linux/poky.git/meta/recipes-connectivity, branch yocto-2.5

openssh: disable ciphers not supported by OpenSSL DES

2018-04-20T07:12:16+00:00

While compiling openssl with option `no-des', it caused the openssh build failure ... cipher.c:85:41: error: 'EVP_des_ede3_cbc' undeclared here (not in a function); ... OpenSSL configured that way defines OPENSSL_NO_DES to disable des (From OE-Core rev: 08a5cda85594fca8b352841a26131bfac39c8417) Signed-off-by: Hongxu Jia Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

dhcp: Security Advisory - CVE-2017-3144

2018-04-13T15:58:07+00:00

Fix CVE-2017-3144 References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3144 https://kb.isc.org/article/AA-01541 Patch from: https://source.isc.org/cgi-bin/gitweb.cgi?p=dhcp.git;a=commitdiff;h=5097bc0559f592683faac1f67bf350e1bddf6ed4 (From OE-Core rev: bcbe9025560dee658c0ead566384e1a8647cebf9) Signed-off-by: Yue Tao Signed-off-by: Mingli Yu Signed-off-by: Yi Zhao Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

openssl: update 1.1.0g -> 1.1.0h

2018-03-29T23:31:18+00:00

Please see this security advisory: https://www.openssl.org/news/secadv/20180327.txt Remove 0001-Remove-test-that-requires-running-as-non-root.patch (issue fixed upstream) Remove 0001-aes-asm-aes-armv4-bsaes-armv7-.pl-make-it-work-with-.patch (backport) License-Update: copyright years (From OE-Core rev: 96d5e9c186fb83f1b5d9b38ace0b1222c3c04c54) Signed-off-by: Alexander Kanavin Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

openssl: update 1.0.2n -> 1.0.2o

2018-03-29T23:31:18+00:00

Please see this security advisory: https://www.openssl.org/news/secadv/20180327.txt License-Update: copyright years (From OE-Core rev: 13542282e34c078296c46a98721b31ed9a69a980) Signed-off-by: Alexander Kanavin Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

openssl: fix libdir logic to allow multiarch style paths

2018-03-15T13:27:19+00:00

The recipes were using 'basename' to turn '/usr/lib' into 'lib', which breaks when libdir is '/usr/lib/tuple', leading to libraries ending up in '/usr/tuple', which isn't in FILES_*. Change the logic to use sed to strip the prefix instead. (From OE-Core rev: e58d5521c7bae8daafdac85754545be176550a02) Signed-off-by: Koen Kooi Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

meta: remove some EXCLUDE_FROM_WORLD assignments

2018-03-15T13:27:19+00:00

Now that we have recipe-specific-sysroots we don't need to exclude recipes from world builds because they conflict with other recipes, as they'll all be built with their own sysroots. (From OE-Core rev: b2f3ac4d994a1921791f6bd0cdb3591586733694) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

iproute2: fix rebuild failures

2018-03-15T13:27:19+00:00

When rebuilding iproute2, many such instances of the following build failure occur: | make[1]: Entering directory '.../iproute2/4.14.1-r0/iproute2-4.14.1/lib' | Makefile:1: ../config.mk: No such file or directory | make[1]: *** No rule to make target '../config.mk'. Stop. (From OE-Core rev: f2e56f6e0da27c70781e51b5486ca6c731013f1c) Signed-off-by: Trevor Woerner Signed-off-by: Richard Purdie

openssl_1.0.2n: improve reproducibility

2018-03-15T13:27:18+00:00

Improve reproducible build of: openssl-staticdev openssl-dbg libcrypto There are two main causes that prevent reproducible build, both related to the generated file "buildinf.h": 1. "buildinf.h" contains build host CFLAGS, containing various build host references. We need to pass sanitized CFLAGS to the script generating this file ("mkbuildinf.pl". ) 2. We also need to modify the script "mkbuildinf.pl" itsel in order to generate a build timestamp based on SOURCE_DATE_EPOCH, if present in the environment. (From OE-Core rev: 6c556ed3553d8f5e75d65cd7db92b26df43846b7) Signed-off-by: Juro Bystricky Signed-off-by: Richard Purdie

openssl: drop openssl-1.0.2a-x32-asm.patch

2018-03-11T13:27:00+00:00

The patch was applied in a completely incorrect spot (due to fuzz), no one noticed or complained. Meanwhile upstream says the issue has been resolved differently: https://rt.openssl.org/Ticket/Display.html?id=3759&user=guest&pass=guest (From OE-Core rev: 325e516b59e677dc8e2c5756589fa8037b3e9392) Signed-off-by: Alexander Kanavin Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

openssl: refresh patches

2018-03-11T13:27:00+00:00

The patch tool will apply patches by default with "fuzz", which is where if the hunk context isn't present but what is there is close enough, it will force the patch in. Whilst this is useful when there's just whitespace changes, when applied to source it is possible for a patch applied with fuzz to produce broken code which still compiles (see #10450). This is obviously bad. We'd like to eventually have do_patch() rejecting any fuzz on these grounds. For that to be realistic the existing patches with fuzz need to be rebased and reviewed. (From OE-Core rev: 7baba7a19c5610a63ccbfd6a2238667772b32118) Signed-off-by: Ross Burton Signed-off-by: Alexander Kanavin Signed-off-by: Ross Burton Signed-off-by: Richard Purdie