From the OpenSSL Security Advisory [05 Jun 2014]
http://www.openssl.org/news/secadv_20140605.txt
Anonymous ECDH denial of service (CVE-2014-3470)
OpenSSL TLS clients enabling anonymous ECDH ciphersuites are subject to a
denial of service attack.
(Patch borrowed from Fedora.)
(From OE-Core rev: 299de5ea53446bc211e6aadf158d6ef7576384ab)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
From the OpenSSL Security Advisory [05 Jun 2014]
http://www.openssl.org/news/secadv_20140605.txt
SSL/TLS MITM vulnerability (CVE-2014-0224)
An attacker using a carefully crafted handshake can force the use of weak
keying material in OpenSSL SSL/TLS clients and servers. This can be exploited
by a Man-in-the-middle (MITM) attack where the attacker can decrypt and
modify traffic from the attacked client and server.
The attack can only be performed between a vulnerable client *and*
server. OpenSSL clients are vulnerable in all versions of OpenSSL. Servers
are only known to be vulnerable in OpenSSL 1.0.1 and 1.0.2-beta1. Users
of OpenSSL servers earlier than 1.0.1 are advised to upgrade as a precaution.
(Patch borrowed from Fedora.)
(From OE-Core rev: 50050c9c2449d14a0d3da91eed5d16cddce9cf76)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
From the OpenSSL Security Advisory [05 Jun 2014]
http://www.openssl.org/news/secadv_20140605.txt
DTLS recursion flaw (CVE-2014-0221)
By sending an invalid DTLS handshake to an OpenSSL DTLS client the code
can be made to recurse eventually crashing in a DoS attack.
Only applications using OpenSSL as a DTLS client are affected.
(Patch borrowed from Fedora.)
(From OE-Core rev: 2a9e46a319d32e99266fd44e1ea1ca2b5e7c9a6a)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
From the OpenSSL Security Advisory [05 Jun 2014]
http://www.openssl.org/news/secadv_20140605.txt
DTLS invalid fragment vulnerability (CVE-2014-0195)
A buffer overrun attack can be triggered by sending invalid DTLS fragments
to an OpenSSL DTLS client or server. This is potentially exploitable to
run arbitrary code on a vulnerable client or server.
Only applications using OpenSSL as a DTLS client or server affected.
(Patch borrowed from Fedora.)
(From OE-Core rev: aac6d15448e9a471a8d4ce086538b39f0b928518)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We don't normally do this, but with the recent CVE fixes (most
importantly the one for the serious CVE-2014-0160 vulnerability) I am
bumping PR explicitly to make it a bit more obvious that the patch has
been applied.
(From OE-Core rev: c50da4a2c1128f599b2c66d06b7d2ea80215f9d0)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fixes the "heartbleed" TLS vulnerability (CVE-2014-0160). More
information here:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160
Patch borrowed from Debian; this is just a tweaked version of the
upstream commit (without patching the CHANGES file which otherwise
would fail to apply on top of this version).
(From OE-Core rev: bebed954e8fea9d805a0eb6b284dd90177379242)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The ssl_get_algorithm2 function in ssl/s3_lib.c in OpenSSL before 1.0.2
obtains a certain version number from an incorrect data structure, which
allows remote attackers to cause a denial of service (daemon crash) via
crafted traffic from a TLS 1.2 client.
(From OE-Core master rev: 3e0ac7357a962e3ef6595d21ec4843b078a764dd)
(From OE-Core rev: 0d3d2d7062a181e878435487c06e26c6547e492f)
Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The DTLS retransmission implementation in OpenSSL through 0.9.8y and 1.x
through 1.0.1e does not properly maintain data structures for digest and
encryption contexts, which might allow man-in-the-middle attackers to
trigger the use of a different context by interfering with packet delivery,
related to ssl/d1_both.c and ssl/t1_enc.c.
(From OE-Core master rev: 94352e694cd828aa84abd846149712535f48ab0f)
(From OE-Core rev: 80263dc0b6c02c21949e81564ac1e5c6f198d9ac)
Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The ssl3_take_mac function in ssl/s3_both.c in OpenSSL 1.0.1 before
1.0.1f allows remote TLS servers to cause a denial of service (NULL
pointer dereference and application crash) via a crafted Next Protocol
Negotiation record in a TLS handshake.
(From OE-Core master rev: 35ccce7002188c8270d2fead35f9763b22776877)
(From OE-Core rev: e36aff4b0ed5f70deb4862dc893eef9ceaa93003)
Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
start-stop-daemon should be called with '--oknodo' instead of
'-oknodo'.
(From OE-Core master rev: 40f65a76b3291ae625c072a8efebbf134b15c367)
(From OE-Core rev: 1832280f616fe7010260afb53bbc3b1c6d7ea08b)
Signed-off-by: Marc Ferland <ferlandm@sonatest.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Some ofono test scripts i.e. enable-modem use python-dbus module
and this must be installed along with ofono-tests package.
(From OE-Core master rev: e5422ed7f3e4b1ee8554ffe3a98006477fb52c4d)
(From OE-Core rev: e731f2764090900ef5c856287fa9e1be12e07a56)
Signed-off-by: Muhammad Shakeel <muhammad_shakeel@mentor.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Without using our python classes and having appropriate dependencies, the
build is nondeterministic, and whether a python-avahi package is produced will
vary depending on the host environment, yet avahi-discover is always produced,
and it depends on python-avahi.
(From OE-Core master rev: 4599ef630c13224506671bf84569bfc240cd3032)
(From OE-Core rev: 472cea702c207a18ab18afe200dff78b328f6cf7)
Signed-off-by: Christopher Larson <chris_larson@mentor.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The connman init script sources a setup file from /usr/lib/connman,
so we end up with no network in qemu multilib enabled images.
The init script it's installed by connman and because wired-setup
it's installed by another package (connman-conf) we can't use
libexecdir here and now (in the init script and systemd service file).
Once libexecdir changes from ${libdir}/${bpn} to something else like
/usr/libexec we could use that instead of ${libdir}/connman.
Changed in v2: - better commit message
[YOCTO #4493]
(From OE-Core master rev: fca3a884e9cae13a521d840838eee3c01f0b6acf)
(From OE-Core rev: d620e5376c10bc5ff1aa551be4a7d1d635a760c3)
Signed-off-by: Stefan Stanacar <stefanx.stanacar@intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
After installing Avahi we need DBus to reload it's configuration. In a
pure-systemd image there isn't a DBus init script to reload, so cut out the
middleman and just sent SIGHUP to all running dbus-daemon processes instead.
(From OE-Core rev: d6fb028de172bb649b905b605f6ddc8402af859a)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
After installing Avahi we need DBus to reload it's configuration. In a
pure-systemd image there isn't a DBus init script to reload, so cut out the
middleman and just sent SIGHUP to all running dbus-daemon processes instead.
(From OE-Core rev: b3e468294a0723b3ceafe2022bf9d735eee64678)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Other recipe versions in other layers
may be using connman.inc, so by resetting
INC_PR they go backwards in version.
Set the INC_PR correctly.
(From OE-Core rev: 2d56006cd88233c7f1f15a44f72a04bd0e441b25)
Signed-off-by: Cristian Iorga <cristian.iorga@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
bluez4 uses readline to be build, but the dependency is not listed
This is listed in the configuration log.
So we add it.
(From OE-Core rev: 99194be0332ac35da729ec53a2cc423cc520db28)
Signed-off-by: Alexandru DAMIAN <alexandru.damian@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sysvinit/systemd assumes that update-rc.d can be inhibited
* with systemd enabled, sysvinit scripts are missing in packages
and update-rc.d needs to be put in BAD_RECOMMENDATIONS to prevent
update-rc.d trying to install them in postinst
* update-rd.c shouldn't be in DEPENDS
(From OE-Core rev: e9e4a90c7e66abe2ab2c335d60ef91e869f48693)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Added support for correctly configuring
wired interface if systemd is the init system.
Fixes [YOCTO #4041].
(From OE-Core rev: ec5530779df23ea25729c7d19c664c05fae5758d)
Signed-off-by: Cristian Iorga <cristian.iorga@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
If run more than once, the IP addresses would be appended
to IPv4 variable. Avoid that by rewriting the IPv4 always.
(From OE-Core rev: da682e752e351e5bb7636ee187db3eabc208c177)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The /etc/connman is not suitable for the setup script.
There are other connman related scripts in /usr/lib/connman
so moving the wired setup script there.
(From OE-Core rev: 858ad53aee9ef5848c09d76c0e6bf464bc31d30e)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add patch to allow out of tree builds to work.
(From OE-Core rev: a3238c1e1317c4fd5526c8854403a2160cb51bb0)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
neard ver 0.10:
Added initial WiFi handover support.
Added Service Name Lookup support to nfctool.
Added NDEF building unit tests.
Added State support to Bluetooth handover agent.
Added neard and neard.conf man pages.
Added a copy of the NFC kernel header.
Fixed handover validation tests failures.
Fixed Tag and Device PropertyChanged signal.
(From OE-Core rev: dff13ee38a4f6aa51722149b860a2af354d6f9e8)
Signed-off-by: Olivier Guiter <olivier.guiter@linux.intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There is no reason to disable exec-stack only for -native builds;
binaries on the target will suffer from the same SELinux ACLs.
OpenSSL does not use executable stack so this option can be disabled
unconditionally.
(From OE-Core rev: 9c32b62d6494139daf4bab3279779c392fead116)
Signed-off-by: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Otherwise configure will use pkg-config and may find systemd, even though we
don't want it.
(From OE-Core rev: 87fe717009fb2bcd8e5dbdf0236fe715effca89f)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The issue is that an ethernet config file is removed without
proper checks in place (rm -f), which triggers an error and
makes the connman startup script to fail.
The file is now removed with proper checks in place.
Fixes [YOCTO #4003].
(From OE-Core rev: d9349e6e28cef107ad8bd00767ceba4d8aa464dd)
Signed-off-by: Cristian Iorga <cristian.iorga@intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Copy from WORKDIR first, then modify. Improves consistency
between successive invocations of do_configure.
(From OE-Core rev: 82205345d777f7f34d43e4f81df0fa3bfe409fc4)
Signed-off-by: Andreas Oberritter <obi@opendreambox.org>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The Linux NFC project aims to provide a full NFC support for Linux.
It is based on the neard NFC user space stack running on top of the
Linux kernel NFC subsystem.
The code generated using this recipe was tested on a ARM11 device, with
a kernel 3.6, using, for the NFC hardware, a USB dongle with the PN533
chipset (SCL3711)
(From OE-Core rev: b2a74ae70725be7efc0226901fd560d3b3b48607)
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- connman-conf package re-implemented
- connman 1.12 introduces provisioning for
wired interfaces also;
- wired interface settings are read from
kernel cmdline if present;
- after that are passed to connman as a
config file
- for BA, this is not needed, as BA will
have a network infrastructure to work with.
Fixes [YOCTO #3227];
Fixes [YOCTO #3804];
Fixes [YOCTO #3843].
(From OE-Core rev: 5711e0cf88fac0de8a5317b16a287b335c827c8f)
Signed-off-by: Cristian Iorga <cristian.iorga@intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* The variable name was truncated.
(From OE-Core rev: 2217176a9e2b9b9ac3b1e42e0feecb2c84d60f49)
Signed-off-by: Andreas Oberritter <obi@opendreambox.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
