The original SRC_URI's certificate has expired - change it to a working URL.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit a1baa1c027cba6ba86d92b4ad5c2db0b7bba0d1f)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-25066
The vulnerable code was introduced in version 4.12[1], and
the recipe version is not vulnerable yet. Due to this,
ignore this CVE.
[1]: b9348e9d6e
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The https link does not work anymore, it just refuses the connection.
http still works though.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 8cab2b2977f7cfbbf7bf1aa617070163e2eaf002)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The https link does not work anymore, it just refuses the connection.
http still works though.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 8da9f2fea2e4c2f525e9357814f21b70669b8d8b)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-2312
Pick the patch that is referenced by the NVD report.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Drop 0001-snprintf-Add-math.h-to-ensure-isnan-and-isinf-are-de.patch and
v1-0001-Make-time-calculations-always-long-long.patch as those were merged upstream.
Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 7fb4910ccb6a156bf67eb773ff1b421b30536b58)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Code maintenance / Compat changes
---------------------------------
- adapt to new "encrypt-then-mac" cipher suites in OpenSSL 3.6.0 - these
need special handling which we don't do, so the t_lpback self-test
failed on them. Exclude from list of allowed ciphers, as there is no
strong reason today to make OpenVPN use these.
- fix various compile-time warnings
Documentation updates
---------------------
- fix outdated and non-HTTPS URLs throughout the tree (doxygen, warnings,
manpage, ...)
Bugfixes
--------
- Fix memcmp check for the hmac verification in the 3way handshake.
This bug renders the HMAC based protection against state exhaustion on
receiving spoofed TLS handshake packets in the OpenVPN server inefficient.
CVE: 2025-13086
- fix invalid pointer creation in tls_pre_decrypt() - technically this is
a memory over-read issue, in practice, the compilers optimize it away
so no negative effects could be observed.
- Windows: in the interactive service, fix the "undo DNS config" handling.
- Windows: in the interactive service, disallow using of "stdin" for the
config file, unless the caller is authorized OpenVPN Administrator
- Windows: in the interactive service, change all netsh calls to use
interface index and not interface name - sidesteps all possible attack
avenues with special characters in interface names.
- Windows: in the interactive service, improve error handling in
some "unlikely to happen" paths.
- auth plugin/script handling: properly check for errors in creation on
$auth_failed_reason_file (arf).
- for incoming TCP connections, close-on-exec option was applied to
the wrong socket fd, leaking socket FDs to child processes.
- sitnl: set close-on-exec flag on netlink socket
- ssl_mbedtls: fix missing perf_pop() call (optional performance profiling)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 351ac662131944f4c40ea8410a0077cc715053a2)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
==========
- Implement support for CURLOPT_CAINFO_BLOB
- Added support for CURLOPT_SSLCERT_BLOB
- Refactor: Pass std::string_view by value instead of by const reference
- Add connection pool option (V3)
- fix: Calling empty callbacks
- fix: callback function pointer type mismatch in writeFunction
- 1.12.0 CI Fixes
- fix: Cmake config file
- fix: make is_same_v check constexpr in set_option_internal
- cpr::MultiPerform fixes - #1047 and #1186
- Bump actions/setup-python from 5 to 6
- Bump actions/checkout from 3 to 5
- Allow disabling PSL
- Make curl dependency management optional
- curl_container: allow calling GetContent without CurlHolder
- Bump stefanzweifel/git-auto-commit-action from 6 to 7
- Bump actions/upload-artifact from 4 to 5
- Bump actions/setup-python from 1 to 5
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Since commit 3200122d68 (chrony: create /var/lib/chrony by systemd-tmpfiles)
tmpfiles.d mechanism already ensures populating /var/lib/chrony at runtime.
Introduce volatiles mechanism to make sure the directory is created
at runtime for sysvinit as well.
Since /var/lib/chrony is populated at runtime, stop packaging at build time.
this helps to align towards stateless system expectations
or when updates are done via meta-updater.
Signed-off-by: Vishwas Udupa <vudupa@qti.qualcomm.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The libtalloc recipe did not properly populate the pytalloc package
because pytalloc was listed after the main libtalloc package in the
PACKAGES variable. As a result, the pytalloc package contained only
talloc.so and was missing other required files.
Signed-off-by: Moraless Philius <moraless.philius5@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Inherit sourceforge-releases class to check the correct latest stable
verison.
Before the patch:
$ devtool latest-version tunctl
INFO: Current version: 1.5
INFO: Latest version:
After the patch:
$ devtool latest-version tunctl
INFO: Current version: 1.5
INFO: Latest version: 1.5
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Inherit sourceforge-releases class to check the correct latest stable
verison.
Before the patch:
$ devtool latest-version openipmi
INFO: Current version: 2.0.36
INFO: Latest version:
After the patch:
$ devtool latest-version openipmi
INFO: Current version: 2.0.36
INFO: Latest version: 2.0.37
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Inherit sourceforge-releases class to check the correct latest stable
verison.
Before the patch:
$ devtool latest-version netcat
INFO: Current version: 0.7.1
INFO: Latest version:
After the patch:
$ devtool latest-version netcat
INFO: Current version: 0.7.1
INFO: Latest version: 0.7.1
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Source branch was renamed from master to main.
Drop patch that was incorporated in this release.
Changelog:
Use GitHub actions for CI
Allow to manually define CPUs for trafgen
Fix make install and output netsniff-ng stats on stderr
trafgen: Fix for ipv6 header generation when L3-only devices are present
mausezahn: use getopt_long instead of getopt
build: fix install dependencies in Makefile template
trafgen: move cpu stats temp file to /tmp
ring_tx: handle EINTR from sendto
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
1.Fix following dovecot.service starting error.
dovecot[364]: doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf line 48: cert_file: open(/etc/dovecot/ssl-cert.pem) failed: No such file or directory
systemd[1]: dovecot.service: Main process exited, code=exited, status=89/n/a
systemd[1]: dovecot.service: Failed with result 'exit-code'.
2. There is no need to do "touch ${D}/etc/dovecot/dovecot.conf" as it was created by dovecot after dovecot was upgraded to 2.4.1-4.
Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
mctp-2.4 was released. It includes a previously submitted patch,
so drop that.
Signed-off-by: Patrick Williams <patrick@stwcx.xyz>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
0001-Fix-compilation-with-musl.patch is obsolete due to
948ecf8 ("hash: include util.h for MIN macro") included in chrony since
version 3.5.
From chrony's NEWS [1] for the 4.8 release:
Enhancements
------------
* Add maxunreach option to limit selection of unreachable sources
* Add -u option to chronyc to drop root privileges (default chronyc user
is set by configure script)
Bug fixes
---------
* Hide chronyc socket to mitigate unsafe permissions change
* Fix refclock extpps option to work on Linux >= 6.15
* Validate refclock samples for reachability updates
[1] https://chrony-project.org/news.html
Signed-off-by: Bastian Krause <bst@pengutronix.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Major Changes in 0.16:
Added
Added DMA-BUF encoder support for GStreamer 1.24+
Implemented hardware-accelerated encoding for Intel GPUs
Added environment variable SPICE_CONVERTER_PREFERRED_FORMAT to override converter format
Multi-plane GL scanout support (new spice_qxl_gl_scanout2())
Changed
Improved memslot to preserve address bits for ARM64 TBI/AMD UAI/Intel LAM
Optimized BGR24/BGRX32 conversion when JCS_EXTENSIONS is defined
Removed GStreamer 0.10 support
Send real time to client, instead of synchronizing on both ends, attempting to fix latency issue
Fixes
Fixes a GL_DRAW cookie assertion race
Add SSL_OP_NO_RENEGOTIATION fallback path, fixing w/LibreSSL 3.7.2 builds
Fix Win32 builds
Fix TCP_NOPUSH usage on Darwin
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Major changes in 0.14.5
=======================
* Add SPICE_MSG_DISPLAY_GL_SCANOUT2_UNIX
* Fix for Windows Arm64 build
Signed-off-by: Khem Raj <raj.khem@gmail.com>
I removed the CVE_STATUS setting for CVE-2016-4983 when this recipe was
updated to 2.4.1-4 - but that was a mistake, the CVE database considers
(incorrectly) even the latest version as vulnerable.
Revert that mistake by adding back the correct CVE_STATUS to the recipe.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
