From patchwork Wed Apr 17 20:35:25 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 42635 X-Patchwork-Delegate: steve@sakoman.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id AE32EC05023 for ; Wed, 17 Apr 2024 20:35:45 +0000 (UTC) Received: from mail-pj1-f45.google.com (mail-pj1-f45.google.com [209.85.216.45]) by mx.groups.io with SMTP id smtpd.web11.24877.1713386141660234150 for ; Wed, 17 Apr 2024 13:35:41 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20230601.gappssmtp.com header.s=20230601 header.b=0MwSY4+3; spf=softfail (domain: sakoman.com, ip: 209.85.216.45, mailfrom: steve@sakoman.com) Received: by mail-pj1-f45.google.com with SMTP id 98e67ed59e1d1-2a6fa7773d3so164829a91.3 for ; Wed, 17 Apr 2024 13:35:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20230601.gappssmtp.com; s=20230601; t=1713386141; x=1713990941; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=JvQICCdPZc+elFCBcchGpoSoJWGUO03JHXIM4yeJojA=; b=0MwSY4+3sTwgwVg4mDdgkj3htrAiJzM5jBbPqCbDrtUF7Vw47fh60rpHofIYon1dui wJtrTl4oBt2ntzsz8du+PV9/nVjNvx27c6YhSEcx592IwwbZoxxh5CASKb8ypQMPG/kK j13pvm2j9DFUFeU9X6Spwqif2ae808SXnhIrChxgmX48u0Py76y+YbiVEdV7ZheOcVl7 9OXgGR6hS/hNurgxhr2TxLEWq6hayVN8ky8PU57qTjTwasn4JX1tXPqmyZk/m2WzHi+V CbAcnuHnFKqrG5CjwZMhf2fNXS1s7lRQkX2W0/DYwhT711Xm0asVPV6jC+9z231Mkh0E PIMg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1713386141; x=1713990941; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=JvQICCdPZc+elFCBcchGpoSoJWGUO03JHXIM4yeJojA=; b=vkI84EF+iAbLgmgdW9sijl+xJEgjvmEn8uYxEov5QSmzOoeJptf85h0xZcjZY9tNTb 6wOkU1FaxN9K5TNdfexYsT5o/9MNEKT0h4wXyvTPDuP7u3oCNQiuO+yww1KoYCoVAsEJ hxsVDQ44ljB9vMoFTnWFK81kkw/kRzp8ik2OTvS9PsGzc25/DAhNQyhGkDW8Wcrvs/WL Sj1jssFlq7w1a7Y7S4l7hx6Q6NZpAIZtD6iv2WDN/HDV6K76AH4FLkWQgByQH6d0hWo+ 1PhL8qONPQ7aA5KvMYYhMA3coeVYuLLql9H6VFBi0LYbUxr54za3jaIfDooiW6aj2mQV oxWg== X-Gm-Message-State: AOJu0YziXUrlDwleZVVvONthAsGfMDFOO2Naqb6HA3VqMZnLU+DJJ0VF yzSgs90vhqLArL1O3+IoyJyjlVDRd9YgPpJvnewTs5F78y/E69++noCBKCv5AaqDilRrS9G56u/ a9CE= X-Google-Smtp-Source: AGHT+IEkh1HfGOFIf8SROwgi1VWhwzwJU9qNlMYHwqgNF/syTmtxBEThaW239rptP0RZllhFdkKi6Q== X-Received: by 2002:a17:90a:3d4a:b0:2a5:fff9:686e with SMTP id o10-20020a17090a3d4a00b002a5fff9686emr543350pjf.16.1713386140635; Wed, 17 Apr 2024 13:35:40 -0700 (PDT) Received: from xps13.. ([199.58.97.236]) by smtp.gmail.com with ESMTPSA id s22-20020a17090aa11600b002ab664e5e17sm76876pjp.1.2024.04.17.13.35.39 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 17 Apr 2024 13:35:40 -0700 (PDT) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 1/7] libssh2: fix CVE-2023-48795 Date: Wed, 17 Apr 2024 13:35:25 -0700 Message-Id: X-Mailer: git-send-email 2.34.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 17 Apr 2024 20:35:45 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/198478 From: Meenali Gupta References: https://nvd.nist.gov/vuln/detail/CVE-2023-48795 Signed-off-by: Meenali Gupta Signed-off-by: Steve Sakoman --- .../libssh2/libssh2/CVE-2023-48795.patch | 459 ++++++++++++++++++ .../recipes-support/libssh2/libssh2_1.10.0.bb | 1 + 2 files changed, 460 insertions(+) create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2023-48795.patch diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2023-48795.patch b/meta/recipes-support/libssh2/libssh2/CVE-2023-48795.patch new file mode 100644 index 0000000000..c7a228217f --- /dev/null +++ b/meta/recipes-support/libssh2/libssh2/CVE-2023-48795.patch @@ -0,0 +1,459 @@ +From d34d9258b8420b19ec3f97b4cc5bf7aa7d98e35a Mon Sep 17 00:00:00 2001 +From: Michael Buckley +Date: Thu, 30 Nov 2023 15:08:02 -0800 +Subject: [PATCH] src: add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack" + +Refs: +https://terrapin-attack.com/ https://seclists.org/oss-sec/2023/q4/292 +https://osv.dev/list?ecosystem=&q=CVE-2023-48795 GHSA-45x7-px36-x8w8 +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-48795 + +Fixes #1290 +Closes #1291 + +CVE: CVE-2023-48795 +Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/d34d9258b8420b19ec3f97b4cc5bf7aa7d98e35a] + +Signed-off-by: Meenali Gupta +--- + src/kex.c | 64 +++++++++++++++++++++------------- + src/libssh2_priv.h | 18 +++++++--- + src/packet.c | 85 +++++++++++++++++++++++++++++++++++++++++++--- + src/packet.h | 2 +- + src/session.c | 3 ++ + src/transport.c | 12 ++++++- + 6 files changed, 150 insertions(+), 34 deletions(-) + +diff --git a/src/kex.c b/src/kex.c +index 9f3ef79..e040dcd 100644 +--- a/src/kex.c ++++ b/src/kex.c +@@ -3026,6 +3026,13 @@ kex_method_ssh_curve25519_sha256 = { + }; + #endif + ++static const LIBSSH2_KEX_METHOD ++kex_method_strict_client_extension = { ++ "kex-strict-c-v00@openssh.com", ++ NULL, ++ 0, ++}; ++ + static const LIBSSH2_KEX_METHOD *libssh2_kex_methods[] = { + #if LIBSSH2_ED25519 + &kex_method_ssh_curve25519_sha256, +@@ -3043,6 +3050,7 @@ static const LIBSSH2_KEX_METHOD *libssh2_kex_methods[] = { + &kex_method_diffie_helman_group14_sha1, + &kex_method_diffie_helman_group1_sha1, + &kex_method_diffie_helman_group_exchange_sha1, ++ &kex_method_strict_client_extension, + NULL + }; + +@@ -3281,13 +3289,13 @@ static int kexinit(LIBSSH2_SESSION * session) + return 0; + } + +-/* kex_agree_instr ++/* _libssh2_kex_agree_instr + * Kex specific variant of strstr() + * Needle must be precede by BOL or ',', and followed by ',' or EOL + */ +-static unsigned char * +-kex_agree_instr(unsigned char *haystack, unsigned long haystack_len, +- const unsigned char *needle, unsigned long needle_len) ++unsigned char * ++_libssh2_kex_agree_instr(unsigned char *haystack, size_t haystack_len, ++ const unsigned char *needle, size_t needle_len) + { + unsigned char *s; + unsigned char *end_haystack; +@@ -3371,7 +3379,7 @@ static int kex_agree_hostkey(LIBSSH2_SESSION * session, + while(s && *s) { + unsigned char *p = (unsigned char *) strchr((char *) s, ','); + size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s)); +- if(kex_agree_instr(hostkey, hostkey_len, s, method_len)) { ++ if(_libssh2_kex_agree_instr(hostkey, hostkey_len, s, method_len)) { + const LIBSSH2_HOSTKEY_METHOD *method = + (const LIBSSH2_HOSTKEY_METHOD *) + kex_get_method_by_name((char *) s, method_len, +@@ -3405,9 +3413,9 @@ static int kex_agree_hostkey(LIBSSH2_SESSION * session, + } + + while(hostkeyp && (*hostkeyp) && (*hostkeyp)->name) { +- s = kex_agree_instr(hostkey, hostkey_len, +- (unsigned char *) (*hostkeyp)->name, +- strlen((*hostkeyp)->name)); ++ s = _libssh2_kex_agree_instr(hostkey, hostkey_len, ++ (unsigned char *) (*hostkeyp)->name, ++ strlen((*hostkeyp)->name)); + if(s) { + /* So far so good, but does it suit our purposes? (Encrypting vs + Signing) */ +@@ -3442,13 +3450,19 @@ static int kex_agree_kex_hostkey(LIBSSH2_SESSION * session, unsigned char *kex, + const LIBSSH2_KEX_METHOD **kexp = libssh2_kex_methods; + unsigned char *s; + ++ const unsigned char *strict = ++ (unsigned char *)"kex-strict-s-v00@openssh.com"; ++ ++ if(_libssh2_kex_agree_instr(kex, kex_len, strict, 28)) { ++ session->kex_strict = 1; ++ } + if(session->kex_prefs) { + s = (unsigned char *) session->kex_prefs; + + while(s && *s) { + unsigned char *q, *p = (unsigned char *) strchr((char *) s, ','); + size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s)); +- q = kex_agree_instr(kex, kex_len, s, method_len); ++ q = _libssh2_kex_agree_instr(kex, kex_len, s, method_len); + if(q) { + const LIBSSH2_KEX_METHOD *method = (const LIBSSH2_KEX_METHOD *) + kex_get_method_by_name((char *) s, method_len, +@@ -3482,9 +3496,9 @@ static int kex_agree_kex_hostkey(LIBSSH2_SESSION * session, unsigned char *kex, + } + + while(*kexp && (*kexp)->name) { +- s = kex_agree_instr(kex, kex_len, +- (unsigned char *) (*kexp)->name, +- strlen((*kexp)->name)); ++ s = _libssh2_kex_agree_instr(kex, kex_len, ++ (unsigned char *) (*kexp)->name, ++ strlen((*kexp)->name)); + if(s) { + /* We've agreed on a key exchange method, + * Can we agree on a hostkey that works with this kex? +@@ -3528,7 +3542,7 @@ static int kex_agree_crypt(LIBSSH2_SESSION * session, + unsigned char *p = (unsigned char *) strchr((char *) s, ','); + size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s)); + +- if(kex_agree_instr(crypt, crypt_len, s, method_len)) { ++ if(_libssh2_kex_agree_instr(crypt, crypt_len, s, method_len)) { + const LIBSSH2_CRYPT_METHOD *method = + (const LIBSSH2_CRYPT_METHOD *) + kex_get_method_by_name((char *) s, method_len, +@@ -3550,9 +3564,9 @@ static int kex_agree_crypt(LIBSSH2_SESSION * session, + } + + while(*cryptp && (*cryptp)->name) { +- s = kex_agree_instr(crypt, crypt_len, +- (unsigned char *) (*cryptp)->name, +- strlen((*cryptp)->name)); ++ s = _libssh2_kex_agree_instr(crypt, crypt_len, ++ (unsigned char *) (*cryptp)->name, ++ strlen((*cryptp)->name)); + if(s) { + endpoint->crypt = *cryptp; + return 0; +@@ -3583,7 +3597,7 @@ static int kex_agree_mac(LIBSSH2_SESSION * session, + unsigned char *p = (unsigned char *) strchr((char *) s, ','); + size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s)); + +- if(kex_agree_instr(mac, mac_len, s, method_len)) { ++ if(_libssh2_kex_agree_instr(mac, mac_len, s, method_len)) { + const LIBSSH2_MAC_METHOD *method = (const LIBSSH2_MAC_METHOD *) + kex_get_method_by_name((char *) s, method_len, + (const LIBSSH2_COMMON_METHOD **) +@@ -3604,8 +3618,9 @@ static int kex_agree_mac(LIBSSH2_SESSION * session, + } + + while(*macp && (*macp)->name) { +- s = kex_agree_instr(mac, mac_len, (unsigned char *) (*macp)->name, +- strlen((*macp)->name)); ++ s = _libssh2_kex_agree_instr(mac, mac_len, ++ (unsigned char *) (*macp)->name, ++ strlen((*macp)->name)); + if(s) { + endpoint->mac = *macp; + return 0; +@@ -3636,7 +3651,7 @@ static int kex_agree_comp(LIBSSH2_SESSION *session, + unsigned char *p = (unsigned char *) strchr((char *) s, ','); + size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s)); + +- if(kex_agree_instr(comp, comp_len, s, method_len)) { ++ if(_libssh2_kex_agree_instr(comp, comp_len, s, method_len)) { + const LIBSSH2_COMP_METHOD *method = + (const LIBSSH2_COMP_METHOD *) + kex_get_method_by_name((char *) s, method_len, +@@ -3658,8 +3673,9 @@ static int kex_agree_comp(LIBSSH2_SESSION *session, + } + + while(*compp && (*compp)->name) { +- s = kex_agree_instr(comp, comp_len, (unsigned char *) (*compp)->name, +- strlen((*compp)->name)); ++ s = _libssh2_kex_agree_instr(comp, comp_len, ++ (unsigned char *) (*compp)->name, ++ strlen((*compp)->name)); + if(s) { + endpoint->comp = *compp; + return 0; +@@ -3856,7 +3872,8 @@ _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange, + session->local.kexinit = key_state->oldlocal; + session->local.kexinit_len = key_state->oldlocal_len; + key_state->state = libssh2_NB_state_idle; +- session->state &= ~LIBSSH2_STATE_KEX_ACTIVE; ++ session->state &= ~LIBSSH2_STATE_INITIAL_KEX; ++ session->state &= ~LIBSSH2_STATE_KEX_ACTIVE; + session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS; + return -1; + } +@@ -3904,6 +3921,7 @@ _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange, + session->remote.kexinit = NULL; + } + ++ session->state &= ~LIBSSH2_STATE_INITIAL_KEX; + session->state &= ~LIBSSH2_STATE_KEX_ACTIVE; + session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS; + +diff --git a/src/libssh2_priv.h b/src/libssh2_priv.h +index da488b7..7faeab6 100644 +--- a/src/libssh2_priv.h ++++ b/src/libssh2_priv.h +@@ -640,6 +640,9 @@ struct _LIBSSH2_SESSION + unsigned char server_hostkey_sha256[SHA256_DIGEST_LENGTH]; + int server_hostkey_sha256_valid; + ++ /* Whether to use the OpenSSH Strict KEX extension */ ++ int kex_strict; ++ + /* (remote as source of data -- packet_read ) */ + libssh2_endpoint_data remote; + +@@ -809,6 +812,7 @@ struct _LIBSSH2_SESSION + int fullpacket_macstate; + size_t fullpacket_payload_len; + int fullpacket_packet_type; ++ uint32_t fullpacket_required_type; + + /* State variables used in libssh2_sftp_init() */ + libssh2_nonblocking_states sftpInit_state; +@@ -856,10 +860,11 @@ struct _LIBSSH2_SESSION + }; + + /* session.state bits */ +-#define LIBSSH2_STATE_EXCHANGING_KEYS 0x00000001 +-#define LIBSSH2_STATE_NEWKEYS 0x00000002 +-#define LIBSSH2_STATE_AUTHENTICATED 0x00000004 +-#define LIBSSH2_STATE_KEX_ACTIVE 0x00000008 ++#define LIBSSH2_STATE_INITIAL_KEX 0x00000001 ++#define LIBSSH2_STATE_EXCHANGING_KEYS 0x00000002 ++#define LIBSSH2_STATE_NEWKEYS 0x00000004 ++#define LIBSSH2_STATE_AUTHENTICATED 0x00000008 ++#define LIBSSH2_STATE_KEX_ACTIVE 0x00000010 + + /* session.flag helpers */ + #ifdef MSG_NOSIGNAL +@@ -1076,6 +1081,11 @@ ssize_t _libssh2_send(libssh2_socket_t socket, const void *buffer, + int _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange, + key_exchange_state_t * state); + ++unsigned char *_libssh2_kex_agree_instr(unsigned char *haystack, ++ size_t haystack_len, ++ const unsigned char *needle, ++ size_t needle_len); ++ + /* Let crypt.c/hostkey.c expose their method structs */ + const LIBSSH2_CRYPT_METHOD **libssh2_crypt_methods(void); + const LIBSSH2_HOSTKEY_METHOD **libssh2_hostkey_methods(void); +diff --git a/src/packet.c b/src/packet.c +index 04937d6..786ba40 100644 +--- a/src/packet.c ++++ b/src/packet.c +@@ -467,14 +467,13 @@ packet_x11_open(LIBSSH2_SESSION * session, unsigned char *data, + * layer when it has received a packet. + * + * The input pointer 'data' is pointing to allocated data that this function +- * is asked to deal with so on failure OR success, it must be freed fine. +- * The only exception is when the return code is LIBSSH2_ERROR_EAGAIN. ++ * will be freed unless return the code is LIBSSH2_ERROR_EAGAIN. + * + * This function will always be called with 'datalen' greater than zero. + */ + int + _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data, +- size_t datalen, int macstate) ++ size_t datalen, int macstate, uint32_t seq) + { + int rc = 0; + unsigned char *message = NULL; +@@ -517,6 +516,70 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data, + break; + } + ++ if(session->state & LIBSSH2_STATE_INITIAL_KEX) { ++ if(msg == SSH_MSG_KEXINIT) { ++ if(!session->kex_strict) { ++ if(datalen < 17) { ++ LIBSSH2_FREE(session, data); ++ session->packAdd_state = libssh2_NB_state_idle; ++ return _libssh2_error(session, ++ LIBSSH2_ERROR_BUFFER_TOO_SMALL, ++ "Data too short extracting kex"); ++ } ++ else { ++ const unsigned char *strict = ++ (unsigned char *)"kex-strict-s-v00@openssh.com"; ++ struct string_buf buf; ++ unsigned char *algs = NULL; ++ size_t algs_len = 0; ++ ++ buf.data = (unsigned char *)data; ++ buf.dataptr = buf.data; ++ buf.len = datalen; ++ buf.dataptr += 17; /* advance past type and cookie */ ++ ++ if(_libssh2_get_string(&buf, &algs, &algs_len)) { ++ LIBSSH2_FREE(session, data); ++ session->packAdd_state = libssh2_NB_state_idle; ++ return _libssh2_error(session, ++ LIBSSH2_ERROR_BUFFER_TOO_SMALL, ++ "Algs too short"); ++ } ++ ++ if(algs_len == 0 || ++ _libssh2_kex_agree_instr(algs, algs_len, strict, 28)) { ++ session->kex_strict = 1; ++ } ++ } ++ } ++ ++ if(session->kex_strict && seq) { ++ LIBSSH2_FREE(session, data); ++ session->socket_state = LIBSSH2_SOCKET_DISCONNECTED; ++ session->packAdd_state = libssh2_NB_state_idle; ++ libssh2_session_disconnect(session, "strict KEX violation: " ++ "KEXINIT was not the first packet"); ++ ++ return _libssh2_error(session, LIBSSH2_ERROR_SOCKET_DISCONNECT, ++ "strict KEX violation: " ++ "KEXINIT was not the first packet"); ++ } ++ } ++ ++ if(session->kex_strict && session->fullpacket_required_type && ++ session->fullpacket_required_type != msg) { ++ LIBSSH2_FREE(session, data); ++ session->socket_state = LIBSSH2_SOCKET_DISCONNECTED; ++ session->packAdd_state = libssh2_NB_state_idle; ++ libssh2_session_disconnect(session, "strict KEX violation: " ++ "unexpected packet type"); ++ ++ return _libssh2_error(session, LIBSSH2_ERROR_SOCKET_DISCONNECT, ++ "strict KEX violation: " ++ "unexpected packet type"); ++ } ++ } ++ + if(session->packAdd_state == libssh2_NB_state_allocated) { + /* A couple exceptions to the packet adding rule: */ + switch(msg) { +@@ -1118,7 +1181,16 @@ _libssh2_packet_ask(LIBSSH2_SESSION * session, unsigned char packet_type, + + return 0; + } +- packet = _libssh2_list_next(&packet->node); ++ else if(session->kex_strict && ++ (session->state & LIBSSH2_STATE_INITIAL_KEX)) { ++ libssh2_session_disconnect(session, "strict KEX violation: " ++ "unexpected packet type"); ++ ++ return _libssh2_error(session, LIBSSH2_ERROR_SOCKET_DISCONNECT, ++ "strict KEX violation: " ++ "unexpected packet type"); ++ } ++ packet = _libssh2_list_next(&packet->node); + } + return -1; + } +@@ -1179,7 +1251,10 @@ _libssh2_packet_require(LIBSSH2_SESSION * session, unsigned char packet_type, + } + + while(session->socket_state == LIBSSH2_SOCKET_CONNECTED) { +- int ret = _libssh2_transport_read(session); ++ int ret; ++ session->fullpacket_required_type = packet_type; ++ ret = _libssh2_transport_read(session); ++ session->fullpacket_required_type = 0; + if(ret == LIBSSH2_ERROR_EAGAIN) + return ret; + else if(ret < 0) { +diff --git a/src/packet.h b/src/packet.h +index 79018bc..08ea2a2 100644 +--- a/src/packet.h ++++ b/src/packet.h +@@ -71,6 +71,6 @@ int _libssh2_packet_burn(LIBSSH2_SESSION * session, + int _libssh2_packet_write(LIBSSH2_SESSION * session, unsigned char *data, + unsigned long data_len); + int _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data, +- size_t datalen, int macstate); ++ size_t datalen, int macstate, uint32_t seq); + + #endif /* __LIBSSH2_PACKET_H */ +diff --git a/src/session.c b/src/session.c +index 212560b..019b9ed 100644 +--- a/src/session.c ++++ b/src/session.c +@@ -500,6 +500,8 @@ libssh2_session_init_ex(LIBSSH2_ALLOC_FUNC((*my_alloc)), + session->abstract = abstract; + session->api_timeout = 0; /* timeout-free API by default */ + session->api_block_mode = 1; /* blocking API by default */ ++ session->state = LIBSSH2_STATE_INITIAL_KEX; ++ session->fullpacket_required_type = 0; + _libssh2_debug(session, LIBSSH2_TRACE_TRANS, + "New session resource allocated"); + _libssh2_init_if_needed(); +@@ -1171,6 +1173,7 @@ libssh2_session_disconnect_ex(LIBSSH2_SESSION *session, int reason, + const char *desc, const char *lang) + { + int rc; ++ session->state &= ~LIBSSH2_STATE_INITIAL_KEX; + session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS; + BLOCK_ADJUST(rc, session, + session_disconnect(session, reason, desc, lang)); +diff --git a/src/transport.c b/src/transport.c +index 1074fc2..6823b63 100644 +--- a/src/transport.c ++++ b/src/transport.c +@@ -168,6 +168,7 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ ) + struct transportpacket *p = &session->packet; + int rc; + int compressed; ++ uint32_t seq = session->remote.seqno; + + if(session->fullpacket_state == libssh2_NB_state_idle) { + session->fullpacket_macstate = LIBSSH2_MAC_CONFIRMED; +@@ -240,7 +241,7 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ ) + if(session->fullpacket_state == libssh2_NB_state_created) { + rc = _libssh2_packet_add(session, p->payload, + session->fullpacket_payload_len, +- session->fullpacket_macstate); ++ session->fullpacket_macstate, seq); + if(rc == LIBSSH2_ERROR_EAGAIN) + return rc; + if(rc) { +@@ -251,6 +252,11 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ ) + + session->fullpacket_state = libssh2_NB_state_idle; + ++ if(session->kex_strict && ++ session->fullpacket_packet_type == SSH_MSG_NEWKEYS) { ++ session->remote.seqno = 0; ++ } ++ + return session->fullpacket_packet_type; + } + +@@ -892,6 +898,10 @@ int _libssh2_transport_send(LIBSSH2_SESSION *session, + + session->local.seqno++; + ++ if(session->kex_strict && data[0] == SSH_MSG_NEWKEYS) { ++ session->local.seqno = 0; ++ } ++ + ret = LIBSSH2_SEND(session, p->outbuf, total_length, + LIBSSH2_SOCKET_SEND_FLAGS(session)); + if(ret < 0) +-- +2.40.0 diff --git a/meta/recipes-support/libssh2/libssh2_1.10.0.bb b/meta/recipes-support/libssh2/libssh2_1.10.0.bb index 8483a292c2..8fd77996d5 100644 --- a/meta/recipes-support/libssh2/libssh2_1.10.0.bb +++ b/meta/recipes-support/libssh2/libssh2_1.10.0.bb @@ -11,6 +11,7 @@ SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \ file://fix-ssh2-test.patch \ file://run-ptest \ file://CVE-2020-22218.patch \ + file://CVE-2023-48795.patch \ " SRC_URI[sha256sum] = "2d64e90f3ded394b91d3a2e774ca203a4179f69aebee03003e5a6fa621e41d51" From patchwork Wed Apr 17 20:35:26 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 42633 X-Patchwork-Delegate: steve@sakoman.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id BB7B6C05052 for ; Wed, 17 Apr 2024 20:35:45 +0000 (UTC) Received: from mail-pf1-f169.google.com (mail-pf1-f169.google.com [209.85.210.169]) by mx.groups.io with SMTP id smtpd.web11.24878.1713386143054857090 for ; Wed, 17 Apr 2024 13:35:43 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20230601.gappssmtp.com header.s=20230601 header.b=1QjMqs/f; spf=softfail (domain: sakoman.com, ip: 209.85.210.169, mailfrom: steve@sakoman.com) Received: by mail-pf1-f169.google.com with SMTP id d2e1a72fcca58-6ed20fb620fso202600b3a.2 for ; Wed, 17 Apr 2024 13:35:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20230601.gappssmtp.com; s=20230601; t=1713386142; x=1713990942; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=kaiRWK9LDqa8ScUMBDrZkElUjAEd06Em8TeJAbfNCMc=; b=1QjMqs/f8L8oDewzCLH3a/sM3bkVk/0jgBB+mBQlf5+k8mdIWNCelI5UYMlPd2Bcuj MEvJgR6WfC3P+1/0rvXhh4psW0vs6zce9Tx9XtNizKdGZ3bxTvCvme1kV4Ij+WgAiWvb YTtrt9u155itPivXE5nmoP5tfkqbx3M02gyzqU/X4KSIHU8tODi0N4fKP4PCTFivjttF YuUAADczJ1spf2CFq0cCqHb/OLjJB6MuIn0d2W+ESJA7XcZ5YEpvZVbHMeyfR2H35yGz T308kDmMmkjPPJb5MhySUnECUUziRaDDeSSmdDnaqAMI4r0UGQIySgx6pJBtuefOtWiB R5fg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1713386142; x=1713990942; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=kaiRWK9LDqa8ScUMBDrZkElUjAEd06Em8TeJAbfNCMc=; b=XA4UEIuKgUBv4Zw9eXwZqmh0bzUCl9Bsc59s2QgqTSv+3Ou/MZkCcLocgYZuJwVlIB eaJbKArrW0cUIPZb0IUSvPM+7tKhxs5suL85fr3QcR1sHpHMJWC4J6kXnm2R9lYzPYVV D7lhlgJULjv258aKyeN4xIUj+hQyDOwHWZFF08tkRWXo37sgwnIDYDCqZ+QyrK1AY7l5 JN+rOJg3VgQd5Cnql4zruhorpMt+TDvRMCJZPVrKLSyGQgQY3YhAxk5BrLgj/xnznGGL zD4kNpZj6/PZbhygmRMQYEZj/rBQqAfCRymFvn2ctQpgrunh8wKJk/zKBbn2m/w7h5z7 qYmA== X-Gm-Message-State: AOJu0YwsG5Ea/vCnQ/FH3Iqi+J8JRX61RNpbLFFSTEnAeXyzsw3/wQU2 IfhplYIv2vDApK++jruHUupj2zo/XtwxssrfgeCvSEC5OGBhDsz1/6ElqtDmLIryheYn5eILM/z 3dTg= X-Google-Smtp-Source: AGHT+IFDoECwi1PcQC2du/9quTTyMMcnG9+YN/qWfL7gjAgFkWz4Is2NcAoU4GYAYbv1kGN8cKBZfQ== X-Received: by 2002:a17:90a:db93:b0:2ab:afb8:e44c with SMTP id h19-20020a17090adb9300b002abafb8e44cmr527838pjv.20.1713386142228; Wed, 17 Apr 2024 13:35:42 -0700 (PDT) Received: from xps13.. ([199.58.97.236]) by smtp.gmail.com with ESMTPSA id s22-20020a17090aa11600b002ab664e5e17sm76876pjp.1.2024.04.17.13.35.41 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 17 Apr 2024 13:35:41 -0700 (PDT) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 2/7] ruby: fix CVE-2024-27281 Date: Wed, 17 Apr 2024 13:35:26 -0700 Message-Id: X-Mailer: git-send-email 2.34.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 17 Apr 2024 20:35:45 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/198479 From: Yogita Urade ruby: RCE vulnerability with .rdoc_options in RDoc References: https://github.com/ruby/ruby/pull/10316 https://security-tracker.debian.org/tracker/CVE-2024-27281 Signed-off-by: Yogita Urade Signed-off-by: Steve Sakoman --- .../ruby/ruby/CVE-2024-27281.patch | 97 +++++++++++++++++++ meta/recipes-devtools/ruby/ruby_3.1.3.bb | 1 + 2 files changed, 98 insertions(+) create mode 100644 meta/recipes-devtools/ruby/ruby/CVE-2024-27281.patch diff --git a/meta/recipes-devtools/ruby/ruby/CVE-2024-27281.patch b/meta/recipes-devtools/ruby/ruby/CVE-2024-27281.patch new file mode 100644 index 0000000000..6f4b35a786 --- /dev/null +++ b/meta/recipes-devtools/ruby/ruby/CVE-2024-27281.patch @@ -0,0 +1,97 @@ +From da7a0c7553ef7250ca665a3fecdc01dbaacbb43d Mon Sep 17 00:00:00 2001 +From: Nobuyoshi Nakada +Date: Mon, 15 Apr 2024 11:40:00 +0000 +Subject: [PATCH] Filter marshaled objets + +CVE: CVE-2024-27281 +Upstream-Status: Backport [https://github.com/ruby/rdoc/commit/da7a0c7553ef7250ca665a3fecdc01dbaacbb43d] + +Signed-off-by: Yogita Urade +--- + lib/rdoc/store.rb | 45 ++++++++++++++++++++++++++------------------- + 1 file changed, 26 insertions(+), 19 deletions(-) + +diff --git a/lib/rdoc/store.rb b/lib/rdoc/store.rb +index 5ba671c..c793e49 100644 +--- a/lib/rdoc/store.rb ++++ b/lib/rdoc/store.rb +@@ -556,9 +556,7 @@ class RDoc::Store + def load_cache + #orig_enc = @encoding + +- File.open cache_path, 'rb' do |io| +- @cache = Marshal.load io.read +- end ++ @cache = marshal_load(cache_path) + + load_enc = @cache[:encoding] + +@@ -615,9 +613,7 @@ class RDoc::Store + def load_class_data klass_name + file = class_file klass_name + +- File.open file, 'rb' do |io| +- Marshal.load io.read +- end ++ marshal_load(file) + rescue Errno::ENOENT => e + error = MissingFileError.new(self, file, klass_name) + error.set_backtrace e.backtrace +@@ -630,14 +626,10 @@ class RDoc::Store + def load_method klass_name, method_name + file = method_file klass_name, method_name + +- File.open file, 'rb' do |io| +- obj = Marshal.load io.read +- obj.store = self +- obj.parent = +- find_class_or_module(klass_name) || load_class(klass_name) unless +- obj.parent +- obj +- end ++ obj = marshal_load(file) ++ obj.store = self ++ obj.parent ||= find_class_or_module(klass_name) || load_class(klass_name) ++ obj + rescue Errno::ENOENT => e + error = MissingFileError.new(self, file, klass_name + method_name) + error.set_backtrace e.backtrace +@@ -650,11 +642,9 @@ class RDoc::Store + def load_page page_name + file = page_file page_name + +- File.open file, 'rb' do |io| +- obj = Marshal.load io.read +- obj.store = self +- obj +- end ++ obj = marshal_load(file) ++ obj.store = self ++ obj + rescue Errno::ENOENT => e + error = MissingFileError.new(self, file, page_name) + error.set_backtrace e.backtrace +@@ -976,4 +966,21 @@ class RDoc::Store + @unique_modules + end + ++ private ++ def marshal_load(file) ++ File.open(file, 'rb') {|io| Marshal.load(io, MarshalFilter)} ++ end ++ ++ MarshalFilter = proc do |obj| ++ case obj ++ when true, false, nil, Array, Class, Encoding, Hash, Integer, String, Symbol, RDoc::Text ++ else ++ unless obj.class.name.start_with?("RDoc::") ++ raise TypeError, "not permitted class: #{obj.class.name}" ++ end ++ end ++ obj ++ end ++ private_constant :MarshalFilter ++ + end +-- +2.35.5 diff --git a/meta/recipes-devtools/ruby/ruby_3.1.3.bb b/meta/recipes-devtools/ruby/ruby_3.1.3.bb index 228a2204db..2ad3c9e207 100644 --- a/meta/recipes-devtools/ruby/ruby_3.1.3.bb +++ b/meta/recipes-devtools/ruby/ruby_3.1.3.bb @@ -33,6 +33,7 @@ SRC_URI = "http://cache.ruby-lang.org/pub/ruby/${SHRT_VER}/ruby-${PV}.tar.gz \ file://CVE-2023-28755.patch \ file://CVE-2023-36617_1.patch \ file://CVE-2023-36617_2.patch \ + file://CVE-2024-27281.patch \ " UPSTREAM_CHECK_URI = "https://www.ruby-lang.org/en/downloads/" From patchwork Wed Apr 17 20:35:27 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 42632 X-Patchwork-Delegate: steve@sakoman.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9C29FC04FFE for ; Wed, 17 Apr 2024 20:35:45 +0000 (UTC) Received: from mail-pl1-f174.google.com (mail-pl1-f174.google.com [209.85.214.174]) by mx.groups.io with SMTP id smtpd.web10.24866.1713386144371630188 for ; Wed, 17 Apr 2024 13:35:44 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20230601.gappssmtp.com header.s=20230601 header.b=ODLSBwGr; spf=softfail (domain: sakoman.com, ip: 209.85.214.174, mailfrom: steve@sakoman.com) Received: by mail-pl1-f174.google.com with SMTP id d9443c01a7336-1e4bf0b3e06so1788575ad.1 for ; Wed, 17 Apr 2024 13:35:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20230601.gappssmtp.com; s=20230601; t=1713386144; x=1713990944; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=nIBbInJ2rDVWaJ9gvwX3kE1dg+oShOxYEHN8JUlfsdQ=; b=ODLSBwGrWSIFuCUXQmdiAogrEgiW7iQGMzgZu8SiYXIW9tqweBIMF9l3e3xBHFtEcr 0Lr/lpEMmHdp1rNJRhRLbFjXYkiLLxnUXPq3Hd61wIbE7r5lSrCDqevbFKYMBtoXBW8E c9bC7zKF4D/e97mDbVmxvp1kMmyKu6i4DxlSpF2B22y/bnzE3zMctQ4iIfuB2zNxt7fI xps2HkRmKt4FTOvKx8yAfPjMSgvkwj5GdcrxHkzY6LqEcOMyEUB4AyqXv/ntvQjxLhzo EQalwUpebH2esf85X0DlC78h83XQ4zDvgg3IJnCnMfXoBsiI3d/o1XddIMo8McV9pmXV nc2A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1713386144; x=1713990944; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=nIBbInJ2rDVWaJ9gvwX3kE1dg+oShOxYEHN8JUlfsdQ=; b=IrQ6PWfqoEZ+qFd8gGhOF2tSyQ4cGtbx46pOd/GIF1oVjcEWPK72WrWCwSm9odw9VL TWdJvqx7nlX/vyWfZT5L91DHfpK+KiM3gmZ8NF6UlWx4pr2+ThO/0r5PImS+Sz61wB1Z lDfGfASijXoxP+TsX6JGqWXxeGqdENcwXqkBAj+lgBHBrQympUUoGr2qW5Nw56enPS7G mdHzSRb5GTBvU+kg0N7vWG9kxZVUnnZZTnoO7+NhUnLCx0OFLu9c2DDDR3dxQ06e3kAK EwrpT/k4l5ev4Ph0gtMfn40bDMI9rIcq8bwoDqkWRC8y4wViXaV0xhzUiUIKWdvBJI1J DBMg== X-Gm-Message-State: AOJu0Yz1iBjRhHUoz0ReJ+UE3h4n1fXc0qmwDs6anmRw5pmyzxWl3dhw iuzxRo9iQU3KZMlpPk5fm6B1gny2vpaaUK2ElFikF958iQ0ruINi8W89uwchlllsS+CKQJRN+cL Oilk= X-Google-Smtp-Source: AGHT+IGeSqVJj987Ir7i0XbM+MHGT7UQ+bn8iccnu+guOuMJJFcNgrhPWBTtkWmHof00AKYVUK6x/g== X-Received: by 2002:a17:90a:728b:b0:2a2:97ce:24f5 with SMTP id e11-20020a17090a728b00b002a297ce24f5mr566177pjg.35.1713386143679; Wed, 17 Apr 2024 13:35:43 -0700 (PDT) Received: from xps13.. ([199.58.97.236]) by smtp.gmail.com with ESMTPSA id s22-20020a17090aa11600b002ab664e5e17sm76876pjp.1.2024.04.17.13.35.43 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 17 Apr 2024 13:35:43 -0700 (PDT) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 3/7] rust: add CVE_CHECK_IGNORE for CVE-2024-24576 Date: Wed, 17 Apr 2024 13:35:27 -0700 Message-Id: <44e0b6b028657d32de5971d6a42a88767ef8c710.1713385733.git.steve@sakoman.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 17 Apr 2024 20:35:45 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/198480 From: Harish Sadineni CVE-2024-24576 only applies when invoking batch files (with the `bat` and `cmd` extensions) on Windows & No other platform or use is affected. More details about CVE is here: https://nvd.nist.gov/vuln/detail/CVE-2024-24576 Signed-off-by: Harish Sadineni Signed-off-by: Steve Sakoman --- meta/recipes-devtools/rust/rust-source.inc | 3 +++ 1 file changed, 3 insertions(+) diff --git a/meta/recipes-devtools/rust/rust-source.inc b/meta/recipes-devtools/rust/rust-source.inc index ea70ad786f..c377a680a7 100644 --- a/meta/recipes-devtools/rust/rust-source.inc +++ b/meta/recipes-devtools/rust/rust-source.inc @@ -5,3 +5,6 @@ RUSTSRC = "${WORKDIR}/rustc-${PV}-src" UPSTREAM_CHECK_URI = "https://forge.rust-lang.org/infra/other-installation-methods.html" UPSTREAM_CHECK_REGEX = "rustc-(?P\d+(\.\d+)+)-src" + +#CVE-2024-24576 is specific to Microsoft Windows +CVE_CHECK_IGNORE += "CVE-2024-24576" From patchwork Wed Apr 17 20:35:28 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 42636 X-Patchwork-Delegate: steve@sakoman.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B581DC4345F for ; Wed, 17 Apr 2024 20:35:55 +0000 (UTC) Received: from mail-pg1-f176.google.com (mail-pg1-f176.google.com [209.85.215.176]) by mx.groups.io with SMTP id smtpd.web11.24879.1713386146014729150 for ; Wed, 17 Apr 2024 13:35:46 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20230601.gappssmtp.com header.s=20230601 header.b=AsLZvX2s; spf=softfail (domain: sakoman.com, ip: 209.85.215.176, mailfrom: steve@sakoman.com) Received: by mail-pg1-f176.google.com with SMTP id 41be03b00d2f7-5dcc4076c13so140666a12.0 for ; Wed, 17 Apr 2024 13:35:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20230601.gappssmtp.com; s=20230601; t=1713386145; x=1713990945; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=DOKRNVZvRvqZ7o0+CDwYfQ/AoXU35i3jMyRGEyO4FpU=; b=AsLZvX2scgBGGGntXf9LjisiqObm66ab/xZDiHfMHAlj3Id030w6iJasNFBv3VTnRq 12bn+V7Sh8SU/hyVSW+F85Z/x3Bb80cK/Oy2ItmMrRGeIUG1PpeTDIDutNYWsTfE6KZy 6xGcoxNrIx3NQfkV6wGfSextWoxX+dhEH0khMIzl/U65x3uqQuYuecHadZrs8pqTYyRg obUIv2IqA4xwJwFmB8eGghYXAWMW9HX65nolDTks/SBDk+TS7NYfU1SPbKSngdsdHoSQ +AIkTlM8XXd7uQS/4URRsZSpQkVsHmUOO1jQ4a6Ecoswh7UyqUPOBk307/nRAnp2TdRO iwzg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1713386145; x=1713990945; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=DOKRNVZvRvqZ7o0+CDwYfQ/AoXU35i3jMyRGEyO4FpU=; b=BmJbRPfHTUDHBUOsCzeQctiXi34pzQp7BDsREUe7yeTeYGvSZ/78T4T1RRzzx2kutB lvsDmssce8iG9ezC/2npOkcK7SMtvr4GXWKQYG6Dc9DteFR5G8vgCfcl74XJVxQFgQoX yyS1IPPY80GnyC+y71xnFwPxNnFRBwd/2w6eaQm3gKmSn3T8vblUXj6V0/+AwSPozNDf o7lOlVwqaUPJ1Ueb5FRXszbgCBRLr/MH2axD+53NSCs25aCumlLDw0JPvW3uUVnhLNvr 9Se9GocHFRvJSQ0YiAC3fdZFKqx3tWIOJ5mi+xEYM4vSfGDUc/jCZqvQNrzyX9ggqxtp 8bvw== X-Gm-Message-State: AOJu0YzXGgDJ45Q7ktQylB7ATHo8g/csxBbpcpMhUO7pOyyJfj5Tw8wn +aF69vP3mBOKEVV2lArTFmUao5XbMh89qSXL4eVGqSUDQdPx8XXDC+Rk0G47N3tzrG7Icw7xG2X cZqU= X-Google-Smtp-Source: AGHT+IEpHe5F5EsnzIOAxSGPCwTtAqhc1fChQVt4nIKwno5zn75KPJi1ANhZNWezNWbO0WTQolyOgQ== X-Received: by 2002:a17:90b:400d:b0:2a5:5f9f:6733 with SMTP id ie13-20020a17090b400d00b002a55f9f6733mr286158pjb.20.1713386145228; Wed, 17 Apr 2024 13:35:45 -0700 (PDT) Received: from xps13.. ([199.58.97.236]) by smtp.gmail.com with ESMTPSA id s22-20020a17090aa11600b002ab664e5e17sm76876pjp.1.2024.04.17.13.35.44 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 17 Apr 2024 13:35:44 -0700 (PDT) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 4/7] nghttp2: Fix CVE-2024-28182 Date: Wed, 17 Apr 2024 13:35:28 -0700 Message-Id: <85e65af4727695d61c225a5911325764f423c331.1713385733.git.steve@sakoman.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 17 Apr 2024 20:35:55 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/198481 From: Soumya Sambu nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability. References: https://nvd.nist.gov/vuln/detail/CVE-2024-28182 Signed-off-by: Soumya Sambu Signed-off-by: Steve Sakoman --- .../nghttp2/nghttp2/CVE-2024-28182-0001.patch | 110 ++++++++++++++++++ .../nghttp2/nghttp2/CVE-2024-28182-0002.patch | 105 +++++++++++++++++ .../recipes-support/nghttp2/nghttp2_1.47.0.bb | 2 + 3 files changed, 217 insertions(+) create mode 100644 meta/recipes-support/nghttp2/nghttp2/CVE-2024-28182-0001.patch create mode 100644 meta/recipes-support/nghttp2/nghttp2/CVE-2024-28182-0002.patch diff --git a/meta/recipes-support/nghttp2/nghttp2/CVE-2024-28182-0001.patch b/meta/recipes-support/nghttp2/nghttp2/CVE-2024-28182-0001.patch new file mode 100644 index 0000000000..e1d909b0d1 --- /dev/null +++ b/meta/recipes-support/nghttp2/nghttp2/CVE-2024-28182-0001.patch @@ -0,0 +1,110 @@ +From 00201ecd8f982da3b67d4f6868af72a1b03b14e0 Mon Sep 17 00:00:00 2001 +From: Tatsuhiro Tsujikawa +Date: Sat, 9 Mar 2024 16:26:42 +0900 +Subject: [PATCH] Limit CONTINUATION frames following an incoming HEADER frame + +CVE: CVE-2024-28182 + +Upstream-Status: Backport [https://github.com/nghttp2/nghttp2/commit/00201ecd8f982da3b67d4f6868af72a1b03b14e0] + +Signed-off-by: Soumya Sambu +--- + lib/includes/nghttp2/nghttp2.h | 7 ++++++- + lib/nghttp2_helper.c | 2 ++ + lib/nghttp2_session.c | 7 +++++++ + lib/nghttp2_session.h | 10 ++++++++++ + 4 files changed, 25 insertions(+), 1 deletion(-) + +diff --git a/lib/includes/nghttp2/nghttp2.h b/lib/includes/nghttp2/nghttp2.h +index 2bd35f4..6cc8c0c 100644 +--- a/lib/includes/nghttp2/nghttp2.h ++++ b/lib/includes/nghttp2/nghttp2.h +@@ -440,7 +440,12 @@ typedef enum { + * exhaustion on server side to send these frames forever and does + * not read network. + */ +- NGHTTP2_ERR_FLOODED = -904 ++ NGHTTP2_ERR_FLOODED = -904, ++ /** ++ * When a local endpoint receives too many CONTINUATION frames ++ * following a HEADER frame. ++ */ ++ NGHTTP2_ERR_TOO_MANY_CONTINUATIONS = -905, + } nghttp2_error; + + /** +diff --git a/lib/nghttp2_helper.c b/lib/nghttp2_helper.c +index 588e269..98989f6 100644 +--- a/lib/nghttp2_helper.c ++++ b/lib/nghttp2_helper.c +@@ -336,6 +336,8 @@ const char *nghttp2_strerror(int error_code) { + "closed"; + case NGHTTP2_ERR_TOO_MANY_SETTINGS: + return "SETTINGS frame contained more than the maximum allowed entries"; ++ case NGHTTP2_ERR_TOO_MANY_CONTINUATIONS: ++ return "Too many CONTINUATION frames following a HEADER frame"; + default: + return "Unknown error code"; + } +diff --git a/lib/nghttp2_session.c b/lib/nghttp2_session.c +index 5c834fa..537127c 100644 +--- a/lib/nghttp2_session.c ++++ b/lib/nghttp2_session.c +@@ -464,6 +464,7 @@ static int session_new(nghttp2_session **session_ptr, + (*session_ptr)->max_send_header_block_length = NGHTTP2_MAX_HEADERSLEN; + (*session_ptr)->max_outbound_ack = NGHTTP2_DEFAULT_MAX_OBQ_FLOOD_ITEM; + (*session_ptr)->max_settings = NGHTTP2_DEFAULT_MAX_SETTINGS; ++ (*session_ptr)->max_continuations = NGHTTP2_DEFAULT_MAX_CONTINUATIONS; + + if (option) { + if ((option->opt_set_mask & NGHTTP2_OPT_NO_AUTO_WINDOW_UPDATE) && +@@ -6307,6 +6308,8 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in, + } + } + session_inbound_frame_reset(session); ++ ++ session->num_continuations = 0; + } + break; + } +@@ -6428,6 +6431,10 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in, + } + #endif /* DEBUGBUILD */ + ++ if (++session->num_continuations > session->max_continuations) { ++ return NGHTTP2_ERR_TOO_MANY_CONTINUATIONS; ++ } ++ + readlen = inbound_frame_buf_read(iframe, in, last); + in += readlen; + +diff --git a/lib/nghttp2_session.h b/lib/nghttp2_session.h +index 5f71a16..9a00b0e 100644 +--- a/lib/nghttp2_session.h ++++ b/lib/nghttp2_session.h +@@ -107,6 +107,10 @@ typedef struct { + #define NGHTTP2_DEFAULT_STREAM_RESET_BURST 1000 + #define NGHTTP2_DEFAULT_STREAM_RESET_RATE 33 + ++/* The default max number of CONTINUATION frames following an incoming ++ HEADER frame. */ ++#define NGHTTP2_DEFAULT_MAX_CONTINUATIONS 8 ++ + /* Internal state when receiving incoming frame */ + typedef enum { + /* Receiving frame header */ +@@ -279,6 +283,12 @@ struct nghttp2_session { + size_t max_send_header_block_length; + /* The maximum number of settings accepted per SETTINGS frame. */ + size_t max_settings; ++ /* The maximum number of CONTINUATION frames following an incoming ++ HEADER frame. */ ++ size_t max_continuations; ++ /* The number of CONTINUATION frames following an incoming HEADER ++ frame. This variable is reset when END_HEADERS flag is seen. */ ++ size_t num_continuations; + /* Next Stream ID. Made unsigned int to detect >= (1 << 31). */ + uint32_t next_stream_id; + /* The last stream ID this session initiated. For client session, +-- +2.40.0 diff --git a/meta/recipes-support/nghttp2/nghttp2/CVE-2024-28182-0002.patch b/meta/recipes-support/nghttp2/nghttp2/CVE-2024-28182-0002.patch new file mode 100644 index 0000000000..fee19465d5 --- /dev/null +++ b/meta/recipes-support/nghttp2/nghttp2/CVE-2024-28182-0002.patch @@ -0,0 +1,105 @@ +From d71a4668c6bead55805d18810d633fbb98315af9 Mon Sep 17 00:00:00 2001 +From: Tatsuhiro Tsujikawa +Date: Sat, 9 Mar 2024 16:48:10 +0900 +Subject: [PATCH] Add nghttp2_option_set_max_continuations + +CVE: CVE-2024-28182 + +Upstream-Status: Backport [https://github.com/nghttp2/nghttp2/commit/d71a4668c6bead55805d18810d633fbb98315af9] + +Signed-off-by: Soumya Sambu +--- + doc/Makefile.am | 1 + + lib/includes/nghttp2/nghttp2.h | 11 +++++++++++ + lib/nghttp2_option.c | 5 +++++ + lib/nghttp2_option.h | 5 +++++ + lib/nghttp2_session.c | 4 ++++ + 5 files changed, 26 insertions(+) + +diff --git a/doc/Makefile.am b/doc/Makefile.am +index b9d5a2d..83cfdfd 100644 +--- a/doc/Makefile.am ++++ b/doc/Makefile.am +@@ -70,6 +70,7 @@ APIDOCS= \ + nghttp2_option_set_no_recv_client_magic.rst \ + nghttp2_option_set_peer_max_concurrent_streams.rst \ + nghttp2_option_set_user_recv_extension_type.rst \ ++ nghttp2_option_set_max_continuations.rst \ + nghttp2_option_set_max_outbound_ack.rst \ + nghttp2_option_set_max_settings.rst \ + nghttp2_option_set_stream_reset_rate_limit.rst \ +diff --git a/lib/includes/nghttp2/nghttp2.h b/lib/includes/nghttp2/nghttp2.h +index 6cc8c0c..c77cca9 100644 +--- a/lib/includes/nghttp2/nghttp2.h ++++ b/lib/includes/nghttp2/nghttp2.h +@@ -2724,6 +2724,17 @@ NGHTTP2_EXTERN void nghttp2_option_set_max_outbound_ack(nghttp2_option *option, + NGHTTP2_EXTERN void nghttp2_option_set_max_settings(nghttp2_option *option, + size_t val); + ++/** ++ * @function ++ * ++ * This function sets the maximum number of CONTINUATION frames ++ * following an incoming HEADER frame. If more than those frames are ++ * received, the remote endpoint is considered to be misbehaving and ++ * session will be closed. The default value is 8. ++ */ ++NGHTTP2_EXTERN void nghttp2_option_set_max_continuations(nghttp2_option *option, ++ size_t val); ++ + /** + * @function + * +diff --git a/lib/nghttp2_option.c b/lib/nghttp2_option.c +index 0d9a404..f3659c1 100644 +--- a/lib/nghttp2_option.c ++++ b/lib/nghttp2_option.c +@@ -133,3 +133,8 @@ void nghttp2_option_set_stream_reset_rate_limit(nghttp2_option *option, + option->stream_reset_burst = burst; + option->stream_reset_rate = rate; + } ++ ++void nghttp2_option_set_max_continuations(nghttp2_option *option, size_t val) { ++ option->opt_set_mask |= NGHTTP2_OPT_MAX_CONTINUATIONS; ++ option->max_continuations = val; ++} +diff --git a/lib/nghttp2_option.h b/lib/nghttp2_option.h +index e6ba910..c1b48c7 100644 +--- a/lib/nghttp2_option.h ++++ b/lib/nghttp2_option.h +@@ -69,6 +69,7 @@ typedef enum { + NGHTTP2_OPT_MAX_OUTBOUND_ACK = 1 << 11, + NGHTTP2_OPT_MAX_SETTINGS = 1 << 12, + NGHTTP2_OPT_STREAM_RESET_RATE_LIMIT = 1 << 15, ++ NGHTTP2_OPT_MAX_CONTINUATIONS = 1 << 16, + } nghttp2_option_flag; + + /** +@@ -96,6 +97,10 @@ struct nghttp2_option { + * NGHTTP2_OPT_MAX_SETTINGS + */ + size_t max_settings; ++ /** ++ * NGHTTP2_OPT_MAX_CONTINUATIONS ++ */ ++ size_t max_continuations; + /** + * Bitwise OR of nghttp2_option_flag to determine that which fields + * are specified. +diff --git a/lib/nghttp2_session.c b/lib/nghttp2_session.c +index 537127c..b390cd5 100644 +--- a/lib/nghttp2_session.c ++++ b/lib/nghttp2_session.c +@@ -539,6 +539,10 @@ static int session_new(nghttp2_session **session_ptr, + option->stream_reset_burst, + option->stream_reset_rate); + } ++ ++ if (option->opt_set_mask & NGHTTP2_OPT_MAX_CONTINUATIONS) { ++ (*session_ptr)->max_continuations = option->max_continuations; ++ } + } + + rv = nghttp2_hd_deflate_init2(&(*session_ptr)->hd_deflater, +-- +2.40.0 diff --git a/meta/recipes-support/nghttp2/nghttp2_1.47.0.bb b/meta/recipes-support/nghttp2/nghttp2_1.47.0.bb index b67313b5c2..79b1cf95c5 100644 --- a/meta/recipes-support/nghttp2/nghttp2_1.47.0.bb +++ b/meta/recipes-support/nghttp2/nghttp2_1.47.0.bb @@ -11,6 +11,8 @@ SRC_URI = "\ file://0001-fetch-ocsp-response-use-python3.patch \ file://CVE-2023-35945.patch \ file://CVE-2023-44487.patch \ + file://CVE-2024-28182-0001.patch \ + file://CVE-2024-28182-0002.patch \ " SRC_URI[sha256sum] = "68271951324554c34501b85190f22f2221056db69f493afc3bbac8e7be21e7cc" From patchwork Wed Apr 17 20:35:29 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 42638 X-Patchwork-Delegate: steve@sakoman.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C4320C05023 for ; Wed, 17 Apr 2024 20:35:55 +0000 (UTC) Received: from mail-pg1-f176.google.com (mail-pg1-f176.google.com [209.85.215.176]) by mx.groups.io with SMTP id smtpd.web10.24869.1713386147569051041 for ; Wed, 17 Apr 2024 13:35:47 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20230601.gappssmtp.com header.s=20230601 header.b=I3fS+B/p; spf=softfail (domain: sakoman.com, ip: 209.85.215.176, mailfrom: steve@sakoman.com) Received: by mail-pg1-f176.google.com with SMTP id 41be03b00d2f7-5cf2d73a183so900872a12.1 for ; Wed, 17 Apr 2024 13:35:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20230601.gappssmtp.com; s=20230601; t=1713386147; x=1713990947; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=CbfjK6Er6vHetDwiT1qr8xKuNOYaN1RCofL5rPWSPkY=; b=I3fS+B/pHTh1MLxzKPQ8mENcvM6PrphWhH8OYLQ3VNV+tpdD8yVeaaPAdVpnt7c2o8 COSQVrlubsvlr93z8rVDykGd3HKFOeF0LQQq1DHJGpZ9uwer+2CniF0i+8MLx38q5r40 OCQQZm8Q6LE4psG/ZBlpAY6UCTqBtJXonzPvzXYqcUaz1Hp3q37r/X7vb+j67yWAemjZ f3U6Eb7UMP7yYDyX+USQEsFMZTcrQmUrtijRteUnluoKzfncGIDaJqL3JzXyvpvcTj2D zRD61c6KTKQdyAnUWsMcGb3LtW8UjWqSG94WV0ADddAVhdVYOkqXydBpJC9SCSNQ1grE jqfA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1713386147; x=1713990947; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=CbfjK6Er6vHetDwiT1qr8xKuNOYaN1RCofL5rPWSPkY=; b=enRDaQBLUCgjWk8x1nvGqkBmxHzdVNG6apxtZgiQDG1zik3JEalLZYp+ipLAQPL69O /ACCH4/pEWJlhIpEv3zyYshEzF8qkY7wIu5FUemRaFszA96WSggGEzRQRG4N6/8itjtJ Fe/QjlhGHVHh1j3A+dH39oHYMt25qIKE1a2xME8MAHBS0oflvsuDIcZRSWvtUxzWCERN sNt55V1jSibBM9pgSQvnzaCcoj+WdE8Gq3BhgG34+1noHZqotMXApbB1j061YY2Jdsx5 jTfGrMnaTKf8fk/Cnt1KP6WMyeX158ojB7l1beBqFzgIFmjHQwD2hOQt/w01Vc5A65FL N+/A== X-Gm-Message-State: AOJu0YzIP0rcAAzg7LWW2ANdaBAOEpH0ysV7Sj5K8K5BUbIBC6BnQ01Q ajAiICgGzvwYanrZ99f+4enhesFqicYU+EzlajKLU9WzgRAyN4TWOL5ZdgiHDYIlC6OhQmGczM8 Uvj8= X-Google-Smtp-Source: AGHT+IEo9qe/8vNt44Kkkww69DlIB4TSzPxNOwGpHGAGHLKns+obP17jMDOB+eRPZo9Klh3P58OLwQ== X-Received: by 2002:a17:90a:7e81:b0:2ab:8e59:9da9 with SMTP id j1-20020a17090a7e8100b002ab8e599da9mr308611pjl.6.1713386146749; Wed, 17 Apr 2024 13:35:46 -0700 (PDT) Received: from xps13.. ([199.58.97.236]) by smtp.gmail.com with ESMTPSA id s22-20020a17090aa11600b002ab664e5e17sm76876pjp.1.2024.04.17.13.35.46 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 17 Apr 2024 13:35:46 -0700 (PDT) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 5/7] valgrind: skip intermittently failing ptest Date: Wed, 17 Apr 2024 13:35:29 -0700 Message-Id: <19e7d5e717e6d28e0b64bd382f07b8e709526474.1713385733.git.steve@sakoman.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 17 Apr 2024 20:35:55 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/198482 Intermittent failures on autobuilder: AssertionError: Failed ptests: {'valgrind': ['memcheck/tests/linux/timerfd-syscall']} Signed-off-by: Steve Sakoman --- meta/recipes-devtools/valgrind/valgrind/remove-for-all | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-devtools/valgrind/valgrind/remove-for-all b/meta/recipes-devtools/valgrind/valgrind/remove-for-all index cb8d10b18f..226f97b50e 100644 --- a/meta/recipes-devtools/valgrind/valgrind/remove-for-all +++ b/meta/recipes-devtools/valgrind/valgrind/remove-for-all @@ -1,8 +1,10 @@ none/tests/amd64/fb_test_amd64 gdbserver_tests/hginfo +memcheck/tests/linux/timerfd-syscall memcheck/tests/supp_unknown helgrind/tests/tls_threads drd/tests/bar_bad_xml drd/tests/pth_barrier_thr_cr drd/tests/thread_name_xml massif/tests/deep-D + From patchwork Wed Apr 17 20:35:30 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 42639 X-Patchwork-Delegate: steve@sakoman.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D34AAC04FFE for ; Wed, 17 Apr 2024 20:35:55 +0000 (UTC) Received: from mail-pg1-f170.google.com (mail-pg1-f170.google.com [209.85.215.170]) by mx.groups.io with SMTP id smtpd.web11.24881.1713386148929236163 for ; Wed, 17 Apr 2024 13:35:48 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20230601.gappssmtp.com header.s=20230601 header.b=aDRjJ27H; spf=softfail (domain: sakoman.com, ip: 209.85.215.170, mailfrom: steve@sakoman.com) Received: by mail-pg1-f170.google.com with SMTP id 41be03b00d2f7-5cf2d73a183so900888a12.1 for ; Wed, 17 Apr 2024 13:35:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20230601.gappssmtp.com; s=20230601; t=1713386148; x=1713990948; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=nxvxWhbbEm7g4ZgX9PfB4UETGetKt7sOS/3R1URp8ao=; b=aDRjJ27HmDS8/XKWVc5eAhQdTDZdWA7LFDUnJ5YQBf2nbFkKVUebtZ0uFljqA8kTEX bnE9eb5qigPOu4NMxL5ZvYvBbJCGEif2az4j82JtE3KvqC6MX3ks9iThKePocL0TNLSl w29xLt9WqCHivUH+IoNBuElX72dcwmA9syF+mEYeFasNpx9kwHkIdc1j7LJ+Mrhe5zc/ QqkqyX6jS4UVCsspIn61xgYzHfR3IrIfM7qHgk4/XXcnovpN1DgLoWOwNEKaainXHPwr G+lvrqCh4iyrBNEmRmaB9zq+6pJTyymiunirER9m/suGRbDw7XUvMB1dxwBh4zj8bKzk x7Pw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1713386148; x=1713990948; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=nxvxWhbbEm7g4ZgX9PfB4UETGetKt7sOS/3R1URp8ao=; b=qsA3NyZgOpHX4oGzPgu5wTKZsemjCHFui0jXTbyayfdsOjjr7VddiXZhttcR10OaHi ILPVr+7OnaMC1DZunynLd1WDIOxiuFzmwnDXSto+FD0CC6Qal8177AgRYLiph8+J7lwg CpuMiEXzM6Ws74t4nO6MjJSUTTnvX6rktZQc/N1cFQigvHE1SEoZC+nVoJvmmRehseUr WpjTiv5eH5+cEZpj6GhcicE9J7nHllGMDlrsQ0EoJ+p+auWXTE8iLqUNYqIjdL6rILFA 1G8uEF03OCYrBF4yzXtt22jdImt/rnX9JYg3hS6rommgqP9VrD2clvJ6C8h4PJtLS5UF yuvg== X-Gm-Message-State: AOJu0YzcS/OtQKFQKC0AHc/h51FRqlk8lMIVeH9n8oej9t9KoQefU005 Z6HVttgPBpDXD9YREEAWrnLA2iZlz3jWXM7K5+ItKuitB8B28jH5jy7vhZgMC5bfOyuNrhSYz2m JLNY= X-Google-Smtp-Source: AGHT+IGnLcksM0VHNKUf6E6g42BZGzrtH2k/HzKe4YgMkWUOtnnMEDBSTzuu4yo2lb4GkCEDVt9PXQ== X-Received: by 2002:a17:90b:1090:b0:2aa:c389:c9f0 with SMTP id gj16-20020a17090b109000b002aac389c9f0mr329585pjb.12.1713386148212; Wed, 17 Apr 2024 13:35:48 -0700 (PDT) Received: from xps13.. ([199.58.97.236]) by smtp.gmail.com with ESMTPSA id s22-20020a17090aa11600b002ab664e5e17sm76876pjp.1.2024.04.17.13.35.47 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 17 Apr 2024 13:35:48 -0700 (PDT) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 6/7] ppp: Add RSA-MD in LICENSE Date: Wed, 17 Apr 2024 13:35:30 -0700 Message-Id: <915df62abd2986b2f9d73718e702cc6ce088d52b.1713385733.git.steve@sakoman.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 17 Apr 2024 20:35:55 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/198483 From: Poonam Jadhav ppp package has "RSA Data Security" license text in Message-Digest Algorithm source file md5.c and md4.c Add RSA-MD in LICENSE field for ppp package Signed-off-by: Poonam Jadhav Signed-off-by: Steve Sakoman --- meta/recipes-connectivity/ppp/ppp_2.4.9.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/recipes-connectivity/ppp/ppp_2.4.9.bb b/meta/recipes-connectivity/ppp/ppp_2.4.9.bb index 7e3ae43b58..b7f71b673d 100644 --- a/meta/recipes-connectivity/ppp/ppp_2.4.9.bb +++ b/meta/recipes-connectivity/ppp/ppp_2.4.9.bb @@ -5,7 +5,7 @@ SECTION = "console/network" HOMEPAGE = "http://samba.org/ppp/" BUGTRACKER = "http://ppp.samba.org/cgi-bin/ppp-bugs" DEPENDS = "libpcap openssl virtual/crypt" -LICENSE = "BSD-3-Clause & BSD-3-Clause-Attribution & GPL-2.0-or-later & LGPL-2.0-or-later & PD" +LICENSE = "BSD-3-Clause & BSD-3-Clause-Attribution & GPL-2.0-or-later & LGPL-2.0-or-later & PD & RSA-MD" LIC_FILES_CHKSUM = "file://pppd/ccp.c;beginline=1;endline=29;md5=e2c43fe6e81ff77d87dc9c290a424dea \ file://pppd/plugins/passprompt.c;beginline=1;endline=10;md5=3bcbcdbf0e369c9a3e0b8c8275b065d8 \ file://pppd/tdb.c;beginline=1;endline=27;md5=4ca3a9991b011038d085d6675ae7c4e6 \ From patchwork Wed Apr 17 20:35:31 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 42637 X-Patchwork-Delegate: steve@sakoman.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B661DC001CC for ; Wed, 17 Apr 2024 20:35:55 +0000 (UTC) Received: from mail-pj1-f42.google.com (mail-pj1-f42.google.com [209.85.216.42]) by mx.groups.io with SMTP id smtpd.web10.24873.1713386150405548973 for ; Wed, 17 Apr 2024 13:35:50 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20230601.gappssmtp.com header.s=20230601 header.b=eDuzPO6Y; spf=softfail (domain: sakoman.com, ip: 209.85.216.42, mailfrom: steve@sakoman.com) Received: by mail-pj1-f42.google.com with SMTP id 98e67ed59e1d1-2a3095907ffso166011a91.0 for ; Wed, 17 Apr 2024 13:35:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20230601.gappssmtp.com; s=20230601; t=1713386150; x=1713990950; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=c9UzC/lEOeszMlOFkbfZ0hnqyTRoqhG/PyuNMRrqoRk=; b=eDuzPO6Y+rztBytypjpRQn+L4D8vGfKYlZ8irKHI+0yfU6z+DzmoDFEF7srLTgnk7M WmOxzDkdxFCMD3Cg3nKF4YN/XYDCjnA2MRzpCA0xEn8uuwA4DCpEoNjQsvvhkGiFBI5w vHnaLTYv3rMfkvTATxZLj1YkYYFEj7HuNe4KdcmT9TqWxsh02wsayMbKBT93dJdIimSP LcaH/0dzlAvBh9rWPowgPoeuGEE57tWkwzM34z0ThWwpT4+w8oJo84QD3jSzr5/kVNgE yMsOiq5HNGj9AjkpJCanfF5qRpGLgssSuPT6rP/CRt4VH7308B7U8Rg1xkZ3RHsrRzDF f+vw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1713386150; x=1713990950; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=c9UzC/lEOeszMlOFkbfZ0hnqyTRoqhG/PyuNMRrqoRk=; b=pR+jpqD5v/eCuv91aZIB31vA3JHnZlbDIAR0OOc5J/7GLcm2vE6gsviCD6CzBhs0JS gyQ6l0tjV/WbKEyYBQ70IGpCJr8pl2ebLZoiQcqgA9jADsIiEv7gf64exEn4mpPd9swk IMUx8nDCFXAljZT8QGHFe+sjgWWsTkeZKxVG0ofnunl1OF547uByBr3zwe5PNtVcEN+Z WpoQQp9tmZ650FUTKcuXolW93UvqpNxe2ooSIn2Fx29BxGdhZeB1TBaBLk5GaHxaqEEN jBMsUA2fDV6sGON/nOg03FCuWTYN/cDbxU1cM841g8CjUAT/MaZXzGyDQ5dPJzilF8gt J6QA== X-Gm-Message-State: AOJu0YzO3mZ1JBR9BAu7X7lKAE0/VhcLFNnDfBLLQm72h5TW/Mxl/BIU 1BSptHk+OHv1T/nD963UGjeZHslaPkrbNsZKrPks9lUR/TkSfBvOdZ8xFEKOhRvStfRB8bFXnPn pJEg= X-Google-Smtp-Source: AGHT+IEcuS69t07P/a/xBKbTv7OLw0gHGdE+QCFQsX6GXWfmhqhdEAnPFsZKi7XSTfmIAiR7YgwlHQ== X-Received: by 2002:a17:90b:380b:b0:2a5:2db0:cbda with SMTP id mq11-20020a17090b380b00b002a52db0cbdamr549347pjb.25.1713386149678; Wed, 17 Apr 2024 13:35:49 -0700 (PDT) Received: from xps13.. ([199.58.97.236]) by smtp.gmail.com with ESMTPSA id s22-20020a17090aa11600b002ab664e5e17sm76876pjp.1.2024.04.17.13.35.49 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 17 Apr 2024 13:35:49 -0700 (PDT) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 7/7] systemd: Fix vlan qos mapping Date: Wed, 17 Apr 2024 13:35:31 -0700 Message-Id: <1010d57595b0a4634d728d1d3fcb0087a2ff17ce.1713385733.git.steve@sakoman.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 17 Apr 2024 20:35:55 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/198484 From: Sana Kazi Drop unnecessary restriction for QoS mapping. Also adds tests for vlan QoS mapping. Link: https://github.com/systemd/systemd/commit/fe830b84d4002582e7aefb16e5e09fd0195f21c8.patch PR: https://github.com/systemd/systemd/pull/27761 Signed-off-by: Sana Kazi Signed-off-by: Sana Kazi Signed-off-by: Steve Sakoman --- .../systemd/fix-vlan-qos-mapping.patch | 140 ++++++++++++++++++ meta/recipes-core/systemd/systemd_250.5.bb | 1 + 2 files changed, 141 insertions(+) create mode 100644 meta/recipes-core/systemd/systemd/fix-vlan-qos-mapping.patch diff --git a/meta/recipes-core/systemd/systemd/fix-vlan-qos-mapping.patch b/meta/recipes-core/systemd/systemd/fix-vlan-qos-mapping.patch new file mode 100644 index 0000000000..c530de7f50 --- /dev/null +++ b/meta/recipes-core/systemd/systemd/fix-vlan-qos-mapping.patch @@ -0,0 +1,140 @@ +From 4d13d175f8454df63843a880c78badd4f6d720ca Mon Sep 17 00:00:00 2001 +From: Yu Watanabe +Date: Wed, 24 May 2023 11:02:36 +0900 +Subject: [PATCH 1/3] network/vlan: drop unnecessary restriction for QoS + mapping + +Fixes #27460. + +Upstream-Status: Backport [https://github.com/systemd/systemd/commit/fe830b84d4002582e7aefb16e5e09fd0195f21c8.patch] +Signed-off-by: Sana Kazi +--- + src/network/netdev/vlan.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/src/network/netdev/vlan.c b/src/network/netdev/vlan.c +index a3d961dac3ca4..d61e9486abc47 100644 +--- a/src/network/netdev/vlan.c ++++ b/src/network/netdev/vlan.c +@@ -165,11 +165,6 @@ int config_parse_vlan_qos_maps( + continue; + } + +- if (m->to > m->from || m->to == 0 || m->from == 0) { +- log_syntax(unit, LOG_WARNING, filename, line, 0, "Invalid %s, ignoring: %s", lvalue, w); +- continue; +- } +- + r = set_ensure_consume(s, &vlan_qos_maps_hash_ops, TAKE_PTR(m)); + if (r < 0) { + log_syntax(unit, LOG_WARNING, filename, line, r, "Failed to store %s, ignoring: %s", lvalue, w); + +From 4194478af861f80a73905d1f9e570a09862f91a7 Mon Sep 17 00:00:00 2001 +From: Yu Watanabe +Date: Wed, 24 May 2023 11:06:35 +0900 +Subject: [PATCH 2/3] network/vlan: paranoia about type safety + +No functional change, as the struct is defined as the following: +``` +struct ifla_vlan_qos_mapping { + __u32 from; + __u32 to; +}; +``` +--- + src/network/netdev/vlan.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/src/network/netdev/vlan.c b/src/network/netdev/vlan.c +index d61e9486abc47..5eb36ef6801f3 100644 +--- a/src/network/netdev/vlan.c ++++ b/src/network/netdev/vlan.c +@@ -144,6 +144,7 @@ int config_parse_vlan_qos_maps( + for (const char *p = rvalue;;) { + _cleanup_free_ struct ifla_vlan_qos_mapping *m = NULL; + _cleanup_free_ char *w = NULL; ++ unsigned from, to; + + r = extract_first_word(&p, &w, NULL, EXTRACT_CUNESCAPE|EXTRACT_UNQUOTE); + if (r == -ENOMEM) +@@ -155,16 +156,21 @@ int config_parse_vlan_qos_maps( + if (r == 0) + return 0; + +- m = new0(struct ifla_vlan_qos_mapping, 1); +- if (!m) +- return log_oom(); +- +- r = parse_range(w, &m->from, &m->to); ++ r = parse_range(w, &from, &to); + if (r < 0) { + log_syntax(unit, LOG_WARNING, filename, line, r, "Failed to parse %s, ignoring: %s", lvalue, w); + continue; + } + ++ m = new(struct ifla_vlan_qos_mapping, 1); ++ if (!m) ++ return log_oom(); ++ ++ *m = (struct ifla_vlan_qos_mapping) { ++ .from = from, ++ .to = to, ++ }; ++ + r = set_ensure_consume(s, &vlan_qos_maps_hash_ops, TAKE_PTR(m)); + if (r < 0) { + log_syntax(unit, LOG_WARNING, filename, line, r, "Failed to store %s, ignoring: %s", lvalue, w); + +From 73d24e45f8ac18eaaebf1df2b1f055c14179c6ff Mon Sep 17 00:00:00 2001 +From: Yu Watanabe +Date: Wed, 24 May 2023 11:15:44 +0900 +Subject: [PATCH 3/3] test-network: add tests for vlan QoS mapping + +--- + .../conf/21-vlan.netdev.d/override.conf | 10 ++++++---- + test/test-network/systemd-networkd-tests.py | 14 ++++++++------ + 2 files changed, 14 insertions(+), 10 deletions(-) + +diff --git a/test/test-network/conf/21-vlan.netdev.d/override.conf b/test/test-network/conf/21-vlan.netdev.d/override.conf +index 3b8d47d9b1db5..c71077d274a69 100644 +--- a/test/test-network/conf/21-vlan.netdev.d/override.conf ++++ b/test/test-network/conf/21-vlan.netdev.d/override.conf +@@ -3,7 +3,9 @@ MTUBytes=2000 + + [VLAN] + Id=99 +-GVRP=true +-MVRP=true +-LooseBinding=true +-ReorderHeader=true ++GVRP=yes ++MVRP=yes ++LooseBinding=yes ++ReorderHeader=yes ++EgressQOSMaps=0-1 1-3 10-3 6-6 7-7 ++IngressQOSMaps=15-13 20-100 +diff --git a/test/test-network/systemd-networkd-tests.py b/test/test-network/systemd-networkd-tests.py +index fe72f37ce4f47..8b01718d55e64 100755 +--- a/test/test-network/systemd-networkd-tests.py ++++ b/test/test-network/systemd-networkd-tests.py +@@ -1285,12 +1285,14 @@ def test_vlan(self): + + output = check_output('ip -d link show vlan99') + print(output) +- self.assertRegex(output, ' mtu 2000 ') +- self.assertRegex(output, 'REORDER_HDR') +- self.assertRegex(output, 'LOOSE_BINDING') +- self.assertRegex(output, 'GVRP') +- self.assertRegex(output, 'MVRP') +- self.assertRegex(output, ' id 99 ') ++ self.assertIn(' mtu 2000 ', output) ++ self.assertIn('REORDER_HDR', output) ++ self.assertIn('LOOSE_BINDING', output) ++ self.assertIn('GVRP', output) ++ self.assertIn('MVRP', output) ++ self.assertIn(' id 99 ', output) ++ self.assertIn('ingress-qos-map { 4:100 7:13 }', output) ++ self.assertIn('egress-qos-map { 0:1 1:3 6:6 7:7 10:3 }', output) + + output = check_output('ip -4 address show dev test1') + print(output) diff --git a/meta/recipes-core/systemd/systemd_250.5.bb b/meta/recipes-core/systemd/systemd_250.5.bb index 80a797cf2c..4d520c85f3 100644 --- a/meta/recipes-core/systemd/systemd_250.5.bb +++ b/meta/recipes-core/systemd/systemd_250.5.bb @@ -33,6 +33,7 @@ SRC_URI += "file://touchscreen.rules \ file://0001-network-remove-only-managed-configs-on-reconfigure-o.patch \ file://0001-nspawn-make-sure-host-root-can-write-to-the-uidmappe.patch \ file://CVE-2023-7008.patch \ + file://fix-vlan-qos-mapping.patch \ " # patches needed by musl