buildroot/package/mosquitto, branch 2019.02-op-build

package/mosquitto: bump version to 1.5.8

2019-03-25T17:52:25+00:00

Bugfix release, fixing a number of issues discovered post-1.5.7 https://mosquitto.org/blog/2019/02/version-1-5-8-released/ Signed-off-by: Peter Korsgaard Signed-off-by: Thomas Petazzoni (cherry picked from commit 24cc2eaa335a34633b71a7db7c972ab64b5e7739) Signed-off-by: Peter Korsgaard

package/mosquitto: bump to version 1.5.7

2019-02-14T20:51:08+00:00

Bugfix release, fixing a number of issues discovered post-1.5.6. Drop patches as they are now included upstream. Signed-off-by: Peter Korsgaard

package/mosquitto: security bump to version 1.5.6

2019-02-10T09:49:26+00:00

Fixes the following security issues: CVE-2018-12551: If Mosquitto is configured to use a password file for authentication, any malformed data in the password file will be treated as valid. This typically means that the malformed data becomes a username and no password. If this occurs, clients can circumvent authentication and get access to the broker by using the malformed username. In particular, a blank line will be treated as a valid empty username. Other security measures are unaffected. Users who have only used the mosquitto_passwd utility to create and modify their password files are unaffected by this vulnerability. Affects version 1.0 to 1.5.5 inclusive. CVE-2018-12550: If an ACL file is empty, or has only blank lines or comments, then mosquitto treats the ACL file as not being defined, which means that no topic access is denied. Although denying access to all topics is not a useful configuration, this behaviour is unexpected and could lead to access being incorrectly granted in some circumstances. Affects versions 1.0 to 1.5.5 inclusive. CVE-2018-12546: If a client publishes a retained message to a topic that they have access to, and then their access to that topic is revoked, the retained message will still be delivered to future subscribers. This behaviour may be undesirable in some applications, so a configuration option check_retain_source has been introduced to enforce checking of the retained message source on publish. Add two upstream post-1.5.6 patches to fix a build error in the bridge code when ADNS is enabled and when building with older toolchains not defaulting to C99 mode. Signed-off-by: Peter Korsgaard

package/mosquitto: fix comments

2019-02-08T14:05:44+00:00

The toplevel mosquitto comment should go after the sub options to ensure they get indented, and the broker comment should be hidden if mosquitto isn't enabled. Signed-off-by: Peter Korsgaard

package/mosquitto: security bump to version 1.5.5

2018-12-21T21:51:59+00:00

>From the release notes: If per_listener_settings is set to true, then the acl_file setting was ignored for the "default listener" only. This has been fixed. This does not affect any listeners defined with the listener option. https://mosquitto.org/blog/2018/12/version-155-released/ Signed-off-by: Peter Korsgaard

package/mosquitto: make broker optional

2018-12-15T08:40:51+00:00

The mosquitto package provides both the MQTT client library and a broker, and the latter may be not needed (when connecting to a remote broker). It should be therefore possible to not install and start it on the target Also remove the dependency on BR2_TOOLCHAIN_HAS_SYNC_4, as it does not seem to be needed. Verified with: * br-m68k-68040-full.config [OK] * br-sparc-uclibc.config [OK] The original issue adding the dependency in commit 874d0784bb23d (package/mosquito: needs sync_4) unfortunately refers to autobuilder results that are no longer available. Signed-off-by: Titouan Christophe [Peter: extend commit message, fix comment line, remove indentation in .mk] Signed-off-by: Peter Korsgaard

mosquitto: security bump to version 1.5.4

2018-11-09T13:05:44+00:00

>From the announcement: When using a TLS enabled websockets listener with require_certificate enabled, the mosquitto broker does not correctly verify client certificates. This is now fixed. All other security measures operate as expected, and in particular non-websockets listeners are not affected by this. https://mosquitto.org/blog/2018/11/version-154-released/ Drop patch 0001, now applied upstream: https://github.com/eclipse/mosquitto/pull/933 Signed-off-by: Peter Korsgaard

mosquitto: security bump to version 1.5.3

2018-09-30T08:38:34+00:00

Fix CVE-2018-12543. If a message is sent to Mosquitto with a topic that begins with $, but is not $SYS, then an assert that should be unreachable is triggered and Mosquitto will exit. Signed-off-by: Fabrice Fontaine Signed-off-by: Peter Korsgaard

package/mosquitto: bump version to 1.5.1

2018-08-24T21:25:08+00:00

Removed patch 0001, applied upstream. Replaced patch 0002 with a more generic solution as patch 0001. Signed-off-by: Bernd Kuhls Signed-off-by: Thomas Petazzoni

mosquitto: fix build with some glibc

2018-06-19T11:59:18+00:00

Add patch to define _GNU_SOURCE before using S_IF{DIR,REG} Fixes: - http://autobuild.buildroot.net/results/7dcfb6ca9d14a5cd6872590065549356f1ab42a0 Signed-off-by: Fabrice Fontaine Signed-off-by: Peter Korsgaard