buildroot/package/libssh2, branch 2019.02-op-build

package/libssh2: security bump to latest git

2019-03-27T21:31:53+00:00

Bump the version to latest git to fix the following security issues: CVE-2019-3855 Possible integer overflow in transport read allows out-of-bounds write URL: https://www.libssh2.org/CVE-2019-3855.html Patch: https://libssh2.org/1.8.0-CVE/CVE-2019-3855.patch CVE-2019-3856 Possible integer overflow in keyboard interactive handling allows out-of-bounds write URL: https://www.libssh2.org/CVE-2019-3856.html Patch: https://libssh2.org/1.8.0-CVE/CVE-2019-3856.patch CVE-2019-3857 Possible integer overflow leading to zero-byte allocation and out-of-bounds write URL: https://www.libssh2.org/CVE-2019-3857.html Patch: https://libssh2.org/1.8.0-CVE/CVE-2019-3857.patch CVE-2019-3858 Possible zero-byte allocation leading to an out-of-bounds read URL: https://www.libssh2.org/CVE-2019-3858.html Patch: https://libssh2.org/1.8.0-CVE/CVE-2019-3858.patch CVE-2019-3859 Out-of-bounds reads with specially crafted payloads due to unchecked use of `_libssh2_packet_require` and `_libssh2_packet_requirev` URL: https://www.libssh2.org/CVE-2019-3859.html Patch: https://libssh2.org/1.8.0-CVE/CVE-2019-3859.patch CVE-2019-3860 Out-of-bounds reads with specially crafted SFTP packets URL: https://www.libssh2.org/CVE-2019-3860.html Patch: https://libssh2.org/1.8.0-CVE/CVE-2019-3860.patch CVE-2019-3861 Out-of-bounds reads with specially crafted SSH packets URL: https://www.libssh2.org/CVE-2019-3861.html Patch: https://libssh2.org/1.8.0-CVE/CVE-2019-3861.patch CVE-2019-3862 Out-of-bounds memory comparison URL: https://www.libssh2.org/CVE-2019-3862.html Patch: https://libssh2.org/1.8.0-CVE/CVE-2019-3862.patch CVE-2019-3863 Integer overflow in user authenicate keyboard interactive allows out-of-bounds writes URL: https://www.libssh2.org/CVE-2019-3863.html Patch: https://libssh2.org/1.8.0-CVE/CVE-2019-3863.txt Drop 0003-openssl-fix-dereferencing-ambiguity-potentially-caus.patch as that is now upstream. Signed-off-by: Peter Korsgaard Signed-off-by: Arnout Vandecappelle (Essensium/Mind) (cherry picked from commit f4f7dd9557cf139f6014ada77e947152d5a82fb3) Signed-off-by: Peter Korsgaard

libssh2: fix static linking scenarios involving mbedtls

2018-11-04T20:28:29+00:00

curl can be statically linked with mbedtls, in this case build will fail on: kex.c:(.text+0x1be0): undefined reference to `mbedtls_mpi_read_binary' This is due to the fact that CURL_LIBRARIES does not contain mbedtls library: CURL_LIBRARIES:INTERNAL=curl;cares;ssh2;ssh2;z;ssl;crypto;z;z;crypto;z;z;ssl;z;z;crypto;z even if libcurl.pc is correct: Libs.private: -lcares -lssh2 -L/home/fabrice/buildroot/output/host/bin/../arm-buildroot-linux-uclibcgnueabi/sysroot/usr/lib -lssh2 /home/fabrice/buildroot/output/host/arm-buildroot-linux-uclibcgnueabi/sysroot/usr/lib/libmbedcrypto.a /home/fabrice/buildroot/output/host/arm-buildroot-linux-uclibcgnueabi/sysroot/usr/lib/libmbedcrypto.a -L/home/fabrice/buildroot/output/host/bin/../arm-buildroot-linux-uclibcgnueabi/sysroot/usr/lib -L/home/fabrice/buildroot/output/host/bin/../arm-buildroot-linux-uclibcgnueabi/sysroot/usr/lib -lz -lssl -lcrypto -lssl -lz -lz -lcrypto -lz -lz This full library path is added by patch 0002-acinclude.m4-add-mbedtls-to-LIBS.patch on libssh2 so update it to replace $LIBMBDEDCRYPTO by -lmbedcrypto Signed-off-by: Fabrice Fontaine Signed-off-by: Thomas Petazzoni

Revert "package/libssh2: fix static linking scenarios involving mbedtls"

2018-11-04T20:28:26+00:00

This reverts commit 48218732a3a7b983825ff3a8cf0767f847ac8d04 because LTLIBMBEDCRYPTO will return "-lmbedcrypto -R/accts/mlweber1/scripts/instance-3/output/host/i586-buildroot-linux-musl/sysroot/usr/lib" On some compilers, -R option won't be recognized and this will prevent the detection of libz: configure:17809: /accts/mlweber1/scripts/instance-3/output/host/bin/i586-linux-gcc -o conftest -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -Os -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -I/accts/mlweber1/scripts/instance-3/output/host/i586-buildroot-linux-musl/sysroot/usr/include conftest.c /accts/mlweber1/scripts/instance-3/output/host/i586-buildroot-linux-musl/sysroot/usr/lib/libz.so -Wl,-rpath -Wl,/accts/mlweber1/scripts/instance-3/output/host/i586-buildroot-linux-musl/sysroot/usr/lib -L/accts/mlweber1/scripts/instance-3/output/host/i586-buildroot-linux-musl/sysroot/usr/lib -lmbedcrypto -R/accts/mlweber1/scripts/instance-3/output/host/i586-buildroot-linux-musl/sysroot/usr/lib >&5 i586-linux-gcc.br_real: error: unrecognized command line option '-R'; did you mean '-R'? Fixes: - http://autobuild.buildroot.org/results/68623f22b49473177c889fe7b12625d779cbd1ed Signed-off-by: Fabrice Fontaine Signed-off-by: Thomas Petazzoni

package/libssh2: fix static linking scenarios involving mbedtls

2018-11-03T21:16:36+00:00

curl can be statically linked with mbedtls, in this case build will fail on: kex.c:(.text+0x1be0): undefined reference to `mbedtls_mpi_read_binary' This is due to the fact that CURL_LIBRARIES does not contain mbedtls library: CURL_LIBRARIES:INTERNAL=curl;cares;ssh2;ssh2;z;ssl;crypto;z;z;crypto;z;z;ssl;z;z;crypto;z even if libcurl.pc is correct: Libs.private: -lcares -lssh2 -L/home/fabrice/buildroot/output/host/bin/../arm-buildroot-linux-uclibcgnueabi/sysroot/usr/lib -lssh2 /home/fabrice/buildroot/output/host/arm-buildroot-linux-uclibcgnueabi/sysroot/usr/lib/libmbedcrypto.a /home/fabrice/buildroot/output/host/arm-buildroot-linux-uclibcgnueabi/sysroot/usr/lib/libmbedcrypto.a -L/home/fabrice/buildroot/output/host/bin/../arm-buildroot-linux-uclibcgnueabi/sysroot/usr/lib -L/home/fabrice/buildroot/output/host/bin/../arm-buildroot-linux-uclibcgnueabi/sysroot/usr/lib -lz -lssl -lcrypto -lssl -lz -lz -lcrypto -lz -lz This full library path is added by patch 0002-acinclude.m4-add-mbedtls-to-LIBS.patch on libssh2 so update it to replace $LIBMBDEDCRYPTO by $LTLIBMBEDCRYPTO as suggested by Thomas during review of https://patchwork.ozlabs.org/patch/989339 Fixes: - http://autobuild.buildroot.org/results/dc7810d5d5c62658837cdd2faae6fe3390f968a2 Signed-off-by: Fabrice Fontaine Signed-off-by: Thomas Petazzoni

package: clean up remaining references to $(HOST_DIR)/usr

2018-09-25T20:22:24+00:00

Signed-off-by: Ferdinand van Aartsen Reviewed-by: "Yann E. MORIN" Signed-off-by: Thomas Petazzoni

libssh2: fix build failure due to pointer dereferencing ambiguity

2018-09-16T14:11:21+00:00

When dereferencing from *aes_ctr_cipher, being a pointer itself, ambiguity can occur with compiler and build can fail reporting: openssl.c:574:20: error: ‘*aes_ctr_cipher’ is a pointer; did you mean to use ‘->’? *aes_ctr_cipher->nid = type; Add a patch to sorround every *aes_ctr_cipher-> occurence with paranthesis like this (*aes_ctr_cipher)-> Fixes: http://autobuild.buildroot.net/results/97c/97c43dd2122f55f3166683aa1b29ce1ca54bcb9c/ http://autobuild.buildroot.net/results/4b7/4b728d275f1399e3cb72d40482076ee54b35852a/ Signed-off-by: Giulio Benetti Signed-off-by: Thomas Petazzoni

package/libssh2: bump version

2018-09-12T08:30:18+00:00

Added license hash. This bump includes "ECDSA key types are now explicit" https://github.com/libssh2/libssh2/commit/62b825c8afb9e5efb6ea9c05b40b309590249fb6 which is needed by vlc since http://git.videolan.org/?p=vlc.git;a=commitdiff;h=afee1e72a8e08866bbe35d1a57e859cac81052b4 Fixes http://autobuild.buildroot.net/results/579/579e2418e59680ad4bf3dc85f2918457b6221bfa/ http://autobuild.buildroot.net/results/c73/c7348c442d3f585ace0bc62860f802dc08150776/ http://autobuild.buildroot.net/results/731/73187b883d7fe14b08a4903b326706c9d1f8b519/ http://autobuild.buildroot.net/results/f6d/f6d4fca6063c81a8e240fed4db89269e455f057e/ http://autobuild.buildroot.net/results/371/371f4f017f4a5af0ac6d6a8b1b8276858ad47f75/ http://autobuild.buildroot.net/results/d6a/d6a3b43211eb740bdebbb339668b854d26e878b7/ http://autobuild.buildroot.net/results/a05/a0576aeeb57a49958e5229d9ec08f2bd792d48b6/ http://autobuild.buildroot.net/results/57a/57a9ae2f157183a86fbf1b2cc5cbb38e948690ce/ Signed-off-by: Bernd Kuhls Signed-off-by: Thomas Petazzoni

libssh2: fix pkg-config info for mbedtls backend

2018-03-24T20:39:49+00:00

The libssh2.pc file did not contain the needed info for static link with libssh2. Add a patch fixing that. Fixes (qemu): http://autobuild.buildroot.net/results/634/6346b25be2844f9ef722e52040ac1b43d9c38899/ Cc: Matt Weber Signed-off-by: Baruch Siach Signed-off-by: Peter Korsgaard

libssh2: add host variant

2018-02-05T13:57:47+00:00

Allow build of host variant of libssh2, which depends on host-openssl. Signed-off-by: Eric Le Bihan Signed-off-by: Peter Korsgaard

libssh2: revert to previous crypto defaults

2017-11-06T17:43:54+00:00

The recent crypto handling change (commit 04a1031d3: package/libssh2: Add selectable crypto libraries) had the unfortunate side effect that it no longer automatically selects the most suitable crypto backend (E.G. one where the dependency is already enabled), so all users not wanting to use the mbedtls backend need to explicitly configure this. Fix this by inverting the logic so the crypto backend sub options use 'depends on' their dependencies instead of 'select', so only the available backends are displayed. Like before, default to openssl if no crypto backend dependencies are currently enabled. Signed-off-by: Peter Korsgaard