
+@@ -259,71 +255,68 @@ static void pcre_parse(const SnortConfig
+ }
+
+ /* now compile the re */
+- pcre_data->re = pcre_compile(re, compile_flags, &error, &erroffset, nullptr);
++ pcre2_data->re = pcre2_compile((PCRE2_SPTR)re, PCRE2_ZERO_TERMINATED, compile_flags, &errorcode, &erroffset, nullptr);
++
++ if (pcre2_data->re == nullptr)
++ {
++ pcre2_get_error_message(errorcode, error, 128);
++ ParseError(": pcre2 compile of '%s' failed at offset "
++ "%zu : %s", re, erroffset, error);
++ return;
++ }
+
+- if (pcre_data->re == nullptr)
++ /* now create match context */
++ pcre2_data->match_context = pcre2_match_context_create(NULL);
++ if(pcre2_data->match_context == NULL)
+ {
+- ParseError(": pcre compile of '%s' failed at offset "
+- "%d : %s", re, erroffset, error);
++ ParseError(": failed to allocate memory for match context");
+ return;
+ }
+
+ /* now study it... */
+- pcre_data->pe = pcre_study(pcre_data->re, PCRE_STUDY_FLAGS, &error);
++ if (PCRE2_JIT)
++ errorcode = pcre2_jit_compile(pcre2_data->re, PCRE2_JIT_COMPLETE);
+
+- if (pcre_data->pe)
++ if (PCRE2_JIT || errorcode)
+ {
+- if ((sc->get_pcre_match_limit() != 0) &&
+- !(pcre_data->options & SNORT_OVERRIDE_MATCH_LIMIT))
++ if ((sc->get_pcre2_match_limit() != 0) &&
++ !(pcre2_data->options & SNORT_OVERRIDE_MATCH_LIMIT))
+ {
+- if ( !(pcre_data->pe->flags & PCRE_EXTRA_MATCH_LIMIT) )
+- pcre_data->pe->flags |= PCRE_EXTRA_MATCH_LIMIT;
+-
+- pcre_data->pe->match_limit = sc->get_pcre_match_limit();
++ pcre2_set_match_limit(pcre2_data->match_context, sc->get_pcre2_match_limit());
+ }
+
+- if ((sc->get_pcre_match_limit_recursion() != 0) &&
+- !(pcre_data->options & SNORT_OVERRIDE_MATCH_LIMIT))
++ if ((sc->get_pcre2_match_limit_recursion() != 0) &&
++ !(pcre2_data->options & SNORT_OVERRIDE_MATCH_LIMIT))
+ {
+- if ( !(pcre_data->pe->flags & PCRE_EXTRA_MATCH_LIMIT_RECURSION) )
+- pcre_data->pe->flags |= PCRE_EXTRA_MATCH_LIMIT_RECURSION;
+-
+- pcre_data->pe->match_limit_recursion =
+- sc->get_pcre_match_limit_recursion();
++ pcre2_set_match_limit(pcre2_data->match_context, sc->get_pcre2_match_limit_recursion());
+ }
+ }
+ else
+ {
+- if (!(pcre_data->options & SNORT_OVERRIDE_MATCH_LIMIT) &&
+- ((sc->get_pcre_match_limit() != 0) ||
+- (sc->get_pcre_match_limit_recursion() != 0)))
++ if (!(pcre2_data->options & SNORT_OVERRIDE_MATCH_LIMIT) &&
++ ((sc->get_pcre2_match_limit() != 0) ||
++ (sc->get_pcre2_match_limit_recursion() != 0)))
+ {
+- pcre_data->pe = (pcre_extra*)snort_calloc(sizeof(pcre_extra));
+- pcre_data->free_pe = true;
+-
+- if (sc->get_pcre_match_limit() != 0)
++ if (sc->get_pcre2_match_limit() != 0)
+ {
+- pcre_data->pe->flags |= PCRE_EXTRA_MATCH_LIMIT;
+- pcre_data->pe->match_limit = sc->get_pcre_match_limit();
++ pcre2_set_match_limit(pcre2_data->match_context, sc->get_pcre2_match_limit());
+ }
+
+- if (sc->get_pcre_match_limit_recursion() != 0)
++ if (sc->get_pcre2_match_limit_recursion() != 0)
+ {
+- pcre_data->pe->flags |= PCRE_EXTRA_MATCH_LIMIT_RECURSION;
+- pcre_data->pe->match_limit_recursion =
+- sc->get_pcre_match_limit_recursion();
++ pcre2_set_match_limit(pcre2_data->match_context, sc->get_pcre2_match_limit_recursion());
+ }
+ }
+ }
+
+- if (error != nullptr)
++ if (PCRE2_JIT && errorcode)
+ {
+- ParseError("pcre study failed : %s", error);
++ ParseError("pcre2 JIT failed : %s", error);
+ return;
+ }
+
+- pcre_capture(pcre_data->re, pcre_data->pe);
+- pcre_check_anchored(pcre_data);
++ pcre2_capture(pcre2_data->re);
++ pcre2_check_anchored(pcre2_data);
+
+ snort_free(free_me);
+ return;
+@@ -332,40 +325,44 @@ syntax:
+ snort_free(free_me);
+
+ // ensure integrity from parse error to fatal error
+- if ( !pcre_data->expression )
+- pcre_data->expression = snort_strdup("");
++ if ( !pcre2_data->expression )
++ pcre2_data->expression = snort_strdup("");
+
+- ParseError("unable to parse pcre %s", data);
++ ParseError("unable to parse pcre2 %s", data);
+ }
+
+ /*
+- * Perform a search of the PCRE data.
++ * Perform a search of the PCRE2 data.
+ * found_offset will be set to -1 when the find is unsuccessful OR the routine is inverted
+ */
+-static bool pcre_search(
++static bool pcre2_search(
+ Packet* p,
+- const PcreData* pcre_data,
++ const Pcre2Data* pcre2_data,
+ const uint8_t* buf,
+ unsigned len,
+ unsigned start_offset,
+ int& found_offset)
+ {
++ pcre2_match_data *match_data;
++ PCRE2_SIZE *ovector;
+ bool matched;
+
+ found_offset = -1;
+
+- std::vector<void *> ss = p->context->conf->state[get_instance_id()];
+- assert(ss[scratch_index]);
++ match_data = pcre2_match_data_create(p->context->conf->pcre2_ovector_size, NULL);
++ if (match_data == nullptr) {
++ pc.pcre2_error++;
++ return false;
++ }
+
+- int result = pcre_exec(
+- pcre_data->re, /* result of pcre_compile() */
+- pcre_data->pe, /* result of pcre_study() */
+- (const char*)buf, /* the subject string */
+- len, /* the length of the subject string */
+- start_offset, /* start at offset 0 in the subject */
+- 0, /* options(handled at compile time */
+- (int*)ss[scratch_index], /* vector for substring information */
+- p->context->conf->pcre_ovector_size); /* number of elements in the vector */
++ int result = pcre2_match(
++ pcre2_data->re, /* result of pcre_compile() */
++ (PCRE2_SPTR)buf, /* the subject string */
++ (PCRE2_SIZE)len, /* the length of the subject string */
++ (PCRE2_SIZE)start_offset, /* start at offset 0 in the subject */
++ 0, /* options(handled at compile time */
++ match_data, /* match data to store the match results */
++ pcre2_data->match_context); /* match context for limits */
+
+ if (result >= 0)
+ {
+@@ -390,34 +387,37 @@ static bool pcre_search(
+ * and a single int for scratch space.
+ */
+
+- found_offset = ((int*)ss[scratch_index])[1];
++ ovector = pcre2_get_ovector_pointer(match_data);
++ found_offset = ovector[1];
+ }
+- else if (result == PCRE_ERROR_NOMATCH)
++ else if (result == PCRE2_ERROR_NOMATCH)
+ {
+ matched = false;
+ }
+- else if (result == PCRE_ERROR_MATCHLIMIT)
++ else if (result == PCRE2_ERROR_MATCHLIMIT)
+ {
+- pc.pcre_match_limit++;
++ pc.pcre2_match_limit++;
+ matched = false;
+ }
+- else if (result == PCRE_ERROR_RECURSIONLIMIT)
++ else if (result == PCRE2_ERROR_RECURSIONLIMIT)
+ {
+- pc.pcre_recursion_limit++;
++ pc.pcre2_recursion_limit++;
+ matched = false;
+ }
+ else
+ {
+- pc.pcre_error++;
++ pc.pcre2_error++;
+ return false;
+ }
+
+ /* invert sense of match */
+- if (pcre_data->options & SNORT_PCRE_INVERT)
++ if (pcre2_data->options & SNORT_PCRE_INVERT)
+ {
+ matched = !matched;
+ }
+
++ pcre2_match_data_free(match_data);
++
+ return matched;
+ }
+
+@@ -425,14 +425,14 @@ static bool pcre_search(
+ // class methods
+ //-------------------------------------------------------------------------
+
+-class PcreOption : public IpsOption
++class Pcre2Option : public IpsOption
+ {
+ public:
+- PcreOption(PcreData* c) :
++ Pcre2Option(Pcre2Data* c) :
+ IpsOption(s_name, RULE_OPTION_TYPE_CONTENT)
+ { config = c; }
+
+- ~PcreOption() override;
++ ~Pcre2Option() override;
+
+ uint32_t hash() const override;
+ bool operator==(const IpsOption&) const override;
+@@ -446,17 +446,17 @@ public:
+ EvalStatus eval(Cursor&, Packet*) override;
+ bool retry(Cursor&, const Cursor&) override;
+
+- PcreData* get_data()
++ Pcre2Data* get_data()
+ { return config; }
+
+- void set_data(PcreData* pcre)
++ void set_data(Pcre2Data* pcre)
+ { config = pcre; }
+
+ private:
+- PcreData* config;
++ Pcre2Data* config;
+ };
+
+-PcreOption::~PcreOption()
++Pcre2Option::~Pcre2Option()
+ {
+ if ( !config )
+ return;
+@@ -464,21 +464,16 @@ PcreOption::~PcreOption()
+ if ( config->expression )
+ snort_free(config->expression);
+
+- if ( config->pe )
+- {
+- if ( config->free_pe )
+- snort_free(config->pe);
+- else
+- pcre_release(config->pe);
+- }
++ if ( config->match_context )
++ pcre2_match_context_free(config->match_context);
+
+ if ( config->re )
+- free(config->re); // external allocation
++ pcre2_code_free(config->re); // external allocation
+
+ snort_free(config);
+ }
+
+-uint32_t PcreOption::hash() const
++uint32_t Pcre2Option::hash() const
+ {
+ uint32_t a = 0, b = 0, c = 0;
+ int expression_len = strlen(config->expression);
+@@ -532,14 +527,14 @@ uint32_t PcreOption::hash() const
+ return c;
+ }
+
+-bool PcreOption::operator==(const IpsOption& ips) const
++bool Pcre2Option::operator==(const IpsOption& ips) const
+ {
+ if ( !IpsOption::operator==(ips) )
+ return false;
+
+- const PcreOption& rhs = (const PcreOption&)ips;
+- PcreData* left = config;
+- PcreData* right = rhs.config;
++ const Pcre2Option& rhs = (const Pcre2Option&)ips;
++ Pcre2Data* left = config;
++ Pcre2Data* right = rhs.config;
+
+ if (( strcmp(left->expression, right->expression) == 0) &&
+ ( left->options == right->options))
+@@ -550,13 +545,13 @@ bool PcreOption::operator==(const IpsOpt
+ return false;
+ }
+
+-IpsOption::EvalStatus PcreOption::eval(Cursor& c, Packet* p)
++IpsOption::EvalStatus Pcre2Option::eval(Cursor& c, Packet* p)
+ {
+ // cppcheck-suppress unreadVariable
+- RuleProfile profile(pcrePerfStats);
++ RuleProfile profile(pcre2PerfStats);
+
+- // short circuit this for testing pcre performance impact
+- if ( p->context->conf->no_pcre() )
++ // short circuit this for testing pcre2 performance impact
++ if ( p->context->conf->no_pcre2() )
+ return NO_MATCH;
+
+ unsigned pos = c.get_delta();
+@@ -570,7 +565,7 @@ IpsOption::EvalStatus PcreOption::eval(C
+
+ int found_offset = -1; // where is the ending location of the pattern
+
+- if ( pcre_search(p, config, c.buffer()+adj, c.size()-adj, pos, found_offset) )
++ if ( pcre2_search(p, config, c.buffer()+adj, c.size()-adj, pos, found_offset) )
+ {
+ if ( found_offset > 0 )
+ {
+@@ -585,17 +580,17 @@ IpsOption::EvalStatus PcreOption::eval(C
+ }
+
+ // we always advance by found_offset so no adjustments to cursor are done
+-// here; note also that this means relative pcre matches on overlapping
++// here; note also that this means relative pcre2 matches on overlapping
+ // patterns won't work. given the test pattern "ABABACD":
+ //
+ // ( sid:1; content:"ABA"; content:"C"; within:1; )
+-// ( sid:2; pcre:"/ABA/"; content:"C"; within:1; )
++// ( sid:2; pcre2:"/ABA/"; content:"C"; within:1; )
+ //
+ // sid 1 will fire but sid 2 will NOT. this example is easily fixed by
+-// using content, but more advanced pcre won't work for the relative /
++// using content, but more advanced pcre2 won't work for the relative /
+ // overlap case.
+
+-bool PcreOption::retry(Cursor&, const Cursor&)
++bool Pcre2Option::retry(Cursor&, const Cursor&)
+ {
+ if ((config->options & (SNORT_PCRE_INVERT | SNORT_PCRE_ANCHORED)))
+ {
+@@ -616,46 +611,43 @@ static const Parameter s_params[] =
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+ };
+
+-struct PcreStats
++struct Pcre2Stats
+ {
+- PegCount pcre_rules;
++ PegCount pcre2_rules;
+ #ifdef HAVE_HYPERSCAN
+- PegCount pcre_to_hyper;
++ PegCount pcre2_to_hyper;
+ #endif
+- PegCount pcre_native;
+- PegCount pcre_negated;
++ PegCount pcre2_native;
++ PegCount pcre2_negated;
+ };
+
+ const PegInfo pcre_pegs[] =
+ {
+- { CountType::SUM, "pcre_rules", "total rules processed with pcre option" },
++ { CountType::SUM, "pcre2_rules", "total rules processed with pcre2 option" },
+ #ifdef HAVE_HYPERSCAN
+- { CountType::SUM, "pcre_to_hyper", "total pcre rules by hyperscan engine" },
++ { CountType::SUM, "pcre2_to_hyper", "total pcre2 rules by hyperscan engine" },
+ #endif
+- { CountType::SUM, "pcre_native", "total pcre rules compiled by pcre engine" },
+- { CountType::SUM, "pcre_negated", "total pcre rules using negation syntax" },
++ { CountType::SUM, "pcre2_native", "total pcre2 rules compiled by pcre engine" },
++ { CountType::SUM, "pcre2_negated", "total pcre2 rules using negation syntax" },
+ { CountType::END, nullptr, nullptr }
+ };
+
+-PcreStats pcre_stats;
++Pcre2Stats pcre2_stats;
+
+ #define s_help \
+- "rule option for matching payload data with pcre"
++ "rule option for matching payload data with pcre2"
+
+-class PcreModule : public Module
++class Pcre2Module : public Module
+ {
+ public:
+- PcreModule() : Module(s_name, s_help, s_params)
++ Pcre2Module() : Module(s_name, s_help, s_params)
+ {
+ data = nullptr;
+- scratcher = new SimpleScratchAllocator(scratch_setup, scratch_cleanup);
+- scratch_index = scratcher->get_id();
+ }
+
+- ~PcreModule() override
++ ~Pcre2Module() override
+ {
+ delete data;
+- delete scratcher;
+ }
+
+ #ifdef HAVE_HYPERSCAN
+@@ -665,12 +657,12 @@ public:
+ bool end(const char*, int, SnortConfig*) override;
+
+ ProfileStats* get_profile() const override
+- { return &pcrePerfStats; }
++ { return &pcre2PerfStats; }
+
+ const PegInfo* get_pegs() const override;
+ PegCount* get_counts() const override;
+
+- PcreData* get_data();
++ Pcre2Data* get_data();
+
+ bool global_stats() const override
+ { return true; }
+@@ -682,31 +674,28 @@ public:
+ { return mod_regex; }
+
+ private:
+- PcreData* data;
++ Pcre2Data* data;
+ Module* mod_regex = nullptr;
+ std::string re;
+-
+- static bool scratch_setup(SnortConfig*);
+- static void scratch_cleanup(SnortConfig*);
+ };
+
+-PcreData* PcreModule::get_data()
++Pcre2Data* Pcre2Module::get_data()
+ {
+- PcreData* tmp = data;
++ Pcre2Data* tmp = data;
+ data = nullptr;
+ return tmp;
+ }
+
+-const PegInfo* PcreModule::get_pegs() const
++const PegInfo* Pcre2Module::get_pegs() const
+ { return pcre_pegs; }
+
+-PegCount* PcreModule::get_counts() const
+-{ return (PegCount*)&pcre_stats; }
++PegCount* Pcre2Module::get_counts() const
++{ return (PegCount*)&pcre2_stats; }
+
+ #ifdef HAVE_HYPERSCAN
+-bool PcreModule::begin(const char* name, int v, SnortConfig* sc)
++bool Pcre2Module::begin(const char* name, int v, SnortConfig* sc)
+ {
+- if ( sc->pcre_to_regex )
++ if ( sc->pcre2_to_regex )
+ {
+ if ( !mod_regex )
+ mod_regex = ModuleManager::get_module(mod_regex_name);
+@@ -718,7 +707,7 @@ bool PcreModule::begin(const char* name,
+ }
+ #endif
+
+-bool PcreModule::set(const char* name, Value& v, SnortConfig* sc)
++bool Pcre2Module::set(const char* name, Value& v, SnortConfig* sc)
+ {
+ assert(v.is("~re"));
+ re = v.get_string();
+@@ -729,50 +718,28 @@ bool PcreModule::set(const char* name, V
+ return true;
+ }
+
+-bool PcreModule::end(const char* name, int v, SnortConfig* sc)
++bool Pcre2Module::end(const char* name, int v, SnortConfig* sc)
+ {
+ if( mod_regex )
+ mod_regex = mod_regex->end(name, v, sc) ? mod_regex : nullptr;
+
+ if ( !mod_regex )
+ {
+- data = (PcreData*)snort_calloc(sizeof(*data));
+- pcre_parse(sc, re.c_str(), data);
++ data = (Pcre2Data*)snort_calloc(sizeof(*data));
++ pcre2_parse(sc, re.c_str(), data);
+ }
+
+- return true;
+-}
+-
+-bool PcreModule::scratch_setup(SnortConfig* sc)
+-{
+- if ( s_ovector_max < 0 )
+- return false;
+-
+ // The pcre_fullinfo() function can be used to find out how many
+ // capturing subpatterns there are in a compiled pattern. The
+ // smallest size for ovector that will allow for n captured
+ // substrings, in addition to the offsets of the substring matched
+ // by the whole pattern is 3(n+1).
+-
+- sc->pcre_ovector_size = 3 * (s_ovector_max + 1);
+- s_ovector_max = -1;
+-
+- for ( unsigned i = 0; i < sc->num_slots; ++i )
+- {
+- std::vector<void *>& ss = sc->state[i];
+- ss[scratch_index] = snort_calloc(sc->pcre_ovector_size, sizeof(int));
++ if ( s_ovector_max >= 0 ) {
++ sc->pcre2_ovector_size = 3 * (s_ovector_max + 1);
++ s_ovector_max = -1;
+ }
+- return true;
+-}
+
+-void PcreModule::scratch_cleanup(SnortConfig* sc)
+-{
+- for ( unsigned i = 0; i < sc->num_slots; ++i )
+- {
+- std::vector<void *>& ss = sc->state[i];
+- snort_free(ss[scratch_index]);
+- ss[scratch_index] = nullptr;
+- }
++ return true;
+ }
+
+ //-------------------------------------------------------------------------
+@@ -780,21 +747,21 @@ void PcreModule::scratch_cleanup(SnortCo
+ //-------------------------------------------------------------------------
+
+ static Module* mod_ctor()
+-{ return new PcreModule; }
++{ return new Pcre2Module; }
+
+ static void mod_dtor(Module* m)
+ { delete m; }
+
+-static IpsOption* pcre_ctor(Module* p, OptTreeNode* otn)
++static IpsOption* pcre2_ctor(Module* p, OptTreeNode* otn)
+ {
+- pcre_stats.pcre_rules++;
+- PcreModule* m = (PcreModule*)p;
++ pcre2_stats.pcre2_rules++;
++ Pcre2Module* m = (Pcre2Module*)p;
+
+ #ifdef HAVE_HYPERSCAN
+ Module* mod_regex = m->get_mod_regex();
+ if ( mod_regex )
+ {
+- pcre_stats.pcre_to_hyper++;
++ pcre2_stats.pcre2_to_hyper++;
+ const IpsApi* opt_api = IpsManager::get_option_api(mod_regex_name);
+ return opt_api->ctor(mod_regex, otn);
+ }
+@@ -803,16 +770,16 @@ static IpsOption* pcre_ctor(Module* p, O
+ UNUSED(otn);
+ #endif
+ {
+- pcre_stats.pcre_native++;
+- PcreData* d = m->get_data();
+- return new PcreOption(d);
++ pcre2_stats.pcre2_native++;
++ Pcre2Data* d = m->get_data();
++ return new Pcre2Option(d);
+ }
+ }
+
+-static void pcre_dtor(IpsOption* p)
++static void pcre2_dtor(IpsOption* p)
+ { delete p; }
+
+-static const IpsApi pcre_api =
++static const IpsApi pcre2_api =
+ {
+ {
+ PT_IPS_OPTION,
+@@ -832,17 +799,17 @@ static const IpsApi pcre_api =
+ nullptr,
+ nullptr,
+ nullptr,
+- pcre_ctor,
+- pcre_dtor,
++ pcre2_ctor,
++ pcre2_dtor,
+ nullptr
+ };
+
+ #ifdef BUILDING_SO
+ SO_PUBLIC const BaseApi* snort_plugins[] =
+ #else
+-const BaseApi* ips_pcre[] =
++const BaseApi* ips_pcre2[] =
+ #endif
+ {
+- &pcre_api.base,
++ &pcre2_api.base,
+ nullptr
+ };
+--- a/src/main/shell.cc
++++ b/src/main/shell.cc
+@@ -29,7 +29,8 @@
+ #include <fstream>
+ #include <openssl/crypto.h>
+ #include <pcap.h>
+-#include <pcre.h>
++#define PCRE2_CODE_UNIT_WIDTH 8
++#include <pcre2.h>
+ #include <stdexcept>
+ #include <vector>
+ #include <zlib.h>
+@@ -138,13 +139,17 @@ static void install_version_strings(lua_
+
+ static void install_dependencies_strings(Shell* sh, lua_State* L)
+ {
++
+ assert(dep_versions[0]);
+
++ const char pcre2_version[32] = { 0 };
+ std::vector<const char*> vs;
+ const char* ljv = LUAJIT_VERSION;
+ const char* osv = OpenSSL_version(SSLEAY_VERSION);
+ const char* lpv = pcap_lib_version();
+
++ pcre2_config(PCRE2_CONFIG_VERSION, (PCRE2_UCHAR8 *)pcre2_version);
++
+ while (*ljv and !isdigit(*ljv))
+ ++ljv;
+ while (*osv and !isdigit(*osv))
+@@ -156,7 +161,7 @@ static void install_dependencies_strings
+ vs.push_back(ljv);
+ vs.push_back(osv);
+ vs.push_back(lpv);
+- vs.push_back(pcre_version());
++ vs.push_back(pcre2_version);
+ vs.push_back(zlib_version);
+ #ifdef HAVE_HYPERSCAN
+ vs.push_back(hs_version());
+--- a/src/main/snort_config.h
++++ b/src/main/snort_config.h
+@@ -60,7 +60,7 @@ enum RunFlag
+ RUN_FLAG__PCAP_SHOW = 0x00001000,
+ RUN_FLAG__SHOW_FILE_CODES = 0x00002000,
+ RUN_FLAG__PAUSE = 0x00004000,
+- RUN_FLAG__NO_PCRE = 0x00008000,
++ RUN_FLAG__NO_PCRE2 = 0x00008000,
+
+ RUN_FLAG__DUMP_RULE_STATE = 0x00010000,
+ RUN_FLAG__DUMP_RULE_DEPS = 0x00020000,
+@@ -214,13 +214,13 @@ public:
+
+ //------------------------------------------------------
+ // detection module stuff
+- // FIXIT-L pcre_match_limit* are interdependent
++ // FIXIT-L pcre2_match_limit* are interdependent
+ // somehow a packet thread needs a much lower setting
+- long int pcre_match_limit = 1500;
+- long int pcre_match_limit_recursion = 1500;
++ long int pcre2_match_limit = 1500;
++ long int pcre2_match_limit_recursion = 1500;
+
+- int pcre_ovector_size = 0;
+- bool pcre_override = true;
++ int pcre2_ovector_size = 0;
++ bool pcre2_override = true;
+
+ uint32_t run_flags = 0;
+
+@@ -228,7 +228,7 @@ public:
+ unsigned offload_threads = 0; // disabled
+
+ bool hyperscan_literals = false;
+- bool pcre_to_regex = false;
++ bool pcre2_to_regex = false;
+
+ bool global_rule_state = false;
+ bool global_default_rule_state = true;
+@@ -600,8 +600,8 @@ public:
+ bool alert_before_pass() const
+ { return run_flags & RUN_FLAG__ALERT_BEFORE_PASS; }
+
+- bool no_pcre() const
+- { return run_flags & RUN_FLAG__NO_PCRE; }
++ bool no_pcre2() const
++ { return run_flags & RUN_FLAG__NO_PCRE2; }
+
+ bool conf_error_out() const
+ { return run_flags & RUN_FLAG__CONF_ERROR_OUT; }
+@@ -616,11 +616,11 @@ public:
+ uint8_t new_ttl() const
+ { return get_network_policy()->new_ttl; }
+
+- long int get_pcre_match_limit() const
+- { return pcre_match_limit; }
++ long int get_pcre2_match_limit() const
++ { return pcre2_match_limit; }
+
+- long int get_pcre_match_limit_recursion() const
+- { return pcre_match_limit_recursion; }
++ long int get_pcre2_match_limit_recursion() const
++ { return pcre2_match_limit_recursion; }
+
+ const ProfilerConfig* get_profiler() const
+ { return profiler; }
+--- a/src/network_inspectors/appid/lua_detector_api.cc
++++ b/src/network_inspectors/appid/lua_detector_api.cc
+@@ -25,7 +25,8 @@
+
+ #include "lua_detector_api.h"
+ #include <lua.hpp>
+-#include <pcre.h>
++#define PCRE2_CODE_UNIT_WIDTH 8
++#include <pcre2.h>
+ #include <unordered_map>
+
+ #include "detection/fp_config.h"
+@@ -714,7 +715,7 @@ static int detector_get_packet_direction
+ return 1;
+ }
+
+-/**Perform a pcre match with grouping. A simple regular expression match with no grouping
++/**Perform a pcre2 match with grouping. A simple regular expression match with no grouping
+ * can also be performed.
+ *
+ * @param Lua_State* - Lua state variable.
+@@ -723,41 +724,50 @@ static int detector_get_packet_direction
+ * @return matchedStrings/stack - matched strings are pushed on stack starting with group 0.
+ * There may be 0 or more strings.
+ */
+-static int detector_get_pcre_groups(lua_State* L)
++static int detector_get_pcre2_groups(lua_State* L)
+ {
+ auto& ud = *UserData<LuaObject>::check(L, DETECTOR, 1);
+ // Verify detector user data and that we are in packet context
+ LuaStateDescriptor* lsd = ud->validate_lua_state(true);
+
+- int ovector[OVECCOUNT];
+- const char* error;
+- int erroffset;
++ PCRE2_SIZE* ovector;
++ pcre2_match_data* match_data;
++ PCRE2_UCHAR error[128];
++ PCRE2_SIZE erroffset;
++ int errorcode;
+
+ const char* pattern = lua_tostring(L, 2);
+ unsigned int offset = lua_tonumber(L, 3); /*offset can be zero, no check necessary. */
+
+ /*compile the regular expression pattern, and handle errors */
+- pcre* re = pcre_compile(pattern, // the pattern
+- PCRE_DOTALL, // default options - dot matches all inc \n
+- &error, // for error message
+- &erroffset, // for error offset
+- nullptr); // use default character tables
++ pcre2_code* re = pcre2_compile((PCRE2_SPTR)pattern, // the pattern
++ PCRE2_ZERO_TERMINATED, // assume zero terminated strings
++ PCRE2_DOTALL, // default options - dot matches all inc \n
++ &errorcode, // for error message
++ &erroffset, // for error offset
++ nullptr); // use default character tables
+
+ if (re == nullptr)
+ {
+- appid_log(lsd->ldp.pkt, TRACE_ERROR_LEVEL, "PCRE compilation failed at offset %d: %s\n", erroffset, error);
++ pcre2_get_error_message(errorcode, error, 128);
++ appid_log(lsd->ldp.pkt, TRACE_ERROR_LEVEL, "PCRE2 compilation failed at offset %d: %s\n", erroffset, error);
++ return 0;
++ }
++
++ match_data = pcre2_match_data_create(OVECCOUNT, NULL);
++ if (match_data == nullptr) {
++ appid_log(lsd->ldp.pkt, TRACE_ERROR_LEVEL, "PCRE2 failed to allocate mem for match_data\n");
+ return 0;
+ }
+
+ /*pattern match against the subject string. */
+- int rc = pcre_exec(re, // compiled pattern
+- nullptr, // no extra data
+- (const char*)lsd->ldp.data, // subject string
+- lsd->ldp.size, // length of the subject
+- offset, // offset 0
+- 0, // default options
+- ovector, // output vector for substring information
+- OVECCOUNT); // number of elements in the output vector
++ int rc = pcre2_match(re, // compiled pattern
++ (PCRE2_SPTR)lsd->ldp.data, // subject string
++ (PCRE2_SIZE)lsd->ldp.size, // length of the subject
++ (PCRE2_SIZE)offset, // offset 0
++ 0, // default options
++ match_data, // match data for match results
++ NULL); // no match context
+
+ if (rc >= 0)
+ {
+@@ -771,10 +781,11 @@ static int detector_get_pcre_groups(lua_
+ if (!lua_checkstack(L, rc))
+ {
+ appid_log(lsd->ldp.pkt, TRACE_WARNING_LEVEL, "Cannot grow Lua stack by %d slots to hold "
+- "PCRE matches\n", rc);
++ "PCRE2 matches\n", rc);
+ return 0;
+ }
+
++ ovector = pcre2_get_ovector_pointer(match_data);
+ for (int i = 0; i < rc; i++)
+ {
+ lua_pushlstring(L, (const char*)lsd->ldp.data + ovector[2*i], ovector[2*i+1] -
+@@ -784,12 +795,13 @@ static int detector_get_pcre_groups(lua_
+ else
+ {
+ // log errors except no matches
+- if (rc != PCRE_ERROR_NOMATCH)
+- appid_log(lsd->ldp.pkt, TRACE_WARNING_LEVEL, "PCRE regular expression group match failed. rc: %d\n", rc);
++ if (rc != PCRE2_ERROR_NOMATCH)
++ appid_log(lsd->ldp.pkt, TRACE_WARNING_LEVEL, "PCRE2 regular expression group match failed. rc: %d\n", rc);
+ rc = 0;
+ }
+
+- pcre_free(re);
++ pcre2_match_data_free(match_data);
++ pcre2_code_free(re);
+ return rc;
+ }
+
+@@ -3229,7 +3241,7 @@ static const luaL_Reg detector_methods[]
+ { "getPacketSize", detector_get_packet_size },
+ { "getPacketDir", detector_get_packet_direction },
+ { "matchSimplePattern", detector_memcmp },
+- { "getPcreGroups", detector_get_pcre_groups },
++ { "getPcreGroups", detector_get_pcre2_groups },
+ { "getL4Protocol", detector_get_protocol_type },
+ { "getPktSrcAddr", detector_get_packet_src_addr },
+ { "getPktDstAddr", detector_get_packet_dst_addr },
+--- a/src/parser/parse_rule.cc
++++ b/src/parser/parse_rule.cc
+@@ -911,10 +911,10 @@ void parse_rule_dir(SnortConfig*, const
+ ParseError("illegal direction specifier: %s", s);
+ }
+
+-// Values of the rule options "pcre", "regex" and "sd_pattern" are already escaped
++// Values of the rule options "pcre2", "regex" and "sd_pattern" are already escaped
+ // They are not unescaped during the rule parsing
+ static bool is_already_escaped(const std::string& opt_key)
+-{ return opt_key == "pcre" or opt_key == "regex" or opt_key == "sd_pattern"; }
++{ return opt_key == "pcre2" or opt_key == "regex" or opt_key == "sd_pattern"; }
+
+ static std::string escape(const std::string& s)
+ {
+--- a/src/parser/parse_stream.cc
++++ b/src/parser/parse_stream.cc
+@@ -603,7 +603,7 @@ static bool exec(
+ // that individual rule options can do whatever
+ static int get_escape(const string& s)
+ {
+- if ( s == "pcre" )
++ if ( s == "pcre2" )
+ return 0; // no escape, option goes to ;
+
+ else if ( s == "regex" || s == "sd_pattern" )
+--- a/src/search_engines/test/hyperscan_test.cc
++++ b/src/search_engines/test/hyperscan_test.cc
+@@ -223,7 +223,7 @@ TEST(mpse_hs_match, regex)
+ CHECK(hits == 3);
+ }
+
+-TEST(mpse_hs_match, pcre)
++TEST(mpse_hs_match, pcre2)
+ {
+ Mpse::PatternDescriptor desc;
+
+--- a/src/utils/stats.cc
++++ b/src/utils/stats.cc
+@@ -227,9 +227,9 @@ const PegInfo pc_names[] =
+ { CountType::SUM, "offload_fallback", "fast pattern offload search fallback attempts" },
+ { CountType::SUM, "offload_failures", "fast pattern offload search failures" },
+ { CountType::SUM, "offload_suspends", "fast pattern search suspends due to offload context chains" },
+- { CountType::SUM, "pcre_match_limit", "total number of times pcre hit the match limit" },
+- { CountType::SUM, "pcre_recursion_limit", "total number of times pcre hit the recursion limit" },
+- { CountType::SUM, "pcre_error", "total number of times pcre returns error" },
++ { CountType::SUM, "pcre2_match_limit", "total number of times pcre2 hit the match limit" },
++ { CountType::SUM, "pcre2_recursion_limit", "total number of times pcre2 hit the recursion limit" },
++ { CountType::SUM, "pcre2_error", "total number of times pcre2 returns error" },
+ { CountType::SUM, "cont_creations", "total number of continuations created" },
+ { CountType::SUM, "cont_recalls", "total number of continuations recalled" },
+ { CountType::SUM, "cont_flows", "total number of flows using continuation" },
+--- a/src/utils/stats.h
++++ b/src/utils/stats.h
+@@ -60,9 +60,9 @@ struct PacketCount
+ PegCount offload_fallback;
+ PegCount offload_failures;
+ PegCount offload_suspends;
+- PegCount pcre_match_limit;
+- PegCount pcre_recursion_limit;
+- PegCount pcre_error;
++ PegCount pcre2_match_limit;
++ PegCount pcre2_recursion_limit;
++ PegCount pcre2_error;
+ PegCount cont_creations;
+ PegCount cont_recalls;
+ PegCount cont_flows;
+--- a/src/utils/util.cc
++++ b/src/utils/util.cc
+@@ -30,7 +30,8 @@
+ #include <netdb.h>
+ #include <openssl/crypto.h>
+ #include <pcap.h>
+-#include <pcre.h>
++#define PCRE2_CODE_UNIT_WIDTH 8
++#include <pcre2.h>
+ #include <pwd.h>
+ #include <sys/file.h>
+ #include <sys/resource.h>
+@@ -105,10 +106,13 @@ void StoreSnortInfoStrings()
+
+ int DisplayBanner()
+ {
++ PCRE2_UCHAR pcre2_version[32];
+ const char* ljv = LUAJIT_VERSION;
+ while ( *ljv && !isdigit(*ljv) )
+ ++ljv;
+
++ pcre2_config(PCRE2_CONFIG_VERSION, pcre2_version);
++
+ LogMessage("\n");
+ LogMessage(" ,,_ -*> Snort++ <*-\n");
+ #ifdef BUILD
+@@ -125,7 +129,7 @@ int DisplayBanner()
+ LogMessage(" Using LuaJIT version %s\n", ljv);
+ LogMessage(" Using %s\n", OpenSSL_version(SSLEAY_VERSION));
+ LogMessage(" Using %s\n", pcap_lib_version());
+- LogMessage(" Using PCRE version %s\n", pcre_version());
++ LogMessage(" Using PCRE version %s\n", pcre2_version);
+ LogMessage(" Using ZLIB version %s\n", zlib_version);
+ #ifdef HAVE_HYPERSCAN
+ LogMessage(" Using Hyperscan version %s\n", hs_version());
+--- a/tools/snort2lua/config_states/config_api.cc
++++ b/tools/snort2lua/config_states/config_api.cc
+@@ -105,13 +105,13 @@ extern const ConvertMap* min_ttl_map;
+ extern const ConvertMap* na_policy_mode_map;
+ extern const ConvertMap* new_ttl_map;
+ extern const ConvertMap* nolog_map;
+-extern const ConvertMap* nopcre_map;
++extern const ConvertMap* nopcre2_map;
+ extern const ConvertMap* no_promisc_map;
+ extern const ConvertMap* obfuscate_map;
+ extern const ConvertMap* order_map;
+ extern const ConvertMap* paf_max_map;
+-extern const ConvertMap* pcre_match_limit_map;
+-extern const ConvertMap* pcre_match_limit_recursion_map;
++extern const ConvertMap* pcre2_match_limit_map;
++extern const ConvertMap* pcre2_match_limit_recursion_map;
+ extern const ConvertMap* pkt_count_map;
+ extern const ConvertMap* ppm_map;
+ extern const ConvertMap* policy_id_map;
+@@ -224,13 +224,13 @@ const std::vector<const ConvertMap*> con
+ na_policy_mode_map,
+ new_ttl_map,
+ nolog_map,
+- nopcre_map,
++ nopcre2_map,
+ no_promisc_map,
+ obfuscate_map,
+ order_map,
+ paf_max_map,
+- pcre_match_limit_map,
+- pcre_match_limit_recursion_map,
++ pcre2_match_limit_map,
++ pcre2_match_limit_recursion_map,
+ pkt_count_map,
+ ppm_map,
+ policy_id_map,
+--- a/tools/snort2lua/config_states/config_no_option.cc
++++ b/tools/snort2lua/config_states/config_no_option.cc
+@@ -250,18 +250,18 @@ static const ConvertMap enable_mpls_over
+ const ConvertMap* enable_mpls_overlapping_ip_map = &enable_mpls_overlapping_ip_api;
+
+ /*************************************************
+- ******************** nopcre *******************
++ ******************** nopcre2 *******************
+ *************************************************/
+
+-static const std::string nopcre = "nopcre";
+-static const std::string pcre_enable = "pcre_enable";
+-static const ConvertMap nopcre_api =
++static const std::string nopcre2 = "nopcre2";
++static const std::string pcre2_enable = "pcre2_enable";
++static const ConvertMap nopcre2_api =
+ {
+- nopcre,
+- config_false_no_opt_ctor<& nopcre, & detection, & pcre_enable>
++ nopcre2,
++ config_false_no_opt_ctor<& nopcre2, & detection, & pcre2_enable>
+ };
+
+-const ConvertMap* nopcre_map = &nopcre_api;
++const ConvertMap* nopcre2_map = &nopcre2_api;
+
+ /*************************************************
+ ****************** obfuscate ******************
+--- a/tools/snort2lua/config_states/config_one_int_option.cc
++++ b/tools/snort2lua/config_states/config_one_int_option.cc
+@@ -217,30 +217,30 @@ static const ConvertMap new_ttl_api =
+ const ConvertMap* new_ttl_map = &new_ttl_api;
+
+ /*************************************************
+- ************** pcre_match_limit **************
++ ************** pcre2_match_limit **************
+ *************************************************/
+
+-static const std::string pcre_match_limit = "pcre_match_limit";
+-static const ConvertMap pcre_match_limit_api =
++static const std::string pcre2_match_limit = "pcre2_match_limit";
++static const ConvertMap pcre2_match_limit_api =
+ {
+- pcre_match_limit,
+- config_int_ctor<& pcre_match_limit, & detection>,
++ pcre2_match_limit,
++ config_int_ctor<& pcre2_match_limit, & detection>,
+ };
+
+-const ConvertMap* pcre_match_limit_map = &pcre_match_limit_api;
++const ConvertMap* pcre2_match_limit_map = &pcre2_match_limit_api;
+
+ /**************************************************
+- ********** pcre_match_limit_recursion **********
++ ********** pcre2_match_limit_recursion **********
+ **************************************************/
+
+-static const std::string pcre_match_limit_recursion = "pcre_match_limit_recursion";
+-static const ConvertMap pcre_match_limit_recursion_api =
++static const std::string pcre2_match_limit_recursion = "pcre_match_limit_recursion";
++static const ConvertMap pcre2_match_limit_recursion_api =
+ {
+- pcre_match_limit_recursion,
+- config_int_ctor<& pcre_match_limit_recursion, & detection>,
++ pcre2_match_limit_recursion,
++ config_int_ctor<& pcre2_match_limit_recursion, & detection>,
+ };
+
+-const ConvertMap* pcre_match_limit_recursion_map = &pcre_match_limit_recursion_api;
++const ConvertMap* pcre2_match_limit_recursion_map = &pcre2_match_limit_recursion_api;
+
+ /*************************************************
+ ****************** pkt_count *****************
+--- a/tools/snort2lua/rule_states/CMakeLists.txt
++++ b/tools/snort2lua/rule_states/CMakeLists.txt
+@@ -12,7 +12,7 @@ add_library( rule_states OBJECT
+ rule_http_encode.cc
+ rule_isdataat.cc
+ rule_metadata.cc
+- rule_pcre.cc
++ rule_pcre2.cc
+ rule_react.cc
+ rule_reference.cc
+ rule_replace.cc
+--- a/tools/snort2lua/rule_states/rule_api.cc
++++ b/tools/snort2lua/rule_states/rule_api.cc
+@@ -75,7 +75,7 @@ extern const ConvertMap* modbus_data_map
+ extern const ConvertMap* modbus_func_map;
+ extern const ConvertMap* modbus_unit_map;
+ extern const ConvertMap* msg_map;
+-extern const ConvertMap* pcre_map;
++extern const ConvertMap* pcre2_map;
+ extern const ConvertMap* pkt_data_map;
+ extern const ConvertMap* priority_map;
+ extern const ConvertMap* protected_content_map;
+@@ -159,7 +159,7 @@ const std::vector<const ConvertMap*> rul
+ modbus_func_map,
+ modbus_unit_map,
+ msg_map,
+- pcre_map,
++ pcre2_map,
+ pkt_data_map,
+ priority_map,
+ protected_content_map,
+--- a/tools/snort2lua/rule_states/rule_pcre.cc
++++ /dev/null
+@@ -1,159 +0,0 @@
+-//--------------------------------------------------------------------------
+-// Copyright (C) 2014-2024 Cisco and/or its affiliates. All rights reserved.
+-//
+-// This program is free software; you can redistribute it and/or modify it
+-// under the terms of the GNU General Public License Version 2 as published
+-// by the Free Software Foundation. You may not use, modify or distribute
+-// this program under any other version of the GNU General Public License.
+-//
+-// This program is distributed in the hope that it will be useful, but
+-// WITHOUT ANY WARRANTY; without even the implied warranty of
+-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+-// General Public License for more details.
+-//
+-// You should have received a copy of the GNU General Public License along
+-// with this program; if not, write to the Free Software Foundation, Inc.,
+-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+-//--------------------------------------------------------------------------
+-// rule_pcre.cc author Josh Rosenbaum <jrosenba@cisco.com>
+-
+-#include <sstream>
+-#include <vector>
+-
+-#include "conversion_state.h"
+-#include "helpers/converter.h"
+-#include "helpers/s2l_util.h"
+-#include "rule_api.h"
+-
+-namespace rules
+-{
+-namespace
+-{
+-class Pcre : public ConversionState
+-{
+-public:
+- Pcre(Converter& c) : ConversionState(c) { }
+- bool convert(std::istringstream& data) override;
+-};
+-} // namespace
+-
+-bool Pcre::convert(std::istringstream& data_stream)
+-{
+- bool sticky_buffer_set = false;
+- std::string buffer = "pkt_data";
+-
+- char delim = '/';
+- std::string pcre_str = util::get_rule_option_args(data_stream);
+- std::string pattern;
+- std::string new_opts;
+- std::string options;
+-
+- if (pcre_str.front() == '!')
+- {
+- pattern += "!";
+- pcre_str.erase(pcre_str.begin());
+- }
+-
+- if (pcre_str.front() != '"' || pcre_str.back() != '"')
+- {
+- rule_api.bad_rule(data_stream, "pattern must be enclosed in \"");
+- return set_next_rule_state(data_stream);
+- }
+-
+- pcre_str.erase(pcre_str.begin());
+- pattern += '"';
+-
+- if (pcre_str.front() == 'm')
+- {
+- pcre_str.erase(pcre_str.begin());
+- pattern += 'm';
+- delim = pcre_str.front();
+- }
+-
+- const std::size_t pattern_end = pcre_str.rfind(delim);
+- if ((pcre_str.front() != delim) || (pattern_end == 0))
+- {
+- std::string tmp = "Regex must be enclosed in delim '";
+- tmp.append(delim, 1);
+- rule_api.bad_rule(data_stream, tmp + "'");
+- return set_next_rule_state(data_stream);
+- }
+-
+- pattern += pcre_str.substr(0, pattern_end + 1);
+- options = pcre_str.substr(pattern_end + 1, std::string::npos);
+- new_opts = "";
+-
+- for (char c : options )
+- {
+- std::string sticky_buffer = std::string(); // empty string
+-
+- switch (c)
+- {
+- case 'B': sticky_buffer = "raw_data"; break;
+- case 'U': sticky_buffer = "http_uri"; break;
+- case 'P': sticky_buffer = "pcre_P_option_body"; break;
+- case 'H': sticky_buffer = "pcre_H_option_header"; break;
+- case 'M': sticky_buffer = "http_method"; break;
+- case 'C': sticky_buffer = "http_cookie"; break;
+- case 'I': sticky_buffer = "http_raw_uri"; break;
+- case 'D': sticky_buffer = "http_raw_header"; break;
+- case 'K': sticky_buffer = "http_raw_cookie"; break;
+- case 'S': sticky_buffer = "http_stat_code"; break;
+- case 'Y': sticky_buffer = "http_stat_msg"; break;
+- case 'i':
+- case 's':
+- case 'm':
+- case 'x':
+- case 'A':
+- case 'E':
+- case 'G':
+- case 'O':
+- case 'R':
+- case '"': // end of reg_ex
+- new_opts += c;
+- break;
+- default:
+- {
+- std::string dlt_opt = "unknown option - '";
+- dlt_opt.append(1, c);
+- dlt_opt += "'";
+- rule_api.bad_rule(data_stream, dlt_opt);
+- break;
+- }
+- }
+-
+- if (!sticky_buffer.empty())
+- {
+- buffer = sticky_buffer;
+-
+- if (sticky_buffer_set)
+- rule_api.bad_rule(data_stream,
+- "Two sticky buffers set for this regular expression!");
+- else
+- sticky_buffer_set = true;
+- }
+- }
+-
+- rule_api.add_option("pcre", pattern + new_opts);
+-
+- rule_api.set_curr_options_buffer(buffer);
+-
+- return set_next_rule_state(data_stream);
+-}
+-
+-/**************************
+- ******* A P I ***********
+- **************************/
+-
+-static ConversionState* ctor(Converter& c)
+-{ return new Pcre(c); }
+-
+-static const ConvertMap pcre_api =
+-{
+- "pcre",
+- ctor,
+-};
+-
+-const ConvertMap* pcre_map = &pcre_api;
+-} // namespace rules
+-
+--- /dev/null
++++ b/tools/snort2lua/rule_states/rule_pcre2.cc
+@@ -0,0 +1,159 @@
++//--------------------------------------------------------------------------
++// Copyright (C) 2014-2024 Cisco and/or its affiliates. All rights reserved.
++//
++// This program is free software; you can redistribute it and/or modify it
++// under the terms of the GNU General Public License Version 2 as published
++// by the Free Software Foundation. You may not use, modify or distribute
++// this program under any other version of the GNU General Public License.
++//
++// This program is distributed in the hope that it will be useful, but
++// WITHOUT ANY WARRANTY; without even the implied warranty of
++// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++// General Public License for more details.
++//
++// You should have received a copy of the GNU General Public License along
++// with this program; if not, write to the Free Software Foundation, Inc.,
++// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
++//--------------------------------------------------------------------------
++// rule_pcre2.cc author Josh Rosenbaum <jrosenba@cisco.com>
++
++#include <sstream>
++#include <vector>
++
++#include "conversion_state.h"
++#include "helpers/converter.h"
++#include "helpers/s2l_util.h"
++#include "rule_api.h"
++
++namespace rules
++{
++namespace
++{
++class Pcre2 : public ConversionState
++{
++public:
++ Pcre2(Converter& c) : ConversionState(c) { }
++ bool convert(std::istringstream& data) override;
++};
++} // namespace
++
++bool Pcre2::convert(std::istringstream& data_stream)
++{
++ bool sticky_buffer_set = false;
++ std::string buffer = "pkt_data";
++
++ char delim = '/';
++ std::string pcre2_str = util::get_rule_option_args(data_stream);
++ std::string pattern;
++ std::string new_opts;
++ std::string options;
++
++ if (pcre2_str.front() == '!')
++ {
++ pattern += "!";
++ pcre2_str.erase(pcre2_str.begin());
++ }
++
++ if (pcre2_str.front() != '"' || pcre2_str.back() != '"')
++ {
++ rule_api.bad_rule(data_stream, "pattern must be enclosed in \"");
++ return set_next_rule_state(data_stream);
++ }
++
++ pcre2_str.erase(pcre2_str.begin());
++ pattern += '"';
++
++ if (pcre2_str.front() == 'm')
++ {
++ pcre2_str.erase(pcre2_str.begin());
++ pattern += 'm';
++ delim = pcre2_str.front();
++ }
++
++ const std::size_t pattern_end = pcre2_str.rfind(delim);
++ if ((pcre2_str.front() != delim) || (pattern_end == 0))
++ {
++ std::string tmp = "Regex must be enclosed in delim '";
++ tmp.append(delim, 1);
++ rule_api.bad_rule(data_stream, tmp + "'");
++ return set_next_rule_state(data_stream);
++ }
++
++ pattern += pcre2_str.substr(0, pattern_end + 1);
++ options = pcre2_str.substr(pattern_end + 1, std::string::npos);
++ new_opts = "";
++
++ for (char c : options )
++ {
++ std::string sticky_buffer = std::string(); // empty string
++
++ switch (c)
++ {
++ case 'B': sticky_buffer = "raw_data"; break;
++ case 'U': sticky_buffer = "http_uri"; break;
++ case 'P': sticky_buffer = "pcre_P_option_body"; break;
++ case 'H': sticky_buffer = "pcre_H_option_header"; break;
++ case 'M': sticky_buffer = "http_method"; break;
++ case 'C': sticky_buffer = "http_cookie"; break;
++ case 'I': sticky_buffer = "http_raw_uri"; break;
++ case 'D': sticky_buffer = "http_raw_header"; break;
++ case 'K': sticky_buffer = "http_raw_cookie"; break;
++ case 'S': sticky_buffer = "http_stat_code"; break;
++ case 'Y': sticky_buffer = "http_stat_msg"; break;
++ case 'i':
++ case 's':
++ case 'm':
++ case 'x':
++ case 'A':
++ case 'E':
++ case 'G':
++ case 'O':
++ case 'R':
++ case '"': // end of reg_ex
++ new_opts += c;
++ break;
++ default:
++ {
++ std::string dlt_opt = "unknown option - '";
++ dlt_opt.append(1, c);
++ dlt_opt += "'";
++ rule_api.bad_rule(data_stream, dlt_opt);
++ break;
++ }
++ }
++
++ if (!sticky_buffer.empty())
++ {
++ buffer = sticky_buffer;
++
++ if (sticky_buffer_set)
++ rule_api.bad_rule(data_stream,
++ "Two sticky buffers set for this regular expression!");
++ else
++ sticky_buffer_set = true;
++ }
++ }
++
++ rule_api.add_option("pcre", pattern + new_opts);
++
++ rule_api.set_curr_options_buffer(buffer);
++
++ return set_next_rule_state(data_stream);
++}
++
++/**************************
++ ******* A P I ***********
++ **************************/
++
++static ConversionState* ctor(Converter& c)
++{ return new Pcre2(c); }
++
++static const ConvertMap pcre2_api =
++{
++ "pcre2",
++ ctor,
++};
++
++const ConvertMap* pcre2_map = &pcre2_api;
++} // namespace rules
++
+--- a/tools/snort2lua/rule_states/rule_sd_pattern.cc
++++ b/tools/snort2lua/rule_states/rule_sd_pattern.cc
+@@ -41,7 +41,7 @@ private:
+
+ std::string SDPattern::convert_pattern(const std::string& pattern)
+ {
+- const std::string unused_pcre_tokens("()[].+*^$|");
++ const std::string unused_pcre2_tokens("()[].+*^$|");
+
+ std::string s3_pattern;
+
+@@ -100,7 +100,7 @@ std::string SDPattern::convert_pattern(c
+ break;
+
+ default:
+- if (unused_pcre_tokens.find(sym) != std::string::npos)
++ if (unused_pcre2_tokens.find(sym) != std::string::npos)
+ s3_pattern.push_back('\\');
+ s3_pattern.push_back(sym);
+ break;
include $(TOPDIR)/rules.mk
PKG_NAME:=socat
-PKG_VERSION:=1.7.4.4
-PKG_RELEASE:=1
+PKG_VERSION:=1.8.0.0
+PKG_RELEASE:=2
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
PKG_SOURCE_URL:=http://www.dest-unreach.org/socat/download
-PKG_HASH:=fbd42bd2f0e54a3af6d01bdf15385384ab82dbc0e4f1a5e153b3e0be1b6380ac
+PKG_HASH:=e1de683dd22ee0e3a6c6bbff269abe18ab0c9d7eb650204f125155b9005faca7
PKG_MAINTAINER:=Ted Hess <thess@kitschensync.net>
PKG_LICENSE:=GPL-2.0-or-later OpenSSL
--disable-readline \
--enable-termios
+## procan.c fails to compile when ccache is enabled
+MAKE_FLAGS += CC="$(TARGET_CC_NOCACHE)"
+
ifneq ($(CONFIG_SOCAT_SSL),y)
CONFIGURE_ARGS+= --disable-openssl
endif
PKG_NAME:=softflowd
PKG_VERSION:=1.1.0
-PKG_RELEASE:=1
+PKG_RELEASE:=2
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://codeload.github.com/irino/softflowd/tar.gz/softflowd-v$(PKG_VERSION)?
option hoplimit ''
option tracking_level 'full'
option track_ipv6 '0'
+ option bidirectional '0'
option sampling_rate '100'
option filter ''
append_string "$section" 'tracking_level' '-T'
append_string "$section" 'sampling_rate' '-s'
append_bool "$section" track_ipv6 '-6'
+ append_bool "$section" bidirectional '-b'
procd_open_instance
procd_set_param command /usr/sbin/softflowd -d $args${pid_file:+ -p $pid_file} "$filter"
include $(TOPDIR)/rules.mk
PKG_NAME:=squid
-PKG_VERSION:=6.8
+PKG_VERSION:=6.9
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
PKG_SOURCE_URL:=http://www2.pl.squid-cache.org/Versions/v6/ \
http://www.squid-cache.org/Versions/v6/
-PKG_HASH:=11cc5650b51809d99483ccfae24744a2e51cd16199f5ff0c917e84fce695870f
+PKG_HASH:=1ad72d46e1cb556e9561214f0fb181adb87c7c47927ef69bc8acd68a03f61882
PKG_MAINTAINER:=Marko Ratkaj <markoratkaj@gmail.com>
PKG_LICENSE:=GPL-2.0-or-later
include $(TOPDIR)/rules.mk
PKG_NAME:=tailscale
-PKG_VERSION:=1.62.1
+PKG_VERSION:=1.64.2
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://codeload.github.com/tailscale/tailscale/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=22737fae37e971fecdf49d6b741b99988868aa3f1e683e67e14b872a2c49ca1c
+PKG_HASH:=e5e46f6b6b716b2c4696dce0b92dc2e36f02b06b7ad9f055042a820ad61b2a47
PKG_MAINTAINER:=Jan Pavlinec <jan.pavlinec1@gmail.com>
PKG_LICENSE:=BSD-3-Clause
include $(TOPDIR)/rules.mk
PKG_NAME:=tor
-PKG_VERSION:=0.4.8.10
+PKG_VERSION:=0.4.8.11
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://dist.torproject.org/ \
https://archive.torproject.org/tor-package-archive
-PKG_HASH:=e628b4fab70edb4727715b23cf2931375a9f7685ac08f2c59ea498a178463a86
+PKG_HASH:=8f2bdf90e63380781235aa7d604e159570f283ecee674670873d8bb7052c8e07
PKG_MAINTAINER:=Hauke Mehrtens <hauke@hauke-m.de> \
Peter Wagner <tripolar@gmx.at>
PKG_LICENSE:=BSD-3-Clause
PKG_NAME:=UDPspeeder
PKG_VERSION:=20230206.0
-PKG_RELEASE:=1
+PKG_RELEASE:=2
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://codeload.github.com/wangyu-/$(PKG_NAME)/tar.gz/$(PKG_VERSION)?
-PKG_HASH:=c6b0c45e971360b25cd49be0369e94b2fb12f649d39c7e60c172c14a9e3a4e0d
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_VERSION:=$(PKG_VERSION)
+PKG_SOURCE_URL:=https://github.com/wangyu-/UDPspeeder
+PKG_MIRROR_HASH:=8196a07089112a164ea07cc95806f79075bd1b12cc7af5316e2793421bb2cfbf
PKG_LICENSE:=MIT
PKG_LICENSE_FILES:=LICENSE
MAKE_FLAGS += cross
define Build/Prepare
- $(PKG_UNPACK)
+ $(Build/Prepare/Default)
sed -i 's/cc_cross=.*/cc_cross=$(TARGET_CXX)/g' $(PKG_BUILD_DIR)/makefile
sed -i '/\gitversion/d' $(PKG_BUILD_DIR)/makefile
echo 'const char * const gitversion = "$(PKG_VERSION)";' > $(PKG_BUILD_DIR)/git_version.h
- $(Build/Patch)
endef
define Package/UDPspeeder/install
include $(TOPDIR)/rules.mk
PKG_NAME:=uwsgi
-PKG_VERSION:=2.0.22
+PKG_VERSION:=2.0.25.1
PKG_RELEASE:=1
PYPI_NAME:=uWSGI
PYPI_SOURCE_NAME:=uwsgi
-PKG_HASH:=4cc4727258671ac5fa17ab422155e9aaef8a2008ebb86e4404b66deaae965db2
+PKG_HASH:=d653d2d804c194c8cbe2585fa56efa2650313ae75c686a9d7931374d4dfbfc6e
PKG_LICENSE:=GPL-2.0-or-later
PKG_LICENSE_FILES:=LICENSE
-PKG_MAINTAINER:=
Ansuel Smith <ansuelsmth@gmail.com>
+PKG_MAINTAINER:=
Christian Marangi <ansuelsmth@gmail.com>
PKG_BUILD_DEPENDS:=python3/host
PYTHON3_PKG_BUILD:=0
--- a/uwsgiconfig.py
+++ b/uwsgiconfig.py
-@@ -859,11 +859,11 @@ class uConf(object):
+@@ -863,11 +863,11 @@ class uConf(object):
self.cflags.append('-DUWSGI_HAS_EXECINFO')
report['execinfo'] = True
--- a/uwsgiconfig.py
+++ b/uwsgiconfig.py
-@@ -688,7 +688,7 @@ class uConf(object):
+@@ -684,7 +684,6 @@ class uConf(object):
self.include_path += os.environ['UWSGI_INCLUDES'].split(',')
-
-- self.cflags = ['-O2', '-I.', '-Wall', '-D_LARGEFILE_SOURCE', '-D_FILE_OFFSET_BITS=64'] + os.environ.get("CFLAGS", "").split() + self.get('cflags','').split()
-+ self.cflags = ['-I.', '-Wall', '-D_LARGEFILE_SOURCE', '-D_FILE_OFFSET_BITS=64'] + os.environ.get("CFLAGS", "").split() + self.get('cflags','').split()
-
- report['kernel'] = uwsgi_os
-
+ cflags = [
+- '-O2',
+ '-I.',
+ '-Wall',
+ '-D_LARGEFILE_SOURCE',
--- a/uwsgiconfig.py
+++ b/uwsgiconfig.py
-@@ -5,9 +5,9 @@ uwsgi_version = '2.0.22'
+@@ -5,9 +5,9 @@ uwsgi_version = '2.0.25.1'
import os
import re
import time
+++ /dev/null
-From bad0edfc10a80de908a3d83c7f075eff8df3a691 Mon Sep 17 00:00:00 2001
-From: Riccardo Magliocchetti <riccardo.magliocchetti@gmail.com>
-Date: Wed, 14 Jan 2015 21:19:24 +0100
-Subject: [PATCH] core/alarm: fix memory leak
-
-Reported by Coverity as CID #971006
----
- core/alarm.c | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/core/alarm.c
-+++ b/core/alarm.c
-@@ -171,6 +171,7 @@ static int uwsgi_alarm_log_add(char *ala
-
- ual = uwsgi_calloc(sizeof(struct uwsgi_alarm_log));
- if (uwsgi_regexp_build(regexp, &ual->pattern, &ual->pattern_extra)) {
-+ free(ual);
- return -1;
- }
- ual->negate = negate;
{"ssl-enable-tlsv1", no_argument, 0, "enable TLSv1 (insecure)", uwsgi_opt_true, &uwsgi.tlsv1, 0},
- {"ssl-option", no_argument, 0, "set a raw ssl option (numeric value)", uwsgi_opt_add_string_list, &uwsgi.ssl_options, 0},
+ {"ssl-option", required_argument, 0, "set a raw ssl option (numeric value)", uwsgi_opt_add_string_list, &uwsgi.ssl_options, 0},
- #ifdef UWSGI_PCRE
+ #if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
{"sni-regexp", required_argument, 0, "add an SNI-governed SSL context (the key is a regexp)", uwsgi_opt_sni, NULL, 0},
#endif
--- a/core/uwsgi.c
+++ b/core/uwsgi.c
-@@ -1825,7 +1825,7 @@ void uwsgi_plugins_atexit(void) {
+@@ -1794,7 +1794,7 @@ void uwsgi_plugins_atexit(void) {
void uwsgi_backtrace(int depth) {
+++ /dev/null
-From 7835662f76831a76e4cc04791fcf2ee1ea725931 Mon Sep 17 00:00:00 2001
-From: Riccardo Magliocchetti <riccardo.magliocchetti@gmail.com>
-Date: Tue, 25 Jul 2023 16:17:52 +0200
-Subject: [PATCH 01/12] uwsgiconfig: prepare for pcre2
-
----
- uwsgiconfig.py | 45 ++++++++++++++++++++++-----------------------
- 1 file changed, 22 insertions(+), 23 deletions(-)
-
---- a/uwsgiconfig.py
-+++ b/uwsgiconfig.py
-@@ -1079,30 +1079,29 @@ class uConf(object):
-
- has_pcre = False
-
-- # re-enable after pcre fix
-- if self.get('pcre'):
-- if self.get('pcre') == 'auto':
-- pcreconf = spcall('pcre-config --libs')
-- if pcreconf:
-- self.libs.append(pcreconf)
-- pcreconf = spcall("pcre-config --cflags")
-- self.cflags.append(pcreconf)
-- self.gcc_list.append('core/regexp')
-- self.cflags.append("-DUWSGI_PCRE")
-- has_pcre = True
--
-+ required_pcre = self.get('pcre')
-+ if required_pcre:
-+ pcre_libs = spcall('pcre2-config --libs8')
-+ if pcre_libs:
-+ pcre_cflags = spcall("pcre2-config --cflags")
-+ pcre_define = "-DUWSGI_PCRE2"
- else:
-- pcreconf = spcall('pcre-config --libs')
-- if pcreconf is None:
-- print("*** libpcre headers unavailable. uWSGI build is interrupted. You have to install pcre development package or disable pcre")
-- sys.exit(1)
-- else:
-- self.libs.append(pcreconf)
-- pcreconf = spcall("pcre-config --cflags")
-- self.cflags.append(pcreconf)
-- self.gcc_list.append('core/regexp')
-- self.cflags.append("-DUWSGI_PCRE")
-- has_pcre = True
-+ pcre_libs = spcall('pcre-config --libs')
-+ pcre_cflags = spcall("pcre-config --cflags")
-+ pcre_define = "-DUWSGI_PCRE"
-+ else:
-+ pcre_libs = None
-+
-+ if required_pcre:
-+ if required_pcre != 'auto' and pcre_libs is None:
-+ print("*** libpcre headers unavailable. uWSGI build is interrupted. You have to install pcre development package or disable pcre")
-+ sys.exit(1)
-+
-+ self.libs.append(pcre_libs)
-+ self.cflags.append(pcre_cflags)
-+ self.gcc_list.append('core/regexp')
-+ self.cflags.append(pcre_define)
-+ has_pcre = True
-
- if has_pcre:
- report['pcre'] = True
---- a/core/alarm.c
-+++ b/core/alarm.c
-@@ -160,7 +160,7 @@ static struct uwsgi_alarm_instance *uwsg
- }
-
-
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- static int uwsgi_alarm_log_add(char *alarms, char *regexp, int negate) {
-
- struct uwsgi_alarm_log *old_ual = NULL, *ual = uwsgi.alarm_logs;
-@@ -170,7 +170,7 @@ static int uwsgi_alarm_log_add(char *ala
- }
-
- ual = uwsgi_calloc(sizeof(struct uwsgi_alarm_log));
-- if (uwsgi_regexp_build(regexp, &ual->pattern, &ual->pattern_extra)) {
-+ if (uwsgi_regexp_build(regexp, &ual->pattern)) {
- free(ual);
- return -1;
- }
-@@ -331,7 +331,7 @@ void uwsgi_alarms_init() {
- usl = usl->next;
- }
-
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- // then map log-alarm
- usl = uwsgi.alarm_logs_list;
- while (usl) {
-@@ -377,14 +377,14 @@ void uwsgi_alarm_trigger_uai(struct uwsg
- }
- }
-
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- // check if a log should raise an alarm
- void uwsgi_alarm_log_check(char *msg, size_t len) {
- if (!uwsgi_strncmp(msg, len, "[uwsgi-alarm", 12))
- return;
- struct uwsgi_alarm_log *ual = uwsgi.alarm_logs;
- while (ual) {
-- if (uwsgi_regexp_match(ual->pattern, ual->pattern_extra, msg, len) >= 0) {
-+ if (uwsgi_regexp_match(ual->pattern, msg, len) >= 0) {
- if (!ual->negate) {
- struct uwsgi_alarm_ll *uall = ual->alarms;
- while (uall) {
---- a/core/logging.c
-+++ b/core/logging.c
-@@ -414,7 +414,7 @@ void uwsgi_setup_log_master(void) {
- usl = usl->next;
- }
-
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- // set logger by its id
- struct uwsgi_regexp_list *url = uwsgi.log_route;
- while (url) {
-@@ -1398,11 +1398,11 @@ int uwsgi_master_log(void) {
-
- ssize_t rlen = read(uwsgi.shared->worker_log_pipe[0], uwsgi.log_master_buf, uwsgi.log_master_bufsize);
- if (rlen > 0) {
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- uwsgi_alarm_log_check(uwsgi.log_master_buf, rlen);
- struct uwsgi_regexp_list *url = uwsgi.log_drain_rules;
- while (url) {
-- if (uwsgi_regexp_match(url->pattern, url->pattern_extra, uwsgi.log_master_buf, rlen) >= 0) {
-+ if (uwsgi_regexp_match(url->pattern, uwsgi.log_master_buf, rlen) >= 0) {
- return 0;
- }
- url = url->next;
-@@ -1411,7 +1411,7 @@ int uwsgi_master_log(void) {
- int show = 0;
- url = uwsgi.log_filter_rules;
- while (url) {
-- if (uwsgi_regexp_match(url->pattern, url->pattern_extra, uwsgi.log_master_buf, rlen) >= 0) {
-+ if (uwsgi_regexp_match(url->pattern, uwsgi.log_master_buf, rlen) >= 0) {
- show = 1;
- break;
- }
-@@ -1424,7 +1424,7 @@ int uwsgi_master_log(void) {
- url = uwsgi.log_route;
- int finish = 0;
- while (url) {
-- if (uwsgi_regexp_match(url->pattern, url->pattern_extra, uwsgi.log_master_buf, rlen) >= 0) {
-+ if (uwsgi_regexp_match(url->pattern, uwsgi.log_master_buf, rlen) >= 0) {
- struct uwsgi_logger *ul_route = (struct uwsgi_logger *) url->custom_ptr;
- if (ul_route) {
- uwsgi_log_func_do(uwsgi.requested_log_encoders, ul_route, uwsgi.log_master_buf, rlen);
-@@ -1464,11 +1464,11 @@ int uwsgi_master_req_log(void) {
-
- ssize_t rlen = read(uwsgi.shared->worker_req_log_pipe[0], uwsgi.log_master_buf, uwsgi.log_master_bufsize);
- if (rlen > 0) {
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- struct uwsgi_regexp_list *url = uwsgi.log_req_route;
- int finish = 0;
- while (url) {
-- if (uwsgi_regexp_match(url->pattern, url->pattern_extra, uwsgi.log_master_buf, rlen) >= 0) {
-+ if (uwsgi_regexp_match(url->pattern, uwsgi.log_master_buf, rlen) >= 0) {
- struct uwsgi_logger *ul_route = (struct uwsgi_logger *) url->custom_ptr;
- if (ul_route) {
- uwsgi_log_func_do(uwsgi.requested_log_req_encoders, ul_route, uwsgi.log_master_buf, rlen);
---- a/core/regexp.c
-+++ b/core/regexp.c
-@@ -1,4 +1,4 @@
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- #include "uwsgi.h"
-
- extern struct uwsgi_server uwsgi;
-@@ -13,48 +13,110 @@ void uwsgi_opt_pcre_jit(char *opt, char
- #endif
- }
-
--int uwsgi_regexp_build(char *re, pcre ** pattern, pcre_extra ** pattern_extra) {
-+int uwsgi_regexp_build(char *re, uwsgi_pcre ** pattern) {
-
-+#ifdef UWSGI_PCRE2
-+ int errnbr;
-+ long unsigned int erroff;
-+
-+ *pattern = pcre2_compile((const unsigned char *) re, PCRE2_ZERO_TERMINATED, 0, &errnbr, &erroff, NULL);
-+#else
- const char *errstr;
- int erroff;
-
-- *pattern = pcre_compile((const char *) re, 0, &errstr, &erroff, NULL);
-- if (!*pattern) {
-+ *pattern = uwsgi_malloc(sizeof(uwsgi_pcre));
-+ (*pattern)->p = pcre_compile((const char *) re, 0, &errstr, &erroff, NULL);
-+#endif
-+#ifdef UWSGI_PCRE2
-+ if (!(*pattern)) {
-+ uwsgi_log("pcre error: code %d at offset %d\n", errnbr, erroff);
-+#else
-+ if (!((*pattern)->p)) {
- uwsgi_log("pcre error: %s at offset %d\n", errstr, erroff);
-+#endif
- return -1;
- }
-
-+#ifdef UWSGI_PCRE2
-+ if (uwsgi.pcre_jit) {
-+ errnbr = pcre2_jit_compile(*pattern, PCRE2_JIT_COMPLETE);
-+ if (errnbr) {
-+ pcre2_code_free(*pattern);
-+ uwsgi_log("pcre JIT compile error code %d\n", errnbr);
-+ return -1;
-+ }
-+#else
- int opt = uwsgi.pcre_jit;
-
-- *pattern_extra = (pcre_extra *) pcre_study((const pcre *) *pattern, opt, &errstr);
-- if (*pattern_extra == NULL && errstr != NULL) {
-- pcre_free(*pattern);
-+ (*pattern)->extra = (pcre_extra *) pcre_study((const pcre *) (*pattern)->p, opt, &errstr);
-+ if ((*pattern)->extra == NULL && errstr != NULL) {
-+ pcre_free((*pattern)->p);
-+ free(*pattern);
- uwsgi_log("pcre (study) error: %s\n", errstr);
- return -1;
-+#endif
- }
-
- return 0;
-
- }
-
--int uwsgi_regexp_match(pcre * pattern, pcre_extra * pattern_extra, char *subject, int length) {
--
-- return pcre_exec((const pcre *) pattern, (const pcre_extra *) pattern_extra, subject, length, 0, 0, NULL, 0);
-+int uwsgi_regexp_match(uwsgi_pcre *pattern, const char *subject, int length) {
-+#ifdef UWSGI_PCRE2
-+ return pcre2_match(pattern, (const unsigned char *)subject, length, 0, 0, NULL, NULL);
-+#else
-+ return pcre_exec((const pcre *) pattern->p, (const pcre_extra *) pattern->extra, subject, length, 0, 0, NULL, 0);
-+#endif
- }
-
--int uwsgi_regexp_match_ovec(pcre * pattern, pcre_extra * pattern_extra, char *subject, int length, int *ovec, int n) {
-+int uwsgi_regexp_match_ovec(uwsgi_pcre *pattern, const char *subject, int length, int *ovec, int n) {
-+
-+#ifdef UWSGI_PCRE2
-+ int rc;
-+ int i;
-+ pcre2_match_data *match_data;
-+ size_t *pcre2_ovec;
-+
-+ match_data = pcre2_match_data_create_from_pattern(pattern, NULL);
-+ rc = pcre2_match(pattern, (const unsigned char *)subject, length, 0, 0, match_data, NULL);
-
-+ /*
-+ * Quoting PCRE{,2} spec, "The first pair of integers, ovector[0]
-+ * and ovector[1], identify the portion of the subject string matched
-+ * by the entire pattern. The next pair is used for the first capturing
-+ * subpattern, and so on." Therefore, the ovector size is the number of
-+ * capturing subpatterns (INFO_CAPTURECOUNT), from uwsgi_regexp_ovector(),
-+ * as matching pairs, plus room for the first pair.
-+ */
- if (n > 0) {
-- return pcre_exec((const pcre *) pattern, (const pcre_extra *) pattern_extra, subject, length, 0, 0, ovec, (n + 1) * 3);
-+ // copy pcre2 output vector to uwsgi output vector
-+ pcre2_ovec = pcre2_get_ovector_pointer(match_data);
-+ for (i=0;i<(n+1)*2;i++) {
-+ ovec[i] = pcre2_ovec[i];
-+ }
-+#else
-+ if (n > 0) {
-+ return pcre_exec((const pcre *) pattern->p, (const pcre_extra *) pattern->extra, subject, length, 0, 0, ovec, PCRE_OVECTOR_BYTESIZE(n));
-+#endif
- }
-- return pcre_exec((const pcre *) pattern, (const pcre_extra *) pattern_extra, subject, length, 0, 0, NULL, 0);
-+
-+#ifdef UWSGI_PCRE2
-+ pcre2_match_data_free(match_data);
-+
-+ return rc;
-+#else
-+ return pcre_exec((const pcre *) pattern->p, (const pcre_extra *) pattern->extra, subject, length, 0, 0, NULL, 0);
-+#endif
- }
-
--int uwsgi_regexp_ovector(pcre * pattern, pcre_extra * pattern_extra) {
-+int uwsgi_regexp_ovector(const uwsgi_pcre *pattern) {
-
- int n;
--
-- if (pcre_fullinfo((const pcre *) pattern, (const pcre_extra *) pattern_extra, PCRE_INFO_CAPTURECOUNT, &n))
-+#ifdef UWSGI_PCRE2
-+ if (pcre2_pattern_info(pattern, PCRE2_INFO_CAPTURECOUNT, &n))
-+#else
-+ if (pcre_fullinfo((const pcre *) pattern->p, (const pcre_extra *) pattern->extra, PCRE_INFO_CAPTURECOUNT, &n))
-+#endif
- return 0;
-
- return n;
-@@ -66,7 +128,7 @@ char *uwsgi_regexp_apply_ovec(char *src,
- int dollar = 0;
-
- size_t dollars = n;
--
-+
- for(i=0;i<dst_n;i++) {
- if (dst[i] == '$') {
- dollars++;
---- a/core/routing.c
-+++ b/core/routing.c
-@@ -211,7 +211,7 @@ int uwsgi_apply_routes_do(struct uwsgi_r
- subject = *subject2 ;
- subject_len = *subject_len2;
- }
-- n = uwsgi_regexp_match_ovec(routes->pattern, routes->pattern_extra, subject, subject_len, routes->ovector[wsgi_req->async_id], routes->ovn[wsgi_req->async_id]);
-+ n = uwsgi_regexp_match_ovec(routes->pattern, subject, subject_len, routes->ovector[wsgi_req->async_id], routes->ovn[wsgi_req->async_id]);
- }
- else {
- int ret = routes->if_func(wsgi_req, routes);
-@@ -506,15 +506,15 @@ void uwsgi_fixup_routes(struct uwsgi_rou
-
- // fill them if needed... (this is an optimization for route with a static subject)
- if (ur->subject && ur->subject_len) {
-- if (uwsgi_regexp_build(ur->orig_route, &ur->pattern, &ur->pattern_extra)) {
-+ if (uwsgi_regexp_build(ur->orig_route, &ur->pattern)) {
- exit(1);
- }
-
- int i;
- for(i=0;i<uwsgi.cores;i++) {
-- ur->ovn[i] = uwsgi_regexp_ovector(ur->pattern, ur->pattern_extra);
-+ ur->ovn[i] = uwsgi_regexp_ovector(ur->pattern);
- if (ur->ovn[i] > 0) {
-- ur->ovector[i] = uwsgi_calloc(sizeof(int) * (3 * (ur->ovn[i] + 1)));
-+ ur->ovector[i] = uwsgi_calloc(sizeof(int) * PCRE_OVECTOR_BYTESIZE(ur->ovn[i]));
- }
- }
- }
-@@ -1484,38 +1484,47 @@ static int uwsgi_route_condition_regexp(
- ur->condition_ub[wsgi_req->async_id] = uwsgi_routing_translate(wsgi_req, ur, NULL, 0, ur->subject_str, semicolon - ur->subject_str);
- if (!ur->condition_ub[wsgi_req->async_id]) return -1;
-
-- pcre *pattern;
-- pcre_extra *pattern_extra;
-+ uwsgi_pcre *pattern;
- char *re = uwsgi_concat2n(semicolon+1, ur->subject_str_len - ((semicolon+1) - ur->subject_str), "", 0);
-- if (uwsgi_regexp_build(re, &pattern, &pattern_extra)) {
-+ if (uwsgi_regexp_build(re, &pattern)) {
- free(re);
- return -1;
- }
- free(re);
-
- // a condition has no initialized vectors, let's create them
-- ur->ovn[wsgi_req->async_id] = uwsgi_regexp_ovector(pattern, pattern_extra);
-+ ur->ovn[wsgi_req->async_id] = uwsgi_regexp_ovector(pattern);
- if (ur->ovn[wsgi_req->async_id] > 0) {
- ur->ovector[wsgi_req->async_id] = uwsgi_calloc(sizeof(int) * (3 * (ur->ovn[wsgi_req->async_id] + 1)));
- }
-
-- if (uwsgi_regexp_match_ovec(pattern, pattern_extra, ur->condition_ub[wsgi_req->async_id]->buf, ur->condition_ub[wsgi_req->async_id]->pos, ur->ovector[wsgi_req->async_id], ur->ovn[wsgi_req->async_id] ) >= 0) {
-- pcre_free(pattern);
-+ if (uwsgi_regexp_match_ovec(pattern, ur->condition_ub[wsgi_req->async_id]->buf, ur->condition_ub[wsgi_req->async_id]->pos, ur->ovector[wsgi_req->async_id], ur->ovn[wsgi_req->async_id] ) >= 0) {
-+#ifdef UWSGI_PCRE2
-+ pcre2_code_free(pattern);
-+#else
-+ pcre_free(pattern->p);
- #ifdef PCRE_STUDY_JIT_COMPILE
-- pcre_free_study(pattern_extra);
-+ pcre_free_study(pattern->extra);
- #else
-- pcre_free(pattern_extra);
-+ pcre_free(pattern->extra);
-+#endif
-+ free(pattern);
- #endif
- return 1;
- }
-
-- pcre_free(pattern);
-+#ifdef UWSGI_PCRE2
-+ pcre2_code_free(pattern);
-+#else
-+ pcre_free(pattern->p);
- #ifdef PCRE_STUDY_JIT_COMPILE
-- pcre_free_study(pattern_extra);
-+ pcre_free_study(pattern->extra);
- #else
-- pcre_free(pattern_extra);
-+ pcre_free(pattern->extra);
- #endif
-- return 0;
-+ free(pattern);
-+#endif
-+ return 0;
- }
-
- static int uwsgi_route_condition_empty(struct wsgi_request *wsgi_req, struct uwsgi_route *ur) {
---- a/core/ssl.c
-+++ b/core/ssl.c
-@@ -145,10 +145,10 @@ static int uwsgi_sni_cb(SSL *ssl, int *a
-
- if (uwsgi.subscription_dotsplit) goto end;
-
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- struct uwsgi_regexp_list *url = uwsgi.sni_regexp;
- while(url) {
-- if (uwsgi_regexp_match(url->pattern, url->pattern_extra, (char *)servername, servername_len) >= 0) {
-+ if (uwsgi_regexp_match(url->pattern, (char *)servername, servername_len) >= 0) {
- SSL_set_SSL_CTX(ssl, url->custom_ptr);
- return SSL_TLSEXT_ERR_OK;
- }
-@@ -621,7 +621,7 @@ void uwsgi_opt_sni(char *opt, char *valu
- return;
- }
-
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- if (!strcmp(opt, "sni-regexp")) {
- struct uwsgi_regexp_list *url = uwsgi_regexp_new_list(&uwsgi.sni_regexp, v);
- url->custom_ptr = ctx;
-@@ -630,7 +630,7 @@ void uwsgi_opt_sni(char *opt, char *valu
- #endif
- struct uwsgi_string_list *usl = uwsgi_string_new_list(&uwsgi.sni, v);
- usl->custom_ptr = ctx;
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- }
- #endif
-
---- a/core/static.c
-+++ b/core/static.c
-@@ -35,11 +35,11 @@ int uwsgi_static_want_gzip(struct wsgi_r
- usl = usl->next;
- }
-
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- // check for regexp
- struct uwsgi_regexp_list *url = uwsgi.static_gzip;
- while(url) {
-- if (uwsgi_regexp_match(url->pattern, url->pattern_extra, filename, *filename_len) >= 0) {
-+ if (uwsgi_regexp_match(url->pattern, filename, *filename_len) >= 0) {
- goto gzip;
- }
- url = url->next;
-@@ -216,7 +216,7 @@ int uwsgi_add_expires_type(struct wsgi_r
- return 0;
- }
-
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- int uwsgi_add_expires(struct wsgi_request *wsgi_req, char *filename, int filename_len, struct stat *st) {
-
- struct uwsgi_dyn_dict *udd = uwsgi.static_expires;
-@@ -225,7 +225,7 @@ int uwsgi_add_expires(struct wsgi_reques
- char expires[31];
-
- while (udd) {
-- if (uwsgi_regexp_match(udd->pattern, udd->pattern_extra, filename, filename_len) >= 0) {
-+ if (uwsgi_regexp_match(udd->pattern, filename, filename_len) >= 0) {
- int delta = uwsgi_str_num(udd->value, udd->vallen);
- int size = uwsgi_http_date(now + delta, expires);
- if (size > 0) {
-@@ -238,7 +238,7 @@ int uwsgi_add_expires(struct wsgi_reques
-
- udd = uwsgi.static_expires_mtime;
- while (udd) {
-- if (uwsgi_regexp_match(udd->pattern, udd->pattern_extra, filename, filename_len) >= 0) {
-+ if (uwsgi_regexp_match(udd->pattern, filename, filename_len) >= 0) {
- int delta = uwsgi_str_num(udd->value, udd->vallen);
- int size = uwsgi_http_date(st->st_mtime + delta, expires);
- if (size > 0) {
-@@ -260,7 +260,7 @@ int uwsgi_add_expires_path_info(struct w
- char expires[31];
-
- while (udd) {
-- if (uwsgi_regexp_match(udd->pattern, udd->pattern_extra, wsgi_req->path_info, wsgi_req->path_info_len) >= 0) {
-+ if (uwsgi_regexp_match(udd->pattern, wsgi_req->path_info, wsgi_req->path_info_len) >= 0) {
- int delta = uwsgi_str_num(udd->value, udd->vallen);
- int size = uwsgi_http_date(now + delta, expires);
- if (size > 0) {
-@@ -273,7 +273,7 @@ int uwsgi_add_expires_path_info(struct w
-
- udd = uwsgi.static_expires_path_info_mtime;
- while (udd) {
-- if (uwsgi_regexp_match(udd->pattern, udd->pattern_extra, wsgi_req->path_info, wsgi_req->path_info_len) >= 0) {
-+ if (uwsgi_regexp_match(udd->pattern, wsgi_req->path_info, wsgi_req->path_info_len) >= 0) {
- int delta = uwsgi_str_num(udd->value, udd->vallen);
- int size = uwsgi_http_date(st->st_mtime + delta, expires);
- if (size > 0) {
-@@ -295,7 +295,7 @@ int uwsgi_add_expires_uri(struct wsgi_re
- char expires[31];
-
- while (udd) {
-- if (uwsgi_regexp_match(udd->pattern, udd->pattern_extra, wsgi_req->uri, wsgi_req->uri_len) >= 0) {
-+ if (uwsgi_regexp_match(udd->pattern, wsgi_req->uri, wsgi_req->uri_len) >= 0) {
- int delta = uwsgi_str_num(udd->value, udd->vallen);
- int size = uwsgi_http_date(now + delta, expires);
- if (size > 0) {
-@@ -308,7 +308,7 @@ int uwsgi_add_expires_uri(struct wsgi_re
-
- udd = uwsgi.static_expires_uri_mtime;
- while (udd) {
-- if (uwsgi_regexp_match(udd->pattern, udd->pattern_extra, wsgi_req->uri, wsgi_req->uri_len) >= 0) {
-+ if (uwsgi_regexp_match(udd->pattern, wsgi_req->uri, wsgi_req->uri_len) >= 0) {
- int delta = uwsgi_str_num(udd->value, udd->vallen);
- int size = uwsgi_http_date(st->st_mtime + delta, expires);
- if (size > 0) {
-@@ -507,7 +507,7 @@ int uwsgi_real_file_serve(struct wsgi_re
- if (uwsgi_response_prepare_headers(wsgi_req, "200 OK", 6)) return -1;
- }
-
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- uwsgi_add_expires(wsgi_req, real_filename, real_filename_len, st);
- uwsgi_add_expires_path_info(wsgi_req, st);
- uwsgi_add_expires_uri(wsgi_req, st);
---- a/core/utils.c
-+++ b/core/utils.c
-@@ -2301,7 +2301,7 @@ struct uwsgi_string_list *uwsgi_string_n
- return uwsgi_string;
- }
-
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- struct uwsgi_regexp_list *uwsgi_regexp_custom_new_list(struct uwsgi_regexp_list **list, char *value, char *custom) {
-
- struct uwsgi_regexp_list *url = *list, *old_url;
-@@ -2320,7 +2320,7 @@ struct uwsgi_regexp_list *uwsgi_regexp_c
- old_url->next = url;
- }
-
-- if (uwsgi_regexp_build(value, &url->pattern, &url->pattern_extra)) {
-+ if (uwsgi_regexp_build(value, &url->pattern)) {
- exit(1);
- }
- url->next = NULL;
-@@ -2333,14 +2333,13 @@ struct uwsgi_regexp_list *uwsgi_regexp_c
-
- int uwsgi_regexp_match_pattern(char *pattern, char *str) {
-
-- pcre *regexp;
-- pcre_extra *regexp_extra;
-+ uwsgi_pcre *regexp;
-
-- if (uwsgi_regexp_build(pattern, ®exp, ®exp_extra))
-+ if (uwsgi_regexp_build(pattern, ®exp))
- return 1;
-- return !uwsgi_regexp_match(regexp, regexp_extra, str, strlen(str));
--}
-
-+ return !uwsgi_regexp_match(regexp, str, strlen(str));
-+}
-
- #endif
-
---- a/core/uwsgi.c
-+++ b/core/uwsgi.c
-@@ -130,7 +130,7 @@ static struct uwsgi_option uwsgi_base_op
- {"if-hostname", required_argument, 0, "(opt logic) check for hostname", uwsgi_opt_logic, (void *) uwsgi_logic_opt_if_hostname, UWSGI_OPT_IMMEDIATE},
- {"if-not-hostname", required_argument, 0, "(opt logic) check for hostname", uwsgi_opt_logic, (void *) uwsgi_logic_opt_if_not_hostname, UWSGI_OPT_IMMEDIATE},
-
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- {"if-hostname-match", required_argument, 0, "(opt logic) try to match hostname against a regular expression", uwsgi_opt_logic, (void *) uwsgi_logic_opt_if_hostname_match, UWSGI_OPT_IMMEDIATE},
- {"if-not-hostname-match", required_argument, 0, "(opt logic) try to match hostname against a regular expression", uwsgi_opt_logic, (void *) uwsgi_logic_opt_if_not_hostname_match, UWSGI_OPT_IMMEDIATE},
- #endif
-@@ -548,7 +548,7 @@ static struct uwsgi_option uwsgi_base_op
- {"ksm", optional_argument, 0, "enable Linux KSM", uwsgi_opt_set_int, &uwsgi.linux_ksm, 0},
- #endif
- #endif
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- {"pcre-jit", no_argument, 0, "enable pcre jit (if available)", uwsgi_opt_pcre_jit, NULL, UWSGI_OPT_IMMEDIATE},
- #endif
- {"never-swap", no_argument, 0, "lock all memory pages avoiding swapping", uwsgi_opt_true, &uwsgi.never_swap, 0},
-@@ -679,7 +679,7 @@ static struct uwsgi_option uwsgi_base_op
- {"ssl-enable-sslv3", no_argument, 0, "enable SSLv3 (insecure)", uwsgi_opt_true, &uwsgi.sslv3, 0},
- {"ssl-enable-tlsv1", no_argument, 0, "enable TLSv1 (insecure)", uwsgi_opt_true, &uwsgi.tlsv1, 0},
- {"ssl-option", required_argument, 0, "set a raw ssl option (numeric value)", uwsgi_opt_add_string_list, &uwsgi.ssl_options, 0},
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- {"sni-regexp", required_argument, 0, "add an SNI-governed SSL context (the key is a regexp)", uwsgi_opt_sni, NULL, 0},
- #endif
- {"ssl-tmp-dir", required_argument, 0, "store ssl-related temp files in the specified directory", uwsgi_opt_set_str, &uwsgi.ssl_tmp_dir, 0},
-@@ -715,7 +715,7 @@ static struct uwsgi_option uwsgi_base_op
- {"log-req-encoder", required_argument, 0, "add an item in the log req encoder chain", uwsgi_opt_add_string_list, &uwsgi.requested_log_req_encoders, UWSGI_OPT_MASTER | UWSGI_OPT_LOG_MASTER},
-
-
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- {"log-drain", required_argument, 0, "drain (do not show) log lines matching the specified regexp", uwsgi_opt_add_regexp_list, &uwsgi.log_drain_rules, UWSGI_OPT_MASTER | UWSGI_OPT_LOG_MASTER},
- {"log-filter", required_argument, 0, "show only log lines matching the specified regexp", uwsgi_opt_add_regexp_list, &uwsgi.log_filter_rules, UWSGI_OPT_MASTER | UWSGI_OPT_LOG_MASTER},
- {"log-route", required_argument, 0, "log to the specified named logger if regexp applied on logline matches", uwsgi_opt_add_regexp_custom_list, &uwsgi.log_route, UWSGI_OPT_MASTER | UWSGI_OPT_LOG_MASTER},
-@@ -736,7 +736,7 @@ static struct uwsgi_option uwsgi_base_op
- {"alarm-lq", required_argument, 0, "raise the specified alarm when the socket backlog queue is full", uwsgi_opt_add_string_list, &uwsgi.alarm_backlog, UWSGI_OPT_MASTER},
- {"alarm-listen-queue", required_argument, 0, "raise the specified alarm when the socket backlog queue is full", uwsgi_opt_add_string_list, &uwsgi.alarm_backlog, UWSGI_OPT_MASTER},
- {"listen-queue-alarm", required_argument, 0, "raise the specified alarm when the socket backlog queue is full", uwsgi_opt_add_string_list, &uwsgi.alarm_backlog, UWSGI_OPT_MASTER},
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- {"log-alarm", required_argument, 0, "raise the specified alarm when a log line matches the specified regexp, syntax: <alarm>[,alarm...] <regexp>", uwsgi_opt_add_string_list, &uwsgi.alarm_logs_list, UWSGI_OPT_MASTER | UWSGI_OPT_LOG_MASTER},
- {"alarm-log", required_argument, 0, "raise the specified alarm when a log line matches the specified regexp, syntax: <alarm>[,alarm...] <regexp>", uwsgi_opt_add_string_list, &uwsgi.alarm_logs_list, UWSGI_OPT_MASTER | UWSGI_OPT_LOG_MASTER},
- {"not-log-alarm", required_argument, 0, "skip the specified alarm when a log line matches the specified regexp, syntax: <alarm>[,alarm...] <regexp>", uwsgi_opt_add_string_list_custom, &uwsgi.alarm_logs_list, UWSGI_OPT_MASTER | UWSGI_OPT_LOG_MASTER},
-@@ -915,7 +915,7 @@ static struct uwsgi_option uwsgi_base_op
- {"static-expires-type", required_argument, 0, "set the Expires header based on content type", uwsgi_opt_add_dyn_dict, &uwsgi.static_expires_type, UWSGI_OPT_MIME},
- {"static-expires-type-mtime", required_argument, 0, "set the Expires header based on content type and file mtime", uwsgi_opt_add_dyn_dict, &uwsgi.static_expires_type_mtime, UWSGI_OPT_MIME},
-
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- {"static-expires", required_argument, 0, "set the Expires header based on filename regexp", uwsgi_opt_add_regexp_dyn_dict, &uwsgi.static_expires, UWSGI_OPT_MIME},
- {"static-expires-mtime", required_argument, 0, "set the Expires header based on filename regexp and file mtime", uwsgi_opt_add_regexp_dyn_dict, &uwsgi.static_expires_mtime, UWSGI_OPT_MIME},
-
-@@ -2424,7 +2424,7 @@ void uwsgi_setup(int argc, char *argv[],
- }
-
- uwsgi_log_initial("clock source: %s\n", uwsgi.clock->name);
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- if (uwsgi.pcre_jit) {
- uwsgi_log_initial("pcre jit enabled\n");
- }
-@@ -4186,7 +4186,7 @@ void uwsgi_opt_add_string_list_custom(ch
- usl->custom = 1;
- }
-
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- void uwsgi_opt_add_regexp_list(char *opt, char *value, void *list) {
- struct uwsgi_regexp_list **ptr = (struct uwsgi_regexp_list **) list;
- uwsgi_regexp_new_list(ptr, value);
-@@ -4452,7 +4452,7 @@ void uwsgi_opt_add_dyn_dict(char *opt, c
-
- }
-
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- void uwsgi_opt_add_regexp_dyn_dict(char *opt, char *value, void *dict) {
-
- char *space = strchr(value, ' ');
-@@ -4467,7 +4467,7 @@ void uwsgi_opt_add_regexp_dyn_dict(char
-
- char *regexp = uwsgi_concat2n(value, space - value, "", 0);
-
-- if (uwsgi_regexp_build(regexp, &new_udd->pattern, &new_udd->pattern_extra)) {
-+ if (uwsgi_regexp_build(regexp, &new_udd->pattern)) {
- exit(1);
- }
-
---- a/uwsgi.h
-+++ b/uwsgi.h
-@@ -438,8 +438,26 @@ struct uwsgi_lock_ops {
- #define uwsgi_wait_read_req(x) uwsgi.wait_read_hook(x->fd, uwsgi.socket_timeout) ; x->switches++
- #define uwsgi_wait_write_req(x) uwsgi.wait_write_hook(x->fd, uwsgi.socket_timeout) ; x->switches++
-
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
-+#ifdef UWSGI_PCRE2
-+
-+#define PCRE2_CODE_UNIT_WIDTH 8
-+#include <pcre2.h>
-+#define PCRE_OVECTOR_BYTESIZE(n) (n+1)*2
-+
-+typedef pcre2_code uwsgi_pcre;
-+
-+#else
-+
- #include <pcre.h>
-+#define PCRE_OVECTOR_BYTESIZE(n) (n+1)*3
-+
-+typedef struct {
-+ pcre *p;
-+ pcre_extra *extra;
-+} uwsgi_pcre;
-+
-+#endif
- #endif
-
- struct uwsgi_dyn_dict {
-@@ -455,9 +473,8 @@ struct uwsgi_dyn_dict {
- struct uwsgi_dyn_dict *prev;
- struct uwsgi_dyn_dict *next;
-
--#ifdef UWSGI_PCRE
-- pcre *pattern;
-- pcre_extra *pattern_extra;
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
-+ uwsgi_pcre *pattern;
- #endif
-
- };
-@@ -468,11 +485,10 @@ struct uwsgi_hook {
- struct uwsgi_hook *next;
- };
-
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- struct uwsgi_regexp_list {
-
-- pcre *pattern;
-- pcre_extra *pattern_extra;
-+ uwsgi_pcre *pattern;
-
- uint64_t custom;
- char *custom_str;
-@@ -1089,11 +1105,11 @@ struct uwsgi_plugin {
- void (*post_uwsgi_fork) (int);
- };
-
--#ifdef UWSGI_PCRE
--int uwsgi_regexp_build(char *, pcre **, pcre_extra **);
--int uwsgi_regexp_match(pcre *, pcre_extra *, char *, int);
--int uwsgi_regexp_match_ovec(pcre *, pcre_extra *, char *, int, int *, int);
--int uwsgi_regexp_ovector(pcre *, pcre_extra *);
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
-+int uwsgi_regexp_build(char *, uwsgi_pcre **);
-+int uwsgi_regexp_match(uwsgi_pcre *, const char *, int);
-+int uwsgi_regexp_match_ovec(uwsgi_pcre *, const char *, int, int *, int);
-+int uwsgi_regexp_ovector(const uwsgi_pcre *);
- char *uwsgi_regexp_apply_ovec(char *, int, char *, int, int *, int);
-
- int uwsgi_regexp_match_pattern(char *pattern, char *str);
-@@ -1182,8 +1198,7 @@ struct uwsgi_spooler {
-
- struct uwsgi_route {
-
-- pcre *pattern;
-- pcre_extra *pattern_extra;
-+ uwsgi_pcre *pattern;
-
- char *orig_route;
-
-@@ -1292,15 +1307,14 @@ struct uwsgi_alarm_fd {
-
- struct uwsgi_alarm_fd *uwsgi_add_alarm_fd(int, char *, size_t, char *, size_t);
-
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- struct uwsgi_alarm_ll {
- struct uwsgi_alarm_instance *alarm;
- struct uwsgi_alarm_ll *next;
- };
-
- struct uwsgi_alarm_log {
-- pcre *pattern;
-- pcre_extra *pattern_extra;
-+ uwsgi_pcre *pattern;
- int negate;
- struct uwsgi_alarm_ll *alarms;
- struct uwsgi_alarm_log *next;
-@@ -2234,7 +2248,7 @@ struct uwsgi_server {
- struct uwsgi_string_list *requested_log_encoders;
- struct uwsgi_string_list *requested_log_req_encoders;
-
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- int pcre_jit;
- struct uwsgi_regexp_list *log_drain_rules;
- struct uwsgi_regexp_list *log_filter_rules;
-@@ -2316,7 +2330,7 @@ struct uwsgi_server {
- int static_gzip_all;
- struct uwsgi_string_list *static_gzip_dir;
- struct uwsgi_string_list *static_gzip_ext;
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- struct uwsgi_regexp_list *static_gzip;
- #endif
-
-@@ -2715,7 +2729,7 @@ struct uwsgi_server {
- int ssl_sessions_timeout;
- struct uwsgi_cache *ssl_sessions_cache;
- char *ssl_tmp_dir;
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- struct uwsgi_regexp_list *sni_regexp;
- #endif
- struct uwsgi_string_list *sni;
-@@ -3584,7 +3598,7 @@ void uwsgi_shutdown_all_sockets(void);
- void uwsgi_close_all_unshared_sockets(void);
-
- struct uwsgi_string_list *uwsgi_string_new_list(struct uwsgi_string_list **, char *);
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- struct uwsgi_regexp_list *uwsgi_regexp_custom_new_list(struct uwsgi_regexp_list **, char *, char *);
- #define uwsgi_regexp_new_list(x, y) uwsgi_regexp_custom_new_list(x, y, NULL);
- #endif
-@@ -3838,7 +3852,7 @@ void uwsgi_opt_add_addr_list(char *, cha
- void uwsgi_opt_add_string_list_custom(char *, char *, void *);
- void uwsgi_opt_add_dyn_dict(char *, char *, void *);
- void uwsgi_opt_binary_append_data(char *, char *, void *);
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- void uwsgi_opt_pcre_jit(char *, char *, void *);
- void uwsgi_opt_add_regexp_dyn_dict(char *, char *, void *);
- void uwsgi_opt_add_regexp_list(char *, char *, void *);
---- a/.github/workflows/compile-test.yml
-+++ b/.github/workflows/compile-test.yml
-@@ -9,6 +9,10 @@ on:
- jobs:
- build:
-
-+ strategy:
-+ matrix:
-+ libpcre: [libpcre3-dev, libpcre2-dev]
-+
- runs-on: ubuntu-20.04
-
- steps:
-@@ -20,7 +24,7 @@ jobs:
- run: |
- sudo apt update -qq
- sudo apt install --no-install-recommends -qqyf python3.8-dev \
-- libxml2-dev libpcre3-dev libcap2-dev \
-+ libxml2-dev ${{ matrix.libpcre }} libcap2-dev \
- libargon2-0-dev libsodium-dev \
- php7.4-dev libphp7.4-embed \
- liblua5.1-0-dev ruby2.7-dev \
---- a/.github/workflows/test.yml
-+++ b/.github/workflows/test.yml
-@@ -21,7 +21,7 @@ jobs:
- run: |
- sudo apt update -qq
- sudo apt install --no-install-recommends -qqyf python${{ matrix.python-version }}-dev \
-- libpcre3-dev libjansson-dev libcap2-dev \
-+ libpcre2-dev libjansson-dev libcap2-dev \
- curl check
- - name: Install distutils
- if: contains(fromJson('["3.6","3.7","3.8","3.9","3.10","3.11"]'), matrix.python-version)
---- a/plugins/php/php_plugin.c
-+++ b/plugins/php/php_plugin.c
-@@ -16,7 +16,7 @@ struct uwsgi_php {
- struct uwsgi_string_list *index;
- struct uwsgi_string_list *set;
- struct uwsgi_string_list *append_config;
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- struct uwsgi_regexp_list *app_bypass;
- #endif
- struct uwsgi_string_list *vars;
-@@ -63,7 +63,7 @@ struct uwsgi_option uwsgi_php_options[]
- {"php-fallback", required_argument, 0, "run the specified php script when the requested one does not exist", uwsgi_opt_set_str, &uphp.fallback, 0},
- {"php-fallback2", required_argument, 0, "run the specified php script relative to the document root when the requested one does not exist", uwsgi_opt_set_str, &uphp.fallback2, 0},
- {"php-fallback-qs", required_argument, 0, "php-fallback with QUERY_STRING set", uwsgi_opt_set_str, &uphp.fallback_qs, 0},
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- {"php-app-bypass", required_argument, 0, "if the regexp matches the uri the --php-app is bypassed", uwsgi_opt_add_regexp_list, &uphp.app_bypass, 0},
- #endif
- {"php-var", required_argument, 0, "add/overwrite a CGI variable at each request", uwsgi_opt_add_string_list, &uphp.vars, 0},
-@@ -810,10 +810,14 @@ int uwsgi_php_request(struct wsgi_reques
- wsgi_req->document_root_len = strlen(wsgi_req->document_root);
-
- if (uphp.app) {
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- struct uwsgi_regexp_list *bypass = uphp.app_bypass;
- while (bypass) {
-+#ifdef UWSGI_PCRE2
-+ if (uwsgi_regexp_match(bypass->pattern, wsgi_req->uri, wsgi_req->uri_len) >= 0) {
-+#else
- if (uwsgi_regexp_match(bypass->pattern, bypass->pattern_extra, wsgi_req->uri, wsgi_req->uri_len) >= 0) {
-+#endif
- goto oldstyle;
- }
- bypass = bypass->next;
-@@ -849,7 +853,7 @@ appready:
- goto secure2;
- }
-
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- oldstyle:
- #endif
-
---- a/core/config.c
-+++ b/core/config.c
-@@ -314,7 +314,7 @@ int uwsgi_logic_opt_if_not_hostname(char
- return 0;
- }
-
--#ifdef UWSGI_PCRE
-+#if defined(UWSGI_PCRE) || defined(UWSGI_PCRE2)
- int uwsgi_logic_opt_if_hostname_match(char *key, char *value) {
- if (uwsgi_regexp_match_pattern(uwsgi.logic_opt_data, uwsgi.hostname)) {
- add_exported_option(key, uwsgi_substitute(value, "%(_)", uwsgi.logic_opt_data), 0);
include $(TOPDIR)/rules.mk
PKG_NAME:=v2ray-core
-PKG_VERSION:=5.15.1
+PKG_VERSION:=5.15.3
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://codeload.github.com/v2fly/v2ray-core/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=461a65a1675f17ad95a2a5ddf0b016247a34aa376ed1738c143e7c6603ab4abd
+PKG_HASH:=32b325e54ee93fb3563c33d3c097592aa857370055d8ef1c50fd2387678843df
PKG_LICENSE:=MIT
PKG_LICENSE_FILES:=LICENSE
include $(TOPDIR)/rules.mk
PKG_NAME:=v2ray-geodata
-PKG_RELEASE:=r1
+PKG_RELEASE:=1
PKG_LICENSE_FILES:=LICENSE
PKG_MAINTAINER:=Tianling Shen <cnsztl@immortalwrt.org>
include $(INCLUDE_DIR)/package.mk
-GEOIP_VER:=202404040040
+GEOIP_VER:=202404110039
GEOIP_FILE:=geoip.dat.$(GEOIP_VER)
define Download/geoip
URL:=https://github.com/v2fly/geoip/releases/download/$(GEOIP_VER)/
URL_FILE:=geoip.dat
FILE:=$(GEOIP_FILE)
- HASH:=492a0af649accb4e9ae91f80a272e295ce6444489f6d85b389cdc635234c6ddf
+ HASH:=d4a2e3666139dc98b76f1b0bc7db6b9dd9b35a5d2b0aecb5943e4211c1ebd026
endef
-GEOSITE_VER:=20240403140129
+GEOSITE_VER:=20240410101316
GEOSITE_FILE:=dlc.dat.$(GEOSITE_VER)
define Download/geosite
URL:=https://github.com/v2fly/domain-list-community/releases/download/$(GEOSITE_VER)/
URL_FILE:=dlc.dat
FILE:=$(GEOSITE_FILE)
- HASH:=bcae4b8ff409117b8f24e6c62c0d5c8c9d4dca75d335e12f8ac3a22331a81c52
+ HASH:=e74d3da9d4db57fba399f9093ffabbc6630a7cf10965ebcde07725a0f00e24d7
endef
-GEOSITE_IRAN_VER:=202404010028
+GEOSITE_IRAN_VER:=202404150255
GEOSITE_IRAN_FILE:=iran.dat.$(GEOSITE_IRAN_VER)
define Download/geosite-ir
URL:=https://github.com/bootmortis/iran-hosted-domains/releases/download/$(GEOSITE_IRAN_VER)/
URL_FILE:=iran.dat
FILE:=$(GEOSITE_IRAN_FILE)
- HASH:=322d972bfb3f6bb5d960c6d7e14a732d75f0a32ad59ce609a1a9843eef51e257
+ HASH:=7b29fd53c2a25c6d79eeb6f76cc4b0a0770fe00eee1ea4d7a4a9f77d49ca44ad
endef
define Package/v2ray-geodata/template
$(call Package/v2ray-geodata/template)
TITLE:=GeoIP List for V2Ray
PROVIDES:=v2ray-geodata xray-geodata xray-geoip
- VERSION:=$(GEOIP_VER)-$(PKG_RELEASE)
+ VERSION:=$(GEOIP_VER)-r$(PKG_RELEASE)
LICENSE:=CC-BY-SA-4.0
endef
$(call Package/v2ray-geodata/template)
TITLE:=Geosite List for V2Ray
PROVIDES:=v2ray-geodata xray-geodata xray-geosite
- VERSION:=$(GEOSITE_VER)-$(PKG_RELEASE)
+ VERSION:=$(GEOSITE_VER)-r$(PKG_RELEASE)
LICENSE:=MIT
endef
$(call Package/v2ray-geodata/template)
TITLE:=Iran Geosite List for V2Ray
PROVIDES:=xray-geosite-ir
- VERSION:=$(GEOSITE_IRAN_VER)-$(PKG_RELEASE)
+ VERSION:=$(GEOSITE_IRAN_VER)-r$(PKG_RELEASE)
LICENSE:=MIT
endef
include $(TOPDIR)/rules.mk
PKG_NAME:=wget
-PKG_VERSION:=1.21.4
+PKG_VERSION:=1.24.5
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=@GNU/$(PKG_NAME)
-PKG_HASH:=81542f5cefb8faacc39bbbc6c82ded80e3e4a88505ae72ea51df27525bcde04c
+PKG_HASH:=fa2dc35bab5184ecbc46a9ef83def2aaaa3f4c9f3c97d4bd19dcb07d4da637de
PKG_MAINTAINER:=
PKG_LICENSE:=GPL-3.0-or-later
--with-kbuild="$(LINUX_DIR)" \
--with-xtlibdir="/usr/lib/iptables"
-ifdef CONFIG_EXTERNAL_TOOLCHAIN
-MAKE_FLAGS:= \
- $(patsubst ARCH=%,ARCH=$(LINUX_KARCH),$(MAKE_FLAGS)) \
- DEPMOD="/bin/true"
-
-MAKE_INSTALL_FLAGS:= \
- $(patsubst ARCH=%,ARCH=$(LINUX_KARCH),$(MAKE_FLAGS)) \
- DEPMOD="/bin/true"
-else
define Build/Compile
+$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR) \
$(KERNEL_MAKE_FLAGS) \
DEPMOD="/bin/true" \
install
endef
-endif
# 1: extension/module suffix used in package name
# 2: extension/module display name used in package title/description
include $(TOPDIR)/rules.mk
PKG_NAME:=mpg123
-PKG_VERSION:=1.32.5
+PKG_VERSION:=1.32.6
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
PKG_SOURCE_URL:=@SF/mpg123
-PKG_HASH:=af908cdf6cdb6544b97bc706a799f79894e69468af5881bf454a0ebb9171ed63
+PKG_HASH:=ccdd1d0abc31d73d8b435fc658c79049d0a905b30669b6a42a03ad169dc609e6
PKG_MAINTAINER:=Zoltan HERPAI <wigyori@uid0.hu>
PKG_LICENSE_FILES:=COPYING
PKG_NAME:=shairport-sync
PKG_VERSION:=4.3.2
-PKG_RELEASE:=3
+PKG_RELEASE:=5
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://codeload.github.com/mikebrady/shairport-sync/tar.gz/$(PKG_VERSION)?
SECTION:=sound
CATEGORY:=Sound
TITLE:=AirPlay compatible audio player
- DEPENDS:=@AUDIO_SUPPORT +libpthread +alsa-lib +libconfig +libdaemon +libpopt +libplist +libsodium +libgcrypt +libffmpeg-full +libuuid +nqptp
+ DEPENDS:=@AUDIO_SUPPORT +libpthread +alsa-lib +libconfig +libdaemon +libpopt +libplist +libsodium +libgcrypt +libffmpeg-full +libuuid +nqptp +libmosquitto
PROVIDES:=shairport-sync
URL:=https://github.com/mikebrady/shairport-sync
endef
--with-libdaemon \
--with-airplay-2 \
--with-pipe \
+ --with-mqtt-client \
--with-metadata
ifeq ($(BUILD_VARIANT),openssl)
# Session Control
option sesctl_run_before_play_begins '' # /etc/shairport-sync-start.sh
option sesctl_run_after_play_ends '' # /etc/shairport-sync-stop.sh
+ option sesctl_run_before_entering_active_state '' # /path/to/script.sh
+ option sesctl_run_after_exiting_active_state '' # /path/to/script.sh
+ option sesctl_run_if_an_unfixable_error_is_detected '' # /path/to/script.sh
+ option sesctl_run_when_volume_is_set '' # /path/to/script.sh
option sesctl_wait_for_completion '' # no/yes
option sesctl_session_interruption '' # no/yes
option sesctl_session_timeout '' # 120
# Stdout
option stdout_latency_offset '' # 0
option stdout_buffer_length '' # 44100
+ # MQTT: https://github.com/mikebrady/shairport-sync/blob/master/MQTT.md
+ option mqtt_enabled 'no'
+ option mqtt_hostname '127.0.0.1'
+ option mqtt_port '1883'
+ option mqtt_username '' # empty = no authentication
+ option mqtt_password '' # empty = no authentication
+ option mqtt_topic 'shairport'
+ option mqtt_publish_raw 'no'
+ option mqtt_publish_parsed 'no'
+ option mqtt_publish_cover 'no'
+ option mqtt_enable_remote 'no'
# AO
option ao_latency_offset '' # 0
option ao_buffer_length '' # 44100
printf "{\n"
append_str "$cfg" sesctl_run_before_play_begins "run_this_before_play_begins"
append_str "$cfg" sesctl_run_after_play_ends "run_this_after_play_ends"
+ append_str "$cfg" sesctl_run_before_entering_active_state "run_this_before_entering_active_state"
+ append_str "$cfg" sesctl_run_after_exiting_active_state "run_this_after_exiting_active_state"
+ append_str "$cfg" sesctl_run_if_an_unfixable_error_is_detected "run_this_if_an_unfixable_error_is_detected"
+ append_str "$cfg" sesctl_run_when_volume_is_set "run_this_when_volume_is_set"
append_str "$cfg" sesctl_wait_for_completion "wait_for_completion"
append_str "$cfg" sesctl_session_interruption "allow_session_interruption"
append_num "$cfg" sesctl_session_timeout "session_timeout"
append_num "$cfg" stdout_buffer_length "audio_backend_buffer_desired_length"
printf "};\n\n"
+ # MQTT
+ printf "mqtt =\n"
+ printf "{\n"
+ append_str "$cfg" mqtt_enabled "enabled"
+ append_str "$cfg" mqtt_hostname "hostname"
+ append_num "$cfg" mqtt_port "port"
+ append_str "$cfg" mqtt_username "username"
+ append_str "$cfg" mqtt_password "password"
+ append_str "$cfg" mqtt_topic "topic"
+ append_str "$cfg" mqtt_publish_raw "publish_raw"
+ append_str "$cfg" mqtt_publish_parsed "publish_parsed"
+ append_str "$cfg" mqtt_publish_cover "publish_cover"
+ append_str "$cfg" mqtt_enable_remote "enable_remote"
+ printf "};\n\n"
+
# AO audio back end
printf "ao =\n"
printf "{\n"
include $(TOPDIR)/rules.mk
PKG_NAME:=acpica-unix
-PKG_VERSION:=20230628
+PKG_VERSION:=20240321
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_CAT:=gzip -dc
-PKG_SOURCE_URL:=https://acpica.org/sites/$(patsubst %-unix,%,$(PKG_NAME))/files/
-PKG_HASH:=86876a745e3d224dcfd222ed3de465b47559e85811df2db9820ef09a9dff5cce
+PKG_SOURCE_URL:=https://downloadmirror.intel.com/819451
+PKG_HASH:=54a299487925fd3e0551c95f9d5cee4f4984930273983eff67aa5cd46f8f338b
PKG_MAINTAINER:=Philip Prindeville <philipp@redfish-solutions.com>
PKG_LICENSE:=GPL-2.0
include $(TOPDIR)/rules.mk
PKG_NAME:=base16384
-PKG_VERSION:=2.3.0
+PKG_VERSION:=2.3.1
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://codeload.github.com/fumiama/base16384/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=b3cda811eabd002cc16f5c0a3fdcac7bf4ffbdeb1447139e6fd21de4811e2f76
+PKG_HASH:=71ee39510c8c687254315ccc1aa5de601a5e2a2554b6db843f3874c12415a77a
PKG_MAINTAINER:=源 文雨 <fumiama@foxmail.com>
PKG_LICENSE:=GPL-3.0-or-later
PKG_NAME:=cni-plugins-nft
PKG_VERSION:=1.0.12
-PKG_RELEASE:=1
+PKG_RELEASE:=2
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://github.com/greenpau/cni-plugins/archive/v$(PKG_VERSION)
-PKG_HASH:=51c4b41c61f46c7dfc691d52dba301e7d8189589e1a625772f761ea3ae804fb3
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_VERSION:=v$(PKG_VERSION)
+PKG_SOURCE_URL:=https://github.com/greenpau/cni-plugins
+PKG_MIRROR_HASH:=3bb778c8f48261eaaee8b14b9219f1730967ef16158b5b540d45da54ef580e53
PKG_MAINTAINER:=Oskari Rauta <oskari.rauta@gmail.com>
PKG_LICENSE:=Apache-2.0
include $(INCLUDE_DIR)/package.mk
include ../../lang/golang/golang-package.mk
-PKG_UNPACK:=$(HOST_TAR) -C "$(PKG_BUILD_DIR)" --strip-components=1 -xzf "$(DL_DIR)/$(PKG_SOURCE)"
-
define Package/cni-plugins-nft
SECTION:=utils
CATEGORY:=Utilities
PKG_NAME:=cni-plugins
PKG_VERSION:=1.1.1
-PKG_RELEASE:=1
-PKG_LICENSE:=Apache-2.0
-PKG_LICENSE_FILES:=LICENSE
+PKG_RELEASE:=2
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://github.com/containernetworking/plugins/archive/v$(PKG_VERSION)
-PKG_HASH:=c86c44877c47f69cd23611e22029ab26b613f620195b76b3ec20f589367a7962
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_VERSION:=v$(PKG_VERSION)
+PKG_SOURCE_URL:=https://github.com/containernetworking/plugins
+PKG_MIRROR_HASH:=4372700fa1fb159235586432800f228d92246d13571f5a29aa9bc58291eac6d9
PKG_MAINTAINER:=Daniel Golle <daniel@makrotopia.org>, Paul Spooren <mail@aparcar.org>
+PKG_LICENSE:=Apache-2.0
+PKG_LICENSE_FILES:=LICENSE
PKG_BUILD_DEPENDS:=golang/host
PKG_BUILD_PARALLEL:=1
include $(INCLUDE_DIR)/package.mk
include ../../lang/golang/golang-package.mk
-PKG_UNPACK:=$(HOST_TAR) -C "$(PKG_BUILD_DIR)" --strip-components=1 -xzf "$(DL_DIR)/$(PKG_SOURCE)"
-
define Package/cni-plugins
SECTION:=utils
CATEGORY:=Utilities
PKG_SOURCE_URL:=https://github.com/blocktrron/cudy-bdinfo-decrypt.git
PKG_SOURCE_DATE:=2023-06-01
PKG_SOURCE_VERSION:=5a60308c0fff610c4698207387d7153aba5fd62b
-PKG_MIRROR_HASH:=aefcd37e4b059d92226d2bc97b1b199f6a360c4935a6e92c930998b510275838
+PKG_MIRROR_HASH:=92fba88358cf150a3be7dd982b2fdf90b9a730de415c39af99b6ac70bc907b53
PKG_MAINTAINER:=David Bauer <mail@david-bauer.net>
PKG_LICENSE:=GPL-2.0-or-later
include $(TOPDIR)/rules.mk
PKG_NAME:=compose
-PKG_VERSION:=2.26.1
-PKG_RELEASE:=2
+PKG_VERSION:=2.27.0
+PKG_RELEASE:=1
PKG_LICENSE:=Apache-2.0
PKG_LICENSE_FILES:=LICENSE
PKG_SOURCE:=$(PKG_NAME)-v$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://codeload.github.com/docker/compose/tar.gz/v${PKG_VERSION}?
-PKG_HASH:=081ad40241f8e144cad088a65e6fd0ec588e3d36931e5baabb3dc5ab068ceb60
+PKG_HASH:=29b2232d1609dff03db74188a7944c85ba8b612f47a7e39938a43db8fb7d7067
PKG_MAINTAINER:=Javier Marcet <javier@marcet.info>
+kmod-veth \
+tini \
+uci-firewall \
- @!(mips||mipsel)
+ @!(mips||mips64||mipsel)
USERID:=docker:docker
MENU:=1
endef
PKG_SOURCE_URL:=https://github.com/rhboot/efibootmgr.git
PKG_SOURCE_DATE:=2022-11-12
PKG_SOURCE_VERSION:=1904f9cd5a48207d49e393ac8de824f54ccfb697
-PKG_MIRROR_HASH:=0355e00bb54d468ecbaa106aa703dd389f2f2f4c7b7afb78a258cec10d75f78d
+PKG_MIRROR_HASH:=24053efe63aa62c711cdc770aaeb7079b95f5bf807f1725d1b2193f2e2683962
PKG_LICENSE:=GPL-2.0-only
PKG_LICENSE_FILES:=COPYING
include $(TOPDIR)/rules.mk
PKG_NAME:=eza
-PKG_VERSION:=0.18.9
+PKG_VERSION:=0.18.11
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://codeload.github.com/eza-community/eza/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=917736591429813ef4cfce47bb2d3d87e9f1e142b2a6ebf74a345c3a15894918
+PKG_HASH:=92d810c36ac67038e2ed3c421087de8793eb0b9de332c9239096df9d52eb30e3
PKG_MAINTAINER:=Jonas Jelonek <jelonek.jonas@gmail.com>
PKG_LICENSE:=MIT
include $(TOPDIR)/rules.mk
PKG_NAME:=fontconfig
-PKG_VERSION:=2.13.94
-PKG_RELEASE:=3
+PKG_VERSION:=2.15.0
+PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
-PKG_SOURCE_URL:=https://fontconfig.org/release/
-PKG_HASH:=a5f052cb73fd479ffb7b697980510903b563bbb55b8f7a2b001fcfb94026003c
+PKG_SOURCE_URL:=https://www.freedesktop.org/software/fontconfig/release/
+PKG_HASH:=63a0658d0e06e0fa886106452b58ef04f21f58202ea02a94c39de0d3335d7c0e
PKG_MAINTAINER:=
PKG_LICENSE:=
SUBMENU:=Font-Utils
TITLE:=fontconfig
DEPENDS:=+libpthread +libexpat +libfreetype
- URL:=http://fontconfig.org/
+ URL:=https://www.freedesktop.org/wiki/Software/fontconfig/
endef
MESON_ARGS += \
+++ /dev/null
-Revert partially the upstream commit ae9ac2a1
-
- Subject: [PATCH] meson: fix cross-compilation issues with gperf header file preprocessing
-
- Pass c_args to the compiler when preprocessing the gperf header file,
- they might contain important bits without which compilation/preprocessing
- might fail (e.g. with clang on Android). cc.cmd_array() does not include
- the c_args and we can't easily look them up from the meson.build file, so
- we have to retrieve from the introspection info.
-
- This is basically the Meson equivalent to commit 57103773.
-
-Revert the host_cargs related part of the patch
-
-
---- a/src/cutout.py
-+++ b/src/cutout.py
-@@ -24,7 +24,7 @@ if __name__== '__main__':
- break
-
- cpp = args[1]
-- ret = subprocess.run(cpp + host_cargs + [args[0].input], stdout=subprocess.PIPE, check=True)
-+ ret = subprocess.run(cpp + [args[0].input], stdout=subprocess.PIPE, check=True)
-
- stdout = ret.stdout.decode('utf8')
-
include $(TOPDIR)/rules.mk
PKG_NAME:=gptfdisk
-PKG_VERSION:=1.0.9
+PKG_VERSION:=1.0.10
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=@SF/$(PKG_NAME)
-PKG_HASH:=dafead2693faeb8e8b97832b23407f6ed5b3219bc1784f482dd855774e2d50c2
+PKG_HASH:=2abed61bc6d2b9ec498973c0440b8b804b7a72d7144069b5a9209b2ad693a282
PKG_MAINTAINER:=
PKG_LICENSE:=GPL-2.0-or-later
+++ /dev/null
-From 7dfa8984f5a30f313d8675ff6097c8592d636d10 Mon Sep 17 00:00:00 2001
-From: Khem Raj <raj.khem@gmail.com>
-Date: Mon, 12 Dec 2022 12:50:07 -0800
-Subject: [PATCH] Use 64bit time_t on linux as well
-
-Alias 64bit version of stat functions to original functions
-we are already passing -D_FILE_OFFSET_BITS=64 in linux Makefile
-
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
----
- diskio-unix.cc | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
---- a/diskio-unix.cc
-+++ b/diskio-unix.cc
-@@ -37,8 +37,12 @@
-
- using namespace std;
-
--#ifdef __APPLE__
-+#if defined(__APPLE__) || defined(__linux__)
- #define off64_t off_t
-+#define stat64 stat
-+#define fstat64 fstat
-+#define lstat64 lstat
-+#define lseek64 lseek
- #endif
-
- // Returns the official "real" name for a shortened version of same.
include $(TOPDIR)/rules.mk
PKG_NAME:=hwdata
-PKG_VERSION:=0.380
+PKG_VERSION:=0.381
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://codeload.github.com/vcrhonek/hwdata/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=e5ca061d9e0b9b177bed8d16f94b4cd54ce9eebd1ec115f7cf2174d3a6052049
+PKG_HASH:=53435c73964ddc24ac53fa86e29e8b9244ca1cab0578ffdd82fd280f35863004
PKG_MAINTAINER:=
PKG_LICENSE:=GPL-2.0-or-later XFree86-1.0
include $(TOPDIR)/rules.mk
PKG_NAME:=mc
-PKG_VERSION:=4.8.30
-PKG_RELEASE:=2
+PKG_VERSION:=4.8.31
+PKG_RELEASE:=1
PKG_MAINTAINER:=
PKG_LICENSE:=GPL-3.0-or-later
PKG_CPE_ID:=cpe:/a:midnight_commander:midnight_commander
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
PKG_SOURCE_URL:=http://ftp.midnight-commander.org/
-PKG_HASH:=5ebc3cb2144b970c5149fda556c4ad50b78780494696cdf2d14a53204c95c7df
+PKG_HASH:=24191cf8667675b8e31fc4a9d18a0a65bdc0598c2c5c4ea092494cd13ab4ab1a
PKG_BUILD_PARALLEL:=1
PKG_FIXUP:=autoreconf gettext-version
PKG_BUILD_DEPENDS:=MC_VFS:libtirpc
include $(TOPDIR)/rules.mk
PKG_NAME:=minicom
-PKG_VERSION:=2.8
-PKG_RELEASE:=2
+PKG_VERSION:=2.9
+PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
PKG_SOURCE_URL:=https://salsa.debian.org/minicom-team/minicom/-/archive/$(PKG_VERSION)
-PKG_HASH:=38cea30913a20349326ff3f1763ee1512b7b41601c24f065f365e18e9db0beba
+PKG_HASH:=9efbb6458140e5a0de445613f0e76bcf12cbf7a9892b2f53e075c2e7beaba86c
PKG_MAINTAINER:=Álvaro Fernández Rojas <noltari@gmail.com>
PKG_LICENSE:=GPL-2.0-or-later
--- a/src/minicom.c
+++ b/src/minicom.c
-@@ -1248,7 +1248,7 @@ int main(int argc, char **argv)
+@@ -1323,7 +1323,7 @@ int main(int argc, char **argv)
switch(c) {
case 'v':
printf(_("%s version %s"), PACKAGE, VERSION);
printf(_(" (compiled %s)"), __DATE__);
#endif
printf("\n");
-@@ -1580,7 +1580,7 @@ int main(int argc, char **argv)
+@@ -1659,7 +1659,7 @@ int main(int argc, char **argv)
mc_wprintf(us, "\n%s %s\r\n", _("Welcome to minicom"), VERSION);
mc_wprintf(us, "\n%s: %s\r\n", _("OPTIONS"), option_string);
include $(TOPDIR)/rules.mk
PKG_NAME:=moreutils
-PKG_VERSION:=0.68
+PKG_VERSION:=0.69
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://git.kitenet.net/index.cgi/moreutils.git/snapshot
-PKG_HASH:=5eb14bc7bc1407743478ebdbd83772bf3b927fd949136a2fbbde96fa6000b6e7
+PKG_HASH:=0f795d25356ca61544966646fb707d5be0b9864116be0269df5433f62d4e05d1
PKG_MAINTAINER:=Nikil Mehta <nikil.mehta@gmail.com>
PKG_LICENSE:=GPL-2.0-or-later
clean:
rm -f $(BINS) $(MANS) dump.c errnos.h errno.o \
-@@ -28,9 +28,6 @@ install:
+@@ -33,9 +33,6 @@ install:
$(INSTALL_BIN) $(BINS) $(DESTDIR)$(PREFIX)/bin
install $(PERLSCRIPTS) $(DESTDIR)$(PREFIX)/bin
CATEGORY:=Utilities
TITLE:=Mellanox Firmware Burning and Diagnostics Tools
URL:=https://github.com/Mellanox/mstflint
- DEPENDS:=@!(mips||mipsel) \
+ DEPENDS:=@!(mips||mips64||mipsel) \
+libcurl +liblzma +libopenssl +libsqlite3 \
+libstdcpp +libxml2 +python3-ctypes \
+python3-urllib +python3-xml +zlib
PKG_SOURCE_PROTO:=git
PKG_SOURCE_URL:=https://github.com/lunn/mv88e6xxx_dump
-PKG_MIRROR_HASH:=cee56d21347496ca38a15d7572dbd2b0db32dfbfbb19a8ce679b9095f7b5a247
+PKG_MIRROR_HASH:=9b6d491933bee0dca79d5ef8b366beff796f90fdc27002a8b82ad8e4c56bd148
PKG_SOURCE_DATE:=2023.03.08
PKG_SOURCE_VERSION:=b4c5247ee8bb5512fb80081503aae183b35ed3c6
include $(TOPDIR)/rules.mk
PKG_NAME:=pciutils
-PKG_VERSION:=3.10.0
+PKG_VERSION:=3.12.0
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
PKG_SOURCE_URL:=@KERNEL/software/utils/pciutils
-PKG_HASH:=238a2e27166730e53a17fe07bfad229e07fa39b618117e5944b6d7eda9fbb0e9
+PKG_HASH:=f185d116d5ff99b797497efce8f19f1ee8ccc5a668b97a159e3d13472f674154
PKG_MAINTAINER:=Lucian Cristian <lucian.cristian@gmail.com>
PKG_LICENSE:=GPL-2.0
--- a/Makefile
+++ b/Makefile
-@@ -149,8 +149,8 @@ distclean: clean
+@@ -162,9 +162,9 @@ distclean: clean
install: all
# -c is ignored on Linux, but required on FreeBSD
$(DIRINSTALL) -m 755 $(DESTDIR)$(BINDIR) $(DESTDIR)$(SBINDIR) $(DESTDIR)$(IDSDIR) $(DESTDIR)$(MANDIR)/man8 $(DESTDIR)$(MANDIR)/man7 $(DESTDIR)$(MANDIR)/man5
- $(INSTALL) -c -m 755 $(STRIP) lspci$(EXEEXT) $(DESTDIR)$(LSPCIDIR)
- $(INSTALL) -c -m 755 $(STRIP) setpci$(EXEEXT) $(DESTDIR)$(SBINDIR)
+- $(INSTALL) -c -m 755 $(STRIP) pcilmr$(EXEEXT) $(DESTDIR)$(SBINDIR)
+ $(INSTALL) -c -m 755 lspci$(EXEEXT) $(DESTDIR)$(LSPCIDIR)
+ $(INSTALL) -c -m 755 setpci$(EXEEXT) $(DESTDIR)$(SBINDIR)
++ $(INSTALL) -c -m 755 pcilmr$(EXEEXT) $(DESTDIR)$(SBINDIR)
$(INSTALL) -c -m 755 update-pciids $(DESTDIR)$(SBINDIR)
ifneq ($(IDSDIR),)
$(INSTALL) -c -m 644 $(PCI_IDS) $(DESTDIR)$(IDSDIR)
include $(TOPDIR)/rules.mk
PKG_NAME:=qemu
-PKG_VERSION:=8.2.0
+PKG_VERSION:=8.2.2
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
-PKG_HASH:=bf00d2fa12010df8b0ade93371def58e632cb32a6bfdc5f5a0ff8e6a1fb1bf32
-PKG_SOURCE_URL:=http://download.qemu.org/
+PKG_HASH:=847346c1b82c1a54b2c38f6edbd85549edeb17430b7d4d3da12620e2962bc4f3
+PKG_SOURCE_URL:=https://download.qemu.org/
PKG_LICENSE:=GPL-2.0-only
PKG_LICENSE_FILES:=LICENSE tcg/LICENSE
PKG_MAINTAINER:=Yousong Zhou <yszhou4tech@gmail.com>
CATEGORY:=Utilities
SUBMENU:=Virtualization
TITLE:=QEMU reverse keymaps for use with -k argument
- URL:=http://www.qemu.org
+ URL:=https://www.qemu.org
DEPENDS:=$(QEMU_DEPS_IN_HOST)
endef
PKG_SOURCE_PROTO:=git
PKG_SOURCE_URL:=https://github.com/Hurricos/realtek-poe.git
PKG_SOURCE_VERSION:=39c93d39dd10da77b4fe48bc1d6bdd3c5978f866
-PKG_MIRROR_HASH:=ad9652dda8d77281e4724e0104552e18e521cedd4e24f56b0483cf6c5ee5ff69
+PKG_MIRROR_HASH:=eb10a6d204bd79ab5a2925f05a68a1a66e0b5402de5d304265858b87d3f7b027
CMAKE_SOURCE_SUBDIR:=src
include $(INCLUDE_DIR)/package.mk
--- /dev/null
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Hauke Mehrtens <hauke@hauke-m.de>
+Date: Sun, 14 Apr 2024 16:06:15 +0200
+Subject: Support POSIX basename() from musl libc
+
+Musl libc 1.2.5 removed the definition of the basename() function from
+string.h and only provides it in libgen.h as the POSIX standard
+defines it.
+
+This change fixes compilation with musl libc 1.2.5.
+````
+build_dir/target-mips_24kc_musl/rtty-mbedtls/rtty-8.1.1/src/file.c:156:24: error: implicit declaration of function 'basename' [-Werror=implicit-function-declaration]
+ 156 | const char *name = basename(path);
+ | ^~~~~~~~
+````
+
+basename() modifies the input string, copy it first with strdup(), If
+strdup() returns NULL the code will handle it.
+
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+---
+ src/file.c | 8 +++++++-
+ src/filectl.c | 6 +++++-
+ 2 files changed, 12 insertions(+), 2 deletions(-)
+
+--- a/src/file.c
++++ b/src/file.c
+@@ -29,6 +29,7 @@
+ #include <unistd.h>
+ #include <mntent.h>
+ #include <inttypes.h>
++#include <libgen.h>
+ #include <sys/statvfs.h>
+ #include <linux/limits.h>
+ #include <sys/sysinfo.h>
+@@ -153,13 +154,17 @@ static int start_upload_file(struct file
+ {
+ struct tty *tty = container_of(ctx, struct tty, file);
+ struct rtty *rtty = tty->rtty;
+- const char *name = basename(path);
++ const char *name;
+ struct stat st;
+ int fd;
++ char *dirc;
+
++ dirc = strdup(path);
++ name = basename(dirc);
+ fd = open(path, O_RDONLY);
+ if (fd < 0) {
+ log_err("open '%s' fail: %s\n", path, strerror(errno));
++ free(dirc);
+ return -1;
+ }
+
+@@ -177,6 +182,7 @@ static int start_upload_file(struct file
+ ctx->remain_size = st.st_size;
+
+ log_info("upload file: %s, size: %" PRIu64 "\n", path, (uint64_t)st.st_size);
++ free(dirc);
+
+ return 0;
+ }
+--- a/src/filectl.c
++++ b/src/filectl.c
+@@ -30,6 +30,7 @@
+ #include <errno.h>
+ #include <stdio.h>
+ #include <fcntl.h>
++#include <libgen.h>
+
+ #include "utils.h"
+ #include "file.h"
+@@ -75,6 +76,7 @@ static void handle_file_control_msg(int
+ {
+ struct file_control_msg msg;
+ struct buffer b = {};
++ char *dirc;
+
+ while (true) {
+ if (buffer_put_fd(&b, fd, -1, NULL) < 0)
+@@ -90,7 +92,9 @@ static void handle_file_control_msg(int
+ if (sfd > -1) {
+ close(sfd);
+ gettimeofday(&start_time, NULL);
+- printf("Transferring '%s'...Press Ctrl+C to cancel\n", basename(path));
++ dirc = strdup(path);
++ printf("Transferring '%s'...Press Ctrl+C to cancel\n", basename(dirc));
++ free(dirc);
+
+ if (total_size == 0) {
+ printf(" 100%% 0 B 0s\n");
include $(TOPDIR)/rules.mk
PKG_NAME:=stress-ng
-PKG_VERSION:=0.17.05
+PKG_VERSION:=0.17.07
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://codeload.github.com/ColinIanKing/stress-ng/tar.gz/refs/tags/V$(PKG_VERSION)?
-PKG_HASH:=48964a0de5838acfed5c78d78d5f4a1d86974883d5537ccc55df019a0186a1b5
+PKG_HASH:=b0bc1495adce6c7a1f82d53f363682b243d6d7e93a06be7f94c9559c0a311a6f
PKG_MAINTAINER:=Alexandru Ardelean <ardeleanalex@gmail.com>
PKG_LICENSE:=GPL-2.0-only
--- a/Makefile.config
+++ b/Makefile.config
-@@ -327,10 +327,10 @@ clean:
+@@ -351,10 +351,10 @@ clean:
.PHONY: libraries
libraries: \
configdir \
--- /dev/null
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Hauke Mehrtens <hauke@hauke-m.de>
+Date: Sun, 14 Apr 2024 15:33:51 +0200
+Subject: Support POSIX basename() from musl libc
+
+Musl libc 1.2.5 removed the definition of the basename() function from
+string.h and only provides it in libgen.h as the POSIX standard
+defines it.
+
+This change fixes compilation with musl libc 1.2.5.
+````
+build_dir/target-mips_24kc_musl/tini-0.19.0/src/tini.c:227:36: error: implicit declaration of function 'basename' [-Wimplicit-function-declaration]
+ 227 | fprintf(file, "%s (%s)\n", basename(name), TINI_VERSION_STRING);
+build_dir/target-mips_24kc_musl/tini-0.19.0/src/tini.c:227:25: error: format '%s' expects argument of type 'char *', but argument 3 has type 'int' [-Werror=format=]
+ 227 | fprintf(file, "%s (%s)\n", basename(name), TINI_VERSION_STRING);
+ | ~^ ~~~~~~~~~~~~~~
+ | | |
+ | char * int
+ | %d
+
+````
+
+basename() modifies the input string, copy it first with strdup(), If
+strdup() returns NULL the code will handle it.
+
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+---
+ src/tini.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+--- a/src/tini.c
++++ b/src/tini.c
+@@ -14,6 +14,7 @@
+ #include <stdlib.h>
+ #include <unistd.h>
+ #include <stdbool.h>
++#include <libgen.h>
+
+ #include "tiniConfig.h"
+ #include "tiniLicense.h"
+@@ -224,14 +225,19 @@ int spawn(const signal_configuration_t*
+ }
+
+ void print_usage(char* const name, FILE* const file) {
+- fprintf(file, "%s (%s)\n", basename(name), TINI_VERSION_STRING);
++ char *dirc, *bname;
++
++ dirc = strdup(name);
++ bname = basename(dirc);
++
++ fprintf(file, "%s (%s)\n", bname, TINI_VERSION_STRING);
+
+ #if TINI_MINIMAL
+- fprintf(file, "Usage: %s PROGRAM [ARGS] | --version\n\n", basename(name));
++ fprintf(file, "Usage: %s PROGRAM [ARGS] | --version\n\n", bname);
+ #else
+- fprintf(file, "Usage: %s [OPTIONS] PROGRAM -- [ARGS] | --version\n\n", basename(name));
++ fprintf(file, "Usage: %s [OPTIONS] PROGRAM -- [ARGS] | --version\n\n", bname);
+ #endif
+- fprintf(file, "Execute a program under the supervision of a valid init process (%s)\n\n", basename(name));
++ fprintf(file, "Execute a program under the supervision of a valid init process (%s)\n\n", bname);
+
+ fprintf(file, "Command line options:\n\n");
+
+@@ -261,6 +267,7 @@ void print_usage(char* const name, FILE*
+ fprintf(file, " %s: Send signals to the child's process group.\n", KILL_PROCESS_GROUP_GROUP_ENV_VAR);
+
+ fprintf(file, "\n");
++ free(dirc);
+ }
+
+ void print_license(FILE* const file) {
PKG_NAME:=usbmuxd
PKG_VERSION:=1.1.1
-PKG_RELEASE:=1
+PKG_RELEASE:=2
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
PKG_SOURCE_URL:=https://www.libimobiledevice.org/downloads
SUBMENU:=libimobiledevice
TITLE:=USB multiplexing daemon
URL:=https://www.libimobiledevice.org/
- DEPENDS:=+librt +libusb-1.0 +libusbmuxd +libopenssl +libimobiledevice
+ DEPENDS:=+libusb-1.0 +libusbmuxd +libopenssl +libimobiledevice +usbutils
endef
define Package/usbmuxd/description
CONFIGURE_ARGS += --with-systemd
define Package/usbmuxd/install
+ $(INSTALL_DIR) $(1)/etc/hotplug.d/usb
$(INSTALL_DIR) $(1)/etc/init.d
+ $(INSTALL_BIN) ./files/usbmuxd.hotplug $(1)/etc/hotplug.d/usb/40-usbmuxd
$(INSTALL_BIN) ./files/usbmuxd.init $(1)/etc/init.d/usbmuxd
$(INSTALL_DIR) $(1)/usr/sbin
$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/usbmuxd $(1)/usr/sbin/
--- /dev/null
+case "$ACTION" in
+ bind)
+ dev=/sys$DEVPATH
+
+ [ ! -f /tmp/iPhone.lock ] && [ -d ${dev}/net ] &&
+ {
+ readlink ${dev}/driver | grep -q ipheth &&
+ {
+ sleep 5
+ carrier_path=${dev}/net/*/carrier
+ carrier=`cat ${carrier_path}`
+
+ [ "${carrier}" = "0" ] &&
+ {
+ touch /tmp/iPhone.lock
+ logger -p daemon.error -t iPhone ${carrier_path} = ${carrier}
+ logger -p daemon.error -t iPhone `/usr/bin/usbreset iPhone`
+ /etc/init.d/usbmuxd restart
+ sleep 5 && rm -f /tmp/iPhone.lock &
+ }
+ }
+ }
+ ;;
+esac
include $(TOPDIR)/rules.mk
PKG_NAME:=whois
-PKG_VERSION:=5.5.21
+PKG_VERSION:=5.5.22
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)_$(PKG_VERSION).tar.xz
PKG_SOURCE_URL:=http://ftp.debian.org/debian/pool/main/w/whois
-PKG_HASH:=760ab584beae76acdcc89c6aec2e91cff571185bccc2bee8e4412a3f8e70be77
+PKG_HASH:=03f12c27ae85870d7bcd95b14f3fb8b174532b2f2a59d8380c42ae436d0630d7
-PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)
PKG_BUILD_DEPENDS:=perl/host
PKG_MAINTAINER:=Paul Spooren <mail@aparcar.org>
PKG_NAME:=xxhash
PKG_VERSION:=0.8.2
-PKG_RELEASE:=1
+PKG_RELEASE:=2
-PKG_SOURCE:=$(PKG_NAME)_$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://github.com/Cyan4973/xxHash/archive/v$(PKG_VERSION)
-PKG_HASH:=baee0c6afd4f03165de7a4e67988d16f0f2b257b51d0e3cb91909302a26a79c4
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_VERSION:=v$(PKG_VERSION)
+PKG_SOURCE_URL:=https://github.com/Cyan4973/xxHash
+PKG_MIRROR_HASH:=0602a12e9ecd009f97a2a845fb5e46af69a60f96547952e5b00228f33bed5cdd
# The source for the library (xxhash.c and xxhash.h) is BSD
# The source for the command line tool (xxhsum.c) is GPLv2+
PKG_LICENSE_FILES:=LICENSE cli/COPYING
PKG_MAINTAINER:=Julien Malik <julien.malik@paraiso.me>
-PKG_INSTALL:=1
+CMAKE_SOURCE_SUBDIR:=cmake_unofficial
include $(INCLUDE_DIR)/package.mk
-
-PKG_UNPACK:=$(HOST_TAR) -C "$(PKG_BUILD_DIR)" --strip-components=1 -xzf "$(DL_DIR)/$(PKG_SOURCE)"
+include $(INCLUDE_DIR)/cmake.mk
define Package/xxhash/Default
TITLE:=Extremely fast hash algorithm
$(INSTALL_DIR) $(1)/usr/include
$(CP) $(PKG_INSTALL_DIR)/usr/include/*.h $(1)/usr/include/
$(INSTALL_DIR) $(1)/usr/lib
- $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxxhash.{a,so*} $(1)/usr/lib/
+ $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxxhash.so* $(1)/usr/lib/
$(INSTALL_DIR) $(1)/usr/lib/pkgconfig
$(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libxxhash.pc $(1)/usr/lib/pkgconfig/
endef
include $(TOPDIR)/rules.mk
PKG_NAME:=yara
-PKG_VERSION:=4.2.0
+PKG_VERSION:=4.5.0
PKG_RELEASE:=1
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://codeload.github.com/VirusTotal/yara/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=6f567d4e4b79a210cd57a820f59f19ee69b024188ef4645b1fc11488a4660951
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_VERSION:=v$(PKG_VERSION)
+PKG_SOURCE_URL:=https://github.com/VirusTotal/yara
+PKG_MIRROR_HASH:=1b549a5aa3320ed768398b0152cb194a7e30c24275fc054facdb4d41bf729cb4
PKG_MAINTAINER:=Marko Ratkaj <markoratkaj@gmail.com>
PKG_LICENSE:=BSD-3-Clause
$(if $(CONFIG_YARA_module_magic),--enable,--disable)-magic \
$(if $(CONFIG_YARA_module_cuckoo),--enable,--disable)-cuckoo
+TARGET_CFLAGS += -D_LARGEFILE64_SOURCE
+
define Package/yara/config
source "$(SOURCE)/Config.in"
endef
projects / feed / packages.git / commitdiff