This includes security fixes that adresses the following defects:
CVE-2018-1050 (Denial of Service Attack on external print server.)
CVE-2018-1057 (Authenticated users can change other users' password.)
* Detail release note:
- https://www.samba.org/samba/history/samba-4.7.6.html
Signed-off-by: Johannes Pointner <johannes.pointner@br-automation.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
1.Upgrade strongswan from 5.5.3 to 5.6.2.
2.Modify fix-funtion-parameter.patch, since the data has been changed.
Signed-off-by: Huang Qiyu <huangqy.fnst@cn.fujitsu.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
RISC-V is newly added to OE-Core, waf needs to know
about it during cross compile
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
This brings in new architecture support for risc-v
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
WARNING: ntp-4.2.8p10-r0 do_patch:
Some of the context lines in patches were ignored. This can lead to incorrectly applied patches.
The context lines in the patches can be updated with devtool:
devtool modify <recipe>
devtool finish --force-patch-refresh <recipe> <layer_path>
Then the updated patches and the source tree (in devtool's workspace)
should be reviewed to make sure the patches apply in the correct place
and don't introduce duplicate lines (which can, and does happen
when some of the context is ignored). Further information:
http://lists.openembedded.org/pipermail/openembedded-core/2018-March/148675.htmlhttps://bugzilla.yoctoproject.org/show_bug.cgi?id=10450
Details:
Applying patch ntp-4.2.4_p6-nano.patch
patching file include/ntp_syscall.h
Hunk #1 succeeded at 10 with fuzz 2 (offset -4 lines).
Now at patch ntp-4.2.4_p6-nano.patch
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* TUNE_PKGARCH cannot RRECOMMEND MACHINE specific kernel-modules
* without virtual/kernel dependency (which isn't really build time
dependency) the QA check won't traverse the dependencies correctly
and shows following errors:
ERROR: QA Issue: freediameter rdepends on kernel-module-ipip, but it isn't a build dependency? [build-deps]
ERROR: QA Issue: freediameter rdepends on kernel-module-sctp, but it isn't a build dependency? [build-deps]
ERROR: QA Issue: freediameter rdepends on kernel-module-tipc, but it isn't a build dependency? [build-deps]
ERROR: QA Issue: freediameter rdepends on kernel-module-udp-tunnel, but it isn't a build dependency? [build-deps]
* also change kernel-module dependencies from RDEPENDS to RRECOMMENDS
because the kernel config might include these directly and then
freediameter shouldn't fail to install
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
WARNING: tcpdump-4.9.2-r0 do_patch:
Some of the context lines in patches were ignored. This can lead to incorrectly applied patches.
The context lines in the patches can be updated with devtool:
devtool modify <recipe>
devtool finish --force-patch-refresh <recipe> <layer_path>
Then the updated patches and the source tree (in devtool's workspace)
should be reviewed to make sure the patches apply in the correct place
and don't introduce duplicate lines (which can, and does happen
when some of the context is ignored). Further information:
http://lists.openembedded.org/pipermail/openembedded-core/2018-March/148675.htmlhttps://bugzilla.yoctoproject.org/show_bug.cgi?id=10450
Details:
Applying patch unnecessary-to-check-libpcap.patch
patching file configure.in
Hunk #1 succeeded at 418 with fuzz 2 (offset -149 lines).
Now at patch unnecessary-to-check-libpcap.patch
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-04-09 12:32:06 -04:00
Mariia Movchan -X \(mmovchan - GLOBALLOGIC INC at Cisco\)
The service file belongs to ${PN}-bin instead of ${PN}, fix things
accordingly.
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Acked-by: Andreas Müller <schnitzeltony@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Make the patch musl specific as it is regressing glibc 2.27
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
On arm64 board, run the kernel as 64bit with 32bit userpace ebtables,
then run ebtables command:
ebtables -A OUTPUT -p arp -o eth3 -j DROP
Below error occurs:
kernel msg: ebtables bug: please report to author: Standard target size too big
To solve this, enable KERNEL_64_USERSPACE_32 for arm as the commit
<ebtables: enable KERNEL_64_USERSPACE_32 for powerpc> do.
Use TARGET_ARCH to replace KARCH here because that KARCH can't always get
value by default.
Signed-off-by: Li Zhou <li.zhou@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
This includes security fixes that adresses the following defects:
CVE-2017-14746: s3: smbd: Fix SMB1 use-after-free crash bug.
CVE-2017-15275: s3: smbd: Chain code can return uninitialized memory when
talloc buffer is grown.
* Detail release note:
- https://www.samba.org/samba/history/samba-4.7.5.html
Signed-off-by: Johannes Pointner <johannes.pointner@br-automation.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Version >= 1.2.3 needed to build samba 4.7.5.
Signed-off-by: Johannes Pointner <johannes.pointner@br-automation.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Version >= 0.9.34 needed to build samba 4.7.5.
Signed-off-by: Johannes Pointner <johannes.pointner@br-automation.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
libgcc is required by ntpd for execution, so add it as runtime dependency.
ntpd execution ref. log.
~# /etc/init.d/ntpd start
Starting ntpd: libgcc_s.so.1 must be installed for pthread_cancel to work
Aborted
done
~#
Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
[v2]
Fix epan/.libs/libwireshark.so: error: undefined reference to 'gpg_strerror'
and update to 2.4.5.
includes:
wnpa-sec-2018-05
The IEEE 802.11 dissector could crash. Bug 14442, CVE-2018-7335
wnpa-sec-2018-06
Multiple dissectors could go into large infinite loops. All ASN.1 BER dissectors (Bug 14444), along with the DICOM (Bug 14411), DMP (Bug 14408), LLTD (Bug 14419), OpenFlow (Bug 14420), RELOAD (Bug 14445), RPCoRDMA (Bug 14449), RPKI-Router (Bug 14414), S7COMM (Bug 14423), SCCP (Bug 14413), Thread (Bug 14428), Thrift (Bug 14379), USB (Bug 14421), and WCCP (Bug 14412) dissectors were susceptible.
wnpa-sec-2018-07
The UMTS MAC dissector could crash. Bug 14339, CVE-2018-7334
wnpa-sec-2018-08
The DOCSIS dissector could crash. Bug 14446, CVE-2018-7337
wnpa-sec-2018-09
The FCP dissector could crash. Bug 14374, CVE-2018-7336
wnpa-sec-2018-10
The SIGCOMP dissector could crash. Bug 14398, CVE-2018-7320
wnpa-sec-2018-11
The pcapng file parser could crash. Bug 14403, CVE-2018-7420
wnpa-sec-2018-12
The IPMI dissector could crash. Bug 14409, CVE-2018-7417
wnpa-sec-2018-13
The SIGCOMP dissector could crash. Bug 14410, CVE-2018-7418
wnpa-sec-2018-14
The NBAP disssector could crash. Bug 14443, CVE-2018-7419
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Request delay to first boot if newaliases fails on host.
Check for linuxstdbase before we might fail.
Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
last update left the musl builds broken since the
patch was not forward ported
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Fix build with musl along the way
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
1.Upgrade geoipupdate from 2.4.0 to 2.5.0.
2.Update the checksum of LIC_FILES_CHKSUM, since ChangeLog.md has been changed. The licence is still GPLv2.
Signed-off-by: Huang Qiyu <huangqy.fnst@cn.fujitsu.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
this fixes build issue on a 4.14 kernel:
/src/compat/padata/padata.c:831:9: error: implicit declaration of function 'padata_alloc'; did you mean 'padata_alloc_pd'? [-Werror=implicit-function-declaration]
| return padata_alloc(wq, cpu_possible_mask, cpu_possible_mask);
| ^~~~~~~~~~~~
| padata_alloc_pd
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Update following the SkipPackage -> SkipRecipe change in oe-core.
Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Add packagegroup for samba, for there are too many rpms in samba and it's hard to manage.
Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
options which involve paths into workspace are usually filtered out
with the sed command, however currently it does half the job and the
resulting config file gets partial replacements leaving the compiler
options with bad syntax e.g.
-fdebug-prefix-map option is left with -fdebug-prefix-map=
which is not correct syntax, the effect of this is seen in other
recipes which then invoke net-snmp-config script and add the
flags obtained from this script into its own configure scripts
and then tries to execute tests, these tests fail because of
bad compiler options e.g. keepalived where configure tests fails like
| configure: error: *** incorrect CFLAGS from net-snmp-config
this is because of wrong compiler options that it got from
recipe-sysroot/usr/bin/crossscripts/net-snmp-config
This patch tries to be specific about which options should
be skimmed and removes the options completely
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* there is explicit dependency on libpam without respecting pam in DISTRO_FEATURES
so add the check to prevent people building it against broken libpam
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
waf-samba.bbclass uses waf in a very different way than the "standard"
method that waf.bbclass targets and ends getting very little useful
functionality from that class.
Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
The nghttp2 depends on c-ares which is provided by meta-networking
layer, so it should be moved there as well.
Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
The previous path value to -fdebug-prefix-map
is null which may result in other package such as
quagga do_config error as below:
====================================================
add DISTRO_FEATURES_append = " snmp" to conf/local.conf
test@buildserver@ bitbake quagga
| checking for i586-poky-linux-net-snmp-config... no
| checking for net-snmp-config... $Prj/tmp/work/i586-poky-linux/quagga/1.2.1-r0/recipe-sysroot/usr/bin/crossscripts/net-snmp-config
| checking whether we can link to Net-SNMP... no
| configure: error: --enable-snmp given but not usable
| NOTE: The following config.log files may provide further information.
| NOTE: $Prj/tmp/work/i586-poky-linux/quagga/1.2.1-r0/build/config.log
| ERROR: configure failed
| WARNING: $Prj/tmp/work/i586-poky-linux/quagga/1.2.1-r0/temp/run.do_configure.80493:1 exit 1 from 'exit 1'
| ERROR: Function failed: do_configure (log file is located at $Prj/tmp/work/i586-poky-linux/quagga/1.2.1-r0/temp/log.do_configure.80493)
====================================================
Signed-off-by: Yu Mingli <mingli.yu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
This allows us to build perl modules with recent versions
of perl.
Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Otherwise we can get gettext-minimal-native dependency instead, which does not
provide gettext.h header.
Signed-off-by: Denys Dmytriyenko <denys@ti.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
'startline' is not a recognised keyword, it's beginline.
ntimed: The new md5 checksum is 89db8e76f2951f3fad167e7aa9718a44
ntimed: Here is the selected license text:
vvvvvvvvvvvvvvvvvvvvvvvvvvvv beginline=2 vvvvvvvvvvvvvvvvvvvvvvvvvvvvv
* Copyright (c) 2014 Poul-Henning Kamp
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
...
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ endline=24 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Signed-off-by: André Draszik <andre.draszik@jci.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Removes the bashism of prefacing shell functions with "function" and
renames the clear function to not conflict with the command of the same
name.
Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* The default DH group curve25519 depends on
an optional plugin ${PN}-plugin-curve25519,
add it to RDEPENDS to avoid below error:
root@test:~# ipsec up host-lan
initiating IKE_SA host-lan[1] to 192.168.7.2
configured DH group CURVE_25519 not supported
tried to checkin and delete nonexisting IKE_SA
establishing connection 'host-lan' failed
Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
