From 475cb72d2bb2f40ca5e9f4edba6d49d6c7afbd3e Mon Sep 17 00:00:00 2001 From: Andrew Geissler Date: Fri, 10 Jul 2020 16:00:51 -0500 Subject: poky: subtree update:5951cbcabe..968fcf4989 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Alejandro Hernandez (3): baremetal-helloworld: Use do_image_complete instead of do_deploy baremetal-image.bbclass: Create a class for baremetal applications or an RTOS baremetal-helloworld: Use baremetal-image class to deploy the application Alejandro del Castillo (2): opkg-utils: upgrade to 0.4.3 opkg: upgrade to version 0.4.3 Alexander Kanavin (30): dnf: upgrade 4.2.21 -> 4.2.23 meson: upgrade 0.54.2 -> 0.54.3 libdnf: update 0.47.0 -> 0.48.0 ffmpeg: disable altivec on ppc by default dropbear: update 2019.78 -> 2020.79 elfutils: upgrade 0.179 -> 0.180 gnu-config: update to latest revision libgpg-error: update 1.37 -> 1.38 perl: update 5.30.2 -> 5.32.0 gst-examples: upstream releases are even numbered bison: upgrade 3.6.3 -> 3.6.4 python3-cython: upgrade 0.29.19 -> 0.29.20 stress-ng: upgrade 0.11.12 -> 0.11.14 piglit: upgrade to latest revision linux-firmware: upgrade 20200519 -> 20200619 systemtap: upgrade 4.2 -> 4.3 alsa-lib: upgrade 1.2.2 -> 1.2.3.1 alsa-topology-conf: upgrade 1.2.2 -> 1.2.3 alsa-ucm-conf: upgrade 1.2.2 -> 1.2.3 alsa-utils: upgrade 1.2.2 -> 1.2.3 puzzles: upgrade to latest revision diffoscope: upgrade 147 -> 148 libcheck: upgrade 0.14.0 -> 0.15.0 rsync: update 3.1.3 -> 3.2.1 sudo: upgrade 1.9.0 -> 1.9.1 python3-numpy: update 1.18.5 -> 1.19.0 mesa: update 20.0.7 -> 20.1.2 go-binary-native: fix upstream version check Revert "python3-setuptools: patch entrypoints for faster initialization" python3-setuptools: upgrade 47.1.1 -> 47.3.1 Alistair Francis (1): opensbi: Update to OpenSBI v0.8 release Andreas Müller (3): nfs-utils: upgrade 2.4.3 -> 2.5.1 ccache: merge ccache.inc into recipe ccache: upgrade 3.7.9 -> 3.7.10 Andrej Valek (2): busybox: 1.31.1 -> 1.32.0 dropbear: update to 2020.80 Andrey Zhizhikin (1): kernel/yocto: fix search for defconfig from src_uri Armin Kuster (1): wpa-supplicant: Security fix CVE-2020-12695 Bjarne Michelsen (1): devtool: default to empty string, if LIC_FILES_CHKSUM is not available Bruce Ashfield (10): kernel/yocto: ensure that defconfigs are processed first linux-yocto/5.4: update to v5.4.45 linux-yocto-rt/5.4: update to rt25 linux-yocto/5.4: update to v5.4.46 linux-yocto/5.4: update to v5.4.47 linux-yocto/5.4: update to v5.4.49 and -rt28 yocto-bsps: bump reference boards to v5.4.49 linux-yocto/5.4: update to v5.4.50 linux-yocto-dev: bump to 5.8-rc lttng-modules: bump devupstream to v2.12.1+ Changqing Li (5): xinit: add rxvt-unicode in RDEPENDS modutils-initscripts: update postinst initscripts: update postinst gtk-icon-cache.bbclass: add runtime dependency logrotate.py: fix testimage occasionally failure Chen Qi (2): oescripts.py: fix typo oescripts: ignore whitespaces when comparing lines Chris Laplante (2): bitbake: contrib/vim: synchronize from kergoth/vim-bitbake rev 4225ee8b4818d7e4696520567216a3a031c26f7d bitbake: ui/teamcity: don't use removed logging classes Christian Eggers (1): libnl: Extend for native/nativesdk Damian Wrobel (1): rootfs: do not let ldconfig to create symlinks Daniel Klauer (2): uboot-sign: Refactor do_deploy prefunc to do_deploy_prepend deploy.bbclass: Clean DEPLOYDIR before do_deploy David Khouya (2): bitbake: lib/ui/taskexp: Validate gi import bitbake: lib/ui/taskexp: Fix missing Gtk import Hannu Lounento (1): openssl: move ${libdir}/[...]/openssl.cnf to ${PN}-conf Hongxu Jia (1): iso-codes: switch upstream branch master -> main Jason Wessel (1): runqemu: If using a vmtype image do not add the -no-reboot flag Joe Slater (1): jquery: use ${S} Joshua Watt (4): bitbake: hashserv: Chunkify large messages bitbake: siggen: Fix error when hash equivalence has an exception classes/archiver: run do_unpack_and_patch after do_preconfigure classes/archive: do_configure should not depend on do_ar_patched Khem Raj (2): musl: Update to tip of master rxvt-unicode: Disable wtmp on musl Konrad Weihmann (2): systemd: remove kernel-install from base pkg bitbake.conf: fix whitespace issues Lee Chee Yang (3): json-c: fix CVE-2020-12762 qemu: fix CVE-2020-10761 oeqa/core/loader: refine regex to find module Lili Li (1): kernel.bbclass: Fix Module.symvers support Matt Madison (1): kernel.bbclass: add gzip-native to do_deploy dependencies Max Krummenacher (2): cogl-1.0: : don't require eglmesaext.h cogl-1.0: cope with missing x11 headers Mingli Yu (2): python3-libarchive-c: add the missing rdepends python3: add ldconfig rdepends for python3-ctypes Nicolas Dechesne (1): checklayer: parse LAYERDEPENDS with bb.utils.explode_dep_versions2() Pierre-Jean Texier (3): libubootenv: bump to revision 86bd30a curl: upgrade 7.71.0 -> 7.71.1 diffoscope: upgrade 148 -> 150 Rahul Kumar (1): bzip2: Add test suite for bzip2 Rasmus Villemoes (1): coreutils: don't split stdbuf to own package with single-binary Richard Purdie (13): pseudo: Switch to oe-core branch in git repo pseudo: merge in fixes for setfacl issue oeqa/selftest: Clean up separate builddir in success case when non-threaded populate_sdk_ext: Fix to use python3, not python bitbake: taskdata: Improve handling of regex in ASSUME_PROVIDED bitbake: runqueue: Avoid unpickle errors in rare cases bitbake: msg: Avoid issues where paths have relative components oeqa/selftest: recipetool/devtool: Avoid load_plugin test race oeqa/targetcontrol: Attempt to fix log closure warning message rootfs-postcommands: Improve/fix rootfs_check_host_user_contaminated spdx: Remove the class as its obsolete adwaita-icon-theme: Add missing license files to LIC_FILES_CHKSUM bitbake: server/process: Increase timeout for commands Ross Burton (3): ovmf: build natively everywhere common-licenses: fix filename of BSD-2-Clause-Patent gtk+3: fix reproducible build failure Timon Ulrich (2): kernel.bbclass: add lz4 dependency and fix the call to lz4 kernel.bbclass: make dependency on lzop-native conditional Vacek, Patrick (1): oeqa/core/loader: fix regex to include numbers Wang Mingyu (1): gtk+3: upgrade 3.24.20 -> 3.24.21 Yanfei Xu (1): classes/kernel: Use a copy of image for kernel*.rpm if fs doesn't support symlinks akuster (5): libuv: update to the last version in meta-oe bitbake: test/fetch: change to better svn source overview-manual: add SPDX license header mega-manual: Add SPDX license headers ref-manual: Add SPDX license headers hongxu (2): qemu: switches from libcap to libcap-ng for PACAKGECONFIG virtfs cpio: add nativesdk support zangrc (1): libjpeg-turbo:upgrade 2.0.4 -> 2.0.5 Signed-off-by: Andrew Geissler Change-Id: I41e066e5957aa74c9a24e86a6c214bcf96e9c46b --- .../recipes-connectivity/libuv/libuv_1.34.2.bb | 19 --- .../recipes-connectivity/libuv/libuv_1.38.0.bb | 19 +++ ...001-cacheio-use-intmax_t-for-formatted-IO.patch | 38 ------ .../nfs-utils/nfs-utils_2.4.3.bb | 147 -------------------- .../nfs-utils/nfs-utils_2.5.1.bb | 144 ++++++++++++++++++++ .../recipes-connectivity/openssl/openssl_1.1.1g.bb | 4 +- ...-not-allow-event-subscriptions-with-URLs-.patch | 151 +++++++++++++++++++++ ...x-event-message-generation-using-a-long-U.patch | 62 +++++++++ ...ndle-HTTP-initiation-failures-for-events-.patch | 50 +++++++ .../wpa-supplicant/wpa-supplicant_2.9.bb | 5 +- 10 files changed, 433 insertions(+), 206 deletions(-) delete mode 100644 poky/meta/recipes-connectivity/libuv/libuv_1.34.2.bb create mode 100644 poky/meta/recipes-connectivity/libuv/libuv_1.38.0.bb delete mode 100644 poky/meta/recipes-connectivity/nfs-utils/nfs-utils/0001-cacheio-use-intmax_t-for-formatted-IO.patch delete mode 100644 poky/meta/recipes-connectivity/nfs-utils/nfs-utils_2.4.3.bb create mode 100644 poky/meta/recipes-connectivity/nfs-utils/nfs-utils_2.5.1.bb create mode 100644 poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch create mode 100644 poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch create mode 100644 poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch (limited to 'poky/meta/recipes-connectivity') diff --git a/poky/meta/recipes-connectivity/libuv/libuv_1.34.2.bb b/poky/meta/recipes-connectivity/libuv/libuv_1.34.2.bb deleted file mode 100644 index 234cec37b..000000000 --- a/poky/meta/recipes-connectivity/libuv/libuv_1.34.2.bb +++ /dev/null @@ -1,19 +0,0 @@ -SUMMARY = "A multi-platform support library with a focus on asynchronous I/O" -HOMEPAGE = "https://github.com/libuv/libuv" -BUGTRACKER = "https://github.com/libuv/libuv/issues" -LICENSE = "MIT" -LIC_FILES_CHKSUM = "file://LICENSE;md5=a68902a430e32200263d182d44924d47" - -SRCREV = "f868c9ab0c307525a16fff99fd21e32a6ebc3837" -SRC_URI = "git://github.com/libuv/libuv;branch=v1.x" - -S = "${WORKDIR}/git" - -inherit autotools - -do_configure() { - ${S}/autogen.sh || bbnote "${PN} failed to autogen.sh" - oe_runconf -} - -BBCLASSEXTEND = "native" diff --git a/poky/meta/recipes-connectivity/libuv/libuv_1.38.0.bb b/poky/meta/recipes-connectivity/libuv/libuv_1.38.0.bb new file mode 100644 index 000000000..afc9b2f2e --- /dev/null +++ b/poky/meta/recipes-connectivity/libuv/libuv_1.38.0.bb @@ -0,0 +1,19 @@ +SUMMARY = "A multi-platform support library with a focus on asynchronous I/O" +HOMEPAGE = "https://github.com/libuv/libuv" +BUGTRACKER = "https://github.com/libuv/libuv/issues" +LICENSE = "MIT" +LIC_FILES_CHKSUM = "file://LICENSE;md5=a68902a430e32200263d182d44924d47" + +SRCREV = "1ab9ea3790378f9f25c4e78e9e2b511c75f9c9ed" +SRC_URI = "git://github.com/libuv/libuv;branch=v1.x" + +S = "${WORKDIR}/git" + +inherit autotools + +do_configure() { + ${S}/autogen.sh || bbnote "${PN} failed to autogen.sh" + oe_runconf +} + +BBCLASSEXTEND = "native" diff --git a/poky/meta/recipes-connectivity/nfs-utils/nfs-utils/0001-cacheio-use-intmax_t-for-formatted-IO.patch b/poky/meta/recipes-connectivity/nfs-utils/nfs-utils/0001-cacheio-use-intmax_t-for-formatted-IO.patch deleted file mode 100644 index bafff5b9c..000000000 --- a/poky/meta/recipes-connectivity/nfs-utils/nfs-utils/0001-cacheio-use-intmax_t-for-formatted-IO.patch +++ /dev/null @@ -1,38 +0,0 @@ -From ac32b813f5d6f9a2de944015cf9bb98d68e0203a Mon Sep 17 00:00:00 2001 -From: Khem Raj -Date: Sat, 1 Dec 2018 10:02:12 -0800 -Subject: [PATCH] cacheio: use intmax_t for formatted IO - -time_t is not same size on x32 ABI (ILP32) - -Upstream-Status: Pending - -Signed-off-by: Khem Raj ---- - support/nfs/cacheio.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/support/nfs/cacheio.c b/support/nfs/cacheio.c -index 9dc4cf1..2086a95 100644 ---- a/support/nfs/cacheio.c -+++ b/support/nfs/cacheio.c -@@ -17,6 +17,7 @@ - - #include - #include -+#include - #include - #include - #include -@@ -234,7 +235,7 @@ cache_flush(int force) - stb.st_mtime > now) - stb.st_mtime = time(0); - -- sprintf(stime, "%ld\n", stb.st_mtime); -+ sprintf(stime, "%jd\n", (intmax_t)stb.st_mtime); - for (c=0; cachelist[c]; c++) { - int fd; - sprintf(path, "/proc/net/rpc/%s/flush", cachelist[c]); --- -2.19.2 - diff --git a/poky/meta/recipes-connectivity/nfs-utils/nfs-utils_2.4.3.bb b/poky/meta/recipes-connectivity/nfs-utils/nfs-utils_2.4.3.bb deleted file mode 100644 index 9bdb6f4ae..000000000 --- a/poky/meta/recipes-connectivity/nfs-utils/nfs-utils_2.4.3.bb +++ /dev/null @@ -1,147 +0,0 @@ -SUMMARY = "userspace utilities for kernel nfs" -DESCRIPTION = "The nfs-utils package provides a daemon for the kernel \ -NFS server and related tools." -HOMEPAGE = "http://nfs.sourceforge.net/" -SECTION = "console/network" - -LICENSE = "MIT & GPLv2+ & BSD" -LIC_FILES_CHKSUM = "file://COPYING;md5=95f3a93a5c3c7888de623b46ea085a84" - -# util-linux for libblkid -DEPENDS = "libcap libevent util-linux sqlite3 libtirpc" -RDEPENDS_${PN} = "${PN}-client" -RRECOMMENDS_${PN} = "kernel-module-nfsd" - -inherit useradd - -USERADD_PACKAGES = "${PN}-client" -USERADD_PARAM_${PN}-client = "--system --home-dir /var/lib/nfs \ - --shell /bin/false --user-group rpcuser" - -SRC_URI = "${KERNELORG_MIRROR}/linux/utils/nfs-utils/${PV}/nfs-utils-${PV}.tar.xz \ - file://nfsserver \ - file://nfscommon \ - file://nfs-utils.conf \ - file://nfs-server.service \ - file://nfs-mountd.service \ - file://nfs-statd.service \ - file://proc-fs-nfsd.mount \ - file://nfs-utils-debianize-start-statd.patch \ - file://bugfix-adjust-statd-service-name.patch \ - file://0001-cacheio-use-intmax_t-for-formatted-IO.patch \ - file://0001-Makefile.am-fix-undefined-function-for-libnsm.a.patch \ - file://clang-warnings.patch \ - " -SRC_URI[md5sum] = "06020c76f531ed97f3145514901e0e7c" -SRC_URI[sha256sum] = "af65fce5dd8370cff9ead67baac5a6cd69c376dcadfef264dc2c78c904f26599" - -# Only kernel-module-nfsd is required here (but can be built-in) - the nfsd module will -# pull in the remainder of the dependencies. - -INITSCRIPT_PACKAGES = "${PN} ${PN}-client" -INITSCRIPT_NAME = "nfsserver" -INITSCRIPT_PARAMS = "defaults" -INITSCRIPT_NAME_${PN}-client = "nfscommon" -INITSCRIPT_PARAMS_${PN}-client = "defaults 19 21" - -inherit autotools-brokensep update-rc.d systemd pkgconfig - -SYSTEMD_PACKAGES = "${PN} ${PN}-client" -SYSTEMD_SERVICE_${PN} = "nfs-server.service nfs-mountd.service" -SYSTEMD_SERVICE_${PN}-client = "nfs-statd.service" - -# --enable-uuid is need for cross-compiling -EXTRA_OECONF = "--with-statduser=rpcuser \ - --enable-mountconfig \ - --enable-libmount-mount \ - --enable-uuid \ - --disable-gss \ - --disable-nfsdcltrack \ - --with-statdpath=/var/lib/nfs/statd \ - " - -PACKAGECONFIG ??= "tcp-wrappers \ - ${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)} \ -" -PACKAGECONFIG_remove_libc-musl = "tcp-wrappers" -PACKAGECONFIG[tcp-wrappers] = "--with-tcp-wrappers,--without-tcp-wrappers,tcp-wrappers" -PACKAGECONFIG[ipv6] = "--enable-ipv6,--disable-ipv6," -# libdevmapper is available in meta-oe -PACKAGECONFIG[nfsv41] = "--enable-nfsv41,--disable-nfsv41,libdevmapper,libdevmapper" -# keyutils is available in meta-oe -PACKAGECONFIG[nfsv4] = "--enable-nfsv4,--disable-nfsv4,keyutils,python3-core" - -PACKAGES =+ "${PN}-client ${PN}-mount ${PN}-stats" - -CONFFILES_${PN}-client += "${localstatedir}/lib/nfs/etab \ - ${localstatedir}/lib/nfs/rmtab \ - ${localstatedir}/lib/nfs/xtab \ - ${localstatedir}/lib/nfs/statd/state \ - ${sysconfdir}/nfsmount.conf" - -FILES_${PN}-client = "${sbindir}/*statd \ - ${sbindir}/rpc.idmapd ${sbindir}/sm-notify \ - ${sbindir}/showmount ${sbindir}/nfsstat \ - ${localstatedir}/lib/nfs \ - ${sysconfdir}/nfs-utils.conf \ - ${sysconfdir}/nfsmount.conf \ - ${sysconfdir}/init.d/nfscommon \ - ${systemd_unitdir}/system/nfs-statd.service" -RDEPENDS_${PN}-client = "${PN}-mount rpcbind" - -FILES_${PN}-mount = "${base_sbindir}/*mount.nfs*" - -FILES_${PN}-stats = "${sbindir}/mountstats ${sbindir}/nfsiostat" -RDEPENDS_${PN}-stats = "python3-core" - -FILES_${PN}-staticdev += "${libdir}/libnfsidmap/*.a" - -FILES_${PN} += "${systemd_unitdir} ${libdir}/libnfsidmap/" - -do_configure_prepend() { - sed -i -e 's,sbindir = /sbin,sbindir = ${base_sbindir},g' \ - ${S}/utils/mount/Makefile.am -} - -# Make clean needed because the package comes with -# precompiled 64-bit objects that break the build -do_compile_prepend() { - make clean -} - -# Works on systemd only -HIGH_RLIMIT_NOFILE ??= "4096" - -do_install_append () { - install -d ${D}${sysconfdir}/init.d - install -m 0755 ${WORKDIR}/nfsserver ${D}${sysconfdir}/init.d/nfsserver - install -m 0755 ${WORKDIR}/nfscommon ${D}${sysconfdir}/init.d/nfscommon - - install -m 0755 ${WORKDIR}/nfs-utils.conf ${D}${sysconfdir} - install -m 0755 ${S}/utils/mount/nfsmount.conf ${D}${sysconfdir} - - install -d ${D}${systemd_unitdir}/system - install -m 0644 ${WORKDIR}/nfs-server.service ${D}${systemd_unitdir}/system/ - install -m 0644 ${WORKDIR}/nfs-mountd.service ${D}${systemd_unitdir}/system/ - install -m 0644 ${WORKDIR}/nfs-statd.service ${D}${systemd_unitdir}/system/ - sed -i -e 's,@SBINDIR@,${sbindir},g' \ - -e 's,@SYSCONFDIR@,${sysconfdir},g' \ - -e 's,@HIGH_RLIMIT_NOFILE@,${HIGH_RLIMIT_NOFILE},g' \ - ${D}${systemd_unitdir}/system/*.service - if ${@bb.utils.contains('DISTRO_FEATURES','systemd','true','false',d)}; then - install -m 0644 ${WORKDIR}/proc-fs-nfsd.mount ${D}${systemd_unitdir}/system/ - install -d ${D}${systemd_unitdir}/system/sysinit.target.wants/ - ln -sf ../proc-fs-nfsd.mount ${D}${systemd_unitdir}/system/sysinit.target.wants/proc-fs-nfsd.mount - fi - - # kernel code as of 3.8 hard-codes this path as a default - install -d ${D}/var/lib/nfs/v4recovery - - # chown the directories and files - chown -R rpcuser:rpcuser ${D}${localstatedir}/lib/nfs/statd - chmod 0644 ${D}${localstatedir}/lib/nfs/statd/state - - # Make python tools use python 3 - sed -i -e '1s,#!.*python.*,#!${bindir}/python3,' ${D}${sbindir}/mountstats ${D}${sbindir}/nfsiostat - -} diff --git a/poky/meta/recipes-connectivity/nfs-utils/nfs-utils_2.5.1.bb b/poky/meta/recipes-connectivity/nfs-utils/nfs-utils_2.5.1.bb new file mode 100644 index 000000000..188a8893b --- /dev/null +++ b/poky/meta/recipes-connectivity/nfs-utils/nfs-utils_2.5.1.bb @@ -0,0 +1,144 @@ +SUMMARY = "userspace utilities for kernel nfs" +DESCRIPTION = "The nfs-utils package provides a daemon for the kernel \ +NFS server and related tools." +HOMEPAGE = "http://nfs.sourceforge.net/" +SECTION = "console/network" + +LICENSE = "MIT & GPLv2+ & BSD" +LIC_FILES_CHKSUM = "file://COPYING;md5=95f3a93a5c3c7888de623b46ea085a84" + +# util-linux for libblkid +DEPENDS = "libcap libevent util-linux sqlite3 libtirpc" +RDEPENDS_${PN} = "${PN}-client" +RRECOMMENDS_${PN} = "kernel-module-nfsd" + +inherit useradd + +USERADD_PACKAGES = "${PN}-client" +USERADD_PARAM_${PN}-client = "--system --home-dir /var/lib/nfs \ + --shell /bin/false --user-group rpcuser" + +SRC_URI = "${KERNELORG_MIRROR}/linux/utils/nfs-utils/${PV}/nfs-utils-${PV}.tar.xz \ + file://nfsserver \ + file://nfscommon \ + file://nfs-utils.conf \ + file://nfs-server.service \ + file://nfs-mountd.service \ + file://nfs-statd.service \ + file://proc-fs-nfsd.mount \ + file://nfs-utils-debianize-start-statd.patch \ + file://bugfix-adjust-statd-service-name.patch \ + file://0001-Makefile.am-fix-undefined-function-for-libnsm.a.patch \ + file://clang-warnings.patch \ + " +SRC_URI[sha256sum] = "0f1c8170e16a07d9836bbf0836d48d0c842b6f0e0e8b18748f099751851d30c4" + +# Only kernel-module-nfsd is required here (but can be built-in) - the nfsd module will +# pull in the remainder of the dependencies. + +INITSCRIPT_PACKAGES = "${PN} ${PN}-client" +INITSCRIPT_NAME = "nfsserver" +INITSCRIPT_PARAMS = "defaults" +INITSCRIPT_NAME_${PN}-client = "nfscommon" +INITSCRIPT_PARAMS_${PN}-client = "defaults 19 21" + +inherit autotools-brokensep update-rc.d systemd pkgconfig + +SYSTEMD_PACKAGES = "${PN} ${PN}-client" +SYSTEMD_SERVICE_${PN} = "nfs-server.service nfs-mountd.service" +SYSTEMD_SERVICE_${PN}-client = "nfs-statd.service" + +# --enable-uuid is need for cross-compiling +EXTRA_OECONF = "--with-statduser=rpcuser \ + --enable-mountconfig \ + --enable-libmount-mount \ + --enable-uuid \ + --disable-gss \ + --disable-nfsdcltrack \ + --with-statdpath=/var/lib/nfs/statd \ + " + +PACKAGECONFIG ??= "tcp-wrappers \ + ${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)} \ +" +PACKAGECONFIG_remove_libc-musl = "tcp-wrappers" +PACKAGECONFIG[tcp-wrappers] = "--with-tcp-wrappers,--without-tcp-wrappers,tcp-wrappers" +PACKAGECONFIG[ipv6] = "--enable-ipv6,--disable-ipv6," +# libdevmapper is available in meta-oe +PACKAGECONFIG[nfsv41] = "--enable-nfsv41,--disable-nfsv41,libdevmapper,libdevmapper" +# keyutils is available in meta-oe +PACKAGECONFIG[nfsv4] = "--enable-nfsv4,--disable-nfsv4,keyutils,python3-core" + +PACKAGES =+ "${PN}-client ${PN}-mount ${PN}-stats" + +CONFFILES_${PN}-client += "${localstatedir}/lib/nfs/etab \ + ${localstatedir}/lib/nfs/rmtab \ + ${localstatedir}/lib/nfs/xtab \ + ${localstatedir}/lib/nfs/statd/state \ + ${sysconfdir}/nfsmount.conf" + +FILES_${PN}-client = "${sbindir}/*statd \ + ${sbindir}/rpc.idmapd ${sbindir}/sm-notify \ + ${sbindir}/showmount ${sbindir}/nfsstat \ + ${localstatedir}/lib/nfs \ + ${sysconfdir}/nfs-utils.conf \ + ${sysconfdir}/nfsmount.conf \ + ${sysconfdir}/init.d/nfscommon \ + ${systemd_unitdir}/system/nfs-statd.service" +RDEPENDS_${PN}-client = "${PN}-mount rpcbind" + +FILES_${PN}-mount = "${base_sbindir}/*mount.nfs*" + +FILES_${PN}-stats = "${sbindir}/mountstats ${sbindir}/nfsiostat ${sbindir}/nfsdclnts" +RDEPENDS_${PN}-stats = "python3-core" + +FILES_${PN}-staticdev += "${libdir}/libnfsidmap/*.a" + +FILES_${PN} += "${systemd_unitdir} ${libdir}/libnfsidmap/" + +do_configure_prepend() { + sed -i -e 's,sbindir = /sbin,sbindir = ${base_sbindir},g' \ + ${S}/utils/mount/Makefile.am +} + +# Make clean needed because the package comes with +# precompiled 64-bit objects that break the build +do_compile_prepend() { + make clean +} + +# Works on systemd only +HIGH_RLIMIT_NOFILE ??= "4096" + +do_install_append () { + install -d ${D}${sysconfdir}/init.d + install -m 0755 ${WORKDIR}/nfsserver ${D}${sysconfdir}/init.d/nfsserver + install -m 0755 ${WORKDIR}/nfscommon ${D}${sysconfdir}/init.d/nfscommon + + install -m 0755 ${WORKDIR}/nfs-utils.conf ${D}${sysconfdir} + install -m 0755 ${S}/utils/mount/nfsmount.conf ${D}${sysconfdir} + + install -d ${D}${systemd_unitdir}/system + install -m 0644 ${WORKDIR}/nfs-server.service ${D}${systemd_unitdir}/system/ + install -m 0644 ${WORKDIR}/nfs-mountd.service ${D}${systemd_unitdir}/system/ + install -m 0644 ${WORKDIR}/nfs-statd.service ${D}${systemd_unitdir}/system/ + sed -i -e 's,@SBINDIR@,${sbindir},g' \ + -e 's,@SYSCONFDIR@,${sysconfdir},g' \ + -e 's,@HIGH_RLIMIT_NOFILE@,${HIGH_RLIMIT_NOFILE},g' \ + ${D}${systemd_unitdir}/system/*.service + if ${@bb.utils.contains('DISTRO_FEATURES','systemd','true','false',d)}; then + install -m 0644 ${WORKDIR}/proc-fs-nfsd.mount ${D}${systemd_unitdir}/system/ + install -d ${D}${systemd_unitdir}/system/sysinit.target.wants/ + ln -sf ../proc-fs-nfsd.mount ${D}${systemd_unitdir}/system/sysinit.target.wants/proc-fs-nfsd.mount + fi + + # kernel code as of 3.8 hard-codes this path as a default + install -d ${D}/var/lib/nfs/v4recovery + + # chown the directories and files + chown -R rpcuser:rpcuser ${D}${localstatedir}/lib/nfs/statd + chmod 0644 ${D}${localstatedir}/lib/nfs/statd/state + + # Make python tools use python 3 + sed -i -e '1s,#!.*python.*,#!${bindir}/python3,' ${D}${sbindir}/mountstats ${D}${sbindir}/nfsiostat +} diff --git a/poky/meta/recipes-connectivity/openssl/openssl_1.1.1g.bb b/poky/meta/recipes-connectivity/openssl/openssl_1.1.1g.bb index 66fa8f7d0..47ed6b764 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl_1.1.1g.bb +++ b/poky/meta/recipes-connectivity/openssl/openssl_1.1.1g.bb @@ -191,7 +191,9 @@ PACKAGES =+ "libcrypto libssl openssl-conf ${PN}-engines ${PN}-misc" FILES_libcrypto = "${libdir}/libcrypto${SOLIBS}" FILES_libssl = "${libdir}/libssl${SOLIBS}" -FILES_openssl-conf = "${sysconfdir}/ssl/openssl.cnf" +FILES_openssl-conf = "${sysconfdir}/ssl/openssl.cnf \ + ${libdir}/ssl-1.1/openssl.cnf* \ + " FILES_${PN}-engines = "${libdir}/engines-1.1" FILES_${PN}-misc = "${libdir}/ssl-1.1/misc" FILES_${PN} =+ "${libdir}/ssl-1.1/*" diff --git a/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch b/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch new file mode 100644 index 000000000..53ad5d028 --- /dev/null +++ b/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch @@ -0,0 +1,151 @@ +From 5b78c8f961f25f4dc22d6f2b77ddd06d712cec63 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen +Date: Wed, 3 Jun 2020 23:17:35 +0300 +Subject: [PATCH 1/3] WPS UPnP: Do not allow event subscriptions with URLs to + other networks + +The UPnP Device Architecture 2.0 specification errata ("UDA errata +16-04-2020.docx") addresses a problem with notifications being allowed +to go out to other domains by disallowing such cases. Do such filtering +for the notification callback URLs to avoid undesired connections to +external networks based on subscriptions that any device in the local +network could request when WPS support for external registrars is +enabled (the upnp_iface parameter in hostapd configuration). + +Upstream-Status: Backport +CVE: CVE-2020-12695 patch #1 +Signed-off-by: Jouni Malinen +Signed-off-by: Armin Kuster + +--- + src/wps/wps_er.c | 2 +- + src/wps/wps_upnp.c | 38 ++++++++++++++++++++++++++++++++++++-- + src/wps/wps_upnp_i.h | 3 ++- + 3 files changed, 39 insertions(+), 4 deletions(-) + +Index: wpa_supplicant-2.9/src/wps/wps_er.c +=================================================================== +--- wpa_supplicant-2.9.orig/src/wps/wps_er.c ++++ wpa_supplicant-2.9/src/wps/wps_er.c +@@ -1298,7 +1298,7 @@ wps_er_init(struct wps_context *wps, con + "with %s", filter); + } + if (get_netif_info(er->ifname, &er->ip_addr, &er->ip_addr_text, +- er->mac_addr)) { ++ NULL, er->mac_addr)) { + wpa_printf(MSG_INFO, "WPS UPnP: Could not get IP/MAC address " + "for %s. Does it have IP address?", er->ifname); + wps_er_deinit(er, NULL, NULL); +Index: wpa_supplicant-2.9/src/wps/wps_upnp.c +=================================================================== +--- wpa_supplicant-2.9.orig/src/wps/wps_upnp.c ++++ wpa_supplicant-2.9/src/wps/wps_upnp.c +@@ -303,6 +303,14 @@ static void subscr_addr_free_all(struct + } + + ++static int local_network_addr(struct upnp_wps_device_sm *sm, ++ struct sockaddr_in *addr) ++{ ++ return (addr->sin_addr.s_addr & sm->netmask.s_addr) == ++ (sm->ip_addr & sm->netmask.s_addr); ++} ++ ++ + /* subscr_addr_add_url -- add address(es) for one url to subscription */ + static void subscr_addr_add_url(struct subscription *s, const char *url, + size_t url_len) +@@ -381,6 +389,7 @@ static void subscr_addr_add_url(struct s + + for (rp = result; rp; rp = rp->ai_next) { + struct subscr_addr *a; ++ struct sockaddr_in *addr = (struct sockaddr_in *) rp->ai_addr; + + /* Limit no. of address to avoid denial of service attack */ + if (dl_list_len(&s->addr_list) >= MAX_ADDR_PER_SUBSCRIPTION) { +@@ -389,6 +398,13 @@ static void subscr_addr_add_url(struct s + break; + } + ++ if (!local_network_addr(s->sm, addr)) { ++ wpa_printf(MSG_INFO, ++ "WPS UPnP: Ignore a delivery URL that points to another network %s", ++ inet_ntoa(addr->sin_addr)); ++ continue; ++ } ++ + a = os_zalloc(sizeof(*a) + alloc_len); + if (a == NULL) + break; +@@ -889,11 +905,12 @@ static int eth_get(const char *device, u + * @net_if: Selected network interface name + * @ip_addr: Buffer for returning IP address in network byte order + * @ip_addr_text: Buffer for returning a pointer to allocated IP address text ++ * @netmask: Buffer for returning netmask or %NULL if not needed + * @mac: Buffer for returning MAC address + * Returns: 0 on success, -1 on failure + */ + int get_netif_info(const char *net_if, unsigned *ip_addr, char **ip_addr_text, +- u8 mac[ETH_ALEN]) ++ struct in_addr *netmask, u8 mac[ETH_ALEN]) + { + struct ifreq req; + int sock = -1; +@@ -919,6 +936,19 @@ int get_netif_info(const char *net_if, u + in_addr.s_addr = *ip_addr; + os_snprintf(*ip_addr_text, 16, "%s", inet_ntoa(in_addr)); + ++ if (netmask) { ++ os_memset(&req, 0, sizeof(req)); ++ os_strlcpy(req.ifr_name, net_if, sizeof(req.ifr_name)); ++ if (ioctl(sock, SIOCGIFNETMASK, &req) < 0) { ++ wpa_printf(MSG_ERROR, ++ "WPS UPnP: SIOCGIFNETMASK failed: %d (%s)", ++ errno, strerror(errno)); ++ goto fail; ++ } ++ addr = (struct sockaddr_in *) &req.ifr_netmask; ++ netmask->s_addr = addr->sin_addr.s_addr; ++ } ++ + #ifdef __linux__ + os_strlcpy(req.ifr_name, net_if, sizeof(req.ifr_name)); + if (ioctl(sock, SIOCGIFHWADDR, &req) < 0) { +@@ -1025,11 +1055,15 @@ static int upnp_wps_device_start(struct + + /* Determine which IP and mac address we're using */ + if (get_netif_info(net_if, &sm->ip_addr, &sm->ip_addr_text, +- sm->mac_addr)) { ++ &sm->netmask, sm->mac_addr)) { + wpa_printf(MSG_INFO, "WPS UPnP: Could not get IP/MAC address " + "for %s. Does it have IP address?", net_if); + goto fail; + } ++ wpa_printf(MSG_DEBUG, "WPS UPnP: Local IP address %s netmask %s hwaddr " ++ MACSTR, ++ sm->ip_addr_text, inet_ntoa(sm->netmask), ++ MAC2STR(sm->mac_addr)); + + /* Listen for incoming TCP connections so that others + * can fetch our "xml files" from us. +Index: wpa_supplicant-2.9/src/wps/wps_upnp_i.h +=================================================================== +--- wpa_supplicant-2.9.orig/src/wps/wps_upnp_i.h ++++ wpa_supplicant-2.9/src/wps/wps_upnp_i.h +@@ -128,6 +128,7 @@ struct upnp_wps_device_sm { + u8 mac_addr[ETH_ALEN]; /* mac addr of network i.f. we use */ + char *ip_addr_text; /* IP address of network i.f. we use */ + unsigned ip_addr; /* IP address of network i.f. we use (host order) */ ++ struct in_addr netmask; + int multicast_sd; /* send multicast messages over this socket */ + int ssdp_sd; /* receive discovery UPD packets on socket */ + int ssdp_sd_registered; /* nonzero if we must unregister */ +@@ -158,7 +159,7 @@ struct subscription * subscription_find( + const u8 uuid[UUID_LEN]); + void subscr_addr_delete(struct subscr_addr *a); + int get_netif_info(const char *net_if, unsigned *ip_addr, char **ip_addr_text, +- u8 mac[ETH_ALEN]); ++ struct in_addr *netmask, u8 mac[ETH_ALEN]); + + /* wps_upnp_ssdp.c */ + void msearchreply_state_machine_stop(struct advertisement_state_machine *a); diff --git a/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch b/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch new file mode 100644 index 000000000..59640859d --- /dev/null +++ b/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch @@ -0,0 +1,62 @@ +From f7d268864a2660b7239b9a8ff5ad37faeeb751ba Mon Sep 17 00:00:00 2001 +From: Jouni Malinen +Date: Wed, 3 Jun 2020 22:41:02 +0300 +Subject: [PATCH 2/3] WPS UPnP: Fix event message generation using a long URL + path + +More than about 700 character URL ended up overflowing the wpabuf used +for building the event notification and this resulted in the wpabuf +buffer overflow checks terminating the hostapd process. Fix this by +allocating the buffer to be large enough to contain the full URL path. +However, since that around 700 character limit has been the practical +limit for more than ten years, start explicitly enforcing that as the +limit or the callback URLs since any longer ones had not worked before +and there is no need to enable them now either. + +Upstream-Status: Backport +CVE: CVE-2020-12695 patch #2 +Signed-off-by: Jouni Malinen +Signed-off-by: Armin Kuster + +--- + src/wps/wps_upnp.c | 9 +++++++-- + src/wps/wps_upnp_event.c | 3 ++- + 2 files changed, 9 insertions(+), 3 deletions(-) + +diff --git a/src/wps/wps_upnp.c b/src/wps/wps_upnp.c +index 7d4b7439940e..ab685d52ecab 100644 +--- a/src/wps/wps_upnp.c ++++ b/src/wps/wps_upnp.c +@@ -328,9 +328,14 @@ static void subscr_addr_add_url(struct subscription *s, const char *url, + int rerr; + size_t host_len, path_len; + +- /* url MUST begin with http: */ +- if (url_len < 7 || os_strncasecmp(url, "http://", 7)) ++ /* URL MUST begin with HTTP scheme. In addition, limit the length of ++ * the URL to 700 characters which is around the limit that was ++ * implicitly enforced for more than 10 years due to a bug in ++ * generating the event messages. */ ++ if (url_len < 7 || os_strncasecmp(url, "http://", 7) || url_len > 700) { ++ wpa_printf(MSG_DEBUG, "WPS UPnP: Reject an unacceptable URL"); + goto fail; ++ } + url += 7; + url_len -= 7; + +diff --git a/src/wps/wps_upnp_event.c b/src/wps/wps_upnp_event.c +index d7e6edcc6503..08a23612f338 100644 +--- a/src/wps/wps_upnp_event.c ++++ b/src/wps/wps_upnp_event.c +@@ -147,7 +147,8 @@ static struct wpabuf * event_build_message(struct wps_event_ *e) + struct wpabuf *buf; + char *b; + +- buf = wpabuf_alloc(1000 + wpabuf_len(e->data)); ++ buf = wpabuf_alloc(1000 + os_strlen(e->addr->path) + ++ wpabuf_len(e->data)); + if (buf == NULL) + return NULL; + wpabuf_printf(buf, "NOTIFY %s HTTP/1.1\r\n", e->addr->path); +-- +2.20.1 diff --git a/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch b/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch new file mode 100644 index 000000000..8a014ef28 --- /dev/null +++ b/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch @@ -0,0 +1,50 @@ +From 85aac526af8612c21b3117dadc8ef5944985b476 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen +Date: Thu, 4 Jun 2020 21:24:04 +0300 +Subject: [PATCH 3/3] WPS UPnP: Handle HTTP initiation failures for events more + properly + +While it is appropriate to try to retransmit the event to another +callback URL on a failure to initiate the HTTP client connection, there +is no point in trying the exact same operation multiple times in a row. +Replve the event_retry() calls with event_addr_failure() for these cases +to avoid busy loops trying to repeat the same failing operation. + +These potential busy loops would go through eloop callbacks, so the +process is not completely stuck on handling them, but unnecessary CPU +would be used to process the continues retries that will keep failing +for the same reason. + +Upstream-Status: Backport +CVE: CVE-2020-12695 patch #2 +Signed-off-by: Jouni Malinen +Signed-off-by: Armin Kuster + +--- + src/wps/wps_upnp_event.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/wps/wps_upnp_event.c b/src/wps/wps_upnp_event.c +index 08a23612f338..c0d9e41d9a38 100644 +--- a/src/wps/wps_upnp_event.c ++++ b/src/wps/wps_upnp_event.c +@@ -294,7 +294,7 @@ static int event_send_start(struct subscription *s) + + buf = event_build_message(e); + if (buf == NULL) { +- event_retry(e, 0); ++ event_addr_failure(e); + return -1; + } + +@@ -302,7 +302,7 @@ static int event_send_start(struct subscription *s) + event_http_cb, e); + if (e->http_event == NULL) { + wpabuf_free(buf); +- event_retry(e, 0); ++ event_addr_failure(e); + return -1; + } + +-- +2.20.1 diff --git a/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.9.bb b/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.9.bb index 2936e89ee..7cc03fef7 100644 --- a/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.9.bb +++ b/poky/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.9.bb @@ -25,7 +25,10 @@ SRC_URI = "http://w1.fi/releases/wpa_supplicant-${PV}.tar.gz \ file://wpa_supplicant.conf-sane \ file://99_wpa_supplicant \ file://0001-replace-systemd-install-Alias-with-WantedBy.patch \ - file://0001-AP-Silently-ignore-management-frame-from-unexpected-.patch \ + file://0001-AP-Silently-ignore-management-frame-from-unexpected-.patch \ + file://0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch \ + file://0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch \ + file://0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch \ " SRC_URI[md5sum] = "2d2958c782576dc9901092fbfecb4190" SRC_URI[sha256sum] = "fcbdee7b4a64bea8177973299c8c824419c413ec2e3a95db63dd6a5dc3541f17" -- cgit v1.2.3