summaryrefslogtreecommitdiffstats
path: root/meta-networking
Commit message (Collapse)AuthorAgeFilesLines
* dovecot: refresh patchesstable/dufell-nutArmin kuster2021-12-273-22/+18
| | | | Signed-off-by: Armin kuster <akuster808@gamil.com>
* dovecot: Fix CVE-2020-12674sana kazi2021-12-032-0/+31
| | | | | | | | | | Added patch for CVE-2020-12674 Link: http://archive.ubuntu.com/ubuntu/pool/main/d/dovecot/dovecot_2.2.33.2-1ubuntu4.7.debian.tar.xz Signed-off-by: Sana Kazi <Sana.Kazi@kpit.com> Signed-off-by: Sana Kazi <sanakazisk19@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dovecot: Fix CVE-2020-12673sana kazi2021-12-032-0/+38
| | | | | | | | | | Added patch for CVE-2020-12673 Link: http://archive.ubuntu.com/ubuntu/pool/main/d/dovecot/dovecot_2.2.33.2-1ubuntu4.7.debian.tar.xz Signed-off-by: Sana Kazi <Sana.Kazi@kpit.com> Signed-off-by: Sana Kazi <sanakazisk19@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dovecot: Fix CVE-2020-12100sana kazi2021-12-0315-0/+1264
| | | | | | | | | | Added patches to fix CVE-2020-12100 Link: http://archive.ubuntu.com/ubuntu/pool/main/d/dovecot/dovecot_2.2.33.2-1ubuntu4.7.debian.tar.xz Signed-off-by: Sana Kazi <Sana.Kazi@kpit.com> Signed-off-by: Sana Kazi <sanakazisk19@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* recipes: Update SRC_URI branch and protocolsArmin Kuster2021-11-1753-56/+56
| | | | | | | | This patch updates SRC_URIs using git to include branch=master if no branch is set and also to use protocol=https for github urls as generated by the conversion script in OE-Core. Signed-off-by: Armin Kuster <akuster808@gmail.com>
* drdb-utils: Define SRCREV_FORMATAndreas Weger2021-11-021-0/+1
| | | | | | | | | Since it uses multiple fetch URIs make it explicit to define SRCREV_FORMAT Signed-off-by: Andreas Weger <weger@hs-mittweida.de> Change-Id: Id1d0a1062d09f690123b2a1c06137ae5c04d7b20 Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tcpdump: Update CVE-2020-8037 tagPurushottam Choudhary2021-10-011-0/+1
| | | | | | | | | | CVE tag was missing inside the patch file which is the remedy for CVE-2020-8037 and tracked by cve-check. Signed-off-by: Purushottam Choudhary <purushottam.Choudhary@kpit.com> Signed-off-by: Purushottam Choudhary <purushottamchoudhary29@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dnsmasq: Security fix CVE-2021-3448Armin Kuster2021-09-102-0/+1041
| | | | | | | | | | | | | Source: https://thekelleys.org.uk/dnsmasq.git MR: 110238 Type: Security Fix Disposition: Backport from https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=74d4fcd756a85bc1823232ea74334f7ccfb9d5d2 ChangeID: 3365bcc47b0467b487f14fc6bfad89bc560cd818 Description: A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given network interface, dnsmasq uses a fixed port while forwarding queries. An attacker on the network, able to find the outgoing port used by dnsmasq, only needs to guess the random transmission ID to forge a reply and get it accepted by dnsmasq. This flaw makes a DNS Cache Poisoning attack much easier. The highest threat from this vulnerability is to data integrity. Signed-off-by: Armin Kuster <akuster@mvista.com>
* stunnel: upgrade 5.56 -> 5.57Pierre-Jean Texier2021-09-101-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Source: https://git.openembedded.org/meta-openembedded MR: 109039 Type: Security Fix Disposition: Backport from https://git.openembedded.org/meta-openembedded/commit/meta-networking/recipes-support/stunnel?h=gatesgarth&id=b76712700c79e4627028787ae65ab306c21eed02 ChangeID: 2543a2516b0f00024ed117a1fe33d1157b3d725f Description: Affects < 5.57 License-Update: copyright years updated. This is a bug fix release: - X.509 v3 extensions required by modern versions of OpenSSL are added to generated self-signed test certificaes. - Fixed a tiny memory leak in configuration file reload error handling (thx to Richard Könning). - Merged Debian 05-typos.patch (thx to Peter Pentchev). - Merged with minor changes Debian 06-hup-separate.patch (thx to Peter Pentchev). - Merged Debian 07-imap-capabilities.patch (thx to Ansgar). - Merged Debian 08-addrconfig-workaround.patch (thx to Peter Pentchev). - Fixed tests on the WSL2 platform. Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit b76712700c79e4627028787ae65ab306c21eed02) [Includes CVE-2021-20230 per changelog Full commit https://github.com/mtrojnar/stunnel/commit/ebad9ddc4efb2635f37174c9d800d06206f1edf9 ] Signed-off-by: Armin Kuster <akuster@mvista.com>
* tcpdump: Exclude CVE-2020-8036 from checkArmin Kuster2021-08-241-0/+5
| | | | | | | This issue was introduce in 4.9 by 246ca110 Autosar SOME/IP protocol support which is after 4.9.3 Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ufw: Fix interpreter for installed ufw and test ufwJate Sujjavanich2021-08-152-16/+6
| | | | | | | | | Revert patch to setup-only-make-one-reference-to-env.patch and make patch for python3 interpreter fix apply to runs of setup.py during self test as well as installs. Reported-by: Kenta Nakamura <Nakamura.Kenta@bp.MitsubishiElectric.co.jp> Signed-off-by: Jate Sujjavanich <jatedev@gmail.com>
* wireshark: update to 3.2.15Armin Kuster2021-07-251-1/+1
| | | | | | | | | | | | | | | | | | | | | Source: Wireshark.org MR: 109612, 110462, 112069 Type: Security Fix Disposition: Backport from wireshark.org ChangeID: 40f9f8ac2431f32680d4817607badbbe44875260 Description: Bug fix only update: see: https://www.wireshark.org/docs/relnotes/wireshark-3.2.15.html https://www.wireshark.org/docs/relnotes/wireshark-3.2.14.html https://www.wireshark.org/docs/relnotes/wireshark-3.2.13.html https://www.wireshark.org/docs/relnotes/wireshark-3.2.12.html https://www.wireshark.org/docs/relnotes/wireshark-3.2.11.html includes: CVE-2021-22191, CVE-2021-22207, CVE-2021-22235 Signed-off-by: Armin Kuster <akuster@mvista.com>
* ufw: backport patches, update RRECOMMENDS, python3 support, testsJate Sujjavanich2021-07-249-7/+18155
| | | | | | | | | | | | | | | | | Backport patches: using conntrack instead of state eliminating warning support setup.py build (python 3) adjust runtime tests to use daytime port (netbase changes) empty out IPT_MODULES (nf conntrack warning) check-requirements patch for python 3.8 Update, add patches for python 3 interpreter Add ufw-test package. Backport fixes for check-requirements script Update kernel RRECOMMENDS for linux-yocto 5.4 in dunfell For dunfell Signed-off-by: Jate Sujjavanich <jatedev@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ntp: fix ntpdate to wait for subprocessesAdrian Zaharia2021-07-101-0/+5
| | | | | | | | | | | | | | | | | | | When using systemd, ntpdate-sync script will start in background triggering the start of ntpd without actually exiting. This results in an bind error in ntpd startup. Add wait at the end of ntpdate script to ensure that when the ntpdate.service is marked as finished the oneshot script ntpdate-sync finished and unbind the ntp port Fixes #386 Signed-off-by: Adrian Zaharia <Adrian.Zaharia@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 73d5cd5e8d9d8a922b6a8a9d90adf0470a99314e) Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit f52ce99b468eff95b6e36caf41fb50808a26f8d5) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dovecot: add CVE-2016-4983 to allowlistkraj/dunfellArmin Kuster2021-07-061-0/+3
| | | | | | | | | | | | CVE-2016-4983 affects only postinstall script on specific distribution, so add it to allowlist. Signed-off-by: Yuichi Ito <ito-yuichi@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 3613b50a84559ce771866cd1eef1141fa3e6d238) [mkcert.sh does mask 077 first] Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit d1fb027f894921ea02c984eb581ee1500c613470) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* cyrus-sasl: add CVE-2020-8032 to allowlistito-yuichi@fujitsu.com2021-07-051-0/+3
| | | | | | | | | | | This affects only openSUSE, so add it to allowlist. Signed-off-by: Yuichi Ito <ito-yuichi@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 711e932b14de57a5f341124470b2f3f131615a25) Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 26819375448077265cd4c9dbb88b6be08b899e3f) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* add CVE-2011-2411 to allowlistSekine Shigeki2021-07-051-0/+4
| | | | | | | | | | | This affects only on HP NonStop Server, so add it to allowlist. Signed-off-by: Sekine Shigeki <sekine.shigeki@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit bb4a4f0ff8d9926137cb152fd3f2808bd9f961ce) Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit d614d160a10b3c5ac36702fbd433f98925a9aa8e) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dnsmasq: Add fixes for CVEs reported for dnsmasqSana Kazi2021-05-297-1/+1631
| | | | | | | | | | | | | | | | | | | | | | | | Applied single patch for below listed CVEs: CVE-2020-25681 CVE-2020-25682 CVE-2020-25683 CVE-2020-25687 as they are fixed by single commit http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=4e96a4be685c9e4445f6ee79ad0b36b9119b502a Link: https://www.openwall.com/lists/oss-security/2021/01/19/1 Also, applied patch for below listed CVEs: CVE-2020-25684 CVE-2020-25685 CVE-2020-25686 all CVEs applicable to v2.81 Signed-off-by: Sana Kazi <Sana.Kazi@kpit.com> Signed-off-by: Nisha Parrakat <nishaparrakat@gmail.com> [Refreshed patches] Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ebtables: use bitbake optimization levelsMikko Rapeli2021-05-292-0/+20
| | | | | | | | | | | | | | Don't overwrite with O3 optimization. Reduces ebtables binary package size from 416241 to 412145 bytes, and enables further optimizations with e.g. -Os flags via bitbake distro wide settings. Only ebtables versions up to 2.0.10-4 and dunfell are affected. The version 2.0.11 from hardknott and master branch use system wide flags already. Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* wireguard: fix build issue with updated 5.4 kernelArmin Kuster2021-04-072-1/+34
| | | | | | | | error: static declaration of 'icmp_ndo_send' follows non-static declaration | 959 | static inline void icmp_ndo_send(struct sk_buff *skb_in, int type, int code, __be32 info) | | ^~~~~~~~~~~~~ Signed-off-by: Armin Kuster <akuster808@gmail.com>
* mdns: Whitelisted CVE-2007-0613 for mdnsSana Kazi2021-03-161-0/+13
| | | | | | | | | | | | | | | | | | | | CVE-2007-0613 is not applicable as it only affects Apple products i.e. ichat,mdnsresponder, instant message framework and MacOS. Also, https://www.exploit-db.com/exploits/3230 shows the part of code affected by CVE-2007-0613 which is not preset in upstream source code. Hence, CVE-2007-0613 does not affect other Yocto implementations and is not reported for other distros can be marked whitelisted. Links: https://vulmon.com/vulnerabilitydetails?qid=CVE-2007-0613 https://www.incibe-cert.es/en/early-warning/vulnerabilities/cve-2007-0613 https://security-tracker.debian.org/tracker/CVE-2007-0613 https://ubuntu.com/security/CVE-2007-0613 https://vulmon.com/vulnerabilitydetails?qid=CVE-2007-0613 Signed-off-by: Sana Kazi <Sana.Kazi@kpit.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit f37e5423da984b7dc721d52f04673d3afc0879a1) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nghttp2: Add fix for CVE-2020-11080Rahul Taya2021-03-163-0/+341
| | | | | | | | | | | Added below two patches to fix CVE-2020-11080: 1. CVE-2020-11080-1.patch 2. CVE-2020-11080-2.patch Signed-off-by: Rahul Taya <Rahul.Taya@kpit.com> [Refreshed patches to apply] Signed-off-by: Armin Kuster <akuster808@gmail.com>
* openipmi: Inherit python3targetconfigKhem Raj2021-02-191-1/+1
| | | | | | | | | | | | | | | | Fixes configure: error: Could not link test program to Python. Maybe the main Python library has been installed in some non-standard library path. If so, pass it to configure, via the LIBS environment variable. Example: ./configure LIBS="-L/usr/non-standard-path/python/lib" Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 59f817bbe374799e4398766c2a444692d932d979) Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 59d3d64e902d4d2e7ea9c3d2e1fec442912bcdd5) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dnsmasq: Fix systemd serviceMario Schuknecht2021-02-151-1/+1
| | | | | | | | | | | | | | Systemd service file option 'ExecStopPre' is warned and ignored by systemd. By replacing 'ExecStopPre' with 'ExecStop', the intended behavior is realized. The 'ExecStop' commands are executed one after the other. Signed-off-by: Mario Schuknecht <mario.schuknecht@dresearch-fe.de> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 55c94cb3196f53d0c1c76bbd74136d1b5d51802d) Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 83842c9150fdead52dc7b0913ffac32677720f98) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* celt051: update SRC_URIchangqing.li@windriver.com2021-02-151-1/+1
| | | | | | | | | | | | original SRC_URI is not valid now, offical CELT repository moved to gitlab Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 5450c958bf66afd560fd8dff5b432ea71f10165c) Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 1de0f4c33b92b9bbd885044df505154c177db59e) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* wireguard-module: remove PKG assignmentMartin Jansa2021-02-101-7/+0
| | | | | | | | | | | | | | | * it's not clear why it was added in first place and it's causing issues since: "package: get_package_mapping: avoid dependency mapping if renamed package provides original name" commit in oe-core as discussed in: https://lists.openembedded.org/g/openembedded-core/message/143672 https://github.com/openembedded/meta-openembedded/issues/285 Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 304f660f880bdf7dd5c51695875ab0a73aaed8b2) Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit f9502868169715ee4945f5d8bef7c845dbb7b9e0) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* networkd-dispatcher: use git fetcherMartin Jansa2021-01-281-3/+4
| | | | | | | | | * now the gitlab QA check was backported to dunfell as well in: https://git.openembedded.org/openembedded-core/commit/?h=dunfell&id=72f2c45880afbba1745e5e0cbd841d7fd666f374 and this started failing with: ERROR: networkd-dispatcher-2.0.1-r0 do_package_qa: QA Issue: networkd-dispatcher: SRC_URI uses unstable GitHub/GitLab archives, convert recipe to use git protocol [src-uri-bad] Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* iscsi-initiator-utils: upgrade 2.1.2 -> 2.1.3zangrc2021-01-252-50/+1
| | | | | | | | | | | | | | | | | | | | | | Source: git.openembedded.org MR: 108115, 108125, 108095, 108105 Type: Security Fix Disposition: Backport from https://git.openembedded.org/meta-openembedded/commit/meta-networking/recipes-daemons/iscsi-initiator-utils?id=46e30569e3b3d0cc66ce05e9accd759f37705feb ChangeID: 46e30569e3b3d0cc66ce05e9accd759f37705feb Description: 0001-libopeniscsiusr-Compare-with-max-int-instead-of-max-.patch Removed since this is included in 2.1.3 Bugfix only update. Also includes these CVE fixes: CVE-2020-13988 CVE-2020-13987 CVE-2020-17438 CVE-2020-17437 Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster@mvista.com>
* iscsi-initiator-utils: Silence a clang warning on 64bit systemsKhem Raj2021-01-252-0/+49
| | | | | | | | This unbreaks the build with clang as well. Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 409032dcc59bed5051cca454f7344b3cd207cebf) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* iscsi-initiator-utils: Upgrade to _2.1.2Khem Raj2021-01-252-6/+34
| | | | | | | | | Fix build with clang Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit b99b2f5297a587188cf28e687111b58d7e358fb7) [Bug fix only update] Signed-off-by: Armin Kuster <akuster808@gmail.com>
* wireshark: Several securtiy fixesArmin Kuster2021-01-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | Source: Wireshark.org MR: 106181, 106696, 107655, 107673, 107682 Type: Security Fix Disposition: Backport from wireshark.org ChangeID: 57df6ac3b11aabd96e6aec728501ce7988bc176a Description: Bugfix only update including these cves: 3.2.8 CVE-2020-26575 CVE-2020-28030 3.2.9 CVE-2020-26418 CVE-2020-26421 CVE-2020-26420 Signed-off-by: Armin Kuster <akuster@mvista.com> (cherry picked from commit a10ea62a1c9c7b0c4810f2e4ef0dcc6f75b0ca6b) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* samba: CVE-2020-14383 Security AdvisoryZheng Ruoqin2021-01-102-0/+113
| | | | | | | | | | | | References https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14383 Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit baee1ebeafce5d6a99dafc30b91e6fb760197686) Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 81d14a86353829eba1d55a93d478faf4c5527a89) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* samba: CVE-2020-14318 Security AdvisoryZheng Ruoqin2021-01-102-0/+143
| | | | | | | | | | | | References https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14318 Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 1d44b4c03d51e91ce01cf5fd0b33155ce36f1862) Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 38beb6fe98894ffaf82a05ccfd6694f735daba26) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* wireguard-module: fix build issue with 5.4 kernelArmin Kuster2020-12-242-1/+31
| | | | | | | | | | | | | | | | | | | /tmp/work/qemux86_64-poky-linux/wireguard-module/1.0.20200401-r0/git/src/compat/compat-asm.h:44: warning: "SYM_FUNC_START" redefined | 44 | #define SYM_FUNC_START ENTRY | | | In file included from /tmp/work/qemux86_64-poky-linux/wireguard-module/1.0.20200401-r0/git/src/compat/compat-asm.h:9, | from <command-line>: | /tmp/work-shared/qemux86-64/kernel-source/include/linux/linkage.h:218: note: this is the location of the previous definition | 218 | #define SYM_FUNC_START(name) \ | | | In file included from <command-line>: | /tmp/work/qemux86_64-poky-linux/wireguard-module/1.0.20200401-r0/git/src/compat/compat-asm.h:45: warning: "SYM_FUNC_END" redefined | 45 | #define SYM_FUNC_END ENDPROC | | Backporit fix from upstream Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tcpdump: Patch for CVE-2020-8037viatsk2020-12-102-0/+71
| | | | | | Signed-off-by: Stacy Gaikovaia <stacy.gaikovaia@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* chrony: Patch CVE-2020-14367Anatol Belski2020-11-092-0/+205
| | | | | | | Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit b4d7b1ee421d9ae75548ac0c0dd0ea9405a0571e) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* samba: upgrade 4.10.17 -> 4.10.18Yi Zhao2020-11-094-193/+2
| | | | | | | | | | | | | | This is security release in order to address CVE-2020-1472 (Unauthenticated domain takeover via netlogon ("ZeroLogon")). See: https://www.samba.org/samba/history/samba-4.10.18.html Also remove 3 backported patches. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit bebdea8530652ff698885a3f55b0a650de319379) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* wireshark: upgrade 3.2.6 -> 3.2.7Zang Ruochen2020-11-091-1/+1
| | | | | | | Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 47821db8ed0dc81e84d5ba6b873dc14d50f85e07) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* wireshark: upgrade 3.2.5 -> 3.2.6Zang Ruochen2020-11-091-1/+1
| | | | | | | Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 88df26ab74a5d1274127f83b854da2d5747b9952) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* crda: rdepends on wireless-regdb-staticRobert Yang2020-10-041-1/+1
| | | | | | | | | | | | | | | | | | | The wireless-regdb has been moved to oe-core. According the commit message: wireless-regdb-static should be used with kernel >= 4.15. wireless-regdb can be used with older kernels and is mostly irrelevant here, but keeping it in meta-networking would create needless recipe duplication. it should replace runtime dependency wireless-regdb with wireless-regdb-static. Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit ac313b638068aabc88f0fa9d1888380e94100f31) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* strongswan: Remove obsolete setting regarding the Standard OutputMingli Yu2020-10-042-0/+35
| | | | | | | | | | | | | | The Standard output type "syslog" is obsolete, causing a warning since systemd version 246 [1]. Please consider using "journal" or "journal+console" [1] https://github.com/systemd/systemd/blob/master/NEWS#L202 Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit e61b73e6d388006375c6fe84cc194299c094a526) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ssmtp: adjust u-aMartin Jansa2020-10-041-8/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * it's newaliases not newalias in sbindir * drop u-a for man pages, because only ssmtp.8 was created which shouldn't conflict with esmpt In my build I don't have mailq, sendmail, newaliases as man pages, but binaries in sbindir (and the sbinbinary is called newaliases, not newalias) tmp-glibc/work/core2-64-oe-linux/ssmtp/2.64-r0/image/ tmp-glibc/work/core2-64-oe-linux/ssmtp/2.64-r0/image/usr tmp-glibc/work/core2-64-oe-linux/ssmtp/2.64-r0/image/usr/share tmp-glibc/work/core2-64-oe-linux/ssmtp/2.64-r0/image/usr/share/man tmp-glibc/work/core2-64-oe-linux/ssmtp/2.64-r0/image/usr/share/man/man8 tmp-glibc/work/core2-64-oe-linux/ssmtp/2.64-r0/image/usr/share/man/man8/ssmtp.8 tmp-glibc/work/core2-64-oe-linux/ssmtp/2.64-r0/image/usr/sbin tmp-glibc/work/core2-64-oe-linux/ssmtp/2.64-r0/image/usr/sbin/mailq tmp-glibc/work/core2-64-oe-linux/ssmtp/2.64-r0/image/usr/sbin/sendmail tmp-glibc/work/core2-64-oe-linux/ssmtp/2.64-r0/image/usr/sbin/newaliases tmp-glibc/work/core2-64-oe-linux/ssmtp/2.64-r0/image/usr/sbin/ssmtp tmp-glibc/work/core2-64-oe-linux/ssmtp/2.64-r0/image/etc tmp-glibc/work/core2-64-oe-linux/ssmtp/2.64-r0/image/etc/ssmtp tmp-glibc/work/core2-64-oe-linux/ssmtp/2.64-r0/image/etc/ssmtp/revaliases this added u-a is causing following warnings: WARNING: ssmtp-2.64-r0 do_package: ssmtp: alternative target (/usr/share/man/man1/mailq.1 or /usr/share/man/man1/mailq.1.ssmtp) does not exist, skipping... WARNING: ssmtp-2.64-r0 do_package: ssmtp: alternative target (/usr/share/man/man1/newaliases.1 or /usr/share/man/man1/newaliases.1.ssmtp) does not exist, skipping... WARNING: ssmtp-2.64-r0 do_package: ssmtp: alternative target (/usr/share/man/man1/sendmail.1 or /usr/share/man/man1/sendmail.1.ssmtp) does not exist, skipping... WARNING: ssmtp-2.64-r0 do_package: ssmtp: alternative target (/usr/sbin/newalias or /usr/sbin/newalias.ssmtp) does not exist, skipping... WARNING: ssmtp-2.64-r0 do_package: ssmtp: NOT adding alternative provide /usr/share/man/man1/mailq.1: /usr/share/man/man1/mailq.1.ssmtp does not exist WARNING: ssmtp-2.64-r0 do_package: ssmtp: NOT adding alternative provide /usr/share/man/man1/newaliases.1: /usr/share/man/man1/newaliases.1.ssmtp does not exist WARNING: ssmtp-2.64-r0 do_package: ssmtp: NOT adding alternative provide /usr/share/man/man1/sendmail.1: /usr/share/man/man1/sendmail.1.ssmtp does not exist WARNING: ssmtp-2.64-r0 do_package: ssmtp: NOT adding alternative provide /usr/sbin/newalias: /usr/sbin/newalias.ssmtp does not exist WARNING: ssmtp-2.64-r0 do_package: ssmtp: alt_link == alt_target: /usr/share/man/man1/mailq.1 == /usr/share/man/man1/mailq.1 WARNING: ssmtp-2.64-r0 do_package: ssmtp: alt_link == alt_target: /usr/share/man/man1/newaliases.1 == /usr/share/man/man1/newaliases.1 WARNING: ssmtp-2.64-r0 do_package: ssmtp: alt_link == alt_target: /usr/share/man/man1/sendmail.1 == /usr/share/man/man1/sendmail.1 WARNING: ssmtp-2.64-r0 do_package: ssmtp: alt_link == alt_target: /usr/sbin/newalias == /usr/sbin/newalias Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit bdb964c907bd7d6972e09992505a0c4bbbda8fa4) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ssmtp: Use update alternatives for conflicts with esmtpKhem Raj2020-10-041-1/+14
| | | | | | Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 916b6f15efe924dc66d7908ac0bea554eaf7ac92) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* netkit-rsh: inherit update-alternativesMartin Jansa2020-10-041-1/+1
| | | | | | | | | | | * fixes: netkit-rsh-0.17-r0 do_package_qa: QA Issue: netkit-rsh: recipe defines ALTERNATIVE_netkit-rsh-client but doesn't inherit update-alternatives. This might fail during do_rootfs later! [missing-update-alternatives] netkit-rsh-0.17-r0 do_package_qa: QA Issue: netkit-rsh: recipe defines ALTERNATIVE_netkit-rsh-server but doesn't inherit update-alternatives. This might fail during do_rootfs later! [missing-update-alternatives] Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit e48aabf951c8759d3c3cb93aed87f1b03a788fe3) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libldb: upgrade 1.5.7 -> 1.5.8Yi Zhao2020-09-191-2/+2
| | | | | | | | | | Samba version 4.10.17 which has been already available in Dunfell depends on version 1.5.8 of libldb. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* net-snmp: Fix CVE-2020-15861 and CVE-2020-15862Ovidiu Panait2020-09-037-0/+723
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Net-SNMP through 5.7.3 allows Escalation of Privileges because of UNIX symbolic link (symlink) following. Net-SNMP through 5.7.3 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB provides the ability to run arbitrary commands as root. References: https://nvd.nist.gov/vuln/detail/CVE-2020-15861 https://nvd.nist.gov/vuln/detail/CVE-2020-15862 Upstream patches: https://github.com/net-snmp/net-snmp/commit/2b3e300ade4add03b889e61d610b0db77d300fc3 https://github.com/net-snmp/net-snmp/commit/9cfb38b0aa95363da1466ca81dd929989ba27c1f https://github.com/net-snmp/net-snmp/commit/114e4c2cec2601ca56e8afb1f441520f75a9a312 https://github.com/net-snmp/net-snmp/commit/2968b455e6f182f329746e2bca1043f368618c73 https://github.com/net-snmp/net-snmp/commit/4fd9a450444a434a993bc72f7c3486ccce41f602 https://github.com/net-snmp/net-snmp/commit/77f6c60f57dba0aaea5d8ef1dd94bcd0c8e6d205 CVE-2020-15861-0005.patch is the actual fix for CVE-2020-15861 and CVE-2020-15861-0001.patch through CVE-2020-15861-0004.patch are context patches needed by the fix to apply cleanly. Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* freeradius: fix the occasional verification failureMingli Yu2020-08-232-0/+136
| | | | | | | | | | | | | | | | | | | | | | | | | Fixes: # cd /etc/raddb/certs # ./bootstrap [snip] chmod g+r ca.key openssl pkcs12 -in server.p12 -out server.pem -passin pass:'whatever' -passout pass:'whatever' chmod g+r server.pem C = FR, ST = Radius, O = Example Inc., CN = Example Server Certificate, emailAddress = admin@example.org error 7 at 0 depth lookup: certificate signature failure 140066667427072:error:04067084:rsa routines:rsa_ossl_public_decrypt:data too large for modulus:../openssl-1.1.1g/crypto/rsa/rsa_ossl.c:553: 140066667427072:error:0D0C5006:asn1 encoding routines:ASN1_item_verify:EVP lib:../openssl-1.1.1g/crypto/asn1/a_verify.c:170: error server.pem: verification failed make: *** [Makefile:107: server.vrfy] Error 2 It seems the ca.pem mismatchs server.pem which results in failing to execute "openssl verify -CAfile ca.pem server.pem", so add the logic to check the file to avoid inconsistency. Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 52f5141109fae5f49c5a7334e9ded2b028e16cf6) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* rdist: fix parallel buildKai Kang2020-08-232-0/+32
| | | | | | | | | | | | | | | | | | | It fails to compile rdist occasionally when system load of build server is high: | In file included from common.c:57: | ../include/defs.h:49:10: fatal error: y.tab.h: No such file or directory | 49 | #include "y.tab.h" | | ^~~~~~~~~ | compilation terminated. Make $(COMMONOBJS) which include common.o to depends on related header files and y.tab.h to fix the parallel build failure. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 1bb990c6ca1b149c19404fbe006fb6b372af8c4c) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* samba: upgrade 4.10.15 -> 4.10.17Yi Zhao2020-08-234-2/+193
| | | | | | | | | | | | | | | | | | | This is a security release in order to address the following defects: CVE-2020-10730: NULL pointer de-reference and use-after-free in Samba AD DC LDAP Server with ASQ, VLV and paged_results. CVE-2020-10745: Parsing and packing of NBT and DNS packets can consume excessive CPU CVE-2020-10760: LDAP Use-after-free in Samba AD DC Global Catalog with paged_results and VLV. CVE-2020-14303: Empty UDP packet DoS in Samba AD DC nbtd. Also backport 3 patches to fix build error with musl. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 1609df11530ebb73de863d0c705e16107015dbe3) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* samba: Fix conflicts with nss.h from glibcKhem Raj2020-07-302-0/+97
| | | | | | | | This is seen with glibc 2.32 where these names are also defined Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 5cf2665446f3fdc16b484c64afffaa0ac8373a35) Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-22 01:04:26 +0000