diff --git a/.gitignore b/.gitignore index 126b35b..9529221 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/radvd-1.9.2.tar.gz +SOURCES/radvd-2.17.tar.xz diff --git a/.radvd.metadata b/.radvd.metadata index 1097f8e..4a480d8 100644 --- a/.radvd.metadata +++ b/.radvd.metadata @@ -1 +1 @@ -5bc39b7bec0d73ffa443634c340e75b54867766c SOURCES/radvd-1.9.2.tar.gz +e6aefd1f94c11c198271622989deefa647a489b5 SOURCES/radvd-2.17.tar.xz diff --git a/SOURCES/radvd-1.9.2-cli-man-help.patch b/SOURCES/radvd-1.9.2-cli-man-help.patch deleted file mode 100644 index 3f16c24..0000000 --- a/SOURCES/radvd-1.9.2-cli-man-help.patch +++ /dev/null @@ -1,35 +0,0 @@ -diff --git a/radvd.8.man b/radvd.8.man -index 0310150..c31d626 100644 ---- a/radvd.8.man -+++ b/radvd.8.man -@@ -71,6 +71,9 @@ This option disables privilege separation, and as a result, - the non-privileged radvd process does not have permissions to - change interface configuration. - .TP -+.BR "\-n" , " \-\-nodaemon" -+Prevent the daemonizing. -+.TP - .BR "\-c" , " \-\-configtest" - Test configuration and do startup tests and then exit. - .TP -diff --git a/radvd.c b/radvd.c -index 7cadf16..a241779 100644 ---- a/radvd.c -+++ b/radvd.c -@@ -42,6 +42,7 @@ char usage_str[] = { - " -p, --pidfile=PATH Sets the pid file.\n" - " -t, --chrootdir=PATH Chroot to the specified path.\n" - " -u, --username=USER Switch to the specified user.\n" -+" -s, --singleprocess Disable privilege separation.\n" - " -n, --nodaemon Prevent the daemonizing.\n" - #ifdef HAVE_NETLINK - " -L, --disablenetlink Disable netlink feature\n" -@@ -137,7 +138,7 @@ main(int argc, char *argv[]) - pidfile = PATH_RADVD_PID; - - /* parse args */ --#define OPTIONS_STR "d:C:l:m:p:t:u:vhcsn" -+#define OPTIONS_STR "d:C:l:m:f:p:t:u:vhcsn" - #ifdef HAVE_GETOPT_LONG - while ((c = getopt_long(argc, argv, OPTIONS_STR, prog_opt, &opt_idx)) > 0) - #else diff --git a/SOURCES/radvd-no_dac_override.patch b/SOURCES/radvd-no_dac_override.patch new file mode 100644 index 0000000..be2b2c6 --- /dev/null +++ b/SOURCES/radvd-no_dac_override.patch @@ -0,0 +1,36 @@ +diff --git a/radvd.c b/radvd.c +index 07a64a1..9f86cf6 100644 +--- a/radvd.c ++++ b/radvd.c +@@ -346,6 +346,15 @@ int main(int argc, char *argv[]) + flog(LOG_WARNING, "IPv6 forwarding seems to be disabled, but continuing anyway"); + } + ++ if (username) { ++ if (drop_root_privileges(username) < 0) { ++ perror("drop_root_privileges"); ++ flog(LOG_ERR, "unable to drop root privileges"); ++ exit(1); ++ } ++ dlog(LOG_DEBUG, 3, "running as user: %s", username); ++ } ++ + int const pidfd = open_and_lock_pid_file(daemon_pid_file_ident); + + /* +@@ -421,15 +430,6 @@ int main(int argc, char *argv[]) + } + #endif + +- if (username) { +- if (drop_root_privileges(username) < 0) { +- perror("drop_root_privileges"); +- flog(LOG_ERR, "unable to drop root privileges"); +- exit(1); +- } +- dlog(LOG_DEBUG, 3, "running as user: %s", username); +- } +- + setup_ifaces(sock, ifaces); + ifaces = main_loop(sock, ifaces, conf_path); + stop_adverts(sock, ifaces); diff --git a/SOURCES/radvd-werror.patch b/SOURCES/radvd-werror.patch new file mode 100644 index 0000000..b623868 --- /dev/null +++ b/SOURCES/radvd-werror.patch @@ -0,0 +1,35 @@ +From 6e45acbf3d64b9bd945adcb3de622fd7d059ceb9 Mon Sep 17 00:00:00 2001 +From: Pavel Zhukov +Date: Fri, 6 Apr 2018 15:04:02 +0200 +Subject: [PATCH] Drop unused variable + +Compillation with Werror=all is now successfull. +--- + gram.y | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/gram.y b/gram.y +index cc0dd4b..5db3bde 100644 +--- a/gram.y ++++ b/gram.y +@@ -408,7 +408,6 @@ v6addrlist_rasrcaddress : IPV6ADDR ';' + prefixdef : prefixhead optional_prefixplist ';' + { + if (prefix) { +- unsigned int dst; + + if (prefix->AdvPreferredLifetime > prefix->AdvValidLifetime) + { +diff --git a/send.c b/send.c +index 8bc16a8..62e3e68 100644 +--- a/send.c ++++ b/send.c +@@ -797,7 +797,7 @@ static int send_ra(int sock, struct Interface *iface, struct in6_addr const *des + } + + // RA built, now send it. +- dlog(LOG_DEBUG, 5, "sending RA to %s on %s (%s), %lu options (using %lu/%u bytes)", dest_text, iface->props.name, ++ dlog(LOG_DEBUG, 5, "sending RA to %s on %s (%s), %lu options (using %zd/%u bytes)", dest_text, iface->props.name, + src_text, option_count, sb->used, iface->props.max_ra_option_size); + int err = really_send(sock, dest, &iface->props, sb); + if (err < 0) { diff --git a/SOURCES/radvd-write_pid_file.patch b/SOURCES/radvd-write_pid_file.patch deleted file mode 100644 index 9825d79..0000000 --- a/SOURCES/radvd-write_pid_file.patch +++ /dev/null @@ -1,170 +0,0 @@ -diff --git a/radvd.c b/radvd.c -index 82efe0b..508abd1 100644 ---- a/radvd.c -+++ b/radvd.c -@@ -17,6 +17,10 @@ - #include "includes.h" - #include "radvd.h" - #include "pathnames.h" -+#include -+#include -+#include -+ - - #ifdef HAVE_NETLINK - #include "netlink.h" -@@ -99,6 +103,9 @@ int readin_config(char *); - int check_conffile_perm(const char *, const char *); - const char *get_pidfile(void); - void main_loop(void); -+static int write_pid_file(char const *daemon_pid_file_ident, pid_t pid); -+static int open_and_lock_pid_file(char const *daemon_pid_file_ident); -+static void check_pid_file(char const *daemon_pid_file_ident); - - int - main(int argc, char *argv[]) -@@ -110,6 +117,7 @@ main(int argc, char *argv[]) - char *chrootdir = NULL; - int configtest = 0; - int daemonize = 1; -+ int pidfd = 0; - #ifdef HAVE_GETOPT_LONG - int opt_idx; - #endif -@@ -332,6 +340,14 @@ main(int argc, char *argv[]) - exit(1); - } - daemon_retval_send(0); -+ } else { -+ pidfd = open_and_lock_pid_file(pidfile); -+ if (0 != write_pid_file(pidfile, getpid())) { -+ flog(LOG_ERR, "failure writing pid file detected"); -+ exit(-1); -+ } -+ check_pid_file(pidfile); -+ - } - - /* -@@ -347,11 +363,11 @@ main(int argc, char *argv[]) - main_loop(); - flog(LOG_INFO, "sending stop adverts", pidfile); - stop_adverts(); -- if (daemonize) { -- flog(LOG_INFO, "removing %s", pidfile); -- unlink(pidfile); -+ if (!daemonize){ -+ close(pidfd); - } -- -+ flog(LOG_INFO, "removing %s", pidfile); -+ unlink(pidfile); - return 0; - } - -@@ -841,3 +857,105 @@ usage(void) - exit(1); - } - -+static int open_pid_file(char const *daemon_pid_file_ident) -+{ -+ int pidfd = open(daemon_pid_file_ident, O_SYNC | O_CREAT | O_RDWR, 0644); -+ if (-1 == pidfd) { -+ flog(LOG_ERR, "unable to open pid file, %s: %s", daemon_pid_file_ident, strerror(errno)); -+ exit(-1); -+ } else { -+ dlog(LOG_DEBUG, 5, "opened pid file %s", daemon_pid_file_ident); -+ } -+ return pidfd; -+} -+ -+static int open_and_lock_pid_file(char const *daemon_pid_file_ident) -+{ -+ dlog(LOG_DEBUG, 3, "radvd startup PID is %d", getpid()); -+ -+ int pidfd = open_pid_file(daemon_pid_file_ident); -+ -+ int lock = flock(pidfd, LOCK_EX | LOCK_NB); -+ if (0 != lock) { -+ flog(LOG_ERR, "unable to lock pid file, %s: %s", daemon_pid_file_ident, strerror(errno)); -+ exit(-1); -+ } else { -+ dlog(LOG_DEBUG, 4, "locked pid file %s", daemon_pid_file_ident); -+ } -+ -+ return pidfd; -+} -+ -+ -+static int write_pid_file(char const *daemon_pid_file_ident, pid_t pid) -+{ -+ int pidfd = open_pid_file(daemon_pid_file_ident); -+ char pid_str[20] = {""}; -+ sprintf(pid_str, "%d", pid); -+ dlog(LOG_DEBUG, 3, "radvd PID is %s", pid_str); -+ size_t len = strlen(pid_str); -+ int rc = write(pidfd, pid_str, len); -+ if (rc != (int)len) { -+ return -1; -+ } -+ char newline[] = {"\n"}; -+ len = strlen(newline); -+ rc = write(pidfd, newline, len); -+ if (rc != (int)len) { -+ close(pidfd); -+ return -1; -+ } -+ rc = fsync(pidfd); -+ if (rc != 0) { -+ dlog(LOG_DEBUG, 4, "failed to fsync pid file: %s", daemon_pid_file_ident); -+ } -+ rc = close(pidfd); -+ if (rc != 0) { -+ dlog(LOG_DEBUG, 4, "failed to close pid file: %s", daemon_pid_file_ident); -+ } -+ char *dirstrcopy = strdup(daemon_pid_file_ident); -+ char *dirstr = dirname(dirstrcopy); -+ int dirfd = open(dirstr, O_RDONLY); -+ if (dirfd == -1){ -+ dlog(LOG_DEBUG, 4, "Failed to open directory: %s", dirstr); -+ } -+ rc = fsync(dirfd); -+ if (rc != 0) { -+ dlog(LOG_DEBUG, 4, "failed to fsync pid dir: %s", dirstr); -+ } -+ rc = close(dirfd); -+ if (rc != 0) { -+ dlog(LOG_DEBUG, 4, "failed to close pid dir: %s", dirstr); -+ } -+ free(dirstrcopy); -+ dlog(LOG_DEBUG, 4, "wrote pid %d to pid file: %s", pid, daemon_pid_file_ident); -+ return rc; -+} -+ -+ -+static void check_pid_file(char const *daemon_pid_file_ident) -+{ -+ FILE *pidfile = fopen(daemon_pid_file_ident, "r"); -+ -+ if (!pidfile) { -+ flog(LOG_ERR, "unable to open pid file, %s: %s", daemon_pid_file_ident, strerror(errno)); -+ exit(-1); -+ } -+ -+ pid_t pid = -1; -+ -+ int rc = fscanf(pidfile, "%d", &pid); -+ fclose(pidfile); -+ -+ if (rc != 1) { -+ flog(LOG_ERR, "unable to read pid from pid file: %s", daemon_pid_file_ident); -+ exit(-1); -+ } -+ -+ if (pid != getpid()) { -+ flog(LOG_ERR, "pid in file, %s, doesn't match getpid(): %d != %d", daemon_pid_file_ident, pid, getpid()); -+ exit(-1); -+ } -+ dlog(LOG_DEBUG, 4, "validated pid file, %s: %d", daemon_pid_file_ident, pid); -+} -+ diff --git a/SOURCES/radvd.service b/SOURCES/radvd.service index 15aeee6..d105501 100644 --- a/SOURCES/radvd.service +++ b/SOURCES/radvd.service @@ -7,6 +7,7 @@ EnvironmentFile=/etc/sysconfig/radvd ExecStart=/usr/sbin/radvd $OPTIONS Type=forking PIDFile=/var/run/radvd/radvd.pid +ExecReload=/bin/kill -HUP $MAINPID [Install] WantedBy=multi-user.target diff --git a/SOURCES/radvd_add_ra_memleak.patch b/SOURCES/radvd_add_ra_memleak.patch new file mode 100644 index 0000000..5d4a8c4 --- /dev/null +++ b/SOURCES/radvd_add_ra_memleak.patch @@ -0,0 +1,25 @@ +From 5ad279f48c0f3d94573e3f3c887f86cd10476c2d Mon Sep 17 00:00:00 2001 +From: David Hallas +Date: Wed, 4 Apr 2018 06:36:12 +0200 +Subject: [PATCH] Fixes memory leak in add_ra_options_dnssl + +The add_ra_options_dnssl function failed to free memory before +returning. +--- + send.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/send.c b/send.c +index 0a4951a..4b83d57 100644 +--- a/send.c ++++ b/send.c +@@ -527,8 +527,8 @@ static struct safe_buffer_list *add_ra_options_dnssl(struct safe_buffer_list *sb + + dnssl = dnssl->next; + } +- return sbl; + safe_buffer_free(serialized_domains); ++ return sbl; + } + + /* diff --git a/SPECS/radvd.spec b/SPECS/radvd.spec index 9764ca6..d1b5c92 100644 --- a/SPECS/radvd.spec +++ b/SPECS/radvd.spec @@ -1,26 +1,29 @@ -Summary: A Router Advertisement daemon -Name: radvd -Version: 1.9.2 -Release: 9%{?dist}.4 +Summary: A Router Advertisement daemon +Name: radvd +Version: 2.17 +Release: 3%{?dist} # The code includes the advertising clause, so it's GPL-incompatible -License: BSD with advertising -Group: System Environment/Daemons -URL: http://www.litech.org/radvd/ -Source0: %{url}dist/%{name}-%{version}.tar.gz -Source1: radvd-tmpfs.conf -Source2: radvd.service -Patch0: radvd-1.9.2-cli-man-help.patch -Patch1: radvd-write_pid_file.patch -BuildRequires: byacc -BuildRequires: flex -BuildRequires: flex-static -BuildRequires: libdaemon-devel -BuildRequires: pkgconfig -BuildRequires: systemd-units -Requires(postun): systemd-units -Requires(preun): systemd-units -Requires(post): systemd-units -Requires(pre): shadow-utils +License: BSD with advertising +Group: System Environment/Daemons +URL: http://www.litech.org/radvd/ +Source0: %{url}dist/%{name}-%{version}.tar.xz +Source1: radvd-tmpfs.conf +Source2: radvd.service +Patch1: radvd-werror.patch +Patch2: radvd-no_dac_override.patch +## https://github.com/reubenhwk/radvd/commit/5ad279f48c0f3d94573e3f3c887f86cd10476c2d.patch +Patch3: radvd_add_ra_memleak.patch + +BuildRequires: bison +BuildRequires: flex +BuildRequires: flex-static +BuildRequires: pkgconfig +%if 0%{?fedora} +BuildRequires: check-devel +%endif +BuildRequires: systemd-units +%{?systemd_requires} +Requires(pre): shadow-utils %description radvd is the router advertisement daemon for IPv6. It listens to router @@ -35,8 +38,9 @@ services. %prep %setup -q -%patch0 -p1 -F2 -b .cli-man-help -%patch1 -p1 -b .pidfile +%patch1 -p1 -b .werror +%patch2 -p1 -b .dac +%patch3 -p1 -b .add_ra_memleak for F in CHANGES; do iconv -f iso-8859-1 -t utf-8 < "$F" > "${F}.new" @@ -45,23 +49,33 @@ for F in CHANGES; do done %build -export CFLAGS="$RPM_OPT_FLAGS -fPIE -fno-strict-aliasing -Werror=all" +export NOERRORFLAGS="${CFLAGS}" +export CFLAGS="$RPM_OPT_FLAGS -fPIE -Werror=all -std=c99" export LDFLAGS='-pie -Wl,-z,relro,-z,now,-z,noexecstack,-z,nodlopen' -%configure --with-pidfile=%{_localstatedir}/run/radvd/radvd.pid -make %{?_smp_mflags} +%configure \ + --disable-silent-rules \ + --with-pidfile=%{_localstatedir}/run/radvd/radvd.pid +make %{?_smp_mflags} %install -make DESTDIR=$RPM_BUILD_ROOT install +make DESTDIR=%{buildroot} install -mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig -mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/run/radvd -mkdir -p $RPM_BUILD_ROOT%{_unitdir} +mkdir -p %{buildroot}%{_sysconfdir}/sysconfig +mkdir -p %{buildroot}/%{_localstatedir}/run/radvd +mkdir -p %{buildroot}%{_unitdir} -install -m 644 redhat/radvd.conf.empty $RPM_BUILD_ROOT%{_sysconfdir}/radvd.conf -install -m 644 redhat/radvd.sysconfig $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig/radvd +install -m 644 redhat/radvd.conf.empty %{buildroot}%{_sysconfdir}/radvd.conf +install -m 644 redhat/radvd.sysconfig %{buildroot}%{_sysconfdir}/sysconfig/radvd -install -D -p -m 644 %{SOURCE1} $RPM_BUILD_ROOT%{_tmpfilesdir}/radvd.conf -install -m 644 %{SOURCE2} ${RPM_BUILD_ROOT}%{_unitdir} +install -d -m 755 %{buildroot}%{_tmpfilesdir} +install -p -m 644 %{SOURCE1} %{buildroot}%{_tmpfilesdir}/radvd.conf +install -m 644 %{SOURCE2} %{buildroot}%{_unitdir} + +## RHEL7 has old check +%if 0%{?fedora} +%check +make check +%endif %postun %systemd_postun_with_restart radvd.service @@ -84,23 +98,30 @@ exit 0 %{_unitdir}/radvd.service %config(noreplace) %{_sysconfdir}/radvd.conf %config(noreplace) %{_sysconfdir}/sysconfig/radvd -%config(noreplace) %{_tmpfilesdir}/radvd.conf %dir %attr(-,radvd,radvd) %{_localstatedir}/run/radvd/ +%config(noreplace) %{_tmpfilesdir}/radvd.conf %doc radvd.conf.example %{_mandir}/*/* %{_sbindir}/radvd %{_sbindir}/radvdump %changelog -* Thu Apr 12 2018 Pavel Zhukov - 1.9.2-9.4 +* Mon Jun 4 2018 Pavel Zhukov - 2.17-3 +- Related: #1475983 - Use /var/run instead of /run in EL7 +- Fix coverity reported errors + +* Mon Jun 4 2018 Pavel Zhukov - 2.17-1 +- Resolves: #1475983 - Rebase on 2.17 + +* Thu Apr 12 2018 Pavel Zhukov - 1.9.2-14 - Check pid file before running main flow - Enable -Werror=all flag -* Wed Apr 11 2018 Pavel Zhukov - 1.9.2-9.3 -- Related: 1564391 - Backport file locking and pidfile removal +* Wed Apr 11 2018 Pavel Zhukov - 1.9.2-13 +- Related: 1559160 - Backport file locking and pidfile removal -* Thu Mar 22 2018 Pavel Zhukov - 1.9.2-9.2 -- Resolves: #1564391 - Write pid file in nodaemon mode +* Thu Mar 22 2018 Pavel Zhukov - 1.9.2-12 +- Resolves: 1559160 - Write pid file in nodaemon mode - Fix coverity warnings * Mon Aug 17 2015 Pavel Šimerda - 1.9.2-9