Commit Graph

14 Commits

Author SHA1 Message Date
Tom Rini
1bbdc674ae inetutils: Update to the 2.5 release
The update from 2.4 to 2.5 was almost something AUH could take care of.
However, we had backported two patches to address CVE-2023-40303 and
that threw off AUH. These changes are confirmed to be in 2.5, so drop
them and update to 2.5.

(From OE-Core rev: e1bffeab27b062884f6366cde24ce1c67e7ec03e)

Signed-off-by: Tom Rini <trini@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-01-03 23:36:34 +00:00
Ross Burton
cc025f14a2 inetutils: remove obsolete patches
fix-disable-ipv6.patch: we don't support uclibc, and most libcs don't
have optional support for IPv6.

inetutils-1.8-0001-printf-parse-pull-in-features.h-for-__GLIBC__.patch and
inetutils-1.8-0003-wchar.patch: these don't appear to be needed anymore.

inetutils-only-check-pam_appl.h-when-pam-enabled.patch: configure.ac
doesn't fail if PAM is disabled anymore.

(From OE-Core rev: abcc8273a788981bd06867d141b78aa0cfedddf4)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-09-02 11:47:50 +01:00
Ross Burton
da317d8dfc inetutils: don't guess target paths
inetutils guesses a lot of target paths in cross builds, and warns that
some of them are known to be wrong (for example, whether /proc/net/dev
exists is guessed as 'no').

Add a post-configure function to check for these warnings, and pass
--with-path-* as appropriate to set the paths explicitly.

This means we can remove the patch which was setting PATH_PROCNET_DEV,
and the autoconf cache value inetutils_cv_path_login.

The downside is that these --with-path-* options are not real autoconf
options, so the "unknown options" warning is emitted.  Losing those is
an acceptable compromise, so disable it.

Musl doesn't implement utmp and has stub defines for _PATH_UTMP but not
_PATH_UTMPX, so we need to set the X variants explicitly.

(From OE-Core rev: 91179f89db127063dbdf998e15d63e04d6be53f7)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-09-02 11:47:50 +01:00
Khem Raj
031dad3c8b inetutils: Fix CVE-2023-40303
(From OE-Core rev: 211942410ec0fb5ebe906b4fed7f1feb13b7cf39)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-08-30 09:56:13 +01:00
Martin Jansa
55703b38d1 inetutils: remove unused patch files
* they were removed from SRC_URI in:
  https://git.openembedded.org/openembedded-core/commit/?id=a21e8fdf1b66961ddae5929d393daa08800bb748

(From OE-Core rev: e2030f2a651920435787b4a580dd18894c1bc02c)

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-05-25 12:36:00 +01:00
Wang Mingyu
f42c3d428d inetutils: upgrade 2.3 -> 2.4
CVE-2022-39028.patch
removed since it's included in 2.4

Changelog:
==========
ifconfig
------------
Support specifying prefix netmask lengths in -A.
Hurd: tell pfinet translator interfaces to configure

ftp
----------
Avoid crash caused by signed integer overflow resulting in out-of-bounds buffer access.
Avoid crash caused by heap buffer overflow.
Avoid crash caused by NULL pointer dereference.
Avoid crash caused by infinite macro recursion.

telnetd
-----------
Avoid crash on 0xff 0xf7 (IAC EC) or 0xff 0xf8 (IAC EL).  CVE-2022-39028

telnet
-----------
Fix a buffer overflow problem.  CVE-2019-0053

tftp
-----------
Avoid crashing when given unexpected or invalid commands from tty.
Various bugs fixes, internal improvements and clean ups.

(From OE-Core rev: fec6ec179b97b768d32fbd782338450edc1a5344)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-11-07 14:32:42 +00:00
Khem Raj
6f9970ea02 inetutils: Fix remote DoS vulnerability in inetutils-telnetd
(From OE-Core rev: f9c23404de44553eacd363885588b88714742387)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-13 23:03:36 +01:00
Alexandre Belloni
9ccf0f47a9 inetutils: drop CVE-2021-40491 patch
This CVE is already fixed in inetutils 2.2

(From OE-Core rev: d0c64bd9aef5fa4bf60cac922b1d5e43652f7919)

Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-10-11 18:41:37 +01:00
Alexander Kanavin
2d4bdfdff6 inetutils: update 2.1 -> 2.2
(From OE-Core rev: c5095396909e6b1450ba2020472b5eb7d14a4751)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-10-11 18:41:37 +01:00
Yi Zhao
eafac9940a inetutils: fix CVE-2021-40491
CVE-2021-40491:
The ftp client in GNU Inetutils before 2.2 does not validate addresses
returned by PASV/LSPV responses to make sure they match the server
address. This is similar to CVE-2020-8284 for curl.

References:
https://nvd.nist.gov/vuln/detail/CVE-2021-40491

Patch from:
https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=58cb043b190fd04effdaea7c9403416b436e50dd

(From OE-Core rev: 1b857807f1cf8fee3175f8479a0c7cb1850bd9a9)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-09-26 12:05:03 +01:00
Oleksandr Kravchuk
bf64a62bfd inetutils: update to 2.0
Removed upstreamed patches and refreshed q few other.

(From OE-Core rev: a21e8fdf1b66961ddae5929d393daa08800bb748)

Signed-off-by: Oleksandr Kravchuk <open.source@oleksandr-kravchuk.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-02-08 14:47:16 +00:00
Khem Raj
35d23eaf53 inetutils: Fix build with -fno-common
Fixes errors like

telnetd/state.c:69: multiple definition of `not42'; utility.o:/usr/src/debug/inetutils/1.9.4-r0/build/telnetd/../../inetutils-1.9.4/telnetd/utility.c:66: first defined here
| clang-11: error: linker command failed with exit code 1 (use -v to see invocation)

(From OE-Core rev: 555bb1191459aa2a05a4ed9e044c0eba085a7162)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-08-06 15:12:39 +01:00
Ricardo Ribalda Delgado
5f1bfba262 inetutils: Fix abort on invalid files
When the code is compiled with  "-fstack-protector-strong
-D_FORTIFY_SOURCE=2", everytime ftpfd is asked for a non existent file,
it crashes with the following error:

*** buffer overflow detected ***:
Aborted

This seems to be a bug/feature of gcc. A bug has been open on their
bugzilla, and also inetutils have been posted with the proposed patch.

Without this patch, pxelinux fails to boot because it keeps asking the
server for the pxelinux.cfg/00-01-02-03-04 and never jumps to /default.

(From OE-Core rev: 0c3a1251a8aec86f3e877130f926a928e5ca2030)

Signed-off-by: Ricardo Ribalda Delgado <ricardo@ribalda.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-08-08 10:19:56 +01:00
Tom Rini
e96a537f11 inetutils: Import version 1.9.4
In order to have more robust stand-alone network tools in oe-core, bring
in inetutils from meta-openembedded/meta-networking.  This imports the
recipes as of git commit:
commit 408204073e6bdcd8ac586e05d5b75213417673f2
Author: Martin Jansa <martin.jansa@gmail.com>
Date:   Thu Aug 16 20:39:15 2018 +0000

    inetutils: fix build with glibc-2.28

(From OE-Core rev: ace6911e663709f07ca73aa72f6bb4f4111b2749)

Signed-off-by: Tom Rini <trini@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-03-06 23:12:27 +00:00