From cddeb4fbc4e7d9573ef9be77cafefdc5ff77e4fd Mon Sep 17 00:00:00 2001 From: Randy MacLeod Date: Fri, 15 Sep 2017 11:23:25 -0400 Subject: rsyslog: update from 8.22 to 8.29 Drop two patches: CVE-2017-12588.patch 0001-core-bugfix-segfault-after-configuration-errors.patch since they are included in 8.29. Update the testbench configuration flags. Signed-off-by: Randy MacLeod Signed-off-by: Martin Jansa --- ...ugfix-segfault-after-configuration-errors.patch | 90 ------------ .../rsyslog/rsyslog/CVE-2017-12588.patch | 40 ------ meta-oe/recipes-extended/rsyslog/rsyslog_8.22.0.bb | 153 --------------------- meta-oe/recipes-extended/rsyslog/rsyslog_8.29.0.bb | 151 ++++++++++++++++++++ 4 files changed, 151 insertions(+), 283 deletions(-) delete mode 100644 meta-oe/recipes-extended/rsyslog/rsyslog/0001-core-bugfix-segfault-after-configuration-errors.patch delete mode 100644 meta-oe/recipes-extended/rsyslog/rsyslog/CVE-2017-12588.patch delete mode 100644 meta-oe/recipes-extended/rsyslog/rsyslog_8.22.0.bb create mode 100644 meta-oe/recipes-extended/rsyslog/rsyslog_8.29.0.bb (limited to 'meta-oe/recipes-extended') diff --git a/meta-oe/recipes-extended/rsyslog/rsyslog/0001-core-bugfix-segfault-after-configuration-errors.patch b/meta-oe/recipes-extended/rsyslog/rsyslog/0001-core-bugfix-segfault-after-configuration-errors.patch deleted file mode 100644 index 189ca654aa..0000000000 --- a/meta-oe/recipes-extended/rsyslog/rsyslog/0001-core-bugfix-segfault-after-configuration-errors.patch +++ /dev/null @@ -1,90 +0,0 @@ -From 6d258339802cb9f13d8a4a157a4b74eccb902d8f Mon Sep 17 00:00:00 2001 -From: Rainer Gerhards -Date: Mon, 17 Jul 2017 15:36:32 +0200 -Subject: [PATCH] core bugfix: segfault after configuration errors - -rsyslog will segfault on startup if -a) the local machine's hostname is set to a non-FQDN name -b) the getaddrinfo() system call fails -This scenario is higly unlikely, but may exist especially with -provisioned VMs which may not properly be able to do name queries -on startup (seen for example on AWS). - -This patch fixes the situation and also provides more robustness -for very early startup error messages when some of the error-reporting -subsystem is not yet properly initialized. Note that under these -circumstances, errors may only show up on stderr. - -Upstream status: Backport - -closes https://github.com/rsyslog/rsyslog/issues/1573 - -Signed-off-by: Ovidiu Panait ---- - runtime/prop.c | 6 ++++++ - tools/rsyslogd.c | 17 +++++++++-------- - 2 files changed, 15 insertions(+), 8 deletions(-) - -diff --git a/runtime/prop.c b/runtime/prop.c -index e5b4693..cb93285 100644 ---- a/runtime/prop.c -+++ b/runtime/prop.c -@@ -133,7 +133,13 @@ propConstructFinalize(prop_t __attribute__((unused)) *pThis) - */ - static rsRetVal AddRef(prop_t *pThis) - { -+ if(pThis == NULL) { -+ DBGPRINTF("prop/AddRef is passed a NULL ptr - ignoring it " -+ "- further problems may occur\n"); -+ FINALIZE; -+ } - ATOMIC_INC(&pThis->iRefCount, &pThis->mutRefCount); -+finalize_it: - return RS_RET_OK; - } - -diff --git a/tools/rsyslogd.c b/tools/rsyslogd.c -index 759d293..6aa1487 100644 ---- a/tools/rsyslogd.c -+++ b/tools/rsyslogd.c -@@ -808,9 +808,11 @@ logmsgInternal(int iErr, const syslog_pri_t pri, const uchar *const msg, int fla - * permits us to process unmodified config files which otherwise contain a - * supressor statement. - */ -- if(((Debug == DEBUG_FULL || !doFork) && ourConf->globals.bErrMsgToStderr) || iConfigVerify) { -+ int emit_to_stderr = (ourConf == NULL) ? 1 : ourConf->globals.bErrMsgToStderr; -+ if(((Debug == DEBUG_FULL || !doFork) && emit_to_stderr) || iConfigVerify) { - if(pri2sev(pri) == LOG_ERR) -- fprintf(stderr, "rsyslogd: %s\n", (bufModMsg == NULL) ? (char*)msg : bufModMsg); -+ fprintf(stderr, "rsyslogd: %s\n", -+ (bufModMsg == NULL) ? (char*)msg : bufModMsg); - } - - finalize_it: -@@ -1115,18 +1117,17 @@ initAll(int argc, char **argv) - - /* doing some core initializations */ - -- /* get our host and domain names - we need to do this early as we may emit -- * error log messages, which need the correct hostname. -- rgerhards, 2008-04-04 -- */ -- queryLocalHostname(); -- -- /* initialize the objects */ - if((iRet = modInitIminternal()) != RS_RET_OK) { - fprintf(stderr, "fatal error: could not initialize errbuf object (error code %d).\n", - iRet); - exit(1); /* "good" exit, leaving at init for fatal error */ - } - -+ /* get our host and domain names - we need to do this early as we may emit -+ * error log messages, which need the correct hostname. -- rgerhards, 2008-04-04 -+ * But we need to have imInternal up first! -+ */ -+ queryLocalHostname(); - - /* END core initializations - we now come back to carrying out command line options*/ - --- -2.10.2 - diff --git a/meta-oe/recipes-extended/rsyslog/rsyslog/CVE-2017-12588.patch b/meta-oe/recipes-extended/rsyslog/rsyslog/CVE-2017-12588.patch deleted file mode 100644 index 73c33109f6..0000000000 --- a/meta-oe/recipes-extended/rsyslog/rsyslog/CVE-2017-12588.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 6bc4aa975a83abed43d734299ce76cd9e1a14aec Mon Sep 17 00:00:00 2001 -From: Thomas Deutschmann -Date: Wed, 17 May 2017 23:05:24 +0200 -Subject: [PATCH] imzmq3: Fix building with -Werror=format-security - -Reference: https://nvd.nist.gov/vuln/detail/CVE-2017-12588 - -CVE: 2017-12588 - -Upstream-Status: Backport -Signed-off-by: Chen Qi ---- - contrib/imzmq3/imzmq3.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/contrib/imzmq3/imzmq3.c b/contrib/imzmq3/imzmq3.c -index 9ca17871..d32dcbc2 100644 ---- a/contrib/imzmq3/imzmq3.c -+++ b/contrib/imzmq3/imzmq3.c -@@ -403,7 +403,7 @@ static rsRetVal createSocket(instanceConf_t* info, void** sock) { - - /* Do the bind/connect... */ - if (info->action==ACTION_CONNECT) { -- rv = zsocket_connect(*sock, info->description); -+ rv = zsocket_connect(*sock, "%s", info->description); - if (rv == -1) { - errmsg.LogError(0, - RS_RET_INVALID_PARAMS, -@@ -413,7 +413,7 @@ static rsRetVal createSocket(instanceConf_t* info, void** sock) { - } - DBGPRINTF("imzmq3: connect for %s successful\n",info->description); - } else { -- rv = zsocket_bind(*sock, info->description); -+ rv = zsocket_bind(*sock, "%s", info->description); - if (rv == -1) { - errmsg.LogError(0, - RS_RET_INVALID_PARAMS, --- -2.13.0 - diff --git a/meta-oe/recipes-extended/rsyslog/rsyslog_8.22.0.bb b/meta-oe/recipes-extended/rsyslog/rsyslog_8.22.0.bb deleted file mode 100644 index 597a0c8dcb..0000000000 --- a/meta-oe/recipes-extended/rsyslog/rsyslog_8.22.0.bb +++ /dev/null @@ -1,153 +0,0 @@ -SUMMARY = "Rsyslog is an enhanced multi-threaded syslogd" -DESCRIPTION = "\ -Rsyslog is an enhanced syslogd supporting, among others, MySQL,\ - PostgreSQL, failover log destinations, syslog/tcp, fine grain\ - output format control, high precision timestamps, queued operations\ - and the ability to filter on any message part. It is quite\ - compatible to stock sysklogd and can be used as a drop-in replacement.\ - Its advanced features make it suitable for enterprise-class,\ - encryption protected syslog relay chains while at the same time being\ - very easy to setup for the novice user." - -DEPENDS = "zlib libestr libfastjson bison-native flex-native liblogging" -HOMEPAGE = "http://www.rsyslog.com/" -LICENSE = "GPLv3 & LGPLv3 & Apache-2.0" -LIC_FILES_CHKSUM = "file://COPYING;md5=51d9635e646fb75e1b74c074f788e973 \ - file://COPYING.LESSER;md5=cb7903f1e5c39ae838209e130dca270a \ - file://COPYING.ASL20;md5=052f8a09206615ab07326ff8ce2d9d32\ -" - -SRC_URI = "http://www.rsyslog.com/download/files/download/rsyslog/${BPN}-${PV}.tar.gz \ - file://initscript \ - file://rsyslog.conf \ - file://rsyslog.logrotate \ - file://use-pkgconfig-to-check-libgcrypt.patch \ - file://run-ptest \ - file://rsyslog-fix-ptest-not-finish.patch \ - file://CVE-2017-12588.patch \ - file://0001-core-bugfix-segfault-after-configuration-errors.patch \ -" - -SRC_URI_append_libc-musl = " \ - file://0001-Undefine-GLOB_BRACE.patch \ - file://0001-Include-sys-time-h.patch \ -" - -SRC_URI[md5sum] = "ad0f25f429aa2daa326732950a5eeb6c" -SRC_URI[sha256sum] = "06e2884181333dccecceaca82827ae24ca7a258b4fbf7b1e07a80d4caae640ca" - -inherit autotools pkgconfig systemd update-rc.d ptest - -EXTRA_OECONF += "--disable-generate-man-pages ap_cv_atomic_builtins=yes" - -# first line is default yes in configure -PACKAGECONFIG ??= " \ - rsyslogd rsyslogrt klog inet regexp uuid libgcrypt \ - imdiag gnutls imfile \ - ${@bb.utils.filter('DISTRO_FEATURES', 'snmp systemd', d)} \ - ${@bb.utils.contains('DISTRO_FEATURES', 'ptest', 'testbench relp ${VALGRIND}', '', d)} \ -" - -# default yes in configure -PACKAGECONFIG[relp] = "--enable-relp,--disable-relp,librelp," -PACKAGECONFIG[rsyslogd] = "--enable-rsyslogd,--disable-rsyslogd,," -PACKAGECONFIG[rsyslogrt] = "--enable-rsyslogrt,--disable-rsyslogrt,," -PACKAGECONFIG[inet] = "--enable-inet,--disable-inet,," -PACKAGECONFIG[klog] = "--enable-klog,--disable-klog,," -PACKAGECONFIG[regexp] = "--enable-regexp,--disable-regexp,," -PACKAGECONFIG[uuid] = "--enable-uuid,--disable-uuid,util-linux," -PACKAGECONFIG[libgcrypt] = "--enable-libgcrypt,--disable-libgcrypt,libgcrypt," -PACKAGECONFIG[testbench] = "--enable-testbench,--disable-testbench,," - -# default no in configure -PACKAGECONFIG[debug] = "--enable-debug,--disable-debug,," -PACKAGECONFIG[imdiag] = "--enable-imdiag,--disable-imdiag,," -PACKAGECONFIG[imfile] = "--enable-imfile,--disable-imfile,," -PACKAGECONFIG[snmp] = "--enable-snmp,--disable-snmp,net-snmp," -PACKAGECONFIG[gnutls] = "--enable-gnutls,--disable-gnutls,gnutls," -PACKAGECONFIG[systemd] = "--with-systemdsystemunitdir=${systemd_unitdir}/system/,--without-systemdsystemunitdir,systemd," -PACKAGECONFIG[mysql] = "--enable-mysql,--disable-mysql,mysql5," -PACKAGECONFIG[postgresql] = "--enable-pgsql,--disable-pgsql,postgresql," -PACKAGECONFIG[libdbi] = "--enable-libdbi,--disable-libdbi,libdbi," -PACKAGECONFIG[mail] = "--enable-mail,--disable-mail,," -PACKAGECONFIG[valgrind] = "--enable-valgrind,--disable-valgrind,valgrind," - -TESTDIR = "tests" -do_compile_ptest() { - echo 'buildtest-TESTS: $(check_PROGRAMS)' >> ${TESTDIR}/Makefile - oe_runmake -C ${TESTDIR} buildtest-TESTS -} - -do_install_ptest() { - # install the tests - cp -rf ${S}/${TESTDIR} ${D}${PTEST_PATH} - cp -rf ${B}/${TESTDIR} ${D}${PTEST_PATH} - - # do NOT need to rebuild Makefile itself - sed -i 's/^Makefile:.*$/Makefile:/' ${D}${PTEST_PATH}/${TESTDIR}/Makefile - - # fix the srcdir, top_srcdir - sed -i 's,^\(srcdir = \).*,\1${PTEST_PATH}/tests,' ${D}${PTEST_PATH}/${TESTDIR}/Makefile - sed -i 's,^\(top_srcdir = \).*,\1${PTEST_PATH}/tests,' ${D}${PTEST_PATH}/${TESTDIR}/Makefile - - # valgrind is not compatible with arm and mips, - # so remove related test cases if there is no valgrind. - if [ x${VALGRIND} = x ]; then - sed -i '/udp-msgreduc-/d' ${D}${PTEST_PATH}/${TESTDIR}/Makefile - fi - - # install test-driver - install -m 644 ${S}/test-driver ${D}${PTEST_PATH} - - # install necessary links - install -d ${D}${PTEST_PATH}/tools - ln -sf ${sbindir}/rsyslogd ${D}${PTEST_PATH}/tools/rsyslogd - - install -d ${D}${PTEST_PATH}/runtime - install -d ${D}${PTEST_PATH}/runtime/.libs - ( - cd ${D}/${libdir}/rsyslog - allso="*.so" - for i in $allso; do - ln -sf ${libdir}/rsyslog/$i ${D}${PTEST_PATH}/runtime/.libs/$i - done - ) - - # fix the module load path with runtime/.libs - find ${D}${PTEST_PATH}/${TESTDIR} -name "*.conf" -o -name "*.sh" -o -name "*.c" | xargs \ - sed -i -e 's:../plugins/.*/.libs/:../runtime/.libs/:g' -} - -do_install_append() { - install -d "${D}${sysconfdir}/init.d" - install -d "${D}${sysconfdir}/logrotate.d" - install -m 755 ${WORKDIR}/initscript ${D}${sysconfdir}/init.d/syslog - install -m 644 ${WORKDIR}/rsyslog.conf ${D}${sysconfdir}/rsyslog.conf - install -m 644 ${WORKDIR}/rsyslog.logrotate ${D}${sysconfdir}/logrotate.d/logrotate.rsyslog -} - -FILES_${PN} += "${bindir}" - -INITSCRIPT_NAME = "syslog" -INITSCRIPT_PARAMS = "defaults" - -CONFFILES_${PN} = "${sysconfdir}/rsyslog.conf" - -RCONFLICTS_${PN} = "busybox-syslog sysklogd syslog-ng" - -RPROVIDES_${PN} += "${PN}-systemd" -RREPLACES_${PN} += "${PN}-systemd" -RCONFLICTS_${PN} += "${PN}-systemd" -SYSTEMD_SERVICE_${PN} = "${BPN}.service" - -RDEPENDS_${PN} += "logrotate" - -# for rsyslog-ptest -VALGRIND = "valgrind" -VALGRIND_mips = "" -VALGRIND_mips64 = "" -VALGRIND_mips64n32 = "" -VALGRIND_arm = "" -VALGRIND_aarch64 = "" -RDEPENDS_${PN}-ptest += "make diffutils gzip bash gawk coreutils procps" -RRECOMMENDS_${PN}-ptest += "${TCLIBC}-dbg ${VALGRIND}" diff --git a/meta-oe/recipes-extended/rsyslog/rsyslog_8.29.0.bb b/meta-oe/recipes-extended/rsyslog/rsyslog_8.29.0.bb new file mode 100644 index 0000000000..7056e1c6ad --- /dev/null +++ b/meta-oe/recipes-extended/rsyslog/rsyslog_8.29.0.bb @@ -0,0 +1,151 @@ +SUMMARY = "Rsyslog is an enhanced multi-threaded syslogd" +DESCRIPTION = "\ +Rsyslog is an enhanced syslogd supporting, among others, MySQL,\ + PostgreSQL, failover log destinations, syslog/tcp, fine grain\ + output format control, high precision timestamps, queued operations\ + and the ability to filter on any message part. It is quite\ + compatible to stock sysklogd and can be used as a drop-in replacement.\ + Its advanced features make it suitable for enterprise-class,\ + encryption protected syslog relay chains while at the same time being\ + very easy to setup for the novice user." + +DEPENDS = "zlib libestr libfastjson bison-native flex-native liblogging" +HOMEPAGE = "http://www.rsyslog.com/" +LICENSE = "GPLv3 & LGPLv3 & Apache-2.0" +LIC_FILES_CHKSUM = "file://COPYING;md5=51d9635e646fb75e1b74c074f788e973 \ + file://COPYING.LESSER;md5=cb7903f1e5c39ae838209e130dca270a \ + file://COPYING.ASL20;md5=052f8a09206615ab07326ff8ce2d9d32\ +" + +SRC_URI = "http://www.rsyslog.com/download/files/download/rsyslog/${BPN}-${PV}.tar.gz \ + file://initscript \ + file://rsyslog.conf \ + file://rsyslog.logrotate \ + file://use-pkgconfig-to-check-libgcrypt.patch \ + file://run-ptest \ + file://rsyslog-fix-ptest-not-finish.patch \ +" + +SRC_URI_append_libc-musl = " \ + file://0001-Undefine-GLOB_BRACE.patch \ + file://0001-Include-sys-time-h.patch \ +" + +SRC_URI[md5sum] = "3805617f65a4b4bea34606487a5255a0" +SRC_URI[sha256sum] = "220ba30b5afb0f3ddb328613fea7aa3966b01e4d0c52d6de9ab27b0858f19738" + +inherit autotools pkgconfig systemd update-rc.d ptest + +EXTRA_OECONF += "--disable-generate-man-pages ap_cv_atomic_builtins=yes" + +# first line is default yes in configure +PACKAGECONFIG ??= " \ + rsyslogd rsyslogrt klog inet regexp uuid libgcrypt \ + imdiag gnutls imfile \ + ${@bb.utils.filter('DISTRO_FEATURES', 'snmp systemd', d)} \ + ${@bb.utils.contains('DISTRO_FEATURES', 'ptest', 'testbench relp ${VALGRIND}', '', d)} \ +" + +# default yes in configure +PACKAGECONFIG[relp] = "--enable-relp,--disable-relp,librelp," +PACKAGECONFIG[rsyslogd] = "--enable-rsyslogd,--disable-rsyslogd,," +PACKAGECONFIG[rsyslogrt] = "--enable-rsyslogrt,--disable-rsyslogrt,," +PACKAGECONFIG[inet] = "--enable-inet,--disable-inet,," +PACKAGECONFIG[klog] = "--enable-klog,--disable-klog,," +PACKAGECONFIG[regexp] = "--enable-regexp,--disable-regexp,," +PACKAGECONFIG[uuid] = "--enable-uuid,--disable-uuid,util-linux," +PACKAGECONFIG[libgcrypt] = "--enable-libgcrypt,--disable-libgcrypt,libgcrypt," +PACKAGECONFIG[testbench] = "--enable-testbench --enable-omstdout,--disable-testbench --disable-omstdout,," + +# default no in configure +PACKAGECONFIG[debug] = "--enable-debug,--disable-debug,," +PACKAGECONFIG[imdiag] = "--enable-imdiag,--disable-imdiag,," +PACKAGECONFIG[imfile] = "--enable-imfile,--disable-imfile,," +PACKAGECONFIG[snmp] = "--enable-snmp,--disable-snmp,net-snmp," +PACKAGECONFIG[gnutls] = "--enable-gnutls,--disable-gnutls,gnutls," +PACKAGECONFIG[systemd] = "--with-systemdsystemunitdir=${systemd_unitdir}/system/,--without-systemdsystemunitdir,systemd," +PACKAGECONFIG[mysql] = "--enable-mysql,--disable-mysql,mysql5," +PACKAGECONFIG[postgresql] = "--enable-pgsql,--disable-pgsql,postgresql," +PACKAGECONFIG[libdbi] = "--enable-libdbi,--disable-libdbi,libdbi," +PACKAGECONFIG[mail] = "--enable-mail,--disable-mail,," +PACKAGECONFIG[valgrind] = "--enable-valgrind,--disable-valgrind,valgrind," + +TESTDIR = "tests" +do_compile_ptest() { + echo 'buildtest-TESTS: $(check_PROGRAMS)' >> ${TESTDIR}/Makefile + oe_runmake -C ${TESTDIR} buildtest-TESTS +} + +do_install_ptest() { + # install the tests + cp -rf ${S}/${TESTDIR} ${D}${PTEST_PATH} + cp -rf ${B}/${TESTDIR} ${D}${PTEST_PATH} + + # do NOT need to rebuild Makefile itself + sed -i 's/^Makefile:.*$/Makefile:/' ${D}${PTEST_PATH}/${TESTDIR}/Makefile + + # fix the srcdir, top_srcdir + sed -i 's,^\(srcdir = \).*,\1${PTEST_PATH}/tests,' ${D}${PTEST_PATH}/${TESTDIR}/Makefile + sed -i 's,^\(top_srcdir = \).*,\1${PTEST_PATH}/tests,' ${D}${PTEST_PATH}/${TESTDIR}/Makefile + + # valgrind is not compatible with arm and mips, + # so remove related test cases if there is no valgrind. + if [ x${VALGRIND} = x ]; then + sed -i '/udp-msgreduc-/d' ${D}${PTEST_PATH}/${TESTDIR}/Makefile + fi + + # install test-driver + install -m 644 ${S}/test-driver ${D}${PTEST_PATH} + + # install necessary links + install -d ${D}${PTEST_PATH}/tools + ln -sf ${sbindir}/rsyslogd ${D}${PTEST_PATH}/tools/rsyslogd + + install -d ${D}${PTEST_PATH}/runtime + install -d ${D}${PTEST_PATH}/runtime/.libs + ( + cd ${D}/${libdir}/rsyslog + allso="*.so" + for i in $allso; do + ln -sf ${libdir}/rsyslog/$i ${D}${PTEST_PATH}/runtime/.libs/$i + done + ) + + # fix the module load path with runtime/.libs + find ${D}${PTEST_PATH}/${TESTDIR} -name "*.conf" -o -name "*.sh" -o -name "*.c" | xargs \ + sed -i -e 's:../plugins/.*/.libs/:../runtime/.libs/:g' +} + +do_install_append() { + install -d "${D}${sysconfdir}/init.d" + install -d "${D}${sysconfdir}/logrotate.d" + install -m 755 ${WORKDIR}/initscript ${D}${sysconfdir}/init.d/syslog + install -m 644 ${WORKDIR}/rsyslog.conf ${D}${sysconfdir}/rsyslog.conf + install -m 644 ${WORKDIR}/rsyslog.logrotate ${D}${sysconfdir}/logrotate.d/logrotate.rsyslog +} + +FILES_${PN} += "${bindir}" + +INITSCRIPT_NAME = "syslog" +INITSCRIPT_PARAMS = "defaults" + +CONFFILES_${PN} = "${sysconfdir}/rsyslog.conf" + +RCONFLICTS_${PN} = "busybox-syslog sysklogd syslog-ng" + +RPROVIDES_${PN} += "${PN}-systemd" +RREPLACES_${PN} += "${PN}-systemd" +RCONFLICTS_${PN} += "${PN}-systemd" +SYSTEMD_SERVICE_${PN} = "${BPN}.service" + +RDEPENDS_${PN} += "logrotate" + +# for rsyslog-ptest +VALGRIND = "valgrind" +VALGRIND_mips = "" +VALGRIND_mips64 = "" +VALGRIND_mips64n32 = "" +VALGRIND_arm = "" +VALGRIND_aarch64 = "" +RDEPENDS_${PN}-ptest += "make diffutils gzip bash gawk coreutils procps" +RRECOMMENDS_${PN}-ptest += "${TCLIBC}-dbg ${VALGRIND}" -- cgit 1.2.3-korg