Age | Commit message (Collapse) | Author |
|
Changelog:
=========
* Skip to next RRSIG if signature has expired or is in
the future rather than failing immediately.
* Implement signature jitter for dnssec-policy.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Remove 0001-mbim-add-an-optional-TEMP_FAILURE_RETRY-macro-copy.patch as
TEMP_FAILURE_RETRY usage has been removed in upstream commit 765c6655
("treewide: Use L_TFR macro").
Remove 0002-mbim-Fix-build-with-ell-0.39-by-restoring-unlikely-m.patch
as likely()/unlikely() has been removed in upstream commit dbbbebf9
("mbimmodem: Remove usage of likely and unlikely").
Remove the do_configure:prepend() that purges the bundled ell directory,
as it isn't needed when passing --enable-external-ell in EXTRA_OECONF.
Signed-off-by: Martin Hundebøll <martin@geanix.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
GCC-14 unearths this bug which is already fixed upstream so backport it
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Advisory: https://github.com/advisories/GHSA-85xr-ghj6-6m46
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Several recipes have S pointing at a directory that does not exist.
Set S in these cases to somethig valid making the metadata and
recipe behaviour more consistent.
Tweak one of the QA test diff offsets to match the changed recipe.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Where recipes use S = ${WORKDIR}, change them to set UNPACKDIR to
a subdir of WORKDIR and make S point at this instead.
I've chosen not to force S into any standard UNPACKDIR we may pick in
future just so the S = UNPACKDIR case is clearly visible by the
directory naming under WORKDIR as that should aid usability.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Replace references of WORKDIR with UNPACKDIR where it makes sense to do
so in preparation for changing the default value of UNPACKDIR.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
There are potential security issues from using pre-generated host keys. We made
the recipe available for autobuilder testing purposes but concerns remain about
how easily this could end up in production.
I thought we'd already done this, but limit the recipe to qemu* machines,
which means any real hardware trying to use it will need to be a bit more
explicit about it and specifically enable it.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
work arounds for:
oe-core/meta/recipes-bsp/lrzsz/lrzsz_0.12.20.bb:do_compile
oe-core/meta/recipes-connectivity/connman/connman-gnome_0.7.bb:do_compile
oe-core/meta/recipes-support/libfm/libfm_1.3.2.bb:do_compile
http://errors.yoctoproject.org/Errors/Build/183127/
More fixes on ML (especially for -native with gcc-14 on host)
cdrtools: https://lists.openembedded.org/g/openembedded-core/message/198899
syslinux: https://lists.openembedded.org/g/openembedded-core/message/198901
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
OpenSSL 3.3.0 introduced new pkgconfig generators which interact badly
with our incorrect setting of --libdir, which is documented as being
the name of the directory _under $prefix_, not an absolute path. This
resulted in the pkgconfig files have libdir=/usr which mostly works as
the actual library directory is on the search path, but can break other
recipes (such as tpm2-openssl).
Pass the correct value for --libdir, and also remove the odd handling of
an empty ${prefix} which is very historical[1] and can't happen anymore
as all build variations have a prefix.
[1] Added in oe-classic f725a81c, 2009
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
This fixes build with gcc-14, where default visibility is extended to
inline functions and getAll() function now falls into this category
and functions are marked hidden resulting in linking errors
Fixes
/OE/build/oe-core/tmp-glibc/work/core2-64-oe-linux/kea/2.5.8/recipe-sysroot-native/usr/bin/x86_64-oe-linux/../../libexec/x86_64-oe-linux/gcc/x86_64-oe-linux/14.0.1/ld: ./.libs/libdhcp4.a(dhcp4_srv.o): in function `isc::dhcp::Dhcpv4Srv::appendRequestedVendorOptions(isc::dhcp::Dhcpv4Exchange&)':
/usr/src/debug/kea/2.5.8/src/bin/dhcp4/dhcp4_srv.cc:2356:(.text+0xaac2): undefined reference to `isc::dhcp::CfgOption::getAll(unsigned int) const'
/OE/build/oe-core/tmp-glibc/work/core2-64-oe-linux/kea/2.5.8/recipe-sysroot-native/usr/bin/x86_64-oe-linux/../../libexec/x86_64-oe-linux/gcc/x86_64-oe-linux/14.0.1/ld: ./.libs/libdhcp4.a(dhcp4_srv.o): in function `isc::dhcp::OptionDescriptor isc::dhcp::CfgOption::get<unsigned int>(unsigned int const&, unsigned short) const':
/usr/src/debug/kea/2.5.8/src/lib/dhcpsrv/cfg_option.h:609:(.text+0xb288): undefined reference to `isc::dhcp::CfgOption::getAll(unsigned int) const'
/OE/build/oe-core/tmp-glibc/work/core2-64-oe-linux/kea/2.5.8/recipe-sysroot-native/usr/bin/x86_64-oe-linux/../../libexec/x86_64-oe-linux/gcc/x86_64-oe-linux/14.0.1/ld: ./.libs/libdhcp4.a(dhcp4_srv.o): in function `isc::dhcp::Dhcpv4Srv::appendRequestedOptions(isc::dhcp::Dhcpv4Exchange&)':
/usr/src/debug/kea/2.5.8/src/bin/dhcp4/dhcp4_srv.cc:2128:(.text+0xc556): undefined reference to `isc::dhcp::CfgOption::getAll(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) const'
/OE/build/oe-core/tmp-glibc/work/core2-64-oe-linux/kea/2.5.8/recipe-sysroot-native/usr/bin/x86_64-oe-linux/../../libexec/x86_64-oe-linux/gcc/x86_64-oe-linux/14.0.1/ld: ./.libs/libdhcp4.a(dhcp4_srv.o): in function `std::vector<isc::dhcp::OptionDescriptor, std::allocator<isc::dhcp::OptionDescriptor> > isc::dhcp::CfgOption::getList<char [6]>(char const (&) [6], unsigned short) const':
/usr/src/debug/kea/2.5.8/src/lib/dhcpsrv/cfg_option.h:641:(.text._ZNK3isc4dhcp9CfgOption7getListIA6_cEESt6vectorINS0_16OptionDescriptorESaIS5_EERKT_t[_ZNK3isc4dhcp9CfgOption7getListIA6_cEESt6vectorINS0_16OptionDescriptorESaIS5_EERKT_t]+0x86): undefined reference to `isc::dhcp::CfgOption::getAll(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) const'
/OE/build/oe-core/tmp-glibc/work/core2-64-oe-linux/kea/2.5.8/recipe-sysroot-native/usr/bin/x86_64-oe-linux/../../libexec/x86_64-oe-linux/gcc/x86_64-oe-linux/14.0.1/ld: ./.libs/libdhcp4.a(dhcp4_srv.o): in function `isc::dhcp::OptionDescriptor isc::dhcp::CfgOption::get<char [6]>(char const (&) [6], unsigned short) const':
/usr/src/debug/kea/2.5.8/src/lib/dhcpsrv/cfg_option.h:609:(.text._ZNK3isc4dhcp9CfgOption3getIA6_cEENS0_16OptionDescriptorERKT_t[_ZNK3isc4dhcp9CfgOption3getIA6_cEENS0_16OptionDescriptorERKT_t]+0x77): undefined reference to `isc::dhcp::CfgOption::getAll(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) const'
collect2: error: ld returned 1 exit status
make[5]: *** [Makefile:651: kea-dhcp4] Error 1
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Cc: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Since we want to be able to stop unpacking to WORKDIR, correct the WORKDIR
references in recipe do_compile/do_install tasks to use UNPACKDIR in the
appropraite places instead.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Where recipes use S = ${WORKDIR}, ensure they are referencing ${S} correctly
to access files as soon we want to stop doing this in WORKDIR at which point
they would break unless corrected.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
* Release Note *
This is regular release of iproute2 corresponding to the 6.8 kernel.
In addition to the usual round of documentation fixes, many
small changes to ss utility. Most of the work to have full JSON
support in traffic control (TC) is done, only a few leftovers.
Remove support fot ipt and xt in tc.
Signed-off-by: Changhyeok Bae <changhyeok.bae@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
libc-compat.h fix for musl was obsolete after 4.16.0 release of iproute2.
Drop it.
Signed-off-by: Maxin John <maxin.john@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
ppp package has "RSA Data Security" license text in
Message-Digest Algorithm source file ppp-md5.c and ppp-md4.c
Add RSA-MD in LICENSE field for ppp package
Signed-off-by: Poonam Jadhav <poonam.jadhav@kpit.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Quoting 'man systemd.special':
nss-user-lookup.target
A target that should be used as synchronization point for all
regular UNIX user/group name service lookups. [...] All services
for which the availability of the full user/group database is
essential should be ordered after this target, but not pull it
in. All services which provide parts of the user/group database
should be ordered before this target, and pull it in.
When no service providing parts of the user/group database exists and
thus pulls in the nss-user-lookup.target, this added dependency is a
no-op.
However, when such a service does exist, and e.g. modifies /etc/shadow
to change password or enable/disable certain accounts, it is essential
that no ssh connections are accepted until those changes are made.
Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
The patch is reworked to take musl-specific path only if the functions are
undefined by libc (which can be checked via __RES, as explained in
https://www.openwall.com/lists/musl/2020/10/23/16 ).
This should make it more suitable for upstream submission.
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Rather, adjust the sed invocation to do the correct thing directly.
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
CVE-2024-2511.patch
revmoed since it's included in 3.3.0
Changelog:
https://github.com/openssl/openssl/blob/openssl-3.3.0/NEWS.md
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Changelog:
============
- Add RESOLVER.ARPA to the built in empty zones.
- dig/mdig +ednsflags=<non-zero-value> did not re-enable
EDNS if it had been disabled.
- Some invalid ISO 8601 durations were accepted
erroneously.
- Don't return static-stub synthesised NS RRset.
- Fix bug in Depends (keymgr_dep) function.
- Support for the RESINFO record type has been added.
- Cleaned up several minor bugs in the RBTDB dbiterator
implementation.
- Added missing dns_rdataset_disassociate calls in
validator.c:findnsec3proofs.
- Fix incorrectly reported errors when running tests
with `make test` on platforms with older pytest.
- Optimize slabheader placement, so the infrastructure
records are put in the beginning of the slabheader
linked list.
- Improve ARM parental-agents definition.
- Fix the DNS_GETDB_STALEFIRST flag, which was defined
incorrectly in lib/ns/query.c.
- Update ZSK minimum lifetime documentation in ARM, also
depends on signing delay.
- Add workaround to enforce dynamic linker to pull
jemalloc earlier than libc to ensure all memory
allocations are done via jemalloc.
- Changes to "listen-on" statements were ignored on
reconfiguration unless the port or interface address was
changed, making it impossible to change a related
listener transport type. Thanks to Thomas Amgarten.
- Expose the TCP client count in statistics channel.
- Fix a possible crash in 'dig +nssearch +nofail' and
'host -C' commands when one of the name servers returns
SERVFAIL.
- When dnssec-policy is in effect the DNSKEY's TTLs in
the zone where not being updated to match the policy.
This lead to failures when DNSKEYs where updated as the
TTLs mismatched.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Add package for using the bridge tool.
Signed-off-by: Michael Haener <michael.haener@siemens.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
0001-systemd-Add-optional-support-for-systemd-sd_notify.patch
refresh for 9.7p1
Changelog:
============
New features
------------
* ssh(1), sshd(8): add a "global" ChannelTimeout type that watches
all open channels and will close all open channels if there is no
traffic on any of them for the specified interval. This is in
addition to the existing per-channel timeouts added recently.
* All: make DSA key support compile-time optional, defaulting to on.
Bugfixes
--------
* sshd(8): don't append an unnecessary space to the end of subsystem
arguments
* ssh(1): fix the multiplexing "channel proxy" mode, broken when
keystroke timing obfuscation was added.
* ssh(1), sshd(8): fix spurious configuration parsing errors when
options that accept array arguments are overridden
* ssh-agent(1): fix potential spin in signal handler
* Many fixes to manual pages and other documentation
* Greatly improve interop testing against PuTTY.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Changelog:
============
-Create the pruning task in the dns_cache_flush(), so
the cache pruning still works after the flush.
-Improve the TTL-based cleaning by removing the expired
headers from the heap, so they don't block the next
cleaning round and clean more than a single item for
each new addition to the RBTDB.
-Revert change 6319 and decrease lock contention during
RBTDB tree pruning by not cleaning up nodes recursively
within a single prune_tree() call.
-Address use after free in expire_lru_headers.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Patch: https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08
News: https://github.com/openssl/openssl/commit/b7acb6731a96b073d6150465bd090e2052a595c2
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
OpenSSH supports FIDO security keys in both the client
and server. Add an option to support them in oe.
This change requires a new recipe that I've submitted to
meta-openembedded that has not merged yet.
Signed-off-by: Dan McGregor <dan.mcgregor@usask.ca>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
On aarch64, if the processor doesn't have the Crypto instructions then
OpenSSL will fall back onto the "bit-sliced" assembler routines. When
branch protection (BTI) was enabled in OpenSSL these routines were
missed, so if BTI is available libssl will immediately abort when it
enters this assembler.
Backport a patch submitted upstream to add the required call target
annotations so that BTI doesn't believe the code is being exploited.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Fixes [YOCTO #15415]
The new openssh version has an ICE on powerpc64le similar to the one on
mips/mips64[1]. By adding flag "--without-hardening" to "./configure",
compiler option "-fzero-call-used-regs" will be removed when compiling. This
prevents certain functions from triggering the following ICE:
unimplemented: argument 'used' is not supported for '-fzero-call-used-regs' on this target
References
[1] https://git.openembedded.org/openembedded-core/commit/?id=5b290566519a87c563945a033cb49863317ad63d
Signed-off-by: William Lyu <William.Lyu@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Changelog:
============
-Add support for new provision database format.
-Add support for Quectel EG96 modem.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
PEAP client: Update Phase 2 authentication requirements. Also see
https://www.top10vpn.com/research/wifi-vulnerabilities/
Signed-off-by: Claus Stovgaard <claus.stovgaard@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
This is updated in openssl [1] since opensssl 3.2.0-alpha1 onwards
[1] https://github.com/openssl/openssl/commit/b625e21e67666213ffd3ba6b1f2cd8a847ba6b66
Signed-off-by: Xiaotian Wu <wuxiaotian@loongson.cn>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
CVE_STATUS was set for those components, but meanwhile databases are updated
with corrected information, so setting the CVE_STATUS is not needed anymore.
Signed-off-by: Simone Weiß <simone.p.weiss@posteo.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Since be0e796299b0 ("build: ship all config files with
--enable-datafiles") in bluez, installing input.conf and network.conf
has been redundant, as the bluez5 recipe already includes
--enable-datafiles.
Signed-off-by: Emil Kronborg <emil.kronborg@protonmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Changelog:
=========
9.18.24:
- Fix case insensitive setting for isc_ht hashtable.
[GL #4568]
9.18.23:
- Specific DNS answers could cause a denial-of-service
condition due to DNS validation taking a long time.
(CVE-2023-50387) [GL #4424]
- Change 6315 inadvertently introduced regressions that
could cause named to crash. [GL #4234]
- Under some circumstances, the DoT code in client
mode could process more than one message at a time when
that was not expected. That has been fixed. [GL #4487]
9.18.22:
- Limit isc_task_send() overhead for RBTDB tree pruning.
[GL #4383]
- Restore DNS64 state when handling a serve-stale timeout.
(CVE-2023-5679) [GL #4334]
- Specific queries could trigger an assertion check with
nxdomain-redirect enabled. (CVE-2023-5517) [GL #4281]
- Speed up parsing of DNS messages with many different
names. (CVE-2023-4408) [GL #4234]
- Address race conditions in dns_tsigkey_find().
[GL #4182]
- Conversion from NSEC3 signed to NSEC signed could
temporarily put the zone into a state where it was
treated as unsigned until the NSEC chain was built.
Additionally conversion from one set of NSEC3 parameters
to another could also temporarily put the zone into a
state where it was treated as unsigned until the new
NSEC3 chain was built. [GL #1794] [GL #4495]
- Memory leak in zone.c:sign_zone. When named signed a
zone it could leak dst_keys due to a misplaced
'continue'. [GL #4488]
- Log more details about the cause of "not exact" errors.
[GL #4500]
- The wrong time was being used to determine what RRSIGs
where to be generated when dnssec-policy was in use.
[GL #4494]
- The "trust-anchor-telemetry" statement is no longer
marked as experimental. This silences a relevant log
message that was emitted even when the feature was
explicitly disabled. [GL #4497]
- Fix statistics export to use full 64 bit signed numbers
instead of truncating values to unsigned 32 bits.
[GL #4467]
- NetBSD has added 'hmac' to libc which collides with our
use of 'hmac'. [GL #4478]
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Upgrade libuv to pull in the fix for CVE-2024-24806
Changes:
* misc: remove deprecated stalebot file (Jameson Nash)
* build: disable windows asan buildbot (Ben Noordhuis)
* test: don't run tcp_writealot under msan (Ben Noordhuis)
* build,win: remove extraneous -lshell32 (Ben Noordhuis)
* unix: ignore ifaddrs with NULL ifa_addr (Stephen Gallagher)
* unix,win: utility for setting priority for thread (Hao Hu)
* pipe: add back error handling to connect / bind (Jameson Nash)
* test: check if ipv6 link-local traffic is routable (Ben Noordhuis)
* win: remove check for UV_PIPE_NO_TRUNCATE (Jameson Nash)
* linux: disable io_uring on hppa below kernel 6.1.51 (matoro)
* unix,win: fix read past end of pipe name buffer (Ben Noordhuis)
* unix: unbreak macOS < 10.14 (Sergey Fedorov)
* aix: disable ipv6 link local (Abdirahim Musse)
* doc: move cjihrig to emeriti (cjihrig)
* unix: correct pwritev conditional (Bo Anderson)
* test_fs.c: Fix issue on 32-bit systems using btrfs (Stephen Gallagher)
* misc: ignore libuv-release-tool files (Jameson Nash)
* win: honor NoDefaultCurrentDirectoryInExePath env var (Ardi Nugraha)
* idna: fix compilation warning (Saúl Ibarra Corretgé)
* linux: remove HAVE_IFADDRS_H macro (Ben Noordhuis)
* test: skip tcp-write-in-a-row on IBM i (Abdirahim Musse)
* build,win: work around missing uuid.dll on MinGW (Anton Bachin)
* win: stop using deprecated names (Matheus Izvekov)
* unix,win: fix busy loop with zero timeout timers (Matheus Izvekov)
* aix,ibmi: use uv_interface_addresses instead of getifaddrs (Abdirahim
Musse)
* linux: fix bind/connect for abstract sockets (Santiago Gimeno)
* win: replace c99 comments with c89 comments (Trevor Flynn)
* build: add .cache clangd folder to .gitignore (Juan José Arboleda)
* unix: support full TCP keep-alive on Solaris (Andy Pan)
* freebsd: fix F_KINFO file path handling (David Carlier)
* linux: retry fs op if unsupported by io_uring (Santiago Gimeno)
* freebsd: fix build on non-intel archs (David Carlier)
* unix: optimize uv__tcp_keepalive cpp directives (Andy Pan)
* linux: disable io_uring on ppc64 and ppc64le (Brad King)
* doc: add very basic Security Policy document (Santiago Gimeno)
* build: re-enable msvc-asan job on CI (Jameson Nash)
* win/spawn: optionally run executable paths with no file extension
(Brad King)
* win: fix ESRCH implementation (Jameson Nash)
* unix,win: reset the timer queue on stop (Santiago Gimeno)
* fix: always zero-terminate idna output (Ben Noordhuis)
* fix: reject zero-length idna inputs (Ben Noordhuis)
* test: empty strings are not valid IDNA (Santiago Gimeno)
* Merge pull request from GHSA-f74f-cvh7-c6q6 (Ben Noordhuis)
Signed-off-by: Simone Weiß <simone.p.weiss@posteo.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Unfortunately the new openssh version has an ICE on mips. This looks similar to:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104817
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104820
Given how long these have been open, workaround the issue by disabling the compiler
hardening options on mips.
It is likely better to do this than have the open CVEs for everyone
as we can't upgrade.
An example:
| during RTL pass: zero_call_used_regs
| clientloop.c: In function 'client_loop':
| clientloop.c:1699:1: internal compiler error: in int_mode_for_mode, at stor-layout.cc:407
| 1699 | }
| | ^
| 0x14d0acc internal_error(char const*, ...)
| ???:0
| 0x5cf765 fancy_abort(char const*, int, char const*)
| ???:0
| 0x826f1f emit_move_insn_1(rtx_def*, rtx_def*)
| ???:0
| 0x8270c5 emit_move_insn(rtx_def*, rtx_def*)
| ???:0
| 0xb7b994 default_zero_call_used_regs(HARD_REG_SET)
| ???:0
| Please submit a full bug report, with preprocessed source (by using -freport-bug).
| Please include the complete backtrace with any bug report.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
* Relocate Upstream-Status in 0001-regress-banner.sh-log-input-and-output-files-on-erro.patch
so it will not throw an error in AUH
https://www.openssh.com/txt/release-9.6
https://github.com/openssh/openssh-portable/compare/V_9_5_P1...V_9_6_P1
https://nvd.nist.gov/vuln/detail/CVE-2023-48795
https://nvd.nist.gov/vuln/detail/CVE-2023-51384
https://nvd.nist.gov/vuln/detail/CVE-2023-51385
CVE: CVE-2023-48795
CVE: CVE-2023-51384
CVE: CVE-2023-51385
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
libpcap is requirements to other recipes that could be integrated in
a SDK.
Add nativesdk to BBCLASSEXTEND.
Signed-off-by: Clément Péron <peron.clem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
Fixes CVE-2024-0727 and CVE-2023-6237
Removed included patch backports.
New module was implemented in tests and needs to be installed
to successfully pass 04-test_provider.t test.
Release information:
https://github.com/openssl/openssl/blob/openssl-3.2/NEWS.md#major-changes-between-openssl-320-and-openssl-321-30-jan-2024
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Changelog:
==========
-Fix issue with handling SMS submit report sizes.
-Fix issue with handling operator name and ISI modems.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
bind-ensure-searching-for-json-headers-searches-sysr.patch
refreshed for 9.18.21
Changelog:
==========
-Improve LRU cleaning behaviour.
-The "resolver-nonbackoff-tries" and "resolver-retry-interval" options are
deprecated; a warning will be logged if they are used.
-BIND might sometimes crash after startup or re-configuration when one 'tls'
entry is used multiple times to connect to remote servers due to initialisation
attempts from contexts of multiple threads. That has been fixed.
-Dig +yaml will now report "no servers could be reached" also for UDP setup
failure when no other servers or tries are left.
-Recognize escapes when reading the public key from file.
-Dig +yaml will now report "no servers could be reached" on TCP connection
failure as well as for UDP timeouts.
-Deprecate AES-based DNS cookies.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Backport a typo fix RISCV_HAS_ZKND_ZKNE -> RISCV_HAS_ZKND_AND_ZKNE
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
52ae965 bump version to 6.7
ac7e46b update nl80211.h
44686ac iw: allow extra cflags
e2224c7 iw: S1G: add 802.11ah support for link command display
7298198 update nl80211.h
a1c9376 iw: connect: Fix segfault during open authentication
ea706b3 iw: fix attribute size mismatch
cb491fa iw: add more extended capa bits
cf26fc9 iw: Fix EHT rates printing.
f2d9f5b iw: S1G: add list command support for 802.11ah
1bc6ab0 iw: S1G: add parsing for 802.11ah scan IE's
a32046b iw: S1G: add frequency set in kHz and offset options
f5e3b43 util: don't print EHT info if not present
7794573 interface: print links
221875e link: update for MLO
5f64b70 link: fix some formatting
29555e1 iw: scan: set NL80211_SCAN_FLAG_COLOCATED_6GHZ in case of full sched scan
997e5f1 util: add support for 320MHz bandwidth without cf1
81d112f util: add support for 320Mhz bandwidth
de3da80 update nl80211.h
d6fd275 iw: event: fix printf format error
cc660cc iw: add support for retrieving keys
c4743bb iw: info: fix bug reading preambles and bandwidths
82e6fba iw: add cac background command
ad2f2f8 iw: info: print PMSR capabilities
Signed-off-by: Changhyeok Bae <changhyeok.bae@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Add systemd-sshd-socket-mode PACKAGECONFIG option to choose installing
sshd.socket and systemd-sshd-service-mode PACKAGECONFIG option to choose
installing sshd.service.
The systemd-sshd-socket-mode PACKAGECONFIG option is enabled by default
and user can choose the above two PACKAGECONFIG option to customize the
sshd mode.
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|