summaryrefslogtreecommitdiffstats
path: root/meta/recipes-connectivity/openssh
Commit message (Collapse)AuthorAgeFilesLines
* openssh: Fix CVE-2023-51385Ranjitsinh Rathod2024-01-312-0/+96
| | | | | | | | | | | | | | | | | | OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name. This patch fixes the above issue Link: http://archive.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_8.2p1-4ubuntu0.11.debian.tar.xz Link: https://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a (From OE-Core rev: a0561ca36bd3be8f44d11908caaf8c9ce5f69032) Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssh: backport Debian patch for CVE-2023-48795Vijay Anusuri2023-12-292-0/+469
| | | | | | | | | | | | | | | import patches from ubuntu to fix CVE-2023-48795 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/openssh/tree/debian/patches?h=ubuntu%2Ffocal-security Upstream commit https://github.com/openssh/openssh-portable/commit/1edb00c58f8a6875fad6a497aa2bacf37f9e6cd5] Reference: https://ubuntu.com/security/CVE-2023-48795 (From OE-Core rev: 4026a1cc3aa242a80c306b34b030f05d41b55dda) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssh: Securiry fix for CVE-2023-38408Shubham Kulkarni2023-09-1513-0/+2198
| | | | | | | | | | | | | | | | | | | | | | | | The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009. References: https://nvd.nist.gov/vuln/detail/CVE-2023-38408 Upstream patches: https://github.com/openssh/openssh-portable/commit/dee22129, https://github.com/openssh/openssh-portable/commit/099cdf59, https://github.com/openssh/openssh-portable/commit/29ef8a04, https://github.com/openssh/openssh-portable/commit/892506b1, https://github.com/openssh/openssh-portable/commit/0c111eb8, https://github.com/openssh/openssh-portable/commit/52a03e9f, https://github.com/openssh/openssh-portable/commit/1fe16fd6, https://github.com/openssh/openssh-portable/commit/e0e8bee8, https://github.com/openssh/openssh-portable/commit/8afaa7d7, https://github.com/openssh/openssh-portable/commit/1a4b9275, https://github.com/openssh/openssh-portable/commit/4c1e3ce8, https://github.com/openssh/openssh-portable/commit/1f2731f5. (From OE-Core rev: 9242b8218858d2bebb3235929fea7e7235cd40f3) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssh: Move sshdgenkeys.service to sshd.socketAlex Kiernan2023-06-132-2/+1
| | | | | | | | | | | | | | sshd.socket launches the templated sshd@.service, so by moving the sshdgenkeys.service to sshd.socket, key generation can start in advance of a connection. (From OE-Core rev: 96798603273bbab40a7e19bbb67a9a5398648c21) Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit af38a39b4bed9e43c5075008be47ca72191a489e) Signed-off-by: Jermain Horsman <jermain.horsman@nedap.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssh: Add openssh-sftp-server to openssh RDEPENDSAlex Kiernan2022-08-181-1/+1
| | | | | | | | | | | | | | | OpenSSH 9.0 uses sftp by default as the transport for scp, add in sftp-server so that this works as expected for users, rather than being left with a confusing "scp: Connection closed" message. (From OE-Core rev: 788e2c6bccc58e5a88b33fa91ea3c3ffec7611ca) Signed-off-by: Alex Kiernan <alexk@zuma.ai> Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit be61b9dac78f0d85c870a0d8304fb4b536ec4bc8) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: break dependency on base package for -dev packageSteve Sakoman2022-07-151-0/+5
| | | | | | | | | | | | Otherwise the SDK fails to build as the main openssh and dropbear packages conflict with each other (From OE-Core rev: e863fc060940d11cd6fd58f0f314333ed419cf54) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit f90647e9dd95cfd29b5bdb8d7dcd688a10fc060c) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Whitelist CVE-2021-36368Pawan Badganchi2022-06-221-0/+7
| | | | | | | | | | | | | | | | As per debian, the issue is fixed by a feature called "agent restriction" in openssh 8.9. Urgency is unimportant as per debian, Hence this CVE is whitelisting. Link: https://security-tracker.debian.org/tracker/CVE-2021-36368 https://bugzilla.mindrot.org/show_bug.cgi?id=3316#c2 https://docs.ssh-mitm.at/trivialauth.html (From OE-Core rev: 179b862e97d95ef57f8ee847e54a78b5f3f52ee7) Signed-off-by: Pawan Badganchi <badganchipv@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Whitelist CVE-2016-20012sana kazi2021-12-301-0/+9
| | | | | | | | | | | | | | | Whitelist CVE-2016-20012 as the upstream OpenSSH developers see this as an important security feature and do not intend to 'fix' it. Link: https://security-tracker.debian.org/tracker/CVE-2016-20012 https://ubuntu.com/security/CVE-2016-20012 (From OE-Core rev: 79c677e994399611819e1e382b3e1b0be16eb6e1) Signed-off-by: Sana Kazi <Sana.Kazi@kpit.com> Signed-off-by: Sana Kazi <sanakazisk19@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Fix CVE-2021-41617sana kazi2021-12-302-0/+53
| | | | | | | | | | | | Add patch to fix CVE-2021-41617 Link: https://bugzilla.suse.com/attachment.cgi?id=854015 (From OE-Core rev: a4e272700e18ca7e86e24ce4e24031ce7745c87b) Signed-off-by: Sana Kazi <Sana.Kazi@kpit.com> Signed-off-by: Sana Kazi <sanakazisk19@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: remove redundant BSD licenseRoss Burton2021-12-021-1/+1
| | | | | | | | | | | | | | | | The license statement already includes BSD-2-Clause and BSD-3-Clause, so remove the redundant and ambiguous BSD license. (From OE-Core rev: 5c0b03cda19bcebfc71e1e601a4336fcda4bfc2b) (From OE-Core rev: f61fcb6e176f19f1e768ce63a693f238713c8887) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de> (cherry picked from commit 7eaab4b261017ae49926b4f18228a3af9906c19c) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Improve LICENSE to show BSD license variants.Wang Mingyu2021-12-021-1/+1
| | | | | | | | | | | | | | | | Update LICENSE to show that BSD-2-Clause, BSD-3-Clause and BSD-4-Clause are all present. (From OE-Core rev: d17938953fc2524bc5f04db4409a47aa400e756a) (From OE-Core rev: efe0bb929bb6e480110ceae567bf3c8d5ca5f379) Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de> (cherry picked from commit e42870e233a85bc0d55395ef110b7445dfe784f8) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Fix CVE-2021-28041sana kazi2021-10-072-0/+21
| | | | | | | | | | | | | | Added patch to fix CVE-2021-28041. Link: http://archive.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_8.2p1-4ubuntu0.3.debian.tar.xz (From OE-Core rev: 969e14a6849a4ec9030d09059e8d81dce0ff0c49) Signed-off-by: Sana Kazi <Sana.Kazi@kpit.com> Signed-off-by: Sana Kazi <sanakazisk19@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Add fixes for CVEs reported for opensshSana Kazi2021-06-032-1/+109
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Applied patch for CVE-2020-14145 Link: https://anongit.mindrot.org/openssh.git/patch/?id=b3855ff053f5078ec3d3c653cdaedefaa5fc362d Also, whitelisted below CVEs: 1.CVE-2020-15778: As per upstream, because of the way scp is based on a historical protocol called rcp which relies on that style of argument passing and therefore encounters expansion problems. Making changes to how the scp command line works breaks the pattern used by scp consumers. Upstream therefore recommends the use of rsync in the place of scp for better security. https://bugzilla.redhat.com/show_bug.cgi?id=1860487 2.CVE-2008-3844: It was reported in OpenSSH on Red Hat Enterprise Linux and certain packages may have been compromised. This CVE is not applicable as our source is OpenBSD. Links: https://securitytracker.com/id?1020730 https://www.securityfocus.com/bid/30794 Also, for CVE-2007-2768 no fix is available yet as it's unavoidable drawback of using one time passwords as per https://bugzilla.suse.com/show_bug.cgi?id=CVE-2007-2768 Also it is marked as unimportant on debian https://security-tracker.debian.org/tracker/CVE-2007-2768 Mailed to CPE to update database for CVE-2020-15778, CVE-2008-3844 and CVE-2007-2768. We can upstream CVE-2020-14145 till we recieve response from CPE. (From OE-Core rev: 302a6828b380ba20bb244f11f22a5bc273f0e5e7) Signed-off-by: Sana Kazi <Sana.Kazi@kpit.com> Signed-off-by: Nisha Parrakat <nishaparrakat@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Exclude CVE-2008-3844 from cve-checkRichard Purdie2021-05-201-0/+3
| | | | | | | | | | | CVE only applies to some distributed RHEL binaries so irrelavent to us. (From OE-Core rev: 44d477b1cadc3e48c0a902123736fdf3bf2b412c) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 5d8b3ddf91050f6745a99a8abb1c3b03c35247af) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Exclude CVE-2007-2768 from cve-checkRichard Purdie2021-05-201-0/+3
| | | | | | | | | | | We don't build/use the OPIE PAM module, exclude the CVE from this recipe. (From OE-Core rev: d55474025a4518c674d9781c4c3b1ce5d6389466) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 3670be602f2ace24dc49e196407efec577164050) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: whitelist CVE-2014-9278Steve Sakoman2020-11-201-0/+4
| | | | | | | | | | | | | | | | | | The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environment, allows remote authenticated users to log in as another user when they are listed in the .k5users file of that user, which might bypass intended authentication requirements that would force a local login. Whitelist the CVE since this issue is Redhat specific. (From OE-Core rev: 49955248b6011450a8767496783fb9f4738c9a99) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 309132e50d23b1e3f15ef8db1a101166b35f7ca4) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Allow enable/disable of rng-tools recommendation on sshdOtavio Salvador2020-10-061-2/+8
| | | | | | | | | | | | | | We are adding a new PACKAGECONFIG option ('rng-tools') to control if we wish the openssh-sshd to RRECOMMENDS the 'rng-tools' package. We are enabling it by default so there is no behavior change. (From OE-Core rev: ff61cf5777c63a7ebecde5ada1cf01d7bafe265d) Signed-off-by: Otavio Salvador <otavio@ossystems.com.br> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit fe99349c1bd72b69d22ab0dc52b8825d3157b8e7) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dropbear/openssh: Lower priority of key generationRichard Purdie2020-10-061-0/+1
| | | | | | | | | | | | | | | | | | Where we have images with PAM+systemd, serial login can be extremely slow. The load generated by key generation does slow down the rest of the boot process. Lower the priority level of these systemd services, since we'd prefer to have the rest of the system boot more effectively. This doesn't "solve" the slow systemd boot issues but does help. (From OE-Core rev: c5394e65972ac21b1c7f68db100754939ecaef8c) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 087700665284c08ba846e52b6b86276629f5f1cd) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Upgrade 8.1p1 -> 8.2p1Alex Kiernan2020-02-154-123/+2
| | | | | | | | | | | | | Drop backports from upstream: 0001-Manually-applied-upstream-fix-for-openssh-test.patch 0001-seccomp-Allow-clock_gettime64-in-sandbox.patch openssh-8.1p1-seccomp-nanosleep.patch (From OE-Core rev: c9b5802bbe1de609450f509edf4721ab0a7a70aa) Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: explicitly skip unit testsAlexander Kanavin2020-01-211-0/+1
| | | | | | | | | | | These tests are already implicitly excluded by not being built. This change avoids a confusing failure-but-not-really printed by run-ptest. (From OE-Core rev: f3e27d8e23df37fb06f77af1583021f471dede51) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: applied upstream fix for "cert not yet valid" testMingde (Matthew) Zeng2020-01-212-0/+61
| | | | | | | | | | | | applied upstream fix for openssh's "cert not yet valid" test Upstream Status: Backport: https://github.com/openssh/openssh-portable/commit/ff31f15773ee173502eec4d7861ec56f26bba381 (From OE-Core rev: f0a949fe33da47fd0a587abb942ff60f0a56ed0d) Signed-off-by: Mingde (Matthew) Zeng<matthew.zeng@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Allow clock_nanosleep/clock_gettime64/clock_nanosleep_time64 syscallKhem Raj2020-01-103-0/+60
| | | | | | | | | Fixes connection denials with these syscalls being there on upcoming glibc 2.31 release (From OE-Core rev: 557d464de217cdf959aa275d20e7b155e4130ec7) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Upgrade 8.0p1 -> 8.1p1Alex Kiernan2019-12-062-45/+10
| | | | | | | | | | | | Drop upstream backport of integer overflow in XMSS private key parsing. Add PACKAGECONFIG for kerberos, libedit and ldns. If api-documentation is enabled then install man(7) manpages rather than catman pages. License-Update: convert to UTF-8 (From OE-Core rev: b084fa095800c090389b9c00d66f109d7cd11455) Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: fix CVE-2019-16905Hongxu Jia2019-10-192-0/+41
| | | | | | | | | | Backport a patch from upstream to fix CVE-2019-16905 https://github.com/openssh/openssh-portable/commit/a546b17bbaeb12beac4c9aeed56f74a42b18a93a (From OE-Core rev: 8bd4b87071c073a0e4d265bc00df34684a355eff) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Update LICENSE field with missing valuesWes Lindauer2019-08-211-1/+1
| | | | | | | | | | The LICENSE file states that some code is licensed under BSD, some under ISC, and some under MIT. The LICENSE field should reflect all of these. (From OE-Core rev: 91096392cf46cae369849723cea14a9da1f3053b) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Add missing DEPENDS on virtual/cryptRichard Purdie2019-06-201-1/+1
| | | | | | | | Changes to libxcrypt revealed a missing dependency in the openssh recipe. (From OE-Core rev: 0fd0a1b1f733a8d9978d64fa23e9d083a716de87) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: fix potential signed overflow in pointer arithmaticHongxu Jia2019-06-181-7/+19
| | | | | | | | | | | | | | Pointer arithmatic results in implementation defined signed integer type, so that 'd - dst’ in strlcat may trigger signed overflow if pointer ‘d’ is near 0x7fffffff in 32 bits system. In case of ompilation by gcc or clang with -ftrapv option, the overflow would generate program abort. (From OE-Core rev: 1c4b8d797c76a08ebd1658066e9d32972b6abe58) Signed-off-by: hguo3 <heng.guo@windriver.com> Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Document skipped test dependencyRichard Purdie2019-06-081-0/+1
| | | | | | | | | | | In minimal images the agent-ptrace test is skipped unless gdb is installed which explains the difference in test counts. We don't want a build dependency on gdb and the test isn't critical so just document the dependency. (From OE-Core rev: d3f29e6e52367e124e3f543f970038c0332ad3e1) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Add missing ptest dependency on coreutilsRichard Purdie2019-06-071-1/+1
| | | | | | | | | | | This fixes the openssh tests in minimal images since they use options not present in the busybox versions of the commands. [YOCTO #13295] (From OE-Core rev: 4059d8eedc5cf6f46a834997b7120150fcec4c0e) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Upgrade 7.9p1 -> 8.0p1Zang Ruochen2019-05-315-629/+2
| | | | | | | | | | | | | | | Upgrade from openssh_7.9p1.bb to openssh_8.0p1.bb. -openssh/0001-upstream-Have-progressmeter-force-an-update-at-the-b.patch -openssh/CVE-2018-20685.patch -openssh/CVE-2019-6109.patch -openssh/CVE-2019-6111.patch -Removed since these are included in 8.0p1. (From OE-Core rev: 7e21cfec4de3d66585c92632e1503df54a89b79a) Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Add sudo dependency for ptestRichard Purdie2019-05-221-1/+1
| | | | | | | | Without this we see test failures due to the sudo binary being missing. (From OE-Core rev: b9e4db06dd95ce709a4a895014cc98fdd7df4624) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Avoid PROVIDES warning from rng-tools dependencyRichard Purdie2019-05-121-1/+1
| | | | | | | | | | Avoid the warning: WARNING: Nothing RPROVIDES 'nativesdk-rng-tools' (but virtual:nativesdk:/home/pokybuild/yocto-worker/build-appliance/build/meta/recipes-connectivity/openssh/openssh_7.9p1.bb RDEPENDS on or otherwise requires it) (From OE-Core rev: f93f026212ebc28fce66682cdb995e061586df45) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: recommend rng-tools with sshdMikko Rapeli2019-05-121-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since openssl 1.1.1 and openssh which uses it, sshd startup is delayed. The delays range from few seconds to minutes and even to hours. The delays are visible in host keys generation and when sshd process is started in response to incoming TCP connection but is failing to provide SSH version string and clients or tests time out. In all cases traces show that sshd is waiting for getentropy() system call to return from Linux kernel, which returns only after kernel side random number pool is initialized. The pool is initialized via various entropy source which may be missing on embedded development boards or via rngd from rng-tools package from userspace. HW random number generation and kernel support help but rngd is till needed to feed that data back to the Linux kernel. Example from an NXP imx8 board shows that kernel random number pool initialization can take over 400 seconds without rngd, and with rngd it is initialized at around 4 seconds after boot. The completion of initialization is visible in kernel dmesg with line "random: crng init done". More details are available from: * https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=912087 * https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=897572 * https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=43838a23a05fbd13e47d750d3dfd77001536dd33 * http://www.man7.org/linux/man-pages/man2/getrandom.2.html (From OE-Core rev: 9b01375236e19e3366c58877c4154d7c71632984) Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de> Cc: Mark Hatle <mark.hatle@windriver.com> Cc: Rasmus Villemoes <rasmus.villemoes@prevas.dk> Cc: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh/systemd/python/qemu: Fix patch Upstream-StatusRichard Purdie2019-05-083-3/+3
| | | | | | | | Fix some missing or corrupted patch Upstream-Status values. (From OE-Core rev: 07bc5a5367e0dec45253fd849e0157094152fd31) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: fix CVE-2018-20685, CVE-2019-6109, CVE-2019-6111Anuj Mittal2019-04-305-0/+627
| | | | | | | | | Also backport a patch to fix issues introduced by fix for CVE-2019-6109. (From OE-Core rev: 31b7485d8377c1c535d1878220bbc1d49dc5f13e) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh/util-linux/python*: Ensure ptest output is unbufferedRichard Purdie2019-04-092-2/+2
| | | | | | | | | | | | | We need to run sed with the -u option to ensure the output is unbuffered else ptest-runner may timeout thinkig things were idle. Busybox doesn't have the -u option so we need to RDEPEND on sed (which is a good thing to do if we use it anyway). Alex Kanavin should get credit for discovering the problem. (From OE-Core rev: d3ffbebf43c23faa43af81c9ecf6fcaef36d675b) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: use tarballs instead of gitAlexander Kanavin2019-01-111-5/+3
| | | | | | | | | | | This was change to git recently to obtain openssl 1.1 compatible pre-release code (before 7.9 was out), however tarballs are preferred, and with them upstream version checks work (openssh uses a weird git tag scheme). (From OE-Core rev: a921a96e84f4d0b3f3d29a571981de08eb148e15) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Update to 7.9 primarily bug fixesArmin Kuster2018-11-141-1/+1
| | | | | | | | | see: https://lwn.net/Articles/768991/ (From OE-Core rev: d9b69aa41bc0b768698b132b9805a8abf0fac40d) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: upgrade 7.8p1 -> 7.8p1+git to support openssl 1.1.xHongxu Jia2018-09-201-6/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | - Convert from tarball to git repository which support openssl 1.1.x - There is no specific minor version that contains the openssl fix (it was merged to master a few days agao), rename recipe version to `7.8p1+git' - Fix regression test binaries missing In commit `1f7aaf7 openssh: build regression test binaries', it build regression test binaries, since upstream add two binaries in commits `c59aca8 Create control sockets in clean temp directories' and `1acc058 Disable tests where fs perms are incorrect', we should update do_compile_ptest. [ptest log] |/usr/lib/openssh/ptest/regress/test-exec.sh: line 330: /usr/lib/openssh/ ptest/regress/mkdtemp: No such file or directory [ptest log] (From OE-Core rev: 9d48cb3da696add33315cf129fe60102bd9756c9) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: update from 7.7p1 to 7.8p1Randy MacLeod2018-09-042-42/+2
| | | | | | | | | | Drop the disable-ciphers patch since it has been integrated: cec33896 Omit 3des-cbc if OpenSSL built without DES. (From OE-Core rev: 7d35f5bb7b1700ae4bb7f55af8db7357a851c15a) Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: add nativesdk supportMikko Rapeli2018-06-181-2/+4
| | | | | | | | | | And use bitbake variables for install paths to fix nativesdk-openssh compilation. (From OE-Core rev: 70470dfa88338cae06670195bb7009cb13098ac2) Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: only create sshd host keys which have been enabledAndre McCurdy2018-06-151-23/+19
| | | | | | | | | | | | | | | Previously sshd_check_keys would create a full set of all possible sshd host keys, even if sshd_config has been set to only enable certain key types. Update sshd_check_keys to only create keys which have been enabled in sshd_config (with a fallback to creating a full set of key types if no HostKey options are defined, as before). (From OE-Core rev: 2303d795ae96f1a60caf145a0ddf100e89c4b5b0) Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: sync local ssh_config + sshd_config files with upstream 7.7p1Andre McCurdy2018-06-152-27/+14
| | | | | | | | | | | | Changes are mostly related to the removal of support for SSH v.1 protocol, which was dropped from openssh sshd in 7.4p1: https://www.openssh.com/txt/release-7.4 (From OE-Core rev: b81389c50e0d191e31f71af82d86bfbb37b83acc) Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: minor indent cleanup for sshd init scriptAndre McCurdy2018-06-151-6/+6
| | | | | | | | | | | | | The openssh sshd init script contains a mix of indent styles, mostly inherited from the Debian script from which it is derived. Leave the indent from Debian as-is, but for lines which are OE specific (e.g. where Debian's log_daemon_msg helper has been replaced with echo) make the indent consistent with surrounding lines. (From OE-Core rev: 68fb7d3b06887e0db3eef0ab231ced37cfa4894c) Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: drop RCONFLICTS for openssh-keygenAndre McCurdy2018-06-151-1/+0
| | | | | | | | | | | The "ssh-keygen" package no longer seems to be provided by any recipe in oe-core or meta-oe, so there's no clear reason for the openssh-keygen package to conflict with it. (From OE-Core rev: 0c5567847edba6b5ab24ae505d16375397cf4b40) Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: stop adding -D__FILE_OFFSET_BITS=64 to CFLAGSAndre McCurdy2018-06-151-3/+0
| | | | | | | | | | | | | | | Openssh takes care of enabling large-file support automatically via the AC_SYS_LARGEFILE in the configure.ac, so additional help from the recipe is not required. Even if it were once required, defining __FILE_OFFSET_BITS (ie with double leading underscores) looks like a typo and probably never had any effect anyway? (From OE-Core rev: 37b1a7bada267b89094ce0c3eb81b1de9f04df8e) Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: drop sshd support for DSA host keysAndre McCurdy2018-06-073-10/+0
| | | | | | | | | | | DSA keys have been deprecated for some time: https://www.gentoo.org/support/news-items/2015-08-13-openssh-weak-keys.html (From OE-Core rev: e6a1c8c4ef4a1d2add6a7492d43027c4c0682300) Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: upgrade 7.6p1 -> 7.7p1Armin Kuster2018-05-291-2/+2
| | | | | | | | (From OE-Core rev: abc729786a6381e0b2c5f13b5dea6afdaada3dc0) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: disable ciphers not supported by OpenSSL DESHongxu Jia2018-04-202-0/+40
| | | | | | | | | | | | | | | | While compiling openssl with option `no-des', it caused the openssh build failure ... cipher.c:85:41: error: 'EVP_des_ede3_cbc' undeclared here (not in a function); ... OpenSSL configured that way defines OPENSSL_NO_DES to disable des (From OE-Core rev: 08a5cda85594fca8b352841a26131bfac39c8417) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: remove unused patchMaxin B. John2018-03-041-33/+0
| | | | | | | | | | | Remove unused patch: 0001-openssh-Fix-syntax-error-on-x32.patch (From OE-Core rev: a752aa31fc8f3a3d283381b7235710af4ece16d8) Signed-off-by: Maxin B. John <maxin.john@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-09-22 02:11:59 +0000