linux/poky.git/meta/recipes-connectivity, branch pyro-enea

openssh: Atomically generate host keys

2018-03-08T18:31:20+00:00

Generating the host keys atomically prevents power interruptions during the first boot from leaving the key files incomplete, which often prevents users from being able to ssh into the device. [YOCTO #11671] (From OE-Core rev: d532735e608e32ef1f5a7307c344e528e8fa2f01) Signed-off-by: Joshua Watt Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit 43fc3d8e180c168dbe5dd5faa577e69a279bd1bd) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

openssl: Upgrade from 1.0.2k to 1.0.2n

2018-03-04T11:11:58+00:00

Drop patches already applied upstream. Refresh parallel.patch using latest version from master. Remove x86-64 test binaries included in source code for ptest. License-Update: Updated copyright years and a minor wording change (From OE-Core rev: 76020de1afc7f7643bc35de2d49bce6da0c7b879) Signed-off-by: Robert Joslyn Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

portmaper: checkuri fails.

2018-01-07T17:07:57+00:00

ERROR: portmap-6.0-r9 do_checkuri: Fetcher failure for URL: 'http://www.sourcefiles.org/Networking/Tools/Miscellanenous/portmap-6.0.tgz'. URL http://www.sourcefiles.org/Networking/Tools/Miscellanenous/portmap-6.0.tgz doesn't work change to fossies [ Yocto #12453 ] (From OE-Core rev: 1c98acf52b702a2bc39e20c8a27850c830063bb4) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

bluez5: fix out-of-bounds access in SDP server (CVE-2017-1000250)

2018-01-07T17:07:57+00:00

All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests. (From OE-Core rev: d25716ceb3ffcdfcfa54516596bd94bf5c050bac) (From OE-Core rev: c8f4cd337b9cc5c5c3fc40c6a6d8d2394fdc9ea3) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

openssh: Fix key generation with systemd

2017-11-05T22:39:48+00:00

106b59d9 broke SSH host key generation when systemd and a read-only root file system are in use because there isn't a way for systemd to get the optional weak assigment of SYSCONFDIR from /etc/default/sshd and still provide a default value if it is not specified. Instead, move the logic for determining if keys need to be created to a helper script that both the SysV init script and the systemd unit file can reference. This does mean that the systemd unit file can't check for file existence to know if it should start the service, but it wasn't able to do that correctly anyway anymore. This should be a problem since the serivce is only run once per power cycle by systemd, and should exit quickly if the keys already exist (From OE-Core rev: 73f1397d86f33abace089cc9a28e859b47bb7b6c) Signed-off-by: Joshua Watt Signed-off-by: Ross Burton (cherry picked from commit 7e49c5879862253ae1b6a26535d07a2740a95798) Signed-off-by: André Draszik Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

openssh: allow to override OpenSSL HostKeys when read-only-rootfs

2017-11-05T22:39:47+00:00

With these changes it is possible to have a .bbappend that - sets SYSCONFDIR to some persistent storage - modifies SYSCONFDIR/sshd_config to use ssh host keys from the (writable) sysconfdir (From OE-Core rev: 79c7c8342859306750f0af17210a183fdc543caf) Signed-off-by: André Draszik Reviewed-by: Stephane Ayotte Signed-off-by: Ross Burton (cherry picked from commit 106b59d9f96f70d133fa1421091ad280d27a5b6a) Signed-off-by: André Draszik Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

wpa_supplicant: fix WPA2 key replay security bug

2017-10-16T22:47:01+00:00

WPA2 is vulnerable to replay attacks which result in unauthenticated users having access to the network. * CVE-2017-13077: reinstallation of the pairwise key in the Four-way handshake * CVE-2017-13078: reinstallation of the group key in the Four-way handshake * CVE-2017-13079: reinstallation of the integrity group key in the Four-way handshake * CVE-2017-13080: reinstallation of the group key in the Group Key handshake * CVE-2017-13081: reinstallation of the integrity group key in the Group Key handshake * CVE-2017-13082: accepting a retransmitted Fast BSS Transition Reassociation Request and reinstalling the pairwise key while processing it * CVE-2017-13086: reinstallation of the Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) key in the TDLS handshake * CVE-2017-13087: reinstallation of the group key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame * CVE-2017-13088: reinstallation of the integrity group key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame Backport patches from upstream to resolve these CVEs. (From OE-Core rev: 28d2d47f2a4fc3eb649cf58e82bce0525ab0bc74) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

bind: Use correct python interpreter path

2017-08-31T16:57:12+00:00

The scripts currently reference "python33", fix this so they reference python3. The move the python3 likely broke these. (From OE-Core rev: 37a40fead443e211f0947d9d9bf2180d95630485) Signed-off-by: Richard Purdie Signed-off-by: Peter Kjellerstedt Signed-off-by: Richard Purdie

connman: Fix for CVE-2017-12865

2017-08-30T10:12:30+00:00

dnsproxy: Fix crash on malformed DNS response If the response query string is malformed, we might access memory pass the end of "name" variable in parse_response(). [YOCTO #11959] (From OE-Core rev: fb3e30e45eea2042fdb0b667cbc2c79ae3f5a1a9) (From OE-Core rev: cf1099babe7291d6f3f4d30eb503e1736437cfe0) Signed-off-by: Sona Sarmadi Signed-off-by: Richard Purdie Signed-off-by: Sona Sarmadi Conflicts: meta/recipes-connectivity/connman/connman_1.33.bb Signed-off-by: Richard Purdie

wpa-supplicant_2.6.bb: set CVE_PRODUCT to wpa_supplicant

2017-08-29T10:57:28+00:00

It is used in NVD database CVE's like: https://nvd.nist.gov/vuln/detail/CVE-2015-1863 (From OE-Core rev: cabacf6ad5a2511f6eb93259a81ab14279fd96bb) Signed-off-by: Mikko Rapeli Signed-off-by: Ross Burton (cherry picked from commit cc3882ca2fea2c5a8830311eeb7840ae98da9b3c) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie