Note, hostapd and wpa_supplicant use the same sources. This commit is based
on Ross Burton's change to OpenEmbedded-core. Below is Ross's commit message
from OpenEmbedded-Core.
WPA2 is vulnerable to replay attacks which result in unauthenticated users
having access to the network.
* CVE-2017-13077: reinstallation of the pairwise key in the Four-way handshake
* CVE-2017-13078: reinstallation of the group key in the Four-way handshake
* CVE-2017-13079: reinstallation of the integrity group key in the Four-way
handshake
* CVE-2017-13080: reinstallation of the group key in the Group Key handshake
* CVE-2017-13081: reinstallation of the integrity group key in the Group Key
handshake
* CVE-2017-13082: accepting a retransmitted Fast BSS Transition Reassociation
Request and reinstalling the pairwise key while processing it
* CVE-2017-13086: reinstallation of the Tunneled Direct-Link Setup (TDLS)
PeerKey (TPK) key in the TDLS handshake
* CVE-2017-13087: reinstallation of the group key (GTK) when processing a
Wireless Network Management (WNM) Sleep Mode Response frame
* CVE-2017-13088: reinstallation of the integrity group key (IGTK) when
processing a Wireless Network Management (WNM) Sleep Mode Response frame
Backport patches from upstream to resolve these CVEs.
Signed-off-by: Ross Burton <ross.burton@intel.com>
The hunk:
[PATCH 7/8] WNM: Ignore WNM-Sleep Mode Response without pending request
does not apply to hostapd and was removed from the patch.
Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to
have unspecified impact via vectors involving automatic deletion of
security contexts on error.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2017-11462
Upstream patch:
56f7b1bc95
Signed-off-by: Catalin Enache <catalin.enache@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Use '${COMMON_LICENSE_DIR}/MIT' for MIT License to fix the warning:
| WARNING: packagegroup-xfce-base-1.0-r5 do_populate_lic:
${COREBASE}/LICENSE is not a valid license file, please use
'${COMMON_LICENSE_DIR}/MIT' for a MIT License file in LIC_FILES_CHKSUM.
This will become an error in the future
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
7b7c15c build: Include check for xxd binary when in maintainer-mode
Signed-off-by: Ankit Navik <ankit.tarot@gmail.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
The libraries can also be build for native and nativesdk.
This is useful for running tests on the build machine.
Signed-off-by: Pascal Bach <pascal.bach@siemens.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
mtp-tools is a 'rename' of the ${PN}-bin, so it should not be in the
PACKAGES value. If it is, it will result in either an error during packaging
or an indeterminate package.
Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
DEBUG: Executing shell function BUILDSPEC
| error: line 109: %package -n mtp-tools: package mtp-tools already exists
Yes, there are two entries in libmtp.spec. Under packages-split, mtp-tools is empty but
libmtp-bin is not.
Removed PKG_${PN}-bin , this alignes how Debian split its packages
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
The following improvements have been made over the recipe that was in
meta-intel-iot-middleware (a layer which is no longer actively
maintained):
* Upgrade to 1.2.0. The version number being used previously (3.1) was
bogus - I guess someone saw that it supported the MQTT *protocol*
version 3.1 and assumed that was the library version. Since we are
renaming it to paho-mqtt-c at the same time to distinguish it from
other Eclipse Paho MQTT library flavours, we don't need to bump PE.
* Fix SRC_URI since the repository has been moved
* Fix "No GNU_HASH in the elf binary" QA error
* Add notice.html and about.html to LIC_FILES_CHKSUM since they cover
licensing
* Add description, Signed-off-by and Upstream-Status to makefile.patch
* Set short description in SUMMARY
* Drop unnecessary custom do_compile - the default implementation
basically does the same thing
* Drop RDEPENDS on openssl - linking already ensures runtime
dependencies get set correctly
* Move DEPENDS further up
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
The following improvements have been made over the recipe that was in
meta-intel-iot-middleware (a layer which is no longer actively
maintained):
* Upgrade to 1.4.14
* Use correct LICENSE value (license changed back in version 1.4)
* Add files containing the actual license terms to LIC_FILES_CHKSUM
* Make optional dependencies optional through PACKAGECONFIG (c-ares
dependency now defaults to disabled)
* Use ${prefix} instead of /usr
* Drop python package since the python client was removed in 1.4
* SUMMARY and DESCRIPTION now reflect that it also supports MQTT 3.1.1
* Add brief description and Upstream-Status to build.patch
* Drop PR = "r0"
* Drop unnecessary setting of FILES_${PN}-staticdev since the default
already includes this file
* Move SRC_URI checksums next to SRC_URI
* Move inherit of systemd further up
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* as PNBLACKLIST message says, these recipes are blacklisted for long
time and nobody showed any interest to fix them
* remove all unused .patch and .inc files as well
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Disable perl explicitly, it pokes into host
its better to disable it.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
meta-openembedded commit eb8994f44a080d9c7fd2c87b6b6935ad0a55eb27 added
iproute2 append to enable tipc PACKAGECONFIG that install libmnl
package. libmnl recipe is in meta-networking layer and this layer
needs to be added to bblayers.conf file to build libmnl. Move
iproute2 append to meta-networking to allow build iproute2 without add
meta-networking layer to bblayers.conf.
Signed-off-by: Fabio Berton <fabio.berton@ossystems.com.br>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
The tipcutils 2.2 removed the tipc-config tool and recommended to use
the new configuration tool named "tipc" in iproute2 package for
configuring the tipc, which utilizes the new tipc netlink kernel API.
We supported tipc in iproute2 with PACKAGECONFIG in oe-core commit
944ef0de241de77429ab0e5cb1dd4a7f355cf3fd
Add iproute2 bbappend to enable tipc for tipcutils.
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
When building openobex on a host without any connection to outside,
the configure fails as it tries to get some url from outside to build
the documentation.
Fix this problem by disabling building documentation.
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* remove recipes which support only bluez4 and are blacklisted when
bluez5 is selected in DISTRO_FEATURES, if someone is still using
bluez4, then it can be restored in separate meta-bluez4 and
maintained by people using it.
* there are few recipes which support both bluez5 or bluez4 based on
selected DISTRO_FEATURES, these can stay in meta-oe repository, but
now people without bluez5 in DISTRO_FEATURES will need to add
meta-bluez4 layer to satisfy bluez4 dependency
meta-gnome/recipes-connectivity/obex/obexd_0.48.bb:DEPENDS += "${@bb.utils.contains('DISTRO_FEATURES','bluez5','bluez5','bluez4',d)}"
meta-gnome/recipes-gnome/gnome-bluetooth/gnome-bluetooth_3.18.2.bb: ${@bb.utils.contains('DISTRO_FEATURES','bluez5','bluez5','bluez4',d)} \
meta-oe/recipes-connectivity/obex/obex-data-server_0.4.6.bb:DEPENDS += "${@bb.utils.contains('DISTRO_FEATURES','bluez5','bluez5','bluez4',d)}"
meta-oe/recipes-connectivity/obex/openobex_1.7.2.bb:DEPENDS_append_class-target = " ${@bb.utils.contains('DISTRO_FEATURES','bluez5','bluez5','bluez4',d)}"
meta-oe/recipes-connectivity/packagegroups/packagegroup-tools-bluetooth.bb:RDEPENDS_bluez4 = " \
meta-oe/recipes-connectivity/packagegroups/packagegroup-tools-bluetooth.bb:# Install bluez4 tools or bluez5 tools depending on what is specified in the distro.
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
It is used in NVD database for CVE's like:
https://nvd.nist.gov/vuln/detail/CVE-2016-3120
Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Now that resolved is enabled in systemd, backport upstream patch that
adds support for the systemd-resolved backend and add one additional
check for the OE-specific resolv.conf link path.
Signed-off-by: Ricardo Salveti <rsalveti@rsalveti.net>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Add systemd service and and sysvinit script
so it's easy to manage the mip6d daemon.
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Add missing dependency in Makefile to fix the
parallel compile issue and re-enable PARALLEL_MAKE
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
- use release tarball instead of git
- move libevent, python and glib into PACKAGECONFIG
- add NOTICE file to copyright check
- split into multiple packages
- libthrift for libaries
- thrift-compiler for compiler
- thrift pulls in everything as before
Signed-off-by: Pascal Bach <pascal.bach@siemens.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
1) Upgrade hostapd from 2.5 to 2.6.
2) License checksum changed,since the copyright years were updated.
2) Delete patch "0001-WPS-Reject-a-Credential-with-invalid-passphrase.patch", since it is integrated upstream.
Signed-off-by: Huang Qiyu <huangqy.fnst@cn.fujitsu.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
1) Upgrade krb5 from 1.13.6 to 1.15.1.
2) License checksum changed,since the copyright years were updated.
3) Fix error in the step of do_configure.
| ERROR: krb5-1.15.1-r0 do_package: QA Issue: krb5: Files/directories were installed but not shipped in any package:
| /usr/lib/krb5/plugins/preauth/test.so
Signed-off-by: Huang Qiyu <huangqy.fnst@cn.fujitsu.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
WARNING: networkmanager-openvpn-1.2.6-r0 do_package: QA Issue: networkmanager-openvpn: Files/directories were installed but not shipped in any package:
/usr/lib/NetworkManager/libnm-vpn-plugin-openvpn.a
Signed-off-by: Andreas Müller <schnitzeltony@googlemail.com>
