openembedded-core.git/meta/recipes-connectivity, branch 2016-4

dhcp: CVE-2016-2774

2016-04-18T15:27:45+00:00

ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before
4.3.4 does not restrict the number of concurrent TCP sessions,
which allows remote attackers to cause a denial of service
(INSIST assertion failure or request-processing outage)
by establishing many sessions.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2774

Signed-off-by: Catalin Enache 
Signed-off-by: Ross Burton

bind: CVE-2016-2088

2016-04-18T15:27:45+00:00

Duplicate EDNS COOKIE options in a response could trigger an
assertion failure: Fix with a backport.

bind as built with the oe-core recipe is not at risk: Only servers
which are built with DNS cookie support (--enable-sit) are vulnerable
to denial of service.

Fixes [YOCTO #9438]

Signed-off-by: Jussi Kukkonen 
Signed-off-by: Ross Burton

dhcp: Enable update-rc.d service

2016-04-15T05:57:48+00:00

do_install_append function installs init scripts but to enable this
service we need to inherit update-rc.d class and set INITSCRIPT name
and params.

Signed-off-by: Fabio Berton 
Signed-off-by: Richard Purdie

bind: CVE-2016-1285 CVE-2016-1286

2016-04-14T09:58:27+00:00

Fixes following vulnerabilities:
CVE-2016-1285 bind: malformed packet sent to rndc can trigger assertion failure
CVE-2016-1286 bind: malformed signature records for DNAME records can
trigger assertion failure

[YOCTO #9400]

External References:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1285
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1286
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1285
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1286

References to the Upstream commits and Security Advisories:
===========================================================
CVE-2016-1285: https://kb.isc.org/article/AA-01352
https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=patch;
h=70037e040e587329cec82123e12b9f4f7c945f67

CVE-2016-1286_1: https://kb.isc.org/article/AA-01353
https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=patch;
h=a3d327bf1ceaaeabb20223d8de85166e940b9f12

CVE-2016-1286_2: https://kb.isc.org/article/AA-01353
https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=patch;
h=7602be276a73a6eb5431c5acd9718e68a55e8b61

Signed-off-by: Sona Sarmadi 
Signed-off-by: Ross Burton

socat: Use c_ispeed and c_ospeed based upon libc

2016-04-14T09:58:26+00:00

musl calls them __c_ispeed and __c_ospeed
and we can not use get/set APIs because the get APIs
will return the value from iflags and not from *speed
element from termios struct

Signed-off-by: Khem Raj 
Signed-off-by: Ross Burton

openssl.inc: minor packaging cleanup

2016-04-08T07:04:28+00:00

libcrypto.so was explicitly added to FILES_${PN}-dev as part of moving
libcrypto from libdir -> base_libdir to support dhclient [1].

However, the line has been unnecessary since ${base_libdir}/lib*.so
files started to be included in FILES_${PN}-dev by default [2] (and
it's still unnecessary now, after moving libcrypto from back to libdir
to support ntp [3]).

 [1] http://git.openembedded.org/openembedded-core/commit/?id=01ea85f7f6c53c66c76d6f832518b28bf06ec072
 [2] http://git.openembedded.org/openembedded-core/commit/?id=66c36bcb7d9368718453265e58bd5e3c854c786a
 [3] http://git.openembedded.org/openembedded-core/commit/?id=0be2ab32f690a2fcba0e821abe11460958bbc6dc

Also define FILES_libssl using SOLIBS instead of a hardcoded pattern.

Signed-off-by: Andre McCurdy 
Signed-off-by: Richard Purdie

bluez5.inc: remove obsolete workaround

2016-04-05T08:55:47+00:00

Bluez 5.37 itself correctly installs bluetooth.conf, and honors
the path settings in dbus-1.pc.

Removing the obsolete workaround is necessary for compiling
"stateless" (= read-only system configuration moved out of /etc).

Signed-off-by: Patrick Ohly 
Signed-off-by: Richard Purdie

bluez5: add ptest support

2016-04-03T14:51:08+00:00

[YOCTO #5134]

Signed-off-by: Alexander Kanavin 
Signed-off-by: Richard Purdie

bind: /var/cache/bind

2016-03-24T21:44:27+00:00

Change the ownership of /var/cache/bind to bind rather than root.

Signed-off-by: Joe Slater 
Signed-off-by: Ross Burton

dhcpd: create dhcpd user for dhcp dameon

2016-03-20T22:57:59+00:00

This patch enables the functionality for dhcpd service to be started
with dhcp uid and gid.

Test steps:

Step 1: Assign ip to interface
ifconfig eth0 192.168.1.1

Step 2: Edit /etc/dhcp/dhcpd.conf:
default-lease-time 600;
max-lease-time 7200;
option subnet-mask 255.255.255.0;
subnet 192.168.1.0 netmask 255.255.255.0 {
        option broadcast-address 192.168.1.255;
        range 192.168.1.88 192.168.1.88;
        option routers 192.168.1.0;
}

Step 3: Edit /etc/default/dhcp-server:
INTERFACES="eth0"

Step 4: Check uid and gid of running dhcpd process
$ ps -eo user:19,group:19,cmd | grep dhcpd
dhcp        dhcp        /usr/sbin/dhcpd eth0 -user dhcp -group dhcp

Signed-off-by: Alexandru Moise 
Signed-off-by: Ross Burton