subtree updates feb 25 2022
poky: 27ff420543..49168f5d55:
Ahsan Hussain (1):
staging: use relative path in sysroot_stage_dir()
Alejandro Hernandez Samaniego (5):
core-image-tiny-initramfs: Mark recipe as 32 bit ARM compatible
kernel.bbclass: Allow initramfs to be built from a separate multiconfig
busybox: Add shell arithmetic to work with poky-tiny
newlib: Upgrade 4.1.0 -> 4.2.0
documentation: Add multiconfig initramfs configuration:
Alex Stewart (1):
sudo: add /etc/sudoers to sudo-lib conffiles
Alexander Kanavin (84):
ruby: do not parallel install
bind: upgrade 9.16.24 -> 9.16.25
ifupdown: upgrade 0.8.36 -> 0.8.37
ethtool: upgrade 5.15 -> 5.16
webkitgtk: upgrade 2.34.3 -> 2.34.4
debianutils: upgrade 5.5 -> 5.7
diffoscope: upgrade 200 -> 201
libbsd: upgrade 0.11.3 -> 0.11.5
libical: upgrade 3.0.12 -> 3.0.13
zstd: update 1.5.0 -> 1.5.2
rust: update 1.58.0 -> 1.58.1
wpa-supplicant: update 2.9 -> 2.10
ltp: update 20210927 -> 20220121
gnutls: update 3.7.2 -> 3.7.3
libusb1: correct SRC_URI
gobject-introspection: replace prelink-rtld with objdump -p
util-linux: update 2.37.2 -> 2.37.3
cmake: update 3.22.1 -> 3.22.2
git: merge .inc into .bb
git: build manpages from source subject to manpages PACKAGECONFIG
git: update 2.34.1 -> 2.35.1
python3-pycryptodome: update 3.12.0 -> 3.14.0
at: update 3.2.2 -> 3.2.4
sudo: update 1.9.8p2 -> 1.9.9
seatd: add recipe
weston: upgrade 9.0.0 -> 10.0.0
xf86-input-libinput: update 1.2.0 -> 1.2.1
glib-2.0: upgrade 2.70.2 -> 2.70.3
lua: upgrade 5.4.3 -> 5.4.4
mmc-utils: upgrade to latest revision
python3-cython: upgrade 0.29.26 -> 0.29.27
python3-hypothesis: upgrade 6.36.0 -> 6.36.1
python3-pip: upgrade 21.3.1 -> 22.0.2
cups: upgrade 2.4.0 -> 2.4.1
stress-ng: upgrade 0.13.10 -> 0.13.11
mesa: upgrade 21.3.4 -> 21.3.5
piglit: upgrade to latest revision
puzzles: upgrade to latest revision
diffoscope: upgrade 201 -> 202
libcap: upgrade 2.62 -> 2.63
libusb1: upgrade 1.0.24 -> 1.0.25
re2c: upgrade 2.2 -> 3.0
libgpg-error: update 1.43 -> 1.44
harfbuzz: upgrade 3.2.0 -> 3.3.1
qemu: replace a gtk wrapper with directly setting environment from runqemu
runqemu: preload uninative libraries when host gl drivers are in use
git: restore reproducibility on centos 7
insane.bbclass: use multiprocessing for collecting 'objdump -p' output
llvm: update 12.0.1 -> 13.0.1
python3-numpy: update 1.22.1 -> 1.22.2
sstate: additional debugging when fetch fails occur
sstate: fix up additional debugging when fetch fails occur
ruby: correctly set native/target dependencies
core-image-weston-sdk: synchronize with core-image-sato-sdk
gstreamer1.0: disable flaky gstbin:test_watch_for_state_change test
weston-init: disable systemd watchdog option
webkitgtk: drop patch merged upstream
man-db: update 2.10.0 -> 2.10.1
webkitgtk: remove rejected patch
vulkan: update 1.2.198 -> 1.3.204
vulkan-samples: update to latest revision
xkeyboard-config: update 2.34 -> 2.35.1
libgit2: update 1.3.0 -> 1.4.0
util-linux: upgrade 2.37.3 -> 2.37.4
python3-tomli: upgrade 2.0.0 -> 2.0.1
repo: upgrade 2.20 -> 2.21
help2man: upgrade 1.48.5 -> 1.49.1
meson: upgrade 0.61.1 -> 0.61.2
mmc-utils: upgrade to latest revision
python3-dtschema: upgrade 2021.12 -> 2022.1
python3-pytest: upgrade 7.0.0 -> 7.0.1
vala: upgrade 0.54.6 -> 0.54.7
gi-docgen: upgrade 2021.8 -> 2022.1
pango: upgrade 1.48.10 -> 1.50.4
piglit: upgrade to latest revision
shaderc: upgrade 2022.0 -> 2022.1
gst-examples: upgrade 1.18.5 -> 1.18.6
libical: upgrade 3.0.13 -> 3.0.14
diffoscope: upgrade 202 -> 204
gdb: update 11.1 -> 11.2
weston-init: replace deprecated/disabled fbdev with drm backend
devtool: explicitly set main or master branches in upgrades when available
base/staging: use HOST_PREFIX, not TARGET_PREFIX
insane: use HOST_ variables, not TARGET_ to determine the cross system
Alexandru Ardelean (1):
libsndfile1: bump to version 1.0.31
Andrej Valek (3):
busybox: refresh defconfig
oeqa: qemu: create missing directory for _write_dump
dhcpcd: add option to set DBDIR location
Andres Beltran (1):
create-spdx: add support for SDKs
Andrey Zhizhikin (1):
waffle: add wayland-protocols when building with wayland
Bruce Ashfield (18):
linux-yocto/5.15: update to v5.15.15
linux-yocto/5.10: update to v5.10.92
x86: fix defconfig configuration warnings
linux-yocto/5.15: update to v5.15.16
linux-yocto/5.10: update to v5.10.93
linux-libc-headers: update to v5.16
qemuarm64: Add tiny ktype to qemuarm64 bsp
lttng-modules: fix build against v5.17+
linux-yocto-dev: update to v5.17+
linux-yocto/5.15: update to v5.15.19
linux-yocto/5.10: update to v5.10.96
lttng-modules: update devupstream to latest 2.13
linux-yocto/5.15: update to v5.15.22
linux-yocto/5.10: update to v5.10.99
linux-yocto/5.15: ppc/riscv: fix build with binutils 2.3.8
linux-yocto/5.10: ppc/riscv: fix build with binutils 2.3.8
linux-yocto/5.10: fix dssall build error with binutils 2.3.8
linux-yocto/5.15: fix dssall build error with binutils 2.3.8
Carlos Rafael Giani (1):
libxml2: Backport python3-lxml workaround patch
Changhyeok Bae (1):
connman: update 1.40 -> 1.41
Changqing Li (2):
mdadm: fix testcase 00multipath failure
nghttp2: fix for multilib support
Chen Qi (1):
mdadm: install mdcheck
Christian Eggers (5):
sdk: fix search for dynamic loader
mc: fix build if ncurses have been configured without wide characters
curl: configure with '--without-ssl' if ssl is disabled
gcsections: add nativesdk-cairo to exclude list
dev-manual: update example from kernel.bbclass
Daiane Angolini (1):
classes/lib/useradd: The option -P is deprecated
Daniel Gomez (2):
bitbake: contrib: Fix hash server Dockerfile dependencies
bitbake: asyncrpc: Fix attribute errors
Daniel Müller (1):
scripts/runqemu-ifdown: Don't treat the last iptables command as special
Denys Dmytriyenko (2):
wayland-protocols: upgrade 1.24 -> 1.25
yocto-check-layer: add ability to perform tests from a global bbclass
Florian Amstutz (1):
devtool: deploy-target: Remove stripped binaries in pseudo context
Hongxu Jia (1):
glibc: fix create thread failed in unprivileged process
Joe Slater (1):
virglrenderer: fix CVE-2022-0135 and -0175
Jon Mason (1):
linux-yocto-dev: add qemuriscv32
Jose Quaresma (18):
icecc.bbclass: replace deprecated bash command substitution
spirv-headers: bump to b42ba6
spirv-tools: upgrade 2021.4 -> 2022.1
glslang: upgrade 11.7.1 -> 11.8.0
shaderc: upgrade 2021.3 -> 2021.4
shaderc: upgrade 2021.4 -> 2022.0
gstreamer1.0: upgrade 1.18.5 -> 1.20.0
gstreamer1.0-plugins-base: upgrade 1.18.5 -> 1.20.0
gstreamer1.0-plugins-good: upgrade 1.18.5 -> 1.20.0
gstreamer1.0-plugins-bad: upgrade 1.18.5 -> 1.20.0
gstreamer1.0-plugins-ugly: upgrade 1.18.5 -> 1.20.0
gstreamer1.0-rtsp-server: upgrade 1.18.5 -> 1.20.0
gstreamer1.0-libav: upgrade 1.18.5 -> 1.20.0
gstreamer1.0-vaapi: upgrade 1.18.5 -> 1.20.0
gstreamer1.0-omx: upgrade 1.18.5 -> 1.20.0
gstreamer1.0-python: upgrade 1.18.5 -> 1.20.0
gst-devtools: upgrade 1.18.5 -> 1.20.0
gstreamer1.0: update licenses of all modules
Joshua Watt (4):
classes/create-spdx: Add packageSupplier field
classes/create-spdx: Remove unnecessary package
spdx: Add set helper for list properties
bitbake: msg: Ensure manually created loggers have the once filter
Justin Bronder (1):
initramfs-framework: unmount automounts before switch_root
Kai Kang (2):
toolchain-scripts.bbclass: use double quotes for exported PS1
webkitgtk: 2.34.4 -> 2.34.5
Khem Raj (17):
ffmpeg: Remove --disable-msa2 mips option
systemd: Forward port musl patches
ruby: Fix build on riscv/musl
musl: Update to latest master
libstd-rs: Apply patches to right version of libc
image-prelink: Remove bbclass
qemuppc64.conf: Remove commented prelink use
meta: Remove libsegfault and catchsegv
man-db: Fix build with clang
diffutils: Link with libbcrypt on mingw
binutils: Upgrade to 2.38 release
opensbi: Upgrade to 1.0
u-boot: Fix RISCV build with binutils 2.38
libgit2: Upgrade to 1.4.1
grub: Fix build with bintutils 2.38 on riscv
boost: Fix build on 32bit arches with 64bit time_t defaults
scripts/documentation-audit: Use renamed LICENSE_FLAGS_ACCEPTED variable
Konrad Weihmann (2):
ruby: fix DEPENDS append
gmp: fix EXTRA_OECONF for mipsarchr6
Kory Maincent (1):
icu: fix make_icudata dependencies
Lee Chee Yang (1):
libarchive : update to 3.5.3
LiweiSong (1):
qemu: add tpm string section to qemu acpi table
Luna Gräfje (1):
tune-cortexa72: Fix a misspelt override in PACKAGE_EXTRA_ARCHS
Marek Vasut (1):
kernel-fitimage: Add missing dependency for UBOOT_ENV
Markus Niebel (1):
kmscube: depend on virtual/libgbm
Markus Volk (2):
libical: build gobject and vala introspection
seatd: build systemd backend if DISTRO_FEATURE systemd is set
Marta Rybczynska (1):
bitbake: lib/bb: fix exit when found renamed variables
Martin Beeger (1):
cmake: remove bogus CMAKE_LDFLAGS_FLAGS definition from toolchain file
Martin Jansa (2):
systemd: fix DeprecationWarning about regexps
icecc.bbclass: fix syntax error
Matthias Klein (1):
boost: add json lib
Michael Halstead (3):
uninative: Upgrade to 3.5
releases: update to include 3.1.14
releases: update to include 3.4.2
Michael Opdenacker (8):
migration-3.5: mention task specific network access
dev-manual: stop mentioning the Angstrom distribution
dev-manual: new "working with pre-compiled libraries" section
manuals: improve references to classes
manuals: propose https for SSTATE_MIRRORS
ref-manual: add usage details about ccache.bbclass
ref-manual: update TCLIBC description
manuals: add 3.4 and 3.4.1 release notes after migration information
Oleksandr Kravchuk (1):
ell: update to 0.48
Oleksandr Suvorov (1):
depmodwrapper-cross: add config directory option
Pavel Zhukov (3):
systemd: allow to create directory whose path contains symlink
systemd: enable KeepConfiguration= when running on network filesystem
patch.py: Prevent git repo reinitialization
Peter Kjellerstedt (21):
sstate: A third fix for for touching files inside pseudo
devtool: sdk-update: Remove an unnecessary \n from SSTATE_MIRRORS
sstatetests: Correct a typo in a comment
glibc-tests: Correct PACKAGE_DEBUG_SPLIT_STYLE
test-manual: Correct two references to BB_SKIP_NETTESTS
package: Split out package_debug_vars from split_and_strip_files
package: Make package_debug_vars() return a dict
package: Pass dv (debug_vars) around instead of individual vars
bitbake: bitbake-user-manual: Remove unnecessary \n from a PREMIRRORS example
bitbake: tests/fetch: Skip the crate tests if network tests are disabled
bitbake: tests/fetch: Remove unnecessary \n from mirror variables
bitbake: tests/fetch: Improve the verbose messages for skipped tests
bitbake: tests/fetch: Unify how git commands are run
bitbake: tests/fetch: Only set the Git user name/email if they are not already set
bitbake: tests/fetch: Make test_npm_premirrors work with the current fetcher
bitbake: fetch2: Correct handling of replacing the basename in URIs
bitbake: fetch2: npm: Put all downloaded files in the npm2 directory
poky.conf: Remove unnecessary \n from PREMIRRORS
local.conf.sample: Remove unnecessary \n from the SSTATE_MIRRORS example
manuals: Remove unnecessary \n from SSTATE_MIRRORS examples
oeqa/selftest/bblogging: Add logging tests for bb.build.exec_func with shell/python code
Pgowda (2):
glibc : Fix CVE-2021-3998
glibc : Fix CVE-2021-3999
Quentin Schulz (2):
docs: point to renamed BB_BASEHASH_IGNORE_VARS variable
docs: fix hardcoded link warning messages
Richard Purdie (65):
lttng-tools: upgrade 2.13.2 -> 2.13.4
gcc: Drop stdlib++ option patch
staging: Add extra hash handling code
abi_version/sstate: Bump for hash equivalence fix
prelink: Drop support for it
glibc: Drop prelink patch
oqea/runtime/oe_syslog: Improve test
vim: Upgrade 4269 -> 4134
binutils: Add fix for CVE-2021-45078
glibc: Upgrade to 2.35
patchelf: Fix corrupted file mode patch
buildtools: Allow testsdk to access the network
scriptutils: Fix handling of srcuri urls
default-distrovars.inc: Switch connectivity check to a yoctoproject.org page
bitbake: tests/fetch: Add missing branch param for git urls
oeqa/buildtools: Switch to our webserver instead of example.com
openssl: Add perl functionality test to do_configure
ltp: Disable proc01 test
bitbake: fetch2/cooker: Fix source revision handling with floating upstreams
bitbake: data_smart: Fix overrides file/line message additions
bitbake: cooker: Improve parsing failure from handled exception usability
bitbake: msg: Add bb.warnonce() and bb.erroronce() log methods
bitbake: data_smart: Add hasOverrides method to public datastore API
selftest/bbtests: Add tests for git floating tag resolution
oeqa/selftest/bbtests: Update to match changed bitbake output
features_check/insane: Use hasOverrides datastore method
recipeutils: Add missing get_srcrev() call
archiver: Fix typo
bitbake: utils: Fix environment decorator logic error
bitbake: fetch2: Abstract fetcher environment to a function
core-image-testmaster: Rename to core-image-testcontroller
scripts: Add a conversion script to use SPDX license names
meta/meta-selftest/meta-skeleton: Update LICENSE variable to use SPDX license identifiers
oeqa/selftest/bbtests: Update after license changes
sstate: Setup fetcher environment in advance
expat: Upgrade 2.4.4 -> 2.4.5
expat: Upgrade 2.4.5 -> 2.4.6
perl: Improve and update module RPDEPENDS
libxml-parser-perl: Add missing RDEPENDS
vim: Upgrade 8.2.4314 -> 8.2.4424
tiff: Add backports for two CVEs from upstream
bitbake: utils: Ensure shell function failure in python logging is correct
oeqa/selftest/bblogging: Split the test cases up for ease of testing
bitbake: data_smart/cookerdata: Add variable remapping support
bitbake: data_smart: Allow rename mechanism to show full expressions
bitbake: data_smart: Add support to BB_RENAMED_VARIABLES for custom strings
bitbake: bitbake: Bump version to 1.53.1
sanity.conf: Require bitbake version 1.53.1
layer.conf: Update to use kirkstone
meta/scripts: Change BB_ENV_EXTRA_WHITE -> BB_ENV_PASSTHROUGH_ADDITIONS
meta/scripts: Handle bitbake variable renaming
bitbake.conf: Add entries for renamed variables
meta/scripts: Automated conversion of OE renamed variables
icecc: Improve variables/terminology
bitbake.conf: Add entries to warn on usage of removed variables
layer.conf: Update to kirkstone namespace
bitbake: data_smart: Avoid exceptions for non string data
bitbake: tests/fetch: Update for master -> main change upstream
python3targetconfig: Use for nativesdk too
licenses: Fix logic error introduced in rename
pip_install_wheel: Recompile modified files
pip_install_wheel: Use --ignore-installed for pip
python3-pip: Don't change shebang
python3-pip: Improve reproducibility
python3-numpy: Fix pyc determinism issue
Robert Joslyn (1):
dev-manual/common-tasks: Fix typo
Robert Yang (1):
bitbake: bitbake: bitbake-worker: Preserve network non-local uid
Ross Burton (21):
tiff: backport fix for CVE-2022-22844
yocto-check-layer: add debug output for the layers that were found
openssl: export OPENSSL_MODULES in the wrapper
expat: upgrade to 2.4.4
vim: upgrade to patch 4269
core-image-sato-sdk: allocate more memory when in qemu
oeqa/runtime/stap: improve systemtap test
systemtap: backport buffer size tuning patches
strace: remove obsolete musl-on-MIPS patch
strace: skip a number of load-sensitive tests
yocto-check-layer: check for duplicate layers when finding layers
common-licences: remove ambiguous "BSD" license
newlib: fix license checksums
oeqa/selftest: test that newlib can build
cmake: stop FetchContent from fetching content
kernel: make kernel-base recommend kernel-image, not depend
poky-tiny: don't skip core-image-base and core-image-full-cmdline
poky-tiny: set QB_DEFAULT_FSTYPE correctly
coreutils: remove obsolete ignored CVE list
cve-check: get_cve_info should open the database read-only
oeqa/controllers: update for MasterImageHardwareTarget->Controller...
Rudolf J Streif (1):
linux-firmware: Add CLM blob to linux-firmware-bcm4373 package
Saul Wold (13):
recipetool: Fix circular reference in SRC_URI
create-spdx: Get SPDX-License-Identifier from source
blacklist: Replace class with SKIP_RECIPE variable
dnf: Use renamed SKIP_RECIPE varFlag
multilib: Use renamed SKIP_RECIPE varFlag
imagefeatures: selftest: Change variable to be more descriptive
scripts: Add convert-variable-renames script for inclusive language variable renaming
meta: Rename LICENSE_FLAGS variable
poky-tiny: Use renamed SKIP_RECIPES varFlag
Rename LICENSE_FLAGS variable
meta: Further LICENSE_FLAGS variable updates
package: rename LICENSE_EXCLUSION
license.py: rename variables
Scott Murray (13):
bitbake: bitbake: Rename basehas and taskhash filtering variables
bitbake: bitbake: Rename environment filtering variables
bitbake: bitbake: Rename configuration hash filtering variable
bitbake: bitbake: Rename setscene enforce filtering variable
bitbake: bitbake: Rename allowed multiple provider variable
bitbake: lib: Replace remaining "blacklist"/"whitelist" usage
bitbake: lib/bb: Replace "abort" usage in task handling
bitbake: lib/bb: Replace "ABORT" action in BB_DISKMON_DIRS
bitbake: bitbake: Replace remaining "abort" usage
local.conf/oeqa: Update BB_DISKMON_DIRS use
meta-poky: Update BB_DISKMON_DIRS use
scripts: fix file writing in convert-variable-renames
scripts: fix file writing in convert-spdx-licenses
Sean Anderson (1):
libpcap: Disable DPDK explicitly
Stefan Herbrechtsmeier (12):
cve-check: create directory of CVE_CHECK_MANIFEST before copy
systemd: Add link-udev-shared PACKAGECONFIG
systemd: Minimize udev package size if DISTRO_FEATURES doen't contain sysvinit
gcc-target: fix glob to remove gcc-<version> binary
gcc-target: move cc1plus to g++ package
wic: partition: Support valueless keys in sourceparams
wic: rawcopy: Add support for packed images
selftest: wic: Remove requirement of syslinux from test_rawcopy_plugin
selftest: wic: Add rawcopy plugin unpack test
selftest: wic: Disable graphic of qemu to support WSL
classes: rootfs-postcommands: avoid exception in overlayfs_qa_check
files: overlayfs-create-dirs: split ExecStart into two commands
Tamizharasan Kumar (2):
linux-yocto/5.10: update genericx86* machines to v5.10.99
linux-yocto/5.15: update genericx86* machines to v5.15.22
Tim Orling (43):
python3-hypothesis: upgrade 6.35.0 -> 6.36.0
python3-setuptools-scm: upgrade 6.3.2 -> 6.4.2
python3-pyparsing: upgrade 3.0.6 -> 3.0.7
python3-importlib-metadata: upgrade 4.10.0 -> 4.10.1
python3-wheel: move 0.37.1 from meta-python
python3-flit-core: add recipe for 3.6.0
python3-flit-core: SUMMARY DESCRIPTION HOMEPAGE
python3-flit-core: inherit pip_install_wheel
flit_core.bbclass: add helper for newer python packaging
python3-wheel: inherit flit_core
pip_install_wheel.bbclass: add helper class
python3-wheel-native: install ${bindir}/wheel
setuptools_build_meta.bbclass: add helper class
python3-pip: inherit setuptools_build_meta
python3-pip-native: install scripts in ${bindir}
python3-attrs: inherit setuptools_build_meta
python3-git: inherit setuptools_build_meta
python3-pytest: inherit setuptools_build_meta
python3-setuptools-scm: inherit setuptools_build_meta
python3-zipp: inherit setuptools_build_meta
python3-iniconfig: inherit setuptools_build_meta
python3-py: inherit setuptools_build_meta
python3-pluggy: inherit setuptools_build_meta
python3-setuptools: inherit setuptools_base_meta
setuptools3.bbclass: refactor for wheels
python3-more-itertools: set PIP_INSTALL_PACKAGE
meson: inherit setuptools_build_meta
python3-libarchive-c: set PIP_INSTALL_PACKAGE
python3-smartypants: patch hash bang to python3
python3-scons: merge -native recipe
python3-subunit: merge inc; set PIP_INSTALL_PACKAGE
python3-magic: set PIP_INSTALL_PACKAGE
bmap-tools: set PIP_INSTALL_PACKAGE, BASEVER
asciidoc: set PIP_INSTALL_PACKAGE
gi-docgen: set PIP_INSTALL_PACKAGE
python3-numpy: set PIP_INSTALL_PACKAGE
python3-dbusmock: set PIP_INSTALL_PACKAGE
python3-mako: inherit setuptools_build_meta
python3-packaging: inherit setuptools_build_meta
python3-nose: drop recipe
disutils*.bbclasses: move to meta-python
selftest: drop distutils3 test from recipetool
pip_install_wheel: improved wheel filename guess
Tom Hochstein (1):
xwayland: Add xkbcomp runtime dependency
Yi Zhao (2):
glibc: unify wordsize.h between arm and aarch64
glibc: fix multilib headers conflict for arm
Zoltán Böszörményi (2):
qemuboot: Fix build error if UNINATIVE_LOADER is unset
gtk-icon-cache: Allow using gtk4
Zygmunt Krynicki (13):
bitbake: fetch2/wget: move loop-invariant load of BB_ORIGENV
bitbake: cooker: Fix typo "isn't" and "tuples"
bitbake: cookerdata: Fix typo "normally"
bitbake: daemonize: Fix typo "separate"
bitbake: event: Fix typo "asynchronous" and "occasionally"
bitbake: fetch2: Fix typo "conform" and "processed"
bitbake: fetch2/git: Remove duplicate "the"
bitbake: persist_data: Fix typo "committed"
bitbake: process: Fix typo: "process"
bitbake: progress: Fix typo "wherever"
bitbake: tinfoil: Fix typo "receive" and "something"
bitbake: utils: Fix typo "dependency" and "spawning"
bitbake: wget: Fix grammar "can happen"
pgowda (1):
gcc : Fix CVE-2021-46195
wangmy (44):
libwebp: 1.2.1 -> 1.2.2
python3-libarchive-c: upgrade 3.2 -> 4.0
lighttpd: upgrade 1.4.63 -> 1.4.64
nfs-utils: upgrade 2.5.4 -> 2.6.1
libmodulemd: upgrade 2.13.0 -> 2.14.0
libxcrypt: upgrade 4.4.27 -> 4.4.28
lzip: upgrade 1.22 -> 1.23
libxkbcommon: upgrade 1.3.1 -> 1.4.0
man-db: upgrade 2.9.4 -> 2.10.0
gdbm: upgrade 1.22 -> 1.23
harfbuzz: upgrade 3.3.1 -> 3.3.2
findutils: upgrade 4.8.0 -> 4.9.0
python3-magic: upgrade 0.4.24 -> 0.4.25
python3-pycryptodome: upgrade 3.14.0 -> 3.14.1
python3-pytest: upgrade 6.2.5 -> 7.0.0
python3-pip: upgrade 22.0.2 -> 22.0.3
python3-pyelftools: upgrade 0.27 -> 0.28
screen: upgrade 4.8.0 -> 4.9.0
ed: upgrade 1.17 -> 1.18
autoconf-archive: upgrade 2021.02.19 -> 2022.02.11
gpgme: upgrade 1.16.0 -> 1.17.0
glib-2.0: upgrade 2.70.3 -> 2.70.4
harfbuzz: upgrade 3.3.2 -> 3.4.0
python3-hypothesis: upgrade 6.36.1 -> 6.36.2
python3-pathlib2: upgrade 2.3.6 -> 2.3.7
python3-pbr: upgrade 5.8.0 -> 5.8.1
python3-ruamel-yaml: upgrade 0.17.20 -> 0.17.21
linux-firmware: upgrade 20211216 -> 20220209
rng-tools: upgrade 6.14 -> 6.15
mesa: upgrade 21.3.5 -> 21.3.6
go: upgrade 1.17.6 -> 1.17.7
libhandy: Use upstream regex to check version of upgrade.
libva-utils: upgrade 2.13.0 -> 2.14.0
patchelf: upgrade 0.14.3 -> 0.14.5
quilt: upgrade 0.66 -> 0.67
ruby: upgrade 3.1.0 -> 3.1.1
wireless-regdb: upgrade 2021.08.28 -> 2022.02.18
bind: upgrade 9.16.25 -> 9.16.26
flac: upgrade 1.3.3 -> 1.3.4
init-system-helpers: upgrade 1.60 -> 1.62
libdrm: upgrade 2.4.109 -> 2.4.110
python3-hypothesis: upgrade 6.36.2 -> 6.37.2
python3-markupsafe: upgrade 2.0.1 -> 2.1.0
asciidoc: upgrade 10.1.1 -> 10.1.3
meta-raspberrypi: 836755370f..e39a0a570c:
Andrei Gherzan (13):
README.md: Add contributing section
Move the python3-adafruit recipes depending on meta-oe to dynamic layers
README.md: Don't advertise meta-oe dependency
docs: Detail the merging process of patches sent through the mailing list
ci: Define an action for building a local docker image
ci: Define an action for cleaning dangling image
ci: Define an action for cleaning/removing an image
ci: Introduce workflow for compliance
ci: Introduce workflow Yocto operations/builds
ci: Add workflow to cancel redundant workflows
ci: Add git mirror workflow
ci: No need for checkout step in mirror workflow
ci: Use the current stable version for the mirror action
Aníbal Limón (1):
gstreamer1.0-plugins-good: Update bbappend to 1.20
Bernhard Guillon (1):
rpi-base.inc: enable i2c-gpio overlay
Devendra Tewari (1):
linux-raspberrypi: Upgrade to 5.10.83
Khem Raj (7):
raspberrypi4-64: Switch to using cortexa72-crc default tune
picamera-libs,python3-picamera: Limit visibility to 32 bit rpi machines
rpi-gpio: Replace setuptool3 instead of distutils3
python3-adafruit-blinka: Disable on musl
linux-raspberrypi: Add recipe for 5.15 LTS kernel
rpi-default-versions: Use 5.15 as default kernel
layers: Bump to use kirkstone
Martin Jansa (4):
sdcard_image-rpi: fix DeprecationWarning
gstreamer1.0-plugins-bad: remove libmms PACKAGECONFIG and add gpl
meta: update variable names
meta: update license names
Mauro Anjo (1):
machine: add Pi Zero 2 W 32bits
Michal Toman (1):
rpi-base.inc: Add vc4-fkms-v3d-pi4 overlay
Mingli Yu (1):
xserver-xorg: remove xshmfence configure option
Otto Esko (2):
recipes-bsp: Add support for gpio-shutdown
Add documentation for gpio-shutdown
Paul Barker (1):
raspberrypi4-64: Switch to cortexa72 tune
bhargavthriler (1):
python3-picamera: Add picamera library
meta-openembedded: 6b63095946..cf0ed42391:
Alejandro Hernandez Samaniego (1):
remmina: Upgrade to 1.4.23
Alexander Kanavin (4):
libvncserver: disable ffmpeg support due to incompatiblility with ffmpeg 5.0
opencv: update 4.5.2 -> 4.5.5
minidlna: update 1.2.1 -> 1.3.0
mpd: update 0.22.9 -> 0.23.5
An?bal Lim?n (2):
python3-apt: add new recipe version 2.3.0
unattended-upgrades: add new recipe version 2.6
Andreas Müller (1):
All layers: Follow oe-core's variable name changes
Andrej Valek (1):
nodejs: add option to use openssl legacy providers
Carlos Rafael Giani (3):
pipewire: Upgrade to 0.3.45
wireplumber: Add recipe
wireplumber: Improve configuration
Changqing Li (1):
python3-psutil: fix test failure
Christian Eggers (5):
ebtables: remove perl from RDEPENDS
graphviz: native: create /usr/lib/graphviz/config6 in populate_sysroot
boost-sml: add new recipe
python3-dt-schema: remove recipe
graphviz: added PACKAGECONFIG for librsvg
Clément Péron (1):
networking: add new netsniff-ng recipe version 0.6.8
Daniel Gomez (1):
opencv: Update contrib 4.5.2 -> 4.5.5
Devendra Tewari (1):
libcamera: add pkg-config files
Fabio Estevam (2):
rtc-tools: Add a recipe
rtc-tools: Update to 2022.02
Gianfranco Costamagna (4):
vboxguestdrivers: upgrade 6.1.30 -> 6.1.32
boinc-client: Update to 7.18.1
mosquitto: upgrade 2.0.12 -> 2.0.14
websocketpp: Apply upstream proposed patch to fix a Scons 4.2.0+ build failure
Jan Luebbe (1):
snappy: use main branch to fix fetch failure
Jan Vermaete (2):
netdata: upgrade 1.32.1 -> 1.33.0
netdata: version bump 1.33.0 -> 1.33.1
Justin Bronder (4):
yaml-cpp: bump 0.7.0
googlebenchmark: add 1.6.1
python3-pytest-forked: add 1.4.0
python3-pytest-xdist: add 2.5.0
Kai Kang (1):
openjpeg: fix CVE-2021-29338
Kartikey Rameshbhai Parmar (1):
imagemagick: update SRC_URI branch to main
Khem Raj (46):
xfce4-datetime-setter: Fix build with meson 0.61+
gerbera: Upgrade to 1.9.2
iotop: Disable LTO with clang/rv64
spdlog: Update the external fmt patch
dlt-daemon: Bump to latest revision on master
evolution-data-server: Disable g-i data generation
gerbera: Fix build with fmt 8.1+
php: Update to 8.1.2
postgresql: Fix build on riscv
libcec: Fix type mismatch for return value of LibCecBootloader()
gparted: Do not use NULL where boolean is expected
python3-pyruvate: Fix build with mips
python3-pyruvate: Fix build with riscv64/musl
pcp: Disable parallel compile
gst-shark: Upgrade to 0.7.3.1
crda: Fix buffer overflow in sscanf
open-vm-tools: Fix build with musl
openldap: Fix build with musl
gimp: Disable vector icons on x86 with clang
libjs-jquery-icheck: Use hardcoded SHA for srcrev
smarty: Upgrade to 4.1.0
dhcp-relay: Package needed shared libs from bind
gimp: Disable vector icons with clang on arm
capnproto: Fix build on mips
packagegroup-meta-oe: Add googlebenchmark
packagegroup-meta-python: Add python3-pytest-forked and python3-pytest-xdist
ntopng: Avoid linking libm statically
libsigc++-3: Upgrade to 3.2.0
geany-plugins: Fix build with libgit2 1.4+
recipes: Use renamed SKIP_RECIPE varFlag
recipes: Use new CVE_CHECK_IGNORE variable
meta-oe: Use new variable SYSROOT_DIRS_IGNORE
layers: Bump to use kirkstone
capnproto: Link with libatomic on rv32
iotop: Disable lto with clang for rv32
glibmm: Add recipe for 2.70.0
cairomm: Add recipe for cairomm 1.16
pangomm: Add recipe for pangomm-2.48
atkmm: Add new recipe for 2.36+
libxml++: Upgrade to 2.42.1 release
libxml++-5.0: Add recipe for libxml++ 5.0
Revert "libcamera: add pkg-config files"
python3-blinker: Migrate to use pytest instead of nose for testing
python3-oauthlib: Drop redundant nose dependency
netplan: Add knob to enable tests
openldap: Use renamed variable CVE_CHECK_IGNORE
Leon Anavi (23):
python3-imageio: Upgrade 2.14.0 -> 2.14.1
python3-pandas: Upgrade 1.3.5 -> 1.4.0
python3-aenum: Upgrade 3.1.6 -> 3.1.8
python3-redis: Upgrade 4.0.2 -> 4.1.1
python3-jdatetime: Upgrade 3.8.1 -> 3.8.2
python3-bandit: Upgrade 1.7.1 -> 1.7.2
python3-fasteners: Upgrade 0.17.2 -> 0.17.3
python3-ansi2html: Upgrade 1.6.0 -> 1.7.0
python3-coverage: Upgrade 6.2 -> 6.3
python3-imageio: Upgrade 2.14.1 -> 2.15.0
python3-humanize: Upgrade 3.13.1 -> 3.14.0
python3-bitarray: Upgrade 2.3.5 -> 2.3.6
python3-itsdangerous: Upgrade 2.0.1 -> 2.1.0
python3-croniter: Upgrade 1.2.0 -> 1.3.4
python3-distro: Upgrade 1.6.0 -> 1.7.0
python3-click: Upgrade 8.0.3 -> 8.0.4
python3-ordered-set: Upgrade 4.0.2 -> 4.1.0
python3-bitarray: Upgrade 2.3.6 -> 2.3.7
python3-pandas: Upgrade 1.4.0 -> 1.4.1
python3-unidiff: Upgrade 0.7.0 -> 0.7.3
python3-langtable: Upgrade to release 0.0.57
python3-cmd2: Upgrade 2.3.3 -> 2.4.0
python3-coverage: Upgrade 6.3 -> 6.3.2
Marek Vasut (1):
freerdp: Update to FreeRDP 2.5.0
Mark Jonas (1):
mbedtls: Upgrade to 2.28.0
Markus Volk (12):
geary: initial add recipe
packagegroup-gnome-apps.bb: add geary
folks: add PACKAGECONFIG for import_tool and inspect_tool
geary: use sha hash for SRCREV; fix identation
folks: make some dependencies optional
evolution-data-server: try to fix g-i data generation
folks: dont build tests as they are not installed anyway
gvfs: upgrade 1.48.1 -> 1.49.1
libxfce4util: inherit vala
xfconf: inherit vala
libxfce4ui: disable vala
xfce4-panel: disable vala
Martin Jansa (1):
Fix DeprecationWarning about regexps
Matsunaga-Shinji (1):
openldap: add CVE-2015-3276 to allowlist
Matthias Klein (1):
gpsd-machine-conf: set precise BSD-3-Clause license
Mingli Yu (5):
plymouth: switch to KillMode=mixed
lxdm: remove conflicts setting
plymouth: add extra kernel parameter
opencv: disable sse4.1 and sse4.2 on x86
plymouth: Add the retain-splash option
Oleksandr Kravchuk (4):
redis: add recipe for 7.0-rc1
iwd: update to 1.24
fping: update to 5.1
capnproto: update to 0.9.1
Peter Bergin (1):
pipewire: fix build error when pipewire-jack is used
Peter Griffin (1):
libcamera: update meson options to build pipeline handlers & cam utility
Randy MacLeod (1):
rsyslog: update to 8.2202
Robert Joslyn (1):
hwdata: Update to 0.356
Ross Burton (16):
python3-jsonpath-rw: set correct license
concurrencykit: use precise BSD licence version
pkcs11-helper: update homepage
pkcs11-helper: set precise BSD license
spice: set correct LICENSE
poppler-data: set precise BSD license
openipmi: use precise BSD license
s-nail: add a maintained mail(1) fork
minidlna: use precise BSD license
smartmontools: use s-nail
mailx: remove
spice-protocol: upgrade to 1.14.3
libjs-jquery: remove
fwupd-efi: upgrade to 1.2
fping: set precise license
concurrencykit: enable 32- and 64-bit Arm targets
Sakib Sajal (1):
nss: uprev v3.73.1 -> v3.74
Sam Van Den Berge (1):
libiio: use setuptools functions instead of distutils
Thomas Perrot (1):
breakpad: fix branch for gtest in SRC_URI
Tim Orling (2):
python3-wheel: drop; moved to oe-core
python3-test-generator: drop recipe
Trevor Gamblin (1):
phoronix-test-suite: upgrade 9.2.1 -> 10.8.1
Wang Mingyu (39):
ndpi: upgrade 4.0 -> 4.2
ntopng: upgrade 5.0 -> 5.2.1
python3-werkzeug: upgrade 2.0.2 -> 2.0.3
python3-twisted: upgrade 21.7.0 -> 22.1.0
python3-natsort: upgrade 8.0.2 -> 8.1.0
xfsdump: upgrade 3.1.9 -> 3.1.10
mm-common: upgrade 1.0.3 -> 1.0.4
fsverity-utils: upgrade 1.4 -> 1.5
libgee: upgrade 0.20.4 -> 0.20.5
libqmi: upgrade 1.30.2 -> 1.30.4
libcrypt-openssl-guess-perl: upgrade 0.14 -> 0.15
gjs: upgrade 1.70.0 -> 1.70.1
dnf-plugin-tui: Fix a bug of multilib
libwacom: upgrade 1.12 -> 2.1.0
gedit: upgrade 40.1 -> 41.0
gnome-autoar: upgrade 0.4.2 -> 0.4.3
libwnck3: upgrade 40.0 -> 40.1
iscsi-initiator-utils: upgrade 2.1.5 -> 2.1.6
iotop: upgrade 1.20 -> 1.21
inotify-tools: upgrade 3.21.9.6 -> 3.22.1.0
gnuplot: upgrade 5.4.2 -> 5.4.3
libxmlb: upgrade 0.3.6 -> 0.3.7
libgusb: upgrade 0.3.9 -> 0.3.10
monit: upgrade 5.30.0 -> 5.31.0
libjcat: upgrade 0.1.9 -> 0.1.10
libio-socket-ssl-perl: upgrade 2.073 -> 2.074
mpv: upgrade 0.34.0 -> 0.34.1
php: upgrade 8.1.2 -> 8.1.3
nano: upgrade 6.0 -> 6.2
rdma-core: upgrade 38.0 -> 39.0
netplan: upgrade 0.103 -> 0.104
nautilus: upgrade 41.1 -> 41.2
zchunk: upgrade 1.1.16 -> 1.2.0
tree: upgrade 2.0.1 -> 2.0.2
soci: upgrade 4.0.2 -> 4.0.3
remmina: upgrade 1.4.23 -> 1.4.24
wolfssl: upgrade 5.1.0- > 5.2.0
tcpreplay: upgrade 4.4.0 -> 4.4.1
spice-protocol: upgrade 0.14.3 -> 0.14.4
Xu Huan (15):
python3-multidict: upgrade 5.2.0 -> 6.0.2
python3-pulsectl upgrade 21.10.5 -> 22.1.3
python3-pyephem: upgrade 4.1.1 -> 4.1.3
python3-pytest-timeout: upgrade 2.0.2 -> 2.1.0
python3-pywbemtools: upgrade 0.9.0 -> 0.9.1
python3-requests-oauthlib: upgrade 1.3.0 -> 1.3.1
python3-sqlalchemy: upgrade 1.4.29 -> 1.4.31
python3-oauthlib: upgrade 3.1.1 -> 3.2.0
python3-pyudev: upgrade 0.22.0 -> 0.23.2
python3-pyopenssl: upgrade 21.0.0 -> 22.0.0
python3-alembic upgrade 1.7.5 -> 1.7.6
python3-autobahn: upgrade 21.11.1 -> 22.1.1
python3-flask: upgrade 2.0.2 -> 2.0.3
python3-imageio: upgrade 2.15.0 -> 2.16.0
python3-jdatetime: upgrade 3.8.2 -> 4.0.0
Yi Zhao (5):
phpmyadmin: upgrade 5.1.1 -> 5.1.2
tcpdump: upgrade 4.99.0 -> 4.99.1
tcpslice: upgrade 1.2a3 -> 1.5
tcpreplay: update HOMEPAGE
samba: upgrade 4.14.11 -> 4.14.12
Zheng Ruoqin (6):
libjs-jquery: Upgrade to 3.3.1.
protobuf: upgrade 3.19.3 -> 3.19.4
phpmyadmin: upgrade 5.1.2 -> 5.1.3
postgresql: upgrade 14.1 -> 14.2
pugixml: upgrade 1.11.4 -> 1.12
poppler: upgrade 22.01.0 -> 22.02.0
wangmy (14):
fatcat: upgrade 1.1.0 -> 1.1.1
libnma: upgrade 1.8.32 -> 1.8.34
botan: upgrade 2.18.2 -> 2.19.1
cgdb: upgrade 0.7.1 -> 0.8.0
ddrescue: upgrade 1.25 -> 1.26
hostapd: upgrade 2.9 -> 2.10
libcereal: upgrade 1.3.0 -> 1.3.1
ser2net: upgrade 4.3.4 -> 4.3.5
dlt-daemon: upgrade 2.18.7 -> 2.18.8
devilspie2: upgrade 0.43 -> 0.44
opensaf: upgrade 5.21.09 -> 5.22.01
tcpreplay: upgrade 4.3.4 -> 4.4.0
lcms: upgrade 2.12 -> 2.13.1
libcgi-perl: upgrade 4.53 -> 4.54
meta-security: c20b35b527..6cc8dde794:
Akshay Bhat (2):
meta-hardening: Fix override syntax
scap-security-guide: Fix openembedded platform tests
Anton Antonov (1):
Upgrade parsec-tool to 0.5.1
Armin Kuster (11):
google-authenticator-libpam: update to 1.09
packagegroup-security-tpm2.bb: remove dynamic pkgs
tpm2-pkcs11_1.7.0: Drop dstat from DPENDS
lkrg-module: update to 0.9.2
suricata: update to 6.0.4
tpm2-tss: update to 3.1.0
parsec-service: fix compile issue.
layer.conf: Update to use kirkstone
recipes: Use renamed SKIP_RECIPE varFlag
chipsec: fix WARNING
smack: Use new CVE_CHECK_IGNORE variable
Patrick Williams (1):
tpm2-pkcs11: fix RDEPENDS variable
Yi Zhao (1):
samhain: upgrade 4.4.3 -> 4.4.6
Signed-off-by: Andrew Geissler <geissonator@yahoo.com>
Change-Id: I270425c8a022f2e281a28ea19fdfae47aa375551
diff --git a/poky/meta/recipes-connectivity/avahi/avahi_0.8.bb b/poky/meta/recipes-connectivity/avahi/avahi_0.8.bb
index 4b15d11..3e020e6 100644
--- a/poky/meta/recipes-connectivity/avahi/avahi_0.8.bb
+++ b/poky/meta/recipes-connectivity/avahi/avahi_0.8.bb
@@ -12,7 +12,7 @@
# major part is under LGPLv2.1+, but several .dtd, .xsl, initscripts and
# python scripts are under GPLv2+
-LICENSE = "GPLv2+ & LGPLv2.1+"
+LICENSE = "GPL-2.0-or-later & LGPL-2.1-or-later"
LIC_FILES_CHKSUM = "file://LICENSE;md5=2d5025d4aa3495befef8f17206a5b0a1 \
file://avahi-common/address.h;endline=25;md5=b1d1d2cda1c07eb848ea7d6215712d9d \
file://avahi-core/dns.h;endline=23;md5=6fe82590b81aa0ddea5095b548e2fdcb \
@@ -33,7 +33,7 @@
SRC_URI[sha256sum] = "060309d7a333d38d951bc27598c677af1796934dbd98e1024e7ad8de798fedda"
# Issue only affects Debian/SUSE, not us
-CVE_CHECK_WHITELIST += "CVE-2021-26720"
+CVE_CHECK_IGNORE += "CVE-2021-26720"
DEPENDS = "expat libcap libdaemon glib-2.0"
@@ -109,15 +109,15 @@
${bindir}/avahi-discover-standalone \
"
-LICENSE:libavahi-gobject = "LGPLv2.1+"
-LICENSE:avahi-daemon = "LGPLv2.1+"
-LICENSE:libavahi-common = "LGPLv2.1+"
-LICENSE:libavahi-core = "LGPLv2.1+"
-LICENSE:libavahi-client = "LGPLv2.1+"
-LICENSE:avahi-dnsconfd = "LGPLv2.1+"
-LICENSE:libavahi-glib = "LGPLv2.1+"
-LICENSE:avahi-autoipd = "LGPLv2.1+"
-LICENSE:avahi-utils = "LGPLv2.1+"
+LICENSE:libavahi-gobject = "LGPL-2.1-or-later"
+LICENSE:avahi-daemon = "LGPL-2.1-or-later"
+LICENSE:libavahi-common = "LGPL-2.1-or-later"
+LICENSE:libavahi-core = "LGPL-2.1-or-later"
+LICENSE:libavahi-client = "LGPL-2.1-or-later"
+LICENSE:avahi-dnsconfd = "LGPL-2.1-or-later"
+LICENSE:libavahi-glib = "LGPL-2.1-or-later"
+LICENSE:avahi-autoipd = "LGPL-2.1-or-later"
+LICENSE:avahi-utils = "LGPL-2.1-or-later"
# As avahi doesn't put any files into PN, clear the files list to avoid problems
# if extra libraries appear.
diff --git a/poky/meta/recipes-connectivity/bind/bind-9.16.24/0001-avoid-start-failure-with-bind-user.patch b/poky/meta/recipes-connectivity/bind/bind-9.16.26/0001-avoid-start-failure-with-bind-user.patch
similarity index 100%
rename from poky/meta/recipes-connectivity/bind/bind-9.16.24/0001-avoid-start-failure-with-bind-user.patch
rename to poky/meta/recipes-connectivity/bind/bind-9.16.26/0001-avoid-start-failure-with-bind-user.patch
diff --git a/poky/meta/recipes-connectivity/bind/bind-9.16.24/0001-named-lwresd-V-and-start-log-hide-build-options.patch b/poky/meta/recipes-connectivity/bind/bind-9.16.26/0001-named-lwresd-V-and-start-log-hide-build-options.patch
similarity index 100%
rename from poky/meta/recipes-connectivity/bind/bind-9.16.24/0001-named-lwresd-V-and-start-log-hide-build-options.patch
rename to poky/meta/recipes-connectivity/bind/bind-9.16.26/0001-named-lwresd-V-and-start-log-hide-build-options.patch
diff --git a/poky/meta/recipes-connectivity/bind/bind-9.16.24/bind-ensure-searching-for-json-headers-searches-sysr.patch b/poky/meta/recipes-connectivity/bind/bind-9.16.26/bind-ensure-searching-for-json-headers-searches-sysr.patch
similarity index 100%
rename from poky/meta/recipes-connectivity/bind/bind-9.16.24/bind-ensure-searching-for-json-headers-searches-sysr.patch
rename to poky/meta/recipes-connectivity/bind/bind-9.16.26/bind-ensure-searching-for-json-headers-searches-sysr.patch
diff --git a/poky/meta/recipes-connectivity/bind/bind-9.16.24/bind9 b/poky/meta/recipes-connectivity/bind/bind-9.16.26/bind9
similarity index 100%
rename from poky/meta/recipes-connectivity/bind/bind-9.16.24/bind9
rename to poky/meta/recipes-connectivity/bind/bind-9.16.26/bind9
diff --git a/poky/meta/recipes-connectivity/bind/bind-9.16.24/conf.patch b/poky/meta/recipes-connectivity/bind/bind-9.16.26/conf.patch
similarity index 100%
rename from poky/meta/recipes-connectivity/bind/bind-9.16.24/conf.patch
rename to poky/meta/recipes-connectivity/bind/bind-9.16.26/conf.patch
diff --git a/poky/meta/recipes-connectivity/bind/bind-9.16.24/generate-rndc-key.sh b/poky/meta/recipes-connectivity/bind/bind-9.16.26/generate-rndc-key.sh
similarity index 100%
rename from poky/meta/recipes-connectivity/bind/bind-9.16.24/generate-rndc-key.sh
rename to poky/meta/recipes-connectivity/bind/bind-9.16.26/generate-rndc-key.sh
diff --git a/poky/meta/recipes-connectivity/bind/bind-9.16.24/init.d-add-support-for-read-only-rootfs.patch b/poky/meta/recipes-connectivity/bind/bind-9.16.26/init.d-add-support-for-read-only-rootfs.patch
similarity index 100%
rename from poky/meta/recipes-connectivity/bind/bind-9.16.24/init.d-add-support-for-read-only-rootfs.patch
rename to poky/meta/recipes-connectivity/bind/bind-9.16.26/init.d-add-support-for-read-only-rootfs.patch
diff --git a/poky/meta/recipes-connectivity/bind/bind-9.16.24/make-etc-initd-bind-stop-work.patch b/poky/meta/recipes-connectivity/bind/bind-9.16.26/make-etc-initd-bind-stop-work.patch
similarity index 100%
rename from poky/meta/recipes-connectivity/bind/bind-9.16.24/make-etc-initd-bind-stop-work.patch
rename to poky/meta/recipes-connectivity/bind/bind-9.16.26/make-etc-initd-bind-stop-work.patch
diff --git a/poky/meta/recipes-connectivity/bind/bind-9.16.24/named.service b/poky/meta/recipes-connectivity/bind/bind-9.16.26/named.service
similarity index 100%
rename from poky/meta/recipes-connectivity/bind/bind-9.16.24/named.service
rename to poky/meta/recipes-connectivity/bind/bind-9.16.26/named.service
diff --git a/poky/meta/recipes-connectivity/bind/bind_9.16.24.bb b/poky/meta/recipes-connectivity/bind/bind_9.16.26.bb
similarity index 95%
rename from poky/meta/recipes-connectivity/bind/bind_9.16.24.bb
rename to poky/meta/recipes-connectivity/bind/bind_9.16.26.bb
index ef5fd42..877d0a2 100644
--- a/poky/meta/recipes-connectivity/bind/bind_9.16.24.bb
+++ b/poky/meta/recipes-connectivity/bind/bind_9.16.26.bb
@@ -4,7 +4,7 @@
SECTION = "console/network"
LICENSE = "MPL-2.0"
-LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=ef10b4de6371115dcecdc38ca2af4561"
+LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=4e7b3c52170a348459a4ff3f5ce95e37"
DEPENDS = "openssl libcap zlib libuv"
@@ -20,7 +20,7 @@
file://0001-avoid-start-failure-with-bind-user.patch \
"
-SRC_URI[sha256sum] = "5582f3734bd6232284f93f14206b8a46d1f819dea4797ae157066f6963b08507"
+SRC_URI[sha256sum] = "70b39a5eb71650358ec9ba41da3050d32aeac0aeb4a466684b23f35affa7fb45"
UPSTREAM_CHECK_URI = "https://ftp.isc.org/isc/bind9/"
# stay at 9.16 follow the ESV versions divisible by 4
@@ -28,7 +28,7 @@
# Issue only affects dhcpd with recent bind versions. We don't ship dhcpd anymore
# so the issue doesn't affect us.
-CVE_CHECK_WHITELIST += "CVE-2019-6470"
+CVE_CHECK_IGNORE += "CVE-2019-6470"
inherit autotools update-rc.d systemd useradd pkgconfig multilib_header update-alternatives
diff --git a/poky/meta/recipes-connectivity/bluez5/bluez5.inc b/poky/meta/recipes-connectivity/bluez5/bluez5.inc
index 0a5fc9d..79d4645 100644
--- a/poky/meta/recipes-connectivity/bluez5/bluez5.inc
+++ b/poky/meta/recipes-connectivity/bluez5/bluez5.inc
@@ -2,7 +2,7 @@
DESCRIPTION = "Linux Bluetooth stack V5 userland components. These include a system configurations, daemons, tools and system libraries."
HOMEPAGE = "http://www.bluez.org"
SECTION = "libs"
-LICENSE = "GPLv2+ & LGPLv2.1+"
+LICENSE = "GPL-2.0-or-later & LGPL-2.1-or-later"
LIC_FILES_CHKSUM = "file://COPYING;md5=12f884d2ae1ff87c09e5b7ccc2c4ca7e \
file://COPYING.LIB;md5=fb504b67c50331fc78734fed90fb0e09 \
file://src/main.c;beginline=1;endline=24;md5=0ad83ca0dc37ab08af448777c581e7ac"
diff --git a/poky/meta/recipes-connectivity/bluez5/bluez5_5.63.bb b/poky/meta/recipes-connectivity/bluez5/bluez5_5.63.bb
index 34c4767..a9ee291 100644
--- a/poky/meta/recipes-connectivity/bluez5/bluez5_5.63.bb
+++ b/poky/meta/recipes-connectivity/bluez5/bluez5_5.63.bb
@@ -3,7 +3,7 @@
SRC_URI[sha256sum] = "9349e11e8160bb3d720835d271250d8a7424d3690f5289e6db6fe07cc66c6d76"
# These issues have kernel fixes rather than bluez fixes so exclude here
-CVE_CHECK_WHITELIST += "CVE-2020-12352 CVE-2020-24490"
+CVE_CHECK_IGNORE += "CVE-2020-12352 CVE-2020-24490"
# noinst programs in Makefile.tools that are conditional on READLINE
# support
diff --git a/poky/meta/recipes-connectivity/connman/connman-conf.bb b/poky/meta/recipes-connectivity/connman/connman-conf.bb
index 97ac498..6b9207c 100644
--- a/poky/meta/recipes-connectivity/connman/connman-conf.bb
+++ b/poky/meta/recipes-connectivity/connman/connman-conf.bb
@@ -1,7 +1,7 @@
SUMMARY = "Connman config to ignore wired interface on qemu machines"
DESCRIPTION = "This is the ConnMan configuration to avoid touching wired \
network interface inside qemu machines."
-LICENSE = "GPLv2"
+LICENSE = "GPL-2.0-only"
LIC_FILES_CHKSUM = "file://${COREBASE}/meta/files/common-licenses/GPL-2.0-only;md5=801f80980d171dd6425610833a22dbe6"
PR = "r2"
diff --git a/poky/meta/recipes-connectivity/connman/connman-gnome_0.7.bb b/poky/meta/recipes-connectivity/connman/connman-gnome_0.7.bb
index 7e1619a..fcd154b 100644
--- a/poky/meta/recipes-connectivity/connman/connman-gnome_0.7.bb
+++ b/poky/meta/recipes-connectivity/connman/connman-gnome_0.7.bb
@@ -1,7 +1,7 @@
SUMMARY = "GTK+ frontend for the ConnMan network connection manager"
HOMEPAGE = "http://connman.net/"
SECTION = "libs/network"
-LICENSE = "GPLv2 & LGPLv2.1"
+LICENSE = "GPL-2.0-only & LGPL-2.1-only"
LIC_FILES_CHKSUM = "file://COPYING;md5=eb723b61539feef013de476e68b5c50a \
file://properties/main.c;beginline=1;endline=20;md5=50c77c81871308b033ab7a1504626afb \
file://common/connman-dbus.c;beginline=1;endline=20;md5=de6b485c0e717a0236402d220187717a"
diff --git a/poky/meta/recipes-connectivity/connman/connman.inc b/poky/meta/recipes-connectivity/connman/connman.inc
index 748eefa..5880ecd 100644
--- a/poky/meta/recipes-connectivity/connman/connman.inc
+++ b/poky/meta/recipes-connectivity/connman/connman.inc
@@ -9,7 +9,7 @@
implemented using plug-ins."
HOMEPAGE = "http://connman.net/"
BUGTRACKER = "https://01.org/jira/browse/CM"
-LICENSE = "GPLv2"
+LICENSE = "GPL-2.0-only"
LIC_FILES_CHKSUM = "file://COPYING;md5=12f884d2ae1ff87c09e5b7ccc2c4ca7e \
file://src/main.c;beginline=1;endline=20;md5=486a279a6ab0c8d152bcda3a5b5edc36"
diff --git a/poky/meta/recipes-connectivity/connman/connman_1.40.bb b/poky/meta/recipes-connectivity/connman/connman_1.41.bb
similarity index 84%
rename from poky/meta/recipes-connectivity/connman/connman_1.40.bb
rename to poky/meta/recipes-connectivity/connman/connman_1.41.bb
index edb23a1..736b78e 100644
--- a/poky/meta/recipes-connectivity/connman/connman_1.40.bb
+++ b/poky/meta/recipes-connectivity/connman/connman_1.41.bb
@@ -9,7 +9,7 @@
SRC_URI:append:libc-musl = " file://0002-resolve-musl-does-not-implement-res_ninit.patch"
-SRC_URI[sha256sum] = "1a57ae7ce234aa3a1744aac3be5c2121d98dce999440ef8ab9cc4edfd5edcb12"
+SRC_URI[sha256sum] = "79fb40f4fdd5530c45aa8e592fb16ba23d3674f3a98cf10b89a6576f198de589"
RRECOMMENDS:${PN} = "connman-conf"
RCONFLICTS:${PN} = "networkmanager"
diff --git a/poky/meta/recipes-connectivity/dhcpcd/dhcpcd_9.4.1.bb b/poky/meta/recipes-connectivity/dhcpcd/dhcpcd_9.4.1.bb
index 4007a4b..ab6ffe9 100644
--- a/poky/meta/recipes-connectivity/dhcpcd/dhcpcd_9.4.1.bb
+++ b/poky/meta/recipes-connectivity/dhcpcd/dhcpcd_9.4.1.bb
@@ -32,8 +32,11 @@
PACKAGECONFIG[chrony] = "--with-hook=ntp, , ,chrony"
PACKAGECONFIG[ypbind] = "--with-eghook=yp, , ,ypbind-mt"
+# add option to override DBDIR location
+DBDIR ?= "${localstatedir}/lib/${BPN}"
+
EXTRA_OECONF = "--enable-ipv4 \
- --dbdir=${localstatedir}/lib/${BPN} \
+ --dbdir=${DBDIR} \
--sbindir=${base_sbindir} \
--runstatedir=/run \
--enable-privsep \
@@ -43,15 +46,15 @@
"
USERADD_PACKAGES = "${PN}"
-USERADD_PARAM:${PN} = "--system -d ${localstatedir}/lib/${BPN} -M -s /bin/false -U dhcpcd"
+USERADD_PARAM:${PN} = "--system -d ${DBDIR} -M -s /bin/false -U dhcpcd"
do_install:append () {
# install systemd unit files
install -d ${D}${systemd_system_unitdir}
install -m 0644 ${WORKDIR}/dhcpcd*.service ${D}${systemd_system_unitdir}
- chmod 700 ${D}${localstatedir}/lib/${BPN}
- chown dhcpcd:dhcpcd ${D}${localstatedir}/lib/${BPN}
+ chmod 700 ${D}${DBDIR}
+ chown dhcpcd:dhcpcd ${D}${DBDIR}
}
FILES:${PN}-dbg += "${libdir}/dhcpcd/dev/.debug"
diff --git a/poky/meta/recipes-connectivity/inetutils/inetutils_2.2.bb b/poky/meta/recipes-connectivity/inetutils/inetutils_2.2.bb
index 3bab137..6c9a299 100644
--- a/poky/meta/recipes-connectivity/inetutils/inetutils_2.2.bb
+++ b/poky/meta/recipes-connectivity/inetutils/inetutils_2.2.bb
@@ -6,7 +6,7 @@
SECTION = "net"
DEPENDS = "ncurses netbase readline virtual/crypt"
-LICENSE = "GPLv3"
+LICENSE = "GPL-3.0-only"
LIC_FILES_CHKSUM = "file://COPYING;md5=0c7051aef9219dc7237f206c5c4179a7"
diff --git a/poky/meta/recipes-connectivity/iproute2/iproute2.inc b/poky/meta/recipes-connectivity/iproute2/iproute2.inc
index 3f070d6..b1bcc14 100644
--- a/poky/meta/recipes-connectivity/iproute2/iproute2.inc
+++ b/poky/meta/recipes-connectivity/iproute2/iproute2.inc
@@ -5,7 +5,7 @@
configuration and tc stands for traffic control."
HOMEPAGE = "http://www.linuxfoundation.org/collaborate/workgroups/networking/iproute2"
SECTION = "base"
-LICENSE = "GPLv2+"
+LICENSE = "GPL-2.0-or-later"
LIC_FILES_CHKSUM = "file://COPYING;md5=eb723b61539feef013de476e68b5c50a \
file://ip/ip.c;beginline=3;endline=8;md5=689d691d0410a4b64d3899f8d6e31817"
diff --git a/poky/meta/recipes-connectivity/libnss-mdns/libnss-mdns_0.15.1.bb b/poky/meta/recipes-connectivity/libnss-mdns/libnss-mdns_0.15.1.bb
index f5c87f7..0db609f 100644
--- a/poky/meta/recipes-connectivity/libnss-mdns/libnss-mdns_0.15.1.bb
+++ b/poky/meta/recipes-connectivity/libnss-mdns/libnss-mdns_0.15.1.bb
@@ -3,7 +3,7 @@
DESCRIPTION = "nss-mdns is a plugin for the GNU Name Service Switch (NSS) functionality of the GNU C Library (glibc) providing host name resolution via Multicast DNS (aka Zeroconf, aka Apple Rendezvous, aka Apple Bonjour), effectively allowing name resolution by common Unix/Linux programs in the ad-hoc mDNS domain .local."
SECTION = "libs"
-LICENSE = "LGPLv2.1+"
+LICENSE = "LGPL-2.1-or-later"
LIC_FILES_CHKSUM = "file://LICENSE;md5=2d5025d4aa3495befef8f17206a5b0a1"
DEPENDS = "avahi"
diff --git a/poky/meta/recipes-connectivity/libpcap/libpcap_1.10.1.bb b/poky/meta/recipes-connectivity/libpcap/libpcap_1.10.1.bb
index 9a8c46e..dbe2fd8 100644
--- a/poky/meta/recipes-connectivity/libpcap/libpcap_1.10.1.bb
+++ b/poky/meta/recipes-connectivity/libpcap/libpcap_1.10.1.bb
@@ -19,10 +19,11 @@
# Explicitly disable dag support. We don't have recipe for it and if enabled here,
# configure script poisons the include dirs with /usr/local/include even when the
-# support hasn't been detected.
+# support hasn't been detected. Do the same thing for DPDK.
EXTRA_OECONF = " \
--with-pcap=linux \
--without-dag \
+ --without-dpdk \
"
EXTRA_AUTORECONF += "--exclude=aclocal"
diff --git a/poky/meta/recipes-connectivity/neard/neard_0.16.bb b/poky/meta/recipes-connectivity/neard/neard_0.16.bb
index b6cc1d6..57f2a3e 100644
--- a/poky/meta/recipes-connectivity/neard/neard_0.16.bb
+++ b/poky/meta/recipes-connectivity/neard/neard_0.16.bb
@@ -1,7 +1,7 @@
SUMMARY = "Linux NFC daemon"
DESCRIPTION = "A daemon for the Linux Near Field Communication stack"
HOMEPAGE = "http://01.org/linux-nfc"
-LICENSE = "GPLv2"
+LICENSE = "GPL-2.0-only"
DEPENDS = "dbus glib-2.0 libnl"
diff --git a/poky/meta/recipes-connectivity/nfs-utils/nfs-utils_2.5.4.bb b/poky/meta/recipes-connectivity/nfs-utils/nfs-utils_2.6.1.bb
similarity index 97%
rename from poky/meta/recipes-connectivity/nfs-utils/nfs-utils_2.5.4.bb
rename to poky/meta/recipes-connectivity/nfs-utils/nfs-utils_2.6.1.bb
index 459f68f..bbed5ae 100644
--- a/poky/meta/recipes-connectivity/nfs-utils/nfs-utils_2.5.4.bb
+++ b/poky/meta/recipes-connectivity/nfs-utils/nfs-utils_2.6.1.bb
@@ -4,7 +4,7 @@
HOMEPAGE = "http://nfs.sourceforge.net/"
SECTION = "console/network"
-LICENSE = "MIT & GPLv2+ & BSD-3-Clause"
+LICENSE = "MIT & GPL-2.0-or-later & BSD-3-Clause"
LIC_FILES_CHKSUM = "file://COPYING;md5=95f3a93a5c3c7888de623b46ea085a84"
# util-linux for libblkid
@@ -31,7 +31,7 @@
file://0001-Makefile.am-fix-undefined-function-for-libnsm.a.patch \
file://clang-warnings.patch \
"
-SRC_URI[sha256sum] = "51997d94e4c8bcef5456dd36a9ccc38e231207c4e9b6a9a2c108841e6aebe3dd"
+SRC_URI[sha256sum] = "60dfcd94a9f3d72a12bc7058d811787ec87a6d593d70da2123faf9aad3d7a1df"
# Only kernel-module-nfsd is required here (but can be built-in) - the nfsd module will
# pull in the remainder of the dependencies.
diff --git a/poky/meta/recipes-connectivity/ofono/ofono_1.34.bb b/poky/meta/recipes-connectivity/ofono/ofono_1.34.bb
index 24369b3..2363174 100644
--- a/poky/meta/recipes-connectivity/ofono/ofono_1.34.bb
+++ b/poky/meta/recipes-connectivity/ofono/ofono_1.34.bb
@@ -2,7 +2,7 @@
DESCRIPTION = "oFono is a stack for mobile telephony devices on Linux. oFono supports speaking to telephony devices through specific drivers, or with generic AT commands."
HOMEPAGE = "http://www.ofono.org"
BUGTRACKER = "https://01.org/jira/browse/OF"
-LICENSE = "GPLv2"
+LICENSE = "GPL-2.0-only"
LIC_FILES_CHKSUM = "file://COPYING;md5=eb723b61539feef013de476e68b5c50a \
file://src/ofono.h;beginline=1;endline=20;md5=3ce17d5978ef3445def265b98899c2ee"
DEPENDS = "dbus glib-2.0 udev mobile-broadband-provider-info ell"
diff --git a/poky/meta/recipes-connectivity/openssh/openssh_8.8p1.bb b/poky/meta/recipes-connectivity/openssh/openssh_8.8p1.bb
index ee86bb9..953c29d 100644
--- a/poky/meta/recipes-connectivity/openssh/openssh_8.8p1.bb
+++ b/poky/meta/recipes-connectivity/openssh/openssh_8.8p1.bb
@@ -28,14 +28,14 @@
SRC_URI[sha256sum] = "4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9"
# This CVE is specific to OpenSSH with the pam opie which we don't build/use here
-CVE_CHECK_WHITELIST += "CVE-2007-2768"
+CVE_CHECK_IGNORE += "CVE-2007-2768"
# This CVE is specific to OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7
# and when running in a Kerberos environment. As such it is not relevant to OpenEmbedded
-CVE_CHECK_WHITELIST += "CVE-2014-9278"
+CVE_CHECK_IGNORE += "CVE-2014-9278"
# CVE only applies to some distributed RHEL binaries
-CVE_CHECK_WHITELIST += "CVE-2008-3844"
+CVE_CHECK_IGNORE += "CVE-2008-3844"
PAM_SRC_URI = "file://sshd"
diff --git a/poky/meta/recipes-connectivity/openssl/openssl_3.0.1.bb b/poky/meta/recipes-connectivity/openssl/openssl_3.0.1.bb
index 7727ec4..1128f6a 100644
--- a/poky/meta/recipes-connectivity/openssl/openssl_3.0.1.bb
+++ b/poky/meta/recipes-connectivity/openssl/openssl_3.0.1.bb
@@ -55,6 +55,15 @@
DEPRECATED_CRYPTO_FLAGS ?= ""
do_configure () {
+ # When we upgrade glibc but not uninative we see obtuse failures in openssl. Make
+ # the issue really clear that perl isn't functional due to symbol mismatch issues.
+ cat <<- EOF > ${WORKDIR}/perltest
+ #!/usr/bin/env perl
+ use POSIX;
+ EOF
+ chmod a+x ${WORKDIR}/perltest
+ ${WORKDIR}/perltest
+
os=${HOST_OS}
case $os in
linux-gnueabi |\
@@ -160,7 +169,8 @@
OPENSSL_CONF=${libdir}/ssl-3/openssl.cnf \
SSL_CERT_DIR=${libdir}/ssl-3/certs \
SSL_CERT_FILE=${libdir}/ssl-3/cert.pem \
- OPENSSL_ENGINES=${libdir}/engines-3
+ OPENSSL_ENGINES=${libdir}/engines-3 \
+ OPENSSL_MODULES=${libdir}/ossl-modules
}
do_install:append:class-nativesdk () {
@@ -245,4 +255,4 @@
# Only affects OpenSSL >= 1.1.1 in combination with Apache < 2.4.37
# Apache in meta-webserver is already recent enough
-CVE_CHECK_WHITELIST += "CVE-2019-0190"
+CVE_CHECK_IGNORE += "CVE-2019-0190"
diff --git a/poky/meta/recipes-connectivity/ppp/ppp_2.4.9.bb b/poky/meta/recipes-connectivity/ppp/ppp_2.4.9.bb
index bd6435e..700ece6 100644
--- a/poky/meta/recipes-connectivity/ppp/ppp_2.4.9.bb
+++ b/poky/meta/recipes-connectivity/ppp/ppp_2.4.9.bb
@@ -5,7 +5,7 @@
HOMEPAGE = "http://samba.org/ppp/"
BUGTRACKER = "http://ppp.samba.org/cgi-bin/ppp-bugs"
DEPENDS = "libpcap openssl virtual/crypt"
-LICENSE = "BSD-3-Clause & BSD-3-Clause-Attribution & GPLv2+ & LGPLv2+ & PD"
+LICENSE = "BSD-3-Clause & BSD-3-Clause-Attribution & GPL-2.0-or-later & LGPL-2.0-or-later & PD"
LIC_FILES_CHKSUM = "file://pppd/ccp.c;beginline=1;endline=29;md5=e2c43fe6e81ff77d87dc9c290a424dea \
file://pppd/plugins/passprompt.c;beginline=1;endline=10;md5=3bcbcdbf0e369c9a3e0b8c8275b065d8 \
file://pppd/tdb.c;beginline=1;endline=27;md5=4ca3a9991b011038d085d6675ae7c4e6 \
diff --git a/poky/meta/recipes-connectivity/resolvconf/resolvconf_1.91.bb b/poky/meta/recipes-connectivity/resolvconf/resolvconf_1.91.bb
index cb25238..94fd2c1 100644
--- a/poky/meta/recipes-connectivity/resolvconf/resolvconf_1.91.bb
+++ b/poky/meta/recipes-connectivity/resolvconf/resolvconf_1.91.bb
@@ -5,7 +5,7 @@
nameserver information and programs that need nameserver \
information."
SECTION = "console/network"
-LICENSE = "GPLv2+"
+LICENSE = "GPL-2.0-or-later"
LIC_FILES_CHKSUM = "file://COPYING;md5=c93c0550bd3173f4504b2cbd8991e50b"
AUTHOR = "Thomas Hood"
HOMEPAGE = "http://packages.debian.org/resolvconf"
diff --git a/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-AP-Silently-ignore-management-frame-from-unexpected-.patch b/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-AP-Silently-ignore-management-frame-from-unexpected-.patch
deleted file mode 100644
index 7b0713c..0000000
--- a/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-AP-Silently-ignore-management-frame-from-unexpected-.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication
-of disconnection in certain situations because source address validation is
-mishandled. This is a denial of service that should have been prevented by PMF
-(aka management frame protection). The attacker must send a crafted 802.11 frame
-from a location that is within the 802.11 communications range.
-
-CVE: CVE-2019-16275
-Upstream-Status: Backport
-Signed-off-by: Ross Burton <ross.burton@intel.com>
-
-From 8c07fa9eda13e835f3f968b2e1c9a8be3a851ff9 Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <j@w1.fi>
-Date: Thu, 29 Aug 2019 11:52:04 +0300
-Subject: [PATCH] AP: Silently ignore management frame from unexpected source
- address
-
-Do not process any received Management frames with unexpected/invalid SA
-so that we do not add any state for unexpected STA addresses or end up
-sending out frames to unexpected destination. This prevents unexpected
-sequences where an unprotected frame might end up causing the AP to send
-out a response to another device and that other device processing the
-unexpected response.
-
-In particular, this prevents some potential denial of service cases
-where the unexpected response frame from the AP might result in a
-connected station dropping its association.
-
-Signed-off-by: Jouni Malinen <j@w1.fi>
----
- src/ap/drv_callbacks.c | 13 +++++++++++++
- src/ap/ieee802_11.c | 12 ++++++++++++
- 2 files changed, 25 insertions(+)
-
-diff --git a/src/ap/drv_callbacks.c b/src/ap/drv_callbacks.c
-index 31587685fe3b..34ca379edc3d 100644
---- a/src/ap/drv_callbacks.c
-+++ b/src/ap/drv_callbacks.c
-@@ -131,6 +131,19 @@ int hostapd_notif_assoc(struct hostapd_data *hapd, const u8 *addr,
- "hostapd_notif_assoc: Skip event with no address");
- return -1;
- }
-+
-+ if (is_multicast_ether_addr(addr) ||
-+ is_zero_ether_addr(addr) ||
-+ os_memcmp(addr, hapd->own_addr, ETH_ALEN) == 0) {
-+ /* Do not process any frames with unexpected/invalid SA so that
-+ * we do not add any state for unexpected STA addresses or end
-+ * up sending out frames to unexpected destination. */
-+ wpa_printf(MSG_DEBUG, "%s: Invalid SA=" MACSTR
-+ " in received indication - ignore this indication silently",
-+ __func__, MAC2STR(addr));
-+ return 0;
-+ }
-+
- random_add_randomness(addr, ETH_ALEN);
-
- hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
-diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c
-index c85a28db44b7..e7065372e158 100644
---- a/src/ap/ieee802_11.c
-+++ b/src/ap/ieee802_11.c
-@@ -4626,6 +4626,18 @@ int ieee802_11_mgmt(struct hostapd_data *hapd, const u8 *buf, size_t len,
- fc = le_to_host16(mgmt->frame_control);
- stype = WLAN_FC_GET_STYPE(fc);
-
-+ if (is_multicast_ether_addr(mgmt->sa) ||
-+ is_zero_ether_addr(mgmt->sa) ||
-+ os_memcmp(mgmt->sa, hapd->own_addr, ETH_ALEN) == 0) {
-+ /* Do not process any frames with unexpected/invalid SA so that
-+ * we do not add any state for unexpected STA addresses or end
-+ * up sending out frames to unexpected destination. */
-+ wpa_printf(MSG_DEBUG, "MGMT: Invalid SA=" MACSTR
-+ " in received frame - ignore this frame silently",
-+ MAC2STR(mgmt->sa));
-+ return 0;
-+ }
-+
- if (stype == WLAN_FC_STYPE_BEACON) {
- handle_beacon(hapd, mgmt, len, fi);
- return 1;
---
-2.20.1
diff --git a/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch b/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch
deleted file mode 100644
index 53ad5d0..0000000
--- a/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch
+++ /dev/null
@@ -1,151 +0,0 @@
-From 5b78c8f961f25f4dc22d6f2b77ddd06d712cec63 Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <jouni@codeaurora.org>
-Date: Wed, 3 Jun 2020 23:17:35 +0300
-Subject: [PATCH 1/3] WPS UPnP: Do not allow event subscriptions with URLs to
- other networks
-
-The UPnP Device Architecture 2.0 specification errata ("UDA errata
-16-04-2020.docx") addresses a problem with notifications being allowed
-to go out to other domains by disallowing such cases. Do such filtering
-for the notification callback URLs to avoid undesired connections to
-external networks based on subscriptions that any device in the local
-network could request when WPS support for external registrars is
-enabled (the upnp_iface parameter in hostapd configuration).
-
-Upstream-Status: Backport
-CVE: CVE-2020-12695 patch #1
-Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
-Signed-off-by: Armin Kuster <akuster@mvista.com>
-
----
- src/wps/wps_er.c | 2 +-
- src/wps/wps_upnp.c | 38 ++++++++++++++++++++++++++++++++++++--
- src/wps/wps_upnp_i.h | 3 ++-
- 3 files changed, 39 insertions(+), 4 deletions(-)
-
-Index: wpa_supplicant-2.9/src/wps/wps_er.c
-===================================================================
---- wpa_supplicant-2.9.orig/src/wps/wps_er.c
-+++ wpa_supplicant-2.9/src/wps/wps_er.c
-@@ -1298,7 +1298,7 @@ wps_er_init(struct wps_context *wps, con
- "with %s", filter);
- }
- if (get_netif_info(er->ifname, &er->ip_addr, &er->ip_addr_text,
-- er->mac_addr)) {
-+ NULL, er->mac_addr)) {
- wpa_printf(MSG_INFO, "WPS UPnP: Could not get IP/MAC address "
- "for %s. Does it have IP address?", er->ifname);
- wps_er_deinit(er, NULL, NULL);
-Index: wpa_supplicant-2.9/src/wps/wps_upnp.c
-===================================================================
---- wpa_supplicant-2.9.orig/src/wps/wps_upnp.c
-+++ wpa_supplicant-2.9/src/wps/wps_upnp.c
-@@ -303,6 +303,14 @@ static void subscr_addr_free_all(struct
- }
-
-
-+static int local_network_addr(struct upnp_wps_device_sm *sm,
-+ struct sockaddr_in *addr)
-+{
-+ return (addr->sin_addr.s_addr & sm->netmask.s_addr) ==
-+ (sm->ip_addr & sm->netmask.s_addr);
-+}
-+
-+
- /* subscr_addr_add_url -- add address(es) for one url to subscription */
- static void subscr_addr_add_url(struct subscription *s, const char *url,
- size_t url_len)
-@@ -381,6 +389,7 @@ static void subscr_addr_add_url(struct s
-
- for (rp = result; rp; rp = rp->ai_next) {
- struct subscr_addr *a;
-+ struct sockaddr_in *addr = (struct sockaddr_in *) rp->ai_addr;
-
- /* Limit no. of address to avoid denial of service attack */
- if (dl_list_len(&s->addr_list) >= MAX_ADDR_PER_SUBSCRIPTION) {
-@@ -389,6 +398,13 @@ static void subscr_addr_add_url(struct s
- break;
- }
-
-+ if (!local_network_addr(s->sm, addr)) {
-+ wpa_printf(MSG_INFO,
-+ "WPS UPnP: Ignore a delivery URL that points to another network %s",
-+ inet_ntoa(addr->sin_addr));
-+ continue;
-+ }
-+
- a = os_zalloc(sizeof(*a) + alloc_len);
- if (a == NULL)
- break;
-@@ -889,11 +905,12 @@ static int eth_get(const char *device, u
- * @net_if: Selected network interface name
- * @ip_addr: Buffer for returning IP address in network byte order
- * @ip_addr_text: Buffer for returning a pointer to allocated IP address text
-+ * @netmask: Buffer for returning netmask or %NULL if not needed
- * @mac: Buffer for returning MAC address
- * Returns: 0 on success, -1 on failure
- */
- int get_netif_info(const char *net_if, unsigned *ip_addr, char **ip_addr_text,
-- u8 mac[ETH_ALEN])
-+ struct in_addr *netmask, u8 mac[ETH_ALEN])
- {
- struct ifreq req;
- int sock = -1;
-@@ -919,6 +936,19 @@ int get_netif_info(const char *net_if, u
- in_addr.s_addr = *ip_addr;
- os_snprintf(*ip_addr_text, 16, "%s", inet_ntoa(in_addr));
-
-+ if (netmask) {
-+ os_memset(&req, 0, sizeof(req));
-+ os_strlcpy(req.ifr_name, net_if, sizeof(req.ifr_name));
-+ if (ioctl(sock, SIOCGIFNETMASK, &req) < 0) {
-+ wpa_printf(MSG_ERROR,
-+ "WPS UPnP: SIOCGIFNETMASK failed: %d (%s)",
-+ errno, strerror(errno));
-+ goto fail;
-+ }
-+ addr = (struct sockaddr_in *) &req.ifr_netmask;
-+ netmask->s_addr = addr->sin_addr.s_addr;
-+ }
-+
- #ifdef __linux__
- os_strlcpy(req.ifr_name, net_if, sizeof(req.ifr_name));
- if (ioctl(sock, SIOCGIFHWADDR, &req) < 0) {
-@@ -1025,11 +1055,15 @@ static int upnp_wps_device_start(struct
-
- /* Determine which IP and mac address we're using */
- if (get_netif_info(net_if, &sm->ip_addr, &sm->ip_addr_text,
-- sm->mac_addr)) {
-+ &sm->netmask, sm->mac_addr)) {
- wpa_printf(MSG_INFO, "WPS UPnP: Could not get IP/MAC address "
- "for %s. Does it have IP address?", net_if);
- goto fail;
- }
-+ wpa_printf(MSG_DEBUG, "WPS UPnP: Local IP address %s netmask %s hwaddr "
-+ MACSTR,
-+ sm->ip_addr_text, inet_ntoa(sm->netmask),
-+ MAC2STR(sm->mac_addr));
-
- /* Listen for incoming TCP connections so that others
- * can fetch our "xml files" from us.
-Index: wpa_supplicant-2.9/src/wps/wps_upnp_i.h
-===================================================================
---- wpa_supplicant-2.9.orig/src/wps/wps_upnp_i.h
-+++ wpa_supplicant-2.9/src/wps/wps_upnp_i.h
-@@ -128,6 +128,7 @@ struct upnp_wps_device_sm {
- u8 mac_addr[ETH_ALEN]; /* mac addr of network i.f. we use */
- char *ip_addr_text; /* IP address of network i.f. we use */
- unsigned ip_addr; /* IP address of network i.f. we use (host order) */
-+ struct in_addr netmask;
- int multicast_sd; /* send multicast messages over this socket */
- int ssdp_sd; /* receive discovery UPD packets on socket */
- int ssdp_sd_registered; /* nonzero if we must unregister */
-@@ -158,7 +159,7 @@ struct subscription * subscription_find(
- const u8 uuid[UUID_LEN]);
- void subscr_addr_delete(struct subscr_addr *a);
- int get_netif_info(const char *net_if, unsigned *ip_addr, char **ip_addr_text,
-- u8 mac[ETH_ALEN]);
-+ struct in_addr *netmask, u8 mac[ETH_ALEN]);
-
- /* wps_upnp_ssdp.c */
- void msearchreply_state_machine_stop(struct advertisement_state_machine *a);
diff --git a/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-replace-systemd-install-Alias-with-WantedBy.patch b/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-replace-systemd-install-Alias-with-WantedBy.patch
deleted file mode 100644
index a476cf0..0000000
--- a/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-replace-systemd-install-Alias-with-WantedBy.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From 94c401733a5a3d294cc412671166e6adfb409f53 Mon Sep 17 00:00:00 2001
-From: Joshua DeWeese <jdeweese@hennypenny.com>
-Date: Wed, 30 Jan 2019 16:19:47 -0500
-Subject: [PATCH] replace systemd install Alias with WantedBy
-
-According to the systemd documentation "WantedBy=foo.service in a
-service bar.service is mostly equivalent to
-Alias=foo.service.wants/bar.service in the same file." However,
-this is not really the intended purpose of install Aliases.
-
-Upstream-Status: Submitted [hostap@lists.infradead.org]
-
-Signed-off-by: Joshua DeWeese <jdeweese@hennypenny.com>
----
- wpa_supplicant/systemd/wpa_supplicant-nl80211.service.arg.in | 2 +-
- wpa_supplicant/systemd/wpa_supplicant-wired.service.arg.in | 2 +-
- wpa_supplicant/systemd/wpa_supplicant.service.arg.in | 2 +-
- 3 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/wpa_supplicant/systemd/wpa_supplicant-nl80211.service.arg.in b/wpa_supplicant/systemd/wpa_supplicant-nl80211.service.arg.in
-index 03ac507..da69a87 100644
---- a/wpa_supplicant/systemd/wpa_supplicant-nl80211.service.arg.in
-+++ b/wpa_supplicant/systemd/wpa_supplicant-nl80211.service.arg.in
-@@ -12,4 +12,4 @@ Type=simple
- ExecStart=@BINDIR@/wpa_supplicant -c/etc/wpa_supplicant/wpa_supplicant-nl80211-%I.conf -Dnl80211 -i%I
-
- [Install]
--Alias=multi-user.target.wants/wpa_supplicant-nl80211@%i.service
-+WantedBy=multi-user.target
-diff --git a/wpa_supplicant/systemd/wpa_supplicant-wired.service.arg.in b/wpa_supplicant/systemd/wpa_supplicant-wired.service.arg.in
-index c8a744d..ca3054b 100644
---- a/wpa_supplicant/systemd/wpa_supplicant-wired.service.arg.in
-+++ b/wpa_supplicant/systemd/wpa_supplicant-wired.service.arg.in
-@@ -12,4 +12,4 @@ Type=simple
- ExecStart=@BINDIR@/wpa_supplicant -c/etc/wpa_supplicant/wpa_supplicant-wired-%I.conf -Dwired -i%I
-
- [Install]
--Alias=multi-user.target.wants/wpa_supplicant-wired@%i.service
-+WantedBy=multi-user.target
-diff --git a/wpa_supplicant/systemd/wpa_supplicant.service.arg.in b/wpa_supplicant/systemd/wpa_supplicant.service.arg.in
-index 7788b38..55d2b9c 100644
---- a/wpa_supplicant/systemd/wpa_supplicant.service.arg.in
-+++ b/wpa_supplicant/systemd/wpa_supplicant.service.arg.in
-@@ -12,4 +12,4 @@ Type=simple
- ExecStart=@BINDIR@/wpa_supplicant -c/etc/wpa_supplicant/wpa_supplicant-%I.conf -i%I
-
- [Install]
--Alias=multi-user.target.wants/wpa_supplicant@%i.service
-+WantedBy=multi-user.target
---
-2.7.4
-
diff --git a/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch b/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch
deleted file mode 100644
index 5964085..0000000
--- a/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From f7d268864a2660b7239b9a8ff5ad37faeeb751ba Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <jouni@codeaurora.org>
-Date: Wed, 3 Jun 2020 22:41:02 +0300
-Subject: [PATCH 2/3] WPS UPnP: Fix event message generation using a long URL
- path
-
-More than about 700 character URL ended up overflowing the wpabuf used
-for building the event notification and this resulted in the wpabuf
-buffer overflow checks terminating the hostapd process. Fix this by
-allocating the buffer to be large enough to contain the full URL path.
-However, since that around 700 character limit has been the practical
-limit for more than ten years, start explicitly enforcing that as the
-limit or the callback URLs since any longer ones had not worked before
-and there is no need to enable them now either.
-
-Upstream-Status: Backport
-CVE: CVE-2020-12695 patch #2
-Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
-Signed-off-by: Armin Kuster <akuster@mvista.com>
-
----
- src/wps/wps_upnp.c | 9 +++++++--
- src/wps/wps_upnp_event.c | 3 ++-
- 2 files changed, 9 insertions(+), 3 deletions(-)
-
-diff --git a/src/wps/wps_upnp.c b/src/wps/wps_upnp.c
-index 7d4b7439940e..ab685d52ecab 100644
---- a/src/wps/wps_upnp.c
-+++ b/src/wps/wps_upnp.c
-@@ -328,9 +328,14 @@ static void subscr_addr_add_url(struct subscription *s, const char *url,
- int rerr;
- size_t host_len, path_len;
-
-- /* url MUST begin with http: */
-- if (url_len < 7 || os_strncasecmp(url, "http://", 7))
-+ /* URL MUST begin with HTTP scheme. In addition, limit the length of
-+ * the URL to 700 characters which is around the limit that was
-+ * implicitly enforced for more than 10 years due to a bug in
-+ * generating the event messages. */
-+ if (url_len < 7 || os_strncasecmp(url, "http://", 7) || url_len > 700) {
-+ wpa_printf(MSG_DEBUG, "WPS UPnP: Reject an unacceptable URL");
- goto fail;
-+ }
- url += 7;
- url_len -= 7;
-
-diff --git a/src/wps/wps_upnp_event.c b/src/wps/wps_upnp_event.c
-index d7e6edcc6503..08a23612f338 100644
---- a/src/wps/wps_upnp_event.c
-+++ b/src/wps/wps_upnp_event.c
-@@ -147,7 +147,8 @@ static struct wpabuf * event_build_message(struct wps_event_ *e)
- struct wpabuf *buf;
- char *b;
-
-- buf = wpabuf_alloc(1000 + wpabuf_len(e->data));
-+ buf = wpabuf_alloc(1000 + os_strlen(e->addr->path) +
-+ wpabuf_len(e->data));
- if (buf == NULL)
- return NULL;
- wpabuf_printf(buf, "NOTIFY %s HTTP/1.1\r\n", e->addr->path);
---
-2.20.1
diff --git a/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch b/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch
deleted file mode 100644
index 8a014ef..0000000
--- a/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 85aac526af8612c21b3117dadc8ef5944985b476 Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <jouni@codeaurora.org>
-Date: Thu, 4 Jun 2020 21:24:04 +0300
-Subject: [PATCH 3/3] WPS UPnP: Handle HTTP initiation failures for events more
- properly
-
-While it is appropriate to try to retransmit the event to another
-callback URL on a failure to initiate the HTTP client connection, there
-is no point in trying the exact same operation multiple times in a row.
-Replve the event_retry() calls with event_addr_failure() for these cases
-to avoid busy loops trying to repeat the same failing operation.
-
-These potential busy loops would go through eloop callbacks, so the
-process is not completely stuck on handling them, but unnecessary CPU
-would be used to process the continues retries that will keep failing
-for the same reason.
-
-Upstream-Status: Backport
-CVE: CVE-2020-12695 patch #2
-Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
-Signed-off-by: Armin Kuster <akuster@mvista.com>
-
----
- src/wps/wps_upnp_event.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/wps/wps_upnp_event.c b/src/wps/wps_upnp_event.c
-index 08a23612f338..c0d9e41d9a38 100644
---- a/src/wps/wps_upnp_event.c
-+++ b/src/wps/wps_upnp_event.c
-@@ -294,7 +294,7 @@ static int event_send_start(struct subscription *s)
-
- buf = event_build_message(e);
- if (buf == NULL) {
-- event_retry(e, 0);
-+ event_addr_failure(e);
- return -1;
- }
-
-@@ -302,7 +302,7 @@ static int event_send_start(struct subscription *s)
- event_http_cb, e);
- if (e->http_event == NULL) {
- wpabuf_free(buf);
-- event_retry(e, 0);
-+ event_addr_failure(e);
- return -1;
- }
-
---
-2.20.1
diff --git a/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2021-0326.patch b/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2021-0326.patch
deleted file mode 100644
index 8c90fa3..0000000
--- a/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2021-0326.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 947272febe24a8f0ea828b5b2f35f13c3821901e Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <jouni@codeaurora.org>
-Date: Mon, 9 Nov 2020 11:43:12 +0200
-Subject: [PATCH] P2P: Fix copying of secondary device types for P2P group
- client
-
-Parsing and copying of WPS secondary device types list was verifying
-that the contents is not too long for the internal maximum in the case
-of WPS messages, but similar validation was missing from the case of P2P
-group information which encodes this information in a different
-attribute. This could result in writing beyond the memory area assigned
-for these entries and corrupting memory within an instance of struct
-p2p_device. This could result in invalid operations and unexpected
-behavior when trying to free pointers from that corrupted memory.
-
-Upstream-Status: Backport
-CVE: CVE-2021-0326
-
-Reference to upstream patch:
-[https://w1.fi/cgit/hostap/commit/?id=947272febe24a8f0ea828b5b2f35f13c3821901e]
-
-Credit to OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27269
-Fixes: e57ae6e19edf ("P2P: Keep track of secondary device types for peers")
-Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
-Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
----
- src/p2p/p2p.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/src/p2p/p2p.c b/src/p2p/p2p.c
-index a08ba02..079270f 100644
---- a/src/p2p/p2p.c
-+++ b/src/p2p/p2p.c
-@@ -453,6 +453,8 @@ static void p2p_copy_client_info(struct p2p_device *dev,
- dev->info.config_methods = cli->config_methods;
- os_memcpy(dev->info.pri_dev_type, cli->pri_dev_type, 8);
- dev->info.wps_sec_dev_type_list_len = 8 * cli->num_sec_dev_types;
-+ if (dev->info.wps_sec_dev_type_list_len > WPS_SEC_DEV_TYPE_MAX_LEN)
-+ dev->info.wps_sec_dev_type_list_len = WPS_SEC_DEV_TYPE_MAX_LEN;
- os_memcpy(dev->info.wps_sec_dev_type_list, cli->sec_dev_types,
- dev->info.wps_sec_dev_type_list_len);
- }
---
-2.17.1
-
diff --git a/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2021-27803.patch b/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2021-27803.patch
deleted file mode 100644
index 004b1db..0000000
--- a/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2021-27803.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From 8460e3230988ef2ec13ce6b69b687e941f6cdb32 Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <jouni@codeaurora.org>
-Date: Tue, 8 Dec 2020 23:52:50 +0200
-Subject: [PATCH] P2P: Fix a corner case in peer addition based on PD Request
-
-p2p_add_device() may remove the oldest entry if there is no room in the
-peer table for a new peer. This would result in any pointer to that
-removed entry becoming stale. A corner case with an invalid PD Request
-frame could result in such a case ending up using (read+write) freed
-memory. This could only by triggered when the peer table has reached its
-maximum size and the PD Request frame is received from the P2P Device
-Address of the oldest remaining entry and the frame has incorrect P2P
-Device Address in the payload.
-
-Fix this by fetching the dev pointer again after having called
-p2p_add_device() so that the stale pointer cannot be used.
-
-Fixes: 17bef1e97a50 ("P2P: Add peer entry based on Provision Discovery Request")
-Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
-
-Upstream-Status: Backport
-CVE: CVE-2021-27803
-
-Reference to upstream patch:
-[https://w1.fi/cgit/hostap/commit/?id=8460e3230988ef2ec13ce6b69b687e941f6cdb32]
-
-Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
----
- src/p2p/p2p_pd.c | 12 +++++-------
- 1 file changed, 5 insertions(+), 7 deletions(-)
-
-diff --git a/src/p2p/p2p_pd.c b/src/p2p/p2p_pd.c
-index 3994ec0..05fd593 100644
---- a/src/p2p/p2p_pd.c
-+++ b/src/p2p/p2p_pd.c
-@@ -595,14 +595,12 @@ void p2p_process_prov_disc_req(struct p2p_data *p2p, const u8 *sa,
- goto out;
- }
-
-+ dev = p2p_get_device(p2p, sa);
- if (!dev) {
-- dev = p2p_get_device(p2p, sa);
-- if (!dev) {
-- p2p_dbg(p2p,
-- "Provision Discovery device not found "
-- MACSTR, MAC2STR(sa));
-- goto out;
-- }
-+ p2p_dbg(p2p,
-+ "Provision Discovery device not found "
-+ MACSTR, MAC2STR(sa));
-+ goto out;
- }
- } else if (msg.wfd_subelems) {
- wpabuf_free(dev->info.wfd_subelems);
---
-2.17.1
-
diff --git a/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2021-30004.patch b/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2021-30004.patch
deleted file mode 100644
index e2540fc..0000000
--- a/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2021-30004.patch
+++ /dev/null
@@ -1,123 +0,0 @@
-From a0541334a6394f8237a4393b7372693cd7e96f15 Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <j@w1.fi>
-Date: Sat, 13 Mar 2021 18:19:31 +0200
-Subject: [PATCH] ASN.1: Validate DigestAlgorithmIdentifier parameters
-
-The supported hash algorithms do not use AlgorithmIdentifier parameters.
-However, there are implementations that include NULL parameters in
-addition to ones that omit the parameters. Previous implementation did
-not check the parameters value at all which supported both these cases,
-but did not reject any other unexpected information.
-
-Use strict validation of digest algorithm parameters and reject any
-unexpected value when validating a signature. This is needed to prevent
-potential forging attacks.
-
-Signed-off-by: Jouni Malinen <j@w1.fi>
-
-Upstream-Status: Backport
-CVE: CVE-2021-30004
-
-Reference to upstream patch:
-[https://w1.fi/cgit/hostap/commit/?id=a0541334a6394f8237a4393b7372693cd7e96f15]
-
-Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
----
- src/tls/pkcs1.c | 21 +++++++++++++++++++++
- src/tls/x509v3.c | 20 ++++++++++++++++++++
- 2 files changed, 41 insertions(+)
-
-diff --git a/src/tls/pkcs1.c b/src/tls/pkcs1.c
-index 141ac50..e09db07 100644
---- a/src/tls/pkcs1.c
-+++ b/src/tls/pkcs1.c
-@@ -240,6 +240,8 @@ int pkcs1_v15_sig_ver(struct crypto_public_key *pk,
- os_free(decrypted);
- return -1;
- }
-+ wpa_hexdump(MSG_MSGDUMP, "PKCS #1: DigestInfo",
-+ hdr.payload, hdr.length);
-
- pos = hdr.payload;
- end = pos + hdr.length;
-@@ -261,6 +263,8 @@ int pkcs1_v15_sig_ver(struct crypto_public_key *pk,
- os_free(decrypted);
- return -1;
- }
-+ wpa_hexdump(MSG_MSGDUMP, "PKCS #1: DigestAlgorithmIdentifier",
-+ hdr.payload, hdr.length);
- da_end = hdr.payload + hdr.length;
-
- if (asn1_get_oid(hdr.payload, hdr.length, &oid, &next)) {
-@@ -269,6 +273,23 @@ int pkcs1_v15_sig_ver(struct crypto_public_key *pk,
- os_free(decrypted);
- return -1;
- }
-+ wpa_hexdump(MSG_MSGDUMP, "PKCS #1: Digest algorithm parameters",
-+ next, da_end - next);
-+
-+ /*
-+ * RFC 5754: The correct encoding for the SHA2 algorithms would be to
-+ * omit the parameters, but there are implementation that encode these
-+ * as a NULL element. Allow these two cases and reject anything else.
-+ */
-+ if (da_end > next &&
-+ (asn1_get_next(next, da_end - next, &hdr) < 0 ||
-+ !asn1_is_null(&hdr) ||
-+ hdr.payload + hdr.length != da_end)) {
-+ wpa_printf(MSG_DEBUG,
-+ "PKCS #1: Unexpected digest algorithm parameters");
-+ os_free(decrypted);
-+ return -1;
-+ }
-
- if (!asn1_oid_equal(&oid, hash_alg)) {
- char txt[100], txt2[100];
-diff --git a/src/tls/x509v3.c b/src/tls/x509v3.c
-index 1bd5aa0..bf2289f 100644
---- a/src/tls/x509v3.c
-+++ b/src/tls/x509v3.c
-@@ -1834,6 +1834,7 @@ int x509_check_signature(struct x509_certificate *issuer,
- os_free(data);
- return -1;
- }
-+ wpa_hexdump(MSG_MSGDUMP, "X509: DigestInfo", hdr.payload, hdr.length);
-
- pos = hdr.payload;
- end = pos + hdr.length;
-@@ -1855,6 +1856,8 @@ int x509_check_signature(struct x509_certificate *issuer,
- os_free(data);
- return -1;
- }
-+ wpa_hexdump(MSG_MSGDUMP, "X509: DigestAlgorithmIdentifier",
-+ hdr.payload, hdr.length);
- da_end = hdr.payload + hdr.length;
-
- if (asn1_get_oid(hdr.payload, hdr.length, &oid, &next)) {
-@@ -1862,6 +1865,23 @@ int x509_check_signature(struct x509_certificate *issuer,
- os_free(data);
- return -1;
- }
-+ wpa_hexdump(MSG_MSGDUMP, "X509: Digest algorithm parameters",
-+ next, da_end - next);
-+
-+ /*
-+ * RFC 5754: The correct encoding for the SHA2 algorithms would be to
-+ * omit the parameters, but there are implementation that encode these
-+ * as a NULL element. Allow these two cases and reject anything else.
-+ */
-+ if (da_end > next &&
-+ (asn1_get_next(next, da_end - next, &hdr) < 0 ||
-+ !asn1_is_null(&hdr) ||
-+ hdr.payload + hdr.length != da_end)) {
-+ wpa_printf(MSG_DEBUG,
-+ "X509: Unexpected digest algorithm parameters");
-+ os_free(data);
-+ return -1;
-+ }
-
- if (x509_sha1_oid(&oid)) {
- if (signature->oid.oid[6] != 5 /* sha-1WithRSAEncryption */) {
---
-2.17.1
-
diff --git a/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.9.bb b/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.10.bb
similarity index 79%
rename from poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.9.bb
rename to poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.10.bb
index 25cd8ef..6e80ac7 100644
--- a/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.9.bb
+++ b/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.10.bb
@@ -4,9 +4,9 @@
BUGTRACKER = "http://w1.fi/security/"
SECTION = "network"
LICENSE = "BSD-3-Clause"
-LIC_FILES_CHKSUM = "file://COPYING;md5=279b4f5abb9c153c285221855ddb78cc \
- file://README;beginline=1;endline=56;md5=e7d3dbb01f75f0b9799e192731d1e1ff \
- file://wpa_supplicant/wpa_supplicant.c;beginline=1;endline=12;md5=0a8b56d3543498b742b9c0e94cc2d18b"
+LIC_FILES_CHKSUM = "file://COPYING;md5=5ebcb90236d1ad640558c3d3cd3035df \
+ file://README;beginline=1;endline=56;md5=e3d2f6c2948991e37c1ca4960de84747 \
+ file://wpa_supplicant/wpa_supplicant.c;beginline=1;endline=12;md5=76306a95306fee9a976b0ac1be70f705"
DEPENDS = "dbus libnl"
RRECOMMENDS:${PN} = "wpa-supplicant-passphrase wpa-supplicant-cli"
@@ -19,23 +19,14 @@
SYSTEMD_SERVICE:${PN} = "wpa_supplicant.service"
SYSTEMD_AUTO_ENABLE = "disable"
-SRC_URI = "http://w1.fi/releases/wpa_supplicant-${PV}.tar.gz \
+SRC_URI = "http://w1.fi/releases/wpa_supplicant-${PV}.tar.gz \
file://defconfig \
file://wpa-supplicant.sh \
file://wpa_supplicant.conf \
file://wpa_supplicant.conf-sane \
file://99_wpa_supplicant \
- file://0001-replace-systemd-install-Alias-with-WantedBy.patch \
- file://0001-AP-Silently-ignore-management-frame-from-unexpected-.patch \
- file://0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch \
- file://0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch \
- file://0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch \
- file://CVE-2021-0326.patch \
- file://CVE-2021-27803.patch \
- file://CVE-2021-30004.patch \
- "
-SRC_URI[md5sum] = "2d2958c782576dc9901092fbfecb4190"
-SRC_URI[sha256sum] = "fcbdee7b4a64bea8177973299c8c824419c413ec2e3a95db63dd6a5dc3541f17"
+ "
+SRC_URI[sha256sum] = "20df7ae5154b3830355f8ab4269123a87affdea59fe74fe9292a91d0d7e17b2f"
CVE_PRODUCT = "wpa_supplicant"