linux/poky.git/meta/recipes-connectivity, branch krogoth

wpa_supplicant: fix WPA2 key replay security bug

2017-10-16T22:47:12+00:00

WPA2 is vulnerable to replay attacks which result in unauthenticated users having access to the network. * CVE-2017-13077: reinstallation of the pairwise key in the Four-way handshake * CVE-2017-13078: reinstallation of the group key in the Four-way handshake * CVE-2017-13079: reinstallation of the integrity group key in the Four-way handshake * CVE-2017-13080: reinstallation of the group key in the Group Key handshake * CVE-2017-13081: reinstallation of the integrity group key in the Group Key handshake * CVE-2017-13082: accepting a retransmitted Fast BSS Transition Reassociation Request and reinstalling the pairwise key while processing it * CVE-2017-13086: reinstallation of the Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) key in the TDLS handshake * CVE-2017-13087: reinstallation of the group key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame * CVE-2017-13088: reinstallation of the integrity group key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame Backport patches from upstream to resolve these CVEs. (From OE-Core rev: bfa04fa71c47e8fe9528208848cfcec2e232777d) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

openssl.inc: avoid random ptest failures

2017-05-18T12:14:22+00:00

"make alltests" is sensitive to the timestamps of the installed files. Depending on the order in which cp copies files, .o and/or executables may end up with time stamps older than the source files. Running tests then triggers recompilation attempts, which typically will fail because dev tools and files are not installed. "cp -a" is not enough because the files also have to be newer than the installed header files. Setting the file time stamps to the current time explicitly after copying solves the problem because do_install_ptest_base is guaranteed to run after do_install. (From OE-Core rev: 101e2a5e0b7822ca3de3d3a73369405c05ab3c5b) (From OE-Core rev: b309bfa265456cda7269ff67e9df5f5c05a9a5a5) Signed-off-by: Patrick Ohly Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

openssl: fix do_configure error when cwd is not in @INC

2017-05-18T12:14:22+00:00

Fixed when building on Debian-testing: | Can't locate find.pl in @INC (@INC contains: /etc/perl /usr/local/lib/x86_64-linux-gnu/perl/5.22.2 /usr/local/share/perl/5.22.2 /usr/lib/x86_64-linux-gnu/perl5/5.22 /usr/share/perl5 /usr/lib/x86_64-linux-gnu/perl/5.22 /usr/share/perl/5.22 /usr/local/lib/site_perl /usr/lib/x86_64-linux-gnu/perl-base) at perlpath.pl line 7. (From OE-Core rev: c28065671b582c140d5971c73791d2ac8bdebe69) (From OE-Core rev: d0500320747608783b41f0035bf962b877a6a1c0) Signed-off-by: Robert Yang Signed-off-by: Ross Burton Signed-off-by: Richard Purdie fixed merge conflict Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

openssl: Security fix CVE-2016-2177

2017-05-18T12:14:22+00:00

Affects openssl <= 1.0.2h CVSS v2 Base Score: 7.5 HIGH (From OE-Core rev: 2848c7d3e454cbc84cba9183f23ccdf3e9200ec9) (From OE-Core rev: 217d245bdb7b19f92fa5f6f93c371094353d6da6) Signed-off-by: Armin Kuster Signed-off-by: Ross Burton Signed-off-by: Richard Purdie fixed merge conflicts Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

openssl: prevent warnings from openssl-c_rehash.sh

2017-05-18T12:14:22+00:00

The openssl-c_rehash.sh script reports duplicate files and files which don't contain a certificate or CRL by echoing a WARNING to stdout. This warning gets picked up by the log checker during rootfs and results in several warnings getting reported to the console during an image build. To prevent the log from being overrun by warnings related to certificates change these messages in openssl-c_rehash.sh to be prefixed with NOTE not WARNING. (From OE-Core rev: 88c25318db9f8091719b317bacd636b03d50a411) (From OE-Core rev: c270ebf9235c5414de1bf80ff40253f5a98dca2a) Signed-off-by: Joshua Lock Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

openssl: Ensure SSL certificates are stored on sysconfdir

2017-05-18T12:14:22+00:00

Debian and other generic distributions has moved the certificates for sysconfdir (/etc/ssl) and made the libdir content to link for it. This provides several advantages specially for read-only rootfs. Another benefit is that it ensures foreign implementations (e.g: BoringSSL, from Chromium, when running with OpenSSL backend for the certificates) to find the content correctly. (From OE-Core rev: 50d63fa346bbb05dafffc0cb55e21e1092272d95) (From OE-Core rev: 735f4528b5046024f118658cda8ee340ff8aa082) Signed-off-by: Otavio Salvador Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

openssl: Add Shell-Script based c_rehash utility

2017-05-18T12:14:22+00:00

The PLD Linux distribution has ported the c_rehash[1] utility from Perl to Shell-Script, allowing it to be shipped by default. 1. https://git.pld-linux.org/?p=packages/openssl.git;a=blob;f=openssl-c_rehash.sh;h=0ea22637ee6dbce845a9e2caf62540aaaf5d0761 The OpenSSL upstream intends[2] to convert the utility for C however did not yet finished the conversion. 2. https://rt.openssl.org/Ticket/Display.html?id=2324 This patch adds this script and thus removed the Perl requirement for it. (From OE-Core rev: cb6150f1a779e356f120d5e45c91fda75789970a) (From OE-Core rev: 9ae6e105bb689faf004f60bb4f9f0ea56e3b8fde) Signed-off-by: Otavio Salvador Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

openssl: fix add missing dependencies building for test directory

2017-05-18T12:14:22+00:00

Regarding the last commit about missing dependencies, another issue was found. The problem was found, while ptest has been built with some set extra settings. It means, when ptest is going to be built, it is necessary to rebuild dependencies for test directory too. (From OE-Core rev: 030142d0410bec85aeacfff6be27d5fed41ce808) (From OE-Core rev: 28419a4e9ad9430e477c1eb7f2a2d1f328bcacaf) Signed-off-by: Andrej Valek Signed-off-by: Pascal Bach Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

openssl: fix add missing `make depend` command before `make` library

2017-05-18T12:14:22+00:00

Settings from EXTRA_OECONF like en/disable no-ssl3, are transferred only into DEPFLAGS. It means that settings have no effect on output files. DEPFLAGS will be transferred into output files with make depend command. https://wiki.openssl.org/index.php/Compilation_and_Installation#Dependencies (From OE-Core rev: e3c251427a305780d3257a011260bd978de273d5) (From OE-Core rev: 11c388226399ec703f4f67ae7cf11c1e4e332710) Signed-off-by: Andrej Valek Signed-off-by: Pascal Bach Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

openssl: Fix MIPS64be and add MIPS64le

2017-05-18T12:14:22+00:00

MIPS64 target was being configured for linux-mips which defaults to MIPS32. Doesn't cause any issue as far as I can see but it would be wiser to use the correct target configuration. Also add MIPS64le configuration which is missing. (From OE-Core rev: 0afec72913bc31d315cba079da317e8b28755ded) (From OE-Core rev: e2b2fbe05fe97a512265d9978011650415e1589a) Signed-off-by: Zubair Lutfullah Kakakhel Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie