summaryrefslogtreecommitdiffstats
path: root/meta/recipes-connectivity
Commit message (Collapse)AuthorAgeFilesLines
* openssh: fix CVE-2024-6387Jose Quaresma2024-07-042-0/+28
| | | | | | | | | | | | | | | | | | | | | sshd(8) in Portable OpenSSH versions 8.5p1 to 9.7p1 (inclusive). Race condition resulting in potential remote code execution. A race condition in sshd(8) could allow remote code execution as root on non-OpenBSD systems. This attack could be prevented by disabling the login grace timeout (LoginGraceTime=0 in sshd_config) though this makes denial-of service against sshd(8) considerably easier. For more information, please refer to the release notes [1] and the report from the Qualys Security Advisory Team [2] who discovered the bug. [1] https://www.openssh.com/txt/release-9.8 [2] https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt References: https://www.openssh.com/security.html (From OE-Core rev: 7ba7c96f31bd81c5d1352136e405e99c3df29ea7) Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: allow configuration of hostkey typeMatthew Bullock2024-07-021-4/+25
| | | | | | | | | | | | | | | | | Allow selection of host key types used by openssh via PACKAGECONFIG. Any combination of hostkey-rsa, hostkey-ecdsa and hostkey-ed25519 can be specified. Default to just generating ecdsa keys. The current default generates all three keys. This can take a significant amount of time on first boot. Having all three keys does not significantly increase compatability. Also RSA keys are being deprecated as they are no longer considered secure. Using just an ecdsa key reduces key generation time by roughly 75%. (From OE-Core rev: 0827c29566f3ea63715a9f9e4ee2639f4eabe0bd) Signed-off-by: Matthew Bullock <mbullock@thegoodpenguin.co.uk> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* native/nativesdk: Stop overriding unprefixed *FLAGS variablesRichard Purdie2024-07-012-2/+2
| | | | | | | | | | | | | | | | | | | | We're currently encouraging an "arms race" with the FLAGS variables since a recipe might want to set a specific flag for all variants but to do so, += won't work due to the assignment in the native/nativesdk class files. This means recipes are using append. Since the default variables are constructed out of TARGET_XXX variables and we redefine these, there is no need to re-define the un-prefixed variables. If we drop that, the += appends and similar work and recipes don't have to resort to append. Change the classes and cleanup a number of recipes to adapt to the change. This change will result in some flags appearing to some native/nativesdk variants but that is probably what was originally expected anyway. (From OE-Core rev: a157b2f9d93428ca21265cc860a3b58b3698b3aa) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: Remove patch already upstreamedClément Péron2024-06-252-44/+0
| | | | | | | | | | | | | | | | Since the bump to OpenSSL 3.3.1, riscv32 doesn't build anymore due to the folowing error: crypto/riscv32cpuid.s:77: Error: symbol `riscv_vlen_asm' is already defined This is due to the patch beeing already applied upstream: Commit: 8702320db98d1346c230aff1282ade3ecdca681a (From OE-Core rev: 06c4168c7bd6a32cb7de3e003793c8e232714fad) Signed-off-by: Clément Péron <peron.clem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dhcpcd: upgrade 10.0.6 -> 10.0.8Trevor Gamblin2024-06-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog (https://github.com/NetworkConfiguration/dhcpcd/releases): 10.0.8: - Fixed compile without ARP - Fixed closefrom test for glibc - Fixed spelling of ADVERTISEMENT 10.0.7: - DHCP: use request_time, fallback_time and ipv4ll_time rather than reboot timeout - DHCP6: Wait for IRT to elapse before requesting advertisments - DHCPv6: Don't re-INFORM if the RA changes - privsep: Reduce fd use - dhcpcd: Add support for arp persist defence by @pradeep-brightsign in #273 - Move dhcp(v4) packet size check earlier by @pemensik in #295 - Define the Azure Endpoint and other site-specific options by @lparkes in #299 - add RFC4191 support by @goertzenator in #297 - dhcpcd: Respect IPV6_PREFERRED_ONLY flag regardless of state by @taoyl-g in #307 - Fix time_offset to be int to match RFC-2132 by @ColinMcInnes in #319 - hooks/30-hostname: Exit with 0 if setting hostname is not needed by @bdrung in #320 (From OE-Core rev: ab134edc9b7a17a7919f91060f3058467abe011c) Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: drop add-test-support-for-busybox.patchAlexander Kanavin2024-06-242-48/+0
| | | | | | | | | | | The ptest package is nowadays depending on coreutils so busybox tweaks are both incomplete and unneeded. (From OE-Core rev: 2408b0b5ea3090fd151de22c91420210fd7ff48f) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ofono: upgrade 2.7 -> 2.8Martin Hundeb?ll2024-06-241-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: * Release 2.8 * build: Require at least version 0.66 when building with external ELL * qmi: Remove unused shutdown members in qmi_device_qrtr * drivers: Use the new license header format * plugins: Use the new license header format * isimodem: Use the new license header format * rilmodem: Use the new license header format * mbimmodem: Use the new license header format * unit: Use the new license header format * tools: Use the new license header format * include: Use the new license header format * dundee: Use the new license header format * core: Use the new license header format * qmimodem: Use the new license header format * atmodem: Use the new license header format * build: Add notifylist.[ch] from ell * udevng: Fix detection of USB attached tty devices * udevng: Don't crash for non-QMI devices * qmimodem: Remove the create exclusive service API * voicecall: Fix use after free * atmodem: gprs-context: use default PPP ACCM for Quectel serial modems * atmodem: sim: Fix CRSM result handling * qmi: gprs-context: support bind_mux for pcie devices * udevng: Add mhi subsystem detection * udevng: add and use get_ifname() for netdev nodes * gobi: ensure required properties are provided * gobi: Rename KernelDriver to NetworkInterfaceDriver * gobi: add / use DeviceProtocol property * qmi: Use l_basename instead of basename * log: Use l_basename instead of basename * build: link dundee with ell * log: Handle dladdr failure License-Update: license header replaced with spdx identifier (From OE-Core rev: fda6b3ff67b56828f5088667a2e3af0a5ffa6ae5) Signed-off-by: Martin Hundebøll <martin@geanix.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: Upgrade 3.3.0 -> 3.3.1Peter Marko2024-06-063-240/+1
| | | | | | | | | | | | | | Handles CVE-2024-4741 Removed included backports. Release information: https://github.com/openssl/openssl/blob/openssl-3.3/NEWS.md#major-changes-between-openssl-330-and-openssl-331-4-jun-2024 (From OE-Core rev: 3c7f8f87741702d50e29a5858802f74c5f4aab49) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: Add passthrough variables to work with bitbakeRichard Purdie2024-06-041-0/+1
| | | | | | | | | | | | | | | | | | Now that bitbake uses websockets over SSL as hashserv and is correctly limiting hash equivalence only to things in the orginal SDK, bitbake builds from buildtools can fail due to broken SSL from buildtools. The issue is that the relocation variables are being removed from the environment. This could be fixed within bitbake or it could be fixed within the SDK environment. This patch does the latter for now. We really need to improve openssl relocation within the SDK in general. Fixing this has become more urgent to fix failing builds in automated testing. (From OE-Core rev: 6a20667c166fa3d7e2b6e8e8b442dec0fc75f349) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* mobile-broadband-provider-info: upgrade 20230416 -> 20240407Alexander Kanavin2024-05-301-3/+3
| | | | | | | | | | Convert to meson. (From OE-Core rev: 643c7c2219886253857fdc7618d5db12ddc0e9de) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libslirp: upgrade 4.7.0 -> 4.8.0Wang Mingyu2024-05-281-2/+2
| | | | | | | | (From OE-Core rev: c1e109eac0c7fa729ca8751c351306cba5f58564) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* iw: upgrade 6.7 -> 6.9Wang Mingyu2024-05-281-1/+1
| | | | | | | | (From OE-Core rev: 27261cda1232ef1a84d1b0d8ba52dc9eb578db81) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* iproute2: upgrade 6.8.0 -> 6.9.0Wang Mingyu2024-05-281-1/+1
| | | | | | | | (From OE-Core rev: f516215f213d809cf89bc8e2e3b36119a80bee63) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bind: upgrade 9.18.26 -> 9.18.27Wang Mingyu2024-05-281-1/+1
| | | | | | | | | | | | | | Changelog: ========= * Skip to next RRSIG if signature has expired or is in the future rather than failing immediately. * Implement signature jitter for dnssec-policy. (From OE-Core rev: ccf45d3cbd06abd48ca2c82a790587457021e6e3) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ofono: upgrade 2.4 -> 2.7Martin Hundeb?ll2024-05-283-72/+1
| | | | | | | | | | | | | | | | | | | Remove 0001-mbim-add-an-optional-TEMP_FAILURE_RETRY-macro-copy.patch as TEMP_FAILURE_RETRY usage has been removed in upstream commit 765c6655 ("treewide: Use L_TFR macro"). Remove 0002-mbim-Fix-build-with-ell-0.39-by-restoring-unlikely-m.patch as likely()/unlikely() has been removed in upstream commit dbbbebf9 ("mbimmodem: Remove usage of likely and unlikely"). Remove the do_configure:prepend() that purges the bundled ell directory, as it isn't needed when passing --enable-external-ell in EXTRA_OECONF. (From OE-Core rev: 9e018a52ab325dd15f129666fcf8a728fc7c7ec0) Signed-off-by: Martin Hundebøll <martin@geanix.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: Fix build on riscvKhem Raj2024-05-232-0/+44
| | | | | | | | | GCC-14 unearths this bug which is already fixed upstream so backport it (From OE-Core rev: 0d5c61a1f5099639acf58b33288f466ce47847b5) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: patch CVE-2024-4603Peter Marko2024-05-222-0/+180
| | | | | | | | | Advisory: https://github.com/advisories/GHSA-85xr-ghj6-6m46 (From OE-Core rev: f136006676750ac653cd7804396614210d1e5120) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* recipes: Ensure S is set to a valid directoryRichard Purdie2024-05-211-0/+3
| | | | | | | | | | | | Several recipes have S pointing at a directory that does not exist. Set S in these cases to somethig valid making the metadata and recipe behaviour more consistent. Tweak one of the QA test diff offsets to match the changed recipe. (From OE-Core rev: 22f1f5849a9a3bf287dbe8933546e52e39ddc86e) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* recipes: Switch away from S = WORKDIRRichard Purdie2024-05-212-2/+4
| | | | | | | | | | | | | Where recipes use S = ${WORKDIR}, change them to set UNPACKDIR to a subdir of WORKDIR and make S point at this instead. I've chosen not to force S into any standard UNPACKDIR we may pick in future just so the S = UNPACKDIR case is clearly visible by the directory naming under WORKDIR as that should aid usability. (From OE-Core rev: d9328e3b0b062f0621de3d114584b44f384a1c02) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* recipes: Start WORKDIR -> UNPACKDIR transitionRichard Purdie2024-05-211-8/+8
| | | | | | | | | Replace references of WORKDIR with UNPACKDIR where it makes sense to do so in preparation for changing the default value of UNPACKDIR. (From OE-Core rev: 1f18b9a512800860d5153d89eb82b56388efad6f) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ssh-pregen-hostkeys: Limit to qemu machines by defaultRichard Purdie2024-05-131-1/+3
| | | | | | | | | | | | | | There are potential security issues from using pre-generated host keys. We made the recipe available for autobuilder testing purposes but concerns remain about how easily this could end up in production. I thought we'd already done this, but limit the recipe to qemu* machines, which means any real hardware trying to use it will need to be a bit more explicit about it and specifically enable it. (From OE-Core rev: b0405972d4fd6fa12f90afea5ecb9a50c01c21c6) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* iproute2: Fix build with GCC-14Khem Raj2024-05-131-0/+2
| | | | | | | | (From OE-Core rev: 127df0ac9b55fa2a7f3269934854f805843d01cc) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* lrzsz connman-gnome libfm: ignore various issues fatal with gcc-14Martin Jansa2024-05-131-0/+4
| | | | | | | | | | | | | | | | | | | | work arounds for: oe-core/meta/recipes-bsp/lrzsz/lrzsz_0.12.20.bb:do_compile oe-core/meta/recipes-connectivity/connman/connman-gnome_0.7.bb:do_compile oe-core/meta/recipes-support/libfm/libfm_1.3.2.bb:do_compile http://errors.yoctoproject.org/Errors/Build/183127/ More fixes on ML (especially for -native with gcc-14 on host) cdrtools: https://lists.openembedded.org/g/openembedded-core/message/198899 syslinux: https://lists.openembedded.org/g/openembedded-core/message/198901 (From OE-Core rev: 856ffc7d0893c1dc549baf401899947f70d31896) Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: fix pkgconfig path problemsRoss Burton2024-05-091-5/+1
| | | | | | | | | | | | | | | | | | | | OpenSSL 3.3.0 introduced new pkgconfig generators which interact badly with our incorrect setting of --libdir, which is documented as being the name of the directory _under $prefix_, not an absolute path. This resulted in the pkgconfig files have libdir=/usr which mostly works as the actual library directory is on the search path, but can break other recipes (such as tpm2-openssl). Pass the correct value for --libdir, and also remove the odd handling of an empty ${prefix} which is very historical[1] and can't happen anymore as all build variations have a prefix. [1] Added in oe-classic f725a81c, 2009 (From OE-Core rev: f5e931c5e5932e35113d13ba053419283f472f43) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kea: Remove -fvisibility-inlines-hidden from C++ flagsKhem Raj2024-05-091-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | This fixes build with gcc-14, where default visibility is extended to inline functions and getAll() function now falls into this category and functions are marked hidden resulting in linking errors Fixes /OE/build/oe-core/tmp-glibc/work/core2-64-oe-linux/kea/2.5.8/recipe-sysroot-native/usr/bin/x86_64-oe-linux/../../libexec/x86_64-oe-linux/gcc/x86_64-oe-linux/14.0.1/ld: ./.libs/libdhcp4.a(dhcp4_srv.o): in function `isc::dhcp::Dhcpv4Srv::appendRequestedVendorOptions(isc::dhcp::Dhcpv4Exchange&)': /usr/src/debug/kea/2.5.8/src/bin/dhcp4/dhcp4_srv.cc:2356:(.text+0xaac2): undefined reference to `isc::dhcp::CfgOption::getAll(unsigned int) const' /OE/build/oe-core/tmp-glibc/work/core2-64-oe-linux/kea/2.5.8/recipe-sysroot-native/usr/bin/x86_64-oe-linux/../../libexec/x86_64-oe-linux/gcc/x86_64-oe-linux/14.0.1/ld: ./.libs/libdhcp4.a(dhcp4_srv.o): in function `isc::dhcp::OptionDescriptor isc::dhcp::CfgOption::get<unsigned int>(unsigned int const&, unsigned short) const': /usr/src/debug/kea/2.5.8/src/lib/dhcpsrv/cfg_option.h:609:(.text+0xb288): undefined reference to `isc::dhcp::CfgOption::getAll(unsigned int) const' /OE/build/oe-core/tmp-glibc/work/core2-64-oe-linux/kea/2.5.8/recipe-sysroot-native/usr/bin/x86_64-oe-linux/../../libexec/x86_64-oe-linux/gcc/x86_64-oe-linux/14.0.1/ld: ./.libs/libdhcp4.a(dhcp4_srv.o): in function `isc::dhcp::Dhcpv4Srv::appendRequestedOptions(isc::dhcp::Dhcpv4Exchange&)': /usr/src/debug/kea/2.5.8/src/bin/dhcp4/dhcp4_srv.cc:2128:(.text+0xc556): undefined reference to `isc::dhcp::CfgOption::getAll(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) const' /OE/build/oe-core/tmp-glibc/work/core2-64-oe-linux/kea/2.5.8/recipe-sysroot-native/usr/bin/x86_64-oe-linux/../../libexec/x86_64-oe-linux/gcc/x86_64-oe-linux/14.0.1/ld: ./.libs/libdhcp4.a(dhcp4_srv.o): in function `std::vector<isc::dhcp::OptionDescriptor, std::allocator<isc::dhcp::OptionDescriptor> > isc::dhcp::CfgOption::getList<char [6]>(char const (&) [6], unsigned short) const': /usr/src/debug/kea/2.5.8/src/lib/dhcpsrv/cfg_option.h:641:(.text._ZNK3isc4dhcp9CfgOption7getListIA6_cEESt6vectorINS0_16OptionDescriptorESaIS5_EERKT_t[_ZNK3isc4dhcp9CfgOption7getListIA6_cEESt6vectorINS0_16OptionDescriptorESaIS5_EERKT_t]+0x86): undefined reference to `isc::dhcp::CfgOption::getAll(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) const' /OE/build/oe-core/tmp-glibc/work/core2-64-oe-linux/kea/2.5.8/recipe-sysroot-native/usr/bin/x86_64-oe-linux/../../libexec/x86_64-oe-linux/gcc/x86_64-oe-linux/14.0.1/ld: ./.libs/libdhcp4.a(dhcp4_srv.o): in function `isc::dhcp::OptionDescriptor isc::dhcp::CfgOption::get<char [6]>(char const (&) [6], unsigned short) const': /usr/src/debug/kea/2.5.8/src/lib/dhcpsrv/cfg_option.h:609:(.text._ZNK3isc4dhcp9CfgOption3getIA6_cEENS0_16OptionDescriptorERKT_t[_ZNK3isc4dhcp9CfgOption3getIA6_cEENS0_16OptionDescriptorERKT_t]+0x77): undefined reference to `isc::dhcp::CfgOption::getAll(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) const' collect2: error: ld returned 1 exit status make[5]: *** [Makefile:651: kea-dhcp4] Error 1 (From OE-Core rev: 584940c2f3234bfaf579429e162e683934e86538) Signed-off-by: Khem Raj <raj.khem@gmail.com> Cc: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* recipes: Update WORKDIR references to UNPACKDIRRichard Purdie2024-05-0217-46/+46
| | | | | | | | | | Since we want to be able to stop unpacking to WORKDIR, correct the WORKDIR references in recipe do_compile/do_install tasks to use UNPACKDIR in the appropraite places instead. (From OE-Core rev: d73595df69667fe9d12ecd407b77a0b8dae2109c) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* recipes: Update S = WORKDIR recipes to use ${S} correctlyRichard Purdie2024-05-021-2/+2
| | | | | | | | | | Where recipes use S = ${WORKDIR}, ensure they are referencing ${S} correctly to access files as soon we want to stop doing this in WORKDIR at which point they would break unless corrected. (From OE-Core rev: f25dd633fffe6560f191526d1869e657e129bad9) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* iproute2: upgrade 6.7.0 -> 6.8.0Changhyeok Bae2024-04-251-1/+4
| | | | | | | | | | | | | | | | * Release Note * This is regular release of iproute2 corresponding to the 6.8 kernel. In addition to the usual round of documentation fixes, many small changes to ss utility. Most of the work to have full JSON support in traffic control (TC) is done, only a few leftovers. Remove support fot ipt and xt in tc. (From OE-Core rev: f0a26644b620dea3f8ca82714cfa3249b13b01b1) Signed-off-by: Changhyeok Bae <changhyeok.bae@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* iproute2: drop obsolete patchMaxin B. John2024-04-252-42/+1
| | | | | | | | | | | libc-compat.h fix for musl was obsolete after 4.16.0 release of iproute2. Drop it. (From OE-Core rev: ad57a1e124a1de7af7ef8479ed779230e923d3af) Signed-off-by: Maxin John <maxin.john@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ppp: Add RSA-MD in LICENSEPoonam Jadhav2024-04-251-1/+1
| | | | | | | | | | | | ppp package has "RSA Data Security" license text in Message-Digest Algorithm source file ppp-md5.c and ppp-md4.c Add RSA-MD in LICENSE field for ppp package (From OE-Core rev: 9c58193c898b0ea28c3931a57dca5bb829a44051) Signed-off-by: Poonam Jadhav <poonam.jadhav@kpit.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: add After dependencies on nss-user-lookup.targetRasmus Villemoes2024-04-252-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | Quoting 'man systemd.special': nss-user-lookup.target A target that should be used as synchronization point for all regular UNIX user/group name service lookups. [...] All services for which the availability of the full user/group database is essential should be ordered after this target, but not pull it in. All services which provide parts of the user/group database should be ordered before this target, and pull it in. When no service providing parts of the user/group database exists and thus pulls in the nss-user-lookup.target, this added dependency is a no-op. However, when such a service does exist, and e.g. modifies /etc/shadow to change password or enable/disable certain accounts, it is essential that no ssh connections are accepted until those changes are made. (From OE-Core rev: 365b5490f3b12772ed57a6bcfd1e0e8a91185afc) Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* connman: submit 0002-resolve-musl-does-not-implement-res_ninit.patch upstreamAlexander Kanavin2024-04-251-1/+1
| | | | | | | (From OE-Core rev: 3e38999c60a58cace97357585271c0b62e5b7de7) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* connman: make 0002-resolve-musl-does-not-implement-res_ninit.patch libc-agnosticAlexander Kanavin2024-04-252-47/+60
| | | | | | | | | | | | | The patch is reworked to take musl-specific path only if the functions are undefined by libc (which can be checked via __RES, as explained in https://www.openwall.com/lists/musl/2020/10/23/16 ). This should make it more suitable for upstream submission. (From OE-Core rev: 8579ae324c69cd278c2bdb08187b27f15c2d9c67) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kea: remove unnecessary reproducibility patchAlexander Kanavin2024-04-252-64/+1
| | | | | | | | | Rather, adjust the sed invocation to do the correct thing directly. (From OE-Core rev: 804afb2eb9cc2b5650faa80816f377fa5b72fb38) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: upgrade 3.2.1 -> 3.3.0Wang Mingyu2024-04-252-122/+1
| | | | | | | | | | | | | CVE-2024-2511.patch revmoed since it's included in 3.3.0 Changelog: https://github.com/openssl/openssl/blob/openssl-3.3.0/NEWS.md (From OE-Core rev: 1d6cb1592d6883cc504ff0776810312f732664ae) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bind: upgrade 9.18.25 -> 9.18.26Wang Mingyu2024-04-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: ============ - Add RESOLVER.ARPA to the built in empty zones. - dig/mdig +ednsflags=<non-zero-value> did not re-enable EDNS if it had been disabled. - Some invalid ISO 8601 durations were accepted erroneously. - Don't return static-stub synthesised NS RRset. - Fix bug in Depends (keymgr_dep) function. - Support for the RESINFO record type has been added. - Cleaned up several minor bugs in the RBTDB dbiterator implementation. - Added missing dns_rdataset_disassociate calls in validator.c:findnsec3proofs. - Fix incorrectly reported errors when running tests with `make test` on platforms with older pytest. - Optimize slabheader placement, so the infrastructure records are put in the beginning of the slabheader linked list. - Improve ARM parental-agents definition. - Fix the DNS_GETDB_STALEFIRST flag, which was defined incorrectly in lib/ns/query.c. - Update ZSK minimum lifetime documentation in ARM, also depends on signing delay. - Add workaround to enforce dynamic linker to pull jemalloc earlier than libc to ensure all memory allocations are done via jemalloc. - Changes to "listen-on" statements were ignored on reconfiguration unless the port or interface address was changed, making it impossible to change a related listener transport type. Thanks to Thomas Amgarten. - Expose the TCP client count in statistics channel. - Fix a possible crash in 'dig +nssearch +nofail' and 'host -C' commands when one of the name servers returns SERVFAIL. - When dnssec-policy is in effect the DNSKEY's TTLs in the zone where not being updated to match the policy. This lead to failures when DNSKEYs where updated as the TTLs mismatched. (From OE-Core rev: 9dc097f240c5ab7703179f480f538be8e21defce) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* iproute2: add bridge packageMichael Haener2024-04-161-0/+2
| | | | | | | | | | Add package for using the bridge tool. (From OE-Core rev: 21689b8984fd426f4e21d729d82444d3a8e230b7) Signed-off-by: Michael Haener <michael.haener@siemens.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: upgrade 9.6p1 -> 9.7p1Wang Mingyu2024-04-162-11/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 0001-systemd-Add-optional-support-for-systemd-sd_notify.patch refresh for 9.7p1 Changelog: ============ New features ------------ * ssh(1), sshd(8): add a "global" ChannelTimeout type that watches all open channels and will close all open channels if there is no traffic on any of them for the specified interval. This is in addition to the existing per-channel timeouts added recently. * All: make DSA key support compile-time optional, defaulting to on. Bugfixes -------- * sshd(8): don't append an unnecessary space to the end of subsystem arguments * ssh(1): fix the multiplexing "channel proxy" mode, broken when keystroke timing obfuscation was added. * ssh(1), sshd(8): fix spurious configuration parsing errors when options that accept array arguments are overridden * ssh-agent(1): fix potential spin in signal handler * Many fixes to manual pages and other documentation * Greatly improve interop testing against PuTTY. (From OE-Core rev: e409b8ceb514d67d6472b4433cc9869c43401b94) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bind: upgrade 9.18.24 -> 9.18.25Wang Mingyu2024-04-161-1/+1
| | | | | | | | | | | | | | | | | | | | Changelog: ============ -Create the pruning task in the dns_cache_flush(), so the cache pruning still works after the flush. -Improve the TTL-based cleaning by removing the expired headers from the heap, so they don't block the next cleaning round and clean more than a single item for each new addition to the RBTDB. -Revert change 6319 and decrease lock contention during RBTDB tree pruning by not cleaning up nodes recursively within a single prune_tree() call. -Address use after free in expire_lru_headers. (From OE-Core rev: 17cecd0d9d0d734d408701d861692ca5987f4ad9) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: openssl: patch CVE-2024-2511Peter Marko2024-04-162-0/+121
| | | | | | | | | | Patch: https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08 News: https://github.com/openssl/openssl/commit/b7acb6731a96b073d6150465bd090e2052a595c2 (From OE-Core rev: b439d1c9e5a115bbb5193a2df25e84291cc07bec) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: add fido2 supportDan McGregor2024-04-141-0/+1
| | | | | | | | | | | | OpenSSH supports FIDO security keys in both the client and server. Add an option to support them in oe. This change requires a new recipe that I've submitted to meta-openembedded that has not merged yet. (From OE-Core rev: 74451a65f29b16f78b008b3ac70c99c2d61a7cad) Signed-off-by: Dan McGregor <dan.mcgregor@usask.ca> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: fix crash on aarch64 if BTI is enabled but no Crypto instructionsRoss Burton2024-03-302-0/+59
| | | | | | | | | | | | | | | | On aarch64, if the processor doesn't have the Crypto instructions then OpenSSL will fall back onto the "bit-sliced" assembler routines. When branch protection (BTI) was enabled in OpenSSL these routines were missed, so if BTI is available libssl will immediately abort when it enters this assembler. Backport a patch submitted upstream to add the required call target annotations so that BTI doesn't believe the code is being exploited. (From OE-Core rev: 438a390e8e1811bc2d3820c1cd2b8e099e70064a) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Add a workaround for ICE on powerpc64le5.0_M3William Lyu2024-03-081-0/+3
| | | | | | | | | | | | | | | | | | | Fixes [YOCTO #15415] The new openssh version has an ICE on powerpc64le similar to the one on mips/mips64[1]. By adding flag "--without-hardening" to "./configure", compiler option "-fzero-call-used-regs" will be removed when compiling. This prevents certain functions from triggering the following ICE: unimplemented: argument 'used' is not supported for '-fzero-call-used-regs' on this target References [1] https://git.openembedded.org/openembedded-core/commit/?id=5b290566519a87c563945a033cb49863317ad63d (From OE-Core rev: bc793fa9d1fe24c102d91e97b7002b6e637cbfa5) Signed-off-by: William Lyu <William.Lyu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ofono: upgrade 2.3 -> 2.4Wang Mingyu2024-03-011-1/+1
| | | | | | | | | | | | Changelog: ============ -Add support for new provision database format. -Add support for Quectel EG96 modem. (From OE-Core rev: c24adeab8287bcedfd04dc67b08dd8b57cfa42ef) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wpa-supplicant: Fix CVE-2023-52160Claus Stovgaard2024-02-292-0/+214
| | | | | | | | | | PEAP client: Update Phase 2 authentication requirements. Also see https://www.top10vpn.com/research/wifi-vulnerabilities/ (From OE-Core rev: 57b6a329df897de69ae8b90706d9fe37e0ed6d35) Signed-off-by: Claus Stovgaard <claus.stovgaard@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: Match target name for loongarch64Xiaotian Wu2024-02-271-0/+3
| | | | | | | | | | | This is updated in openssl [1] since opensssl 3.2.0-alpha1 onwards [1] https://github.com/openssl/openssl/commit/b625e21e67666213ffd3ba6b1f2cd8a847ba6b66 (From OE-Core rev: 1e5b30d92da2e51e6a4ba75e2cc1e9ccebc8efe7) Signed-off-by: Xiaotian Wu <wuxiaotian@loongson.cn> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta: Remove some not needed CVE_STATUSSimone Weiß2024-02-241-2/+0
| | | | | | | | | | CVE_STATUS was set for those components, but meanwhile databases are updated with corrected information, so setting the CVE_STATUS is not needed anymore. (From OE-Core rev: 5ec6057cfa66ceeb33bec013e320f8e3fa7d7ecf) Signed-off-by: Simone Weiß <simone.p.weiss@posteo.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bluez5: remove configuration files from install taskEmil Kronborg2024-02-241-8/+0
| | | | | | | | | | | | Since be0e796299b0 ("build: ship all config files with --enable-datafiles") in bluez, installing input.conf and network.conf has been redundant, as the bluez5 recipe already includes --enable-datafiles. (From OE-Core rev: 49391fdcf71b32c5fd3c7b134c1d1c45cc1db388) Signed-off-by: Emil Kronborg <emil.kronborg@protonmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bind: Upgrade 9.18.21 -> 9.18.24Soumya Sambu2024-02-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: ========= 9.18.24: - Fix case insensitive setting for isc_ht hashtable. [GL #4568] 9.18.23: - Specific DNS answers could cause a denial-of-service condition due to DNS validation taking a long time. (CVE-2023-50387) [GL #4424] - Change 6315 inadvertently introduced regressions that could cause named to crash. [GL #4234] - Under some circumstances, the DoT code in client mode could process more than one message at a time when that was not expected. That has been fixed. [GL #4487] 9.18.22: - Limit isc_task_send() overhead for RBTDB tree pruning. [GL #4383] - Restore DNS64 state when handling a serve-stale timeout. (CVE-2023-5679) [GL #4334] - Specific queries could trigger an assertion check with nxdomain-redirect enabled. (CVE-2023-5517) [GL #4281] - Speed up parsing of DNS messages with many different names. (CVE-2023-4408) [GL #4234] - Address race conditions in dns_tsigkey_find(). [GL #4182] - Conversion from NSEC3 signed to NSEC signed could temporarily put the zone into a state where it was treated as unsigned until the NSEC chain was built. Additionally conversion from one set of NSEC3 parameters to another could also temporarily put the zone into a state where it was treated as unsigned until the new NSEC3 chain was built. [GL #1794] [GL #4495] - Memory leak in zone.c:sign_zone. When named signed a zone it could leak dst_keys due to a misplaced 'continue'. [GL #4488] - Log more details about the cause of "not exact" errors. [GL #4500] - The wrong time was being used to determine what RRSIGs where to be generated when dnssec-policy was in use. [GL #4494] - The "trust-anchor-telemetry" statement is no longer marked as experimental. This silences a relevant log message that was emitted even when the feature was explicitly disabled. [GL #4497] - Fix statistics export to use full 64 bit signed numbers instead of truncating values to unsigned 32 bits. [GL #4467] - NetBSD has added 'hmac' to libc which collides with our use of 'hmac'. [GL #4478] (From OE-Core rev: d7f31aba343948dbaadafc8c0c66f78e6ffb46e3) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libuv: Upgrade 1.47.0 -> 1.48.0Simone Weiß2024-02-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Upgrade libuv to pull in the fix for CVE-2024-24806 Changes: * misc: remove deprecated stalebot file (Jameson Nash) * build: disable windows asan buildbot (Ben Noordhuis) * test: don't run tcp_writealot under msan (Ben Noordhuis) * build,win: remove extraneous -lshell32 (Ben Noordhuis) * unix: ignore ifaddrs with NULL ifa_addr (Stephen Gallagher) * unix,win: utility for setting priority for thread (Hao Hu) * pipe: add back error handling to connect / bind (Jameson Nash) * test: check if ipv6 link-local traffic is routable (Ben Noordhuis) * win: remove check for UV_PIPE_NO_TRUNCATE (Jameson Nash) * linux: disable io_uring on hppa below kernel 6.1.51 (matoro) * unix,win: fix read past end of pipe name buffer (Ben Noordhuis) * unix: unbreak macOS < 10.14 (Sergey Fedorov) * aix: disable ipv6 link local (Abdirahim Musse) * doc: move cjihrig to emeriti (cjihrig) * unix: correct pwritev conditional (Bo Anderson) * test_fs.c: Fix issue on 32-bit systems using btrfs (Stephen Gallagher) * misc: ignore libuv-release-tool files (Jameson Nash) * win: honor NoDefaultCurrentDirectoryInExePath env var (Ardi Nugraha) * idna: fix compilation warning (Saúl Ibarra Corretgé) * linux: remove HAVE_IFADDRS_H macro (Ben Noordhuis) * test: skip tcp-write-in-a-row on IBM i (Abdirahim Musse) * build,win: work around missing uuid.dll on MinGW (Anton Bachin) * win: stop using deprecated names (Matheus Izvekov) * unix,win: fix busy loop with zero timeout timers (Matheus Izvekov) * aix,ibmi: use uv_interface_addresses instead of getifaddrs (Abdirahim Musse) * linux: fix bind/connect for abstract sockets (Santiago Gimeno) * win: replace c99 comments with c89 comments (Trevor Flynn) * build: add .cache clangd folder to .gitignore (Juan José Arboleda) * unix: support full TCP keep-alive on Solaris (Andy Pan) * freebsd: fix F_KINFO file path handling (David Carlier) * linux: retry fs op if unsupported by io_uring (Santiago Gimeno) * freebsd: fix build on non-intel archs (David Carlier) * unix: optimize uv__tcp_keepalive cpp directives (Andy Pan) * linux: disable io_uring on ppc64 and ppc64le (Brad King) * doc: add very basic Security Policy document (Santiago Gimeno) * build: re-enable msvc-asan job on CI (Jameson Nash) * win/spawn: optionally run executable paths with no file extension (Brad King) * win: fix ESRCH implementation (Jameson Nash) * unix,win: reset the timer queue on stop (Santiago Gimeno) * fix: always zero-terminate idna output (Ben Noordhuis) * fix: reject zero-length idna inputs (Ben Noordhuis) * test: empty strings are not valid IDNA (Santiago Gimeno) * Merge pull request from GHSA-f74f-cvh7-c6q6 (Ben Noordhuis) (From OE-Core rev: 15110dc982bd65a6165693568b57c91c662812b4) Signed-off-by: Simone Weiß <simone.p.weiss@posteo.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-01-10 17:26:10 +0000