summaryrefslogtreecommitdiff
path: root/net/xymon
AgeCommit message (Collapse)AuthorFilesLines
2021-04-21revbump for textproc/icuadam1-1/+2
2021-03-14update xymon and xymonclient to version 4.3.30spz19-644/+22
Upstream release notes: Changes for 4.3.30 ================== Various crashes and bugs relating to string handling changes have been fixed, including problems with hostnames with dashes in them. Combostatus tests propagated up from other combostatus tests should now display properly.
2020-11-05*: Recursive revbump from textproc/icu-68.1ryoon1-2/+2
2020-08-17*: revbump after fontconfig bl3 changes (libuuid removal)leot1-2/+2
2020-06-02Revbump for icuadam1-2/+2
2020-03-10librsvg: update bl3.mk to remove libcroco in rust casewiz1-2/+2
recursive bump for the dependency change
2020-03-08*: recursive bump for libffiwiz1-2/+2
2020-01-18*: Recursive revision bump for openssl 1.1.1.jperkin1-1/+2
2019-11-24Update xymon and xymonclient to version 4.3.29.spz20-22/+659
Add patches to xymon from the xymon code repository to fix compatibility issues in 4.3.29. Upstream changelog: Changes for 4.3.29 ================== Several buffer overflow security issues have been resolved, as well as a potential XSS attack on certain CGI interfaces. Although the ability to exploit is limited, all users are urged to upgrade. The assigned CVE numbers are: CVE-2019-13451, CVE-2019-13452, CVE-2019-13455, CVE-2019-13473, CVE-2019-13474, CVE-2019-13484, CVE-2019-13485, CVE-2019-13486 In addition, revisions have been made to a number of places throughout the code to convert the most common sprintf statements to snprintf for safer processing, which should reduce the impact of similar parsing. Additional work on this will continue in the future. The affected CGIs are: history.c (overflow of histlogfn) = CVE-2019-13451 reportlog.c (overflow of histlogfn) = CVE-2019-13452 csvinfo.c (overflow of dbfn) = CVE-2019-13273 csvinfo.c (reflected XSS) = CVE-2019-13274 acknowledge.c (overflow of msgline) = CVE-2019-13455 appfeed.c (overflow of errtxt) = CVE-2019-13484 history.c (overflow of selfurl) = CVE-2019-13485 svcstatus.c (overflow of errtxt) = CVE-2019-13486 We would like to thank the University of Cambridge Computer Security Incident Response Team for their assistance in reporting and helping resolve these issues. Additional Changes: On Linux, a few additional tmpfs volumes are ignored by default on new (or unmodified) installs. This includes /run/user/<uid>, which is a transient, per-session tmpfs on some systems. To re- enable monitoring for this (if you are running services under a user with a login session), you may need to edit the analysis.cfg(5) file. After upgrade, these partitions will no longer be alerted on or tracked, and their associated RRD files may also be removed: /run/user/<uid> (but NOT /run) /dev (but NOT /dev/shm) /sys/fs/cgroup /lib/init/rw The default hard limit for an incoming message has been raised from 10MB to 64MB The secure apache config snippet no longer requires a xymongroups file to be present (and module loaded), since it's not used by default. This will not affect existing installs. A --no-cpu-listing option has been added to xymond_client to suppress the 'top' output in cpu test status messages. The conversation used in SMTP checks has been adjusted to perform a proper "EHLO" greeting against servers, using the host string 'xymonnet'. If the string needs to be adjusted, however, see protocols.cfg(5) "Actual" memory usage (as a percentage) may be >100% on some platforms in certain situations. This alone will not be tagged as "invalid" data and should be graphed in RRD.
2019-11-03net: align variable assignmentsrillig1-6/+6
pkglint -Wall -F --only aligned --only indent -r No manual corrections.
2018-11-14Revbump after cairo 1.16.0 update.kleink1-2/+2
2018-11-12Recursive revbump from hardbuzz-2.1.1ryoon1-2/+2
2018-07-04*: Move SUBST_STAGE from post-patch to pre-configurejperkin1-2/+2
Performing substitutions during post-patch breaks tools such as mkpatches, making it very difficult to regenerate correct patches after making changes, and often leading to substituted string replacements being committed.
2018-04-16Recursive bump for new fribidi dependency in pango.wiz1-2/+2
2018-03-12Recursive bumps for fontconfig and libzip dependency changes.wiz1-1/+2
2017-09-28update xymon + xymonclient to 4.3.28spz20-34/+542
notable changes: OpenSSL 1.1.0 is now supported, and c-ares has been updated While touching the package anyhow, it has been taught to pass down hardening flags, so that the various PKGSRC_USE_ flags now have effect.
2017-09-06Follow some redirects.wiz1-2/+2
2017-05-03chmod the right files, the .sh are just an identical wrapper nowspz1-4/+4
2017-02-12Recursive revbump from fonts/harfbuzzryoon1-2/+2
2017-02-06Recursive bump for harfbuzz's new graphite2 dependency.wiz1-1/+2
2016-12-09update xymon and xymonclient to the current version, 4.3.27spz2-8/+7
Upstream relnotes: Changes for 4.3.27 ================== Fixes for CGI acknowledgements and NK/criticalview web redirects. Xymon should now properly check for lack of SSLv3 (or v2) support at compile- time and exclude the openssl options as needed. Completely empty directories (on Windows) are no longer considered errors. Changes for 4.3.26 ================== This is mostly a bug fix release for javascript issues on the info and trends pages, along with the enable / disable CGI. Several browsers had difficulty with the new CSP rules introduced in 4.3.25. XYMWEBREFRESH is now used as the default refresh interval for dynamic status pages and various other xymongen destinations. Non-svcstatus pages can be overridden by altering the appropriate *_header template files, but svcstatus refresh interval uses this value. (default: 60s) Set in xymonserver.cfg(5). Incoming test names are now restricted to alphanumeric characters, colons dashes, underscores, and slashes. Slashes and colons may be restricted in a future release. Unconfigured (ghost) host names are now restricted to alphanumerics, colons, commas, periods, dashes, and underscores. It is strongly recommended to use only valid hostnames and DNS components in servers names. Files matched multiple times by logfetch in the client config retrieved from config-local.cfg (such as a file matching multiple globs) will now only be scanned once and only use the ignore/trigger rules from its first entry. (Note: A future version of Xymon may combine all matching rules for a file together.) CLASS groupings in analysis.cfg and alerts.cfg will now reliably work for hosts with a CLASS override in hosts.cfg. Previous, this class was not used in favor of the class type sent in on any specific client message.
2016-03-05Bump PKGREVISION for security/openssl ABI bump.jperkin1-1/+2
2016-02-16update of xymon and xymonclient from 4.3.17 to 4.3.25spz4-18/+30
The following security issues are fixed with this update: * Resolve buffer overflow when handling "config" file requests (CVE-2016-2054) * Restrict "config" files to regular files inside the $XYMONHOME/etc/ directory (symlinks disallowed) (CVE-2016-2055). Also, require that the initial filename end in '.cfg' by default * Resolve shell command injection vulnerability in useradm and chpasswd CGIs (CVE-2016-2056) * Tighten permissions on the xymond BFQ used for message submission to restrict access to the xymon user and group. It is now 0620. (CVE-2016-2057) * Restrict javascript execution in current and historical status messages by the addition of appropriate Content-Security-Policy headers to prevent XSS attacks. (CVE-2016-2058) * Fix CVE-2015-1430, a buffer overflow in the acknowledge.cgi script. Thank you to Mark Felder for noting the impact and Martin Lenko for the original patch. * Mitigate CVE-2014-6271 (bash 'Shell shock' vulnerability) by eliminating the shell script CGI wrappers Please refer to https://sourceforge.net/projects/xymon/files/Xymon/4.3.25/Changes/download for further information on fixes and new features.
2015-11-25Remove mk/find-prefix.mk usage from the net category.jperkin1-4/+2
The find-prefix infrastructure was required in a pkgviews world where packages installed from pkgsrc could have different installation prefixes, and this was a way for a dependency prefix to be determined. Now that pkgviews has been removed there is no longer any need for the overhead of this infrastructure. Instead we use BUILDLINK_PREFIX.pkg for dependencies pulled in via buildlink, or LOCALBASE/PREFIX where the dependency is coming from pkgsrc. Provides a reasonable performance win due to the reduction of `pkg_info -qp` calls, some of which were redundant anyway as they were duplicating the same information provided by BUILDLINK_PREFIX.pkg.
2015-11-04Add SHA512 digests for distfiles for net categoryagc1-1/+2
Problems found with existing digests: Package haproxy distfile haproxy-1.5.14.tar.gz 159f5beb8fdc6b8059ae51b53dc935d91c0fb51f [recorded] da39a3ee5e6b4b0d3255bfef95601890afd80709 [calculated] Problems found locating distfiles: Package bsddip: missing distfile bsddip-1.02.tar.Z Package citrix_ica: missing distfile citrix_ica-10.6.115659/en.linuxx86.tar.gz Package djbdns: missing distfile djbdns-1.05-test25.diff.bz2 Package djbdns: missing distfile djbdns-cachestats.patch Package djbdns: missing distfile 0002-dnscache-cache-soa-records.patch Package gated: missing distfile gated-3-5-11.tar.gz Package owncloudclient: missing distfile owncloudclient-2.0.2.tar.xz Package poink: missing distfile poink-1.6.tar.gz Package ra-rtsp-proxy: missing distfile rtspd-src-1.0.0.0.tar.gz Package ucspi-ssl: missing distfile ucspi-ssl-0.70-ucspitls-0.1.patch Package waste: missing distfile waste-source.tar.gz Otherwise, existing SHA1 digests verified and found to be the same on the machine holding the existing distfiles (morden). All existing SHA1 digests retained for now as an audit trail.
2015-04-25Recursive revbump following MesaLib update, categories g through n.tnn1-2/+2
2014-09-21fix inode checks for NetBSDspz4-6/+30
fix inode check result rrd handling for all BSDish systems; if you use xymon-4.3.17nb1 on *BSD you may have lots of inode<number>.rrd files in /var/xymon/rrd, since it used iavail instead of the name of the filesystem mount to identify the inode usage stats.
2014-07-25Pass RPATH into the environment, fixes check-shlibs-elf.jperkin1-1/+2
2014-05-05Recursive revbump from x11/pixmanryoon1-1/+2
Fix PR pkg/48777
2014-03-11Remove example rc.d scripts from PLISTs.jperkin1-2/+1
These are now handled dynamically if INIT_SYSTEM is set to "rc.d", or ignored otherwise.
2014-02-27file escaped cvs add: from PR 48575spz1-0/+28
2014-02-27Update to 4.3.17. The last two teeny versions were for bug fixes.spz5-66/+86
Also contains the inode check expansion for NetBSD from PR 48575 Upstream changelog: Changes for 4.3.15 - 4.3.17 =========================== No significant changes. Changes for 4.3.14 ================== In previous Xymon versions, a client-only configuration (i.e. one configured with "./configure --client") would place the client files in a "client" subdirectory below the directory specified during configuration. This is the same directory layout as a server installation, where the server and client parts of Xymon are in separate subdirectories. In 4.3.14, the default has changed so a client-only installation now installs in the directory given during the configure-step. The "/client" has been eliminated, so if you are upgrading an existing client you must either move the old client installation one level up from the "client/" directory, or change the Makefile generated by "configure --client" and add "/client" to the XYMONTOPDIR setting. The SNI support added in 4.3.13 causes problems with some older webservers, whose SSL implementation cannot handshake correctly when SNI is used. The failed handshake causes Xymon to report the site as down. In 4.3.14, the default is changed so SNI is disabled. A new "--sni" option was added to xymonnet to control the default setting, and two new tags "sni" and "nosni" can be used in hosts.cfg to control SNI for each host that is tested. Changes for 4.3.13 ================== This is mostly a bugfix release. Apart from simple bugs (see the Changes file), there are some enhancements: Alerts sent via e-mail have <CR><NL> line-endings converted to plain <NL>, since the carriage-return characters would cause some mailers to send alerts as a (binary) attachment to an empty mail message. https-URL's can be forced to use TLS only, by using "httpst://..." similar to how SSLv2 and SSLv3 can be chosen. SSL connections (e.g. for https URL's) now use the TLS "Server Name Indication" (SNI) if your OpenSSL library supports it. This allows testing of systems that have multiple SSL websites located on the same physical IP+port (i.e. virtual name-based hosts). Changes for 4.3.12 ================== NOTE: This release includes a bugfix for a security issue in the xymond_history and xymond_rrd modules. A "drophost" command sent to the xymond port (default: 1984) from an IP listed in the --admin-senders access control list can be used to delete files owned by the user running the xymond daemon. This is allowed by default, so it is highly recommended to install this update. Changes for 4.3.2 - 4.3.11 ========================== See the Changes file for a list of significant changes. These releases are mostly to fix bugs. NOTE: Some configuration parameters have changed, so you must regenerate the top-level Makefile by running the "configure" script before compiling the new version. The inode-check introduced in 4.3.8 and 4.3.10 requires that you update both the Xymon server installation and the Xymon client on the systems where you want to monitor how many inodes are being used.
2014-02-12Recursive PKGREVISION bump for OpenSSL API version bump.tron1-2/+2
2013-10-10Recursive revbump from pango-1.36.0ryoon1-2/+2
2013-09-02Revbump after cairo updateadam1-2/+2
2013-07-12Bump PKGREVISION of all packages which create users, to pick up change ofjperkin1-2/+2
sysutils/user_* packages.
2013-06-06Bump PKGREVISION for libXft changes for NetBSD native X support onwiz1-2/+2
NetBSD 6, requested by tron.
2013-06-04Try to fix the fallout caused by the fix for PR pkg/47882. Part 3:tron1-2/+2
Recursively bump package revisions again after the "freetype2" and "fontconfig" handling was fixed.
2013-06-03Bump freetype2 and fontconfig dependencies to current pkgsrc versions,wiz1-2/+2
to address issues with NetBSD-6(and earlier)'s fontconfig not being new enough for pango. While doing that, also bump freetype2 dependency to current pkgsrc version. Suggested by tron in PR 47882
2013-03-29Add extra compiler flags to build correctly on Linux.sbd2-1/+24
2013-02-16Recursive bump for png-1.6.wiz1-2/+2
2013-02-06PKGREVISION bumps for the security/openssl 1.0.1d update.jperkin1-2/+2
2012-12-16recursive bump from cyrus-sasl libsasl2 shlib major bump.obache1-1/+2
2012-10-23Drop superfluous PKG_DESTDIR_SUPPORT, "user-destdir" is default these days.asau1-2/+1
2012-10-11- fix FreeBSD/Dragonfly properlyspz9-64/+68
- update to newest version Upstream changelog: Xymon release 4.3.10 - released on Aug 6 2012 ============================================= Main features in this release is the addition of inode-checks on all major platforms, and a series of enhancements to the build procedure. Also, building Xymon on most common platforms is now explicitly described in the "install" document. * Fix build problems with "errno" * Fix build problems with OpenSSL in non-default locations * Fix build problems with certain LDAP configurations * Fix build problems with RRDtool on FreeBSD / OpenBSD * Fix problem with ifstat data from Fedora in graphs * "inode" check on FreeBSD, OpenBSD, OSX, Solaris, HP/UX, AIX in addition to existing support for Linux * Document building and installing Xymon on common platforms (Linux, FreeBSD, OpenBSD, Solaris) * Enhance xymoncfg so it can be used to import Xymon configuration settings into shell-scripts. Xymon release 4.3.9 - released on Jul 24 2012 ============================================= This release is mainly a bug-fix release. * Fix crash when XYMSRV is undefined but XYMSERVERS is * Fix error in calculating combo-status messages with forward references * Fix error in disable-until-TIME or disable-until-OK code * Fix documentation of DURATION in alerts.cfg / xymond_alert so it is consistenly listed as being in "minutes". * Permit explicit use of ">" and ">=" in alerts.cfg * Permit building without the RRDtool libraries, e.g. for a network-tester build, but with trend-graphing disabled. * Full compiler-warning cleanup * Various configuration/build-script issues fixed. Xymon release 4.3.8 - released on Jul 15 2012 ============================================= This release is mainly a bug-fix release. Bugfixes * Workaround for DNS timeout handling, now fixed at approximately 25 seconds. * "hostinfo" command for xymond documented * confreport only shows processes that are monitored * analysis.cfg parsing of COLOR for UP rules was broken * RRD handlers no longer crash after receiving 1 billion updates * Using .netrc for authentication could crash xymonnet * "directory" includes would report the wrong filename for missing directories. * useradm CGI would invoke htpassword twice * "include" and "directory" now ignores trailing whitespace * SSLv2 support disabled if SSL-library does not support it * Minor bugfixes and cleanups of compiler warnings. Enhancements * Service status on info page now links to the detailed status page. * Add RRDGRAPHOPTS setting to permit global user-specified RRD options, e.g. for font to showgraph CGI * Add check for the size of public keys used in SSL certificates (enabled via --sslkeysize=N option for xymonnet) * Optionally disable the display of SSL ciphers in the sslcert status (the --no-cipherlist option for xymonnet) * Improved build-scripts works on newer systems with libraries in new and surprising places * Reduce xymonnet memory usage and runtime for ping tests when there are multiple hosts.cfg entries with the same IP-address. * Add code for inode-monitoring on Linux. Does not currently work on any other client platform. * Added the ability to disable tests until a specific time, instead of for some interval. Disabling a test also now computes the expire time for the disable to happen at the next closest minute.
2012-10-08Revbump after updating graphics/pangoadam1-2/+2
2012-10-02Mass recursive bump after the dependence fix of the "cairo" packagetron1-2/+2
requested by Thomas Klausner.
2012-09-15recursive bump from libffi shlib major bumpobache1-2/+2
(additionaly, reset PKGREVISION of qt4-* sub packages from base qt4 update)
2012-09-07Revbump after updating graphics/cairoadam1-2/+2
2012-08-13net/xymon: Add DragonFly support / fix FreeBSDmarino3-2/+21
* Add Makefile.DragonFly * Fix sha2.c #include <stdint.h>. On last, nothing sets HAVE_STDINT_H and passing -DHAVE_STDINT_H through cflags fails. Just switch it based on __FreeBSD__ and __DragonFly__.
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-03 03:41:59 +0000