summaryrefslogtreecommitdiffstats
path: root/meta-networking
Commit message (Collapse)AuthorAgeFilesLines
* frr: patch CVE-2025-61099..61107Gyorgy Sarvari2026-01-204-0/+416
| | | | | | | | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-61099 https://nvd.nist.gov/vuln/detail/CVE-2025-61100 https://nvd.nist.gov/vuln/detail/CVE-2025-61101 https://nvd.nist.gov/vuln/detail/CVE-2025-61102 https://nvd.nist.gov/vuln/detail/CVE-2025-61103 https://nvd.nist.gov/vuln/detail/CVE-2025-61104 https://nvd.nist.gov/vuln/detail/CVE-2025-61105 https://nvd.nist.gov/vuln/detail/CVE-2025-61106 https://nvd.nist.gov/vuln/detail/CVE-2025-61107 The NVD advisory refernces a PR[1] that contains only an unfinished, and ultimately unmerged attempt at the fixes. The actual solution comes from a different PR[2]. These patches are 3 commits from that PR. The last commit wasn't backported, because it is just code formatting. [1]: https://github.com/FRRouting/frr/pull/19480 [2]: https://github.com/FRRouting/frr/pull/19983 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* adcli: upgrade 0.9.2 -> 0.9.3.1Liu Yiding2026-01-202-4/+60
| | | | | | | | | | | | | | | | | 1. Add pkgconfig to solve following configure error: ../sources/adcli-0.9.3.1/configure: line 15340: syntax error near unexpected token `LIBSELINUX,' ../sources/adcli-0.9.3.1/configure: line 15340: `PKG_CHECK_MODULES(LIBSELINUX, libselinux, found_libselinux=yes, found_libselinux=no)' 2. Add PACKAGECONFIG[selinux] for new selinux support in 0.9.3.1. 3. Add 0001-configure.ac-Fix-selinux-error-for-cross_compiling.patch to fix SELINUX_MAKEFILE file check in 0.9.3.1. 4. Add --disable-offline-join-support to solve following configure error configure: error: Couldn't build offline join support, Samba version too old or libnatapi devel package is missing Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* libcoap: set CVE version suffixPeter Marko2026-01-201-0/+2
| | | | | | | | | CVE metrics currently report CVE-2025-34468 as open. CPE is <=4.3.5, while recipe version is 4.3.5a which is a higher version, however by default cve-check only compares numbers. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* open62541: update to v1.4Johannes Kauffmann2026-01-163-32/+123
| | | | | | | | | | | | | | | | Use the latest commit from the 1.4 branch; the last 1.4 release was 3 months ago so it contains important fixes. - The contents of /usr/share/ are slightly different, so change the path slightly. - The new patch fixes the .pc file generation (it also ensures that there are no references to absolute paths in the .pc file which would need to be removed again). - PubSub information model is now enabled by default, add a new option to disable it (disabling only pubsub isn't enough). Signed-off-by: Johannes Kauffmann <johanneskauffmann@hotmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* adcli: Fix OECONFLiu Yiding2026-01-141-2/+1
| | | | | | | | | Remove "--disable-static" as it's not needed for default option. ./configure --help --enable-static[=PKGS] build static libraries [default=no] Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* openfortivpn: upgrade 1.24.0 -> 1.24.1Wang Mingyu2026-01-131-1/+1
| | | | | | | | Changelog: fix regression where the 'plugin' was not passed to pppd Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* frr: upgrade 10.5.0 -> 10.5.1Yi Zhao2026-01-131-1/+1
| | | | | | | | ChangeLog: https://github.com/FRRouting/frr/releases/tag/frr-10.5.1 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nng: add ptestYi Zhao2026-01-122-3/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ptest results on genericx86-64 BSP: $ run-ptest PASS: compat_block PASS: compat_bug777 PASS: compat_bus PASS: compat_cmsg PASS: compat_device PASS: compat_iovec PASS: compat_msg PASS: compat_options PASS: compat_pair PASS: compat_pipeline PASS: compat_poll PASS: compat_reqrep PASS: compat_reqttl PASS: compat_shutdown PASS: compat_survey PASS: compat_surveyttl PASS: cplusplus_pair PASS: device PASS: files FAIL: httpclient PASS: httpserver PASS: inproc PASS: ipc PASS: ipcsupp PASS: multistress PASS: nonblock PASS: options PASS: pipe PASS: pollfd PASS: reqctx PASS: reqstress PASS: scalability PASS: synch PASS: tcp PASS: tcp6 PASS: tcpsupp PASS: tls PASS: ws PASS: wss The httpclient case attempts to retrieve the Content-Length field from HTTP header of http://example.com/, but because the site uses chunked transfer encoding, the Content-Length field is not present, leading to an assertion failure. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nng: upgrade 1.7.3 -> 1.11Yi Zhao2026-01-121-3/+2
| | | | | | | | | | | ChangeLog: https://github.com/nanomsg/nng/releases/tag/v1.11 https://github.com/nanomsg/nng/releases/tag/v1.10 https://github.com/nanomsg/nng/releases/tag/v1.9.0 https://github.com/nanomsg/nng/releases/tag/v1.8.0 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nanomsg: add ptestYi Zhao2026-01-122-2/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ptest results: $ run-ptest PASS: async_shutdown PASS: block PASS: bug328 PASS: bug777 PASS: bus PASS: cmsg PASS: device PASS: device4 PASS: device5 PASS: device6 PASS: device7 PASS: domain PASS: emfile PASS: hash PASS: inproc PASS: inproc_shutdown PASS: iovec PASS: ipc PASS: ipc_shutdown PASS: ipc_stress PASS: list PASS: msg PASS: pair PASS: pipeline PASS: poll PASS: prio PASS: pubsub PASS: reqrep PASS: reqttl PASS: separation PASS: shutdown PASS: stats PASS: survey PASS: surveyttl PASS: symbol PASS: tcp PASS: tcp_shutdown PASS: term PASS: timeo PASS: trie PASS: ws PASS: ws_async_shutdown PASS: zerocopy Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nanomsg: upgrade 1.2.1 -> 1.2.2Yi Zhao2026-01-122-60/+2
| | | | | | | | | | | ChangeLog: https://github.com/nanomsg/nanomsg/releases/tag/1.2.2 Drop 0001-allow-build-with-cmake-4.patch as the issue has been fixed upstream. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* tcpdump: upgrade 4.99.5 -> 4.99.6Wang Mingyu2026-01-122-7/+4
| | | | | | | | add-ptest.patch refreshed for 4.99.6 Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nbdkit: upgrade 1.46.0 -> 1.47.1Wang Mingyu2026-01-121-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* fping: upgrade 5.4 -> 5.5Wang Mingyu2026-01-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: =========== - New option -J / --json for JSON output. See doc/fping-json.md for the JSON schema. This feature is still in alpha and the schema might change in future releases - The -g, --generate option now also supports IPv6 addresses - New option --seqmap-timeout to control the time after which sequence numbers can be used again - Fix OpenBSD sprintf() warning - Fix fallback to SO\_TIMESTAMP if SO\_TIMESTAMPNS is not available - When reading target names from file or standard input, lines longer than the static buffer are no longer interpreted as more than one line - Typo fix in error message when SO\_BINDTODEVICE fails - Options --print-tos and --print-ttl now also work for IPv6, and no longer require privileges - Report received ICMPv6 error messages - Suppress duplicate reports in count mode with -q, --quiet or -Q, --squiet - Switch to alpine-based multi-stage Docker build to reduce image size and improve build performance; add OpenContainers-compatible labels - Print receive ping moved to new functions - Avoid unsigned overflow when determining the memory size to save response times on systems where size\_t is the same as unsigned int - Document the new minimum value for the -p option - Fix build without IPv6 support - Fix debug build use of dbg_printf in fping.c - Remove MacOS-specific test for -I option - GitHub Actions fixes - Fix measurement of time for timed reports (-Q) to start after DNS name resolution. - Updated autoconf from 2.71 to 2.72 - Updated automake from 1.16.5 to 1.18.1 - Updated libtool from 2.4.6 to 2.5.4 - Implemented verification of autotools tarballs in Github actions. - Implemented stricter flag value checking (e.g. -c 10xyz is not accepted anymore). Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* net-snmp: Update to 5.9.5.2Peter Kjellerstedt2026-01-061-1/+1
| | | | | | | | | | | 5.9.5.1: * Only a version numbering fix. 5.9.5.2: * Fix an issue with needing limits.h included. Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* vsomeip: Don't fail on Boost.Asio deprecation warningsKhem Raj2026-01-031-0/+2
| | | | | | | Append -Wno-error=deprecated-declarations to CXXFLAGS so builds don't break when Boost marks APIs like strand::wrap() as deprecated. Signed-off-by: Khem Raj <raj.khem@gmail.com>
* python3-scapy: set CVE_PRODUCTGyorgy Sarvari2025-12-311-0/+2
| | | | | | | | | | | | | | The default ${PN} (python3-scapy) CVE fails to match relevant CVEs, because they are tracked under the scapy:scapy CPE. Set CVE_PRODUCT to the correct value. See CVE db query: sqlite> select * from products where product like '%scapy%'; CVE-2019-1010142|scapy|scapy|2.4.0|=|| Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* networkmanager-openvpn: upgrade 1.12.3 -> 1.12.5Liu Yiding2025-12-311-1/+3
| | | | | Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* networkmanager: upgrade 1.52.0 -> 1.52.2Liu Yiding2025-12-311-2/+2
| | | | | Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* libowfat: update SRC_URIGyorgy Sarvari2025-12-281-1/+1
| | | | | | | | The https link does not work anymore, it just refuses the connection. http still works though. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* ncp: update SRC_URIGyorgy Sarvari2025-12-281-1/+1
| | | | | | | | The https link does not work anymore, it just refuses the connection. http still works though. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* cifs-utils: fix broken PACKAGECONFIGsGyorgy Sarvari2025-12-251-0/+2
| | | | | | | | | | | | | | | | | | | Some PACKAGECONFIGs (cifsidmap, cifsacl, pam) were failing to build since a while, erroring out with: | ../sources/cifs-utils-7.4/resolve_host.c:23:10: fatal error: config.h: No such file or directory | 23 | #include "config.h" | | ^~~~~~~~~~ | compilation terminated. The config.h header is generated in the root of build folder, and it seems that the recipe can't be built 100% out of the source tree. To avoid this issue, add ${B} as an include folder to CFLAGS, so it finds the required header. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* cifs-utils: upgrade 7.0 -> 7.4Gyorgy Sarvari2025-12-251-2/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Contains fix for CVE-2025-2312 The recipe installs two scripts in bindir - this is nothing new. But the shebang has changed from "/usr/bin/env python3" to "/usr/bin/python3" - these were always python scripts, but they weren't recognized as such during the QA checks, and python wasn't installed as a runtime dependency. Now QA check is complaining about missing python in RDEPENDS. To avoid mandatory python installation, package the scripts separately in cifs-utils-scripts package. Shortlog: cifs-utils: bump version to 7.4 mount.cifs: retry mount on -EINPROGRESS cifs.upcall: correctly treat UPTARGET_UNSPECIFIED as UPTARGET_APP cifscreds: use <libgen.h> for basename getcifsacl, setcifsacl: use <libgen.h> for basename cifs.upcall: fix memory leaks in check_service_ticket_exits() cifs-utils: bump version to 7.3 Fix regression in mount.cifs with guest mount option resolve_host.c: Initialize site_name cldap_ping: Fix socket fd leak cifs-utils: bump version to 7.2 getcifsacl: fix return code check for getting full ACL cifs-utils: add documentation for upcall_target cifs-utils: avoid using mktemp when updating mtab cldap_ping.c: add missing <sys/types.h> include configure.ac: libtalloc is now mandatory cifscreds: allow user to set the key's timeout cifscreds: use continue instead of break when matching commands Do not pass passwords with sec=none and sec=krb5 docs: add esize description docs: add max_cached_dirs description docs: update actimeo description Fix compiler warnings in mount.cifs CIFS.upcall to accomodate new namespace mount opt cifs-utils: Skip TGT check if valid service ticket is already available use enums to check password or password2 in set_password, get_password_from_file and minor documentation additions cifs-utils: support and document password2 mount option smbinfo: add bash completion support for filestreaminfo, keys, gettconinfo cifs-utils: bump version to 7.1 cifs: update documentation for sloppy mount option docs: add closetimeo description docs: add compress description checkopts: update it to work with latest kernel version cifs-utils: add documentation for multichannel and max_channels cifs-utils: smbinfo: add gettconinfo command Implement CLDAP Ping to find the closest site mount.cifs.rst: update section about xattr/acl support mount.cifs.rst: add missing reference for sssd getcifsacl, setcifsacl: add missing <endian.h> include for le32toh getcifsacl, setcifsacl: add missing <linux/limits.h> include for XATTR_SIZE_MAX cifs-utils: Make automake treat /sbin as exec, not data pam_cifscreds: fix warning on NULL arg passed to %s in pam_syslog() cifs.upcall: fix UAF in get_cachename_from_process_env() cifs-utils: add documentation for acregmax and acdirmax setcifsacl: Fix uninitialized value. Use explicit "#!/usr/bin/python3" Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nbdkit: upgrade 1.45.15 -> 1.46.0Wang Mingyu2025-12-241-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* memcached: upgrade 1.6.39 -> 1.6.40Wang Mingyu2025-12-241-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* wolfssl: ignore CVE-2025-11931 and CVE-2025-12889Gyorgy Sarvari2025-12-241-0/+3
| | | | | | | | | | | | | | | | | | NVD claims that WolfSSL 5.8.4 is affected by both of these vulnerabilities, however actually both have been fixed in that version. CVE-2025-11931: NVD[1] references [2] PR as a patch, which was merged in [3]. CVE-2025-12889: NVD[4] referenced [5] PR as a patch, which was merged in [6]. [1]: https://nvd.nist.gov/vuln/detail/CVE-2025-11931 [2]: https://github.com/wolfSSL/wolfssl/pull/9223 [3]: https://github.com/wolfSSL/wolfssl/commit/e497d28ae1b364e0136849996b893f55d8a8fd4a [4]: https://nvd.nist.gov/vuln/detail/CVE-2025-12889 [5]: https://github.com/wolfSSL/wolfssl/pull/9395 [6]: https://github.com/wolfSSL/wolfssl/commit/2db1c7a522ba258d841fbce95ab84156669a5a3e Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* tinyproxy: add ptest supportGyorgy Sarvari2025-12-243-1/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It takes <10s to execute. Sample output: root@qemux86-64:~# ptest-runner START: ptest-runner 2025-12-23T17:45 BEGIN: /usr/lib/tinyproxy/ptest starting web server... done (listening on 127.0.0.3:32123) starting tinyproxy... done (listening on 127.0.0.2:12321) waiting for 1 seconds.. done checking direct connection to web server... ok testing connection through tinyproxy... ok requesting statspage via stathost url... ok signaling tinyproxy to reload config...ok checking direct connection to web server... ok testing connection through tinyproxy... ok requesting statspage via stathost url... ok checking bogus request... ok, got expected error code 400 testing connection to filtered domain... ok, got expected error code 403 requesting connect method to denied port... ok, got expected error code 403 testing unavailable backend... ok, got expected error code 502 0 errors killing tinyproxy... ok killing webserver... ok done PASS: run_tests.sh DURATION: 1 END: /usr/lib/tinyproxy/ptest 2025-12-23T17:45 STOP: ptest-runner TOTAL: 1 FAIL: 0 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* tinyproxy: patch CVE-2025-63938Gyorgy Sarvari2025-12-242-0/+44
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-63938 Pick the patch referenced by the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* net-snmp: upgrade 5.9.4 -> 5.9.5Liu Yiding2025-12-237-591/+1
| | | | | | | | | | | | | | 1.Drop following patches as they were merged upstream. 0001-Android-Fix-the-build.patch 0012-Fix-configuration-of-NETSNMP_FD_MASK_TYPE.patch net-snmp-5.9.4-kernel-6.7.patch 0008-net-snmp-fix-engineBoots-value-on-SIGHUP.patch 0001-Fix-LDFLAGS-vs-LIBS-ordering.patch 2.Drop 0005-snmplib-keytools.c-Don-t-check-for-return-from-EVP_M.patch as compile error has been fixed. Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* dovecot: upgrade 2.4.1-4 -> 2.4.2Gyorgy Sarvari2025-12-223-30/+28
| | | | | | | | | Contains fix for CVE-2025-30189 Changelog: https://github.com/dovecot/core/releases/tag/2.4.2 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* strongswan: upgrade 6.0.3 -> 6.0.4Wang Mingyu2025-12-211-1/+1
| | | | | | | | | | | | | Changelog: ========== - Fixed a vulnerability in the NetworkManager plugin charon-nm that potentially allows using credentials of other local users. - Concurrent requests to fetch the same CRL URI by multiple threads are now combined. - Increased the max. supported length for section names in swanctl.conf to 256. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* fetchmail: upgrade 6.5.2 -> 6.6.2Gyorgy Sarvari2025-12-201-2/+2
| | | | | | | | | | | Contains fix for CVE-2025-61962. License-Update: added a warning about linking against the newly relicensed WolfSSL. Changelog: https://gitlab.com/fetchmail/fetchmail/-/blob/6.6.2/NEWS Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* unbound: complete ptest supportGyorgy Sarvari2025-12-163-5/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The recipe had already an almost working ptest config which wasn't enabled, it just needed some small fixes to make it work: correct the output of the run-ptest script, and install some extra testdata. Execution is quick, single digit seconds: root@qemux86-64:/usr/lib/unbound/ptest/tests# ptest-runner START: ptest-runner 2025-12-16T11:53 BEGIN: /usr/lib/unbound/ptest Start of unbound 1.24.2 unit test. test authzone functions test negative cache functions test ub_random functions [...many lines...] PASS: ./testdata/val_unsecds_negcache.rpl PASS: ./testdata/val_unsecds_qtypeds.rpl PASS: ./testdata/val_wild_pos.rpl PASS: ./testdata/version_bind.rpl PASS: ./testdata/version_bind_hide.rpl PASS: ./testdata/views.rpl DURATION: 4 END: /usr/lib/unbound/ptest 2025-12-16T11:53 STOP: ptest-runner TOTAL: 1 FAIL: 0 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* unbound: upgrade 1.22.0 -> 1.24.2Gyorgy Sarvari2025-12-162-52/+2
| | | | | | | | | | | | | | | | Contains fixes for CVE-2025-11411 and CVE-2025-5994. Drop patch that was incorporated in this release. Changelogs: https://github.com/NLnetLabs/unbound/releases/tag/release-1.24.2 https://github.com/NLnetLabs/unbound/releases/tag/release-1.24.1 https://github.com/NLnetLabs/unbound/releases/tag/release-1.24.0 https://github.com/NLnetLabs/unbound/releases/tag/release-1.23.1 https://github.com/NLnetLabs/unbound/releases/tag/release-1.23.0 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* libcoap: ignore CVE-2025-50518Gyorgy Sarvari2025-12-161-0/+2
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-50518 The vulnerability is disputed by upstream, because the vulnerability requires a user error, incorrect library usage. See also an upstream discussion in a related (rejected) PR: https://github.com/obgm/libcoap/pull/1726 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* openvpn: upgrade 2.6.16 -> 2.6.17Gyorgy Sarvari2025-12-161-1/+1
| | | | | | | | | | | | | | Changelog: - Windows/interactive service: fix erroneous exit on error that could be used by a local Windows users to achieve a local denial-of-service (CVE-2025-13751) - Windows/interactive service: improve service pipe robustness against file access races (uuid) and access by unauthorized processes (ACL). upgrade bundled build instruction (vcpkg and patch) for pkcs11-helper to 1.31, fixing a parser bug Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nopoll: Upgrade to 0.4.7.b429Jason Schonberg2025-12-141-2/+1
| | | | | Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* packagegroups: Remove packages not yet ported onto riscv32Khem Raj2025-12-131-0/+2
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* freediameter: Add 600s timeout via ctest driverKhem Raj2025-12-101-2/+2
| | | | | | | | | This helps tests not hitting timeout (120s default) especially testmesg_stress test can timeout on slower machines e.g. fully emulated ( non-kvm ) qemu machines e.g. qemuarm64 on x86_64 machine. Signed-off-by: Khem Raj <raj.khem@gmail.com>
* dante: Add _GNU_SOURCE for musl buildsKhem Raj2025-12-101-0/+2
| | | | | | | This helps build fixes e.g. cpuset_t definitions etc. glibc builds have _GNU_SOURCE defined inherently. Signed-off-by: Khem Raj <raj.khem@gmail.com>
* frr: Upgrade to 10.5.0Khem Raj2025-12-101-4/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Relase Overview: * BFD the ability to listen for specific VRFs only - Configure which VRFs the BFD daemon will listen to. By default, BFD listens to all VRFs present in the system, including the default VRF. Default VRF must be specified as `default`. * BGP SRv6/MPLS coexistence - Allow MPLS and SRv6 to coexist on the same L3VRF, even for a given prefix. This feature is important in brown fields where some operators want to migrate from MPLS to SRv6 backbone. * BGP SRv6 locator per VRF support - Ability to choose SRv6 locator per VRF. * BGP Error handling (RFC 7606) for iBGP peers - Before 10.5.0, once we received a malformed packet between iBGP peers, we always reset the session, and with this release, we handle malformed packets the same way as for eBGP (by withdrawing or discarding the malformed packets). * BGP IPv6 Link-Local Capability is disabled by default - In 10.4.0, this capability was enabled by default for a “datacenter” profile, but it’s disabled for 10.5.0 and will be backported to 10.4.2 as well. The problem arises when the receiver has configured a route-map with `set ipv6 next-hop prefer-global` and we send only an IPv6 Link-Local address; therefore, it was decided to revert it to be disabled by default. * BGP BGPID Next-Hop Characteristic - In some cases, the BGP speaker sending a route might encode only a link-local address and no global address. To provide uniqueness in this case, it is sufficient to associate the BGP Identifier and AS Number of the route's sender. The BGP Identifier Characteristic (BGPID) provides a way to convey this information if required. * BGP EVPN flooding per VNI support - Add an ability to adjust BUM flooding per VNI, instead of just globally. E.g., disable flooding only for an arbitrary VNI. * BGP RPKI strict mode - RPKI strict mode prevents BGP from establishing a session if no RPKI cache server is connected. * BGP rejects AS_SET by default** - Until 10.5.0, it was disabled by default, and since RFC 9774 was published, we switched this on by default (to reject). * BGP has lots of improvements for Graceful-Restart** * PIM/PIMv6 route-map support to allow users to filter IGMP/MLD joins using source, group, and interface combinations * Support for multiple SRv6 locators - This extends the SRv6 SID Manager to add support for multiple locators. * Zebra 16-bit next hop weights support - The weights used in ECMP’s consistent hashing have been widened from 8 bits to 16 bits since the 6.12 Linux kernel. Signed-off-by: Khem Raj <raj.khem@gmail.com>
* wolfssl: upgrade 5.8.0 -> 5.8.4Gyorgy Sarvari2025-12-102-796/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | License-Update: the project was relicensed from GPL-2 to GPL-3 Inludes fixes for the following vulnerabilities: CVE-2025-7394, CVE-2025-7395, CVE-2025-7396, CVE-2025-12888, CVE-2025-11936, CVE-2025-11935, CVE-2025-11934, CVE-2025-11933, CVE-2025-11932, CVE-2025-11931, CVE-2025-12889 Drop patch that is incorporated in this release. Changelog: https://github.com/wolfSSL/wolfssl/blob/master/ChangeLog.md Ptests passed: START: ptest-runner 2025-12-09T18:23 BEGIN: /usr/lib/wolfssl/ptest Wolfssl ptest logs are stored in /tmp/wolfss_temp.6rsnys/ptest.log Test script returned: 0 unit_test: Success for all configured tests. PASS: Wolfssl DURATION: 13 END: /usr/lib/wolfssl/ptest 2025-12-09T18:23 STOP: ptest-runner TOTAL: 1 FAIL: 0 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* dante: upgrade 1.4.3 -> 1.4.4Gyorgy Sarvari2025-12-101-2/+2
| | | | | | | | | | | | | | | | | License-Update: copyright year bump Changelog: - Fix potential security issue CVE-2024-54662, related to "socksmethod" use in client/hostid-rules. - Add a missing call to setgroups(2). - Patch to fix compilation with libminiupnp 2.2.8. - Client connectchild optimizations. - Client SIGIO handling improvements. - Various configure/build fixes. - Updated to support TCP_EXP1 version of TCP hostid format. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* civetweb: ignore CVE-2025-9648Gyorgy Sarvari2025-12-101-1/+2
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-9648 It is already fixed in the currently used version. Also, update CVE-2025-55763's status to "fixed-version" (so it will be marked as "Patched" in the CVE report instead of "Ignored") Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nftables: upgrade 1.1.5 -> 1.1.6Wang Mingyu2025-12-092-37/+1
| | | | | | | | 0001-fix-typo-in-test-script.patch removed since it's included in 1.1.6 Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* openfortivpn: upgrade 1.23.1 -> 1.24.0Wang Mingyu2025-12-091-2/+2
| | | | | | | | | | | | | | | | | | | Changelog: =========== - add OpenSSL 3.0+ PKCS#11 support using OSSL_STORE API - add OpenSSL Engine support (with OpenSSL < 3.0) - update package links for distros in README - remove deprecated option --plugin - increase the maximum size of the proxy response - route: always remove wrong pppd route to self - fix several Coverity warnings - fix a memory leak in new ipv4_drop_wrong_route method - HTTP: fixes missing '\0' in debug - IO: fixes a RC use after free - SSL: Avoid leaking SSL context Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nbdkit: upgrade 1.45.14 -> 1.45.15Wang Mingyu2025-12-091-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* libnftnl: upgrade 1.3.0 -> 1.3.1Wang Mingyu2025-12-091-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* ufw: upgrade 0.36.1 -> 0.36.2Liu Yiding2025-12-081-2/+2
| | | | | Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* openipmi: Pass BUILD_CFLAGS to BUILD_CCMingli Yu2025-12-052-0/+36
| | | | | | | | | | | | | | | | | * The option -fcanon-prefix-map is added to CFLAGS after the commit [1] introduced and result in the below build error. Making all in sdrcomp make[3]: Entering directory '/tmp/work/cortexa57-wrs-linux/openipmi/2.0.37/sources/OpenIPMI-2.0.37/lanserv/sdrcomp' aarch64-wrs-linux-gcc -mcpu=cortex-a57+crc -mbranch-protection=standard -fstack-protector-strong -O2 -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security --sysroot=/tmp/work/cortexa57-wrs-linux/openipmi/2.0.37/recipe-sysroot -DHAVE_CONFIG_H -I. -I../.. -DSTATEDIR='"/var"' -Wall -Wsign-compare -I../../include -I../../lanserv -I../../utils -O2 -g -fcanon-prefix-map -ffile-prefix-map=/tmp/work/cortexa57-wrs-linux/openipmi/2.0.37/sources/OpenIPMI-2.0.37=/usr/src/debug/openipmi/2.0.37 -ffile-prefix-map=/tmp/work/cortexa57-wrs-linux/openipmi/2.0.37/sources/OpenIPMI-2.0.37=/usr/src/debug/openipmi/2.0.37 -ffile-prefix-map=/tmp/work/cortexa57-wrs-linux/openipmi/2.0.37/recipe-sysroot= -ffile-prefix-map=/tmp/work/cortexa57-wrs-linux/openipmi/2.0.37/recipe-sysroot-native= -pipe -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -c -o sdrcomp.o sdrcomp.c gcc -o sdrcomp_build ../../lanserv/sdrcomp/sdrcomp.c -O2 -g -fcanon-prefix-map -ffile-prefix-map=/tmp/work/cortexa57-wrs-linux/openipmi/2.0.37/sources/OpenIPMI-2.0.37=/usr/src/debug/openipmi/2.0.37 -ffile-prefix-map=/tmp/work/cortexa57-wrs-linux/openipmi/2.0.37/sources/OpenIPMI-2.0.37=/usr/src/debug/openipmi/2.0.37 -ffile-prefix-map=/tmp/work/cortexa57-wrs-linux/openipmi/2.0.37/recipe-sysroot= -ffile-prefix-map=/tmp/work/cortexa57-wrs-linux/openipmi/2.0.37/recipe-sysroot-native= -pipe -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -Wall -Wsign-compare -I../../include -I../../lanserv -I../../utils -lm gcc: error: unrecognized command-line option ‘-fcanon-prefix-map’; did you mean ‘-fmacro-prefix-map=’? * Pass BUILD_CFLAGS for BUILD_CC to fix the above build issue. [1] https://git.openembedded.org/openembedded-core/commit/?id=3dbc4a79f01ebfc54da024c1460c06772659088d Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-09-02 22:43:12 +0000