summaryrefslogtreecommitdiffstats
path: root/meta/recipes-connectivity
Commit message (Collapse)AuthorAgeFilesLines
* openssh: fix CVE-2023-38408Archana Polampalli2023-08-025-0/+912
| | | | | | | | | | | | | | | | | | | | | | The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009. References: https://nvd.nist.gov/vuln/detail/CVE-2023-38408 Upstream patches: https://github.com/openssh/openssh-portable/commit/892506b13654301f69f9545f48213fc210e5c5cc https://github.com/openssh/openssh-portable/commit/1f2731f5d7a8f8a8385c6031667ed29072c0d92a https://github.com/openssh/openssh-portable/commit/29ef8a04866ca14688d5b7fed7b8b9deab851f77 https://github.com/openssh/openssh-portable/commit/099cdf59ce1e72f55d421c8445bf6321b3004755 (From OE-Core rev: 3c01159ab6a843fc922cf779b022c965d4ecd453) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bind : fix CVE-2023-2828 & CVE-2023-2911Hitendra Prajapati2023-07-213-0/+296
| | | | | | | | | | | Backport fixes for: * CVE-2023-2828 - Upstream-Status: Backport from https://gitlab.isc.org/isc-projects/bind9/-/commit/e9d5219fca9f6b819d953990b369d6acfb4e952b * CVE-2023-2911 - Upstream-Status: Backport from https://gitlab.isc.org/isc-projects/bind9/-/commit/240caa32b9cab90a38ab863fd64e6becf5d1393c && https://gitlab.isc.org/isc-projects/bind9/-/commit/ff5bacf17c2451e9d48c78a5ef96ec0c376ff33d (From OE-Core rev: 08810d3fe6988ea821805eca16105b4632335654) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* connman: fix warning by specifying runstatedir at configure timeMarc Ferland2023-07-011-0/+1
| | | | | | | | | | | | | | | | | | | Without this patch, systemd complains on startup with messages similar to: systemd-tmpfiles[128]: /etc/tmpfiles.d/connman_resolvconf.conf:1: Line references path below legacy directory /var/run/, updating /var/run/connman → /run/connman; please update the tmpfiles.d/ drop-in file accordingly. systemd-tmpfiles[172]: /etc/tmpfiles.d/connman_resolvconf.conf:1: Line references path below legacy directory /var/run/, updating /var/run/connman → /run/connman; please update the tmpfiles.d/ drop-in file accordingly. By default, connman will use "/var/run/connman" for runstatedir instead of the now recommended "/run/connman". (From OE-Core rev: 52268f077af4fd21ac93623017160cb474bbef00) Signed-off-by: Marc Ferland <ferlandm@amotus.ca> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 8d17776765a99a4ae327797206ef2a8a735ce87b) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* mobile-broadband-provider-info: upgrade 20221107 -> 20230416Wang Mingyu2023-07-011-2/+2
| | | | | | | | | (From OE-Core rev: 82cffbc90caeff76a8ebb7ff1527b69e21b8a967) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 125f72393c9b6fea02757cdc3a22696945e0f490) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssh: fix CVE-2023-28531Chen Qi2023-06-212-0/+36
| | | | | | | | | Backport patch to fix CVE-2023-28531. (From OE-Core rev: 2da7a711ca396451b10f5d2084532f7ae6f65cbe) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssh: Remove BSD-4-clause contents completely from codebaseRiyaz Khan2023-06-142-0/+985
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Below upstream commit removed BSD-4-Clause from the LICENSE variable, Link: https://git.yoctoproject.org/poky/commit/?id=2c86f586d55d0f6b99053e3e4d14c9ee36fa8aa8 But actually if we check from the source code of the openssh for this version (8.9p1), there are some files (openbsd-compat/libressl-api-compat.c) still affected. As upstream removed this BSD-4-clause license, there are still some files has this license. Below file is affected by this BSD-4-clause contents when the below command is executed grep -rl "All advertising materials mentioning features or use of this software" *|grep -v \.1|grep -v \.5|grep -v \.8 | sort openbsd-compat/libressl-api-compat.c All advertising materials mentioning features or use of this software Reason for backporting is some of the product restrict the BSD-4-Clause usage and the purpose of this commit is to completely remove the BSD-4-Clause license from the openssh. When checked in the master branch, openssh upstream removes the bsd-4 license compeletely from this commit https://github.com/openssh/openssh-portable/commit/7280401bdd77ca54be6867a154cc01e0d72612e0 Hence Backport this commit completely to remove license of BSD-4-clause contents from code. Hunks are refreshed. (From OE-Core rev: 10b9fdce3553a69714de17d3ed5c13c99ec8c460) Signed-off-by: Riyaz Khan <Riyaz.Khan@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: Upgrade 3.0.8 -> 3.0.9Peter Marko2023-06-145-336/+2
| | | | | | | | | | | | | | | | | | | * fix CVEs CVE-2023-1255 and CVE-2023-2650 * drop CVE patches merged upstream * refresh 0001-Configure-do-not-tweak-mips-cflags.patch https://www.openssl.org/news/openssl-3.0-notes.html Major changes between OpenSSL 3.0.8 and OpenSSL 3.0.9 [30 May 2023] * Mitigate for very slow `OBJ_obj2txt()` performance with gigantic OBJECT IDENTIFIER sub-identities. ([CVE-2023-2650]) * Fixed buffer overread in AES-XTS decryption on ARM 64 bit platforms ([CVE-2023-1255]) * Fixed documentation of X509_VERIFY_PARAM_add0_policy() ([CVE-2023-0466]) * Fixed handling of invalid certificate policies in leaf certificates ([CVE-2023-0465]) * Limited the number of nodes created in a policy tree ([CVE-2023-0464]) (From OE-Core rev: 5140fdf3417c7553d3b035d7eafacda139936494) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dhcpcd: use git instead of tarballsAlexander Kanavin2023-05-301-4/+3
| | | | | | | | | | | | | As announced here: https://roy.marples.name/downloads/dhcpcd/ (From OE-Core rev: ceb8e2fd1686d9a8b9be3feb277741f97c4c6c66) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 6e317eaab45da2dea70d1485fdae93cfeea0db1d) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* avahi: fix D-Bus introspectionEero Aaltonen2023-05-301-2/+1
| | | | | | | | | | | | Install and package the D-Bus introspection files. (From OE-Core rev: 45714f9ea8bde1c8047d493667b1a1d808ea7949) Signed-off-by: Eero Aaltonen <eero.aaltonen@vaisala.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit b8183ad25af3bcf23f04dd649b6ef665569fac8c) Signed-off-by: Eero Aaltonen <eero.aaltonen@vaisala.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* connman: fix CVE-2023-28488 DoS in client.cHitendra Prajapati2023-05-102-0/+61
| | | | | | | | | Upstream-Status: Backport from https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=99e2c16ea1cced34a5dc450d76287a1c3e762138 (From OE-Core rev: 7a5d78de47cdd79bcb1b0e62a65e10705d59a7d9) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: Move microblaze to linux-latomic configMark Hatle2023-04-191-2/+2
| | | | | | | | | | | | | | | When building with the previous a number of atomic functions come back as undefined. Switching to linux-latomic fixes this. (From OE-Core rev: 88d5bf78ffb1d120df48139b1ed3c2e3fa8310d0) (From OE-Core rev: 26b4db753c4f2080a132fb176b514efafa3ff8e3) Signed-off-by: Mark Hatle <mark.hatle@kernel.crashing.org> Signed-off-by: Mark Hatle <mark.hatle@amd.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: Security fix for CVE-2023-0464, CVE-2023-0465, CVE-2023-0466Siddharth Doshi2023-04-114-0/+334
| | | | | | | | | | | | | Upstream-Status: - CVE-2023-0464: Backport from [https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=959c59c7a0164117e7f8366466a32bb1f8d77ff1] - CVE-2023-0465: Backport from [https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1dd43e0709fece299b15208f36cc7c76209ba0bb] - CVE-2023-0466: Backport from [https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=51e8a84ce742db0f6c70510d0159dad8f7825908] (From OE-Core rev: 699ed495ee65991bf4ab286070d72109e72b1f81) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dhcpcd: Fix install conflict when enable multilib.Wang Mingyu2023-03-232-0/+47
| | | | | | | | | | | | | | | | | | | | | | | | Error: Transaction test error: file /usr/share/man/man8/dhcpcd.8 conflicts between attempted installs of dhcpcd-doc-9.4.1-r0.cortexa57 and lib32-dhcpcd-doc-9.4.1-r0.armv7ahf_neon The differences between the two files are as follows: @@ -821,7 +821,7 @@ If you always use the same options, put them here. .It Pa /usr/libexec/dhcpcd-run-hooks Bourne shell script that is run to configure or de-configure an interface. -.It Pa /usr/lib64/dhcpcd/dev +.It Pa /usr/lib/dhcpcd/dev Linux .Pa /dev management modules. (From OE-Core rev: 800ea13091216a59e21718fa0fada45b45bdca2c) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 65ca2c4b7349a4f7dcfcc580d926a99c673deb60) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dhcpcd: fix dhcpcd start failure on qemuppc64Xiangyu Chen2023-03-092-0/+35
| | | | | | | | | | | | | Backport patch to fix dhcpcd start failed on qemuppc64. (From OE-Core rev: 4b4f071fd178b4c8208fccf2e218d3945ed224e3) Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a31d658198566de12cdd1aad18776b8da8065787) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: Upgrade 3.0.7 -> 3.0.8Siddharth Doshi2023-03-092-45/+1
| | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL 3.0.8 fixes 1 HIGH level security vulnerability and 7 MODERATE level security vulnerability [1]. Upgrade the recipe to point to 3.0.8. CVE-2022-3996 is reported fixed in 3.0.8, so drop the patch for that as well. [1] https://www.openssl.org/news/vulnerabilities.html CVEs Fixed: https://www.openssl.org/news/secadv/20230207.txt (From OE-Core rev: e356e203a72fc2062b63b0f744b15313e41e2880) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 8461466f63200a0b1c9c247b70fdf5819651544c) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit f5dce7274bfd65c05df932f36a5e43cfc884fd41) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bind: upgrade 9.18.10 -> 9.18.11Alexander Kanavin2023-02-2410-2/+2
| | | | | | | | | | | | | | | | | Stable branch update License-update: copyright years (From OE-Core rev: e9e54549426ccfac2c8da4053754f648e42a6c4a) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 63e8a8952c3d1b3b5c481be6bba52a3f4d65648e) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 54e2de8a589766c9a305c9bd0782afb5353fd109) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ppp: backport fix for CVE-2022-4603Ross Burton2023-02-042-0/+49
| | | | | | | | | | | (From OE-Core rev: 3ce605e701c516ee46b25fe5bdb0b8de9fc2a29d) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d5d787b44b102e3a69e28948326e39f83fc1d98d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: fix CVE-2022-3996 double locking leads to denial of serviceVivek Kumbhar2023-01-262-0/+44
| | | | | | | | (From OE-Core rev: ac5441f0ff6b3c33be2f62d060d9cf03458a51c4) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dhcpcd: backport two patches to fix runtime errorChen Qi2023-01-263-0/+63
| | | | | | | | | | | | | | | | In case of nodistro, dhcpcd gives us 'Bad system call' error and exits. This is because there are syscalls that should be allowed but not in privsep. Backport two patches to fix this issue. (From OE-Core rev: a40acd3741069bb70283581d186e09d1d7df2a7a) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f1e6a0c16d6685096ec9313301aa431e73d02c07) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bind: upgrade 9.18.9 -> 9.18.10Wang Mingyu2023-01-1510-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: ========== The key file IO locks objects would never get deleted from the hashtable due to off-by-one error. ANY responses could sometimes have the wrong TTL. Speed up the named shutdown time by explicitly canceling all recursing ns_client objects for Removing a catalog zone from catalog-zones without also removing the referenced zone could leave a dangling pointer. [GL #3683] nslookup and host were not honoring the selected port in TCP mode. [GL #3721] Deprecate alt-transfer-source, alt-transfer-source-v6 and use-alt-transfer-source. [GL #3694] Move the "final reference detached" log message from dns_zone unit to the DEBUG(1) log level. Fix assertion failure in isc_http API used by statschannel if the read callback would be called on HTTP request that has been already closed. Deduplicate time unit conversion factors. Copy TLS identifier when setting up primaries for catalog member zones. Deprecate 'auto-dnssec'. [GL #3667] The decompression implementation in dns_name_fromwire() is now smaller and faster. [GL #3655] Use the current domain name when checking answers from a dual-stack-server. Ensure 'named-checkconf -z' respects the check-wildcard option when loading a zone. [GL #1905] Deprecate 'coresize', 'datasize', 'files', and 'stacksize' named.conf options. The view's zone table was not locked when it should have been leading to race conditions when external extensions that manipulate the zone table where in use. Some browsers (Firefox) send more than 10 HTTP headers. Bump the number of allowed HTTP headers to 100. [GL #3670] NXDOMAIN cache records are no longer retained in the cache after expiry, even when serve-stale is in use. [GL #3386] (From OE-Core rev: 932546383875692c4cc9e05c75a4be64a6c3f0c7) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 1c093c38e247b522f279f616d16373795a4cdf89) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 410d69c684ba4eb6dd279a40436043259f94b6b9) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: remove RRECOMMENDS to rng-tools for sshd packageXiangyu Chen2023-01-061-9/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It appears that rngd is not needed as of linux-5.6 and later[1] and should not be installed by default since the purpose of rngd is to provide additional trusted sources of entropy. We did some testing on real hardware, the result seems to support that we no longer need rngd by default on kernel v5.6 and later. Testing result as below: 1. observing the crng init stage. the "random: crng init done" always available before fs being mounted. 2. generating random number without rngd. testing command: dd if=/dev/random of=/dev/null status=progress on Marvell CN96xx RDB board, speed almost 20.4 MB/s without block on NXP i.mx6q board, speed almost 31.9 MB/s without block on qemu x86-64, speed almost 2.6MB/s without block 3. using rngtest command without rngd testing command: rngtest -c 1000 </dev/random on Marvell CN96xx RDB board: rngtest: input channel speed: (min=4.340; avg=135.364; max=146.719)Mibits/s rngtest: FIPS tests speed: (min=8.197; avg=69.020; max=72.800)Mibits/s rngtest: Program run time: 418771 microseconds on NXP i.mx6q board: rngtest: input channel speed: (min=96.820; avg=326.769; max=340.598)Mibits/s rngtest: FIPS tests speed: (min=15.090; avg=37.543; max=40.324)Mibits/s rngtest: Program run time: 570229 microseconds on qemu x86-64: rngtest: input channel speed: (min=37.769; avg=101.136; max=136.239)Mibits/s rngtest: FIPS tests speed: (min=10.288; avg=30.682; max=40.155)Mibits/s rngtest: Program run time: 836800 microseconds 4. observing sshd service. using "systemctl disable rng-tools" disable service and reboot system. system boot up normal, sshd service also start in normal time without block. Reference: [1] https://github.com/torvalds/linux/commit/30c08efec8884fb106b8e57094baa51bb4c44e32 (From OE-Core rev: 2ed579aa28194cf671e5d4f4c61dc38d05de4b0c) Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 868dfb46d96a27ec9041cb902fb769330277257d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bind: upgrade 9.18.8 -> 9.18.9Wang Mingyu2022-12-2310-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: =========== Fix a crash that could happen when you change a dnssec-policy zone with NSEC3 to start using inline-signing. [GL #3591] Don't trust a placeholder KEYDATA from the managed-keys zone by adding it into secroots. [GL #2895] Fixed a race condition that could cause a crash in dns_zone_synckeyzone(). [GL #3617] Don't enforce the jemalloc use on NetBSD. [GL #3634] Fix an inheritance bug when setting the port on remote servers in configuration. [GL #3627] Fix a resolver prefetch bug when the record's TTL value is equal to the configured prefetch eligibility value, but the record was erroneously not treated as eligible for prefetching. [GL #3603] Always call dns_adb_endudpfetch() after calling dns_adb_beginudpfetch() for UDP queries in resolver.c, in order to adjust back the quota. [GL #3598] Fix a startup issue on Solaris systems with many (reportedly > 510) CPUs. Thanks to Stacey Marshall from Oracle for deep investigation of the problem. [GL #3563] rpz-ip rules could be ineffective in some scenarios with CD=1 queries. [GL #3247] The RecursClients statistics counter could overflow in certain resolution scenarios. [GL #3584] Less ceremonial UNEXPECTED_ERROR() and FATAL_ERROR() reporting macros. [GL !6914] Fix a couple of bugs in cfg_print_duration(), which could result in generating incomplete duration values when printing the configuration using named-checkconf. [GL !6880] Refactor the isc_httpd implementation used in the statistics channel. [GL !6879] (From OE-Core rev: 38219ac0617eac1969e4535a7dd22bf4c1fa1463) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit e57fe26b3f85ebfabdc8b574caa5c97602e4d771) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dhcpcd: fix to work with systemdChen Qi2022-12-072-0/+83
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, dhcpcd does not work well with systemd. When using dhcpcd to configure network, the /etc/resolv.conf contents are not correct. This issue could easily be reproduced by using 'qemu + slirp' to start a systemd based image and using dhcpcd to configure network. The expected 'nameserver 10.0.2.3' is not in /etc/resolv.conf. The root cause of this problem is that dhcpcd assumes the resolvconf should recognize .protocol suffix[1]. But systemd's resolvconf (which is a symlink to resolvectl) has a limited support for traditional resolvconf interface[2], and "may not work with all clients"[3]. This of cource includes the clients that use the .protocol suffix. The current situation is: 1. systemd is not going to support the .protocol suffix in the foreseeable near future[4]. 2. dhcpcd does not want to merge systemd specific patch and insists systemd needs to consider the .protocol suffix[5][6]. It's a normal thing that people have different opinions. As a build system that supports such combination, however, we do need to come up with a solution to fix this typical integration problem, making dhcpcd and systemd work together. This patch solves this integration problem by relying on dhcpcd's ability to manage its own resolv.conf contents. But instead of letting it to write to /etc/resolv.conf directly, we supply the generated contents to resolvconf. In this way, the resolvconf still stands in the central place and dhcpcd remains a supplier to it. And the /etc/resolv.conf can get the correct contents. With this patch, dhcpcd could work with both sysvinit and systemd. [1] https://man.archlinux.org/man/resolvconf.8.en [2] https://man.archlinux.org/man/resolvectl.1#COMPATIBILITY_WITH_RESOLVCONF(8) [3] https://wiki.archlinux.org/title/systemd-resolved [4] https://github.com/systemd/systemd/issues/25032 [5] https://github.com/NetworkConfiguration/dhcpcd/pull/152 [6] https://github.com/NetworkConfiguration/dhcpcd/issues/146 (From OE-Core rev: 26c1338f5ad73488d80cdb97ae2efbf0652ee1ac) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 935ae419f51d911c73f5dc7b4a2e5e9a7b206985) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* resolvconf: make it workChen Qi2022-12-072-4/+42
| | | | | | | | | | | | | | | | | | | | | | | | The current resolvconf does not work. Make it work with the following changes. 1. Install normalize-resolvconf, which is used by resolvconf. 2. Add dependencies: sed, util-linux-flock. util-linux-flock is needed by our busybox does not support '-w' by default. sed is needed because we want to avoid package QA issue complaining sed is needed by no one provides it. 3. Add a patch to replace 'readlink -m' with 'readlink -l'. This could avoid the runtime dependency on coreutils. The replacement is safe as /etc always exits in OE's system. 4. Remove allarch inheritage. This is because the above RDEPENDS change does not allow this any more. test_sstate_allarch_samesigs would fail if we don't do this. (From OE-Core rev: 66d85b2d841e6d3281f47ef9a39aa5483aad35d0) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 1b0581fd241cc9de2feda896aefbf055dc0099dc) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* mobile-broadband-provider-info: upgrade 20220725 -> 20221107Wang Mingyu2022-12-011-2/+2
| | | | | | | | | | (From OE-Core rev: d9c986703568e115df7ce87b548879d1d732116f) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 7e12fa1e6250fc358ba159a6b626458d871f7ccf) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libuv: fixup SRC_URIKai Kang2022-11-241-1/+1
| | | | | | | | | | | | | | Add the trailing '.git' to git repo uri in SRC_URI then it could share source code repo on premirror with grpc which uses libuv as a git submodule with fixed revision. (From OE-Core rev: 8e5d2044ff27b54a8013fbf2ecf1cccd2cf76871) Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit cecdf616e7cf192cdc723a446be1d14c197c980d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bluez5: Point hciattach bcm43xx firmware search path to /lib/firmwareMarek Vasut2022-11-241-0/+2
| | | | | | | | | | | | | | | Currently the hciattach bcm43xx firmware loader looks up the firmware blob in /etc/firmware . Change this to /lib/firmware instead, so that the path is consistent with Linux kernel which also looks up firmware for the WiFi part in /lib/firmware . (From OE-Core rev: 67f6fe7d2cfb95c9a39a0d288daabf69babf6f17) Signed-off-by: Marek Vasut <marex@denx.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 72b3b79ad8b980e8dd9470d16b72c2c70072bbc0) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kea: submit patch upstreamAlexander Kanavin2022-11-241-1/+1
| | | | | | | | | | | (From OE-Core rev: aba10f1c085110bd7c17e671aad23c3694980e52) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e8f0e3a01262ecb83185ec5e84e6f359d7d64d1d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* socat: upgrade 1.7.4.3 -> 1.7.4.4Wang Mingyu2022-11-242-39/+2
| | | | | | | | | | | | | | | 1.7.4.4 is a bug fix release 0001-configure.ac-check-getprotobynumber_r-with-AC_TRY_LI.patch removed since it's included in 1.7.4.4 (From OE-Core rev: 42942e565870bd4d0753e0dc7bed9277a71bccf9) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit c00e9d66f0b8449ff1bf24546f232345eb6feebd) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bind: upgrade 9.18.7 -> 9.18.8Wang Mingyu2022-11-2410-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: https://gitlab.isc.org/isc-projects/bind9/-/blob/v9_18_8/CHANGES --- 9.18.7 released --- 5962. [security] Fix memory leak in EdDSA verify processing. (CVE-2022-38178) [GL #3487] 5960. [security] Fix serve-stale crash that could happen when stale-answer-client-timeout was set to 0 and there was a stale CNAME in the cache for an incoming query. (CVE-2022-3080) [GL #3517] 5959. [security] Fix memory leaks in the DH code when using OpenSSL 3.0.0 and later versions. The openssldh_compare(), openssldh_paramcompare(), and openssldh_todns() functions were affected. (CVE-2022-2906) [GL #3491] 5958. [security] When an HTTP connection was reused to get statistics from the stats channel, and zlib compression was in use, each successive response sent larger and larger blocks of memory, potentially reading past the end of the allocated buffer. (CVE-2022-2881) [GL #3493] 5957. [security] Prevent excessive resource use while processing large delegations. (CVE-2022-2795) [GL #3394] 5956. [func] Make RRL code treat all QNAMEs that are subject to wildcard processing within a given zone as the same name. [GL #3459] 5955. [port] The libxml2 library has deprecated the usage of xmlInitThreads() and xmlCleanupThreads() functions. Use xmlInitParser() and xmlCleanupParser() instead. [GL #3518] 5954. [func] Fallback to IDNA2003 processing in dig when IDNA2008 conversion fails. [GL #3485] 5953. [bug] Fix a crash on shutdown in delete_trace_entry(). Add mctx attach/detach pair to make sure that the memory context used by a memory pool is not destroyed before the memory pool itself. [GL #3515] 5952. [bug] Use quotes around address strings in YAML output. [GL #3511] 5951. [bug] In some cases, the dnstap query_message field was erroneously set when logging response messages. [GL #3501] 5948. [bug] Fix nsec3.c:dns_nsec3_activex() function, add a missing dns_db_detachnode() call. [GL #3500] 5947. [func] Change dnssec-policy to allow graceful transition from an NSEC only zone to NSEC3. [GL #3486] 5946. [bug] Fix statistics channel's handling of multiple HTTP requests in a single connection which have non-empty request bodies. [GL #3463] 5945. [bug] If parsing /etc/bind.key failed, delv could assert when trying to parse the built in trust anchors as the parser hadn't been reset. [GL !6468] 5944. [bug] Fix +http-plain-get and +http-plain-post options support in dig. Thanks to Marco Davids at SIDN for reporting the problem. [GL !6672] 5942. [bug] Fix tkey.c:buildquery() function's error handling by adding the missing cleanup code. [GL #3492] 5941. [func] Zones with dnssec-policy now require dynamic DNS or inline-siging to be configured explicitly. [GL #3381] 5938. [bug] An integer type overflow could cause an assertion failure when freeing memory. [GL #3483] 5936. [bug] Don't enable serve-stale for lookups that error because it is a duplicate query or a query that would be dropped. [GL #2982] 5935. [bug] Fix DiG lookup reference counting bug, which could be observed in NSSEARCH mode. [GL #3478] (From OE-Core rev: ed4a32b9c6e25b09a2aa4eb0446bf0ea9ed37ca9) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 1d87d2652f7f6640dda85e037c580c83f99a8ba8) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bluez5: add dbus to RDEPENDSBartosz Golaszewski2022-11-091-0/+1
| | | | | | | | | | | | | | | Unless we're using systemd, dbus is not pulled into the system automatically. Bluez5 will not work without dbus so add it to RDEPENDS explicitly. (From OE-Core rev: eba53bb6663222d47e14d26a5f22d26ba198f019) Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 377ef7009a8638efe688b6b61f67ae399eb1f23d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: Upgrade 3.0.5 -> 3.0.7Ed Tanous2022-11-042-57/+1
| | | | | | | | | | | | | | | | | | | | | | OpenSSL 3.0.5 includes a HIGH level security vulnerability [1]. Upgrade the recipe to point to 3.0.7. CVE-2022-3358 is reported fixed in 3.0.6, so drop the patch for that as well. [1] https://www.openssl.org/news/vulnerabilities.html Fixes CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buffer Overflows https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/ (From OE-Core rev: 78220bd59d98c1713336baf06b4babc6390a07c4) Signed-off-by: Ed Tanous <edtanous@google.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a69ea1f7db96ec8b853573bd581438edd42ad6e0) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: CVE-2022-3358 Using a Custom Cipher with NID_undef may lead to NULL ↵Hitendra Prajapati2022-11-042-0/+56
| | | | | | | | | | | | | | | | | | | encryption Upstream-Status: Backport from https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=5485c56679d7c49b96e8fc8ca708b0b7e7c03c4b] Description: CVE-2022-3358 openssl: Using a Custom Cipher with NID_undef may lead to NULL encryption. Affects "openssl < 3.0.6" (From OE-Core rev: 098e89e89eb58f7d0a6004d4672f3d7365c329dc) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit f98b2273c6f03f8f6029a7a409600ce290817e27) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 08b32d2b35c2ba63774d098af467d1c723b1b6e6) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: Fix SSL_CERT_FILE to match ca-certs locationRichard Purdie2022-11-041-1/+1
| | | | | | | | | | | | | | | | | In OE-Core d6b15d1e70b99185cf245d829ada5b6fb99ec1af, "openssl: export necessary env vars in SDK", the value added for SSL_CERT_FILE was in conflict with the value used elsewhere, such as in buildtools. This makes them match and fixes buildtools testsdk failures. (From OE-Core rev: 850ccc2a303f940f3a13ea6b2581081162f014e4) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 7d383a7fc6da666c80f2fc037af5f49a3388eb2b) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit a9a50f2216951e26b62ed2f86f341d9ad13acf48) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: export necessary env vars in SDKChen Qi2022-11-041-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In current SDK, when running the following command in python shell, we get an error. $ python3 >>> from cryptography.hazmat.backends import openssl The error message is as below: cryptography.exceptions.InternalError: Unknown OpenSSL error. We could set OPENSSL_MODULES explicitly in nativesdk-openssl package so that when SDK is set up, it's in environment and we can get rid of the above error. Also, there are other env vars that need to be exported. And we export all of them to keep sync with openssl-native.bbclass. (From OE-Core rev: f51c9af925ab4cf338ec9ba3e4bebdae25113a3a) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d6b15d1e70b99185cf245d829ada5b6fb99ec1af) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 69030b368773baae65d95e39d3587913b8401bc7) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bind: upgrade 9.18.6 -> 9.18.7Teoh Jay Shen2022-10-1110-1/+1
| | | | | | | | | | | | | | | | | | | | CVE fixed : -CVE-2022-2795 -CVE-2022-2881 -CVE-2022-2906 -CVE-2022-3080 -CVE-2022-38178 Notes for BIND 9.18.7 [https://downloads.isc.org/isc/bind9/9.18.7/doc/arm/html/notes.html#notes-for-bind-9-18-7] (From OE-Core rev: 5b87b79c6bb155d23ad4eab3243118b98a3b5906) (From OE-Core rev: 01710ddade6cf20a5ddbbf9599843e8753baff51) Signed-off-by: Teoh Jay Shen <jay.shen.teoh@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bind: upgrade 9.18.5 -> 9.18.6wangmy2022-10-1110-1/+1
| | | | | | | | | | | | (From OE-Core rev: f7061fc14cbc4388b1fd0cf6233b1a2e743e20e5) (From OE-Core rev: daae4cada71b197a353b7f0446d43f98e17bcbaa) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* inetutils: fix CVE-2022-39028 - remote DoS vulnerability in inetutils-telnetdTeoh Jay Shen2022-09-282-0/+55
| | | | | | | | (From OE-Core rev: 12740b58ce1f700ff271a9891a92de6e04e325f2) Signed-off-by: Teoh Jay Shen <jay.shen.teoh@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bind: upgrade 9.18.4 -> 9.18.5Alexander Kanavin2022-09-0310-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | BIND 9.18 is a stable branch, suitable for production use. Notes for BIND 9.18.5 Feature Changes The dnssec-signzone -H default value has been changed to 0 additional NSEC3 iterations. This change aligns the dnssec-signzone default with the default used by the dnssec-policy feature. At the same time, documentation about NSEC3 has been aligned with the Best Current Practice. [GL #3395] Bug Fixes - An assertion failure caused by a TCP connection closing between a connect (or accept) and a read from a socket has been fixed. [GL #3400] - When grafting non-delegated namespace onto delegated namespace, synth-from-dnssec could incorrectly synthesize non-existence of records within the non-delegated namespace using NSEC records from higher zones. [GL #3402] - Previously, named immediately returned a SERVFAIL response to the client when it received a FORMERR response from an authoritative server during recursive resolution. This has been fixed: named acting as a resolver now attempts to contact other authoritative servers for a given domain when it receives a FORMERR response from one of them. [GL #3152] - Previously, rndc reconfig did not pick up changes to endpoints statements in http blocks. This has been fixed. [GL #3415] - It was possible for a catalog zone consumer to process a catalog zone member zone when there was a configured pre-existing forward-only forward zone with the same name. This has been fixed. [GL #2506] (From OE-Core rev: 75c4b8361ef2d3a39e192ed8318d1038a3ff0999) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 0a419b730ca87daa4e07daf022a550fb4112b9b0) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* mobile-broadband-provider-info: upgrade 20220511 -> 20220725Alexander Kanavin2022-08-281-2/+2
| | | | | | | | | | | (From OE-Core rev: 63b38e57618d6c18c71d1b2b35fb16c63041ddfc) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 96185dac787e14fa9eb77d009653a2fd4d926e3f) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bluez5: update 5.64 -> 5.65Alexander Kanavin2022-08-283-32/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | ver 5.65 changes: Fix issue with A2DP cache invalidation handling. Fix issue with A2DP and not initialized SEP codec. Fix issue with A2DP and multiple SetConfiguration to same SEP Fix issue with AVRCP and not properly initialized volume. Fix issue with SDP records when operating in LE only mode. Fix issue with HoG and not reading report map of instances. Fix issue with GATT server crashing while disconnecting. Fix issue with not removing connected devices. Fix issue with enabling wake support without RPA Resolution. Fix issue with pairing failed due to the error of Already Paired. Add support for CONFIGURATION_DIRECTORY environment variable. Add support for STATE_DIRECTORY environment variable. Add support for "Bonded" property with Device API. Add experimental support for ISO socket. Drop fix_service.patch as it is merged upstream. (From OE-Core rev: 4fdb3d4e031e22c03d03c6cc7713ec45d7498555) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 10374b5ed4b5550eadacbcd71ae20b751ce5c038) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* connman: Backports for security fixesKhem Raj2022-08-284-0/+355
| | | | | | | | | | | | | Fixes CVE: CVE-2022-32292, CVE-2022-32293 (From OE-Core rev: ea0d6f29d65889adc1d1080c5cd0cff4ae584900) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4b3caa1541d69826c14e010ce3ac1a1ca34f3c62) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Add openssh-sftp-server to openssh RDEPENDSAlex Kiernan2022-08-081-1/+1
| | | | | | | | | | | | | | | OpenSSH 9.0 uses sftp by default as the transport for scp, add in sftp-server so that this works as expected for users, rather than being left with a confusing "scp: Connection closed" message. (From OE-Core rev: c33eb7fb1d1e91a005b22b65d221d4b899ec69dc) Signed-off-by: Alex Kiernan <alexk@zuma.ai> Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit be61b9dac78f0d85c870a0d8304fb4b536ec4bc8) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bind: Remove legacy python3 PACKAGECONFIG codeAlex Kiernan2022-08-041-13/+0
| | | | | | | | | | | | | | | Python support was dropped upstream and removed in 8a9a5885995c ("bind: update 9.16.26 -> 9.18.1"), clean up the remaining pieces of python3 in the recipe. (From OE-Core rev: acda23e0d985049ae83e9516315c33afae763ad9) Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ee4e4eb16a3729dcafad075c42aec1695b8ea15f) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libuv: upgrade 1.44.1 -> 1.44.2Alexander Kanavin2022-08-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | Important bugs fixed loop: better align order-of-events behavior between platforms #3598 zos: fix fs event not fired if the watched file is moved/removed/recreated #3540 win: Fix pipe resource leak if closed during connect (and other bugs) #3611 zos: don't error when killing a zombie process #3625 Regressions fixed macos: avoid posix_spawnp() cwd bug #3597 kqueue: skip EVFILT_PROC events when invalidating events for an fd. #3629 (From OE-Core rev: c785f1d3a7f8ef2c7047fad7a2a483c5ebd658e0) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ccd589604c2d7648dcd3541c61a2b48e692ca258) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bind: upgrade 9.18.3 -> 9.18.4wangmy2022-08-0110-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: ========== [func] Don't try to process DNSSEC-related and ZONEMD records in catz. [GL #3380] [func] Add some more dnssec-policy checks to detect weird policies. [GL #1611] [test] Add new set of unit test macros and move the unit tests under single namespace in /tests/. [GL !6243] [func] Key timing options for 'dnssec-settime' and related utilities now accept "UNSET" times as printed by 'dnssec-settime -p'. [GL #3361] [bug] When the fetches-per-server quota was adjusted because of an authoritative server timing out more or less frequently, it was incorrectly set to 1 rather than the intended value. This has been fixed. [GL #3327] [bug] Only write key files if the dnssec-policy keymgr has changed the metadata. [GL #3302] [func] Key timing options for 'dnssec-keygen' and 'dnssec-settime' now accept times as printed by 'dnssec-settime -p'. [GL !2947] (From OE-Core rev: 5bfb44bff5d296b8fd447acb7bdb29b544bd1c20) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d5a12d549209f01324d03963db96449ee43452eb) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bind: upgrade 9.18.2 -> 9.18.3wangmy2022-08-0110-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: ========== [security] Fix a crash in DNS-over-HTTPS (DoH) code caused by premature TLS stream socket object deletion. (CVE-2022-1183) [GL #3216] [bug] RPZ NSIP and NSDNAME rule processing didn't handle stub and static-stub zones at or above the query name. This has now been addressed. [GL #3232] Fixed a deadlock that could occur if an rndc connection arrived during the shutdown of network interfaces. [GL #3272] Refactor the fctx_done() function to set fctx to NULL after detaching, so that reference counting errors will be easier to avoid. [GL #2969] udp_recv() in dispatch could trigger an INSIST when the callback's result indicated success but the response was canceled in the meantime. [GL #3300] Work around a jemalloc quirk which could trigger an out-of-memory condition in named over time. [GL #3287] If there was a pending negative cache DS entry, validations depending upon it could fail. [GL #3279] dig returned a 0 exit status on UDP connection failure. [GL #3235] Fix an assertion failure when using dig with +nssearch and +tcp options by starting the next query in the send_done() callback (like in the UDP mode) instead of doing that recursively in start_tcp(). Also ensure that queries interrupted while connecting are detached properly. [GL #3144] Don't remove CDS/CDNSKEY DELETE records on zone sign when using 'auto-dnssec maintain;'. [GL #2931] [contrib] Avoid name space collision in dlz modules by prefixing functions with 'dlz_'. [GL !5778] dlz: Add FALLTHROUGH and UNREACHABLE macros. [GL #3306] [func] Add new named command-line option -C to print built-in defaults. [GL #1326] Introduce the concept of broken catalog zones described in the DNS catalog zones draft version 5 document. [GL #3224] Add DNS Extended Errors when stale answers are returned from cache. [GL #2267] Implement support for catalog zones change of ownership (coo) mechanism described in the DNS catalog zones draft version 5 document. [GL #3223] Implement support for catalog zones options new syntax based on catalog zones custom properties with "ext" suffix described in the DNS catalog zones draft version 5 document. [GL #3222] Implement reference counting for TLS contexts and allow reloading of TLS certificates on reconfiguration without destroying the underlying TCP listener sockets for TLS-based DNS transports. [GL #3122] Add support for remote TLS certificates verification, both to BIND and dig, making it possible to implement Strict and Mutual TLS authentication, as described in RFC 9103, Section 9.3. [GL #3163] [cleanup] Remove use of exclusive mode in ns_interfacemgr in favor of rwlocked access to localhost and localnets members of dns_aclenv_t structure. [GL #3229] Remove the task exclusive mode use in ns_clientmgr. [GL #3230] (From OE-Core rev: 1bbedc1c6f9b1d431a7d72b9e8e2871d0fe988f5) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d2ae8b85c71be2e9e332b1ef0a2d3083b30c63e6) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: update 3.0.4 -> 3.0.5Alexander Kanavin2022-07-161-1/+1
| | | | | | | | | | | | | | CVEs fixed: https://www.openssl.org/news/secadv/20220705.txt (From OE-Core rev: 76162757033437507fb7309ce9f41fcaaf996ca9) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 84204dea7dec05e053cce5be0071cd9c1fb4ff6f) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: break dependency on base package for -dev packageSteve Sakoman2022-07-081-0/+5
| | | | | | | | | | Otherwise the SDK fails to build as the main openssh and dropbear packages conflict with each other (From OE-Core rev: f90647e9dd95cfd29b5bdb8d7dcd688a10fc060c) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: Upgrade 3.0.3 -> 3.0.4Richard Purdie2022-07-085-77/+21
| | | | | | | | | | | Includes a fix for CVE-2022-2068. (From OE-Core rev: e5b48730a9916eeda37c34d6d2b41c903a3dcdeb) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f034faebd45e63385849078e6ee4b51257763e99) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-28 20:12:30 +0000