The live resolver tests use the system resolver configuration. When the
network is configured by the kernel ip= parameter and nothing in userspace
writes /etc/resolv.conf, the nameserver is only available in /proc/net/pnp
and the tests fail with "no nameservers". Seed resolv.conf from it when
it has no nameserver entry.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The final rpcbind check chained 'which systemctl && systemctl status ||
service rpcbind status', so on sysvinit images without systemctl it fell
back to 'service', which may not exist, and the tests were skipped even
though rpcbind was running. Check the status with the same init system
that was used to start it.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The GPU software ISP renders with GLES 2 through EGL and never uses
desktop GL, so depend on virtual/libgles2 instead of virtual/libgl.
Requiring virtual/libgl breaks machines whose GPU stack only provides
EGL and GLES, e.g. StarFive JH7110 with the PowerVR mesa-pvr.
Also carry a patch so libcamera doesn't redefine EGL_NO_X11 when an
older Mesa's egl.pc already passes -DEGL_NO_X11, which fails the build
with -Werror.
Signed-off-by: Joel Winarske <joel.winarske@linux.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.104.1:
- WireGuard packet buffering uses less memory while waiting for
peer handshakes.
- WireGuard packet queue depth scales with CPU core count, reducing
peak memory usage under heavy traffic.
- Client-side netmap caching improves start up speed and
connectivity when the Tailscale control plane is unreachable.
- WireGuard allocates a single packet buffer for batched I/O,
improving throughput and reducing memory usage.
- An issue that could prevent traffic over IPv6 link-local
addresses from flowing through direct and Tailscale Peer Relay
connections is resolved.
- An issue preventing Linux desktop detection from working on
Wayland environments is resolved.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
dumpcap is a lightweight capture tool which carries no dependencies on
wireshark. Break it into its own package, with an RDEPENDS back to
wireshark.
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 7.991:
- Upgraded included OpenSSL t- version 3.0.21 on all platforms.
- Fixed a memory-consumption hang in Ncat's HTTP proxy code that
affected both connect and listen modes, reported by kumama_nui.
- Patched our included libssh2 source with upstream fixes for
CVE-2025-15661, CVE-2026-7598, CVE-2026-55199, CVE-2026-55200,
CVE-2026-58050, and CVE-2026-58051. The version number has been
annotated as 1.11.1_NMAP1
- [Zenmap][GH#3347] Fixed several issues leading t- crashes when
parsing, editing, or saving command profiles containing '%'
characters.
- [NSE][GH#2272] smb-enum-shares failed t- produce output for valid
shares when an error was encountered on one share.
- [GH#3410] Fixed an issue where DNS resolution would incorrectly
fail t- match the same name in a different case.
- [NSE][GH#1066] Added service names for SSL-protected services
like amt-soap-https t- portrules for several scripts, ensuring
they run on these as well as the standard unencrypted services.
- Audited and converted most instances of strcat, strcpy, and
sprintf t- use bounded functions instead.
- [NSE][GH#2221] mysql-dump-hashes now uses the correct column name
for MySQL 5.7+
- [NSE][GH#2238] http-referer-checker was incorrectly fetching
off-host URLs. Now only URLs on the target are fetched.
- [GH#2122] When an interface is specified with -e, als- bind t-
the IP address for that device s- that it works for non-Linux
systems and non-root users.
- [Nsock][GH#1939] When nsock_iod_set_localaddr() is used,
nsock_connect_*() will now treat errors in bind(2) as connection
failure.
- [GH#2732] Fix a potential crash on 32-bit platforms in debug mode
due to incorrect format specifier for 64-bit integer type.
[Christopher Chavez]
- [GH#3201][GH#3367] Increase line length limit for
nmap-service-probes and correctly handle lines that are to- long.
[@liquidpele, Ashutosh Kumar Singh]
- [GH#3414] Avoid out-of-bounds read when parsing PTR domain names.
[@toor11 (Juri)]
- [GH#2245] Ensure variables updated by signal handlers are
volatile sig_atomic_t.
- [Ncat][GH#1410] Fix an assertion failure (count <= INT_MAX) in
ncat -lk in some cases where stdin or a listening socket produces
an error.
- [NSE][GH#1946] Fix a cryptic error in smb-enum-services, "Server
returned less data than needed for header" when smb.start_smb()
failed.
- Fixed an issue with parsing nmap-service-probes that could cause
a corrupted file t- crash Nmap. Reported by Muhammed Hussein.
- [NSE][GH#2016] Removed hostmap-bfk.nse, since the service it used
shut down.
- Fixed several issues reported by Himanshu Anand: infinite loop in
TCP options parsing and out-of-bounds memory read in IPv4 OS
detection; integer underflow in IPv6 extension header processing;
and undefined behavior in DNS label parsing.
- [GH#2721] Added checks for returned pointers from OpenSSL
allocation functions.
- [GH#1546] Fix an incorrect assertion "timeout / 1000 <= (long)
o.scan_delay" in traceroute which failed for timeouts greater
than 1 second when there was n- scan delay.
- [GH#3175] The --stats-every option can now be used in conjunction
with --noninteractive. Previously, n- stats messages were printed
if a TTY was not attached.
- [GH#3375] Nmap can now be built with OpenSSL 4.0
- [Nping][GH#1751] The --rate option will not accept a rate higher
than 1000 packets per second, since Nsock timers have millisecond
resolution. Use --delay 0 for unlimited rate.
- [Nping] Fixed several issues with Nping in IPv6 mode including:
+ [GH#1261] Incorrect BPF generated leading t- "expression
rejects all packets"
+ [GH#3215] Incorrect constant used t- check for IP version in
Ech- Server
- [NSE][GH#3368] Fixed an out-of-memory issue in packet.lua when
parsing a zero-length TCP header option. [Maxim Suhanov]
- Fixed an issue where Nmap OS scan trusts a packet's ip_len t-
size a CRC32 computation over TCP RST payload data, which may
result in reading arbitrary heap data. Reported by Michael
Bommarito.
- [Ncat][GH#3005] Correctly report listening port number. `ncat -l
-p 0` will cause Ncat t- listen on an ephemeral port, but it was
reporting itself as listening on port 0.
- [Ncat][GH#1672] Fixed an issue where Ncat in server mode would
quit without printing the last received data on a connection,
particularly affecting SCTP.
- [Ncat][GH#2827] Fixed an issue where Ncat in --send-only mode
would ignore disconnects and crash when it tries t- send data t-
a disconnected client.
- [Ncat][GH#3291] Fixed an issue where Ncat on Windows would quit
after 2 minutes due t- an OS-enforced timeout on the half-open
TCP socket used to emulate STDIN.
- [Nping][GH#564] Allow Nping t- fall back t- TCP Connect mode on
Windows when Npcap is not installed.
- [Ncat] Fixed several issues reported by Muhammed Hussein
involving crashes in Ncat's server-mode HTTP proxy, as well as
one code-quality issue with its Telnet negotiation code.
- [Nsock][GH#2595] Fix an issue where Nsock's SOCKS4 proxy code
would send additional null bytes on Windows and other platforms
where the compiler does not understand __attribute__((packed)).
[Daniel Miller]
- The --release-memory option is now a no-op. Nmap will always run
finalization routines that release allocated memory before
closing.
- Fixed an integer underflow in service_scan.cc that would cause
little-endian integers extracted from the beginning of a service
banner t- be interpreted as 0. Discovered with AFL++ by Malek
Althubiany.
- [Nsock][GH#583] Use OpenSSL security levels and callbacks t-
prevent errors connecting t- certain insecure targets when using
NSOCK_SSL_MAX_SPEED. The default, as used in Ncat, now uses
stricter-than-default security level.
- [GH#410] If a target times out due t- --host-timeout, d- not
perform traceroute.
- [Nping][GH#380] Disallow combining Ethernet-related options like
--dest-mac with --send-ip
- [NSE][GH#3250][GH#3206] Fix assertion failures in cases where
connect or send returns immediately with a status other than
ERROR, e.g. TIMEOUT or CANCELED. [Daniel Miller]
- [Ncat][GH#290] Enable ncat -l --ssl t- use DHE and ECDHE cipher
suites for perfect forward secrecy.
- Fix a crash when writing long CPE strings t- output. Reported by
Harshit Gupta. [Daniel Miller]
- [Ncat] Fix several cases where Ncat's SOCKS5 client could
interpret uninitialized data as protocol data, triggered by a
malicious SOCKS5 proxy server. N- code execution or application
crash is possible. Reported by Govind Pratap Singh. [Daniel
Miller]
- [Nping] Fix a out-of-bounds access in Nping Ech- client allowing
a malicious Nping EchoServer t- zer- 32 bytes of memory outside
the packet buffer. Reported by Harshit Gupta. [Daniel Miller]
- Fix a 1-byte overrun (read) while reading certain crafted DNS
labels, reported by Peter Parker. [Daniel Miller]
- [NSE][GH#3317] Function url.build_path was mangling special
characters in URL path segments. [nnposter]
Drop 0004-libdnet-fix-PF_PACKET-conftest-nested-function.patch
because the check for PF_PACKET that failed with clang has been
fixed with commit 33c39cd38 in the upstream of nmap.
Set OEQA_BUILDPATHS_SKIP to ignore upstream HOME path match and
avoid buildpaths QA error.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog:
- New –format string %{progress-conemu}, and option –conemu, to show
progress in the terminal title tab on terminals with ConEmu OSC 9;4
support
- Eliminate potential for closure of standard output under a combination of
error conditions when using –monitor mode
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
mctp version 2.7 adds Meson's installation tags to the project, now allowing
binaries to be selectively installed.
Use MESON_INSTALL_TAGS to selectively install files specific to each recipe.
No longer rm in mctpd's do_install step, which was a now-unneeded hack.
Meson tags prevent installation of the extra binaries.
Add mctpd.conf to FILES in the mctpd recipe following its installation to
improve recipe readability.
Signed-off-by: James Lee <james@codeconstruct.com.au>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Alex Kiernan (2):
VarlinkTransport: stop reading after a failed peek
VarlinkTransport: treat a failed read as a lost connection
Colin Watson (1):
types: return NotImplemented from __eq__ for type errors
Helmut Grohne (37):
varlinkmethod: allow overriding the return type
reduce contents of the main import and avoid star imports
CI: tune certification socket timeout
CI: fixup certification timeout change
document that it is uploaded to PyPI
docs/structure.rst: finish truncated paragraph on file descriptors
pyproject.toml: document development packages
VarlinkTransport: send correct data on partial send
validate_interface: fix acceptance of garbage at end
create_unix_server: actually make the socket non-inheritable
docs: adapt documentation to pause_reading/resume_reading rename
__init__.py: improve language of initial __doc__ string
GenericVarlinkErrorReply: provide a __str__ method
connect_unix_varlink: fix resource leak in error path
VarlinkTransport: delay eof_received call
VarlinkTransport: remember the readable handler function
VarlinkTransport: turn a magic number into a class attribute
expand ci coverage to Python 3.15
VarlinkTransport: fix association of messages and file descriptors
correctly determine whether typing.override exists
fix result type of wrapped varlinkmethod
github: allow manually scheduling workflows
test_protocol.py: fix missing import
VarlinkTransport: tighten assertion
test_protocol.py: close the transport, not the connections
VarlinkTransport: harden resume_reading against concurrent closing
TransportTests.test_send_socket: avoid exceptions in callbacks
VarlinkClientProtocol.call: avoid failing future with no consumers
test_certification.py: delete unused import
test_protocol.py: delete unused import again
tests: add StrictAsyncioTestCase helper class and use it
tests: another type hint improvement
test_conversion.py: increase precsion of two type annotations
varlinkmethod: clarify that the type annotation must signal generators
add a HACKING.md file clarifying development processes
add the justfile promised in HACKING.md
upload to pypi as version 0.3.3
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Fixes CVE-2026-107816: an out-of-bounds heap read in the qc_info plugin
when reading information_schema.query_cache_info after caching a query
that contains embedded null bytes, which could disclose adjacent heap
memory or crash the server.
Drop c21bb11be28ae9b2432b2a661bf38a197cf9514d.patch, which is already
included upstream in 11.4.13.
Disable the DuckDB storage engine (new in 11.4.13) via -DPLUGIN_DUCKDB=NO:
it bundles its own CMake subproject that is not cross-compile aware and
fails do_compile in a cross environment.
CVE: CVE-2026-107816
Signed-off-by: Poornima Lokesh <Poornima.Lokesh@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
aiohttp 3.14.4 requires yarl >= 1.25.1 and imports query_to_pairs,
which 1.24.5 does not have, so importing aiohttp.web fails with:
ImportError: cannot import name 'query_to_pairs' from 'yarl'
AI-Generated: Claude Opus 5.5 (Claude Code)
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The previous SUMMARY could be read as suggesting that this recipe is the
official GNU coreutils project. Reword it to state that uutils is a
separate, Rust reimplementation.
Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 2.5.0:
- Added with_doc, a decorator for overriding the docstring that
help(), pydoc and other introspection tools see for a wrapped
callable without mutating the wrapped function itself. It is the
companion of with_signature. The docstring can be supplied
directly, or as a factory callable that derives it from the
wrapped function at decoration time. When stacked above
with_signature the factory sees the overridden signature and can
embed it in the docstring. Assigning to __doc__ on the resulting
wrapper replaces the override, and deleting it restores
delegation to the wrapped function. Previously the only option
was to assign to __doc__ on a wrapper, which writes through to
the wrapped function since __doc__ on every proxy delegates to
the wrapped object, and so changed what was reported for the
wrapped function everywhere. The override is handled for instance
methods, class methods and static methods, and propagates through
outer wrapt decorators stacked on top. See the "Docstring
Override" section of Bundled Decorators for details.
- with_signature now accepts a doc argument for overriding the
docstring at the same time as the signature, and the factory
callable may return a tuple of (signature_or_prototype,
docstring) so that a single factory can derive both from the
wrapped function in one pass. When doc is supplied, the docstring
from the tuple is ignored. When neither is given, __doc__
continues to delegate to the wrapped function as before,
including for assignment and deletion.
- A class derived from wrapt.BaseObjectProxy may now define __doc__
as a property, or other descriptor, in its class body, and that
is used for instances of the class in place of the default
delegation of __doc__ to the wrapped object. This works with both
the pure Python implementation and the C extension, and the
descriptor is inherited by further derived classes. Previously
the pure Python metaclass overwrote such a descriptor with the
default delegating property, and the C extension forwarded
__doc__ to the wrapped object before consulting the type, so it
was never used. Only __doc__ is affected, with __module__ always
delegating to the wrapped object. This is the mechanism with_doc
relies on.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Khem Raj
shenlf
Jason Schonberg
Ankur Tyagi
Joel Winarske
Leon Anavi
Alex Kiernan
James Lee
Peter Marko
Poornima Lokesh
Etienne Cordonnier