[Buildroot] [PATCH] package/tcpreplay: security bump to version 4.6.1

* [Buildroot] [PATCH] package/tcpreplay: security bump to version 4.6.1
@ 2026-09-29 12:39 Yegor Yefremov via buildroot
  2026-10-03 16:02 ` Thomas Petazzoni via buildroot
  2026-10-10  9:23 ` Thomas Perale via buildroot
  0 siblings, 2 replies; 3+ messages in thread
From: Yegor Yefremov via buildroot @ 2026-09-29 12:39 UTC (permalink / raw)
  To: buildroot

From: Yegor Yefremov <yegorslists@googlemail.com>

Fixes the following security issues:

4.5.4: GHSA-2wmf-4p77-784q, GHSA-5cjx-62pj-pmgq, GHSA-pfqg-243f-8q25,
       GHSA-pjh6-6hrw-vcwr, GHSA-ww62-mxv7-pg55
4.5.5: GHSA-27v4-xhfx-g2rx, GHSA-777w-9599-w8g4, GHSA-jj65-mrgg-f5fx,
       GHSA-m655-53p4-6qm8, GHSA-p7xp-4gj2-x56c, GHSA-v8c4-9w98-9v6v
4.6.0: GHSA-5q26-7fxx-v8fh, GHSA-fwcr-mqg6-hqmx, GHSA-m6w7-8497-g9c9
4.6.1: GHSA-4hqm-8v2c-9pwj, GHSA-p3f2-88rg-9mch, GHSA-pmmx-m8p5-969j

Release notes:
https://github.com/appneta/tcpreplay/releases/tag/v4.5.3
https://github.com/appneta/tcpreplay/releases/tag/v4.5.4
https://github.com/appneta/tcpreplay/releases/tag/v4.5.5
https://github.com/appneta/tcpreplay/releases/tag/v4.6.0
https://github.com/appneta/tcpreplay/releases/tag/v4.6.1

Since 4.6.0, CMake is upstream's recommended build system, so convert
the package to it. The option parsers, tcpedit_stub.h and man pages
are pre-generated in the release tarball, so disable autogen, python3
and asciidoctor to not depend on what's installed on the host.

Add patches to:
- make WITH_TCPDUMP work when cross compiling
- find fts_read() in musl-fts' libfts (replaces passing -lfts)
- fix a struct ethhdr redefinition in txring.h with musl

TX_RING support, which is always detected on Linux, unconditionally
uses pthreads, so add a dependency on BR2_TOOLCHAIN_HAS_THREADS.

Fixes:
https://autobuild.buildroot.org/results/1db3e924c659c8edff026568ffbfc576d5222db9

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5-5
---
 ...pdump-detection-when-cross-compiling.patch | 43 +++++++++++
 ...02-build-look-for-fts_read-in-libfts.patch | 77 +++++++++++++++++++
 .../0003-txring.h-fix-build-with-musl.patch   | 41 ++++++++++
 package/tcpreplay/Config.in                   |  5 ++
 package/tcpreplay/tcpreplay.hash              |  4 +-
 package/tcpreplay/tcpreplay.mk                | 33 ++++----
 6 files changed, 187 insertions(+), 16 deletions(-)
 create mode 100644 package/tcpreplay/0001-cmake-fix-tcpdump-detection-when-cross-compiling.patch
 create mode 100644 package/tcpreplay/0002-build-look-for-fts_read-in-libfts.patch
 create mode 100644 package/tcpreplay/0003-txring.h-fix-build-with-musl.patch

diff --git a/package/tcpreplay/0001-cmake-fix-tcpdump-detection-when-cross-compiling.patch b/package/tcpreplay/0001-cmake-fix-tcpdump-detection-when-cross-compiling.patch
new file mode 100644
index 0000000000..efcc291636
--- /dev/null
+++ b/package/tcpreplay/0001-cmake-fix-tcpdump-detection-when-cross-compiling.patch
@@ -0,0 +1,43 @@
+From d7e8593b515e53f6f6b7e2df496955568146ecdd Mon Sep 17 00:00:00 2001
+From: Yegor Yefremov <yegorslists@googlemail.com>
+Date: Tue, 29 Sep 2026 11:21:30 +0200
+Subject: [PATCH] cmake: fix tcpdump detection when cross compiling
+
+WITH_TCPDUMP names the tcpdump binary on the machine tcpreplay will run
+on. When cross compiling, that path doesn't exist on the build machine,
+so the EXISTS check always fails and --verbose gets disabled.
+
+Trust WITH_TCPDUMP when cross compiling, and accept WITH_TCPDUMP=no
+(like WITH_LIBDNET=no) to skip the host find_program() lookup, which
+would otherwise pick up the build machine's tcpdump.
+
+Upstream: https://github.com/appneta/tcpreplay/pull/1152
+Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
+Assisted-by: Claude:claude-opus-5-5
+---
+ cmake/OptionalDeps.cmake | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/cmake/OptionalDeps.cmake b/cmake/OptionalDeps.cmake
+index 6c73a20e..5239630a 100644
+--- a/cmake/OptionalDeps.cmake
++++ b/cmake/OptionalDeps.cmake
+@@ -177,12 +177,16 @@ endif()
+ # tcpdump binary (--with-tcpdump → WITH_TCPDUMP)
+ # ---------------------------------------------------------------------------
+ set(HAVE_TCPDUMP "")
+-if(WITH_TCPDUMP)
++if(WITH_TCPDUMP STREQUAL "no")
++    set(TCPDUMP_PATH "")
++elseif(WITH_TCPDUMP)
+     set(TCPDUMP_PATH ${WITH_TCPDUMP})
+ else()
+     find_program(TCPDUMP_PATH tcpdump PATHS /usr/sbin /sbin /usr/local/sbin)
+ endif()
+-if(TCPDUMP_PATH AND EXISTS ${TCPDUMP_PATH})
++# When cross compiling, WITH_TCPDUMP is a path on the target, which can't
++# be checked for existence on the build machine.
++if(TCPDUMP_PATH AND (EXISTS "${TCPDUMP_PATH}" OR (CMAKE_CROSSCOMPILING AND WITH_TCPDUMP)))
+     set(HAVE_TCPDUMP 1)
+     message(STATUS "Using tcpdump in ${TCPDUMP_PATH}")
+ else()
diff --git a/package/tcpreplay/0002-build-look-for-fts_read-in-libfts.patch b/package/tcpreplay/0002-build-look-for-fts_read-in-libfts.patch
new file mode 100644
index 0000000000..ce5344316e
--- /dev/null
+++ b/package/tcpreplay/0002-build-look-for-fts_read-in-libfts.patch
@@ -0,0 +1,77 @@
+From a829c8a247cfb688f6c2103d750f72a1f0fc348a Mon Sep 17 00:00:00 2001
+From: Yegor Yefremov <yegorslists@googlemail.com>
+Date: Tue, 29 Sep 2026 11:33:40 +0200
+Subject: [PATCH] build: look for fts_read() in libfts
+
+On musl and uClibc, fts_*() is not part of the C library but provided
+by the standalone musl-fts library (libfts). Look for it there when
+it's neither in libc nor in libbsd, in both configure.ac and CMake.
+
+Without this, cross builds against these C libraries have to pass
+-lfts by hand, and with CMake that doesn't work for static builds, as
+CMAKE_EXE_LINKER_FLAGS ends up before the objects on the link line:
+
+  tcpreplay.c:(.text.startup+0x1e8): undefined reference to `fts_open'
+
+Upstream: https://github.com/appneta/tcpreplay/pull/1153
+Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
+Assisted-by: Claude:claude-opus-5-5
+---
+ cmake/ConfigureChecks.cmake | 7 ++++++-
+ cmake/config.h.cmake        | 3 +++
+ configure.ac                | 5 +++--
+ 3 files changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/cmake/ConfigureChecks.cmake b/cmake/ConfigureChecks.cmake
+index 5b829a5d..b8c81aeb 100644
+--- a/cmake/ConfigureChecks.cmake
++++ b/cmake/ConfigureChecks.cmake
+@@ -365,12 +365,17 @@ if(NOT HAVE_INET_ADDR)
+     message(FATAL_ERROR "We need inet_addr.  See bug 26")
+ endif()
+ 
+-# Haiku: fts_*() lives in libbsd
++# Haiku: fts_*() lives in libbsd; musl and uClibc: in the standalone libfts
+ check_function_exists(fts_read HAVE_FTS_READ)
+ if(NOT HAVE_FTS_READ)
+     check_library_exists(bsd fts_read "" HAVE_LIBBSD)
+     if(HAVE_LIBBSD)
+         list(APPEND TCPR_SYSTEM_LIBS bsd)
++    else()
++        check_library_exists(fts fts_read "" HAVE_LIBFTS)
++        if(HAVE_LIBFTS)
++            list(APPEND TCPR_SYSTEM_LIBS fts)
++        endif()
+     endif()
+ endif()
+ 
+diff --git a/cmake/config.h.cmake b/cmake/config.h.cmake
+index 15531ca3..12084d28 100644
+--- a/cmake/config.h.cmake
++++ b/cmake/config.h.cmake
+@@ -232,6 +232,9 @@
+ /* Do we have libdnet? */
+ #cmakedefine HAVE_LIBDNET @HAVE_LIBDNET@
+ 
++/* Define to 1 if you have the 'fts' library (-lfts). */
++#cmakedefine HAVE_LIBFTS @HAVE_LIBFTS@
++
+ /* Define to 1 if you have the 'gen' library (-lgen). */
+ #cmakedefine HAVE_LIBGEN @HAVE_LIBGEN@
+ 
+diff --git a/configure.ac b/configure.ac
+index 20e4f465..00fd13bd 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -718,8 +718,9 @@ if test x$inet_addr = xno ; then
+     AC_MSG_ERROR([We need inet_addr.  See bug 26])
+ fi
+ 
+-dnl On Haiku fts_*() functions are in libbsd.
+-AC_CHECK_FUNC(fts_read,,[AC_CHECK_LIB(bsd, fts_read)])
++dnl On Haiku fts_*() functions are in libbsd, on musl and uClibc in the
++dnl standalone libfts (musl-fts).
++AC_CHECK_FUNC(fts_read,,[AC_CHECK_LIB(bsd, fts_read,,[AC_CHECK_LIB(fts, fts_read)])])
+ 
+ dnl #####################################################
+ dnl Checks for tuntap device support
diff --git a/package/tcpreplay/0003-txring.h-fix-build-with-musl.patch b/package/tcpreplay/0003-txring.h-fix-build-with-musl.patch
new file mode 100644
index 0000000000..6bbe2314e2
--- /dev/null
+++ b/package/tcpreplay/0003-txring.h-fix-build-with-musl.patch
@@ -0,0 +1,41 @@
+From da763d37b2b275ef977e5a9bf4424bbe1fb2b22d Mon Sep 17 00:00:00 2001
+From: Yegor Yefremov <yegorslists@googlemail.com>
+Date: Tue, 29 Sep 2026 11:33:40 +0200
+Subject: [PATCH] txring.h: fix build with musl
+
+Commit 78076385 ("txring: fix __GLIBC_MINOR typo and include the header
+that defines the TX_RING API (#1043)") made the libc check work, so
+non-glibc C libraries now include <linux/if_ether.h>. On musl, that
+clashes with <netinet/if_ether.h>, included later via sendpacket.h:
+
+  netinet/if_ether.h:122:1: error: redefinition of struct or union 'struct ethhdr'
+
+<net/ethernet.h> is available on all Linux C libraries, so use it
+unconditionally.
+
+Upstream: https://github.com/appneta/tcpreplay/pull/1154
+Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
+Assisted-by: Claude:claude-opus-5-5
+---
+ src/common/txring.h | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/src/common/txring.h b/src/common/txring.h
+index 59dabd1a..0c1e4bfd 100644
+--- a/src/common/txring.h
++++ b/src/common/txring.h
+@@ -38,14 +38,8 @@
+ 
+ #ifdef HAVE_TX_RING
+ 
+-#if __GLIBC__ >= 2 && __GLIBC_MINOR__ >= 1
+ #include <net/ethernet.h> /* the L2 protocols */
+ #include <linux/if_packet.h>
+-#else
+-#include <asm/types.h>
+-#include <linux/if_ether.h> /* The L2 protocols */
+-#include <linux/if_packet.h>
+-#endif
+ #include <pthread.h>
+ 
+ struct txring_s {
diff --git a/package/tcpreplay/Config.in b/package/tcpreplay/Config.in
index 9e5509114e..dc3645dce6 100644
--- a/package/tcpreplay/Config.in
+++ b/package/tcpreplay/Config.in
@@ -1,6 +1,7 @@
 config BR2_PACKAGE_TCPREPLAY
 	bool "tcpreplay"
 	depends on BR2_USE_MMU # fork()
+	depends on BR2_TOOLCHAIN_HAS_THREADS
 	select BR2_PACKAGE_LIBPCAP
 	select BR2_PACKAGE_MUSL_FTS if !BR2_TOOLCHAIN_USES_GLIBC
 	help
@@ -8,3 +9,7 @@ config BR2_PACKAGE_TCPREPLAY
 	  saved with tcpdump or other tools which write pcap(3) files.
 
 	  http://tcpreplay.appneta.com/
+
+comment "tcpreplay needs a toolchain w/ threads"
+	depends on BR2_USE_MMU
+	depends on !BR2_TOOLCHAIN_HAS_THREADS
diff --git a/package/tcpreplay/tcpreplay.hash b/package/tcpreplay/tcpreplay.hash
index 4307fa60fc..023830f9a5 100644
--- a/package/tcpreplay/tcpreplay.hash
+++ b/package/tcpreplay/tcpreplay.hash
@@ -1,5 +1,5 @@
 # Locally calculated after checking pgp signature
-# https://github.com/appneta/tcpreplay/releases/download/v4.5.2/tcpreplay-4.5.2.tar.xz.asc
+# https://github.com/appneta/tcpreplay/releases/download/v4.6.1/tcpreplay-4.6.1.tar.xz.asc
 # using key 84E4FA215C934A7D97DC76D5E9E2149793BDE17E
-sha256  2df15bc6d49f96a77617d137049f998193bbae95c1a31b04ca02856a24cbf384  tcpreplay-4.5.2.tar.xz
+sha256  14b96e3565d6e66e813000d0d510afeaecb871f2b533182c391c6ccf948c3e21  tcpreplay-4.6.1.tar.xz
 sha256  07cf5e92d475287a7d1663b33097f40cae5adf03ed8920fcd4374e3dfb48c8ad  docs/LICENSE
diff --git a/package/tcpreplay/tcpreplay.mk b/package/tcpreplay/tcpreplay.mk
index 32bcf8d278..4a50e88aaf 100644
--- a/package/tcpreplay/tcpreplay.mk
+++ b/package/tcpreplay/tcpreplay.mk
@@ -4,40 +4,45 @@
 #
 ################################################################################
 
-TCPREPLAY_VERSION = 4.5.2
+TCPREPLAY_VERSION = 4.6.1
 TCPREPLAY_SITE = https://github.com/appneta/tcpreplay/releases/download/v$(TCPREPLAY_VERSION)
 TCPREPLAY_SOURCE = tcpreplay-$(TCPREPLAY_VERSION).tar.xz
 TCPREPLAY_LICENSE = GPL-3.0
 TCPREPLAY_LICENSE_FILES = docs/LICENSE
 TCPREPLAY_CPE_ID_VENDOR = broadcom
-TCPREPLAY_CONF_ENV = \
-	ac_cv_path_ac_pt_PCAP_CONFIG="$(STAGING_DIR)/usr/bin/pcap-config" \
-	LIBS="$(TCPREPLAY_LIBS)"
-TCPREPLAY_CONF_OPTS = --with-libpcap=$(STAGING_DIR)/usr \
-	--enable-pcapconfig
 TCPREPLAY_DEPENDENCIES = libpcap
+# The option parsers, tcpedit_stub.h and man pages are pre-generated in
+# the release tarball, so don't use autogen, python3 or asciidoctor from
+# the host.
+TCPREPLAY_CONF_OPTS = \
+	-DENABLE_PCAPCONFIG=ON \
+	-DPCAP_CONFIG_EXECUTABLE=$(STAGING_DIR)/usr/bin/pcap-config \
+	-DAUTOGEN_EXECUTABLE=OFF \
+	-DPYTHON3_EXECUTABLE=OFF \
+	-DASCIIDOCTOR_EXECUTABLE=OFF \
+	-DPCAPNAV_CONFIG_EXECUTABLE=OFF
 
 ifeq ($(BR2_TOOLCHAIN_USES_GLIBC),)
 TCPREPLAY_DEPENDENCIES += musl-fts
-TCPREPLAY_LIBS += -lfts
 endif
 
 ifeq ($(BR2_STATIC_LIBS),y)
-TCPREPLAY_CONF_OPTS += --enable-dynamic-link=no
-TCPREPLAY_LIBS += `$(STAGING_DIR)/usr/bin/pcap-config --static --libs`
+TCPREPLAY_CONF_OPTS += -DENABLE_STATIC_LINK=ON
+else
+TCPREPLAY_CONF_OPTS += -DENABLE_STATIC_LINK=OFF
 endif
 
 ifeq ($(BR2_PACKAGE_LIBDNET),y)
 TCPREPLAY_DEPENDENCIES += libdnet
-TCPREPLAY_CONF_OPTS += --with-libdnet=$(STAGING_DIR)/usr
+TCPREPLAY_CONF_OPTS += -DWITH_LIBDNET=$(STAGING_DIR)/usr
 else
-TCPREPLAY_CONF_OPTS += --without-libdnet
+TCPREPLAY_CONF_OPTS += -DWITH_LIBDNET=no
 endif
 
 ifeq ($(BR2_PACKAGE_TCPDUMP),y)
-TCPREPLAY_CONF_ENV += ac_cv_path_tcpdump_path=/usr/sbin/tcpdump
+TCPREPLAY_CONF_OPTS += -DWITH_TCPDUMP=/usr/sbin/tcpdump
 else
-TCPREPLAY_CONF_ENV += ac_cv_path_tcpdump_path=no
+TCPREPLAY_CONF_OPTS += -DWITH_TCPDUMP=no
 endif
 
-$(eval $(autotools-package))
+$(eval $(cmake-package))
-- 
2.34.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply related	[flat|nested] 3+ messages in thread