Mirror of git.openembedded.org/meta-openembedded https://git.enea.com/cgit/linux/meta-openembedded.git/atom?h=master-next 2026-06-16T05:43:49+00:00 2026-06-16T05:43:49+00:00 Khem Raj khem.raj@oss.qualcomm.com 2026-06-10T04:17:20+00:00 urn:sha1:20feb7fd95ae69f01175463ec130d2a79f8013e3 Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> 2026-05-13T07:17:26+00:00 Louis Rannou louis.rannou@non.se.com 2026-05-11T11:47:23+00:00 urn:sha1:995f143cb9ec6594419177ee4072b52f26c79a8a The dns-updown script is written in bash which is under the GPLv3 license. As this script is optional, it is preffered to have it in an extra package. Signed-off-by: Louis Rannou <louis.rannou@non.se.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> 2026-03-27T16:09:05+00:00 Haixiao Yan haixiao.yan.cn@windriver.com 2026-03-27T02:12:43+00:00 urn:sha1:79201ef95ed1169f21c97710859de5417824c55e The openvpn 2.7.0 upgrade refactored tests/unit_tests/openvpn/Makefile.am, changing how test_binaries is defined. This caused autoreconf to generate Makefiles where buildtest-TESTS and runtest-TESTS no longer have rule bodies, breaking the existing ptest recipe which relied on these targets for compilation and execution. The fix replaces these internal automake targets with stable interfaces: check-am for compilation and direct binary execution on target. Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> 2026-03-25T06:32:48+00:00 Zoltán Böszörményi zboszor@gmail.com 2026-03-25T04:50:56+00:00 urn:sha1:d03b3460474c4a359d413ce6ebcc99ffe39aea1a Release notes: https://community.openvpn.net/ReleaseHistory#openvpn-270-released-11-february-2026 Signed-off-by: Zoltán Böszörményi <zboszor@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> 2025-12-17T03:57:33+00:00 Gyorgy Sarvari skandigraun@gmail.com 2025-12-16T09:09:37+00:00 urn:sha1:30d2c25a8d448e567affcc30a41942b959739d51 Changelog: - Windows/interactive service: fix erroneous exit on error that could be used by a local Windows users to achieve a local denial-of-service (CVE-2025-13751) - Windows/interactive service: improve service pipe robustness against file access races (uuid) and access by unauthorized processes (ACL). upgrade bundled build instruction (vcpkg and patch) for pkcs11-helper to 1.31, fixing a parser bug Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> 2025-11-25T15:44:41+00:00 Wang Mingyu wangmy@fujitsu.com 2025-11-25T09:11:39+00:00 urn:sha1:351ac662131944f4c40ea8410a0077cc715053a2 Code maintenance / Compat changes --------------------------------- - adapt to new "encrypt-then-mac" cipher suites in OpenSSL 3.6.0 - these need special handling which we don't do, so the t_lpback self-test failed on them. Exclude from list of allowed ciphers, as there is no strong reason today to make OpenVPN use these. - fix various compile-time warnings Documentation updates --------------------- - fix outdated and non-HTTPS URLs throughout the tree (doxygen, warnings, manpage, ...) Bugfixes -------- - Fix memcmp check for the hmac verification in the 3way handshake. This bug renders the HMAC based protection against state exhaustion on receiving spoofed TLS handshake packets in the OpenVPN server inefficient. CVE: 2025-13086 - fix invalid pointer creation in tls_pre_decrypt() - technically this is a memory over-read issue, in practice, the compilers optimize it away so no negative effects could be observed. - Windows: in the interactive service, fix the "undo DNS config" handling. - Windows: in the interactive service, disallow using of "stdin" for the config file, unless the caller is authorized OpenVPN Administrator - Windows: in the interactive service, change all netsh calls to use interface index and not interface name - sidesteps all possible attack avenues with special characters in interface names. - Windows: in the interactive service, improve error handling in some "unlikely to happen" paths. - auth plugin/script handling: properly check for errors in creation on $auth_failed_reason_file (arf). - for incoming TCP connections, close-on-exec option was applied to the wrong socket fd, leaking socket FDs to child processes. - sitnl: set close-on-exec flag on netlink socket - ssl_mbedtls: fix missing perf_pop() call (optional performance profiling) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> 2025-10-09T06:35:52+00:00 Wang Mingyu wangmy@fujitsu.com 2025-10-09T06:07:52+00:00 urn:sha1:9b5ab1a96ca56ca3a7d31c98eedc8153cf916d40 Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> 2025-08-21T20:15:39+00:00 Jiaying Song jiaying.song.cn@windriver.com 2025-08-21T09:06:06+00:00 urn:sha1:8e28287dde1627d09e5be8264d8552e0c9c4bab0 The format selected is the automake "simple test" format: "result: testname". Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> 2025-08-14T14:40:09+00:00 Zoltán Böszörményi zboszor@gmail.com 2025-08-14T08:40:48+00:00 urn:sha1:df6a14a27c81675f31da3c488d35f07ee413afb5 Moved the iproute2 backend enablement into a new PACKAGECONFIG. It is enabled to keep the current defaults. Added the explicit runtime dependency on iproute2-ip (the "ip" command) which this backend requires. Added a new PACKAGECONFIG[dco] which enables the libnl backend, which is mutually incompatible with iproute2 backend in OpenVPN. With these: PACKAGECONFIG:remove = "iproute2" PACKAGECONFIG:append = " dco" the data channel offload is enabled: checking for LIBNL_GENL... yes configure: Enabled ovpn-dco support for Linux With Linux kernel 6.16 or newer, and CONFIG_OVPN enabled, the data channel offload will be used. Signed-off-by: Zoltán Böszörményi <zboszor@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> 2025-04-07T19:21:18+00:00 Wang Mingyu wangmy@fujitsu.com 2025-04-07T09:16:49+00:00 urn:sha1:03efb8bf8c01bfff4bd37bfe076004a0c3407ac5 Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>