aboutsummaryrefslogtreecommitdiffstats
path: root/meta-networking/recipes-protocols/net-snmp/net-snmp
AgeCommit message (Collapse)Author
2020-09-03net-snmp: Fix CVE-2020-15861 and CVE-2020-15862Ovidiu Panait
Net-SNMP through 5.7.3 allows Escalation of Privileges because of UNIX symbolic link (symlink) following. Net-SNMP through 5.7.3 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB provides the ability to run arbitrary commands as root. References: https://nvd.nist.gov/vuln/detail/CVE-2020-15861 https://nvd.nist.gov/vuln/detail/CVE-2020-15862 Upstream patches: https://github.com/net-snmp/net-snmp/commit/2b3e300ade4add03b889e61d610b0db77d300fc3 https://github.com/net-snmp/net-snmp/commit/9cfb38b0aa95363da1466ca81dd929989ba27c1f https://github.com/net-snmp/net-snmp/commit/114e4c2cec2601ca56e8afb1f441520f75a9a312 https://github.com/net-snmp/net-snmp/commit/2968b455e6f182f329746e2bca1043f368618c73 https://github.com/net-snmp/net-snmp/commit/4fd9a450444a434a993bc72f7c3486ccce41f602 https://github.com/net-snmp/net-snmp/commit/77f6c60f57dba0aaea5d8ef1dd94bcd0c8e6d205 CVE-2020-15861-0005.patch is the actual fix for CVE-2020-15861 and CVE-2020-15861-0001.patch through CVE-2020-15861-0004.patch are context patches needed by the fix to apply cleanly. Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-12net-snmp: Security fix CVE-2019-20892Armin Kuster
Source: net-snmp.org MR: 104509 Type: Security Fix Disposition: Backport from https://github.com/net-snmp/net-snmp/commit/5f881d3bf24599b90d67a45cae7a3eb099cd71c9 ChangeID: 206d822029d48d904864f23fd1b1af69dffc26c8 Description: Fixes CVE-2019-20892 which affect net-snmp <= 5.8pre1 Had to fix up some file do to later code restructioning. "int refcnt;" addition was done in include/net-snmp/library/snmpusm.h Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 96a63b1ecf321c9a63880a963ed257086998133b) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-06-12net-snmp: refresh patchesPatrick Williams
Refreshed patches for 5.8 due to the following: ERROR: net-snmp-5.8-r0 do_patch: Command Error: 'quilt --quiltrc .../net-snmp/5.8-r0/recipe-sysroot-native/etc/quiltrc push' exited with 0 Output: Applying patch 0001-Add-pkg-config-support-for-building-applications-and.patch patching file configure ... Hunk #1 succeeded at 32248 with fuzz 2 (offset 1826 lines). Hunk #2 FAILED at 31447. 1 out of 2 hunks FAILED -- rejects in file configure ... Patch 0001-Add-pkg-config-support-for-building-applications-and.patch does not apply (enforce with -f) Signed-off-by: Patrick Williams <patrick@stwcx.xyz> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 9c3b872f846e0a2491fe8bf16ae38db82609938c) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-20net-snmp: Add pkgconfig file supportJeremy Puhlman
Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-02-26net-snmp: fix compile error with --disable-desChangqing Li
| scapi.c: In function 'sc_encrypt': | scapi.c:1256:5: error: 'pad_size' undeclared (first use in this function); did you mean 'dysize'? | pad_size = pai->pad_size; | ^~~~~~~~ | dysize pad_size is defined only without --disable-des [snip] int pad, plast, pad_size = 0; but used when disable-des [snip] QUITFUN(SNMPERR_GENERR, sc_encrypt_quit); } pad_size = pai->pad_size; memset(my_iv, 0, sizeof(my_iv)); if (USM_CREATE_USER_PRIV_DES == (pai->type & USM_PRIV_MASK_ALG)) { /* fix by move it into #ifndef NETSNMP_DISABLE_DES Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2018-11-27net-snmp: inherit ptestKai Kang
Inherit ptest for net-snmp to create ${PN}-ptest. Update run-ptest as well to avoid only could be run in the same directory. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2018-11-26net-snmp: Reproducibility: Set NETSNMP_CONFIGURE_OPTIONS nulldouglas.royds
To avoid build host paths being written into binaries, accept a null NETSNMP_CONFIGURE_OPTIONS from the environment. Upstream-Status: Submitted https://sourceforge.net/p/net-snmp/patches/1384/ Signed-off-by: Douglas Royds <douglas.royds@taitradio.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2018-11-26net-snmp: Reproducibility: Don't check build host for /etc/printcapdouglas.royds
Don't check for /etc/printcap on the build machine when cross-compiling. Use AC_CHECK_FILE to set the cached variable ac_cv_file__etc_printcap instead. When cross-compiling, this variable should be set in the environment to "yes" or "no" as appropriate for the target platform. I have taken the simple expedient of setting ac_cv_file__etc_printcap=no. If this proves to be a problem, we can easily add a new variable, HAS_PRINTCAP. Upstream-Status: Submitted https://sourceforge.net/p/net-snmp/patches/1385/ Signed-off-by: Douglas Royds <douglas.royds@taitradio.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2018-11-26Revert "net-snmp: improve reproducibility"douglas.royds
This reverts commit 57d8e2c673d5f5686bbf411333f1d39c3e29690e. Signed-off-by: Douglas Royds <douglas.royds@taitradio.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2018-09-29net-snmp: improve reproducibilityHongxu Jia
- Remoe prefix ${RECIPE_SYSROOT} from net-snmp-config - Remove configure options from versioninfo Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2018-08-11net-snmp: upgrade 5.7.3 -> 5.8Changqing Li
Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2018-06-25net-snmp: Refresh openssl support patchKhem Raj
Avoid fuzz warnings Signed-off-by: Khem Raj <raj.khem@gmail.com>
2018-06-12net-snmp: add support for openssl 1.1xAndrej Valek
Patch was copied from [https://sourceforge.net/p/net-snmp/patches/1336]. Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2018-04-13net-snmp: refresh patchesArmin Kuster
WARNING: net-snmp-5.7.3-r0 do_patch: Some of the context lines in patches were ignored. This can lead to incorrectly applied patches. The context lines in the patches can be updated with devtool: devtool modify <recipe> devtool finish --force-patch-refresh <recipe> <layer_path> Then the updated patches and the source tree (in devtool's workspace) should be reviewed to make sure the patches apply in the correct place and don't introduce duplicate lines (which can, and does happen when some of the context is ignored). Further information: http://lists.openembedded.org/pipermail/openembedded-core/2018-March/148675.html https://bugzilla.yoctoproject.org/show_bug.cgi?id=10450 Details: Applying patch 0001-BUG-a2584-Fix-snmptrap-to-use-clientaddr-from-snmp.c.patch patching file snmplib/transports/snmpUDPIPv6Domain.c Hunk #1 succeeded at 286 with fuzz 2 (offset 30 lines). Now at patch 0001-BUG-a2584-Fix-snmptrap-to-use-clientaddr-from-snmp.c.patch Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-02-05net-snmp: remove U64 typedefSlater, Joseph
This allows us to build perl modules with recent versions of perl. Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-01-08net-snmp: support openssl without 3desJackie Huang
net-snmp enables 3des support by default and fails to build with distro feature openssl-no-weak-ciphers: | ../../net-snmp-5.7.3/snmplib/scapi.c:82:25: fatal error: openssl/des.h: No such file or directory | #include <openssl/des.h> To fix the issue: * add a patch to include des.h only if it's found in openssl * disable des when openssl-no-weak-ciphers is enabled Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2017-09-12net-snmp: fix engineBoots value on SIGHUPLi Zhou
Store the incremented engineBoots value on SIGHUP. And don't reset engineBoots to 1 when oldEngineIDLength is 0. For the first run, the oldEngineIDLength is 0. When we say first run of the daemon, we talk about the first run ever on the machine, not only first run of every boot. Signed-off-by: Marian Florea <marian.florea@windriver.com> Reviewed-by: Wenkuan Wang <Wenkuan.Wang@windriver.com> Reviewed-by: Zhaolong Zhang <Zhaolong.Zhang@windriver.com> Signed-off-by: Li Zhou <li.zhou@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2017-06-28net-snmp: supported cross compile for the perl embedded and perl modulesWenlin Kang
The patch solves two issues: 1. Supported cross compile for the perl embedded and perl modules. 2. Solved runtime depend issue. Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-12-14net-snmp: snmplib, UDPIPv6 transport: Add a missing return statementLi Zhou
Backport a succeeding commit from net-snmp upstream to fix the issue introduced by commit <BUG#a2584: Fix snmptrap to use clientaddr from snmp.conf>. The missing return will cause crash when binding to a non-exist IPv6 address. Signed-off-by: Li Zhou <li.zhou@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-12-14net-snmp: fix snmptrap to use clientaddr from snmp.conf.Li Zhou
Under IPv6 IP-multihomed environment, the socket does not bind to the clientaddr indicated in snmp.conf when sending snmptrap and it might choose a random one. Backport the patch from net-snmp upstream to fix it. Signed-off-by: Li Zhou <li.zhou@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-09-26net-snmp: Fix build issue found with muslKhem Raj
limits.h is needed for PATH_MAX and NAME_MAX Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2016-07-18net-snmp: fix snmpd crash via AgentX connectionJackie Huang
backport a patch to fixed snmpd crashing when an AgentX subagent disconnect in the middle of processing of a request. Signed-off-by: Zhu Yanjun <yanjun.zhu@windriver.com> Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-01-04net-snmp: apply patch for cross-compilationRafaël Carré
7fb5479 added the patch but did not apply it Rename patch to explicit it differentiate it from other patches Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2015-11-30net-snmp: fix cross compilationRafaël Carré
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2015-11-30net-snmp: Modify snmpd.serviceLi Xin
Add "-a" parameter in snmpd.service,it is needed to address logs. Signed-off-by: Li Xin <lixin.fnst@cn.fujitsu.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2015-10-21net-snmp: Fix build with gcc5Khem Raj
Fix errors seen with gcc5 Change-Id: I9c4361f3a9c25342f5c740263f551c162dce8faf Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2015-09-11net-snmp: upgrade 5.7.2.1 -> 5.7.3Li xin
* Dropped backported patches --ifmib.patch --0001-Added-checks-for-printing-variables-with-wrong-types.patch --0001-Fix-CVE-2014-2285.patch --net-snmp-5.7.2-fix-mib-timeout-values.patch * Update patches --dont-return-incompletely-parsed-varbinds.patch --systemd-support.patch * Add a new patch to avoid build Errors. --0001-config_os_headers-Error-Fix.patch Signed-off-by: Li Xin <lixin.fnst@cn.fujitsu.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2015-08-06net-snmp: fix mib representation of timeout valuesRoy Li
Fix mib representation of timeout values,correct conversion factor from microseconds to centiseconds. Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com> Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2015-07-16net-snmp: don't return incompletely parsed varbindsJian Liu
the snmp_pdu_parse() function could leave incompletely parsed varBind variables in the list of variables in case the parsing of the SNMP PDU failed. If later processing tries to operate on the stale and incompletely processed varBind (e.g. when printing the variables), this can lead to e.g. crashes or, possibly, execution of arbitrary code. The snmp_pdu_parse() function stores varBind variables in a list of netsnmp_variable_list structures. Each time the function parses a new varBind, a new netsnmp_variable_list item is allocated on the heap and linked to the list of variables. The problem is that this item is not removed from the list, even if snmp_pdu_parse() fails to complete the parsing. The "type" member of the stale netsnmp_variable_list is not properly initialized in case snmp_pdu_parse() returns early from the parsing. However, the "type" member is used to determine later code paths, which is why we see crashes in a variety of functions, although the root cause for all of these is the same. This patch come from http://sourceforge.net/p/net-snmp/code/ci/f23bcd3ac6ddee5d0a48f9703007ccc738914791/ Written-by: Robert Story Signed-off-by: Jian Liu <jian.liu@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2015-05-08net-snmp: fix CVE-2014-2285Junling Zheng
The perl_trapd_handler function in perl/TrapReceiver/TrapReceiver.xs in Net-SNMP 5.7.3.pre3 and earlier, when using certain Perl versions, allows remote attackers to cause a denial of service (snmptrapd crash) via an empty community string in an SNMP trap, which triggers a NULL pointer dereference within the newSVpv function in Perl. Refer to: https://bugzilla.redhat.com/show_bug.cgi?id=1072044 Signed-off-by: Junling Zheng <zhengjunling@huawei.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2015-03-11net-snmp: add ptest packageJackie Huang
Issue: TA79430 - Change to use append for PACKAGES so that: * ptest package is added from ptest bbcalss * the PN is back, allow empty and add rdepends on net-snmp-client in case the user try to add net-snmp to the image - Add a patch to fix the output format for ptest - Add run-ptest - Add rdepends on perl for ptest (LOCAL REV: NOT UPSTREAM) -- Sent to meta-networking on 20150114 Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2015-03-11net-snmp: fix "libtool --finish"Jackie Huang
LIB_LDCONFIG_CMD failed since it is using a host dir $(libdir) which is /usr/lib64 does not exist on host when compile 64bit image. In fact, configuring dynamic linker run-time bindings is meaningless at this step, If it is needed, Poky would write ldconfig scripts to rpm-postinst for each recipe while do_package, in package.bbclass. Signed-off-by: Roy.Li <rongqing.li@windriver.com> Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2015-03-11net-snmp: add knob whether nlist.h are checkedChong.Lu@windriver.com
Previously, it still was checked when there was no nlish.h in sysroots directory. Add knob to decide whether nlist.h are checked or not. Fixed by using PACKAGECONFIG to check elf, with default disabled set. Signed-off-by: Chong Lu <Chong.Lu@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2015-02-11snmpd: instead option -LS by -LsBian Naimeng
Option -LS does not work, we should instead it by -Ls as usage said. Deprecated options: -l FILE use -Lf <FILE> instead -P use -p instead -s use -Lsd instead -S d|i|0-7 use -Ls <facility> instead Signed-off-by: Bian Naimeng <biannm@cn.fujitsu.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2014-11-04net-snmp: fix for Security Advisory - CVE-2014-3565Roy Li
snmplib/mib.c in net-snmp 5.7.0 and earlier, when the -OQ option is used, allows remote attackers to cause a denial of service (snmptrapd crash) via a crafted SNMP trap message, which triggers a conversion to the variable type designated in the MIB file, as demonstrated by a NULL type in an ifMtu trap message. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3565 Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2013-06-10net-snmp: Backport fix for NETSNMP_NO_SYSTEMD typosThomas Fitzsimmons
Added Signed-off-by for backport patch refresh. Bumped PR. Signed-off-by: Thomas Fitzsimmons <fitzsim@cisco.com> Signed-off-by: Joe MacDonald <joe.macdonald@windriver.com>
2013-04-26net-snmp: move to meta-networking and tweakPaul Eggleton
* Set SUMMARY instead of DESCRIPTION * Move SRC_URI checksums under SRC_URI * Move packaging definitions to the end Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-05-11 06:42:50 +0000