Changelog:
===========
- avoid possible double free of found in idbm_rec_update_param (#528)
- Modify log function to print session id (#498)
- Add tcp.congestion_control configuration option (#520)
- iscsi-gen-initiatorname use @IQN_PREFIX@ as default
- iscsi-init.service: Use iscsi-gen-initiatorname
- Fix issue with IPv6 adapter interfaces (#508)
- Small cleanups for firmware discovery. (#522)
- Fix unused variable warning in usr/io.c (#524)
- Make iface.example a doc file. (#526)
- Fix security issues recently discovered by Keith at Linneman Labs (#535)
- Makefile: fix "No rule to make target 'iscsiuio/Makefile.in" issue (#506)
- fwparam_ppc.c: Fix the calloc-transposed-args issue (#504)
- Fix incorrect parsing of node.discovery_type "static" and "fw" (#518)
- doc: fixup iscsiadm man page option for -r (#501)
- Fix typo in initiator.c (#507)
- iscsi: validate interface IP against target address family (#527)
- iscsi: delay reconnect until interface has valid IP. (#511)
- Fix minor typo ("authenticaton") (#500)
- iscsi_net_util: avoid copying NULL pointers with strlcpy()
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
do_package failed with a fatal QA error:
QA Issue: ufw: Files/directories were installed but not shipped in
any package: /usr/usr/lib/ufw/... (and on repeated rebuilds
/usr/usr/usr/lib/ufw/...) [installed-vs-shipped]
Under the usrmerge DISTRO_FEATURE, do_configure:prepend rewrites the
single os.path.join('/lib', 'ufw') in setup.py to nonarch_base_libdir
(/usr/lib) with an in-place sed. The pattern '/lib' is not anchored, so
when do_configure re-runs against an already-patched ${S} (cached
unpack/patch, as happens on world rebuilds) it matches the '/lib' inside
the previously substituted '/usr/lib' and prepends another /usr, giving
/usr/usr/lib and then /usr/usr/usr/lib. FILES:${PN} ships
${nonarch_base_libdir}/ufw (/usr/lib/ufw), so the doubled paths are
unshipped and QA fails.
Anchor the substitution to the quoted literal '/lib'. After the first
run the text is '/usr/lib', which no longer contains '/lib', so
re-running do_configure is a no-op. Verified two forced do_configure
runs leave os.path.join('/usr/lib', 'ufw') and do_package succeeds.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
===========
- Issue 2135 - ExecEnviron values not passed due to regression since 1.3.8.d.
- Issue 2146 - Stack buffer overflow in MLSD/MLST handling for long path names.
- Issue 2158 - MaxTransfersPerUser no longer enforces configured limits.
- Issue 2163 - AdminControlsACLs for config, get actions not honored as they
should be.
- Issue 2166 - Memcached/Redis-cached JSON TLS session/OCSP entries decoded
into fixed buffers without bounds checking.
- Issue 2173 - RewriteMap unescape builtin use causes one-byte out-of-bounds
write, fails to reject illegal characters.
- Issue 2188 - SQL group name lookup concatenates client-provided group names
without escaping.
- Issue 2190 - Authenticated SFTP sessions can overflow the SFTP packet buffer.
- Issue 2210 - Default Controls socket ACLs unintentionally allow all users
access for sending Controls requests.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
frr's configure links libatomic whenever the toolchain merely has it:
AC_CHECK_LIB([atomic], [main], [LIBS="$LIBS -latomic"], [], [])
This probe only asks whether -latomic links, never whether frr needs a
symbol from it. On x86-64 the atomics frr uses are inlined, so the
resulting native clippy references no __atomic_* symbol at all, yet
still records a DT_NEEDED on libatomic.so.1.
Nothing prunes it: ASNEEDED is part of TARGET_LDFLAGS only, so native
links get no --as-needed. Nothing can satisfy it either: clippy's
RUNPATH points solely into recipe-sysroot-native, there is no
libatomic-native, and uninative only rewrites the ELF interpreter.
buildtools-extended-tarball ships nativesdk-libatomic, so on hosts using
buildtools (Rocky 8, Alma 8, openSUSE on the autobuilder) the probe
succeeds at link time while the loader cannot find libatomic later, and
the target do_compile dies executing clippy:
clippy: error while loading shared libraries: libatomic.so.1:
cannot open shared object file: No such file or directory
Hosts with a system libatomic in the default loader path, such as Ubuntu
with libatomic1 installed, only avoid this by accident.
Link native clippy with --as-needed so the unused libatomic dependency is
dropped, making the frr-native artifact independent of the build host.
Fixes [YOCTO #15590] and [YOCTO #15590]
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Analysis:
- The Mbed TLS advisory states the issue occurs when LLVM
select-optimize is enabled. [1]
- The same advisory also states that Arm/x86 builds with
MBEDTLS_HAVE_ASM enabled are not affected. The default mbedtls
configuration in this branch enables MBEDTLS_HAVE_ASM.
- NVD also describes the issue as occurring only with LLVM's
select-optimize feature. [2]
- The mbedtls recipes now evaluate the effective build flags across
target, native, and nativesdk variants, handle the supported
-mllvm spellings, and only mark the CVE unpatched when the
vulnerable LLVM option combination is explicitly enabled and the
Arm/x86 MBEDTLS_HAVE_ASM carve-out does not apply.
- When those conditions are not met, the current mbedtls build
configuration is not affected.
- Hence ignoring/deferred the CVE for now.
Reference:
[1] https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-compiler-induced-constant-time-violations/
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-66442
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
GCC 14 promotes -Wincompatible-pointer-types to an error by default. The
buffer_init*.c sources pass read()/write() directly where a typeless op
function pointer is expected:
buffer/buffer_init_read.c:6:18: error: passing argument 2 of 'buffer_init'
from incompatible pointer type [-Wincompatible-pointer-types]
The existing gcc-15 patch only fixes the BUFFER_INIT macro, not these call
sites. Add -Wno-error=incompatible-pointer-types so the build completes.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The shipped Makefile does 'include config.mk' which is only created by
configure, so the 'make clean' run by autotools_preconfigure fails before
configure has run.
Set CLEANBROKEN to skip that pre-configure clean.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Inherit python3targetconfig
point CMake's FindPython at the target sysroot libpython/headers
so Embed component resolves when cross compiling.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The webkit2gtk pkg-config check was unconditional, but WEBKIT is only
used by the GNOME auth dialog. Move it under the with-gnome guard
add webkitgtk3 to the gnome PACKAGECONFIG deps
ship the D-Bus system policy file.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
License-Update: copyright year range updated; still BSD-3-Clause
Update LIC_FILES_CHKSUM: the LICENSE text changed only in its copyright
year range, it is still BSD-3-Clause.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Add a patch fixing the autoconf 2.13-era idioms that abort autom4te
under autoconf 2.73, and regenerate the existing patches so they apply
without fuzz.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Drop 0001-replace-__pure__-with-compiler-attribute-pure, which is obsolete
in 0.34, and refresh 0001-fix-incompatible-type-error-with-gcc-15 to the
hunks still needed.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
License-Update: license header switched from "LIC: GPL" to SPDX GPL-2.0-or-later; license text unchanged
Adapt the patches to the 4.0 source restructure: refresh
configure_in_cross.patch for the new configure, and drop
0001-ppoe-Dont-include-linux-if_ether.h and
0002-Enable-support-for-the-kernel-module which are obsolete/upstreamed
in 4.0.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
License-Update: added GPLv2/GPLv2+ files (linux_helpers.h, rbtree_augmented.h, rbtree_types.h) to the per-file license listing
Drop 0001-dlm_controld-remove-unnecessary-header-include,
0001-Disable-annobin-plugin and 0001-Remove-fcf-protection-full, which
are all present in 4.3.0.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
drop upstreamed cross-compile test patch
This release already guards the auth-pam unit test TESTS assignment with
"if !CROSS_COMPILING" in tests/unit_tests/plugins/auth-pam/Makefile.am
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
lftp 4.9.3 bundles gnulib sources that fail to build with the OpenEmbedded
clang + lld toolchain. Carry a single patch with the gnulib compatibility
fixes:
1. Single-argument static_assert (lib/dirent.in.h, lib/uchar.in.h) is a
C++17 feature; clang in its default C++14 mode rejects it with
"static_assert with no message is a C++17 extension". Add a message.
Reported upstream: https://github.com/lavv17/lftp/issues/766
2. lib/stdlib.in.h pre-includes <string> to pre-instantiate std::strtoull
before the "#define strtoull rpl_strtoull" macro fires, but guarded the
workaround with "&& !defined __clang__" so it never triggered under
clang + libstdc++, rewriting std::strtoull to the non-existent
std::rpl_strtoull. Extend the guard to cover clang.
3. After gnulib split md5.c/sha1.c into primary + -stream.c files, both
define GL_OPENSSL_INLINE to _GL_EXTERN_INLINE before including the
header, so with the OpenSSL md5/sha1 backends both translation units
emit out-of-line wrapper copies and lld fails with duplicate symbol
errors. Drop the override from the -stream.c files.
Consolidates the three previously separate patches into one; verified by
building lftp for qemux86-64 with clang + lld (the duplicate-symbol link
failure reproduces without the patch and is resolved with it).
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Update to a newer version of the last release, because this does not compile
which got fixed with
https://github.com/irontec/sngrep/commit/b84f0663e47de6f238d9f81eed67612a9ab616ef.
sngrep supports pcre2, so use this instead of pcre, which is outdated.
Changelog:
* capture: add support for telephony-event rtp streams (RFC 4733)
* capture: replace fake HEP frames for network captured packets
* call flow: limit call-id displayed on title to 125 characters
* rtp: fix duration value in telephony-event is incorrectly converted
* core: fix out of bound arrays crashes
* eep: fix multiple memory crashes in HEP parsing
* ipv6: fixed incorrect payload length for fragmented IPv6 packets
* build: use libgcrypt-config if pkg-config is not available for libcrypt
Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The Debian package page is not the appropriate homepage. And we can add the
bug tracker URL and a description. Configure has some more options we can
expose as PACKAGECONFIG. In INSTALL file in the source repository states
that libpcre2 (instead of libpcre) should be used. And std=gnu89 is no
longer needed.
Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
GCC 16 defaults to C++20 which enforces stricter designated
initializer rules. Add patches to fix the two affected test files.
Signed-off-by: Hemanth Kumar M D <Hemanth.KumarMD@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Ankur Tyagi
Wang Mingyu
Khem Raj
Peter Marko
Lian Wang
Deepak Rathore
Hemanth Kumar M D
Gianfranco Costamagna
Jörg Sommer