When ntp could be correctly built with openssh and libcrypto, we would meet
the following QA issue.
WARNING: QA Issue: package ntp contains bad RPATH ... [rpath]
Fix this problem by adding '--disable-rpath' to EXTRA_OECONF.
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
SQUID-2015:2 - Does not affect Squid-3.4 and older versions are not vulnerable.
CVE-2015-5400
CVE-2015-3455
CVE-2014-7142
CVE-2014-7141
CVE-2014-6270
see http://www.squid-cache.org/Advisories/
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
replace to run "make install" with directly calling install command,
since "make install" asks "bin" user and group, and maybe fail when
system has not;
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
ntp 4.2.8p2 has more CVE fixes, like CVE-2015-1799, CVE-2015-1798;
and remove ntp-4.2.8-ntp-keygen-no-openssl.patch which 4.2.8p2 has integrated
4.2.8.p1 included CVE-2014-9297, CVE-2014-9298 (ak).
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
This fixed the CVE-2015-4047:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4047
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libsmi is autodetected in configure, but in most cases disabled because of
cross-compilation so keep it explicitly disabled
* resolves following difference in builds with and without libsmi built
before tcpdump:
4.7.4-r0-with/temp/log.do_configure:checking smi.h usability... yes
4.7.4-r0-with/temp/log.do_configure:checking smi.h presence... yes
4.7.4-r0-with/temp/log.do_configure:checking for smi.h... yes
4.7.4-r0-with/temp/log.do_configure:checking for smiInit in -lsmi... yes
4.7.4-r0-with/temp/log.do_configure:checking whether to enable libsmi... not when cross-compiling
4.7.4-r0-without/temp/log.do_configure:checking smi.h usability... no
4.7.4-r0-without/temp/log.do_configure:checking smi.h presence... no
4.7.4-r0-without/temp/log.do_configure:checking for smi.h... no
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
ERROR: Nothing PROVIDES 'libdnet' (but /home/akuster/oss/clean/meta-openembedded/meta-oe/recipes-connectivity/daq/daq_2.0.2.bb DEPENDS on or otherwise requires it). Close matches:
libnet
libnewt
libidn
ERROR: Required build target 'daq' has no buildable providers.
Missing or unbuildable dependency chain was: ['daq', 'libdnet']
world build fails for meta-oe.
move daq to meta-networking where snort and libdnet both reside.
Signed-off-by: Armin Kuster <akuster808@gmail.com>
When building for a system including systemd ypbind-mt will link against
libsystemd creating an implicit dependency. Make that explicit.
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
An update in OpenSSL removed the -lcrypto from libssl's pkg-config
options. The old behaviour always linked it with -lssl, so revert to that
for now.
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
We should set group of ${localstatedir}/lib/postfix to 'nogroup' not 'postfix',
actually it's done at the below, so remove this useless code.
Signed-off-by: Bian Naimeng <biannm@cn.fujitsu.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Issue: TA79430
- Change to use append for PACKAGES so that:
* ptest package is added from ptest bbcalss
* the PN is back, allow empty and add rdepends on net-snmp-client
in case the user try to add net-snmp to the image
- Add a patch to fix the output format for ptest
- Add run-ptest
- Add rdepends on perl for ptest
(LOCAL REV: NOT UPSTREAM) -- Sent to meta-networking on 20150114
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Since net-snmp-config is a common tool, move it from dev package
to client package.
Signed-off-by: yzhu1 <yanjun.zhu@windriver.com>
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Changes:
1. Add source function and status command.
2. make it possible to change the start arguments with a default file
in the same way as debian.
3. change the default INITSCRIPT_PARAMS
4. Add PIDFILE and fix restart
5. remove the postrm sicne we use the one from update-rc.d
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
LIB_LDCONFIG_CMD failed since it is using a host dir $(libdir)
which is /usr/lib64 does not exist on host when compile 64bit
image.
In fact, configuring dynamic linker run-time bindings is meaningless
at this step, If it is needed, Poky would write ldconfig scripts to
rpm-postinst for each recipe while do_package, in package.bbclass.
Signed-off-by: Roy.Li <rongqing.li@windriver.com>
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Move persistent dir to /var/lib/net-snmp and fix security contexts for
them.
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
According to the following commit, net-snmp needs to have
mib-modules=smux enabled:
commit f64db3011c
Author: Aws Ismail <aws.ismail@windriver.com>
Date: Mon Mar 25 11:30:06 2013 -0400
Quagga has no snmp support, unrecognized options --enable-tcp-md5
1. Quagga's tcp-md5 has been renamed to linux24-tcp-md5
2. net-snmp needs to have mib-modules=smux enabled to enable
quagga to support snmp. Make the net-snmp option dependent
on the DISTRO_FEATURE snmp.
3. Misc: install the sample conf files for quagga. Also,
Make sure that the post install script is being run
on the target rather than during the rootfs creation
stage.
Signed-off-by: Amy Fong <amy.fong@windriver.com>
Signed-off-by: Aws Ismail <aws.ismail@windriver.com>
Signed-off-by: Joe MacDonald <joe.macdonald@windriver.com>
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Previously, it still was checked when there was no nlish.h in sysroots directory.
Add knob to decide whether nlist.h are checked or not.
Fixed by using PACKAGECONFIG to check elf, with default disabled set.
Signed-off-by: Chong Lu <Chong.Lu@windriver.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Link file /usr/lib/sendmail points to /usr/sbin/sendmail is required by
LSB core test according to Linux FHS[Ref2]: "For historical reasons,
/usr/lib/sendmail must be a symbolic link to /usr/sbin/sendmail if the
latter exists."
The linke file was provided by package lsb before, but should be
provided by packages which provides command sendmail such as msmtp,
postfix and esmtp etc.
Refs:
1 http://refspecs.linuxfoundation.org/LSB_4.1.0/LSB-Core-generic/LSB-Core-generic/normativerefs.html#STD.
2 http://www.pathname.com/fhs/pub/fhs-2.3.html#SPECIFICOPTIONS13
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
esmtp use 'sbinsendmail' to define alternative ${sbindir}/sendmail, but
other packages msmtp and postfix use 'sendmail'. When remove esmtp, it
removes ${sbindir}/sendmail even msmtp or postfix is installed which has
alternative ${sbindir}/sendmail.
Make esmtp use 'sendmail' too to fix this issue.
Remove ${libdir}/sendmail which is only used by LSB core test for
historical reasons. And only create link file with fixed path
/usr/lib/sendmail for LSB images even for 64 bits system.
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
crda has a build time dependence on libgcrypt, so move the dependence
from RDEPENDS to DEPENDS.
Otherwise the build fails with:
reglib.c:28:20: fatal error: gcrypt.h: No such file or directory
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
The following vulnerabilities have been fixed.
* [1]wnpa-sec-2015-06
The ATN-CPDLC dissector could crash. ([2]Bug 9952) [3]CVE-2015-2187
* [4]wnpa-sec-2015-07
The WCP dissector could crash. ([5]Bug 10844) [6]CVE-2015-2188
* [7]wnpa-sec-2015-08
The pcapng file parser could crash. ([8]Bug 10895) [9]CVE-2015-2189
* [10]wnpa-sec-2015-09
The LLDP dissector could crash. ([11]Bug 10983) [12]CVE-2015-2190
* [13]wnpa-sec-2015-10
The TNEF dissector could go into an infinite loop. Discovered by
Vlad Tsyrklevich. ([14]Bug 11023) [15]CVE-2015-2191
* [16]wnpa-sec-2015-11
The SCSI OSD dissector could go into an infinite loop. Discovered
by Vlad Tsyrklevich. ([17]Bug 11024) [18]CVE-2015-2192
For more information see
https://www.wireshark.org/docs/relnotes/wireshark-1.12.4.html
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Signed-off-by: Sven Ebenfeld <sven.ebenfeld@gmail.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
The updated yp-tools fails on qemuarm:
/home/jenkins/oe/world/shr-core/tmp-glibc/work/armv5e-oe-linux-gnueabi/yp-tools/3.3-r0/yp-tools-3.3/lib/do_ypcall.c: In function 'do_ypcall_tr':
/home/jenkins/oe/world/shr-core/tmp-glibc/work/armv5e-oe-linux-gnueabi/yp-tools/3.3-r0/yp-tools-3.3/lib/do_ypcall.c:461:27:
error: cast increases required alignment of target type [-Werror=cast-align]
status = ypprot_err (((struct ypresp_val *) resp)->status);
http://errors.yoctoproject.org/Errors/Details/9221/
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Update to the latest stable NIS tools. The yp-tools libraries and headers
conflict with the RPC headers provided by glibc, so install them to a
different location. Systems that intend to build using the NIS-provided
versions will need to specify the alternate location, but that is covered
by pkg-config, so it should only be necessary to point pkg-config at the
alternate .pc file.
The older stable versions are suitable for IPv4-only setups, so keep them
around in case those are required for some systems.
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Both yp-tools and ypbind-mt were out of date with their latest released
versions, so bump them up to current. Remove two dead patches at the same
time and reorganize the recipes to better follow the preferred OE style.
Finally, the new release includes a new version of the GPLv2 COPYING file,
with a significant amount of whitespace fixes, so update the license
checksum.
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
pcap-config should not be used for determining how to build against
libpcap in a yocto environment.
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Typically the major-version-only link for shared libs are included in the
base package. Move the links into the base packages here, leaving the
un-versioned links in the -dev packages.
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Specifying the plugin directory with a trailing '/' hit this failure in
the install rule:
... snip ...
install-exec-local: $(INSTALLOSX)
@if test "$(plugindir)" != "$(prefix)/lib/sasl2"; then \
echo "********************************************************"; \
echo "* WARNING:"; \
echo "* Plugins are being installed into $(prefix)/lib/sasl2,"; \
echo "* but the library will look for them in $(plugindir)."; \
echo "* You need to make sure that the plugins will eventually"; \
echo "* be in $(plugindir) -- the easiest way is to make a"; \
echo "* symbolic link from $(plugindir) to $(prefix)/lib/sasl2,"; \
echo "* but this may not be appropriate for your site, so this"; \
echo "* installation procedure won't do it for you."; \
echo "*"; \
echo "* If you don't want to do this for some reason, you can"; \
echo "* set the location where the library will look for plugins"; \
echo "* by setting the environment variable SASL_PATH to the path"; \
echo "* the library should use."; \
echo "********************************************************"; \
fi
Work around that.
Signed-off-by: Bian Naimeng <biannm@cn.fujitsu.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
configure: error: Header file pcap.h not found; if you installed libpcap
don't use pcap. Use the internal version.
And minor configure cleanups
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Directory /var/run/openvpn is required by service.
Signed-off-by: Bian Naimeng <biannm@cn.fujitsu.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
CRDA has been relicensed under the copyleft-next license.
Regulatory bins license remains ISC.
There is an new internal library called libreg.so which was
placed in the same directory of the regulatory bin. The call
to make was adjusted accordingly.
Remove version 1.1.3.
Signed-off-by: Hugo Vasconcelos Saldanha <hugo.saldanha@aker.com.br>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Details: http://errors.yoctoproject.org/Errors/Details/8936/
The configure failure can cause an OOM on the system, so we will shut this
down immediately.
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Option -LS does not work, we should instead it by -Ls as usage said.
Deprecated options:
-l FILE use -Lf <FILE> instead
-P use -p instead
-s use -Lsd instead
-S d|i|0-7 use -Ls <facility> instead
Signed-off-by: Bian Naimeng <biannm@cn.fujitsu.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
