summaryrefslogtreecommitdiffstats
path: root/meta-networking
Commit message (Collapse)AuthorAgeFilesLines
...
* wolfssl: upgrade 5.3.0 -> 5.4.0wangmy2022-07-261-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* unbound: upgrade 1.16.0 -> 1.16.1wangmy2022-07-261-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* stunnel: upgrade 5.64 -> 5.65wangmy2022-07-262-8/+18
| | | | | | | | | | | | | | | | | fix-openssl-no-des.patch refreshed for version 5.65 Changelog: ========== Security bugfixes OpenSSL DLLs updated to version 3.0.5. Bugfixes Fixed handling globally enabled FIPS. Fixed the default openssl.cnf path in stunnel.exe. Fixed a number of MSVC warnings. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nbdkit: upgrade 1.31.12 -> 1.31.14wangmy2022-07-261-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* ndisc6: upgrade 1.0.5 -> 1.0.6Wang Mingyu2022-07-191-2/+1
| | | | | | | | | | Changelog: ========== # ndisc6: print NAT64 prefix if present. # rdnssd: fix timeout calculation. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nbdkit: upgrade 1.31.10 -> 1.31.12wangmy2022-07-191-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* openflow: ignore unrelated CVEsDavide Gardenal2022-07-151-0/+5
| | | | | | | | CVE-2015-1611 and CVE-2015-1612 are not referred to our implementation of openflow as specified by the NVD database, ignore them. Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* freeradius: ignore patched CVEsDavide Gardenal2022-07-151-0/+5
| | | | | | | | | CVE-2002-0318 and CVE-2011-4966 are both patched in our version of freeradius. The CPE in the NVD database doesn't reflect correctly the vulnerable versions that's why they are incorrectly picked up. Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nftables: Upgrade 1.0.2 -> 1.0.4Alex Kiernan2022-07-123-49/+54
| | | | | | | | | | | | | | | | | Drop backported patch, switch PACKAGECONFIG assignment to ?= (matches current practice), add in editline, linenoise CLI options and xtables option. Switch to --disable-python when building without python to avoid a configure time warning. We can drop UPSTREAM_CHECK_REGEX as the version no longer gets confused by the 0.099 version which exists. Fix buildpaths warning by switching to setuptools and add dependency on ${PN}-python to ${PN}-ptest so that the embedded paths in the compiled python files are correct. Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* openvpn: distribute sample-config-filesAlex Stewart2022-07-081-0/+4
| | | | | | | | | | | | | | | The openvpn tarball has additional sample config files which are generally useful to users, and which are typically distributed in other distros' openvpn packages. Include these sample configs in the OE recipe. Signed-off-by: Bill Pittman <bill.pittman@ni.com> Rebased to openvpn_2.5.7. Signed-off-by: Alex Stewart <alex.stewart@ni.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* firewalld: upgrade 1.1.1 -> 1.2.0Adrian Freihofer2022-07-071-2/+15
| | | | | | | | | | | | | | | | Firewalld: This is a feature release. It also includes all bug fixes since v1.1.0. Details are here: https://firewalld.org/2022/07/firewalld-1-2-0-release Recipe: Firewalld defaults to create a log file for debug messages. This is basically an empty file until firewalld's log level is configured to debug level. Writing log files requies something like log-rotate to prevent full disks. The default for OE is to not create files and send all log messages to syslog (journald). Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* openvpn: add PACKAGECONFIG for selinuxYi Zhao2022-07-071-0/+2
| | | | | | | This is useful for selinux distro feature. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* openvpn: add PACKAGECONFIG for systemdYi Zhao2022-07-074-40/+22
| | | | | | | | The systemd support had been integrated to openvpn for a long time. Add PACKAGECONFIG for it and use its own service files and volatile file. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* openconnect: upgrade 8.20 -> 9.01wangmy2022-07-071-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nbdkit: upgrade 1.31.9 -> 1.31.10wangmy2022-07-071-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* quagga: ignore CVE-2016-4049Davide Gardenal2022-07-061-0/+4
| | | | | | | | | CVE-2016-4049 is not affecting our version, so we can ignore it. This is caused because the CPE in the NVD database doesn't specify a vulnerable version range. Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* spice: ignore patched CVEsDavide Gardenal2022-07-061-0/+6
| | | | | | | | | | | | The following CVEs are already patched so we can ignore them: - CVE-2016-0749 - CVE-2016-2150 - CVE-2018-10893 This is caused by inaccurate CPE in the NVD database. Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* wireshark: upgrade 3.4.11 -> 3.4.12Davide Gardenal2022-07-061-1/+1
| | | | | | | | | | | | | This upgrade includes the following CVE fixes: - CVE-2021-4190 - CVE-2022-0581 - CVE-2022-0582 - CVE-2022-0583 - CVE-2022-0585 - CVE-2022-0586 Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* openflow: ignore CVE-2018-1078Davide Gardenal2022-07-051-0/+4
| | | | | | | | | CVE-2018-1078 is not for openflow but in the NVD database the CVE is for a specific implementation that we don't have so we can ignore it. Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* ntp: ignore many CVEsDavide Gardenal2022-07-051-1/+25
| | | | | | | | | | cve-check is not able to correctly identify many of the patched CVEs because of the non standard version number. All the ignored CVEs were manually checked with the NVD database and deemed not applicable to the current version. Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* usrsctp: add CVE_VERSION to correctly check for CVEsDavide Gardenal2022-07-051-0/+2
| | | | | | | | | | | The current version of usrsctp is not a release so cve-check is not able to find the product version. CVE_VERSION is now set to 0.9.3.0 that is the nearest version in the past starting from the revision we have. This is done because we don't have the complete 0.9.4.0 release. Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* crda: Depend on correct wireless-regdb packageTheodore A. Roth2022-07-021-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The cdra application is looking for the `regulatory.bin` file that is installed by the `wireless-regdb` package, but that is not installed because the RDEPENDS lists`wireless-regdb-static` (which conflicts with `wireless-regdb`). Changing RDEPENDS to use `wireless-regdb` instead of `wireless-regdb-static` allows the cdra application to function properly. Example output before this fix was applied: root@yocto:~# COUNTRY=US crda failed to open db file: No such file or directory root@yocto:~# COUNTRY=US strace crda execve("/usr/sbin/crda", ["crda"], 0xbec80d70 /* 17 vars */) = 0 ... openat(AT_FDCWD, "/usr/local/lib/crda/regulatory.bin", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/usr/lib/crda/regulatory.bin", O_RDONLY) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/lib/crda/regulatory.bin", O_RDONLY) = -1 ENOENT (No such file or directory) ... write(3, "failed to open db file: No such "..., 50failed to open db file: No such file or directory ) = 50 close(3) = 0 exit_group(-2) = ? +++ exited with 254 +++ Signed-off-by: Theodore A. Roth <theodore_roth@trimble.com> Signed-off-by: Theodore A. Roth <troth@openavr.org> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* freeradius: mutlilib fixesJeremy Puhlman2022-07-021-13/+21
| | | | | | | Define raddbdir based on multilib Add multilib headers and scripts for conflicting content Signed-off-by: Khem Raj <raj.khem@gmail.com>
* strongswan: upgrade 5.9.5 -> 5.9.6Yi Zhao2022-07-023-94/+33
| | | | | | | | | | | | | * Drop backport patch 0001-openssl-Don-t-unload-providers.patch * Backport a patch to fix the build error: src/libstrongswan/utils/enum.c: In function 'enum_flags_to_string': src/libstrongswan/utils/enum.c:100:9: error: format not a string literal and no format arguments [-Werror=format-security] 100 | if (snprintf(buf, len, e->names[0]) >= len) | ^~ Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* networkmanager: fix build with enabled pppJavier Viguera2022-07-021-1/+1
| | | | | | | | | | | | | | | | | If 'ppp' packageconfig option is enabled, but the build system does NOT have pppd binary installed, the build fails with: | Has header "pppd/pppd.h" : YES | Program pppd /sbin/pppd /usr/sbin/pppd found: NO | | ../NetworkManager-1.36.2/meson.build:570:4: ERROR: Assert failed: pppd required but not found, please provide a valid pppd path or use -Dppp=false to disable it This is due to meson trying to look for the 'pppd' binary in the build system when it should not. If the build system does not contain pppd, the build fails. Signed-off-by: Javier Viguera <javier.viguera@digi.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nbdkit: upgrade 1.31.8 -> 1.31.9wangmy2022-07-021-2/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* chrony: create /var/lib/chrony by systemd-tmpfilesChangqing Li2022-06-301-0/+4
| | | | | | | | | Ensure /var/lib/chrony exist to avoid error like: chronyd.service: Failed to set up mount namespacing: /run/systemd/unit-root/var/lib/chrony: No such> chronyd.service: Failed at step NAMESPACE spawning /usr/sbin/chronyd: No such file or directory Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* dnsmasq: Security fix CVE-2022-0934Yi Zhao2022-06-302-0/+192
| | | | | | | | | | | | | | CVE-2022-0934: Heap use after free in dhcp6_no_relay Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-0934 Patch from: https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=03345ecefe Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* lldpd: upgrade 1.0.8 -> 1.0.14Harshal2022-06-301-2/+1
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* blueman: fix typo for RRECOMMENDSYi Zhao2022-06-301-1/+1
| | | | | | | RRECOMENDS_${PN} -> RRECOMMENDS:${PN} Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* snort: upgrade 2.9.19 -> 2.9.20wangmy2022-06-301-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: ========== * src/dynamic-preprocessors/appid/service_plugins/service_ssl.c : Fixed a scenario where SSL traffic was not detected correctly. * src/dynamic-preprocessors/smtp/snort_smtp.c : Fixed a possible memory corruption. * src/dynamic-preprocessors/imap/imap_util.c src/dynamic-preprocessors/pop/pop_util.c src/dynamic-preprocessors/smtp/smtp_util.c src/preprocessors/spp_httpinspect.c : Fixed malformed packet debug engine output. * src/preprocessors/Stream6/snort_stream_tcp.c : Fixed security zones info in intrusion events. * src/dynamic-preprocessors/appid/fw_appid.c : Fixed URL lookup failure. * src/preprocessors/HttpInspect/server/hi_server.c : Fixed a possible memory leak. * src/dynamic-preprocessors/appid/detector_plugins/detector_dns.c src/dynamic-preprocessors/appid/fw_appid.c src/dynamic-preprocessors/appid/fw_appid.h src/dynamic-preprocessors/appid/detector_plugins/service_plugins/service_api.h : Added support for dns root queries and underflow. * src/dynamic-preprocessors/smtp/snort_smtp.c src/Makefile.am src/dynamic-examples/Makefile.am src/dynamic-plugins/sf_dynamic_plugins.c src/dynamic-plugins/sf_dynamic_preprocessor.h src/dynamic-preprocessors/Makefile.am src/dynamic-preprocessors/smtp/snort_smtp.h src/dynamic-preprocessors/smtp/spp_smtp.c src/smtp_api.h : Added support to get extra data from SMTP and HTTP into IPS event. * src/dynamic-preprocessors/appid/detector_plugins/detector_imap.c src/dynamic-preprocessors/appid/detector_plugins/detector_pop3.c : Added support for login success and failure eventing for IMAP and POP3. * src/dynamic-preprocessors/appid/hi_server.c : Added support to handle empty string for SNI/CN/SAN/ORG. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* rdma-core: upgrade 40.0 -> 41.0wangmy2022-06-301-1/+1
| | | | | | | | | | | | | | | | | | Changelog: ========= Merge pull request #1178 from yishaih/mlx5_misc mlx5: Fix check for SQ overflow in bind_mw mlx5: DR, Add support for modify IP ECN action for CX7 Merge pull request #1175 from zhijianli88/print-style Merge pull request #1176 from EdwardSro/pr-extend-wqe-class Merge pull request #1174 from EdwardSro/pr-pyverbs-read-write Merge pull request #1170 from Hakon-Bugge/rdma_xserver_xclient Merge pull request #1166 from EdwardSro/pr-tests-fixes pyverbs/mr.pyx: Make MR and MW print style identical pyverbs: Extend segments format of WQE class Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* netserver: don't change permissions on /dev/nullAshish Sharma2022-06-302-0/+30
| | | | | | | | | | | | | | Source: MontaVista Software, LLC MR: 117141 Type: Defect Fix Disposition: Backport from [https://github.com/HewlettPackard/netperf/pull/27/commits/78c9ae7d9a6735575bc72dd28a19b2bc3a251981] ChangeID: 199f8618971de15d177dab9651f82f5696ff1aa1 Description: the (now default) suppress_debug=1 changes permissions on /dev/null to 0644. Don't do this. Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* openvpn: eliminate build path from openvpn --version optionYi Zhao2022-06-302-0/+49
| | | | | | | | | | | | | | | | | | | | | | | | Before the patch: $ openvpn --version OpenVPN 2.5.7 x86_64-poky-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [snip] Compile time defines: enable_async_push=no enable_comp_stub=no [snip] with_crypto_library=openssl with_gnu_ld=yes with_libtool_sysroot=/buildarea/build/tmp/work/core2-64-poky-linux/openvpn/2.5.7-r0/recipe-sysroot with_mem_check=no with_openssl_engine=auto After the patch: $ openvpn --version OpenVPN 2.5.7 x86_64-poky-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [snip] Compile time defines: enable_async_push=no enable_comp_stub=no [snip] with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_openssl_engine=auto Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nbdkit: upgrade 1.31.7 -> 1.31.8wangmy2022-06-301-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* libnftnl: upgrade 1.2.1 -> 1.2.2wangmy2022-06-301-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* kronosnet: Fix build with gcc-12Mingli Yu2022-06-302-0/+41
| | | | | | | | | | | | | | | | | | | Fix the build failure when debug build is enabled. Add DEBUG_BUILD = "1" in conf/local.conf. $ bitbake kronosnet | /build/tmp-glibc/work/corei7-64-wrs-linux/kronosnet/1.22-r0/recipe-sysroot/usr/include/bits/string_fortified.h:59:10: error: 'link' may be used uninitialized [-Werror=maybe-uninitialized] | 59 | return __builtin___memset_chk (__dest, __ch, __len, | | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | 60 | __glibc_objsize0 (__dest)); | | ~~~~~~~~~~~~~~~~~~~~~~~~~~ | ../../git/libknet/links.c: In function 'knet_link_set_config': | ../../git/libknet/links.c:108:27: note: 'link' was declared here | 108 | struct knet_link *link; | | ^~~~ | cc1: all warnings being treated as errors Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* firewalld: update to 1.1.1 fixes ptestAdrian Freihofer2022-06-303-92/+318
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Update firewalld by 2 major versions, which also includes breaking and behavioral changes. Highlights from 0.9 to 1.0: - Reduced dependencies - Intra-zone forwarding by default - NAT rules moved to inet family (reduced rule set) - Default target is now similar to reject - ICMP blocks and block inversion only apply to input, not forward - tftp-client service has been removed - iptables backend is deprecated - Direct interface is deprecated - CleanupModulesOnExit defaults to no (kernel modules not unloaded) Details: - https://firewalld.org/2021/07/firewalld-1-0-0-release - https://github.com/firewalld/firewalld/compare/v0.9.0...v1.0.0 From 1.0 to 1.1 is mostly a bug fix release update. Details: - https://firewalld.org/2022/02/firewalld-1-1-0-release - https://github.com/firewalld/firewalld/compare/v0.9.0...v1.0.0 Improvements on the recipe: - Add ptest - Very helpful to get all the kernel modules - Long running, probably not suitable for any OE autobuilder - RRECOMMENS kernel modules, document configuration - Improve package splitting - firewalld-config and firewalld-applet depend on QT5, pyqt5 and GTK. The dependencies were not correctly set but the code was ending up on the target device. Now the code gets into a separate package but the dependeinces are probably still not complete. Since this is probably not used anyway it is not tested yet. It's still not perfect but much better than installing broken stuff to the target device. - The dependenices are added to variables instead of rdepends to keep the meta-qt5 and gnome layers optional also at build-time. - New packageconfigs: ebtables, ipset. This is mosly required to get the test suite running but probably also usable otherwise. Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* networkmanager: udpate to 1.38.0Adrian Freihofer2022-06-062-36/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add support for route type "throw". * Fix bug setting priority for IP addresses. * Static IPv6 addresses from "ipv6.addresses" are now preferred over addresses from DHCPv6, which are preferred over addresses from autoconf. This affects IPv6 source address selection, if the rules from RFC 6724, section 5 don't give a exhaustive match. * Static IPv6 addresses from "ipv6.addresses" are now interpreted with first address being preferred. Their order got inverted. This is now consistent with IPv4. * Wi-Fi hotspots will use a (stable) random channel number unless one is chosen manually. * Don't use unsupported SAE/WPA3 mode for AP mode. * NetworkManager will no longer advertise frequencies as supported when they're disallowed in configured regulatory domain. * Attempt to connect to WEP-encrypted Wi-Fi network will now fail gracefully with a recent version of wpa_supplicant when built without WEP support. As long as wpa_supplicant supports WEP, NetworkManager will continue to work. * Disable WPA3 transition mode for wifi.key-mgmt=wpa-psk if the NIC does not support PMF. This is known to cause problems in some setups. It is still possible to explicitly configure wifi.key-mgmt=sae for WPA3. * Add new dummy crypto backend "null" that does nothing. NetworkManager uses the crypto library when handling certificates for 802.1x profiles. * Veth devices with name "eth*" are now managed by default via the udev rule. This is to support managing the network in LXD containers. * The hostname received from DHCP is now shortened to the first dot (or to 64 characters, whatever comes first) if it's too long. * As the insecure WEP encryption for Wi-Fi network is phased out, nmcli now discourages its use when activating or modifying a profile. * Fix connectivity checks in case the check endpoint address resolves to multiple addresses. * Workaround libcurl blocking NetworkManager while resolving DNS names. * nmcli: indicate missing Wi-Fi hardware when showing rfkill setting. * nmcli: add connection migrate command to move a profile to a specified settings plugin. This allows to convert profiles in the deprecated ifcfg-rh format to keyfile. * Set "src" attribute for routes from DHCPv4 to the leased address. This helps with source address selection. * Updated translations. * Various bugfixes and internal improvements. Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* networkmanager: use nftables by defaultAdrian Freihofer2022-06-061-1/+5
| | | | | | | | | | | | | | | | From NEWS file of netowrkmanager 1.32: firewall: add nftables firewall backend for configuring IPv4 NAT with shared mode. Now two backends are supported, "iptables" and "nftables". The default gets detected based on whether /usr/sbin/nft or /usr/sbin/iptables is installed, with nftables preferred. With this change nftables is not the prefered backend also with OE. But it's still possible to set NETWORKMANAGER_FIREWALL_DEFAULT back to iptables. Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* networkmanager: simplify selective installationAdrian Freihofer2022-06-061-42/+73
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The main motivation for this rework is to support compiling the NetworkManager with many plugins, but to install only a few of them in a firmware image. This is advantageous when different products with different network interfaces should be supported by only one binary distribution. This is more in line with the way NetworkManager is designed and used by other binary Linux distributions. Basically this is already supported since the last rework of the networkmanager recipe. However, the rrecomments from networkmanager to all available plugins is not straight forward to be used in such a scenario. Installing only a subset of the compiled plugins required to override the rrecommends from networkmanager to the plugins in some way. To simplify the usage the networkmanager package is now an empty meta package and networkmanager itself gets moved to a new networkmanager-daemon package. This allows to keep backward compatibility: Installing the networkmanager package still adds all compiled plugins to the firmware. But with the new package splitting it's also possible to install for example only the networkmanager-wifi but not the networkmanager-wwan package even if networkamanger has been compiled with the modemmanager PACAKGECONFIG flag enabled as well. The relation from plugins to services is now a stronger rdepends which reflects better how NetworkManager is supposed to be used. If a plugin is installed but the required service is not the plugin periodically tries to connect to the service and reports error messages to the syslog if the service is not available. Therefore it's better to make the installation of the plugin optional but not the installation of the services. The bash-completion package adds support for the nmcli command line utility. This change also moves the bash completion configuration to a new package networkmanager-nmcli-bash-completion. This is more consistent anyway but gets even more important when the networkmanager package gets optional. To simplify the usage of all these packages a SUMMARY:${PN}-.. for each packages has been added. The separation of the doc packages has been removed. Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* networkmanager: improve dependency handlingAdrian Freihofer2022-06-061-2/+17
| | | | | | | | | | Plugins of networkmanager redpends on related services. If for example modemmanager or wpa-supplicant is not installed but the related networkmanager plugin is, the plugin writes error messages to the syslog. Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* unbound: upgrade 1.15.0 -> 1.16.0Wang Mingyu2022-06-061-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: ========== This release has EDE support, for extended EDNS error reporting, it fixes unsupported ZONEMD algorithms to load, and has more bug fixes. The EDE errors can be turned on by 'ede: yes', it is default disabled. Validation errors and other errors are then reported. If you also want stale answers for expired responses to have an error code, the option 'ede-serve-expired: yes' can be used. Features - Merge PR #604: Add basic support for EDE (RFC8914). Bug Fixes - Fix #412: cache invalidation issue with CNAME+A. - Fix that TCP interface does not use TLS when TLS is also configured. - Fix #624: Unable to stop Unbound in Windows console (does not respond to CTRL+C command). - Fix #618: enabling interface-automatic disables DNS-over-TLS. Adds the option to list interface-automatic-ports. - Remove debug info from #618 fix. - Fix #628: A rpz-passthru action is not ending RPZ zone processing. - Fix for #628: fix rpz-passthru for qname trigger by localzone type. - Fix that address not available is squelched from the logs for udp connect failures. It is visible on verbosity 4 and more. - Merge #631 from mollyim: Replace OpenSSL's ERR_PACK with ERR_GET_REASON. - Fix to detect that no IPv6 support means that IPv6 addresses are useless for delegation point lookups. - update Makefile dependencies. - Fix check interface existence for support detection in remote lookup. - Fix #633: Document unix domain socket support for unbound-control. - Fix for #633: updated fix with new text. - Fix edns client subnet to add the option based on the option list, so that it is not state dependent, after the state fix of #605 for double EDNS options. - Fix for edns client subnet option add fix in removal code, from review. - Fix #630: Unify the RPZ log messages. - Merge #623 from rex4539: Fix typos. - Fix pythonmod for change in iter_dp_is_useless function prototype. - Fix compile warnings for printf ll format on mingw compile. - Merge PR #632 from scottrw93: Match cnames in ipset. - Various fixes for #632: variable initialisation, convert the qinfo to str once, accept trailing dot in the local-zone ipset option. - Fix #637: Integer Overflow in sldns_str2period function. - Fix for #637: fix integer overflow checks in sldns_str2period. - Fix configure for python to use sysutils, because distutils is deprecated. It uses sysutils when available, distutils otherwise. - Merge #644: Make 'install-lib' make target install the pkg-config file. - Fix to ensure uniform handling of spaces and tabs when parsing RRs. - Fix to describe auth-zone and other configuration at the local-zone configuration option, to allow for more broadly view of the options. - Merge PR #648 from eaglegai: fix -q doesn't work when use with 'unbound-control stats_shm'. - Fix #651: [FR] Better logging for refused queries. - Fix spelling error in comment in sldns_str2wire_svcparam_key_lookup. - Fix zonemd check to allow unsupported algorithms to load. If there are only unsupported algorithms, or unsupported schemes, and no failed or successful other ZONEMD records, or malformed or bad ZONEMD records, the unsupported records allow the zone load. - Fix zonemd unsupported algo check. - Fix zonemd unsupported algo check reason to not copy to next record, and check for success for debug printout. - Fix zonemd unsupported algo check to print unsupported reason before zeroing it. - Fix zonemd unsupported algo check to set reason to NULL before the check routine, but after malformed checks, to get the correct NULL output when the digest matches. - Fix #670: SERVFAIL problems with unbound 1.15.0 running on OpenBSD 7.1. - Fix Python build in non-source directory; based on patch by Michael Tokarev. - Fix #673: DNS over TLS: error: SSL_handshake syscall: No route to host. - Merge #677: Allow using system certificates not only on Windows, from pemensik. - For #677: Added tls-system-cert to config parser and documentation. - Fix #417: prefetch and ECS causing cache corruption when used together. - Fix #678: [FR] modify behaviour of unbound-control rpz_enable zone, by updating unbound-control's documentation. - Fix typos in config_set_option for the 'num-threads' and 'ede-serve-expired' options. - Fix to silence test for ede error output to the console from the test setup script. - Fix ede test to not use default pidfile, and use local interface. - Fix some lint type warnings. - Fix #684: [FTBS] configure script error with libmnl on openSUSE 15.3 (and possibly other distributions) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* tgt: upgrade 1.0.82 -> 1.0.83Wang Mingyu2022-06-061-2/+2
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* openvpn: upgrade 2.5.6 -> 2.5.7Wang Mingyu2022-06-061-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: ========= networking: use OPENVPN_ETH_ALEN instead of ETH_ALEN networking_iproute2: don't pass M_WARN to openvpn_execve_check() t_net.sh: delete dummy iface using iproute command auth-pam.c: add missing include limits.h Add insecure tls-cert-profile options Refactor early initialisation and uninitialisation into methods Allow loading of non default providers Add ubuntu 22.04 to Github Actions Add macos OpenSSL 3.0 and ASAN builds Add --with-openssl-engine autoconf option (auto|yes|no) Fix allowing/showing unsupported ciphers and digests Remove dependency on BF-CBC existance from test_ncp Add message when decoding PKCS12 file fails. Translate OpenSSL 3.0 digest names to OpenSSL 1.1 digest names Fix client-pending-auth error message to say ERROR instead of SUCCESS Preparing release 2.5.7 cipher-negotiation.rst missing from doc/Makefile.am vcpkg-ports\pkcs11-helper: shorten patch filename msvc: adjust build options to harden binaries vcpkg-ports: remove openssl port vcpkg: switch to manifest Fix M_ERRNO behavior on Windows vcpkg-ports/pkcs11-helper: bump to release 1.29 tapctl: Resolve MSVC C4996 warnings Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* tinyproxy: upgrade 1.11.0 -> 1.11.1Wang Mingyu2022-06-062-4/+3
| | | | | | | | | | Refresh disable-documentation.patch for new version. Changelog: Fixes issues detected in 1.11.0, add new fnmatch based filtertype. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* conntrack-tools: fix postinst scriptAdrian Freihofer2022-05-281-0/+1
| | | | | | | | | | | | | | Fix error caused by postinst script of conntrack-tools: do_rootfs: Postinstall scriptlets of ['conntrack-tools'] have failed... Configuring ... rootfs//var/lib/opkg/info/conntrack-tools.postinst: line 2: setcap: command not found conntrack-tools.postinst returned 127, marking as unpacked only... Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nbdkit: upgrade 1.31.5 -> 1.31.7Wang Mingyu2022-05-241-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* babeld: upgrade 1.12 -> 1.12.1Wang Mingyu2022-05-241-1/+1
| | | | | | | | | | | 18 May 2022: babeld-1.12.1 * Implement separate PC values for unicast and multicast, which avoids dropping packets protected by MAC when WiFi powersave is active. * Schedule an interface check just after adding an interface. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nbd: update 3.20 -> 3.24Thomas Perrot2022-05-242-4/+6
| | | | | Signed-off-by: Thomas Perrot <thomas.perrot@bootlin.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-04 19:46:04 +0000