openembedded-core.git/meta/recipes-connectivity, branch 2016-10

bind: fix two CVEs

2016-10-15T08:58:56+00:00

Add two CVE patches from upstream
git: https://www.isc.org/git/

1.CVE-2016-2775.patch
2.CVE-2016-2776.patch

Signed-off-by: zhengruoqin 
Signed-off-by: Ross Burton

ppp: fix building with linux-4.8

2016-10-15T08:57:09+00:00

Fix a build error when using the linux-4.8 headers that results in:

In file included from pppoe.h:87:0,
                 from plugin.c:29:
../usr/include/netinet/in.h:211:8: note: originally defined here
 struct in6_addr
        ^~~~~~~~
In file included from ../usr/include/linux/if_pppol2tp.h:20:0,
                 from ../usr/include/linux/if_pppox.h:26,
                 from plugin.c:52:
../usr/include/linux/in6.h:49:8: error: redefinition of 'struct sockaddr_in6'
 struct sockaddr_in6 {
        ^~~~~~~~~~~~

Signed-off-by: Jackie Huang 
Signed-off-by: Ross Burton

Revert "connman-gnome: StatusIcon adapts to size changes"

2016-10-04T23:12:43+00:00

The aim of the original commit was to make connman-gnome load the icons
at the exact size of the systray. There are two problems with this:
* There are not enough icon sizes provided to make the scaling
  look good at most sizes (including current panel size)
* Both connman-gnome and mb-panel have bugs in the icon size update
  code and using scaling to exact size makes these much more visible
  (See bug 9995 for example).

The problems the original commit tried to fix can be worked around
with better packing in matchbox-panel-2.

Signed-off-by: Jussi Kukkonen 
Signed-off-by: Richard Purdie

openssl: Upgrade 1.0.2i -> 1.0.2j

2016-09-28T09:15:54+00:00

Deals with a CVE issue
Drops a patch applied upstream and no longer needed.

Signed-off-by: Richard Purdie

openssl.inc: avoid random ptest failures

2016-09-23T17:06:10+00:00

"make alltests" is sensitive to the timestamps of the installed
files. Depending on the order in which cp copies files, .o and/or
executables may end up with time stamps older than the source files.
Running tests then triggers recompilation attempts, which typically
will fail because dev tools and files are not installed.

"cp -a" is not enough because the files also have to be newer than
the installed header files. Setting the file time stamps to
the current time explicitly after copying solves the problem because
do_install_ptest_base is guaranteed to run after do_install.

Signed-off-by: Patrick Ohly 
Signed-off-by: Richard Purdie

openssl: update to 1.0.2i (CVE-2016-6304 and more)

2016-09-23T17:06:10+00:00

This update fixes several CVEs:
* OCSP Status Request extension unbounded memory growth (CVE-2016-6304)
* SWEET32 Mitigation (CVE-2016-2183)
* OOB write in MDC2_Update() (CVE-2016-6303)
* Malformed SHA512 ticket DoS (CVE-2016-6302)
* OOB write in BN_bn2dec() (CVE-2016-2182)
* OOB read in TS_OBJ_print_bio() (CVE-2016-2180)
* DTLS buffered message DoS (CVE-2016-2179)
* DTLS replay protection DoS (CVE-2016-2181)
* Certificate message OOB reads (CVE-2016-6306)

Of these, only CVE-2016-6304 is considered of high
severity. Everything else is low. CVE-2016-2177 and CVE-2016-2178 were
already fixed via local patches, which can be removed now.

See https://www.openssl.org/news/secadv/20160922.txt for details.

Some patches had to be refreshed and one compile error fix from
upstream's OpenSSL_1_0_2-stable was required. The server.pem
file is needed for test_dtls.

Signed-off-by: Patrick Ohly 
Signed-off-by: Richard Purdie

bluez5: remove duplicated udev setting from FILES_${PN}

2016-09-23T17:06:10+00:00

bitbake.conf already sets it.

Signed-off-by: Robert Yang

ofono: remove duplicated udev setting from FILES_${PN}

2016-09-23T17:06:10+00:00

It doesn't have files in udev dir, and bitbake.conf already sets it.

Signed-off-by: Robert Yang

wpa_supplicant: Security Advisory-CVE-2016-4477

2016-09-23T13:55:25+00:00

Add CVE-2016-4477 patch for avoiding \n and \r characters in passphrase
parameters, which allows remote attackers to cause a denial of service
(daemon outage) via a crafted WPS operation.
Patches came from http://w1.fi/security/2016-1/

Signed-off-by: Zhixiong Chi 
Signed-off-by: Ross Burton

wpa_supplicant: Security Advisory-CVE-2016-4476

2016-09-23T13:55:24+00:00

Add CVE-2016-4476 patch for avoiding \n and \r characters in passphrase
parameters, which allows remote attackers to cause a denial of service
(daemon outage) via a crafted WPS operation.
Patches came from http://w1.fi/security/2016-1/

Signed-off-by: Zhixiong Chi 
Signed-off-by: Ross Burton