Bug fix only and includes two security fixes:
CVE-2021-26675
CVE-2021-26676
Changelog:
- Fix issue with scanning state synchronization and iwd.
- Fix issue with invalid key with 4-way handshake offloading.
- Fix issue with DNS proxy length checks to prevent buffer overflow.
- Fix issue with DHCP leaking stack data via uninitialized variable.
[Yocto #14231]
(From OE-Core rev: eb20fd47d738f469f7bbeb4b8d85040f9163722b)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
rename directory of patches
-License-Update: Copyright year updated to 2021.
(From OE-Core rev: 316f9602c633fdf52009b4567ccf598d1c716acd)
Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* it breaks KDE's qca and dependencies
* it is not deprecated. Openssl 3.0 (currently alpha) will deprecate whirlpool
[1] https://www.openssl.org/news/changelog.html#openssl-30
(From OE-Core rev: bc02baadeee477b10eceae62985af4f4c323506e)
Signed-off-by: Andreas Müller <schnitzeltony@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This fixes openssh failing to work on qemux86 with glibc 2.33 due to
seccomp and the fact new syscalls are used. Also likely fixes issues
on other platforms.
(From OE-Core rev: 22f8ce6e6d998c0539a40b2776b1a2abb4f44bb3)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 17df664a32a74f17baaef8c31ac23adec2d6255f)
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The rdma command is part of iproute2 and is used to query or set the RDMA
configuration where applicable. This patch adds options to build it
and include it.
(From OE-Core rev: a2d79159dd3fa583ae28fc138f68ad9c893f5de0)
Signed-off-by: Alan Perry <alanp@snowmoose.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is still needed by libest in meta-security
(From OE-Core rev: 1242b04e97fbef3d926bcf706ac99a580109e58b)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Cc: Shachar Menashe <shachar@vdoo.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
TLS 1.3 implementation in qt5 uses psk so retain it for now
(From OE-Core rev: ab2cc33331ee931e65a63a02cf034c1b8ee695ac)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
They are still needed by several packages in meta-openembedded
(From OE-Core rev: 52af41387f1c843e7677c0bb632b2b96f9793ebd)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Cc: Shachar Menashe <shachar@vdoo.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
1. Drop support for many deprecated algorithms by default
2. Allow dropping support for TLS 1.0/1.1 via PACKAGECONFIG
(From OE-Core rev: 304417a97db89d9ea4a41aa7c92b5a052896d63b)
Signed-off-by: Shachar Menashe <shachar@vdoo.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Move the ip tool into its own package. Useful for size constrained
systems that only want the ip tool.
(From OE-Core rev: 938fe58625e2285ee529ee589908bb0d54810f01)
Signed-off-by: Sinan Kaya <okaya@kernel.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Depending on which patches the make program has, the internal or external
utmp could would be used. Add add a patch which avoids the issue and makes
the build determnistic. We saw the regression on ubuntu1604.
(From OE-Core rev: 77e8c0f0e1236a134148dfb2c4ba5e8a612984fe)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is the first ppp release in a long time. Many patches
were resolved upstream:
* musl fixes were merged
* EAP patch was a backport added upstream
* cflags were fixed upstream
* CVE fix was merged upstream and a backport
* pcap header from the host was fixed upstream
* suid bits during install was removed upstream
The only patch left was the /var/ redirect for resolv.conf which no longer
applied cleanly after upstream changes. For this one the patch will
need to be rewritten (and preferably submitted upstream) by someone
who needs/uses it. It was presumbaly for RO rootfs and may be resolved
by symlinks in modern system usage anyway.
Tweak the files pulled into the pppoe package for a compatibility
symlink and module rename.
Add CC to the OEMAKE command to allow builds correctly.
[Big thanks to Alex Kanavin for a lot of the work with upstream and
pre-release testing of this]
(From OE-Core rev: b524ba3e7941b9112ae4b6ae4aa7795c59ff0d16)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The dnsdomainname can also be provided by busybox and net-tools. Also
move it from ${bindir} to ${base_bindir} because the command provided by
busybox or net-tools is located here.
(From OE-Core rev: 3b258e4d9e38d4224029ad503c7821d9381264c0)
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The dhcpcd doesn't work on Intel 32bit platform. Backport a patch to fix
the issue.
(From OE-Core rev: e8b03a8e3a6748374340d45ce39e922eee6817e3)
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Currently there's no easy way to override this part as it's hardcoded
into the EXTRA_OEMAKE var. This change makes it possible to manipulate
the list of subdirs in a more fine graned and future oriented manner.
(From OE-Core rev: 1ca2b21cb7d638f36860bd16a90c1fb8238d4552)
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Engines are installed in a slightly different path, and
the host type doesn't precisely match in x86_64
Co-authored-by: Paul Eggleton <paul.eggleton@microsoft.com>
Co-authored-by: Deepak Rawat <derawa@microsoft.com>
(From OE-Core rev: 166bb89f6d97495b6522786182b4f9623acd7ff4)
Signed-off-by: Luca Boccassi <luca.boccassi@microsoft.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Backport a patch to fix privsep build error on ppc.
(From OE-Core rev: d79624f9dbe79f6185a2d6127c67508ba940f527)
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Without further examples of how this is failing revert as using both
together is a valid use case, for example connman handling Wifi/AP
and systemd-networkd handling more complex routing such as for
containers and ethernet switches.
This reverts commit 5303420ead25817f5caec276b79eec7ee797271a.
(From OE-Core rev: 99d55bd094fe3d12724d77af3f15e2494cad4e0d)
Signed-off-by: Jack Mitchell <ml@embed.me.uk>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The OpenSSH server, as used in Fedora and Red Hat Enterprise
Linux 7 and when running in a Kerberos environment, allows remote
authenticated users to log in as another user when they are listed
in the .k5users file of that user, which might bypass intended
authentication requirements that would force a local login.
Whitelist the CVE since this issue is Redhat specific.
(From OE-Core rev: 309132e50d23b1e3f15ef8db1a101166b35f7ca4)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The following changes since commit f075071761172c69f8ae2be5868d51ef9ef646e7:
conf: update for release 3.2 (2020-11-09 13:16:13 +0000)
are available in the Git repository at:
git://push.yoctoproject.org/poky-contrib fedepell/bug14083
Federico Pellegrin (1):
openssl: Add c_rehash to misc package and add perl runtime dependency
c_rehash implemented in perl is back (in history was moved to shell for
some time), so handle it inside the -misc package so just that one will
carry the heavy runtime dependency on perl and not the whole openssl
package. Note: in misc there were already before a few perl files
(tsget.pl and CA.pl) so the added perl dependency will fix those too.
[YOCTO #14083]
(From OE-Core rev: 70da1f956bfbb627691c47eba7451182aca758e3)
Signed-off-by: Federico Pellegrin <fede@evolware.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
0001-devlink.c-add-missing-include.patch
Removed since this is included in 5.9.0.
(From OE-Core rev: e434627b29a1a01b06473efeb291783a4afdd50f)
Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The dhcpcd path is hardcoded to /sbin in ifupdown package. Move dhcpcd
from /usr/sbin to /sbin to make sure ifup/ifdown can find it when dhcpcd
as the dhcp client backend.
(From OE-Core rev: ed7cdf95f1dcb3df6e954551f9578a8ac15f2795)
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Do not run systemd-networkd and connman simultaneously. These two
network managers may conflict with each other.
(From OE-Core rev: 5303420ead25817f5caec276b79eec7ee797271a)
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop chunks from clang-warnings.patch that are merged upstream.
(From OE-Core rev: ef0312566e53de693d5b0071afbec07b2840feae)
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Do not install the dhclient hooks
/etc/dhcp/dhclient-enter-hooks.d/resolvconf because the dhclient has
been removed from oe-core.
(From OE-Core rev: 6a7c6b0b654d8a9b062526fa86644ac21a13189f)
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
