Commit Graph

236 Commits

Author SHA1 Message Date
Armin Kuster 76a6070e68 hiawatha: fix url.
files moved under a new dir structure.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-07-24 08:22:45 -07:00
Li Wang 70b1aa0a4c apache2: fix CVE-2020-13950 CVE-2020-35452 CVE-2021-26690 CVE-2021-26691 CVE-2021-30641
CVE-2020-13950:
Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be
made to crash (NULL pointer dereference) with specially crafted
requests using both Content-Length and Transfer-Encoding headers,
leading to a Denial of Service

References:
https://nvd.nist.gov/vuln/detail/CVE-2020-13950

Upstream patches:
https://bugzilla.redhat.com/show_bug.cgi?id=1966738
https://github.com/apache/httpd/commit/8c162db8b65b2193e622b780e8c6516d4265f68b

CVE-2020-35452:
Apache HTTP Server versions 2.4.0 to 2.4.46 A specially
crafted Digest nonce can cause a stack overflow in
mod_auth_digest. There is no report of this overflow
being exploitable, nor the Apache HTTP Server team could
create one, though some particular compiler and/or
compilation option might make it possible, with limited
consequences anyway due to the size (a single byte) and
the value (zero byte) of the overflow

References:
https://nvd.nist.gov/vuln/detail/CVE-2020-35452

Upstream patches:
https://security-tracker.debian.org/tracker/CVE-2020-35452
https://github.com/apache/httpd/commit/3b6431eb9c9dba603385f70a2131ab4a01bf0d3b

CVE-2021-26690:
Apache HTTP Server versions 2.4.0 to 2.4.46 A specially
crafted Cookie header handled by mod_session can cause
a NULL pointer dereference and crash, leading to a
possible Denial Of Service

References:
https://nvd.nist.gov/vuln/detail/CVE-2021-26690

Upstream patches:
https://security-tracker.debian.org/tracker/CVE-2021-26690
https://github.com/apache/httpd/commit/67bd9bfe6c38831e14fe7122f1d84391472498f8

CVE-2021-26691:
In Apache HTTP Server versions 2.4.0 to 2.4.46 a
specially crafted SessionHeader sent by an origin server
could cause a heap overflow

References:
https://nvd.nist.gov/vuln/detail/CVE-2021-26691

Upstream patches:
https://bugzilla.redhat.com/show_bug.cgi?id=1966732
https://github.com/apache/httpd/commit/7e09dd714fc62c08c5b0319ed7b9702594faf49b

CVE-2021-30641:
Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected
matching behavior with 'MergeSlashes OFF'

References:
https://nvd.nist.gov/vuln/detail/CVE-2021-30641

Upstream patches:
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-30641
https://github.com/apache/httpd/commit/6141d5aa3f5cf8f1b89472e7fdb66578810d0ae3

Signed-off-by: Li Wang <li.wang@windriver.com>
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-07-10 11:20:05 -07:00
Changqing Li 8238504903 nginx: fix CVE-2021-23017
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-07-10 11:20:01 -07:00
Armin Kuster c4a4070a46 nostromo: Blacklist and exclude from world builds
Host site is dead.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-29 18:39:03 -07:00
changqing.li@windriver.com 5af79fb5f1 nginx: upgrade 1.17.8 -> 1.19.6
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-12-30 22:26:30 -08:00
changqing.li@windriver.com b647b9566a nginx: upgrade 1.16.1 -> 1.18.0
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-12-30 22:26:30 -08:00
Khem Raj d387720a4e monkey: Correct the install path in init services
Its not in bindir but in sbindir

Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-08-31 23:47:52 -07:00
Khem Raj 7363206d5b monkey: Remove /var/run
This is empty and its a runtime directory which is created by base-files
already

Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-08-31 23:47:52 -07:00
Sakib Sajal fc995b3cfe apache2: upgrade v2.4.43 -> v2.4.46
Minor upgrade inluding bug and CVE fixes, namely:
  - CVE-2020-9490
  - CVE-2020-11984
  - CVE-2020-11993

Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-08-26 14:27:09 -07:00
Khem Raj 45b327ba16 monkey: Upgrade to 1.6.9
Switch to using cmake
Use CMake option to select musl support

Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-08-13 22:32:07 -07:00
Zang Ruochen c07cfc20b2 nostromo: upgrade 1.9.7 -> 1.9.9
Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-07-28 12:23:16 -07:00
Zang Ruochen 10cbc8e3c5 hiawatha: upgrade 10.10 -> 10.11
Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-07-28 12:23:16 -07:00
Zang Ruochen ef17d6f30b apache-websocket: upgrade 0.1.1 -> 0.1.2
Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-07-28 12:23:15 -07:00
Yi Zhao 6f4d0dbfbc apache2: create log/run directory via pkg_postinst
The commit e789c3837c tries to create
log/run directory in initscript/systemd unit file. This is not a correct
method. We should create them in pkg_postinst.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-05-21 20:16:40 -07:00
Changqing Li e789c3837c apache2: fix service start fail
reproduce steps:
1. boot up target
2. scp apache2-2.4.41-r0.1.aarch64.rpm on target
3. rpm -i apache2-2.4.41-r0.1.aarch64.rpm
4. systemctl status apache2

Error:
httpd[7767]: (2)No such file or directory: AH02291: Cannot access directory '/var/log/apache2/' for main error log

with the old way, /var/log/apache2/ is created by service
systemd-tmpfiles-setup during boot, so only works when apache2
already installed before boot, in above scenario,
/var/log/apache2/ will not created. fix by creating it in the
service file. similar fix for sysV system

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-05-14 10:43:48 -07:00
Yi Zhao 6e9f393605 nginx: remove /var/log/nginx when do_install
Remove directory /var/log/nginx when do_install because it is created by
volatiles file.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-05-06 12:51:39 -07:00
Trevor Gamblin b1aa5f7850 apache2: add patch ensuring destdir is empty string
apache2 added cross-compilation support after 2.4.41, but
this conflicts with our own cross-compilation setup and causes
related recipes like apache-websocket to fail to find config
files (due to incorrect file paths) during build:

| cannot open
/ala-lpggp31/tgamblin/yocto/poky.git/build/tmp/work/core2-64-poky-linux/apache-websocket/0.1.1+gitAUTOINC+6968083264-r0/recipe-sysroot/ala-lpggp31/tgamblin/yocto/poky.git/build/tmp/work/core2-64-poky-linux/apache-websocket/0.1.1+gitAUTOINC+6968083264-r0/recipe-sysroot//usr/share/apache2/build/config_vars.mk:
No such file or directory at
/ala-lpggp31/tgamblin/yocto/poky.git/build/tmp/work/core2-64-poky-linux/apache-websocket/0.1.1+gitAUTOINC+6968083264-r0/recipe-sysroot/usr/bin/crossscripts/apxs
line 213.

Add this patch to ensure that the $destdir
variable used in apache2's cross-compilation scheme is always
the empty string so that apache-websocket can find the right
files.

Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-04-17 19:05:58 -07:00
Trevor Gamblin e9252506c3 apache2: upgrade 2.4.41 -> 2.4.43
LICENSE file was updated due to a typo fix.

Note that this upgrade fixes two CVES affecting versions
2.4.41 and earlier:

CVE: CVE-2020-1927
CVE: CVE-2020-1934

See:
https://nvd.nist.gov/vuln/detail/CVE-2020-1927
https://nvd.nist.gov/vuln/detail/CVE-2020-1934

Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-04-17 19:05:58 -07:00
Wang Mingyu 553dfcde3d nostromo: upgrade 1.9.6 -> 1.9.7
Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-04-01 23:32:54 -07:00
Changqing Li fc8f28c611 nginx: fix error during service startup
fix below error:
nginx.service: failed to parse pid from file /run/nginx/nginx.pid:
invalid argument

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-02-26 07:17:58 -08:00
Derek Straka 4cc894ad99 nginx: update to the latest development version (1.17.8)
See Changelog: https://nginx.org/en/CHANGES

Signed-off-by: Derek Straka <derek@asterius.io>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-02-09 22:31:31 -08:00
Derek Straka 7e37a79e24 nginx: update to the latest stable version (1.16.1)
See changlog here: https://nginx.org/en/CHANGES-1.16
  * Fixes CVE-2019-9511, CVE-2019-9513, CVE-2019-9516

Signed-off-by: Derek Straka <derek@asterius.io>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-02-09 22:31:31 -08:00
Pierre-Jean Texier 9cc9bd0bd6 hiawatha: upgrade 10.7 -> 10.10
See full changelog https://www.hiawatha-webserver.org/changelog

Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-02-03 12:54:21 -08:00
Khem Raj 1da85ce7d1 cherokee: Replace using BBPATH with BBFILE_COLLECTIONS for meta-python2 check
BBPATH check actually does not work

Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-01-22 19:21:39 -08:00
Khem Raj 613a05bfc7 recipes: Turn inherit classes from meta-py2 to conditional constructs
helps parsing without meta-py2 in mix

Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-01-22 14:20:35 -08:00
Khem Raj 7df11a27a0 cherokee: Only build with meta-py2 is in layermix
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-01-22 09:56:35 -08:00
Khem Raj 698c36f584 cherokee: Use python3 native during build
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-01-22 09:56:34 -08:00
Gaylord Charles 35dddf62f5 nginx: fix install paths
This patch fixes Nginx install paths. I tried to build the native variant
for testing purpose and had errors.

- Use path variable instead of /usr
- Replace the absolute path symlink with a relative one

Signed-off-by: Gaylord CHARLES <gaylord.charles@veo-labs.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-11-17 12:34:21 -08:00
Khem Raj 037dc77fa7 cherokee: Fix build when time_t is 64bit
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-11-11 21:21:13 -08:00
Khem Raj bc3b2149d0 cherokee: Update to latest
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-11-10 07:52:39 -08:00
Yi Zhao 540df694e4 apache-websocket: fix module path
The apache2 module's path has been changed from ${libdir} to
${libexecdir} in commit 8d4d608b4e.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-09-10 06:54:01 -07:00
Kai Kang 8d4d608b4e apache2: fix multilib file conflicts
There are errors of apache2 about files conflicts when multilib enabled:

| Error: Transaction check error:
|   file /etc/apache2/extra/httpd-ssl.conf conflicts between attempted installs of lib32-apache2-2.4.41-r0.core2_32 and apache2-2.4.41-r0.core2_64
|   file /etc/apache2/httpd.conf conflicts between attempted installs of lib32-apache2-2.4.41-r0.core2_32 and apache2-2.4.41-r0.core2_64
|   file /usr/sbin/envvars conflicts between attempted installs of lib32-apache2-2.4.41-r0.core2_32 and apache2-2.4.41-r0.core2_64
|   file /usr/sbin/envvars-std conflicts between attempted installs of lib32-apache2-2.4.41-r0.core2_32 and apache2-2.4.41-r0.core2_64

It makes libexecdir point to ${libdir}. Reset to ${libexecdir} which could
eliminate file conflicts of the conf files. And remove /usr/sbin/envvars and
/usr/sbin/envvars-std which only used by apachectl. They only add standard
library path ${libdir} to LD_LIBRARY_PATH, so remove them to avoid multilib
file conflicts.

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-09-05 18:13:44 -07:00
Yi Zhao 992f4bd570 apache2: upgrade 2.4.39 -> 2.4.41
Security fixes:
  CVE-2019-10081
  CVE-2019-9517
  CVE-2019-10098
  CVE-2019-10092
  CVE-2019-10097
  CVE-2019-10082

See: http://www.apache.org/dist/httpd/CHANGES_2.4.41

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-08-20 09:31:16 -07:00
Khem Raj 659ce8b375 sthttpd: Use git SRC_URI instead of github archive
Fixes
SRC_URI uses unstable GitHub archives [src-uri-bad]

Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-07-21 09:40:20 -07:00
nick83ola dd5622ef2b nginx: fix kill path in nginx systemd unit file
the kill utility is located in /bin/kill -> use base_bindir instead of bindir

Signed-off-by: Nicola Lunghi <nick83ola@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-05-27 09:48:07 -07:00
nick83ola acb604775e nginx: add PACKAGECONFIG[http-auth-request]
Signed-off-by: Nicola Lunghi <nick83ola@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-05-27 09:48:07 -07:00
nick83ola 17f6abb622 nginx: update stable version to 1.16.0
The LIC_FILES_CHKSUM needs also to be updated due to the updated year in the
LICENSE file

  - * Copyright (C) 2002-2018 Igor Sysoev
  - * Copyright (C) 2011-2018 Nginx, Inc.
  + * Copyright (C) 2002-2019 Igor Sysoev
  + * Copyright (C) 2011-2019 Nginx, Inc.

Signed-off-by: Nicola Lunghi <nick83ola@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-05-27 09:48:07 -07:00
nick83ola 0ea5589b40 nginx: update to version 1.17.0
The LIC_FILES_CHKSUM needs also to be updated due to the updated year in the
LICENSE file

  - * Copyright (C) 2002-2018 Igor Sysoev
  - * Copyright (C) 2011-2018 Nginx, Inc.
  + * Copyright (C) 2002-2019 Igor Sysoev
  + * Copyright (C) 2011-2019 Nginx, Inc.

Signed-off-by: Nicola Lunghi <nick83ola@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-05-27 09:48:07 -07:00
Alejandro del Castillo 2e59ec2d28 apache2: add all extra/*.conf to conffiles
Signed-off-by: Alejandro del Castillo <alejandro.delcastillo@ni.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-05-23 08:26:15 -07:00
Changqing Li a687e01760 apache2: add back patch for set perlbin
Add back this patch. Without this patch, apxs's shebang will use
perl under hosttools, which can be too long for shebang, and cause
error:
bad interpreter: No such file or directory

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-04-29 10:13:56 -07:00
Peter Kjellerstedt e7f13b68fe apache2: Correct packaging of build and doc related files
The build related files (${datadir}/${BPN}/build and ${bindir}/apxs)
belong in the -dev package, and the manual belong in the -doc package.

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-04-27 10:13:07 -07:00
Peter Kjellerstedt 90558c5316 apache2: Correct appending to SYSROOT_PREPROCESS_FUNCS
A missing space lead to problems if something else was already added to
SYSROOT_PREPROCESS_FUNCS.

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-04-27 10:13:07 -07:00
Yi Zhao 102237efa6 apache-websocket: upgrade to latest git rev
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-04-16 21:07:25 -07:00
Yi Zhao fd526d60d4 apache2: upgrade 2.4.34 -> 2.4.39
* Drop apache2-native recipe.
  Add native to BBCLASSEXTEND in apache2 recipe.

* Refresh patches.
  Drop CVE-2018-11763.patch and apache-configure_perlbin.patch

* Cleanup recipe file. Remove obsolete code.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-04-16 21:07:25 -07:00
Qi.Chen@windriver.com bd4759ee16 apache2: set CVE_PRODUCT
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-03-29 10:35:27 -07:00
André Draszik eaedfa5e0e nginx: add default proxy_params
As per Debian packaging - to use it, see
    https://wiki.debian.org/Nginx/DirectoryStructure#Extra_Parameters

    This file is most commonly included when Nginx is acting
    as a reverse proxy:
        include /etc/nginx/proxy_params;
        proxy_pass http://localhost:8000;

Signed-off-by: André Draszik <andre.draszik@jci.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-01-19 10:06:20 -08:00
André Draszik 22e17bb10c nginx: configuration update
Restructure the main configuration file to simplify custom configuration:
* support inclusion of configuration fragments from subdirectories:
  - /etc/nginx/modules-enabled/*.conf
  - /etc/nginx/conf.d/*.conf
  - /etc/nginx/sites-enabled/*
* default site (port 80):
  - move into /etc/nginx/sites-available/default_server
    and enable via symlink in /etc/nginx/sites-enabled/
  - listen on IPv6
  - drop unneeded example fragments
* configure and enable gzip
* update TLS settings to drop SSLv3 and enable TLSv1.3 for some safer
  defaults
* update remaining bits to follow Debian standard configuration
  https://salsa.debian.org/nginx-team/nginx/blob/62a54a8ba66ee6cc1b4f8a33dab9a6f27a3fdac4/debian/conf/nginx.conf
* drop unneeded example configuration bits from /etc/nginx/*.default

These changes, in particular the configuration fragment
support allow to easily customise nginx based on individual
requirements.
In addition, it is now possible for other recipes / packages
to drop fragments into the respective directories in /etc/nginx
without having to meddle with /etc/nginx/nginx.conf

Signed-off-by: André Draszik <andre.draszik@jci.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-01-19 10:06:20 -08:00
André Draszik a0eadda910 nginx: update systemd unit using nginx recommendation
Our systemd unit doesn't follow the official
recommendation, see
    https://www.nginx.com/resources/wiki/start/topics/examples/systemd/

Most importantly:
* it should start after some additional specific
  targets/units
* using PrivateTmp is a useful security feature, in
  particular to avoid cross domain scripting via the
  temp folder
* using systemd's $MAINPID, we can distinguish between
  multiple running nginx instances correctly

Signed-off-by: André Draszik <andre.draszik@jci.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-01-19 10:06:20 -08:00
Andrej Valek 6356e84d6b nginx: update stable version to 1.14.2
Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2018-12-11 22:13:55 -08:00
Andrej Valek ace39a5ed1 nginx: update to version 1.15.7
Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2018-12-10 09:31:27 -08:00