buildroot/package/openssh, branch 2017.05

openssh: add support for HW SSL engines

2017-05-03T21:07:57+00:00

Enable support for OpenSSH to use a hardware SSL engine if cryptodev-linux is included. Without this, OpenSSH uses only OpenSSL software crypto implementation. Signed-off-by: Gilad Ben-Yossef CC: Baruch Siach CC: Arnout Vandecappelle Reviewed-by: Arnout Vandecappelle (Essensium/Mind) Signed-off-by: Peter Korsgaard

boot, package: use SPDX short identifier for BSD-2c

2017-04-01T13:27:05+00:00

We want to use SPDX identifier for license string as much as possible. SPDX short identifier for BSD-2c is BSD-2-Clause. This change is done using following command. find . -name "*.mk" | xargs sed -ri '/LICENSE( )?[\+:]?=/s/BSD-2c/BSD-2-Clause/g' Signed-off-by: Rahul Bedarkar Signed-off-by: Thomas Petazzoni

boot, package: use SPDX short identifier for BSD-3c

2017-04-01T13:26:57+00:00

We want to use SPDX identifier for license string as much as possible. SPDX short identifier for BSD-3c is BSD-3-Clause. This change is done using following command. find . -name "*.mk" | xargs sed -ri '/LICENSE( )?[\+:]?=/s/BSD-3c/BSD-3-Clause/g' Signed-off-by: Rahul Bedarkar Signed-off-by: Thomas Petazzoni

openssh: security bump to version 7.5

2017-03-21T16:26:45+00:00

From the release notes (https://www.openssh.com/txt/release-7.5): Security -------- * ssh(1), sshd(8): Fix weakness in CBC padding oracle countermeasures that allowed a variant of the attack fixed in OpenSSH 7.3 to proceed. Note that the OpenSSH client disables CBC ciphers by default, sshd offers them as lowest-preference options and will remove them by default entriely in the next release. Reported by Jean Paul Degabriele, Kenny Paterson, Martin Albrecht and Torben Hansen of Royal Holloway, University of London. * sftp-client(1): [portable OpenSSH only] On Cygwin, a client making a recursive file transfer could be maniuplated by a hostile server to perform a path-traversal attack. creating or modifying files outside of the intended target directory. Reported by Jann Horn of Google Project Zero. [Peter: mention security fixes] Signed-off-by: Baruch Siach Signed-off-by: Peter Korsgaard

openssh: Move key generation to the start function of init script.

2017-02-26T13:37:54+00:00

Since there's not much point in generating missing host keys when the init script is called with "stop", the call to ssh-keygen should not be done inconditionally, but in the start function instead. Signed-off-by: Ignacy Gawędzki Acked-by: "Yann E. MORIN" Signed-off-by: Thomas Petazzoni

packages: improve license type lists

2017-02-20T21:16:01+00:00

Make license type lists more uniform: * put content license applies to in parenthesis; ex: "GPLv2+ (programs)" * use commas to separate types listed without conjuction; ex: "GPLv2, LGPLv2" No attempt was made to validate the claimed licenses. This is just a tweak to increase uniformity of the _LICENSE variables. Signed-off-by: Danomi Manchego Reviewed-by: Thomas Petazzoni [Thomas: replace semi-colons by commas in LIBURCU_LICENSE.] Signed-off-by: Thomas Petazzoni

openssh: security bump to version 7.4p1

2016-12-19T19:53:24+00:00

Fixes: CVE-2016-10009 - ssh-agent(1): Will now refuse to load PKCS#11 modules from paths outside a trusted whitelist CVE-2016-10010 - sshd(8): When privilege separation is disabled, forwarded Unix-domain sockets would be created by sshd(8) with the privileges of 'root' CVE-2016-10011 - sshd(8): Avoid theoretical leak of host private key material to privilege-separated child processes via realloc() CVE-2016-10012 - sshd(8): The shared memory manager used by pre-authentication compression support had a bounds checks that could be elided by some optimising compilers http://seclists.org/oss-sec/2016/q4/708 Drop upstream patch. Signed-off-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard

openssh: add upstream security fix

2016-11-15T11:58:20+00:00

Fixes CVE-2016-8858: Memory exhaustion, up to 128MB, of unauthenticated peer. Signed-off-by: Baruch Siach Signed-off-by: Thomas Petazzoni

openssh: bump version to 7.3p1

2016-08-01T20:11:31+00:00

Signed-off-by: Vicente Olivert Riera Signed-off-by: Thomas Petazzoni

toolchain: add hidden symbol for PIE support

2016-07-24T19:44:22+00:00

uClibc-ng does not support PIE for some architectures as arc and m68k. It isn't implemented in the static linking case, too. With musl toolchains you might have static PIE support with little patching of gcc. Static linking for GNU libc isn't enabled in buildroot. Fixup any package using special treatment of PIE. (grep -ir pie package/*/*.mk) Signed-off-by: Waldemar Brodkorb [Thomas: use positive logic.] Signed-off-by: Thomas Petazzoni