summaryrefslogtreecommitdiffstats
path: root/meta-networking
Commit message (Collapse)AuthorAgeFilesLines
* weechat: upgrade 4.0.2 -> 4.0.3Wang Mingyu2023-08-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | Changelog: =========== Bug fixes:: ---------- * core: fix input length and crash after delete of line * irc: fix display of self CTCP message containing bold attribute * irc: fix memory leak in IRC message parser * irc: fix switch to channel manually joined when server option autojoin_dynamic is on and option irc.look.buffer_switch_autojoin is off * irc: fix display of outgoing notice with channel when capability "echo-message" is enabled * relay: fix display of IRC CTCP messages received from client Build:: ----------- * doc: display a warning if a locale is missing with fallback to English for auto-generated content Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* networkmanager: upgrade 1.42.8 -> 1.44.0Wang Mingyu2023-08-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: ========== * Introduce a new "link" setting that holds properties related to the kernel link such as "tx-queue-length", "gso-max-size", "gso-max-segments", "gro-max-size". * Support sending a DHCPv6 prefix delegation hint via the "ipv6.dhcp-pd-hint" connection property. * Support new bond options: "arp_missed_max", "lacp_active", "ns_ip6_target". * Add new "initial-eps-bearer-configure" and "initial-eps-bearer-apn" properties in the GSM setting. * Setting "connection.stable-id=default${CONNECTION}" changed behavior to be identical to the built-in default value when the stable-id is not set. * Add a "[keyfile].rename" option to NetworkManager.conf to force renaming profiles on disk when their name changes. * The ifcfg-rh plugin is deprecated; it will only receive bugfixes and no new features. A warning is emitted the log when a connection in ifcfg-rh format is found. * To automatically migrate existing ifcfg-rh connections to the keyfile format, a new configuration option "main.migrate-ifcfg-rh" is provided. Migration is disabled by default, but the default value can be changed at build time via "--with-config-migrate-ifcfg-rh-default=yes". * When configuring hostnames in non-public TLD (like "example.local"), use the TLD as default search domain instead of the full hostname. * Always apply DNS options from the [global-dns] configuration section * The NetworkManager daemon now acquires the D-Bus name only after populating the D-Bus tree. This can add a delay during startup but it is required to avoid race conditions with other services depending on NM. * Add a "version-id" argument to the Update2() D-Bus call to guard against concurrent modifications of profiles. * Don't use tentative IPv6 addresses to resolve the system hostname via DNS. * Track the number of autoconnect retries left for each device and connection. Previously it was tracked only per connection and this lead to unexpected behaviors in case of multiconnect profiles. * Set VLAN filtering options on bridge via netlink instead of sysfs. * nm-cloud-setup now supports IMDSv2 on Amazon EC2. * nmtui now allows to enable or disable Wi-Fi and WWAN radios. * Honor ignore-carrier=no for bond/bridge/team devices. * Add version mismatch warning when running nmcli commands. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* chrony: upgrade 4.3 -> 4.4Wang Mingyu2023-08-152-11/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | arm_eabi.patch refreshed for 4.4 Changelog: =========== * Add support for AES-GCM-SIV with Nettle >= 3.9 to shorten NTS cookies to avoid some length-specific blocking of NTP on Internet * Add support for multiple refclocks using extpps option on one PHC * Add maxpoll option to hwtimestamp directive to improve PHC tracking with low packet rates * Add hwtstimeout directive to configure timeout for late timestamps * Handle late hardware transmit timestamps of NTP requests on all sockets * Handle mismatched 32/64-bit time_t in SOCK refclock samples * Improve source replacement * Log important changes made by command requests (chronyc) * Refresh address of NTP sources periodically * Request nanosecond kernel RX timestamping on FreeBSD * Set DSCP for IPv6 packets * Shorten NTS-KE retry interval when network is down * Update seccomp filter for musl * Warn if loading keys from file with unexpected permissions * Warn if source selection fails or falseticker is detected * Add selectopts command to modify source-specific selection options * Add timestamp sources to serverstats report and make its fields 64-bit * Add -e option to chronyc to indicate end of response Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* open-vm-tools: add CVE_PRODUCTChen Qi2023-08-071-0/+2
| | | | | | | | vmware:tools is also a valid CVE_PRODUCT for open-vm-tools, e.g., https://nvd.nist.gov/vuln/detail/CVE-2023-20867. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* radvd: Fix groupname gid change warningJD Schroeder2023-08-051-0/+1
| | | | | | | | | | | | | | This patch fixes warnings when useradd-staticids.bbclass is used and USERADD_PARAM is used to add the user to a group that has not been explicitly created yet. By adding the GROUPADD_PARAM for the new group being used the warnings for changing the gid from GID-OLD to GID-NEW is eliminated. Warning fixed: radvd: Changing groupname nogroup's gid from (WXYZ) to (JKLM), verify configuration files! Signed-off-by: JD Schroeder <sweng5080@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* remove unused AUTHOR variableMichael Opdenacker2023-08-035-5/+0
| | | | | | | | | No longer used in generating packages Also creates a possible confusion with the recipe maintainer name. Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* rdma-core: upgrade 46.0 -> 47.0Wang Mingyu2023-08-011-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* mdio-tools,mdio-netlink: Upgrade recipes to 1.3.0Wang Mingyu2023-08-013-1/+1
| | | | | | | | | | | | | | | | | | Changelog: =========== Primarily widen the gamut of supported kernel versions, now supporting all kernels from 5.2 and onwards. Added ------ mvls: Support for 88E6320/88E6321 Changed -------- mdio-netlink: Adapt to the upstream C22/C45 refactor. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* babeld: upgrade 1.12.2 -> 1.13.1Wang Mingyu2023-08-011-1/+1
| | | | | | | | | | | | | | | | | Changelog: ========== * Implemented the per-interface option "probe-mtu", which automatically discards links with a mis-configured MTU. * Fixed a typo in the handing of the option "v4viav6". * Removed diversity support and related configuration file directives. * Optimised route redistribution. We now install just the route that the kernel sent us rather than doing a full route dump on every change. * Added optional delay to daemon shutdown; see the configuration option "shutdown-delay-ms". * Fixed compilation under BSD. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* cve_check: fix conversion errorsPeter Marko2023-07-312-3/+3
| | | | | | | | Conversion from CVE_CHECK_IGNORE to CVE_STATUS had some copy+paste issues. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* daq: enable nfq module buildYi Zhao2023-07-282-7/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | NFQ is the new and improved way to process iptables packets. Snort IPS mode requires this module in some cases. Before the patch: $ snort --daq-list Available DAQ modules: pcap(v3): readback live multi unpriv ipfw(v3): live inline multi unpriv dump(v3): readback live inline multi unpriv afpacket(v5): live inline multi unpriv After the patch: $ snort --daq-list Available DAQ modules: pcap(v3): readback live multi unpriv nfq(v7): live inline multi ipfw(v3): live inline multi unpriv dump(v3): readback live inline multi unpriv afpacket(v5): live inline multi unpriv Also update 0001-correct-the-location-of-unistd.h.patch to fix build with musl. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* libnetfilter-queue: enable native buildYi Zhao2023-07-281-0/+2
| | | | | | | Required by daq native build. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* libnfnetlink: enable native buildYi Zhao2023-07-281-0/+2
| | | | | | | Required by libnetfilter-queue native build. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* samba: upgrade 4.18.4 -> 4.18.5Yi Zhao2023-07-271-1/+1
| | | | | | | | | | | | | | | This is a security release in order to address the following defects: CVE-2022-2127 CVE-2023-3347 CVE-2023-34966 CVE-2023-34967 CVE-2023-34968 Release Notes: https://www.samba.org/samba/history/samba-4.18.5.html Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* cve_check: convert CVE_CHECK_IGNORE to CVE_STATUSAndrej Valek2023-07-2711-61/+30
| | | | | | | | | - Try to add convert and apply statuses for old CVEs - Drop some obsolete ignores, while they are not relevant for current version Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* dlm: Do not use -fcf-protection=full on aarch64 platformsMartin Jansa2023-07-211-0/+1
| | | | | | | | | | | Its not supported option, see: http://errors.yoctoproject.org/Errors/Details/721121/ aarch64-oe-linux-gcc -mcpu=cortex-a57 -march=armv8-a+crc -mbranch-protection=standard --sysroot=TOPDIR/tmp-glibc/work/cortexa57-oe-linux/dlm/4.2.0-r0/recipe-sysroot libdlm.c -O2 -pipe -g -feliminate-unused-debug-types -fcanon-prefix-map -fmacro-prefix-map=TOPDIR/tmp-glibc/work/cortexa57-oe-linux/dlm/4.2.0-r0/dlm-dlm-4.2.0=/usr/src/debug/dlm/4.2.0-r0 -fdebug-prefix-map=TOPDIR/tmp-glibc/work/cortexa57-oe-linux/dlm/4.2.0-r0/dlm-dlm-4.2.0=/usr/src/debug/dlm/4.2.0-r0 -fmacro-prefix-map=TOPDIR/tmp-glibc/work/cortexa57-oe-linux/dlm/4.2.0-r0/dlm-dlm-4.2.0=/usr/src/debug/dlm/4.2.0-r0 -fdebug-prefix-map=TOPDIR/tmp-glibc/work/cortexa57-oe-linux/dlm/4.2.0-r0/dlm-dlm-4.2.0=/usr/src/debug/dlm/4.2.0-r0 -fdebug-prefix-map=TOPDIR/tmp-glibc/work/cortexa57-oe-linux/dlm/4.2.0-r0/recipe-sysroot= -fmacro-prefix-map=TOPDIR/tmp-glibc/work/cortexa57-oe-linux/dlm/4.2.0-r0/recipe-sysroot= -fdebug-prefix-map=TOPDIR/tmp-glibc/work/cortexa57-oe-linux/dlm/4.2.0-r0/recipe-sysroot-native= -fcf-protection=full -D_GNU_SOURCE -O2 -ggdb -Wall -Wformat -Wformat-security -Wmissing-prototypes -Wnested-externs -Wpointer-arith -Wextra -Wshadow -Wcast-align -Wwrite-strings -Waggregate-return -Wstrict-prototypes -Winline -Wredundant-decls -Wno-sign-compare -Wno-unused-parameter -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fstack-protector-strong -fstack-clash-protection -fexceptions -fasynchronous-unwind-tables -fdiagnostics-show-option -fPIC -D_REENTRANT -c -o libdlm.o cc1: error: '-fcf-protection=full' is not supported for this target Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* wireshark: upgrade 4.0.6 -> 4.0.7Wang Mingyu2023-07-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: ========== The following vulnerabilities have been fixed: wnpa-sec-2023-21[3] Kafka dissector crash. Issue 19105[4]. wnpa-sec-2023-22[5] iSCSI dissector crash. Issue 19164[6]. The following bugs have been fixed: -Crash when (re)loading a capture file after renaming a dfilter macro. Issue 13753[7]. - Moving a column deselects selected packet and moves to beginning of packet list. Issue 16251[8]. -If you set the default interface in the preferences, it doesn't work with TShark. Issue 16593[9]. -Severe performance issues in Follow → Save As raw workflow. Issue 17313[10]. -TShark doesn't support the tab character as an aggregator character in \"-T fields\" Issue 18002[11]. -On Windows clicking on a link in the 'Software Update' window launches, now unsupported, MS Internet Explorer. Issue 18488[12]. -Wireshark 4.x.x on Win10-x64 crashes after saving a file with a name already in use. Issue 18679[13]. -NAS-5GS Operator-defined Access Category: Multiple Criteria values not displayed in dissected packet display. Issue 18941[14]. -Server Hello Packet Invisible - during 802.1x Authentication- from Wireshark App Version 4.0.3 (v4.0.3-0-gc552f74cdc23) & above. Issue 19071[15]. -TShark reassembled data is incomplete/truncated. Issue 19107[16]. CQL protocol parsing issues with 'Result' frames from open source Cassandra. Issue 19119[17]. -TLS 1.3 second Key Update doesn't work. Issue 19120[18]. -HTTP2 dissector reports an assertion error on large data frames. Issue 19121[19]. -epan: Single letter hostnames aren't displayed correctly. Issue 19137[20]. -BLF: CAN-FD-Message format is missing a field. Issue 19146[21]. -BLF: last parameter of LIN-Message is not mandatory (BUGFIX) Issue 19147[22]. -PPP IPv6CP: Incorrect payload length warning. Issue 19149[23]. -INSTALL file needs to be updated for Debian. Issue 19167[24]. -Some RTP streams make Wireshark crash when trying to play stream. Issue 19170[25]. -Wrong ordering in OpenFlow 1.0 Datapath unique ID. Issue 19172[26]. -Incorrect mask in RTCP slice picture ID. Issue 19182[27]. -Dissection error in AMQP 1.0. Issue 19191[28]. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* weechat: upgrade 4.0.1 -> 4.0.2Wang Mingyu2023-07-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | Changelog: =========== Bug fixes:: * core: fix renaming of options with command '/item rename' * core: don't send "key_pressed" signal again for the same key press * core: don't send "key_combo_*" signals for incomplete keys * core: add key ctrl-backspace in /help key * core: keep keys ctrl-H and ctrl-? (in lower case) if they were manually bound to custom commands in a previous version Tests:: * core: fix hdata tests failure on Alpine 3.18 * relay: fix crash in tests on Alpine 3.18 Build:: * php: fix detection of PHP 8.2 on Alpine 3.18 Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* libnftnl: upgrade 1.2.5 -> 1.2.6Wang Mingyu2023-07-201-1/+1
| | | | | | | | | | | Changelog: ========= tests: nft-rule-test: Add test cases to improve code coverage tests: nft-table-test: fix typo shixuantong expr: meta: introduce broute meta expression Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* dhcp-relay: Pass cross configure flags to bind buildKhem Raj2023-07-151-1/+8
| | | | | | | | | | | | | This ensures that host tools like 'gen' are built for build host and not target. internal bind build supplies its own options to configuring it, where it does not pass --host option and as a result it does not deduce it to be a cross compile and hence these variables are not set property inside bind build Fixes | ./gen: /usr/lib/libc.so.6: version `GLIBC_2.38' not found (required by ./gen) Signed-off-by: Khem Raj <raj.khem@gmail.com>
* dlm: Do not use -fcf-protection=full on arm platformsKhem Raj2023-07-151-0/+1
| | | | | | Its not supported option Signed-off-by: Khem Raj <raj.khem@gmail.com>
* dlm: Do not pass -fcf-protection=full via MakefileKhem Raj2023-07-152-5/+70
| | | | | | | | | Pass it via cflags from environment, so it can be controlled for platforms where it is not supported Pass -fstack-clash-protection for clang too, it is available now a days Signed-off-by: Khem Raj <raj.khem@gmail.com>
* dlm: Fix build with linux kernel 6.4+Khem Raj2023-07-153-0/+70
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* mdio-tools: Update to latest on trunkKhem Raj2023-07-151-1/+1
| | | | | | This brings fixed for compiling kmod with linux 6.4+ Signed-off-by: Khem Raj <raj.khem@gmail.com>
* dlm: Upgrade to 4.2.0Khem Raj2023-07-133-61/+1
| | | | | | | Drop upstreamed patch and another patch which is fixed differently upstream Signed-off-by: Khem Raj <raj.khem@gmail.com>
* samba: upgrade 4.18.3 -> 4.18.4Yi Zhao2023-07-121-1/+1
| | | | | | | | Release Notes: https://www.samba.org/samba/history/samba-4.18.4.html Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* snort: Add systemd unit fileMingli Yu2023-07-123-2/+31
| | | | | | | | | Add systemd unit file snort.service. Reference: https://salsa.debian.org/lts-team/packages/snort/-/blob/debian/buster/debian/snort.service.example Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* weechat: upgrade 4.0.0 -> 4.0.1Wang Mingyu2023-07-071-1/+1
| | | | | | | | | | | | | | | | | | | Bug fixes ========= * core: force key "return" to command "/input return" when migrating legacy keys * core: display actual key name and command with key kbd:[Alt+k], remove key kbd:[Alt+K] (grab raw key) and associated commands '/input grab_raw_key' and '/input grab_raw_key_command' * core: check for newline characters in string_is_whitespace_char * api: do not convert option name to lower case in API functions config_set_plugin and config_set_desc_plugin * guile: fix crash on quit with Guile < 3 (issue #1965) * irc: reply to a CTCP request sent to self nick (issue #1966) * irc: sent "QUIT" message to servers connected with TLS on '/upgrade' Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* networkmanager: upgrade 1.42.6 -> 1.42.8Petr Gotthard2023-07-051-1/+1
| | | | | | | | | | | | | | | | | | | Changelog: ========== * Add support for ppp 2.5.0. * Fix nft rules for balance-slb bonding. * Support port priority for bonding. * Fix regression handling the PKEY_ID for infiniband profiles in ifcfg-rh format. * Fix race in nm-cloud-setup that caused partial configuration and loss of connectivity with multiple interfaces. * Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly required for IPv6 sharing. * Various bugfixes related to team, Wi-Fi P2P, IPv6LL. * Automatically unblock autoconnect of profiles during reapply. Signed-off-by: Petr Gotthard <petr.gotthard@advantech.cz> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* libcoap: Build linker symbol file explicitlyKhem Raj2023-07-041-0/+6
| | | | | | | | | | | | Since we autoreconf, it should be better to build the linker map file too, which requires ctags during build. This is otherwise flagged as error by lld linker where we specify a linker symbol file on cmdline but the file is not there. Fixes | libtool: error: symbol file './libcoap-3.sym' does not exist Signed-off-by: Khem Raj <raj.khem@gmail.com>
* open-vm-tools: Security fix CVE-2023-20867Yi Zhao2023-06-292-0/+164
| | | | | | | | | | | | | | | | CVE-2023-20867: A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-20867 Patch from: https://github.com/vmware/open-vm-tools/blob/CVE-2023-20867.patch/2023-20867-Remove-some-dead-code.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* mbedtls: upgrade 2.28.2 -> 2.28.3Yi Zhao2023-06-281-1/+7
| | | | | | | | | | | Mbed TLS 2.28 is a long-time support branch. It will be supported with bug-fixes and security fixes until end of 2024. ChangeLog: https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.3 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* frr: upgrade 8.4.2 -> 8.4.4Yi Zhao2023-06-281-1/+1
| | | | | | | | | ChangeLog: https://github.com/FRRouting/frr/releases/tag/frr-8.4.4 https://github.com/FRRouting/frr/commit/45e36c0c00a517ad1606135b18c5753e210cfc0d Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* weechat: upgrade 3.8 -> 4.0.0Wang Mingyu2023-06-271-1/+1
| | | | | | | | Changelog: https://weechat.org/files/doc/weechat/ChangeLog-4.0.0.html Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* openfortivpn: upgrade 1.20.3 -> 1.20.5Wang Mingyu2023-06-271-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* conntrack-tools: add required kernel modules to RRECOMMENDSYi Zhao2023-06-271-0/+4
| | | | | | | | Refer to https://git.netfilter.org/conntrack-tools/tree/INSTALL, add required kernel modules to RRECOMMENDS. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* conntrack-tools: add systemd unit fileYi Zhao2023-06-272-0/+21
| | | | | | | | | Refer to https://salsa.debian.org/pkg-netfilter-team/pkg-conntrack-tools/-/blob/master/debian/conntrackd.service, add systemd unit file conntrackd.service. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* mbedtls: fix builds with crypto extensionsBeniamin Sandu2023-06-263-5/+70
| | | | | Signed-off-by: Beniamin Sandu <beniaminsandu@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* tcpreplay: upgrade 4.4.3 -> 4.4.4Archana Polampalli2023-06-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This release contains bug fixes only. The following CVEs have been addressed: CVE-2023-27783 CVE-2023-27784 CVE-2023-27785 CVE-2023-27786 CVE-2023-27787 CVE-2023-27788 CVE-2023-27789 Changelog: ========= dlt_jnpr_ether_cleanup: check subctx before cleanup by @Marsman1996 in #781 Bug #780 assert tcpedit dlt cleanup by @fklassen in #800 Fix bugs caused by strtok_r by @Marsman1996 in #783 Bug #782 #784 #785 #786 #787 #788 strtok r isuses by @fklassen in #801 Update en10mb.c by @david-guti in #793 PR #793 ip6 unicast flood by @fklassen in #802 Bug #719 fix overflow check for parse_mpls() by @fklassen in #804 PR #793 - update tests for corrected IPv6 MAC by @fklassen in #805 PR #793 - update tests for vlandel by @fklassen in #806 Feature #773 gh actions ci by @fklassen in #807 Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* unbound: add option to build with libeventBeniamin Sandu2023-06-241-1/+2
| | | | | Signed-off-by: Beniamin Sandu <beniaminsandu@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* postfix: remove 2nd Upstream-StatusMartin Jansa2023-06-221-2/+0
| | | | | Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* *.patch: add Upstream-Status to all patchesMartin Jansa2023-06-21120-0/+240
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is new patch-status QA check in oe-core: https://git.openembedded.org/openembedded-core/commit/?id=76a685bfcf927593eac67157762a53259089ea8a This is temporary work around just to hide _many_ warnings from optional patch-status (if you add it to WARN_QA). This just added Upstream-Status: Pending everywhere without actually investigating what's the proper status. This is just to hide current QA warnings and to catch new .patch files being added without Upstream-Status, but the number of Pending patches is now terrible: 5 (26%) meta-xfce 6 (50%) meta-perl 15 (42%) meta-webserver 21 (36%) meta-gnome 25 (57%) meta-filesystems 26 (43%) meta-initramfs 45 (45%) meta-python 47 (55%) meta-multimedia 312 (63%) meta-networking 756 (61%) meta-oe Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* postfix: fix malformed Upstream-StatusMartin Jansa2023-06-212-2/+2
| | | | | Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* mbedtls: add support for v3.xBeniamin Sandu2023-06-191-0/+85
| | | | | | | | | | Version 3.4.0 adds a lot of improvements and fixes (a notable one being initial support for PKCS7 CMS), but since this is a pretty big jump, let's keep both versions for a while, so the v2.x users can upgrade to 3.x in a timely manner if needed. Signed-off-by: Beniamin Sandu <beniaminsandu@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* mdns: remove unneeded headersBeniamin Sandu2023-06-192-0/+34
| | | | | Signed-off-by: Beniamin Sandu <beniaminsandu@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* strongswan: upgrade 5.9.10 -> 5.9.11Wang Mingyu2023-06-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: ========== - A deadlock in the vici plugin has been fixed that could get triggered when multiple connections were initiated/terminated concurrently and control-log events were raised by the watcher_t component. - CRLs have to be signed by a certificate that has the cRLSign keyUsage bit encoded (even if it's a CA), or a CA certificate without keyUsage extension. - Optional CA labels in EST server URIs are supported by `pki --est/estca`. - CMS-style signatures in PKCS#7 containers are supported by the pkcs7 and openssl plugins, which allows verifying RSA-PSS and ECDSA signatures. - Fixed a regression in the server implementation of EAP-TLS with TLS 1.2 or earlier that was introduced with 5.9.10. - Ensure the TLS handshake is complete in the EAP-TLS client with TLS <= 1.2. - kernel-libipsec can process raw ESP packets on Linux (disabled by default) and gained support for trap policies. - The dhcp plugin uses an alternate method to determine the source address for unicast DHCP requests that's not affected by interface filtering. - Certificate and trust chain selection as initiator has been improved in case the local trust chain is incomplete and an unrelated certreq is received. - ECDSA and EdDSA keys in IPSECKEY RRs are supported by the ipseckey plugin. - To bypass tunnel mode SAs/policies, the kernel-wfp plugin installs bypass policies also on the FWPM_SUBLAYER_IPSEC_TUNNEL sublayer. - Stale OCSP responses are now replace in-place in the certificate cache. - Fixed parsing of SCEP server capabilities by `pki --scep/scepca`. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* layers: Move READMEs to markdown formatKhem Raj2023-06-171-0/+0
| | | | | | | The READMEs are often viewed from websites markdown format which is much as readable as text and yet friendlier in browsers. Signed-off-by: Khem Raj <raj.khem@gmail.com>
* ntpd: switch service type from forking to simpleJohannes Kauffmann2023-06-151-3/+2
| | | | | | | | | | | | | | | | | | Type=forking means systemd waits untill the main process, /usr/sbin/ntpd in this case, has exited. However, the ntpd daemon does not seem to call fork() or vfork() and runs endlessly untill killed. Eventually, this causes systemd to trigger a timeout, and the ntpd service is killed. All the while, "systemctl status ntpd" shows "activating (start)" instead of "active (running)". This is fixed by switching Type=forking to Type=simple. Reading ntpd(8) shows that the "-n" option requests ntpd not to fork, so also use that to be safe. Finally, there is no need anymore to keep a pidfile around. Signed-off-by: Johannes Kauffmann <johanneskauffmann@hotmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* open62541: allow disabling subscriptionsJohannes Kauffmann2023-06-141-1/+3
| | | | | | | By default, subscriptions are turned on. Signed-off-by: Johannes Kauffmann <johanneskauffmann@hotmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* open62541: add multithreading PACKAGECONFIG optionJohannes Kauffmann2023-06-141-0/+1
| | | | | | | | By default, open62541 is built without multithreading support. Make this configurable. Signed-off-by: Johannes Kauffmann <johanneskauffmann@hotmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-05 23:19:22 +0000