linux/meta-openembedded.git/meta-networking/recipes-support, branch nanbield

strongswan: upgrade 5.9.12 -> 5.9.13

2024-01-17T00:20:45+00:00

Changelog: - Fixes a regression with handling OCSP error responses and adds a new option to specify the length of nonces in OCSP requests. Also adds some other improvements for OCSP handling and fuzzers for OCSP requests/responses. Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj (cherry picked from commit 5be2e20157f3025f9e2370933267a56fd526c58e) Signed-off-by: Armin Kuster

strongswan: upgrade 5.9.11 -> 5.9.12

2024-01-05T12:52:17+00:00

Changelog: ========== - Fixed a vulnerability in charon-tkm related to processing DH public values that can lead to a buffer overflow and potentially remote code execution. - The new `pki --ocsp` command produces OCSP responses based on certificate status information provided by plugins. - The cert-enroll script handles the initial enrollment of an X.509 host certificate with a PKI server via the EST or SCEP protocols. - The --priv argument for charon-cmd allows using any type of private key. - Support for nameConstraints of type iPAddress has been added (the openssl plugin previously didn't support nameConstraints at all). - SANs of type uniformResourceIdentifier can now be encoded in certificates. - Password-less PKCS#12 and PKCS#8 files are supported. - A new global option allows preventing peers from authenticating with trusted end-entity certificates (i.e. local certificates). - ECDSA public keys that encode curve parameters explicitly are now rejected by all plugins that support ECDSA. - charon-nm now actually uses the XFRM interfaces added with 5.9.10, it can also use the name in connection.interface-name. - The resolve plugin tries to maintain the order of installed DNS servers. - The kernel-libipsec plugin always installs routes even if no address is found in the local traffic selectors. - Increased the default receive buffer size for Netlink sockets to 8 MiB and simplified its configuration. - Copy the issuer's subjectKeyIdentifier as authorityKeyIdentifier instead of always generating a hash of the subjectPublicKey. - Fixed issues while reestablishing multiple CHILD_SAs (e.g. after a DPD timeout) that could cause a reqid to get assigned to multiple CHILD_SAs with unrelated traffic selectors. - Fixed a possible infinite loop issue in watcher_t and removed WATCHER_EXCEPT, instead callbacks are always invoked even if only errors are signaled. - Fixed a regression in the IKE_SA_INIT tracking code added with 5.9.6 when handling invalid messages. - Fixed adding the XFRMA_REPLAY_ESN_VAL attribute twice when updating SAs. - Correctly encode SPI from REKEY_SA notify in CHILD_SA_NOT_FOUND notify if CHILD_SA is not found during rekeying. - The testing environment is now based on Debian 12 (bookworm), by default. Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj (cherry picked from commit 077489fda8f27336942457da1eaa022804f327c2) Signed-off-by: Armin Kuster

openvpn: upgrade 2.6.3 -> 2.6.6

2024-01-05T12:52:16+00:00

License-Update: Added Apache2 linking exception Signed-off-by: Khem Raj (cherry picked from commit 45ad525348569f8f5f694a88bb311dbf83998304) Signed-off-by: Armin Kuster

mdio-tools: Add virtual/kernel dependency to avoid stale SPDX reference

2023-11-01T12:16:30+00:00

OpenBMC enables SPDX SBOM generation by default. For Meta's Bletchley platform we found that mdio-tools and its relationships with both mdio-netlink and the mdio-netlink kernel module break SPDX processing while generating the rootfs after a kernel bump. For example, the following output was generated by `bitbake obmc-phosphor-image`: ERROR: obmc-phosphor-image-1.0-r0 do_rootfs: Cannot find any SPDX file for document http://spdx.org/spdxdoc/kernel-module-mdio-netlink-6.5.4-da279e9-00089-gda279e98c07f-89187488-3164-50cb-94c5-8b76a30ea093 The error occurred after the following patch was applied (again, in the context of OpenBMC): diff --git a/meta-aspeed/recipes-kernel/linux/linux-aspeed_git.bb b/meta-aspeed/recipes-kernel/linux/linux-aspeed_git.bb index e6f98297c540..b852e993f0f6 100644 --- a/meta-aspeed/recipes-kernel/linux/linux-aspeed_git.bb +++ b/meta-aspeed/recipes-kernel/linux/linux-aspeed_git.bb @@ -1,6 +1,6 @@ KBRANCH ?= "dev-6.5" -LINUX_VERSION ?= "6.5.4" +LINUX_VERSION ?= "6.5.9" -SRCREV="da279e98c07f9c948c60a434ab0043a55c26ea1d" +SRCREV="fc8d4fdba5bd2b9b1cea2aa8a731531943c45aa7" require linux-aspeed.inc With the lack of a dependency the mdio-tools package is not rebuilt subsequent to the kernel bump and the package information remains stale, leading to an incorrect SPDX path being generated. Signed-off-by: Andrew Jeffery Signed-off-by: Khem Raj (cherry picked from commit 668cf43b21e27faa34b7c3c7133a480a9e4e480f) Signed-off-by: Armin Kuster

meta-networking: Drop broken BBCLASSEXTEND variants

2023-11-01T12:16:30+00:00

The command "bitbake universe -c fetch" currently throws a ton of warnings as there are many 'impossible' dependencies. In some cases these variants may never have worked and were just added by copy and paste of recipes. In some cases they once clearly did work but became broken somewhere along the way. Users may also be carrying local bbappend files which add further BBCLASSEXTEND. Having universe fetch work without warnings is desireable so clean up the broken variants. Anyone actually needing something dropped here can propose adding it and the correct functional dependencies back quite easily. This also then ensures we're not carrying or fixing things nobody uses. Signed-off-by: Richard Purdie Signed-off-by: Khem Raj (cherry picked from commit e1b332f2eff7df2336ff87917cd48249edf763a2) Signed-off-by: Armin Kuster

wireshark: upgrade 4.0.8 -> 4.0.10

2023-10-30T11:14:03+00:00

Bugfix: Error loading g729.so plugin with Wireshark 4.0.9 and 3.6.17 on macOS. Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj (cherry picked from commit 7e44aac2fb6a7e9d95cba4341d7fcaf5fa2a0923) Signed-off-by: Armin Kuster

rdma-core: upgrade 47.0 -> 48.0

2023-10-30T11:14:03+00:00

Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj (cherry picked from commit 21db09270d8c05ea1871277dd9899e352915297a) Signed-off-by: Armin Kuster

libexosip2: add recipe

2023-10-30T11:14:02+00:00

libexosip2 extends the capabilities of the osip2 library. It can be a useful building block for an embedded device application. Signed-off-by: Charles Perry Signed-off-by: Khem Raj (cherry picked from commit 2b4cb938b043c77f9f12f5cfb84fbc8f1f3fbf4d) Signed-off-by: Armin Kuster

libosip2: add recipe

2023-10-30T11:14:02+00:00

The GNU oSIP library is an implementation of SIP - rfc3261. It can be a useful building block for an embedded device application. Signed-off-by: Charles Perry Signed-off-by: Khem Raj (cherry picked from commit 03a948375e5e21c8b92123b034176977083de464) Signed-off-by: Armin Kuster

libldb: add ptest

2023-10-17T12:23:02+00:00

* use external cmocka instead of bundled cmocka * add run-ptest script Ptest results: $ ptest-runner libldb START: ptest-runner 2023-10-12T11:49 BEGIN: /usr/lib/libldb/ptest PASS: test_ldb_dn PASS: test_ldb_qsort DURATION: 0 END: /usr/lib/libldb/ptest 2023-10-12T11:49 STOP: ptest-runner TOTAL: 1 FAIL: 0 Signed-off-by: Yi Zhao Signed-off-by: Khem Raj (cherry picked from commit 4a07ee78c57950aaf2e0858c159ffa6454f7f28a) Signed-off-by: Armin Kuster