summaryrefslogtreecommitdiffstats
path: root/meta/recipes-connectivity
AgeCommit message (Collapse)Author
2020-05-17openssl: upgrade 1.1.1f -> 1.1.1gJan Luebbe
This also fixes CVE-2020-1967. Signed-off-by: Jan Luebbe <jlu@pengutronix.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-05-17openssl: update to 1.1.1fAlexander Kanavin
This also un-breaks python3 ptest which got broken with 1.1.1e update. Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b4ddf5b9d8cd769b7026663f93c8bc69b55d8cbf) [AK: bugfix only update] Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-05-17openssl: Upgrade 1.1.1d -> 1.1.1eAdrian Bunk
Backported patch removed. Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 710bc0f8544f54750c8fb7b8affa243932927a24) [AK: bug fix only update] Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-05-17openssl: recommend cryptodev-module for corresponding PACKAGECONFIGDenys Dmytriyenko
Signed-off-by: Denys Dmytriyenko <denys@ti.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 57fcf9b517fe95e871122946cb99fe7fa9fd2e26) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-05-17openssl: Fix reproducibility issueRichard Purdie
There was a build architecture leaking into the target ptest which could vary depending upon host. Remove it as its cosmetic. [YOCTO #13770] (From OE-Core rev: 37db519eedb7eb5cd4f14d05f30f5d580aa7458d) (From OE-Core rev: c31c676319812e6fc036741db2ab8e16eccff723) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-25openssl10: Upgrade 1.0.2r -> 1.0.2uAdrian Bunk
Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-25openssl10: Add CVE_PRODUCTAdrian Bunk
Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-08ppp: Security fix CVE-2020-8597Yi Zhao
CVE-2020-8597: eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions. References: https://nvd.nist.gov/vuln/detail/CVE-2020-8597 Patch from: https://github.com/paulusmack/ppp/commit/8d7970b8f3db727fe798b65f3377fe6787575426 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-27openssh: backport patch to fix "cert not yet valid" testAnuj Mittal
Fixes [YOCTO #13796] Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> [Fix up for warrior context] Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-22openssl: fix CVE-2019-1551Anuj Mittal
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-22openssl: Whitelist CVE-2019-0190Adrian Bunk
This is only a problem with older Apache versions. Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-22openssl: Enable os option for with-rand-seed as wellKhem Raj
with openSSL 1.1.1d we start seeing errors like Error Generating Key 139979727451584:error:2406C06E:random number generator:RAND_DRBG_instantiate:error retrieving entropy:../openssl-1.1.1d/crypto/rand/drbg_lib.c:342: when using openssl from openssl-native on build hosts, this is due to limiting the random seed to devrandom, to support older hosts, since the option allows to have a comma separated list of methods to try, we can try the default first and if that fails then fallback to devrandom, this will ensure that it keeps working with build systems which dont support getrandom() Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-22openssl: Upgrade 1.1.1c -> 1.1.1dAdrian Bunk
Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-22openssl: Upgrade 1.1.1b -> 1.1.1cAdrian Bunk
Backported patch removed. Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-22bind: Whitelist CVE-2019-6470Adrian Bunk
Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-01-22wpa-supplicant: fix CVE-2019-16275Ross Burton
Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2019-11-24libpcap: upgrade 1.9.0 -> 1.9.1Zang Ruochen
-libpcap/0001-pcap-usb-linux.c-add-missing-limits.h-for-musl-syste.patch Removed since this is included in 1.9.1. Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> [CVE-2018-16301 CVE-2019-15161 CVE-2019-15162 CVE-2019-15163 CVE-2019-15164 CVE-2019-15165] Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-11-24openssl: set CVE vendor to opensslAnuj Mittal
Differentiate it from openssl gem for Ruby. Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-11-23bind: fix CVE-2019-6471 and CVE-2018-5743Kai Kang
Backport patches to fix CVE-2019-6471 and CVE-2018-5743 for bind. CVE-2019-6471 is fixed by 0001-bind-fix-CVE-2019-6471.patch and the other 6 patches are for CVE-2018-5743. And backport one more patch to fix compile error on arm caused by these 6 commits. (From OE-Core rev: 3c39d4158677b97253df63f23b74c3a9dd5539f6) Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-30openssl: make OPENSSL_ENGINES match install pathGeorge McCollister
Set OPENSSL_ENGINES to the path where engines are actually installed. Signed-off-by: George McCollister <george.mccollister@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit 59565fec0b3f3e24eb01c03b671913599cd3134d) Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 578f41124565a7cda738c7fe3d25702ee41b08ed) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-06-27wpa-supplicant: Fix CVE-2019-9494 CVE-2019-9495 CVE-2019-9496 CVE-2019-9497 ↵Adrian Bunk
CVE-2019-9498 CVE-2019-9499 CVE-2019-11555 Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-27openssl: fix failure of ptest test_shlibloadKai Kang
It fails to run ptest case test_shlibload which requires libcrypto.so and libssl.so with version numbers now. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-02openssh: Add sudo dependency for ptestRichard Purdie
Without this we see test failures due to the sudo binary being missing. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-01openssh: Avoid PROVIDES warning from rng-tools dependencyRichard Purdie
Avoid the warning: WARNING: Nothing RPROVIDES 'nativesdk-rng-tools' (but virtual:nativesdk:/home/pokybuild/yocto-worker/build-appliance/build/meta/recipes-connectivity/openssh/openssh_7.9p1.bb RDEPENDS on or otherwise requires it) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-01openssh: recommend rng-tools with sshdMikko Rapeli
Since openssl 1.1.1 and openssh which uses it, sshd startup is delayed. The delays range from few seconds to minutes and even to hours. The delays are visible in host keys generation and when sshd process is started in response to incoming TCP connection but is failing to provide SSH version string and clients or tests time out. In all cases traces show that sshd is waiting for getentropy() system call to return from Linux kernel, which returns only after kernel side random number pool is initialized. The pool is initialized via various entropy source which may be missing on embedded development boards or via rngd from rng-tools package from userspace. HW random number generation and kernel support help but rngd is till needed to feed that data back to the Linux kernel. Example from an NXP imx8 board shows that kernel random number pool initialization can take over 400 seconds without rngd, and with rngd it is initialized at around 4 seconds after boot. The completion of initialization is visible in kernel dmesg with line "random: crng init done". More details are available from: * https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=912087 * https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=897572 * https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=43838a23a05fbd13e47d750d3dfd77001536dd33 * http://www.man7.org/linux/man-pages/man2/getrandom.2.html Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de> Cc: Mark Hatle <mark.hatle@windriver.com> Cc: Rasmus Villemoes <rasmus.villemoes@prevas.dk> Cc: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-05-02openssh: fix CVE-2018-20685, CVE-2019-6109, CVE-2019-6111Anuj Mittal
Also backport a patch to fix issues introduced by fix for CVE-2019-6109. Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-05-02dhcp: Replace OE specific patch for compatibility with latest bind with ↵Adrian Bunk
upstream patch This also fixes a dhcp breakage noticed by Enrico Scholz. Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-04-10bind: upgrade 9.11.5 -> 9.11.5-P4Adrian Bunk
Bugfix-only compared to 9.11.5, mostly CVE fixes. COPYRIGHT checksum changed due to 2018 -> 2019. Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-04-09openssh/util-linux/python*: Ensure ptest output is unbufferedRichard Purdie
We need to run sed with the -u option to ensure the output is unbuffered else ptest-runner may timeout thinkig things were idle. Busybox doesn't have the -u option so we need to RDEPEND on sed (which is a good thing to do if we use it anyway). Alex Kanavin should get credit for discovering the problem. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-04-03avahi: fix CVE-2017-6519Kai Kang
Backport patch to fix CVE-2017-6519. CVE: CVE-2017-6519 Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-03-29openssl: follow OE's rule for specifying CVE IDChen Qi
Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-03-25bluez5: fix CVE-2018-10910Ross Burton
Fix this CVE (Bluetooth discoverability may be enabled with no agents to handle requests) by backporting a number of patches from upstream. Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-03-19openssl10: Upgrade 1.0.2q -> 1.0.2rOtavio Salvador
Signed-off-by: Otavio Salvador <otavio@ossystems.com.br> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-03-19openssl: Upgrade 1.1.1a -> 1.1.1bOtavio Salvador
License-Update: copyright years updated Signed-off-by: Otavio Salvador <otavio@ossystems.com.br> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-03-19openssl: Remove the c_rehash shell re-implementationOtavio Salvador
We had a c_rehash shell re-implementation being used for the native package however the ca-certificates now uses the openssl rehash internal application so there is no use for the c_rehash anymore. Signed-off-by: Otavio Salvador <otavio@ossystems.com.br> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-03-18openssl: fix CVE-2019-1543Ross Burton
Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-03-18iproute2: add tc to the alternatives listLars Persson
The tc command is provided both by busybox and iproute2. Signed-off-by: Lars Persson <larper@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-03-18inetutils: Disable rsh, etc in the buildTom Rini
It is long since past time for rsh and company to be retired from the world. Disable building these now. Suggested-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Tom Rini <trini@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-03-18inetutils: Handle rsh, etc more consistentlyTom Rini
- We cannot build rsh, rshd, rlogind and rcp on musl. This is handled gracefully in the configure scripts and spelled out with EXTRA_OECONF. Expand this to include rexec to cover all of the related functionality. - Rework adding in the xinetd.d files for these services to only do so when we even have the services being built. This leads to no rsh/rshd sub-packages on musl at all. - If we use the normal alternatives mechanism to allow for this or netkit-rsh to provide rsh/rshd functionality we end up with QA issues on musl as we have unused ALTERNATIVES logic. Switch to making use of RPROVIDES / RCONFLICTS logic instead and make it match the netkit-rsh packaging names. Cc: Khem Raj <raj.khem@gmail.com> Signed-off-by: Tom Rini <trini@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-03-18inetutils: Remove talk / talkd from ALTERNATIVESTom Rini
There are no alternative provides of these packages anymore. To avoid QA issues when building with musl, don't put these under an alternative at all. Cc: Khem Raj <raj.khem@gmail.com> Signed-off-by: Tom Rini <trini@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-03-09inetutils: Fix build on RISC-VKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-03-06inetutils: Import version 1.9.4Tom Rini
In order to have more robust stand-alone network tools in oe-core, bring in inetutils from meta-openembedded/meta-networking. This imports the recipes as of git commit: commit 408204073e6bdcd8ac586e05d5b75213417673f2 Author: Martin Jansa <martin.jansa@gmail.com> Date: Thu Aug 16 20:39:15 2018 +0000 inetutils: fix build with glibc-2.28 Signed-off-by: Tom Rini <trini@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-03-06bind-utils: Install nslookupAdrian Bunk
nslookup was undeprecated 15 years ago, and installing bind-utils should replace the busybox version. Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-03-06wpa-supplicant: Remove no longer required hack for libnlAdrian Bunk
Upstream already fixed this properly by using pkg-config. Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-03-04openssl: Add cryptodev-linux PACKAGECONFIGOvidiu Panait
The old bsd cryptodev engine was removed in https://github.com/openssl/openssl/pull/3699 and the new one added in: https://github.com/openssl/openssl/pull/3744 It can be enabled by configuring with "enable-devcryptoeng". Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-03-03openssl10: Fix mutliple include assumptions for des.h in opensslconf.hDenys Dmytriyenko
The fix is heavily based on Khem's previous fix for bn.h/BN_LLONG breakage: https://git.openembedded.org/openembedded-core/commit/?id=f787b0bb9b0626ddbf2ac94cb206c76716a3773d Signed-off-by: Denys Dmytriyenko <denys@ti.com> Cc: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-02-28openssl: drop Python 2.x dependency in -ptestAlexander Kanavin
It is only needed by 95-test_external_pyca_data which is actually skipped on the target. [YOCTO #13204] Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-02-27openssl: Fix ptest test output translationRichard Purdie
openssl-ptest was recording now results, despite most tests passing. Fix so that the successes/skips/failures are reported correctly. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-02-25openssl: move c_rehash pkg to avoid perl depBrad Bishop
Perl and its dependencies have a decent footprint impact. On my xz compressed filesystem: 634880: /usr/lib/libperl.so.5.24.4 Put c_rehash in the openssl-misc package so the dependency can be avoided where it isn't needed. Change-Id: Iae9bccabfb1c8cfa1401ca6785abc39713d3fdf0 Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-02-16nfs-utils: build tools with target compilerPascal Bach
Some tools were built with CC_FOR_BUILD which points to the target compiler. The current patch avoided issues by deleting some of the binaries during install. This patch replaces the CC_FOR_BUILD with CC so the tools are built with the target compiler. This means the binaries no longer need to be deleted. I stumbled upon this by trying to globally add "--ffile-prefix-map", which is not supported by my host GCC, to get rid of some "buildpaths" QA Warnings. Cc: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Pascal Bach <pascal.bach@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-05-31 02:12:34 +0000