openvpn: bypass check for /sbin/ip on the host

In the commit 'openvpn: use default iproute2 path', the configure flag
to explicitly set the iproute2 path was removed, since busybox now
provides the 'ip' applet at the default path.  However, setting this
flag is necessary to bypass the configure-time check for /sbin/ip on the
host, which will otherwise fail if iproute2 is not installed on the
host.  Add back the flag (pointing to the correct path), and add a
comment to describe why this is necessary.

Signed-off-by: Ben Shelton <ben.shelton@ni.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
apache: add fix for CVE-2014-0117 Security Advisory

The patch comes from upstream:
http://svn.apache.org/viewvc?view=revision&revision=1610674

SECURITY (CVE-2014-0117): Fix a crash in mod_proxy.  In a reverse proxy
configuration, a remote attacker could send a carefully crafted request which
could crash a server process, resulting in denial of service.

Thanks to Marek Kroemeke working with HP's Zero Day Initiative for reporting
this issue.

Submitted by: Edward Lu, breser, covener
Signed-off-by: Zhang Xiao <xiao.zhang@windriver.com>
Signed-off-by: Kai Kang <kai.kang@windriver.com>
phpmyadmin: fix for Security Advisory CVE-2014-5273

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x
before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow
remote authenticated users to inject arbitrary web script or HTML via the
(1) browse table page, related to js/sql.js; (2) ENUM editor page, related
to js/functions.js; (3) monitor page, related to js/server_status_monitor.js;
(4) query charts page, related to js/tbl_chart.js; or (5) table relations
page, related to libraries/tbl_relation.lib.php.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-5273

Signed-off-by: Roy Li <rongqing.li@windriver.com>
phpmyadmin: fix for Security Advisory CVE-2014-5274

Cross-site scripting (XSS) vulnerability in the view operations page in
phpMyAdmin 4.1.x before 4.1.14.3 and 4.2.x before 4.2.7.1 allows remote
authenticated users to inject arbitrary web script or HTML via a crafted
view name, related to js/functions.js.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-5274

Signed-off-by: Roy Li <rongqing.li@windriver.com>
phpmyadmin: fix for Security Advisory CVE-2014-7217

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before
4.0.10.4, 4.1.x before 4.1.14.5, and 4.2.x before 4.2.9.1 allow remote
authenticated users to inject arbitrary web script or HTML via a crafted ENUM
value that is improperly handled during rendering of the (1) table search or (2)
table structure page, related to
libraries/TableSearch.class.php and libraries/Util.class.php.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7217

Signed-off-by: Roy Li <rongqing.li@windriver.com>
webmin: remove init script for gentoo

The configure.initd.gentoo script is used for gentoo, it is invalid for oe. So
remove it to solve the following warning:

webmin-1.700: webmin-module-ajaxterm requires /sbin/runscript, but no providers
in its RDEPENDS [file-rdeps]

Signed-off-by: Chong Lu <Chong.Lu@windriver.com>
ntp: add sntp.service for sntp package

This solves the following warning:

lib32-ntp-4.2.6p5: lib32-ntp: Files/directories were installed but not shipped
  /lib/systemd/system/sntp.service [installed-vs-shipped]

Signed-off-by: Chong Lu <Chong.Lu@windriver.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
ntp: make daemon run under ntp:ntp

Fix the service so that the ntpd daemon is run under ntp:ntp.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Acked-by: Peter A. Bigot <pab@pabigot.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
net-snmp: fix for Security Advisory - CVE-2014-3565

snmplib/mib.c in net-snmp 5.7.0 and earlier, when the -OQ option is used,
allows remote attackers to cause a denial of service (snmptrapd crash) via
a crafted SNMP trap message, which triggers a conversion to the variable
type designated in the MIB file, as demonstrated by a NULL type in an ifMtu
trap message.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3565

Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
polarssl: set LIB_INSTALL_DIR to baselib

This solves the following warning:

polarssl-1.3.8: polarssl: Files/directories were installed but not shipped
  /usr/lib
  /usr/lib/libpolarssl.so.1.3.8
  /usr/lib/libpolarssl.so.7
  /usr/lib/libpolarssl.so
  /usr/lib/libpolarssl.a
  /usr/lib/.debug
  /usr/lib/.debug/libpolarssl.so.1.3.8 [installed-vs-shipped]
polarssl-1.3.8: polarssl requires libpolarssl.so.7()(64bit), but no providers
in its RDEPENDS [file-rdeps]

Signed-off-by: Chong Lu <Chong.Lu@windriver.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
squid: change ksh reference in krb ldap helper to sh

This solves the following warning:

squid-3.4.7: squid requires /bin/bash, /usr/bin/perl, but no providers in its
RDEPENDS [file-rdeps]

Signed-off-by: Chong Lu <Chong.Lu@windriver.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
vpnc: use nativeperl to run perl scripts

inhert perlnative and make sure we use nativeperl
to run perl scripts when compile.

fixed:
| ./makeman.pl
| Can't locate Fatal.pm in @INC

Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
samba: make build deterministic by adding PACKAGECONFIG for valgrind

* No configure option for valgrind, use the ac_cv_header_*
* The PACKAGECONFIG for valgrind is disabled by default

Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
mariadb: change socket location in my.cnf

Change socket location to /var/lib/mysql/mysql.sock. Otherwise, we
could spot errors in systemd systems like below.

mysqladmin: connect to server at 'localhost' failed
error: 'Can't connect to local MySQL server through socket '/tmp/mysql.sock' (2)'
Check that mysqld is running and that the socket: '/tmp/mysql.sock' exists!

This is because mysqld.service is using PrivateTmp=true.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
fftw: s/PN/BPN/

Replace the PN with BPN to fix the multilib build.

The error is:
/ala-lpggp21/bpiolin/intel-x86-64-gplv2-4/bitbake_build/tmp/pkgdata/*/runtime-reverse/lib32-libfftw:
No such file or directory

Because the PN causes the package is named as lib32-liblib32-fftw.

Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
breakpad: correct the file suffix of the symbol file

minidump_stackwalk looks for a .sym file extension. Correct the extension used for the generated file.

Signed-off-by: Anders Darander <anders@chargestorm.se>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
mariadb: use ${PN} for SYSTEMD_AUTO_ENABLE

Use ${PN} instead of hardcoding 'mariadb' so that everything works
fine in case of multilib.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
postgresql: add fix for CVE-2014-0064 Security Advisory

Multiple integer overflows in the path_in and other unspecified
functions in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before
9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote
authenticated users to have unspecified impact and attack vectors, which
trigger a buffer overflow. NOTE: this identifier has been SPLIT due to
different affected versions; use CVE-2014-2669 for the hstore vector.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0064

Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
postgresql: add fix for CVE-2014-0060 Security Advisory

PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12,
9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the
ADMIN OPTION restriction, which allows remote authenticated members of a
role to add or remove arbitrary users to that role by calling the SET
ROLE command before the associated GRANT command.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0060

Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
postgresql: add fix for CVE-2014-0061 Security Advisory

The validator functions for the procedural languages (PLs) in PostgreSQL
before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before
9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to gain
privileges via a function that is (1) defined in another language or (2)
not allowed to be directly called by the user due to permissions.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0061

Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>