Development April 2018

development@lists.ipfire.org

10 participants
27 discussions

Question regarding package updates, applying patches, and building
by Peter Müller 17 Jun '18

17 Jun '18

Hello, while trying to update entire packages in IPFire (some of them are outdated) and to fix some bugs, I ran into a couple of questions: (a) How to update entire packages? As far as I understood, to every package belongs a file in lfs/[package_name], containing information about how to build, apply patches to it, and so on. It seems like packages are downloaded from https://source.ipfire.org/ , but it did not became clear to me how to upload a new version of a package to this server. Of course, the download URL can be changed manually, but that seems rather ugly to me. Unfortunately, I was unable to find a sort of tutorial in the wiki for this issue. (b) How to apply patches to downloaded packages with changed filenames? As discussed in December (https://wiki.ipfire.org/devel/telco/2017-12-04), I am supposed to have a look at the DEFAULT cipher suite in OpenSSL. To change this value, the .tar.gz file needs to be downloaded and unpacked first. After that, the file "ssl/ssl.h" needs to be changed. The patch at src/patches/openssl-1.0.2h-weak-ciphers.patch does something similar: diff -Naur openssl-1.0.2h.org/ssl/ssl.h openssl-1.0.2h/ssl/ssl.h --- openssl-1.0.2h.org/ssl/ssl.h 2016-05-03 15:44:42.000000000 +0200 +++ openssl-1.0.2h/ssl/ssl.h 2016-05-03 18:49:10.393302264 +0200 @@ -338,7 +338,7 @@ * The following cipher list is used by default. It also is substituted when * an application-defined cipher list string starts with 'DEFAULT'. */ -# define SSL_DEFAULT_CIPHER_LIST "ALL:!EXPORT:!LOW:!aNULL:!eNULL:!SSLv2" +# define SSL_DEFAULT_CIPHER_LIST "ALL:!EXPORT:!LOW:!aNULL:!eNULL:!SSLv2:!RC2:!DES" /* * As of OpenSSL 1.0.0, ssl_create_cipher_list() in ssl/ssl_ciph.c always * starts with a reasonable order, and all we have to do for DEFAULT is But where does the file openssl-[...].org came from? (c) How to build the distribution partly? In the past, I handed in some patches to allow remote syslogging via TCP, too. After some struggles (settings are written by a C program, not the CGI file itself), I modified syslogdctrl.c, and the changes were shipped. (See https://bugzilla.ipfire.org/show_bug.cgi?id=11540 for details.) But since this program now crashes with a segfault on my machine (*sigh*), it seems like my patch contained some errors. However, building the entire distribution is somewhat time-consuming and not worth the effort for a probably small error. Is there any way of just building this C program, and omit the rest? Thanks in advance! Best regards, Peter Müller

2 3

[PATCH] harden authentication and logging in OpenSSH server configuration
by Peter Müller 30 May '18

30 May '18

Update some values in the OpenSSH server configuration at /etc/ssh/sshd_config to secure values. Changes are also applied on existing installations via update.sh script. This partly solves #11538 and performs these changes: - never accept empty passwords for authentication - make sure OpenSSH always logs properly - make sure permissions of .ssh/authorized_keys are checked (StrictModes) - limit maximum concurring sessions to 5 - make sure custom rhosts files are always ignored - limit maximum authentication tries to 3 The logging options were not applied during build correctly, which is fixed now. Changes are not expected to break existing systems. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- config/rootfiles/core/121/update.sh | 12 ++++++++++++ lfs/openssh | 9 +++++++-- 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/config/rootfiles/core/121/update.sh b/config/rootfiles/core/121/update.sh index 87d5f6ebd..d3ceb84aa 100644 --- a/config/rootfiles/core/121/update.sh +++ b/config/rootfiles/core/121/update.sh @@ -32,6 +32,7 @@ for (( i=1; i<=$core; i++ )); do done # Stop services +/etc/init.d/sshd stop # Extract files extract_files @@ -56,8 +57,19 @@ rm -rvf \ /usr/share/nagios/ \ /var/nagios/ +# Update SSH configuration +sed -i /etc/ssh/sshd_config \ + -e 's/^#SyslogFacility AUTH$/SyslogFacility AUTH/' \ + -e 's/^#LogLevel INFO$/LogLevel INFO/' \ + -e 's/^#PermitEmptyPasswords no$/PermitEmptyPasswords no/' \ + -e 's/^#MaxAuthTries .*$/MaxAuthTries 3/' \ + -e 's/^#StrictModes .*$/StrictModes yes/' \ + -e 's/^#MaxSessions .*$/MaxSessions 5/' \ + -e 's/^#IgnoreRhosts .*$/IgnoreRhosts yes/' + # Start services /etc/init.d/apache restart +/etc/init.d/sshd start # This update needs a reboot... touch /var/run/need_reboot diff --git a/lfs/openssh b/lfs/openssh index 203446370..90279ac98 100644 --- a/lfs/openssh +++ b/lfs/openssh @@ -91,10 +91,15 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) -e 's/^#\?IgnoreUserKnownHosts .*$$/IgnoreUserKnownHosts yes/' \ -e 's/^#\?UsePAM .*$$//' \ -e 's/^#\?X11Forwarding .*$$/X11Forwarding no/' \ - -e 's/^#\?SyslogFacility AUTH .*$$/SyslogFacility AUTH/' \ - -e 's/^#\?LogLevel INFO .*$$/LogLevel INFO/' \ + -e 's/^#SyslogFacility AUTH$/SyslogFacility AUTH/' \ + -e 's/^#LogLevel INFO$/LogLevel INFO/' \ -e 's/^#\?AllowTcpForwarding .*$$/AllowTcpForwarding no/' \ -e 's/^#\?PermitRootLogin .*$$/PermitRootLogin yes/' \ + -e 's/^#PermitEmptyPasswords no$/PermitEmptyPasswords no/' \ + -e 's/^#MaxAuthTries .*$/MaxAuthTries 3/' \ + -e 's/^#StrictModes .*$/StrictModes yes/' \ + -e 's/^#MaxSessions .*$/MaxSessions 5/' \ + -e 's/^#IgnoreRhosts .*$/IgnoreRhosts yes/' \ -e 's|^#\?HostKey /etc/ssh/ssh_host_dsa_key$$||' \ -e 's|^#\?HostKey /etc/ssh/ssh_host_ecdsa_key$$||' \ -e 's|^#\?HostKey /etc/ssh/ssh_host_ed25519_key$$||' \ -- 2.13.6

2 3

Planning out Core Update 117
by Michael Tremer 12 May '18

12 May '18

Hello, so the big Core Update 115 has been shipped last week. Core Update 116 is coming today. So the next one should be a little bit calmer please :) I do not have anything so far except some smaller bug fixes here and there. Does anyone have anything big? It doesn't have to be another big update. We could also just improve IPFire where ever it is needed with loads of smaller changes and start working on 3 and other sub-projects that are floating around... Best, -Michael

5 31

[PATCH] mark OpenSSH password authentication as insecure
by Peter Müller 06 May '18

06 May '18

Using password authentication for SSH access is quite risky since the security depends on the password strength. People should use public-key authentication instead. This partly fixes #11538. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- langs/de/cgi-bin/de.pl | 2 +- langs/en/cgi-bin/en.pl | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index 07bef906b..477c23920 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -2156,7 +2156,7 @@ 'ssh key size' => 'Länge (bits)', 'ssh keys' => 'Authentifizierung auf Basis öffentlicher Schlüssel zulassen', 'ssh no auth' => 'Sie haben keinerlei Authentifizierungverfahren zugelassen; dies wird Ihre Anmeldung verhindern', -'ssh passwords' => 'Passwortbasierte Authentifizierung zulassen', +'ssh passwords' => 'Passwortbasierte Authentifizierung zulassen (Sicherheitsrisiko)', 'ssh port' => 'SSH Port auf 22 setzen (Standard ist 222)', 'ssh portfw' => 'TCP-Weiterleitung zulassen', 'ssh tempstart15' => 'SSH-Deamon in 15 Minuten beenden', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index a343b3bd7..66356cc69 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -2194,7 +2194,7 @@ 'ssh key size' => 'Size (bits)', 'ssh keys' => 'Allow public key based authentication', 'ssh no auth' => 'You have not allowed any authentication methods; this will stop you logging in', -'ssh passwords' => 'Allow password based authentication', +'ssh passwords' => 'Allow password based authentication (security risk)', 'ssh port' => 'SSH port set to 22 (default is 222)', 'ssh portfw' => 'Allow TCP forwarding', 'ssh tempstart15' => 'Stop SSH demon in 15 minutes', -- 2.13.6

2 2

[PATCH] dhcp: Update to 4.4.1
by Matthias Fischer 01 May '18

01 May '18

For details see: https://kb.isc.org/article/AA-01571/82/DHCP-4.4.1-Release-Notes.html This closes https://bugzilla.ipfire.org/show_bug.cgi?id=11697 and https://bugzilla.ipfire.org/show_bug.cgi?id=11293, hopefully. This update required some changes as described in: https://bugzilla.ipfire.org/show_bug.cgi?id=11697#c6 Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/dhcp | 4 +- lfs/dhcp | 39 +- .../dhcp/dhcp-64_bit_lease_parse.patch | 75 --- src/patches/dhcp/dhcp-CLOEXEC.patch | 342 ---------- src/patches/dhcp/dhcp-PPP.patch | 150 ----- src/patches/dhcp/dhcp-UseMulticast.patch | 241 -------- .../dhcp/dhcp-add_timeout_when_NULL.patch | 14 - src/patches/dhcp/dhcp-capability.patch | 250 -------- .../dhcp/dhcp-default-requested-options.patch | 44 -- .../dhcp/dhcp-dhclient-decline-backoff.patch | 63 -- src/patches/dhcp/dhcp-dhclient-options.patch | 509 --------------- src/patches/dhcp/dhcp-errwarn-message.patch | 22 - src/patches/dhcp/dhcp-garbage-chars.patch | 12 - src/patches/dhcp/dhcp-gpxe-cid.patch | 73 --- src/patches/dhcp/dhcp-honor-expired.patch | 49 -- src/patches/dhcp/dhcp-improved-xid.patch | 138 ----- src/patches/dhcp/dhcp-logpid.patch | 11 - src/patches/dhcp/dhcp-lpf-ib.patch | 585 ------------------ src/patches/dhcp/dhcp-manpages.patch | 157 ----- src/patches/dhcp/dhcp-paranoia.patch | 156 ----- src/patches/dhcp/dhcp-paths.patch | 44 -- src/patches/dhcp/dhcp-release-by-ifup.patch | 85 --- src/patches/dhcp/dhcp-remove-bind.patch | 192 ------ ...dhcp-rfc3442-classless-static-routes.patch | 405 ------------ src/patches/dhcp/dhcp-sendDecline.patch | 231 ------- src/patches/dhcp/dhcp-sharedlib.patch | 107 ---- .../dhcp/dhcp-stateless-DUID-LLT.patch | 48 -- src/patches/dhcp/dhcp-unicast-bootp.patch | 101 --- src/patches/dhcp/dhcp-xen-checksum.patch | 251 -------- 29 files changed, 7 insertions(+), 4391 deletions(-) delete mode 100644 src/patches/dhcp/dhcp-64_bit_lease_parse.patch delete mode 100644 src/patches/dhcp/dhcp-CLOEXEC.patch delete mode 100644 src/patches/dhcp/dhcp-PPP.patch delete mode 100644 src/patches/dhcp/dhcp-UseMulticast.patch delete mode 100644 src/patches/dhcp/dhcp-add_timeout_when_NULL.patch delete mode 100644 src/patches/dhcp/dhcp-capability.patch delete mode 100644 src/patches/dhcp/dhcp-default-requested-options.patch delete mode 100644 src/patches/dhcp/dhcp-dhclient-decline-backoff.patch delete mode 100644 src/patches/dhcp/dhcp-dhclient-options.patch delete mode 100644 src/patches/dhcp/dhcp-errwarn-message.patch delete mode 100644 src/patches/dhcp/dhcp-garbage-chars.patch delete mode 100644 src/patches/dhcp/dhcp-gpxe-cid.patch delete mode 100644 src/patches/dhcp/dhcp-honor-expired.patch delete mode 100644 src/patches/dhcp/dhcp-improved-xid.patch delete mode 100644 src/patches/dhcp/dhcp-logpid.patch delete mode 100644 src/patches/dhcp/dhcp-lpf-ib.patch delete mode 100644 src/patches/dhcp/dhcp-manpages.patch delete mode 100644 src/patches/dhcp/dhcp-paranoia.patch delete mode 100644 src/patches/dhcp/dhcp-paths.patch delete mode 100644 src/patches/dhcp/dhcp-release-by-ifup.patch delete mode 100644 src/patches/dhcp/dhcp-remove-bind.patch delete mode 100644 src/patches/dhcp/dhcp-rfc3442-classless-static-routes.patch delete mode 100644 src/patches/dhcp/dhcp-sendDecline.patch delete mode 100644 src/patches/dhcp/dhcp-sharedlib.patch delete mode 100644 src/patches/dhcp/dhcp-stateless-DUID-LLT.patch delete mode 100644 src/patches/dhcp/dhcp-unicast-bootp.patch delete mode 100644 src/patches/dhcp/dhcp-xen-checksum.patch diff --git a/config/rootfiles/common/dhcp b/config/rootfiles/common/dhcp index ff225a571..9e6d52e4e 100644 --- a/config/rootfiles/common/dhcp +++ b/config/rootfiles/common/dhcp @@ -5,8 +5,6 @@ etc/dhcp/dhcpd.conf #usr/bin/omshell #usr/include/dhcpctl #usr/include/dhcpctl/dhcpctl.h -#usr/include/isc-dhcp -#usr/include/isc-dhcp/dst.h #usr/include/omapip #usr/include/omapip/alloc.h #usr/include/omapip/buffer.h @@ -17,8 +15,8 @@ etc/dhcp/dhcpd.conf #usr/include/omapip/omapip_p.h #usr/include/omapip/result.h #usr/include/omapip/trace.h +#usr/lib/libdhcp.a #usr/lib/libdhcpctl.a -#usr/lib/libdst.a #usr/lib/libomapi.a #usr/sbin/dhclient usr/sbin/dhcpd diff --git a/lfs/dhcp b/lfs/dhcp index 262a25129..a055d6081 100644 --- a/lfs/dhcp +++ b/lfs/dhcp @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2015 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 4.3.1 +VER = 4.4.1 THISAPP = dhcp-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = b3a42ece3c7f2cd2e74a3e12ca881d20 +$(DL_FILE)_MD5 = 18c7f4dcbb0a63df25098216d47b1ede install : $(TARGET) @@ -71,47 +71,20 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-remove-bind.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-errwarn-message.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-dhclient-options.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-release-by-ifup.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-dhclient-decline-backoff.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-unicast-bootp.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-default-requested-options.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-xen-checksum.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-manpages.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-paths.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-CLOEXEC.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-garbage-chars.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-add_timeout_when_NULL.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-64_bit_lease_parse.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-capability.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-logpid.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-UseMulticast.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-sendDecline.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-rfc3442-classless-static-routes.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-honor-expired.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-sharedlib.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-PPP.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-paranoia.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-lpf-ib.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-improved-xid.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-gpxe-cid.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-stateless-DUID-LLT.patch - # Help unpacking bundled BIND - cd $(DIR_APP) && sed -e "s/gunzip -c/&d/" -i bind/Makefile + cd $(DIR_APP) && sed -e "s/gunzip -c/&d/" -i bind/Makefile.in cd $(DIR_APP) && \ ./configure \ --prefix=/usr \ --sysconfdir=/etc/dhcp \ + --with-srv-conf-file=/etc/dhcp/dhcpd.conf \ --with-srv-lease-file=/var/state/dhcp/dhcpd.leases \ --enable-paranoia \ --enable-early-chroot \ --disable-dhcpv6 - cd $(DIR_APP) && make $(MAKETUNING) + cd $(DIR_APP) && make cd $(DIR_APP) && make install mkdir -pv /var/state/dhcp diff --git a/src/patches/dhcp/dhcp-64_bit_lease_parse.patch b/src/patches/dhcp/dhcp-64_bit_lease_parse.patch deleted file mode 100644 index a07b5b032..000000000 --- a/src/patches/dhcp/dhcp-64_bit_lease_parse.patch +++ /dev/null @@ -1,75 +0,0 @@ -diff -up dhcp-4.3.0a1/common/parse.c.64-bit_lease_parse dhcp-4.3.0a1/common/parse.c ---- dhcp-4.3.0a1/common/parse.c.64-bit_lease_parse 2013-12-11 01:25:12.000000000 +0100 -+++ dhcp-4.3.0a1/common/parse.c 2013-12-19 15:45:25.990771814 +0100 -@@ -938,8 +938,8 @@ TIME - parse_date_core(cfile) - struct parse *cfile; - { -- int guess; -- int tzoff, year, mon, mday, hour, min, sec; -+ TIME guess; -+ long int tzoff, year, mon, mday, hour, min, sec; - const char *val; - enum dhcp_token token; - static int months[11] = { 31, 59, 90, 120, 151, 181, -@@ -965,7 +965,7 @@ parse_date_core(cfile) - } - - skip_token(&val, NULL, cfile); /* consume number */ -- guess = atoi(val); -+ guess = atol(val); - - return((TIME)guess); - } -@@ -993,7 +993,7 @@ parse_date_core(cfile) - somebody invents a time machine, I think we can safely disregard - it. This actually works around a stupid Y2K bug that was present - in a very early beta release of dhcpd. */ -- year = atoi(val); -+ year = atol(val); - if (year > 1900) - year -= 1900; - -@@ -1039,7 +1039,7 @@ parse_date_core(cfile) - return((TIME)0); - } - skip_token(&val, NULL, cfile); /* consume day of month */ -- mday = atoi(val); -+ mday = atol(val); - - /* Hour... */ - token = peek_token(&val, NULL, cfile); -@@ -1050,7 +1050,7 @@ parse_date_core(cfile) - return((TIME)0); - } - skip_token(&val, NULL, cfile); /* consume hour */ -- hour = atoi(val); -+ hour = atol(val); - - /* Colon separating hour from minute... */ - token = peek_token(&val, NULL, cfile); -@@ -1072,7 +1072,7 @@ parse_date_core(cfile) - return((TIME)0); - } - skip_token(&val, NULL, cfile); /* consume minute */ -- min = atoi(val); -+ min = atol(val); - - /* Colon separating minute from second... */ - token = peek_token(&val, NULL, cfile); -@@ -1094,13 +1094,13 @@ parse_date_core(cfile) - return((TIME)0); - } - skip_token(&val, NULL, cfile); /* consume second */ -- sec = atoi(val); -+ sec = atol(val); - - tzoff = 0; - token = peek_token(&val, NULL, cfile); - if (token == NUMBER) { - skip_token(&val, NULL, cfile); /* consume tzoff */ -- tzoff = atoi(val); -+ tzoff = atol(val); - } else if (token != SEMI) { - skip_token(&val, NULL, cfile); - parse_warn(cfile, diff --git a/src/patches/dhcp/dhcp-CLOEXEC.patch b/src/patches/dhcp/dhcp-CLOEXEC.patch deleted file mode 100644 index 722865e4f..000000000 --- a/src/patches/dhcp/dhcp-CLOEXEC.patch +++ /dev/null @@ -1,342 +0,0 @@ -diff -up dhcp-4.3.0a1/client/clparse.c.cloexec dhcp-4.3.0a1/client/clparse.c ---- dhcp-4.3.0a1/client/clparse.c.cloexec 2013-12-19 15:34:41.638886256 +0100 -+++ dhcp-4.3.0a1/client/clparse.c 2013-12-19 15:34:41.657885985 +0100 -@@ -253,7 +253,7 @@ int read_client_conf_file (const char *n - int token; - isc_result_t status; - -- if ((file = open (name, O_RDONLY)) < 0) -+ if ((file = open (name, O_RDONLY | O_CLOEXEC)) < 0) - return uerr2isc (errno); - - cfile = NULL; -@@ -290,7 +290,7 @@ void read_client_leases () - - /* Open the lease file. If we can't open it, just return - - we can safely trust the server to remember our state. */ -- if ((file = open (path_dhclient_db, O_RDONLY)) < 0) -+ if ((file = open (path_dhclient_db, O_RDONLY | O_CLOEXEC)) < 0) - return; - - cfile = NULL; -diff -up dhcp-4.3.0a1/client/dhclient.c.cloexec dhcp-4.3.0a1/client/dhclient.c ---- dhcp-4.3.0a1/client/dhclient.c.cloexec 2013-12-19 15:34:41.629886384 +0100 -+++ dhcp-4.3.0a1/client/dhclient.c 2013-12-19 15:36:41.608180467 +0100 -@@ -148,11 +148,11 @@ main(int argc, char **argv) { - /* Make sure that file descriptors 0 (stdin), 1, (stdout), and - 2 (stderr) are open. To do this, we assume that when we - open a file the lowest available file descriptor is used. */ -- fd = open("/dev/null", O_RDWR); -+ fd = open("/dev/null", O_RDWR | O_CLOEXEC); - if (fd == 0) -- fd = open("/dev/null", O_RDWR); -+ fd = open("/dev/null", O_RDWR | O_CLOEXEC); - if (fd == 1) -- fd = open("/dev/null", O_RDWR); -+ fd = open("/dev/null", O_RDWR | O_CLOEXEC); - if (fd == 2) - log_perror = 0; /* No sense logging to /dev/null. */ - else if (fd != -1) -@@ -504,7 +504,7 @@ main(int argc, char **argv) { - long temp; - int e; - -- if ((pidfd = fopen(path_dhclient_pid, "r")) != NULL) { -+ if ((pidfd = fopen(path_dhclient_pid, "re")) != NULL) { - e = fscanf(pidfd, "%ld\n", &temp); - oldpid = (pid_t)temp; - -@@ -554,7 +554,7 @@ main(int argc, char **argv) { - strncpy(new_path_dhclient_pid, path_dhclient_pid, pfx); - sprintf(new_path_dhclient_pid + pfx, "-%s.pid", ip->name); - -- if ((pidfd = fopen(new_path_dhclient_pid, "r")) != NULL) { -+ if ((pidfd = fopen(new_path_dhclient_pid, "re")) != NULL) { - e = fscanf(pidfd, "%ld\n", &temp); - oldpid = (pid_t)temp; - -@@ -579,7 +579,7 @@ main(int argc, char **argv) { - int dhc_running = 0; - char procfn[256] = ""; - -- if ((pidfp = fopen(path_dhclient_pid, "r")) != NULL) { -+ if ((pidfp = fopen(path_dhclient_pid, "re")) != NULL) { - if ((fscanf(pidfp, "%ld", &temp)==1) && ((dhcpid=(pid_t)temp) > 0)) { - snprintf(procfn,256,"/proc/%u",dhcpid); - dhc_running = (access(procfn, F_OK) == 0); -@@ -3077,7 +3077,7 @@ void rewrite_client_leases () - - if (leaseFile != NULL) - fclose (leaseFile); -- leaseFile = fopen (path_dhclient_db, "w"); -+ leaseFile = fopen (path_dhclient_db, "we"); - if (leaseFile == NULL) { - log_error ("can't create %s: %m", path_dhclient_db); - return; -@@ -3261,7 +3261,7 @@ write_duid(struct data_string *duid) - return DHCP_R_INVALIDARG; - - if (leaseFile == NULL) { /* XXX? */ -- leaseFile = fopen(path_dhclient_db, "w"); -+ leaseFile = fopen(path_dhclient_db, "we"); - if (leaseFile == NULL) { - log_error("can't create %s: %m", path_dhclient_db); - return ISC_R_IOERROR; -@@ -3441,7 +3441,7 @@ int write_client_lease (client, lease, r - return 1; - - if (leaseFile == NULL) { /* XXX */ -- leaseFile = fopen (path_dhclient_db, "w"); -+ leaseFile = fopen (path_dhclient_db, "we"); - if (leaseFile == NULL) { - log_error ("can't create %s: %m", path_dhclient_db); - return 0; -@@ -3952,9 +3952,9 @@ void go_daemon () - (void) close(2); - - /* Reopen them on /dev/null. */ -- (void) open("/dev/null", O_RDWR); -- (void) open("/dev/null", O_RDWR); -- (void) open("/dev/null", O_RDWR); -+ (void) open("/dev/null", O_RDWR | O_CLOEXEC); -+ (void) open("/dev/null", O_RDWR | O_CLOEXEC); -+ (void) open("/dev/null", O_RDWR | O_CLOEXEC); - - write_client_pid_file (); - -@@ -3971,14 +3971,14 @@ void write_client_pid_file () - return; - } - -- pfdesc = open (path_dhclient_pid, O_CREAT | O_TRUNC | O_WRONLY, 0644); -+ pfdesc = open (path_dhclient_pid, O_CREAT | O_TRUNC | O_WRONLY | O_CLOEXEC, 0644); - - if (pfdesc < 0) { - log_error ("Can't create %s: %m", path_dhclient_pid); - return; - } - -- pf = fdopen (pfdesc, "w"); -+ pf = fdopen (pfdesc, "we"); - if (!pf) { - close(pfdesc); - log_error ("Can't fdopen %s: %m", path_dhclient_pid); -diff -up dhcp-4.3.0a1/common/bpf.c.cloexec dhcp-4.3.0a1/common/bpf.c ---- dhcp-4.3.0a1/common/bpf.c.cloexec 2013-12-19 15:34:41.640886227 +0100 -+++ dhcp-4.3.0a1/common/bpf.c 2013-12-19 15:34:41.661885928 +0100 -@@ -95,7 +95,7 @@ int if_register_bpf (info) - for (b = 0; 1; b++) { - /* %Audit% 31 bytes max. %2004.06.17,Safe% */ - sprintf(filename, BPF_FORMAT, b); -- sock = open (filename, O_RDWR, 0); -+ sock = open (filename, O_RDWR | O_CLOEXEC, 0); - if (sock < 0) { - if (errno == EBUSY) { - continue; -diff -up dhcp-4.3.0a1/common/dlpi.c.cloexec dhcp-4.3.0a1/common/dlpi.c ---- dhcp-4.3.0a1/common/dlpi.c.cloexec 2013-12-19 15:34:41.641886213 +0100 -+++ dhcp-4.3.0a1/common/dlpi.c 2013-12-19 15:34:41.662885914 +0100 -@@ -804,7 +804,7 @@ dlpiopen(const char *ifname) { - } - *dp = '\0'; - -- return open (devname, O_RDWR, 0); -+ return open (devname, O_RDWR | O_CLOEXEC, 0); - } - - /* -diff -up dhcp-4.3.0a1/common/nit.c.cloexec dhcp-4.3.0a1/common/nit.c ---- dhcp-4.3.0a1/common/nit.c.cloexec 2013-12-19 15:34:41.642886199 +0100 -+++ dhcp-4.3.0a1/common/nit.c 2013-12-19 15:34:41.662885914 +0100 -@@ -81,7 +81,7 @@ int if_register_nit (info) - struct strioctl sio; - - /* Open a NIT device */ -- sock = open ("/dev/nit", O_RDWR); -+ sock = open ("/dev/nit", O_RDWR | O_CLOEXEC); - if (sock < 0) - log_fatal ("Can't open NIT device for %s: %m", info -> name); - -diff -up dhcp-4.3.0a1/common/resolv.c.cloexec dhcp-4.3.0a1/common/resolv.c ---- dhcp-4.3.0a1/common/resolv.c.cloexec 2013-12-11 01:25:12.000000000 +0100 -+++ dhcp-4.3.0a1/common/resolv.c 2013-12-19 15:34:41.663885900 +0100 -@@ -50,7 +50,7 @@ void read_resolv_conf (parse_time) - struct domain_search_list *dp, *dl, *nd; - isc_result_t status; - -- if ((file = open (path_resolv_conf, O_RDONLY)) < 0) { -+ if ((file = open (path_resolv_conf, O_RDONLY | O_CLOEXEC)) < 0) { - log_error ("Can't open %s: %m", path_resolv_conf); - return; - } -diff -up dhcp-4.3.0a1/common/upf.c.cloexec dhcp-4.3.0a1/common/upf.c ---- dhcp-4.3.0a1/common/upf.c.cloexec 2013-12-19 15:34:41.642886199 +0100 -+++ dhcp-4.3.0a1/common/upf.c 2013-12-19 15:34:41.663885900 +0100 -@@ -77,7 +77,7 @@ int if_register_upf (info) - /* %Audit% Cannot exceed 36 bytes. %2004.06.17,Safe% */ - sprintf(filename, "/dev/pf/pfilt%d", b); - -- sock = open (filename, O_RDWR, 0); -+ sock = open (filename, O_RDWR | O_CLOEXEC, 0); - if (sock < 0) { - if (errno == EBUSY) { - continue; -diff -up dhcp-4.3.0a1/omapip/trace.c.cloexec dhcp-4.3.0a1/omapip/trace.c ---- dhcp-4.3.0a1/omapip/trace.c.cloexec 2013-12-11 01:01:03.000000000 +0100 -+++ dhcp-4.3.0a1/omapip/trace.c 2013-12-19 15:34:41.663885900 +0100 -@@ -142,10 +142,10 @@ isc_result_t trace_begin (const char *fi - return DHCP_R_INVALIDARG; - } - -- traceoutfile = open (filename, O_CREAT | O_WRONLY | O_EXCL, 0600); -+ traceoutfile = open (filename, O_CREAT | O_WRONLY | O_EXCL | O_CLOEXEC, 0600); - if (traceoutfile < 0 && errno == EEXIST) { - log_error ("WARNING: Overwriting trace file \"%s\"", filename); -- traceoutfile = open (filename, O_WRONLY | O_EXCL | O_TRUNC, -+ traceoutfile = open (filename, O_WRONLY | O_EXCL | O_TRUNC | O_CLOEXEC, - 0600); - } - -@@ -433,7 +433,7 @@ void trace_file_replay (const char *file - isc_result_t result; - int len; - -- traceinfile = fopen (filename, "r"); -+ traceinfile = fopen (filename, "re"); - if (!traceinfile) { - log_error("Can't open tracefile %s: %m", filename); - return; -diff -up dhcp-4.3.0a1/relay/dhcrelay.c.cloexec dhcp-4.3.0a1/relay/dhcrelay.c ---- dhcp-4.3.0a1/relay/dhcrelay.c.cloexec 2013-12-13 22:26:21.000000000 +0100 -+++ dhcp-4.3.0a1/relay/dhcrelay.c 2013-12-19 15:34:41.664885886 +0100 -@@ -193,11 +193,11 @@ main(int argc, char **argv) { - /* Make sure that file descriptors 0(stdin), 1,(stdout), and - 2(stderr) are open. To do this, we assume that when we - open a file the lowest available file descriptor is used. */ -- fd = open("/dev/null", O_RDWR); -+ fd = open("/dev/null", O_RDWR | O_CLOEXEC); - if (fd == 0) -- fd = open("/dev/null", O_RDWR); -+ fd = open("/dev/null", O_RDWR | O_CLOEXEC); - if (fd == 1) -- fd = open("/dev/null", O_RDWR); -+ fd = open("/dev/null", O_RDWR | O_CLOEXEC); - if (fd == 2) - log_perror = 0; /* No sense logging to /dev/null. */ - else if (fd != -1) -@@ -564,13 +564,13 @@ main(int argc, char **argv) { - - if (no_pid_file == ISC_FALSE) { - pfdesc = open(path_dhcrelay_pid, -- O_CREAT | O_TRUNC | O_WRONLY, 0644); -+ O_CREAT | O_TRUNC | O_WRONLY | O_CLOEXEC, 0644); - - if (pfdesc < 0) { - log_error("Can't create %s: %m", - path_dhcrelay_pid); - } else { -- pf = fdopen(pfdesc, "w"); -+ pf = fdopen(pfdesc, "we"); - if (!pf) - log_error("Can't fdopen %s: %m", - path_dhcrelay_pid); -diff -up dhcp-4.3.0a1/server/confpars.c.cloexec dhcp-4.3.0a1/server/confpars.c ---- dhcp-4.3.0a1/server/confpars.c.cloexec 2013-12-11 01:25:12.000000000 +0100 -+++ dhcp-4.3.0a1/server/confpars.c 2013-12-19 15:34:41.665885871 +0100 -@@ -117,7 +117,7 @@ isc_result_t read_conf_file (const char - } - #endif - -- if ((file = open (filename, O_RDONLY)) < 0) { -+ if ((file = open (filename, O_RDONLY | O_CLOEXEC)) < 0) { - if (leasep) { - log_error ("Can't open lease database %s: %m --", - path_dhcpd_db); -diff -up dhcp-4.3.0a1/server/db.c.cloexec dhcp-4.3.0a1/server/db.c ---- dhcp-4.3.0a1/server/db.c.cloexec 2013-12-11 01:25:12.000000000 +0100 -+++ dhcp-4.3.0a1/server/db.c 2013-12-19 15:34:41.666885857 +0100 -@@ -1081,7 +1081,7 @@ void db_startup (testp) - } - #endif - if (!testp) { -- db_file = fopen (path_dhcpd_db, "a"); -+ db_file = fopen (path_dhcpd_db, "ae"); - if (!db_file) - log_fatal ("Can't open %s for append.", path_dhcpd_db); - expire_all_pools (); -@@ -1129,12 +1129,12 @@ int new_lease_file () - path_dhcpd_db, (int)t) >= sizeof newfname) - log_fatal("new_lease_file: lease file path too long"); - -- db_fd = open (newfname, O_WRONLY | O_TRUNC | O_CREAT, 0664); -+ db_fd = open (newfname, O_WRONLY | O_TRUNC | O_CREAT | O_CLOEXEC, 0664); - if (db_fd < 0) { - log_error ("Can't create new lease file: %m"); - return 0; - } -- if ((new_db_file = fdopen(db_fd, "w")) == NULL) { -+ if ((new_db_file = fdopen(db_fd, "we")) == NULL) { - log_error("Can't fdopen new lease file: %m"); - close(db_fd); - goto fdfail; -diff -up dhcp-4.3.0a1/server/dhcpd.c.cloexec dhcp-4.3.0a1/server/dhcpd.c ---- dhcp-4.3.0a1/server/dhcpd.c.cloexec 2013-12-13 22:26:01.000000000 +0100 -+++ dhcp-4.3.0a1/server/dhcpd.c 2013-12-19 15:37:17.258674472 +0100 -@@ -193,11 +193,11 @@ main(int argc, char **argv) { - /* Make sure that file descriptors 0 (stdin), 1, (stdout), and - 2 (stderr) are open. To do this, we assume that when we - open a file the lowest available file descriptor is used. */ -- fd = open("/dev/null", O_RDWR); -+ fd = open("/dev/null", O_RDWR | O_CLOEXEC); - if (fd == 0) -- fd = open("/dev/null", O_RDWR); -+ fd = open("/dev/null", O_RDWR | O_CLOEXEC); - if (fd == 1) -- fd = open("/dev/null", O_RDWR); -+ fd = open("/dev/null", O_RDWR | O_CLOEXEC); - if (fd == 2) - log_perror = 0; /* No sense logging to /dev/null. */ - else if (fd != -1) -@@ -716,7 +716,7 @@ main(int argc, char **argv) { - */ - if (no_pid_file == ISC_FALSE) { - /*Read previous pid file. */ -- if ((i = open (path_dhcpd_pid, O_RDONLY)) >= 0) { -+ if ((i = open (path_dhcpd_pid, O_RDONLY | O_CLOEXEC)) >= 0) { - status = read(i, pbuf, (sizeof pbuf) - 1); - close (i); - if (status > 0) { -@@ -735,7 +735,7 @@ main(int argc, char **argv) { - } - - /* Write new pid file. */ -- i = open(path_dhcpd_pid, O_WRONLY|O_CREAT|O_TRUNC, 0644); -+ i = open(path_dhcpd_pid, O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0644); - if (i >= 0) { - sprintf(pbuf, "%d\n", (int) getpid()); - IGNORE_RET (write(i, pbuf, strlen(pbuf))); -@@ -763,9 +763,9 @@ main(int argc, char **argv) { - (void) close(2); - - /* Reopen them on /dev/null. */ -- (void) open("/dev/null", O_RDWR); -- (void) open("/dev/null", O_RDWR); -- (void) open("/dev/null", O_RDWR); -+ (void) open("/dev/null", O_RDWR | O_CLOEXEC); -+ (void) open("/dev/null", O_RDWR | O_CLOEXEC); -+ (void) open("/dev/null", O_RDWR | O_CLOEXEC); - log_perror = 0; /* No sense logging to /dev/null. */ - - IGNORE_RET (chdir("/")); -diff -up dhcp-4.3.0a1/server/ldap.c.cloexec dhcp-4.3.0a1/server/ldap.c ---- dhcp-4.3.0a1/server/ldap.c.cloexec 2013-12-11 01:25:12.000000000 +0100 -+++ dhcp-4.3.0a1/server/ldap.c 2013-12-19 15:34:41.667885843 +0100 -@@ -684,7 +684,7 @@ ldap_start (void) - - if (ldap_debug_file != NULL && ldap_debug_fd == -1) - { -- if ((ldap_debug_fd = open (ldap_debug_file, O_CREAT | O_TRUNC | O_WRONLY, -+ if ((ldap_debug_fd = open (ldap_debug_file, O_CREAT | O_TRUNC | O_WRONLY | O_CLOEXEC, - S_IRUSR | S_IWUSR)) < 0) - log_error ("Error opening debug LDAP log file %s: %s", ldap_debug_file, - strerror (errno)); diff --git a/src/patches/dhcp/dhcp-PPP.patch b/src/patches/dhcp/dhcp-PPP.patch deleted file mode 100644 index 5d022e432..000000000 --- a/src/patches/dhcp/dhcp-PPP.patch +++ /dev/null @@ -1,150 +0,0 @@ -diff -up dhcp-4.3.1b1/client/dhc6.c.mRfpsB dhcp-4.3.1b1/client/dhc6.c ---- dhcp-4.3.1b1/client/dhc6.c.mRfpsB 2014-07-10 17:48:03.779424870 +0200 -+++ dhcp-4.3.1b1/client/dhc6.c 2014-07-10 17:48:03.795424644 +0200 -@@ -5088,7 +5088,8 @@ make_client6_options(struct client_state - */ - if ((oc = lookup_option(&dhcpv6_universe, *op, - D6O_CLIENTID)) == NULL) { -- if (!option_cache(&oc, &default_duid, NULL, clientid_option, -+ if (default_duid.len == 0 || -+ !option_cache(&oc, &default_duid, NULL, clientid_option, - MDL)) - log_fatal("Failure assembling a DUID."); - -diff -up dhcp-4.3.1b1/client/dhclient.c.mRfpsB dhcp-4.3.1b1/client/dhclient.c ---- dhcp-4.3.1b1/client/dhclient.c.mRfpsB 2014-07-10 17:39:25.853763858 +0200 -+++ dhcp-4.3.1b1/client/dhclient.c 2014-07-10 17:49:49.882925843 +0200 -@@ -948,8 +948,8 @@ main(int argc, char **argv) { - if (default_duid.buffer != NULL) - data_string_forget(&default_duid, MDL); - -- form_duid(&default_duid, MDL); -- write_duid(&default_duid); -+ if (form_duid(&default_duid, MDL) == ISC_R_SUCCESS) -+ write_duid(&default_duid); - } - } - -@@ -3267,7 +3267,7 @@ write_options(struct client_state *clien - * is not how it is intended. Upcoming rearchitecting the client should - * address this "one daemon model." - */ --void -+isc_result_t - form_duid(struct data_string *duid, const char *file, int line) - { - struct interface_info *ip; -@@ -3280,6 +3280,15 @@ form_duid(struct data_string *duid, cons - if (ip == NULL) - log_fatal("Impossible condition at %s:%d.", MDL); - -+ while (ip && ip->hw_address.hbuf[0] == HTYPE_RESERVED) { -+ /* Try the other interfaces */ -+ log_debug("Cannot form default DUID from interface %s.", ip->name); -+ ip = ip->next; -+ } -+ if (ip == NULL) { -+ return ISC_R_UNEXPECTED; -+ } -+ - if ((ip->hw_address.hlen == 0) || - (ip->hw_address.hlen > sizeof(ip->hw_address.hbuf))) - log_fatal("Impossible hardware address length at %s:%d.", MDL); -@@ -3323,6 +3332,8 @@ form_duid(struct data_string *duid, cons - log_info("Created duid %s.", str); - dfree(str, MDL); - } -+ -+ return ISC_R_SUCCESS; - } - - /* Write the default DUID to the lease store. */ -diff -up dhcp-4.3.1b1/common/bpf.c.mRfpsB dhcp-4.3.1b1/common/bpf.c ---- dhcp-4.3.1b1/common/bpf.c.mRfpsB 2014-07-10 17:39:25.797764653 +0200 -+++ dhcp-4.3.1b1/common/bpf.c 2014-07-10 17:48:03.797424616 +0200 -@@ -600,6 +600,22 @@ get_hw_addr(const char *name, struct har - memcpy(&hw->hbuf[1], LLADDR(sa), sa->sdl_alen); - break; - #endif /* IFT_FDDI */ -+#if defined(IFT_PPP) -+ case IFT_PPP: -+ if (local_family != AF_INET6) -+ log_fatal("Unsupported device type %d for \"%s\"", -+ sa->sdl_type, name); -+ hw->hlen = 0; -+ hw->hbuf[0] = HTYPE_RESERVED; -+ /* 0xdeadbeef should never occur on the wire, -+ * and is a signature that something went wrong. -+ */ -+ hw->hbuf[1] = 0xde; -+ hw->hbuf[2] = 0xad; -+ hw->hbuf[3] = 0xbe; -+ hw->hbuf[4] = 0xef; -+ break; -+#endif - default: - log_fatal("Unsupported device type %d for \"%s\"", - sa->sdl_type, name); -diff -up dhcp-4.3.1b1/common/lpf.c.mRfpsB dhcp-4.3.1b1/common/lpf.c ---- dhcp-4.3.1b1/common/lpf.c.mRfpsB 2014-07-10 17:39:25.744765404 +0200 -+++ dhcp-4.3.1b1/common/lpf.c 2014-07-10 17:48:03.797424616 +0200 -@@ -511,6 +511,22 @@ get_hw_addr(const char *name, struct har - hw->hbuf[0] = HTYPE_FDDI; - memcpy(&hw->hbuf[1], sa->sa_data, 6); - break; -+#if defined(ARPHRD_PPP) -+ case ARPHRD_PPP: -+ if (local_family != AF_INET6) -+ log_fatal("Unsupported device type %d for \"%s\"", -+ sa->sa_family, name); -+ hw->hlen = 0; -+ hw->hbuf[0] = HTYPE_RESERVED; -+ /* 0xdeadbeef should never occur on the wire, -+ * and is a signature that something went wrong. -+ */ -+ hw->hbuf[1] = 0xde; -+ hw->hbuf[2] = 0xad; -+ hw->hbuf[3] = 0xbe; -+ hw->hbuf[4] = 0xef; -+ break; -+#endif - default: - log_fatal("Unsupported device type %ld for \"%s\"", - (long int)sa->sa_family, name); -diff -up dhcp-4.3.1b1/includes/dhcpd.h.mRfpsB dhcp-4.3.1b1/includes/dhcpd.h ---- dhcp-4.3.1b1/includes/dhcpd.h.mRfpsB 2014-07-10 17:48:03.761425124 +0200 -+++ dhcp-4.3.1b1/includes/dhcpd.h 2014-07-10 17:48:03.798424601 +0200 -@@ -2839,7 +2839,7 @@ void client_dns_remove(struct client_sta - - void dhcpv4_client_assignments(void); - void dhcpv6_client_assignments(void); --void form_duid(struct data_string *duid, const char *file, int line); -+isc_result_t form_duid(struct data_string *duid, const char *file, int line); - - /* dhc6.c */ - void dhc6_lease_destroy(struct dhc6_lease **src, const char *file, int line); -diff -up dhcp-4.3.1b1/includes/dhcp.h.mRfpsB dhcp-4.3.1b1/includes/dhcp.h ---- dhcp-4.3.1b1/includes/dhcp.h.mRfpsB 2014-07-10 17:48:03.761425124 +0200 -+++ dhcp-4.3.1b1/includes/dhcp.h 2014-07-10 17:48:03.798424601 +0200 -@@ -81,6 +81,8 @@ struct dhcp_packet { - * is no standard for this so we - * just steal a type */ - -+#define HTYPE_RESERVED 0 /* RFC 5494 */ -+ - /* Magic cookie validating dhcp options field (and bootp vendor - extensions field). */ - #define DHCP_OPTIONS_COOKIE "\143\202\123\143" -diff -up dhcp-4.3.1b1/server/dhcpv6.c.mRfpsB dhcp-4.3.1b1/server/dhcpv6.c ---- dhcp-4.3.1b1/server/dhcpv6.c.mRfpsB 2014-07-10 17:47:31.464881409 +0200 -+++ dhcp-4.3.1b1/server/dhcpv6.c 2014-07-10 17:48:03.800424573 +0200 -@@ -330,6 +330,9 @@ generate_new_server_duid(void) { - if (p->hw_address.hlen > 0) { - break; - } -+ if (p->next == NULL && p->hw_address.hbuf[0] == HTYPE_RESERVED) { -+ log_error("Can not generate DUID from interfaces which do not have hardware addresses, please configure server-duid!"); -+ } - } - if (p == NULL) { - return ISC_R_UNEXPECTED; diff --git a/src/patches/dhcp/dhcp-UseMulticast.patch b/src/patches/dhcp/dhcp-UseMulticast.patch deleted file mode 100644 index ee0ea6b9a..000000000 --- a/src/patches/dhcp/dhcp-UseMulticast.patch +++ /dev/null @@ -1,241 +0,0 @@ -diff -up dhcp-4.3.1b1/server/dhcpv6.c.UseMulticast dhcp-4.3.1b1/server/dhcpv6.c ---- dhcp-4.3.1b1/server/dhcpv6.c.UseMulticast 2014-07-02 19:58:40.000000000 +0200 -+++ dhcp-4.3.1b1/server/dhcpv6.c 2014-07-10 18:20:03.066256219 +0200 -@@ -376,6 +376,48 @@ generate_new_server_duid(void) { - } - - /* -+ * Is the D6O_UNICAST option defined in dhcpd.conf ? -+ */ -+static isc_boolean_t unicast_option_defined; -+ -+/* -+ * Did we already search dhcpd.conf for D6O_UNICAST option ? -+ * We need to store it here to not parse dhcpd.conf repeatedly. -+ */ -+static isc_boolean_t unicast_option_parsed = ISC_FALSE; -+ -+ -+/* -+ * Is the D6O_UNICAST option defined in dhcpd.conf ? -+ */ -+isc_boolean_t -+is_unicast_option_defined(void) { -+ struct option_state *opt_state; -+ struct option_cache *oc; -+ -+ /* -+ * If we are looking for the unicast option for the first time -+ */ -+ if (unicast_option_parsed == ISC_FALSE) { -+ unicast_option_parsed = ISC_TRUE; -+ opt_state = NULL; -+ if (!option_state_allocate(&opt_state, MDL)) { -+ log_fatal("No memory for option state."); -+ } -+ -+ execute_statements_in_scope(NULL, NULL, NULL, NULL, NULL, -+ opt_state, &global_scope, root_group, NULL, NULL); -+ -+ oc = lookup_option(&dhcpv6_universe, opt_state, D6O_UNICAST); -+ unicast_option_defined = (oc != NULL); -+ -+ option_state_dereference(&opt_state, MDL); -+ } -+ -+ return (unicast_option_defined); -+} -+ -+/* - * Get the client identifier from the packet. - */ - isc_result_t -@@ -706,6 +748,12 @@ static const int required_opts[] = { - D6O_PREFERENCE, - 0 - }; -+static const int required_opts_NAA[] = { -+ D6O_CLIENTID, -+ D6O_SERVERID, -+ D6O_STATUS_CODE, -+ 0 -+}; - static const int required_opts_solicit[] = { - D6O_CLIENTID, - D6O_SERVERID, -@@ -1587,6 +1635,56 @@ lease_to_client(struct data_string *repl - reply.shared->group, NULL); - } - -+ /* reject unicast message, unless we set unicast option */ -+ if ((packet->unicast == ISC_TRUE) && !is_unicast_option_defined()) -+ /* -+ * RFC3315 section 18.2.1 (Request): -+ * -+ * When the server receives a Request message via unicast from a client -+ * to which the server has not sent a unicast option, the server -+ * discards the Request message and responds with a Reply message -+ * containing a Status Code option with the value UseMulticast, a Server -+ * Identifier option containing the server's DUID, the Client Identifier -+ * option from the client message, and no other options. -+ * -+ * Section 18.2.3 (Renew): -+ * -+ * When the server receives a Renew message via unicast from a client to -+ * which the server has not sent a unicast option, the server discards -+ * the Renew message and responds with a Reply message containing a -+ * Status Code option with the value UseMulticast, a Server Identifier -+ * option containing the server's DUID, the Client Identifier option -+ * from the client message, and no other options. -+ */ -+ { -+ /* Set the UseMulticast status code. */ -+ if (!set_status_code(STATUS_UseMulticast, -+ "Unicast not allowed by server.", -+ reply.opt_state)) { -+ log_error("lease_to_client: Unable to set " -+ "UseMulticast status code."); -+ goto exit; -+ } -+ -+ /* Rewind the cursor to the start. */ -+ reply.cursor = REPLY_OPTIONS_INDEX; -+ -+ /* -+ * Produce an reply that includes only: -+ * -+ * Status code. -+ * Server DUID. -+ * Client DUID. -+ */ -+ reply.cursor += store_options6((char *)reply.buf.data + -+ reply.cursor, -+ sizeof(reply.buf) - -+ reply.cursor, -+ reply.opt_state, reply.packet, -+ required_opts_NAA, -+ NULL); -+ } -+ - /* - * RFC3315 section 17.2.2 (Solicit): - * -@@ -1619,6 +1717,7 @@ lease_to_client(struct data_string *repl - * Having stored the client's IA's, store any options that - * will fit in the remaining space. - */ -+ else - reply.cursor += store_options6((char *)reply.buf.data + reply.cursor, - sizeof(reply.buf) - reply.cursor, - reply.opt_state, reply.packet, -@@ -4748,7 +4847,6 @@ dhcpv6_solicit(struct data_string *reply - * Very similar to Solicit handling, except the server DUID is required. - */ - --/* TODO: reject unicast messages, unless we set unicast option */ - static void - dhcpv6_request(struct data_string *reply_ret, struct packet *packet) { - struct data_string client_id; -@@ -5078,7 +5176,6 @@ exit: - * except for the error code of when addresses don't match. - */ - --/* TODO: reject unicast messages, unless we set unicast option */ - static void - dhcpv6_renew(struct data_string *reply, struct packet *packet) { - struct data_string client_id; -@@ -5322,18 +5419,60 @@ iterate_over_ia_na(struct data_string *r - goto exit; - } - -- snprintf(status_msg, sizeof(status_msg), "%s received.", packet_type); -- if (!set_status_code(STATUS_Success, status_msg, opt_state)) { -- goto exit; -- } -+ /* reject unicast message, unless we set unicast option */ -+ if ((packet->unicast == ISC_TRUE) && !is_unicast_option_defined()) { -+ /* -+ * RFC3315 section 18.2.6 (Release): -+ * -+ * When the server receives a Release message via unicast from a client -+ * to which the server has not sent a unicast option, the server -+ * discards the Release message and responds with a Reply message -+ * containing a Status Code option with value UseMulticast, a Server -+ * Identifier option containing the server's DUID, the Client Identifier -+ * option from the client message, and no other options. -+ * -+ * Section 18.2.7 (Decline): -+ * -+ * When the server receives a Decline message via unicast from a client -+ * to which the server has not sent a unicast option, the server -+ * discards the Decline message and responds with a Reply message -+ * containing a Status Code option with the value UseMulticast, a Server -+ * Identifier option containing the server's DUID, the Client Identifier -+ * option from the client message, and no other options. -+ */ -+ snprintf(status_msg, sizeof(status_msg), -+ "%s received unicast.", packet_type); -+ if (!set_status_code(STATUS_UseMulticast, status_msg, opt_state)) { -+ goto exit; -+ } - -- /* -- * Add our options that are not associated with any IA_NA or IA_TA. -- */ -- reply_ofs += store_options6(reply_data+reply_ofs, -- sizeof(reply_data)-reply_ofs, -+ /* -+ * Produce an reply that includes only: -+ * -+ * Status code. -+ * Server DUID. -+ * Client DUID. -+ */ -+ reply_ofs += store_options6(reply_data+reply_ofs, -+ sizeof(reply_data)-reply_ofs, - opt_state, packet, -- required_opts, NULL); -+ required_opts_NAA, NULL); -+ -+ goto return_reply; -+ } else { -+ snprintf(status_msg, sizeof(status_msg), "%s received.", packet_type); -+ if (!set_status_code(STATUS_Success, status_msg, opt_state)) { -+ goto exit; -+ } -+ -+ /* -+ * Add our options that are not associated with any IA_NA or IA_TA. -+ */ -+ reply_ofs += store_options6(reply_data+reply_ofs, -+ sizeof(reply_data)-reply_ofs, -+ opt_state, packet, -+ required_opts, NULL); -+ } - - /* - * Loop through the IA_NA reported by the client, and deal with -@@ -5471,6 +5610,7 @@ iterate_over_ia_na(struct data_string *r - /* - * Return our reply to the caller. - */ -+return_reply: - reply_ret->len = reply_ofs; - reply_ret->buffer = NULL; - if (!buffer_allocate(&reply_ret->buffer, reply_ofs, MDL)) { -@@ -5516,7 +5656,6 @@ exit: - * we still need to be aware of this possibility. - */ - --/* TODO: reject unicast messages, unless we set unicast option */ - /* TODO: IA_TA */ - static void - dhcpv6_decline(struct data_string *reply, struct packet *packet) { -@@ -5986,7 +6125,6 @@ exit: - * Release means a client is done with the leases. - */ - --/* TODO: reject unicast messages, unless we set unicast option */ - static void - dhcpv6_release(struct data_string *reply, struct packet *packet) { - struct data_string client_id; diff --git a/src/patches/dhcp/dhcp-add_timeout_when_NULL.patch b/src/patches/dhcp/dhcp-add_timeout_when_NULL.patch deleted file mode 100644 index 103824c38..000000000 --- a/src/patches/dhcp/dhcp-add_timeout_when_NULL.patch +++ /dev/null @@ -1,14 +0,0 @@ -diff -up dhcp-4.3.0a1/common/dispatch.c.dracut dhcp-4.3.0a1/common/dispatch.c ---- dhcp-4.3.0a1/common/dispatch.c.dracut 2013-12-11 01:25:12.000000000 +0100 -+++ dhcp-4.3.0a1/common/dispatch.c 2013-12-19 15:39:50.350505860 +0100 -@@ -210,6 +210,10 @@ void add_timeout (when, where, what, ref - isc_interval_t interval; - isc_time_t expires; - -+ if (when == NULL) { -+ return; -+ } -+ - /* See if this timeout supersedes an existing timeout. */ - t = (struct timeout *)0; - for (q = timeouts; q; q = q->next) { diff --git a/src/patches/dhcp/dhcp-capability.patch b/src/patches/dhcp/dhcp-capability.patch deleted file mode 100644 index 91a1baef5..000000000 --- a/src/patches/dhcp/dhcp-capability.patch +++ /dev/null @@ -1,250 +0,0 @@ -diff -up dhcp-4.3.1b1/client/dhclient.8.zzftXp dhcp-4.3.1b1/client/dhclient.8 ---- dhcp-4.3.1b1/client/dhclient.8.zzftXp 2014-07-10 17:38:26.938599402 +0200 -+++ dhcp-4.3.1b1/client/dhclient.8 2014-07-10 17:39:25.852763873 +0200 -@@ -128,6 +128,9 @@ dhclient - Dynamic Host Configuration Pr - .B -w - ] - [ -+.B -nc -+] -+[ - .B -B - ] - [ -@@ -304,6 +307,32 @@ has been added or removed, so that the c - address on that interface. - - .TP -+.BI \-nc -+Do not drop capabilities. -+ -+Normally, if -+.B dhclient -+was compiled with libcap-ng support, -+.B dhclient -+drops most capabilities immediately upon startup. While more secure, -+this greatly restricts the additional actions that hooks in -+.B dhclient-script (8) -+can take. (For example, any daemons that -+.B dhclient-script (8) -+starts or restarts will inherit the restricted capabilities as well, -+which may interfere with their correct operation.) Thus, the -+.BI \-nc -+option can be used to prevent -+.B dhclient -+from dropping capabilities. -+ -+The -+.BI \-nc -+option is ignored if -+.B dhclient -+was not compiled with libcap-ng support. -+ -+.TP - .BI \-B - Set the BOOTP broadcast flag in request packets so servers will always - broadcast replies. -diff -up dhcp-4.3.1b1/client/dhclient.c.zzftXp dhcp-4.3.1b1/client/dhclient.c ---- dhcp-4.3.1b1/client/dhclient.c.zzftXp 2014-07-10 17:39:25.797764653 +0200 -+++ dhcp-4.3.1b1/client/dhclient.c 2014-07-10 17:39:25.853763858 +0200 -@@ -39,6 +39,10 @@ - #include <limits.h> - #include <dns/result.h> - -+#ifdef HAVE_LIBCAP_NG -+#include <cap-ng.h> -+#endif -+ - /* - * Defined in stdio.h when _GNU_SOURCE is set, but we don't want to define - * that when building ISC code. -@@ -143,6 +147,9 @@ main(int argc, char **argv) { - int timeout_arg = 0; - char *arg_conf = NULL; - int arg_conf_len = 0; -+#ifdef HAVE_LIBCAP_NG -+ int keep_capabilities = 0; -+#endif - - /* Initialize client globals. */ - memset(&default_duid, 0, sizeof(default_duid)); -@@ -425,6 +432,10 @@ main(int argc, char **argv) { - } - - dhclient_request_options = argv[i]; -+ } else if (!strcmp(argv[i], "-nc")) { -+#ifdef HAVE_LIBCAP_NG -+ keep_capabilities = 1; -+#endif - } else if (argv[i][0] == '-') { - usage(); - } else if (interfaces_requested < 0) { -@@ -473,6 +484,19 @@ main(int argc, char **argv) { - path_dhclient_script = s; - } - -+#ifdef HAVE_LIBCAP_NG -+ /* Drop capabilities */ -+ if (!keep_capabilities) { -+ capng_clear(CAPNG_SELECT_CAPS); -+ capng_update(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED, -+ CAP_DAC_OVERRIDE); // Drop this someday -+ capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED, -+ CAP_NET_ADMIN, CAP_NET_RAW, -+ CAP_NET_BIND_SERVICE, CAP_SYS_ADMIN, -1); -+ capng_apply(CAPNG_SELECT_CAPS); -+ } -+#endif -+ - /* Set up the initial dhcp option universe. */ - initialize_common_option_spaces(); - -diff -up dhcp-4.3.1b1/client/dhclient-script.8.zzftXp dhcp-4.3.1b1/client/dhclient-script.8 ---- dhcp-4.3.1b1/client/dhclient-script.8.zzftXp 2014-07-10 17:39:25.761765163 +0200 -+++ dhcp-4.3.1b1/client/dhclient-script.8 2014-07-10 17:39:25.851763887 +0200 -@@ -243,6 +243,16 @@ repeatedly initialized to the values pro - the other. Assuming the information provided by both servers is - valid, this shouldn't cause any real problems, but it could be - confusing. -+.PP -+Normally, if dhclient was compiled with libcap-ng support, -+dhclient drops most capabilities immediately upon startup. -+While more secure, this greatly restricts the additional actions that -+hooks in dhclient-script can take. For example, any daemons that -+dhclient-script starts or restarts will inherit the restricted -+capabilities as well, which may interfere with their correct operation. -+Thus, the -+.BI \-nc -+option can be used to prevent dhclient from dropping capabilities. - .SH SEE ALSO - dhclient(8), dhcpd(8), dhcrelay(8), dhclient.conf(5) and - dhclient.leases(5). -diff -up dhcp-4.3.1b1/client/Makefile.am.zzftXp dhcp-4.3.1b1/client/Makefile.am ---- dhcp-4.3.1b1/client/Makefile.am.zzftXp 2014-07-10 17:38:10.778828583 +0200 -+++ dhcp-4.3.1b1/client/Makefile.am 2014-07-10 17:39:25.851763887 +0200 -@@ -10,7 +10,7 @@ dhclient_SOURCES = clparse.c dhclient.c - scripts/bsdos scripts/freebsd scripts/linux scripts/macos \ - scripts/netbsd scripts/nextstep scripts/openbsd \ - scripts/solaris scripts/openwrt --dhclient_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \ -+dhclient_LDADD = ../common/libdhcp.a ../omapip/libomapi.la $(CAPNG_LDADD) \ - $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc - man_MANS = dhclient.8 dhclient-script.8 dhclient.conf.5 dhclient.leases.5 - EXTRA_DIST = $(man_MANS) -diff -up dhcp-4.3.1b1/configure.ac.zzftXp dhcp-4.3.1b1/configure.ac ---- dhcp-4.3.1b1/configure.ac.zzftXp 2014-07-10 17:38:10.779828569 +0200 -+++ dhcp-4.3.1b1/configure.ac 2014-07-10 17:39:25.854763844 +0200 -@@ -499,6 +499,41 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[]], - # Look for optional headers. - AC_CHECK_HEADERS(sys/socket.h net/if_dl.h net/if6.h regex.h) - -+# look for capabilities library -+AC_ARG_WITH(libcap-ng, -+ [ --with-libcap-ng=[auto/yes/no] Add Libcap-ng support [default=auto]],, -+ with_libcap_ng=auto) -+ -+# Check for Libcap-ng API -+# -+# libcap-ng detection -+if test x$with_libcap_ng = xno ; then -+ have_libcap_ng=no; -+else -+ # Start by checking for header file -+ AC_CHECK_HEADER(cap-ng.h, capng_headers=yes, capng_headers=no) -+ -+ # See if we have libcap-ng library -+ AC_CHECK_LIB(cap-ng, capng_clear, -+ CAPNG_LDADD=-lcap-ng,) -+ -+ # Check results are usable -+ if test x$with_libcap_ng = xyes -a x$CAPNG_LDADD = x ; then -+ AC_MSG_ERROR(libcap-ng support was requested and the library was not found) -+ fi -+ if test x$CAPNG_LDADD != x -a $capng_headers = no ; then -+ AC_MSG_ERROR(libcap-ng libraries found but headers are missing) -+ fi -+fi -+AC_SUBST(CAPNG_LDADD) -+AC_MSG_CHECKING(whether to use libcap-ng) -+if test x$CAPNG_LDADD != x ; then -+ AC_DEFINE(HAVE_LIBCAP_NG,1,[libcap-ng support]) -+ AC_MSG_RESULT(yes) -+else -+ AC_MSG_RESULT(no) -+fi -+ - # Solaris needs some libraries for functions - AC_SEARCH_LIBS(socket, [socket]) - AC_SEARCH_LIBS(inet_ntoa, [nsl]) -diff -up dhcp-4.3.1b1/relay/dhcrelay.c.zzftXp dhcp-4.3.1b1/relay/dhcrelay.c ---- dhcp-4.3.1b1/relay/dhcrelay.c.zzftXp 2014-07-10 17:39:25.799764624 +0200 -+++ dhcp-4.3.1b1/relay/dhcrelay.c 2014-07-10 17:40:19.191007421 +0200 -@@ -31,6 +31,11 @@ - #include <signal.h> - #include <sys/time.h> - -+#ifdef HAVE_LIBCAP_NG -+# include <cap-ng.h> -+ int keep_capabilities = 0; -+#endif -+ - TIME default_lease_time = 43200; /* 12 hours... */ - TIME max_lease_time = 86400; /* 24 hours... */ - struct tree_cache *global_options[256]; -@@ -376,6 +381,10 @@ main(int argc, char **argv) { - usage(); - dhcrelay_sub_id = argv[i]; - #endif -+ } else if (!strcmp(argv[i], "-nc")) { -+#ifdef HAVE_LIBCAP_NG -+ keep_capabilities = 1; -+#endif - } else if (!strcmp(argv[i], "-pf")) { - if (++i == argc) - usage(); -@@ -446,6 +455,17 @@ main(int argc, char **argv) { - #endif - } - -+#ifdef HAVE_LIBCAP_NG -+ /* Drop capabilities */ -+ if (!keep_capabilities) { -+ capng_clear(CAPNG_SELECT_BOTH); -+ capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED, -+ CAP_NET_RAW, CAP_NET_BIND_SERVICE, -1); -+ capng_apply(CAPNG_SELECT_BOTH); -+ log_info ("Dropped all unnecessary capabilities."); -+ } -+#endif -+ - if (!quiet) { - log_info("%s %s", message, PACKAGE_VERSION); - log_info(copyright); -@@ -598,6 +618,15 @@ main(int argc, char **argv) { - signal(SIGTERM, dhcp_signal_handler); /* kill */ - #endif - -+#ifdef HAVE_LIBCAP_NG -+ /* Drop all capabilities */ -+ if (!keep_capabilities) { -+ capng_clear(CAPNG_SELECT_BOTH); -+ capng_apply(CAPNG_SELECT_BOTH); -+ log_info ("Dropped all capabilities."); -+ } -+#endif -+ - /* Start dispatching packets and timeouts... */ - dispatch(); - -diff -up dhcp-4.3.1b1/relay/Makefile.am.zzftXp dhcp-4.3.1b1/relay/Makefile.am ---- dhcp-4.3.1b1/relay/Makefile.am.zzftXp 2014-07-10 17:38:10.780828554 +0200 -+++ dhcp-4.3.1b1/relay/Makefile.am 2014-07-10 17:39:25.854763844 +0200 -@@ -2,7 +2,7 @@ AM_CPPFLAGS = -DLOCALSTATEDIR='"@localst - - sbin_PROGRAMS = dhcrelay - dhcrelay_SOURCES = dhcrelay.c --dhcrelay_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \ -+dhcrelay_LDADD = ../common/libdhcp.a ../omapip/libomapi.la $(CAPNG_LDADD) \ - $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc - man_MANS = dhcrelay.8 - EXTRA_DIST = $(man_MANS) diff --git a/src/patches/dhcp/dhcp-default-requested-options.patch b/src/patches/dhcp/dhcp-default-requested-options.patch deleted file mode 100644 index afda222e6..000000000 --- a/src/patches/dhcp/dhcp-default-requested-options.patch +++ /dev/null @@ -1,44 +0,0 @@ -diff -up dhcp-4.3.0a1/client/clparse.c.requested dhcp-4.3.0a1/client/clparse.c ---- dhcp-4.3.0a1/client/clparse.c.requested 2013-12-19 15:13:27.276631307 +0100 -+++ dhcp-4.3.0a1/client/clparse.c 2013-12-19 15:13:27.313630789 +0100 -@@ -37,7 +37,7 @@ - - struct client_config top_level_config; - --#define NUM_DEFAULT_REQUESTED_OPTS 9 -+#define NUM_DEFAULT_REQUESTED_OPTS 14 - struct option *default_requested_options[NUM_DEFAULT_REQUESTED_OPTS + 1]; - - static void parse_client_default_duid(struct parse *cfile); -@@ -119,6 +119,31 @@ isc_result_t read_client_conf () - option_code_hash_lookup(&default_requested_options[8], - dhcpv6_universe.code_hash, &code, 0, MDL); - -+ /* 10 */ -+ code = DHO_NIS_DOMAIN; -+ option_code_hash_lookup(&default_requested_options[9], -+ dhcp_universe.code_hash, &code, 0, MDL); -+ -+ /* 11 */ -+ code = DHO_NIS_SERVERS; -+ option_code_hash_lookup(&default_requested_options[10], -+ dhcp_universe.code_hash, &code, 0, MDL); -+ -+ /* 12 */ -+ code = DHO_NTP_SERVERS; -+ option_code_hash_lookup(&default_requested_options[11], -+ dhcp_universe.code_hash, &code, 0, MDL); -+ -+ /* 13 */ -+ code = DHO_INTERFACE_MTU; -+ option_code_hash_lookup(&default_requested_options[12], -+ dhcp_universe.code_hash, &code, 0, MDL); -+ -+ /* 14 */ -+ code = DHO_DOMAIN_SEARCH; -+ option_code_hash_lookup(&default_requested_options[13], -+ dhcp_universe.code_hash, &code, 0, MDL); -+ - for (code = 0 ; code < NUM_DEFAULT_REQUESTED_OPTS ; code++) { - if (default_requested_options[code] == NULL) - log_fatal("Unable to find option definition for " diff --git a/src/patches/dhcp/dhcp-dhclient-decline-backoff.patch b/src/patches/dhcp/dhcp-dhclient-decline-backoff.patch deleted file mode 100644 index 3e52e6400..000000000 --- a/src/patches/dhcp/dhcp-dhclient-decline-backoff.patch +++ /dev/null @@ -1,63 +0,0 @@ -diff -up dhcp-4.3.1b1/client/dhclient.c.JwFUZj dhcp-4.3.1b1/client/dhclient.c ---- dhcp-4.3.1b1/client/dhclient.c.JwFUZj 2014-07-10 17:38:50.511265091 +0200 -+++ dhcp-4.3.1b1/client/dhclient.c 2014-07-10 17:39:16.164901267 +0200 -@@ -1281,6 +1281,8 @@ void state_init (cpp) - void *cpp; - { - struct client_state *client = cpp; -+ enum dhcp_state init_state = client->state; -+ struct timeval tv; - - ASSERT_STATE(state, S_INIT); - -@@ -1293,9 +1295,18 @@ void state_init (cpp) - client -> first_sending = cur_time; - client -> interval = client -> config -> initial_interval; - -- /* Add an immediate timeout to cause the first DHCPDISCOVER packet -- to go out. */ -- send_discover (client); -+ if (init_state != S_DECLINED) { -+ /* Add an immediate timeout to cause the first DHCPDISCOVER packet -+ to go out. */ -+ send_discover(client); -+ } else { -+ /* We've received an OFFER and it has been DECLINEd by dhclient-script. -+ * wait for a random time between 1 and backoff_cutoff seconds before -+ * trying again. */ -+ tv . tv_sec = cur_time + ((1 + (random() >> 2)) % client->config->backoff_cutoff); -+ tv . tv_usec = 0; -+ add_timeout(&tv, send_discover, client, 0, 0); -+ } - } - - /* -@@ -1592,6 +1603,7 @@ void bind_lease (client) - "try (declined). Exiting."); - exit(2); - } else { -+ client -> state = S_DECLINED; - state_init(client); - return; - } -@@ -4059,6 +4071,7 @@ void client_location_changed () - case S_INIT: - case S_REBINDING: - case S_STOPPED: -+ case S_DECLINED: - break; - } - client -> state = S_INIT; -diff -up dhcp-4.3.1b1/includes/dhcpd.h.JwFUZj dhcp-4.3.1b1/includes/dhcpd.h ---- dhcp-4.3.1b1/includes/dhcpd.h.JwFUZj 2014-07-10 17:38:26.941599360 +0200 -+++ dhcp-4.3.1b1/includes/dhcpd.h 2014-07-10 17:38:50.526264878 +0200 -@@ -1087,7 +1087,8 @@ enum dhcp_state { - S_BOUND = 5, - S_RENEWING = 6, - S_REBINDING = 7, -- S_STOPPED = 8 -+ S_STOPPED = 8, -+ S_DECLINED = 9 - }; - - /* Authentication and BOOTP policy possibilities (not all values work diff --git a/src/patches/dhcp/dhcp-dhclient-options.patch b/src/patches/dhcp/dhcp-dhclient-options.patch deleted file mode 100644 index 67f144ecb..000000000 --- a/src/patches/dhcp/dhcp-dhclient-options.patch +++ /dev/null @@ -1,509 +0,0 @@ -diff -up dhcp-4.3.1b1/client/clparse.c.fLPqYB dhcp-4.3.1b1/client/clparse.c ---- dhcp-4.3.1b1/client/clparse.c.fLPqYB 2014-07-02 19:58:38.000000000 +0200 -+++ dhcp-4.3.1b1/client/clparse.c 2014-07-10 17:38:26.938599402 +0200 -@@ -148,6 +148,7 @@ isc_result_t read_client_conf () - /* Requested lease time, used by DHCPv6 (DHCPv4 uses the option cache) - */ - top_level_config.requested_lease = 7200; -+ top_level_config.bootp_broadcast_always = 0; - - group_allocate (&top_level_config.on_receipt, MDL); - if (!top_level_config.on_receipt) -@@ -353,7 +354,8 @@ void read_client_leases () - interface-declaration | - LEASE client-lease-statement | - ALIAS client-lease-statement | -- KEY key-definition */ -+ KEY key-definition | -+ BOOTP_BROADCAST_ALWAYS */ - - void parse_client_statement (cfile, ip, config) - struct parse *cfile; -@@ -771,6 +773,12 @@ void parse_client_statement (cfile, ip, - parse_reject_statement (cfile, config); - return; - -+ case BOOTP_BROADCAST_ALWAYS: -+ token = next_token(&val, (unsigned*)0, cfile); -+ config -> bootp_broadcast_always = 1; -+ parse_semi (cfile); -+ return; -+ - default: - lose = 0; - stmt = (struct executable_statement *)0; -diff -up dhcp-4.3.1b1/client/dhclient.8.fLPqYB dhcp-4.3.1b1/client/dhclient.8 ---- dhcp-4.3.1b1/client/dhclient.8.fLPqYB 2014-07-02 19:58:38.000000000 +0200 -+++ dhcp-4.3.1b1/client/dhclient.8 2014-07-10 17:38:26.938599402 +0200 -@@ -128,6 +128,33 @@ dhclient - Dynamic Host Configuration Pr - .B -w - ] - [ -+.B -B -+] -+[ -+.B -C -+.I dhcp-client-identifier -+] -+[ -+.B -H -+.I host-name -+] -+[ -+.B -F -+.I fqdn.fqdn -+] -+[ -+.B -V -+.I vendor-class-identifier -+] -+[ -+.B -R -+.I request-option-list -+] -+[ -+.B -timeout -+.I timeout -+] -+[ - .B -v - ] - [ -@@ -275,6 +302,69 @@ not to exit when it doesn't find any suc - program can then be used to notify the client when a network interface - has been added or removed, so that the client can attempt to configure an IP - address on that interface. -+ -+.TP -+.BI \-B -+Set the BOOTP broadcast flag in request packets so servers will always -+broadcast replies. -+ -+.TP -+.BI \-C\ <dhcp-client-identifier> -+Specify the dhcp-client-identifier option to send to the DHCP server. -+ -+.TP -+.BI \-H\ <host-name> -+Specify the host-name option to send to the DHCP server. The host-name -+string only contains the client's hostname prefix, to which the server will -+append the ddns-domainname or domain-name options, if any, to derive the -+fully qualified domain name of the client. The -+.B -H -+option cannot be used with the -+.B -F -+option. -+ -+.TP -+.BI \-F\ <fqdn.fqdn> -+Specify the fqdn.fqdn option to send to the DHCP server. This option cannot -+be used with the -+.B -H -+option. The fqdn.fqdn option must specify the complete domain name of the -+client host, which the server may use for dynamic DNS updates. -+ -+.TP -+.BI \-V\ <vendor-class-identifier> -+Specify the vendor-class-identifier option to send to the DHCP server. -+ -+.TP -+.BI \-R\ <option>[,<option>...] -+Specify the list of options the client is to request from the server. The -+option list must be a single string consisting of option names separated -+by at least one command and optional space characters. The default option -+list is: -+ -+.BR -+ subnet-mask, broadcast-address, time-offset, routers, -+.BR -+ domain-search, domain-name, domain-name-servers, host-name, -+.BR -+ nis-domain, nis-servers, ntp-servers, interface-mtu -+ -+.TP -+.B -R -+option does not append options to the default request, it overrides the -+default request list. Keep this in mind if you want to request an -+additional option besides the default request list. You will have to -+specify all option names for the -+.B -R -+parameter. -+ -+.TP -+.BI \-timeout\ <timeout> -+Specify the time after which -+.B dhclient -+will decide that no DHCP servers can be contacted when no responses have been -+received. -+ - .TP - .BI \-n - Do not configure any interfaces. This is most likely to be useful in -diff -up dhcp-4.3.1b1/client/dhclient.c.fLPqYB dhcp-4.3.1b1/client/dhclient.c ---- dhcp-4.3.1b1/client/dhclient.c.fLPqYB 2014-07-02 19:58:38.000000000 +0200 -+++ dhcp-4.3.1b1/client/dhclient.c 2014-07-10 17:38:44.520350055 +0200 -@@ -39,6 +39,12 @@ - #include <limits.h> - #include <dns/result.h> - -+/* -+ * Defined in stdio.h when _GNU_SOURCE is set, but we don't want to define -+ * that when building ISC code. -+ */ -+extern int asprintf(char **strp, const char *fmt, ...); -+ - TIME default_lease_time = 43200; /* 12 hours... */ - TIME max_lease_time = 86400; /* 24 hours... */ - -@@ -88,6 +94,9 @@ int wanted_ia_na = -1; /* the absolute - int wanted_ia_ta = 0; - int wanted_ia_pd = 0; - char *mockup_relay = NULL; -+int bootp_broadcast_always = 0; -+ -+extern struct option *default_requested_options[]; - - void run_stateless(int exit_mode); - -@@ -125,6 +134,15 @@ main(int argc, char **argv) { - int local_family_set = 0; - #endif /* DHCPv6 */ - char *s; -+ char *dhcp_client_identifier_arg = NULL; -+ char *dhcp_host_name_arg = NULL; -+ char *dhcp_fqdn_arg = NULL; -+ char *dhcp_vendor_class_identifier_arg = NULL; -+ char *dhclient_request_options = NULL; -+ -+ int timeout_arg = 0; -+ char *arg_conf = NULL; -+ int arg_conf_len = 0; - - /* Initialize client globals. */ - memset(&default_duid, 0, sizeof(default_duid)); -@@ -325,6 +343,88 @@ main(int argc, char **argv) { - strlen(PACKAGE_VERSION))); - IGNORE_RET(write(STDERR_FILENO, "\n", 1)); - exit(0); -+ } else if (!strcmp(argv[i], "-C")) { -+ if ((++i == argc) || (argv[i] == NULL) || (*(argv[i])=='\0')) { -+ usage(); -+ exit(1); -+ } -+ -+ if (strlen(argv[i]) >= DHCP_MAX_OPTION_LEN) { -+ log_error("-C option dhcp-client-identifier string \"%s\" is too long - maximum length is: %d", argv[i], DHCP_MAX_OPTION_LEN-1); -+ exit(1); -+ } -+ -+ dhcp_client_identifier_arg = argv[i]; -+ } else if (!strcmp(argv[i], "-B")) { -+ bootp_broadcast_always = 1; -+ } else if (!strcmp(argv[i], "-H")) { -+ if ((++i == argc) || (argv[i] == NULL) || (*(argv[i])=='\0')) { -+ usage(); -+ exit(1); -+ } -+ -+ if (strlen(argv[i]) >= DHCP_MAX_OPTION_LEN) { -+ log_error("-H option host-name string \"%s\" is too long - maximum length is: %d", argv[i], DHCP_MAX_OPTION_LEN-1); -+ exit(1); -+ } -+ -+ if (dhcp_host_name_arg != NULL) { -+ log_error("The -H <host-name> and -F <fqdn> arguments are mutually exclusive"); -+ exit(1); -+ } -+ -+ dhcp_host_name_arg = argv[i]; -+ } else if (!strcmp(argv[i], "-F")) { -+ if ((++i == argc) || (argv[i] == NULL) || (*(argv[i])=='\0')) { -+ usage(); -+ exit(1); -+ } -+ -+ if (strlen(argv[i]) >= DHCP_MAX_OPTION_LEN) { -+ log_error("-F option fqdn.fqdn string \"%s\" is too long - maximum length is: %d", argv[i], DHCP_MAX_OPTION_LEN-1); -+ exit(1); -+ } -+ -+ if (dhcp_fqdn_arg != NULL) { -+ log_error("Only one -F <fqdn> argument can be specified"); -+ exit(1); -+ } -+ -+ if (dhcp_host_name_arg != NULL) { -+ log_error("The -F <fqdn> and -H <host-name> arguments are mutually exclusive"); -+ exit(1); -+ } -+ -+ dhcp_fqdn_arg = argv[i]; -+ } else if (!strcmp(argv[i], "-timeout")) { -+ if ((++i == argc) || (argv[i] == NULL) || (*(argv[i])=='\0')) { -+ usage(); -+ exit(1); -+ } -+ -+ if ((timeout_arg = atoi(argv[i])) <= 0) { -+ log_error("timeout option must be > 0 - bad value: %s",argv[i]); -+ exit(1); -+ } -+ } else if (!strcmp(argv[i], "-V")) { -+ if ((++i == argc) || (argv[i] == NULL) || (*(argv[i])=='\0')) { -+ usage(); -+ exit(1); -+ } -+ -+ if (strlen(argv[i]) >= DHCP_MAX_OPTION_LEN) { -+ log_error("-V option vendor-class-identifier string \"%s\" is too long - maximum length is: %d", argv[i], DHCP_MAX_OPTION_LEN-1); -+ exit(1); -+ } -+ -+ dhcp_vendor_class_identifier_arg = argv[i]; -+ } else if (!strcmp(argv[i], "-R")) { -+ if ((++i == argc) || (argv[i] == NULL) || (*(argv[i])=='\0')) { -+ usage(); -+ exit(1); -+ } -+ -+ dhclient_request_options = argv[i]; - } else if (argv[i][0] == '-') { - usage(); - } else if (interfaces_requested < 0) { -@@ -507,6 +607,156 @@ main(int argc, char **argv) { - /* Parse the dhclient.conf file. */ - read_client_conf(); - -+ /* Parse any extra command line configuration arguments: */ -+ if ((dhcp_client_identifier_arg != NULL) && (*dhcp_client_identifier_arg != '\0')) { -+ arg_conf_len = asprintf(&arg_conf, "send dhcp-client-identifier \"%s\";", dhcp_client_identifier_arg); -+ -+ if ((arg_conf == 0) || (arg_conf_len <= 0)) -+ log_fatal("Unable to send -C option dhcp-client-identifier"); -+ } -+ -+ if ((dhcp_host_name_arg != NULL) && (*dhcp_host_name_arg != '\0')) { -+ if (arg_conf == 0) { -+ arg_conf_len = asprintf(&arg_conf, "send host-name \"%s\";", dhcp_host_name_arg); -+ -+ if ((arg_conf == 0) || (arg_conf_len <= 0)) -+ log_fatal("Unable to send -H option host-name"); -+ } else { -+ char *last_arg_conf = arg_conf; -+ arg_conf = NULL; -+ arg_conf_len = asprintf(&arg_conf, "%s\nsend host-name \"%s\";", last_arg_conf, dhcp_host_name_arg); -+ -+ if ((arg_conf == 0) || (arg_conf_len <= 0)) -+ log_fatal("Unable to send -H option host-name"); -+ -+ free(last_arg_conf); -+ } -+ } -+ -+ if ((dhcp_fqdn_arg != NULL) && (*dhcp_fqdn_arg != '\0')) { -+ if (arg_conf == 0) { -+ arg_conf_len = asprintf(&arg_conf, "send fqdn.fqdn \"%s\";", dhcp_fqdn_arg); -+ -+ if ((arg_conf == 0) || (arg_conf_len <= 0)) -+ log_fatal("Unable to send -F option fqdn.fqdn"); -+ } else { -+ char *last_arg_conf = arg_conf; -+ arg_conf = NULL; -+ arg_conf_len = asprintf(&arg_conf, "%s\nsend fqdn.fqdn \"%s\";", last_arg_conf, dhcp_fqdn_arg); -+ -+ if ((arg_conf == 0) || (arg_conf_len <= 0)) -+ log_fatal("Unable to send -F option fqdn.fqdn"); -+ -+ free(last_arg_conf); -+ } -+ } -+ -+ if (timeout_arg) { -+ if (arg_conf == 0) { -+ arg_conf_len = asprintf(&arg_conf, "timeout %d;", timeout_arg); -+ -+ if ((arg_conf == 0) || (arg_conf_len <= 0)) -+ log_fatal("Unable to process -timeout timeout argument"); -+ } else { -+ char *last_arg_conf = arg_conf; -+ arg_conf = NULL; -+ arg_conf_len = asprintf(&arg_conf, "%s\ntimeout %d;", last_arg_conf, timeout_arg); -+ -+ if ((arg_conf == 0) || (arg_conf_len == 0)) -+ log_fatal("Unable to process -timeout timeout argument"); -+ -+ free(last_arg_conf); -+ } -+ } -+ -+ if ((dhcp_vendor_class_identifier_arg != NULL) && (*dhcp_vendor_class_identifier_arg != '\0')) { -+ if (arg_conf == 0) { -+ arg_conf_len = asprintf(&arg_conf, "send vendor-class-identifier \"%s\";", dhcp_vendor_class_identifier_arg); -+ -+ if ((arg_conf == 0) || (arg_conf_len <= 0)) -+ log_fatal("Unable to send -V option vendor-class-identifier"); -+ } else { -+ char *last_arg_conf = arg_conf; -+ arg_conf = NULL; -+ arg_conf_len = asprintf(&arg_conf, "%s\nsend vendor-class-identifier \"%s\";", last_arg_conf, dhcp_vendor_class_identifier_arg); -+ -+ if ((arg_conf == 0) || (arg_conf_len <= 0)) -+ log_fatal("Unable to send -V option vendor-class-identifier"); -+ -+ free(last_arg_conf); -+ } -+ } -+ -+ if (dhclient_request_options != NULL) { -+ if (arg_conf == 0) { -+ arg_conf_len = asprintf(&arg_conf, "request %s;", dhclient_request_options); -+ -+ if ((arg_conf == 0) || (arg_conf_len <= 0)) -+ log_fatal("Unable to parse -R <request options list> argument"); -+ } else { -+ char *last_arg_conf = arg_conf; -+ arg_conf = NULL; -+ arg_conf_len = asprintf(&arg_conf, "%s\nrequest %s;", last_arg_conf, dhclient_request_options); -+ -+ if ((arg_conf == 0) || (arg_conf_len <= 0)) -+ log_fatal("Unable to parse -R <request options list> argument"); -+ -+ free(last_arg_conf); -+ } -+ } -+ -+ if (arg_conf) { -+ if (arg_conf_len == 0) -+ if ((arg_conf_len = strlen(arg_conf)) == 0) -+ /* huh ? cannot happen ! */ -+ log_fatal("Unable to process -C/-H/-F/-timeout/-V/-R configuration arguments"); -+ -+ /* parse the extra dhclient.conf configuration arguments -+ * into top level config: */ -+ struct parse *cfile = (struct parse *)0; -+ const char *val = NULL; -+ int token; -+ -+ status = new_parse(&cfile, -1, arg_conf, arg_conf_len, "extra dhclient -C/-H/-F/-timeout/-V/-R configuration arguments", 0); -+ -+ if ((status != ISC_R_SUCCESS) || (cfile -> warnings_occurred)) -+ log_fatal("Cannot parse -C/-H/-F/-timeout/-V/-R configuration arguments !"); -+ /* more detailed parse failures will be logged */ -+ -+ do { -+ token = peek_token(&val, (unsigned *)0, cfile); -+ if (token == END_OF_FILE) -+ break; -+ -+ parse_client_statement(cfile, (struct interface_info *)0, &top_level_config); -+ } while (1); -+ -+ if (cfile -> warnings_occurred) -+ log_fatal("Cannot parse -C/-H/-F/-timeout/-V/-R configuration arguments !"); -+ end_parse(&cfile); -+ -+ if (timeout_arg) { -+ /* we just set the toplevel timeout, but per-client -+ * timeouts may still be at defaults. -+ */ -+ for (ip=interfaces; ip; ip = ip->next) { -+ if (ip->client->config->timeout == 60) -+ ip->client->config->timeout = timeout_arg; -+ } -+ } -+ -+ if ((dhclient_request_options != 0) && (top_level_config.requested_options != default_requested_options)) { -+ for (ip=interfaces; ip; ip = ip->next) { -+ if (ip->client->config->requested_options == default_requested_options) -+ ip->client->config->requested_options = top_level_config.requested_options; -+ } -+ } -+ -+ free(arg_conf); -+ arg_conf = NULL; -+ arg_conf_len = 0; -+ } -+ - /* Parse the lease database. */ - read_client_leases(); - -@@ -756,6 +1006,10 @@ static void usage() - " [-s server-addr] [-cf config-file]\n" - " [-df duid-file] [-lf lease-file]\n" - " [-pf pid-file] [--no-pid] [-e VAR=val]\n" -+ " [-C <dhcp-client-identifier>] [-B]\n" -+ " [-H <host-name> | -F <fqdn.fqdn>] [-timeout <timeout>]\n" -+ " [-V <vendor-class-identifier>]\n" -+ " [-R <request option list>]\n" - " [-sf script-file] [interface]"); - } - -@@ -2531,7 +2785,8 @@ void make_discover (client, lease) - client -> packet.xid = random (); - client -> packet.secs = 0; /* filled in by send_discover. */ - -- if (can_receive_unicast_unconfigured (client -> interface)) -+ if ((!(bootp_broadcast_always || client->config->bootp_broadcast_always)) -+ && can_receive_unicast_unconfigured(client->interface)) - client -> packet.flags = 0; - else - client -> packet.flags = htons (BOOTP_BROADCAST); -@@ -2615,7 +2870,9 @@ void make_request (client, lease) - } else { - memset (&client -> packet.ciaddr, 0, - sizeof client -> packet.ciaddr); -- if (can_receive_unicast_unconfigured (client -> interface)) -+ if ((!(bootp_broadcast_always || -+ client ->config->bootp_broadcast_always)) && -+ can_receive_unicast_unconfigured (client -> interface)) - client -> packet.flags = 0; - else - client -> packet.flags = htons (BOOTP_BROADCAST); -@@ -2677,7 +2934,8 @@ void make_decline (client, lease) - client -> packet.hops = 0; - client -> packet.xid = client -> xid; - client -> packet.secs = 0; /* Filled in by send_request. */ -- if (can_receive_unicast_unconfigured (client -> interface)) -+ if ((!(bootp_broadcast_always || client->config-> bootp_broadcast_always)) -+ && can_receive_unicast_unconfigured (client->interface)) - client -> packet.flags = 0; - else - client -> packet.flags = htons (BOOTP_BROADCAST); -diff -up dhcp-4.3.1b1/common/conflex.c.fLPqYB dhcp-4.3.1b1/common/conflex.c ---- dhcp-4.3.1b1/common/conflex.c.fLPqYB 2014-07-02 19:58:38.000000000 +0200 -+++ dhcp-4.3.1b1/common/conflex.c 2014-07-10 17:38:26.940599374 +0200 -@@ -811,6 +811,8 @@ intern(char *atom, enum dhcp_token dfv) - return BALANCE; - if (!strcasecmp (atom + 1, "ound")) - return BOUND; -+ if (!strcasecmp (atom + 1, "ootp-broadcast-always")) -+ return BOOTP_BROADCAST_ALWAYS; - break; - case 'c': - if (!strcasecmp(atom + 1, "ase")) -diff -up dhcp-4.3.1b1/includes/dhcpd.h.fLPqYB dhcp-4.3.1b1/includes/dhcpd.h ---- dhcp-4.3.1b1/includes/dhcpd.h.fLPqYB 2014-07-02 19:58:39.000000000 +0200 -+++ dhcp-4.3.1b1/includes/dhcpd.h 2014-07-10 17:38:26.941599360 +0200 -@@ -1152,6 +1152,9 @@ struct client_config { - int do_forward_update; /* If nonzero, and if we have the - information we need, update the - A record for the address we get. */ -+ -+ int bootp_broadcast_always; /* If nonzero, always set the BOOTP_BROADCAST -+ flag in requests */ - }; - - /* Per-interface state used in the dhcp client... */ -diff -up dhcp-4.3.1b1/includes/dhctoken.h.fLPqYB dhcp-4.3.1b1/includes/dhctoken.h ---- dhcp-4.3.1b1/includes/dhctoken.h.fLPqYB 2014-07-02 19:58:39.000000000 +0200 -+++ dhcp-4.3.1b1/includes/dhctoken.h 2014-07-10 17:38:26.942599346 +0200 -@@ -367,7 +367,8 @@ enum dhcp_token { - TOKEN_INFINIBAND = 668, - POOL6 = 669, - V6RELAY = 670, -- V6RELOPT = 671 -+ V6RELOPT = 671, -+ BOOTP_BROADCAST_ALWAYS = 672 - }; - - #define is_identifier(x) ((x) >= FIRST_TOKEN && \ diff --git a/src/patches/dhcp/dhcp-errwarn-message.patch b/src/patches/dhcp/dhcp-errwarn-message.patch deleted file mode 100644 index a65c2c2ed..000000000 --- a/src/patches/dhcp/dhcp-errwarn-message.patch +++ /dev/null @@ -1,22 +0,0 @@ -diff -up dhcp-4.3.0b1/omapip/errwarn.c.errwarn dhcp-4.3.0b1/omapip/errwarn.c ---- dhcp-4.3.0b1/omapip/errwarn.c.errwarn 2014-01-21 09:31:47.301334249 +0100 -+++ dhcp-4.3.0b1/omapip/errwarn.c 2014-01-21 09:33:20.569039072 +0100 -@@ -76,11 +76,13 @@ void log_fatal (const char * fmt, ... ) - } - - log_error ("%s", ""); -- log_error ("If you think you have received this message due to a bug rather"); -- log_error ("than a configuration issue please read the section on submitting"); -- log_error ("bugs on either our web page at www.isc.org or in the README file"); -- log_error ("before submitting a bug. These pages explain the proper"); -- log_error ("process and the information we find helpful for debugging.."); -+ log_error ("This version of ISC DHCP is based on the release available"); -+ log_error ("on ftp.isc.org. Features have been added and other changes"); -+ log_error ("have been made to the base software release in order to make"); -+ log_error ("it work better with this distribution."); -+ log_error ("%s", ""); -+ log_error ("Please report for this software via the Red Hat Bugzilla site:"); -+ log_error (" http://bugzilla.redhat.com"); - log_error ("%s", ""); - log_error ("exiting."); - diff --git a/src/patches/dhcp/dhcp-garbage-chars.patch b/src/patches/dhcp/dhcp-garbage-chars.patch deleted file mode 100644 index 131360be6..000000000 --- a/src/patches/dhcp/dhcp-garbage-chars.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up dhcp-4.3.0rc1/common/tables.c.garbage dhcp-4.3.0rc1/common/tables.c ---- dhcp-4.3.0rc1/common/tables.c.garbage 2014-01-29 10:03:52.132624677 +0100 -+++ dhcp-4.3.0rc1/common/tables.c 2014-01-29 10:04:51.413875343 +0100 -@@ -213,7 +213,7 @@ static struct option dhcp_options[] = { - { "name-service-search", "Sa", &dhcp_universe, 117, 1 }, - #endif - { "subnet-selection", "I", &dhcp_universe, 118, 1 }, -- { "domain-search", "Dc", &dhcp_universe, 119, 1 }, -+ { "domain-search", "D", &dhcp_universe, 119, 1 }, - { "vivco", "Evendor-class.", &dhcp_universe, 124, 1 }, - { "vivso", "Evendor.", &dhcp_universe, 125, 1 }, - #if 0 diff --git a/src/patches/dhcp/dhcp-gpxe-cid.patch b/src/patches/dhcp/dhcp-gpxe-cid.patch deleted file mode 100644 index c8c2b84f9..000000000 --- a/src/patches/dhcp/dhcp-gpxe-cid.patch +++ /dev/null @@ -1,73 +0,0 @@ -diff -up dhcp-4.3.0a1/client/dhclient.c.gpxe-cid dhcp-4.3.0a1/client/dhclient.c ---- dhcp-4.3.0a1/client/dhclient.c.gpxe-cid 2013-12-20 13:28:45.105048317 +0100 -+++ dhcp-4.3.0a1/client/dhclient.c 2013-12-20 13:28:45.109048261 +0100 -@@ -47,6 +47,14 @@ - const char *path_dhclient_pid = NULL; - static char path_dhclient_script_array[] = _PATH_DHCLIENT_SCRIPT; - char *path_dhclient_script = path_dhclient_script_array; -+ -+/* Default Prefix */ -+static unsigned char default_prefix[12] = { -+ 0xff, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x02, 0x00, -+ 0x00, 0x02, 0xc9, 0x00 -+}; -+ - const char *path_dhclient_duid = NULL; - - /* False (default) => we write and use a pid file */ -@@ -1253,6 +1260,12 @@ int find_subnet (struct subnet **sp, - static void setup_ib_interface(struct interface_info *ip) - { - struct group *g; -+ struct hardware *hw = &ip->hw_address; -+ char client_id[64]; -+ char *arg_conf = NULL; -+ int arg_conf_len = 0; -+ isc_result_t status; -+ struct parse *cfile = (struct parse *)0; - - /* Set the broadcast flag */ - ip->client->config->bootp_broadcast_always = 1; -@@ -1269,8 +1282,39 @@ static void setup_ib_interface(struct in - } - } - -- /* No client ID specified */ -- log_fatal("dhcp-client-identifier must be specified for InfiniBand"); -+ /* -+ * No client ID specified, make up one based on a default -+ * "prefix" and the port GUID. -+ * -+ * NOTE: This is compatible with what gpxe does. -+ */ -+ sprintf(client_id, "%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x", -+ default_prefix[0], default_prefix[1], default_prefix[2], -+ default_prefix[3], default_prefix[4], default_prefix[5], -+ default_prefix[6], default_prefix[7], default_prefix[8], -+ default_prefix[9], default_prefix[10], default_prefix[11], -+ hw->hbuf[1], hw->hbuf[2], hw->hbuf[3], hw->hbuf[4], -+ hw->hbuf[5], hw->hbuf[6], hw->hbuf[7], hw->hbuf[8]); -+ -+ arg_conf_len = asprintf(&arg_conf, -+ "send dhcp-client-identifier %s;", -+ client_id); -+ -+ if ((arg_conf == 0) || (arg_conf_len <= 0)) -+ log_fatal("Unable to send option dhcp-client-identifier"); -+ -+ status = new_parse(&cfile, -1, arg_conf, arg_conf_len, -+ "Automatic Infiniband client identifier", 0); -+ -+ if ((status != ISC_R_SUCCESS) || (cfile->warnings_occurred)) -+ log_fatal("Failed to parse Infiniband client identifier"); -+ -+ parse_client_statement(cfile, NULL, ip->client->config); -+ -+ if (cfile->warnings_occurred) -+ log_fatal("Failed to parse Infiniband client identifier"); -+ -+ end_parse(&cfile); - } - - /* Individual States: diff --git a/src/patches/dhcp/dhcp-honor-expired.patch b/src/patches/dhcp/dhcp-honor-expired.patch deleted file mode 100644 index bd892975b..000000000 --- a/src/patches/dhcp/dhcp-honor-expired.patch +++ /dev/null @@ -1,49 +0,0 @@ -diff -up dhcp-4.3.0a1/client/dhc6.c.honor-expired dhcp-4.3.0a1/client/dhc6.c ---- dhcp-4.3.0a1/client/dhc6.c.honor-expired 2013-12-19 16:00:28.062183037 +0100 -+++ dhcp-4.3.0a1/client/dhc6.c 2013-12-19 16:00:28.076182842 +0100 -@@ -1351,6 +1351,32 @@ start_info_request6(struct client_state - go_daemon(); - } - -+/* Run through the addresses in lease and return true if there's any unexpired. -+ * Return false otherwise. -+ */ -+isc_boolean_t -+unexpired_address_in_lease(struct dhc6_lease *lease) -+{ -+ struct dhc6_ia *ia; -+ struct dhc6_addr *addr; -+ -+ for (ia = lease->bindings ; ia != NULL ; ia = ia->next) { -+ for (addr = ia->addrs ; addr != NULL ; addr = addr->next) { -+ if (addr->flags & DHC6_ADDR_EXPIRED) -+ continue; -+ -+ if (addr->starts + addr->max_life > cur_time) { -+ return ISC_TRUE; -+ } -+ } -+ } -+ -+ log_info("PRC: Previous lease is devoid of active addresses." -+ " Re-initializing."); -+ -+ return ISC_FALSE; -+} -+ - /* - * start_confirm6() kicks off an "init-reboot" version of the process, at - * startup to find out if old bindings are 'fair' and at runtime whenever -@@ -1363,8 +1389,10 @@ start_confirm6(struct client_state *clie - - /* If there is no active lease, there is nothing to check. */ - if ((client->active_lease == NULL) || -- !active_prefix(client) || -- client->active_lease->released) { -+ !active_prefix(client) || -+ client->active_lease->released || -+ !unexpired_address_in_lease(client->active_lease)) { -+ dhc6_lease_destroy(&client->active_lease, MDL); - start_init6(client); - return; - } diff --git a/src/patches/dhcp/dhcp-improved-xid.patch b/src/patches/dhcp/dhcp-improved-xid.patch deleted file mode 100644 index eccff4987..000000000 --- a/src/patches/dhcp/dhcp-improved-xid.patch +++ /dev/null @@ -1,138 +0,0 @@ -diff -up dhcp-4.3.0a1/client/dhclient.c.improved-xid dhcp-4.3.0a1/client/dhclient.c ---- dhcp-4.3.0a1/client/dhclient.c.improved-xid 2013-12-20 13:29:41.836260810 +0100 -+++ dhcp-4.3.0a1/client/dhclient.c 2013-12-20 13:29:41.843260713 +0100 -@@ -894,6 +894,26 @@ main(int argc, char **argv) { - } - } - -+ /* We create a backup seed before rediscovering interfaces in order to -+ have a seed built using all of the available interfaces -+ It's interesting if required interfaces doesn't let us defined -+ a really unique seed due to a lack of valid HW addr later -+ (this is the case with DHCP over IB) -+ We only use the last device as using a sum could broke the -+ uniqueness of the seed among multiple nodes -+ */ -+ unsigned backup_seed = 0; -+ for (ip = interfaces; ip; ip = ip -> next) { -+ int junk; -+ if ( ip -> hw_address.hlen <= sizeof seed ) -+ continue; -+ memcpy (&junk, -+ &ip -> hw_address.hbuf [ip -> hw_address.hlen - -+ sizeof seed], sizeof seed); -+ backup_seed = junk; -+ } -+ -+ - /* At this point, all the interfaces that the script thinks - are relevant should be running, so now we once again call - discover_interfaces(), and this time ask it to actually set -@@ -908,14 +928,36 @@ main(int argc, char **argv) { - Not much entropy, but we're booting, so we're not likely to - find anything better. */ - seed = 0; -+ int seed_flag = 0; - for (ip = interfaces; ip; ip = ip->next) { - int junk; -+ if ( ip -> hw_address.hlen <= sizeof seed ) -+ continue; - memcpy(&junk, - &ip->hw_address.hbuf[ip->hw_address.hlen - - sizeof seed], sizeof seed); - seed += junk; -+ seed_flag = 1; - } -- srandom(seed + cur_time + (unsigned)getpid()); -+ if ( seed_flag == 0 ) { -+ if ( backup_seed != 0 ) { -+ seed = backup_seed; -+ log_info ("xid: rand init seed (0x%x) built using all" -+ " available interfaces",seed); -+ } -+ else { -+ seed = cur_time^((unsigned) gethostid()) ; -+ log_info ("xid: warning: no netdev with useable HWADDR found" -+ " for seed's uniqueness enforcement"); -+ log_info ("xid: rand init seed (0x%x) built using gethostid", -+ seed); -+ } -+ /* we only use seed and no current time as a broadcast reply */ -+ /* will certainly be used by the hwaddrless interface */ -+ srandom(seed); -+ } -+ else -+ srandom(seed + cur_time + (unsigned)getpid()); - - /* Setup specific Infiniband options */ - for (ip = interfaces; ip; ip = ip->next) { -@@ -1460,7 +1502,7 @@ void dhcpack (packet) - return; - } - -- log_info ("DHCPACK from %s", piaddr (packet -> client_addr)); -+ log_info ("DHCPACK from %s (xid=0x%x)", piaddr (packet -> client_addr), client -> xid); - - lease = packet_to_lease (packet, client); - if (!lease) { -@@ -2171,7 +2213,7 @@ void dhcpnak (packet) - return; - } - -- log_info ("DHCPNAK from %s", piaddr (packet -> client_addr)); -+ log_info ("DHCPNAK from %s (xid=0x%x)", piaddr (packet -> client_addr), client -> xid); - - if (!client -> active) { - #if defined (DEBUG) -@@ -2298,10 +2340,10 @@ void send_discover (cpp) - client -> packet.secs = htons (65535); - client -> secs = client -> packet.secs; - -- log_info ("DHCPDISCOVER on %s to %s port %d interval %ld", -+ log_info ("DHCPDISCOVER on %s to %s port %d interval %ld (xid=0x%x)", - client -> name ? client -> name : client -> interface -> name, - inet_ntoa (sockaddr_broadcast.sin_addr), -- ntohs (sockaddr_broadcast.sin_port), (long)(client -> interval)); -+ ntohs (sockaddr_broadcast.sin_port), (long)(client -> interval), client -> xid); - - /* Send out a packet. */ - result = send_packet(client->interface, NULL, &client->packet, -@@ -2570,10 +2612,10 @@ void send_request (cpp) - client -> packet.secs = htons (65535); - } - -- log_info ("DHCPREQUEST on %s to %s port %d", -+ log_info ("DHCPREQUEST on %s to %s port %d (xid=0x%x)", - client -> name ? client -> name : client -> interface -> name, - inet_ntoa (destination.sin_addr), -- ntohs (destination.sin_port)); -+ ntohs (destination.sin_port), client -> xid); - - if (destination.sin_addr.s_addr != INADDR_BROADCAST && - fallback_interface) { -@@ -2613,10 +2655,10 @@ void send_decline (cpp) - - int result; - -- log_info ("DHCPDECLINE on %s to %s port %d", -+ log_info ("DHCPDECLINE on %s to %s port %d (xid=0x%x)", - client->name ? client->name : client->interface->name, - inet_ntoa(sockaddr_broadcast.sin_addr), -- ntohs(sockaddr_broadcast.sin_port)); -+ ntohs(sockaddr_broadcast.sin_port), client -> xid); - - /* Send out a packet. */ - result = send_packet(client->interface, NULL, &client->packet, -@@ -2659,10 +2701,10 @@ void send_release (cpp) - return; - } - -- log_info ("DHCPRELEASE on %s to %s port %d", -+ log_info ("DHCPRELEASE on %s to %s port %d (xid=0x%x)", - client -> name ? client -> name : client -> interface -> name, - inet_ntoa (destination.sin_addr), -- ntohs (destination.sin_port)); -+ ntohs (destination.sin_port), client -> xid); - - if (fallback_interface) { - result = send_packet(fallback_interface, NULL, &client->packet, diff --git a/src/patches/dhcp/dhcp-logpid.patch b/src/patches/dhcp/dhcp-logpid.patch deleted file mode 100644 index e1a6ebdb5..000000000 --- a/src/patches/dhcp/dhcp-logpid.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- expanded_org/client/dhclient.c Wed Aug 06 23:35:00 2014 -+++ expanded_logpid/client/dhclient.c Mon Feb 16 13:35:31 2015 -@@ -142,7 +142,7 @@ - else if (fd != -1) - close(fd); - -- openlog("dhclient", DHCP_LOG_OPTIONS, LOG_DAEMON); -+ openlog("dhclient", LOG_NDELAY | LOG_PID, LOG_DAEMON); - - #if !(defined(DEBUG) || defined(__CYGWIN32__)) - setlogmask(LOG_UPTO(LOG_INFO)); diff --git a/src/patches/dhcp/dhcp-lpf-ib.patch b/src/patches/dhcp/dhcp-lpf-ib.patch deleted file mode 100644 index 8e094d649..000000000 --- a/src/patches/dhcp/dhcp-lpf-ib.patch +++ /dev/null @@ -1,585 +0,0 @@ -diff -up dhcp-4.3.1b1/client/dhclient.c.bmgpWV dhcp-4.3.1b1/client/dhclient.c ---- dhcp-4.3.1b1/client/dhclient.c.bmgpWV 2014-07-10 17:50:26.922402550 +0200 -+++ dhcp-4.3.1b1/client/dhclient.c 2014-07-10 17:53:43.629623477 +0200 -@@ -114,6 +114,8 @@ static int check_domain_name_list(const - static int check_option_values(struct universe *universe, unsigned int opt, - const char *ptr, size_t len); - -+static void setup_ib_interface(struct interface_info *ip); -+ - #ifndef UNIT_TEST - int - main(int argc, char **argv) { -@@ -937,6 +939,13 @@ main(int argc, char **argv) { - } - srandom(seed + cur_time + (unsigned)getpid()); - -+ /* Setup specific Infiniband options */ -+ for (ip = interfaces; ip; ip = ip->next) { -+ if (ip->client && -+ (ip->hw_address.hbuf[0] == HTYPE_INFINIBAND)) { -+ setup_ib_interface(ip); -+ } -+ } - - /* - * Establish a default DUID. We always do so for v6 and -@@ -1230,6 +1239,29 @@ int find_subnet (struct subnet **sp, - return 0; - } - -+static void setup_ib_interface(struct interface_info *ip) -+{ -+ struct group *g; -+ -+ /* Set the broadcast flag */ -+ ip->client->config->bootp_broadcast_always = 1; -+ -+ /* -+ * Find out if a dhcp-client-identifier option was specified either -+ * in the config file or on the command line -+ */ -+ for (g = ip->client->config->on_transmission; g != NULL; g = g->next) { -+ if ((g->statements != NULL) && -+ (strcmp(g->statements->data.option->option->name, -+ "dhcp-client-identifier") == 0)) { -+ return; -+ } -+ } -+ -+ /* No client ID specified */ -+ log_fatal("dhcp-client-identifier must be specified for InfiniBand"); -+} -+ - /* Individual States: - * - * Each routine is called from the dhclient_state_machine() in one of -diff -up dhcp-4.3.1b1/common/bpf.c.bmgpWV dhcp-4.3.1b1/common/bpf.c ---- dhcp-4.3.1b1/common/bpf.c.bmgpWV 2014-07-10 17:48:03.797424616 +0200 -+++ dhcp-4.3.1b1/common/bpf.c 2014-07-10 17:52:57.705272295 +0200 -@@ -199,11 +199,44 @@ struct bpf_insn dhcp_bpf_filter [] = { - BPF_STMT(BPF_RET+BPF_K, 0), - }; - -+/* Packet filter program for DHCP over Infiniband. -+ * -+ * XXX -+ * Changes to the filter program may require changes to the constant offsets -+ * used in lpf_gen_filter_setup to patch the port in the BPF program! -+ * XXX -+ */ -+struct bpf_insn dhcp_ib_bpf_filter [] = { -+ /* Packet filter for Infiniband */ -+ /* Make sure it's a UDP packet... */ -+ BPF_STMT(BPF_LD + BPF_B + BPF_ABS, 9), -+ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, IPPROTO_UDP, 0, 6), -+ -+ /* Make sure this isn't a fragment... */ -+ BPF_STMT(BPF_LD + BPF_H + BPF_ABS, 6), -+ BPF_JUMP(BPF_JMP + BPF_JSET + BPF_K, 0x1fff, 4, 0), -+ -+ /* Get the IP header length... */ -+ BPF_STMT(BPF_LDX + BPF_B + BPF_MSH, 0), -+ -+ /* Make sure it's to the right port... */ -+ BPF_STMT(BPF_LD + BPF_H + BPF_IND, 2), -+ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, 67, 0, 1), -+ -+ /* If we passed all the tests, ask for the whole packet. */ -+ BPF_STMT(BPF_RET + BPF_K, (u_int)-1), -+ -+ /* Otherwise, drop it. */ -+ BPF_STMT(BPF_RET + BPF_K, 0), -+}; -+ - #if defined (DEC_FDDI) - struct bpf_insn *bpf_fddi_filter; - #endif - - int dhcp_bpf_filter_len = sizeof dhcp_bpf_filter / sizeof (struct bpf_insn); -+int dhcp_ib_bpf_filter_len = sizeof dhcp_ib_bpf_filter / sizeof (struct bpf_insn); -+ - #if defined (HAVE_TR_SUPPORT) - struct bpf_insn dhcp_bpf_tr_filter [] = { - /* accept all token ring packets due to variable length header */ -diff -up dhcp-4.3.1b1/common/lpf.c.bmgpWV dhcp-4.3.1b1/common/lpf.c ---- dhcp-4.3.1b1/common/lpf.c.bmgpWV 2014-07-10 17:48:03.797424616 +0200 -+++ dhcp-4.3.1b1/common/lpf.c 2014-07-10 17:52:57.706272281 +0200 -@@ -46,6 +46,17 @@ - #if defined (USE_LPF_RECEIVE) || defined (USE_LPF_HWADDR) - #include <sys/ioctl.h> - #include <net/if.h> -+#include <ifaddrs.h> -+ -+/* Default broadcast address for IPoIB */ -+static unsigned char default_ib_bcast_addr[20] = { -+ 0x00, 0xff, 0xff, 0xff, -+ 0xff, 0x12, 0x40, 0x1b, -+ 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, -+ 0xff, 0xff, 0xff, 0xff -+}; -+ - #endif - - #if defined (USE_LPF_SEND) || defined (USE_LPF_RECEIVE) -@@ -92,10 +103,21 @@ int if_register_lpf (info) - struct sockaddr common; - } sa; - struct ifreq ifr; -+ int type; -+ int protocol; - - /* Make an LPF socket. */ -- if ((sock = socket(PF_PACKET, SOCK_RAW, -- htons((short)ETH_P_ALL))) < 0) { -+ get_hw_addr(info); -+ -+ if (info->hw_address.hbuf[0] == HTYPE_INFINIBAND) { -+ type = SOCK_DGRAM; -+ protocol = ETHERTYPE_IP; -+ } else { -+ type = SOCK_RAW; -+ protocol = ETH_P_ALL; -+ } -+ -+ if ((sock = socket(PF_PACKET, type, htons((short)protocol))) < 0) { - if (errno == ENOPROTOOPT || errno == EPROTONOSUPPORT || - errno == ESOCKTNOSUPPORT || errno == EPFNOSUPPORT || - errno == EAFNOSUPPORT || errno == EINVAL) { -@@ -118,6 +140,7 @@ int if_register_lpf (info) - /* Bind to the interface name */ - memset (&sa, 0, sizeof sa); - sa.ll.sll_family = AF_PACKET; -+ sa.ll.sll_protocol = htons(protocol); - sa.ll.sll_ifindex = ifr.ifr_ifindex; - if (bind (sock, &sa.common, sizeof sa)) { - if (errno == ENOPROTOOPT || errno == EPROTONOSUPPORT || -@@ -133,8 +156,6 @@ int if_register_lpf (info) - log_fatal ("Bind socket to interface: %m"); - } - -- get_hw_addr(info->name, &info->hw_address); -- - return sock; - } - #endif /* USE_LPF_SEND || USE_LPF_RECEIVE */ -@@ -189,6 +210,8 @@ void if_deregister_send (info) - in bpf includes... */ - extern struct sock_filter dhcp_bpf_filter []; - extern int dhcp_bpf_filter_len; -+extern struct sock_filter dhcp_ib_bpf_filter []; -+extern int dhcp_ib_bpf_filter_len; - - #if defined (HAVE_TR_SUPPORT) - extern struct sock_filter dhcp_bpf_tr_filter []; -@@ -206,11 +229,13 @@ void if_register_receive (info) - /* Open a LPF device and hang it on this interface... */ - info -> rfdesc = if_register_lpf (info); - -- val = 1; -- if (setsockopt (info -> rfdesc, SOL_PACKET, PACKET_AUXDATA, &val, -- sizeof val) < 0) { -- if (errno != ENOPROTOOPT) -- log_fatal ("Failed to set auxiliary packet data: %m"); -+ if (info->hw_address.hbuf[0] != HTYPE_INFINIBAND) { -+ val = 1; -+ if (setsockopt (info -> rfdesc, SOL_PACKET, PACKET_AUXDATA, -+ &val, sizeof val) < 0) { -+ if (errno != ENOPROTOOPT) -+ log_fatal ("Failed to set auxiliary packet data: %m"); -+ } - } - - #if defined (HAVE_TR_SUPPORT) -@@ -256,15 +281,28 @@ static void lpf_gen_filter_setup (info) - - memset(&p, 0, sizeof(p)); - -- /* Set up the bpf filter program structure. This is defined in -- bpf.c */ -- p.len = dhcp_bpf_filter_len; -- p.filter = dhcp_bpf_filter; -- -- /* Patch the server port into the LPF program... -- XXX changes to filter program may require changes -- to the insn number(s) used below! XXX */ -- dhcp_bpf_filter [8].k = ntohs ((short)local_port); -+ if (info->hw_address.hbuf[0] == HTYPE_INFINIBAND) { -+ /* Set up the bpf filter program structure. */ -+ p.len = dhcp_ib_bpf_filter_len; -+ p.filter = dhcp_ib_bpf_filter; -+ -+ /* Patch the server port into the LPF program... -+ XXX -+ changes to filter program may require changes -+ to the insn number(s) used below! -+ XXX */ -+ dhcp_ib_bpf_filter[6].k = ntohs ((short)local_port); -+ } else { -+ /* Set up the bpf filter program structure. -+ This is defined in bpf.c */ -+ p.len = dhcp_bpf_filter_len; -+ p.filter = dhcp_bpf_filter; -+ -+ /* Patch the server port into the LPF program... -+ XXX changes to filter program may require changes -+ to the insn number(s) used below! XXX */ -+ dhcp_bpf_filter [8].k = ntohs ((short)local_port); -+ } - - if (setsockopt (info -> rfdesc, SOL_SOCKET, SO_ATTACH_FILTER, &p, - sizeof p) < 0) { -@@ -321,6 +359,54 @@ static void lpf_tr_filter_setup (info) - #endif /* USE_LPF_RECEIVE */ - - #ifdef USE_LPF_SEND -+ssize_t send_packet_ib(interface, packet, raw, len, from, to, hto) -+ struct interface_info *interface; -+ struct packet *packet; -+ struct dhcp_packet *raw; -+ size_t len; -+ struct in_addr from; -+ struct sockaddr_in *to; -+ struct hardware *hto; -+{ -+ unsigned ibufp = 0; -+ double ih [1536 / sizeof (double)]; -+ unsigned char *buf = (unsigned char *)ih; -+ ssize_t result; -+ -+ union sockunion { -+ struct sockaddr sa; -+ struct sockaddr_ll sll; -+ struct sockaddr_storage ss; -+ } su; -+ -+ assemble_udp_ip_header (interface, buf, &ibufp, from.s_addr, -+ to->sin_addr.s_addr, to->sin_port, -+ (unsigned char *)raw, len); -+ memcpy (buf + ibufp, raw, len); -+ -+ memset(&su, 0, sizeof(su)); -+ su.sll.sll_family = AF_PACKET; -+ su.sll.sll_protocol = htons(ETHERTYPE_IP); -+ -+ if (!(su.sll.sll_ifindex = if_nametoindex(interface->name))) { -+ errno = ENOENT; -+ log_error ("send_packet_ib: %m - failed to get if index"); -+ return -1; -+ } -+ -+ su.sll.sll_hatype = htons(HTYPE_INFINIBAND); -+ su.sll.sll_halen = sizeof(interface->bcast_addr); -+ memcpy(&su.sll.sll_addr, interface->bcast_addr, 20); -+ -+ result = sendto(interface->wfdesc, buf, ibufp + len, 0, -+ &su.sa, sizeof(su)); -+ -+ if (result < 0) -+ log_error ("send_packet_ib: %m"); -+ -+ return result; -+} -+ - ssize_t send_packet (interface, packet, raw, len, from, to, hto) - struct interface_info *interface; - struct packet *packet; -@@ -341,6 +427,11 @@ ssize_t send_packet (interface, packet, - return send_fallback (interface, packet, raw, - len, from, to, hto); - -+ if (interface->hw_address.hbuf[0] == HTYPE_INFINIBAND) { -+ return send_packet_ib(interface, packet, raw, len, from, -+ to, hto); -+ } -+ - if (hto == NULL && interface->anycast_mac_addr.hlen) - hto = &interface->anycast_mac_addr; - -@@ -362,6 +453,42 @@ ssize_t send_packet (interface, packet, - #endif /* USE_LPF_SEND */ - - #ifdef USE_LPF_RECEIVE -+ssize_t receive_packet_ib (interface, buf, len, from, hfrom) -+ struct interface_info *interface; -+ unsigned char *buf; -+ size_t len; -+ struct sockaddr_in *from; -+ struct hardware *hfrom; -+{ -+ int length = 0; -+ int offset = 0; -+ unsigned char ibuf [1536]; -+ unsigned bufix = 0; -+ unsigned paylen; -+ -+ length = read(interface->rfdesc, ibuf, sizeof(ibuf)); -+ -+ if (length <= 0) -+ return length; -+ -+ offset = decode_udp_ip_header(interface, ibuf, bufix, from, -+ (unsigned)length, &paylen, 0); -+ -+ if (offset < 0) -+ return 0; -+ -+ bufix += offset; -+ length -= offset; -+ -+ if (length < paylen) -+ log_fatal("Internal inconsistency at %s:%d.", MDL); -+ -+ /* Copy out the data in the packet... */ -+ memcpy(buf, &ibuf[bufix], paylen); -+ -+ return (ssize_t)paylen; -+} -+ - ssize_t receive_packet (interface, buf, len, from, hfrom) - struct interface_info *interface; - unsigned char *buf; -@@ -388,6 +515,10 @@ ssize_t receive_packet (interface, buf, - }; - struct cmsghdr *cmsg; - -+ if (interface->hw_address.hbuf[0] == HTYPE_INFINIBAND) { -+ return receive_packet_ib(interface, buf, len, from, hfrom); -+ } -+ - length = recvmsg (interface -> rfdesc, &msg, 0); - if (length <= 0) - return length; -@@ -469,11 +600,33 @@ void maybe_setup_fallback () - #endif - - #if defined (USE_LPF_RECEIVE) || defined (USE_LPF_HWADDR) --void --get_hw_addr(const char *name, struct hardware *hw) { -+struct sockaddr_ll * -+get_ll (struct ifaddrs *ifaddrs, struct ifaddrs **ifa, char *name) -+{ -+ for (*ifa = ifaddrs; *ifa != NULL; *ifa = (*ifa)->ifa_next) { -+ if ((*ifa)->ifa_addr == NULL) -+ continue; -+ -+ if ((*ifa)->ifa_addr->sa_family != AF_PACKET) -+ continue; -+ -+ if ((*ifa)->ifa_flags & IFF_LOOPBACK) -+ continue; -+ -+ if (strcmp((*ifa)->ifa_name, name) == 0) -+ return (struct sockaddr_ll *)(void *)(*ifa)->ifa_addr; -+ } -+ *ifa = NULL; -+ return NULL; -+} -+ -+struct sockaddr_ll * -+ioctl_get_ll(char *name) -+{ - int sock; - struct ifreq tmp; -- struct sockaddr *sa; -+ struct sockaddr *sa = NULL; -+ struct sockaddr_ll *sll = NULL; - - if (strlen(name) >= sizeof(tmp.ifr_name)) { - log_fatal("Device name too long: \"%s\"", name); -@@ -487,16 +640,62 @@ get_hw_addr(const char *name, struct har - memset(&tmp, 0, sizeof(tmp)); - strcpy(tmp.ifr_name, name); - if (ioctl(sock, SIOCGIFHWADDR, &tmp) < 0) { -- log_fatal("Error getting hardware address for \"%s\": %m", -+ log_fatal("Error getting hardware address for \"%s\": %m", - name); - } -+ close(sock); - - sa = &tmp.ifr_hwaddr; -- switch (sa->sa_family) { -+ // needs to be freed outside this function -+ sll = dmalloc (sizeof (struct sockaddr_ll), MDL); -+ if (!sll) -+ log_fatal("Unable to allocate memory for link layer address"); -+ memcpy(&sll->sll_hatype, &sa->sa_family, sizeof (sll->sll_hatype)); -+ memcpy(sll->sll_addr, sa->sa_data, sizeof (sll->sll_addr)); -+ switch (sll->sll_hatype) { -+ case ARPHRD_INFINIBAND: -+ /* ioctl limits hardware addresses to 8 bytes */ -+ sll->sll_halen = 8; -+ break; -+ default: -+ break; -+ } -+ return sll; -+} -+ -+void -+get_hw_addr(struct interface_info *info) -+{ -+ struct hardware *hw = &info->hw_address; -+ char *name = info->name; -+ struct ifaddrs *ifaddrs = NULL; -+ struct ifaddrs *ifa = NULL; -+ struct sockaddr_ll *sll = NULL; -+ int sll_allocated = 0; -+ char *dup = NULL; -+ char *colon = NULL; -+ -+ if (getifaddrs(&ifaddrs) == -1) -+ log_fatal("Failed to get interfaces"); -+ -+ if ((sll = get_ll(ifaddrs, &ifa, name)) == NULL) { -+ /* -+ * We were unable to get link-layer address for name. -+ * Fall back to ioctl(SIOCGIFHWADDR). -+ */ -+ sll = ioctl_get_ll(name); -+ if (sll != NULL) -+ sll_allocated = 1; -+ else -+ // shouldn't happen -+ log_fatal("Unexpected internal error"); -+ } -+ -+ switch (sll->sll_hatype) { - case ARPHRD_ETHER: - hw->hlen = 7; - hw->hbuf[0] = HTYPE_ETHER; -- memcpy(&hw->hbuf[1], sa->sa_data, 6); -+ memcpy(&hw->hbuf[1], sll->sll_addr, 6); - break; - case ARPHRD_IEEE802: - #ifdef ARPHRD_IEEE802_TR -@@ -504,18 +703,48 @@ get_hw_addr(const char *name, struct har - #endif /* ARPHRD_IEEE802_TR */ - hw->hlen = 7; - hw->hbuf[0] = HTYPE_IEEE802; -- memcpy(&hw->hbuf[1], sa->sa_data, 6); -+ memcpy(&hw->hbuf[1], sll->sll_addr, 6); - break; - case ARPHRD_FDDI: - hw->hlen = 7; - hw->hbuf[0] = HTYPE_FDDI; -- memcpy(&hw->hbuf[1], sa->sa_data, 6); -+ memcpy(&hw->hbuf[1], sll->sll_addr, 6); -+ break; -+ case ARPHRD_INFINIBAND: -+ dup = strdup(name); -+ /* Aliased infiniband interface is special case where -+ * neither get_ll() nor ioctl_get_ll() get's correct hw -+ * address, so we have to truncate the :0 and run -+ * get_ll() again for the rest. -+ */ -+ if ((colon = strchr(dup, ':')) != NULL) { -+ *colon = '\0'; -+ if ((sll = get_ll(ifaddrs, &ifa, dup)) == NULL) -+ log_fatal("Error getting hardware address for \"%s\": %m", name); -+ } -+ free (dup); -+ /* For Infiniband, save the broadcast address and store -+ * the port GUID into the hardware address. -+ */ -+ if (ifa && (ifa->ifa_flags & IFF_BROADCAST)) { -+ struct sockaddr_ll *bll; -+ -+ bll = (struct sockaddr_ll *)ifa->ifa_broadaddr; -+ memcpy(&info->bcast_addr, bll->sll_addr, 20); -+ } else { -+ memcpy(&info->bcast_addr, default_ib_bcast_addr, -+ 20); -+ } -+ -+ hw->hlen = 1; -+ hw->hbuf[0] = HTYPE_INFINIBAND; -+ memcpy(&hw->hbuf[1], &sll->sll_addr[sll->sll_halen - 8], 8); - break; - #if defined(ARPHRD_PPP) - case ARPHRD_PPP: - if (local_family != AF_INET6) -- log_fatal("Unsupported device type %d for \"%s\"", -- sa->sa_family, name); -+ log_fatal("local_family != AF_INET6 for \"%s\"", -+ name); - hw->hlen = 0; - hw->hbuf[0] = HTYPE_RESERVED; - /* 0xdeadbeef should never occur on the wire, -@@ -528,10 +757,13 @@ get_hw_addr(const char *name, struct har - break; - #endif - default: -- log_fatal("Unsupported device type %ld for \"%s\"", -- (long int)sa->sa_family, name); -+ freeifaddrs(ifaddrs); -+ log_fatal("Unsupported device type %hu for \"%s\"", -+ sll->sll_hatype, name); - } - -- close(sock); -+ if (sll_allocated) -+ dfree(sll, MDL); -+ freeifaddrs(ifaddrs); - } - #endif -diff -up dhcp-4.3.1b1/common/socket.c.bmgpWV dhcp-4.3.1b1/common/socket.c ---- dhcp-4.3.1b1/common/socket.c.bmgpWV 2014-07-02 19:58:38.000000000 +0200 -+++ dhcp-4.3.1b1/common/socket.c 2014-07-10 17:52:57.706272281 +0200 -@@ -322,7 +322,7 @@ void if_register_send (info) - info->wfdesc = if_register_socket(info, AF_INET, 0, NULL); - /* If this is a normal IPv4 address, get the hardware address. */ - if (strcmp(info->name, "fallback") != 0) -- get_hw_addr(info->name, &info->hw_address); -+ get_hw_addr(info); - #if defined (USE_SOCKET_FALLBACK) - /* Fallback only registers for send, but may need to receive as - well. */ -@@ -385,7 +385,7 @@ void if_register_receive (info) - #endif /* IP_PKTINFO... */ - /* If this is a normal IPv4 address, get the hardware address. */ - if (strcmp(info->name, "fallback") != 0) -- get_hw_addr(info->name, &info->hw_address); -+ get_hw_addr(info); - - if (!quiet_interface_discovery) - log_info ("Listening on Socket/%s%s%s", -@@ -499,7 +499,7 @@ if_register6(struct interface_info *info - if (req_multi) - if_register_multicast(info); - -- get_hw_addr(info->name, &info->hw_address); -+ get_hw_addr(info); - - if (!quiet_interface_discovery) { - if (info->shared_network != NULL) { -@@ -555,7 +555,7 @@ if_register_linklocal6(struct interface_ - info->rfdesc = sock; - info->wfdesc = sock; - -- get_hw_addr(info->name, &info->hw_address); -+ get_hw_addr(info); - - if (!quiet_interface_discovery) { - if (info->shared_network != NULL) { -diff -up dhcp-4.3.1b1/includes/dhcpd.h.bmgpWV dhcp-4.3.1b1/includes/dhcpd.h ---- dhcp-4.3.1b1/includes/dhcpd.h.bmgpWV 2014-07-10 17:50:26.923402536 +0200 -+++ dhcp-4.3.1b1/includes/dhcpd.h 2014-07-10 17:52:57.707272266 +0200 -@@ -1248,6 +1248,7 @@ struct interface_info { - struct shared_network *shared_network; - /* Networks connected to this interface. */ - struct hardware hw_address; /* Its physical address. */ -+ u_int8_t bcast_addr[20]; /* Infiniband broadcast address */ - struct in_addr *addresses; /* Addresses associated with this - * interface. - */ -@@ -2439,7 +2440,7 @@ void print_dns_status (int, struct dhcp_ - #endif - const char *print_time(TIME); - --void get_hw_addr(const char *name, struct hardware *hw); -+void get_hw_addr(struct interface_info *info); - - /* socket.c */ - #if defined (USE_SOCKET_SEND) || defined (USE_SOCKET_RECEIVE) \ diff --git a/src/patches/dhcp/dhcp-manpages.patch b/src/patches/dhcp/dhcp-manpages.patch deleted file mode 100644 index dde16c735..000000000 --- a/src/patches/dhcp/dhcp-manpages.patch +++ /dev/null @@ -1,157 +0,0 @@ -diff -up dhcp-4.3.0a1/client/dhclient-script.8.man dhcp-4.3.0a1/client/dhclient-script.8 ---- dhcp-4.3.0a1/client/dhclient-script.8.man 2013-12-11 01:01:02.000000000 +0100 -+++ dhcp-4.3.0a1/client/dhclient-script.8 2013-12-19 15:27:17.617118805 +0100 -@@ -48,7 +48,7 @@ customizations are needed, they should b - exit hooks provided (see HOOKS for details). These hooks will allow the - user to override the default behaviour of the client in creating a - .B /etc/resolv.conf --file. -+file, and to handle DHCP options not handled by default. - .PP - No standard client script exists for some operating systems, even though - the actual client may work, so a pioneering user may well need to create -@@ -92,6 +92,26 @@ present. The - .B ETCDIR/dhclient-exit-hooks - script can modify the valid of exit_status to change the exit status - of dhclient-script. -+.PP -+Immediately after dhclient brings an interface UP with a new IP address, -+subnet mask, and routes, in the REBOOT/BOUND states, it will check for the -+existence of an executable -+.B ETCDIR/dhclient-up-hooks -+script, and source it if found. This script can handle DHCP options in -+the environment that are not handled by default. A per-interface. -+.B ETCDIR/dhclient-${IF}-up-hooks -+script will override the generic script and be sourced when interface -+$IF has been brought up. -+.PP -+Immediately before dhclient brings an interface DOWN, removing its IP -+address, subnet mask, and routes, in the STOP/RELEASE states, it will -+check for the existence of an executable -+.B ETCDIR/dhclient-down-hooks -+script, and source it if found. This script can handle DHCP options in -+the environment that are not handled by default. A per-interface -+.B ETCDIR/dhclient-${IF}-down-hooks -+script will override the generic script and be sourced when interface -+$IF is about to be brought down. - .SH OPERATION - When dhclient needs to invoke the client configuration script, it - defines a set of variables in the environment, and then invokes -diff -up dhcp-4.3.0a1/client/dhclient.conf.5.man dhcp-4.3.0a1/client/dhclient.conf.5 ---- dhcp-4.3.0a1/client/dhclient.conf.5.man 2013-12-11 01:01:02.000000000 +0100 -+++ dhcp-4.3.0a1/client/dhclient.conf.5 2013-12-19 15:27:17.617118805 +0100 -@@ -202,7 +202,8 @@ responding to the client send the client - options. Only the option names should be specified in the request - statement - not option parameters. By default, the DHCPv4 client - requests the subnet-mask, broadcast-address, time-offset, routers, --domain-name, domain-name-servers and host-name options while the DHCPv6 -+domain-search, domain-name, domain-name-servers, host-name, nis-domain, -+nis-servers, ntp-servers and interface-mtu options while the DHCPv6 - client requests the dhcp6 name-servers and domain-search options. Note - that if you enter a \'request\' statement, you over-ride these defaults - and these options will not be requested. -@@ -688,6 +689,17 @@ know the DHCP service(s) anycast MAC add - client. The \fIlink-type\fR and \fImac-address\fR parameters are configured - in a similar manner to the \fBhardware\fR statement. - .PP -+ \fBbootp-broadcast-always;\fR -+.PP -+The -+.B bootp-broadcast-always -+statement instructs dhclient to always set the bootp broadcast flag in -+request packets, so that servers will always broadcast replies. -+This is equivalent to supplying the dhclient -B argument, and has -+the same effect as specifying 'always-broadcast' in the server's dhcpd.conf. -+This option is provided as an extension to enable dhclient to work -+on IBM s390 Linux guests. -+.PP - .SH SAMPLE - The following configuration file is used on a laptop running NetBSD - 1.3. The laptop has an IP alias of 192.5.5.213, and has one -@@ -713,7 +725,7 @@ interface "ep0" { - supersede domain-search "fugue.com", "rc.vix.com", "home.vix.com"; - prepend domain-name-servers 127.0.0.1; - request subnet-mask, broadcast-address, time-offset, routers, -- domain-name, domain-name-servers, host-name; -+ domain-search, domain-name, domain-name-servers, host-name; - require subnet-mask, domain-name-servers; - script "CLIENTBINDIR/dhclient-script"; - media "media 10baseT/UTP", "media 10base2/BNC"; -diff -up dhcp-4.3.0a1/common/dhcp-options.5.man dhcp-4.3.0a1/common/dhcp-options.5 ---- dhcp-4.3.0a1/common/dhcp-options.5.man 2013-12-11 01:25:12.000000000 +0100 -+++ dhcp-4.3.0a1/common/dhcp-options.5 2013-12-19 15:27:17.618118791 +0100 -@@ -914,6 +914,21 @@ classless IP routing - it does not inclu - classless IP routing is now the most widely deployed routing standard, - this option is virtually useless, and is not implemented by any of the - popular DHCP clients, for example the Microsoft DHCP client. -+.PP -+NOTE to Fedora dhclient users: -+.br -+dhclient-script interprets trailing 0 octets of the target as indicating -+the subnet class of the route, so for the following static-routes value: -+.br -+ option static-routes 172.0.0.0 172.16.2.254, -+.br -+ 192.168.0.0 192.168.2.254; -+.br -+dhclient-script will create routes: -+.br -+ 172/8 via 172.16.2.254 dev $interface -+.br -+ 192.168/16 via 192.168.2.254 dev $interface - .RE - .PP - .nf -diff -up dhcp-4.3.0a1/server/dhcpd.conf.5.man dhcp-4.3.0a1/server/dhcpd.conf.5 ---- dhcp-4.3.0a1/server/dhcpd.conf.5.man 2013-12-13 21:49:44.000000000 +0100 -+++ dhcp-4.3.0a1/server/dhcpd.conf.5 2013-12-19 15:30:14.266670962 +0100 -@@ -527,6 +527,9 @@ pool { - }; - .fi - .PP -+Dynamic BOOTP leases are not compatible with failover, and, as such, -+you need to disallow BOOTP in pools that you are using failover for. -+.PP - The server currently does very little sanity checking, so if you - configure it wrong, it will just fail in odd ways. I would recommend - therefore that you either do failover or don't do failover, but don't -@@ -541,9 +544,9 @@ primary server might look like this: - failover peer "foo" { - primary; - address anthrax.rc.vix.com; -- port 519; -+ port 647; - peer address trantor.rc.vix.com; -- peer port 520; -+ peer port 847; - max-response-delay 60; - max-unacked-updates 10; - mclt 3600; -@@ -1241,7 +1244,7 @@ the zone containing PTR records - for IS - .PP - .nf - key DHCP_UPDATER { -- algorithm HMAC-MD5.SIG-ALG.REG.INT; -+ algorithm hmac-md5; - secret pRP5FapFoJ95JEL06sv4PQ==; - }; - -@@ -1264,7 +1267,7 @@ dhcpd.conf file: - .PP - .nf - key DHCP_UPDATER { -- algorithm HMAC-MD5.SIG-ALG.REG.INT; -+ algorithm hmac-md5; - secret pRP5FapFoJ95JEL06sv4PQ==; - }; - -@@ -2539,7 +2542,8 @@ statement - The \fInext-server\fR statement is used to specify the host address of - the server from which the initial boot file (specified in the - \fIfilename\fR statement) is to be loaded. \fIServer-name\fR should --be a numeric IP address or a domain name. -+be a numeric IP address or a domain name. If no \fInext-server\fR statement -+applies to a given client, the address 0.0.0.0 is used. - .RE - .PP - The diff --git a/src/patches/dhcp/dhcp-paranoia.patch b/src/patches/dhcp/dhcp-paranoia.patch deleted file mode 100644 index 0f2db8c18..000000000 --- a/src/patches/dhcp/dhcp-paranoia.patch +++ /dev/null @@ -1,156 +0,0 @@ -diff -up dhcp-4.3.1b1/client/dhclient.c.dlTsyN dhcp-4.3.1b1/client/dhclient.c ---- dhcp-4.3.1b1/client/dhclient.c.dlTsyN 2014-07-10 17:49:49.882925843 +0200 -+++ dhcp-4.3.1b1/client/dhclient.c 2014-07-10 17:50:26.922402550 +0200 -@@ -1748,11 +1748,6 @@ int write_host (host) - return 0; - } - --void db_startup (testp) -- int testp; --{ --} -- - void bootp (packet) - struct packet *packet; - { -diff -up dhcp-4.3.1b1/includes/dhcpd.h.dlTsyN dhcp-4.3.1b1/includes/dhcpd.h ---- dhcp-4.3.1b1/includes/dhcpd.h.dlTsyN 2014-07-10 17:48:03.798424601 +0200 -+++ dhcp-4.3.1b1/includes/dhcpd.h 2014-07-10 17:50:26.923402536 +0200 -@@ -2866,7 +2866,11 @@ void commit_leases_timeout (void *); - void commit_leases_readerdry(void *); - int commit_leases (void); - int commit_leases_timed (void); -+#if defined (PARANOIA) -+void db_startup (int, uid_t, gid_t); -+#else - void db_startup (int); -+#endif /* PARANOIA */ - int new_lease_file (void); - int group_writer (struct group_object *); - int write_ia(const struct ia_xx *); -diff -up dhcp-4.3.1b1/server/confpars.c.dlTsyN dhcp-4.3.1b1/server/confpars.c ---- dhcp-4.3.1b1/server/confpars.c.dlTsyN 2014-07-10 17:39:25.801764596 +0200 -+++ dhcp-4.3.1b1/server/confpars.c 2014-07-10 17:50:26.924402522 +0200 -@@ -219,7 +219,11 @@ void trace_conf_input (trace_type_t *tty - } - - if (!leaseconf_initialized && ttype == trace_readleases_type) { -+#if defined (PARANOIA) -+ db_startup (0, 0, 0); -+#else - db_startup (0); -+#endif /* PARANOIA */ - leaseconf_initialized = 1; - postdb_startup (); - } -diff -up dhcp-4.3.1b1/server/db.c.dlTsyN dhcp-4.3.1b1/server/db.c ---- dhcp-4.3.1b1/server/db.c.dlTsyN 2014-07-10 17:39:25.801764596 +0200 -+++ dhcp-4.3.1b1/server/db.c 2014-07-10 17:50:26.925402508 +0200 -@@ -42,6 +42,10 @@ static int counting = 0; - static int count = 0; - TIME write_time; - int lease_file_is_corrupt = 0; -+#if defined (PARANOIA) -+uid_t global_set_uid = 0; -+gid_t global_set_gid = 0; -+#endif /* PARANOIA */ - - /* Write a single binding scope value in parsable format. - */ -@@ -1046,8 +1050,11 @@ int commit_leases_timed() - return (1); - } - --void db_startup (testp) -- int testp; -+#if defined (PARANOIA) -+void db_startup (int testp, uid_t set_uid, gid_t set_gid) -+#else -+void db_startup (int testp) -+#endif /* PARANOIA */ - { - isc_result_t status; - -@@ -1066,6 +1073,11 @@ void db_startup (testp) - } - #endif - -+#if defined (PARANOIA) -+ global_set_uid = set_uid; -+ global_set_gid = set_gid; -+#endif /* PARANOIA */ -+ - #if defined (TRACING) - /* If we're playing back, there is no lease file, so we can't - append it, so we create one immediately (maybe this isn't -@@ -1128,6 +1140,17 @@ int new_lease_file () - log_error ("Can't create new lease file: %m"); - return 0; - } -+ -+#if defined (PARANOIA) -+ if (global_set_uid && !geteuid() && -+ global_set_gid && !getegid()) -+ if (fchown(db_fd, global_set_uid, global_set_gid)) { -+ log_fatal ("Can't chown new lease file: %m"); -+ close(db_fd); -+ goto fdfail; -+ } -+#endif /* PARANOIA */ -+ - if ((new_db_file = fdopen(db_fd, "we")) == NULL) { - log_error("Can't fdopen new lease file: %m"); - close(db_fd); -diff -up dhcp-4.3.1b1/server/dhcpd.8.dlTsyN dhcp-4.3.1b1/server/dhcpd.8 ---- dhcp-4.3.1b1/server/dhcpd.8.dlTsyN 2014-07-02 19:58:39.000000000 +0200 -+++ dhcp-4.3.1b1/server/dhcpd.8 2014-07-10 17:50:26.925402508 +0200 -@@ -82,6 +82,18 @@ dhcpd - Dynamic Host Configuration Proto - .I trace-output-file - ] - [ -+.B -user -+.I user -+] -+[ -+.B -group -+.I group -+] -+[ -+.B -chroot -+.I dir -+] -+[ - .B -play - .I trace-playback-file - ] -@@ -269,6 +281,15 @@ lease file. - .TP - .BI --version - Print version number and exit. -+.TP -+.BI \-user \ user -+Setuid to user after completing privileged operations, such as creating sockets that listen on privileged ports. -+.TP -+.BI \-group \ group -+Setgid to group after completing privileged operations, such as creating sockets that listen on privileged ports. -+.TP -+.BI \-chroot \ dir -+Chroot to directory after processing the command line arguments, but before reading the configuration file. - .PP - .I Modifying default file locations: - The following options can be used to modify the locations -diff -up dhcp-4.3.1b1/server/dhcpd.c.dlTsyN dhcp-4.3.1b1/server/dhcpd.c ---- dhcp-4.3.1b1/server/dhcpd.c.dlTsyN 2014-07-10 17:39:25.802764582 +0200 -+++ dhcp-4.3.1b1/server/dhcpd.c 2014-07-10 17:52:35.341588248 +0200 -@@ -628,7 +628,11 @@ main(int argc, char **argv) { - group_write_hook = group_writer; - - /* Start up the database... */ -+#if defined (PARANOIA) -+ db_startup (lftest, set_uid, set_gid); -+#else - db_startup (lftest); -+#endif /* PARANOIA */ - - if (lftest) - exit (0); diff --git a/src/patches/dhcp/dhcp-paths.patch b/src/patches/dhcp/dhcp-paths.patch deleted file mode 100644 index 2f43e51fe..000000000 --- a/src/patches/dhcp/dhcp-paths.patch +++ /dev/null @@ -1,44 +0,0 @@ ---- expanded_org/includes/dhcpd.h Wed Aug 06 23:35:02 2014 -+++ expanded_patched_51_4_2_0_paths_patch/includes/dhcpd.h Mon Feb 16 13:22:11 2015 -@@ -1424,15 +1424,15 @@ - #else /* !DEBUG */ - - #ifndef _PATH_DHCPD_CONF --#define _PATH_DHCPD_CONF "/etc/dhcpd.conf" -+#define _PATH_DHCPD_CONF "/etc/dhcp/dhcpd.conf" - #endif /* DEBUG */ - - #ifndef _PATH_DHCPD_DB --#define _PATH_DHCPD_DB LOCALSTATEDIR"/db/dhcpd.leases" -+#define _PATH_DHCPD_DB LOCALSTATEDIR"/dhcpd/dhcpd.leases" - #endif - - #ifndef _PATH_DHCPD6_DB --#define _PATH_DHCPD6_DB LOCALSTATEDIR"/db/dhcpd6.leases" -+#define _PATH_DHCPD6_DB LOCALSTATEDIR"/dhcpd/dhcpd6.leases" - #endif - - #ifndef _PATH_DHCPD_PID -@@ -1446,7 +1446,7 @@ - #endif /* DEBUG */ - - #ifndef _PATH_DHCLIENT_CONF --#define _PATH_DHCLIENT_CONF "/etc/dhclient.conf" -+#define _PATH_DHCLIENT_CONF "/etc/dhcp/dhclient.conf" - #endif - - #ifndef _PATH_DHCLIENT_SCRIPT -@@ -1462,11 +1462,11 @@ - #endif - - #ifndef _PATH_DHCLIENT_DB --#define _PATH_DHCLIENT_DB LOCALSTATEDIR"/db/dhclient.leases" -+#define _PATH_DHCLIENT_DB LOCALSTATEDIR"/dhclient/dhclient.leases" - #endif - - #ifndef _PATH_DHCLIENT6_DB --#define _PATH_DHCLIENT6_DB LOCALSTATEDIR"/db/dhclient6.leases" -+#define _PATH_DHCLIENT6_DB LOCALSTATEDIR"/dhclient/dhclient6.leases" - #endif - - #ifndef _PATH_RESOLV_CONF diff --git a/src/patches/dhcp/dhcp-release-by-ifup.patch b/src/patches/dhcp/dhcp-release-by-ifup.patch deleted file mode 100644 index 677eb5c75..000000000 --- a/src/patches/dhcp/dhcp-release-by-ifup.patch +++ /dev/null @@ -1,85 +0,0 @@ -diff -up dhcp-4.3.0a1/client/dhclient.c.ifup dhcp-4.3.0a1/client/dhclient.c ---- dhcp-4.3.0a1/client/dhclient.c.ifup 2013-12-19 14:53:08.817760677 +0100 -+++ dhcp-4.3.0a1/client/dhclient.c 2013-12-19 15:05:16.290518574 +0100 -@@ -521,9 +521,81 @@ main(int argc, char **argv) { - } - } - fclose(pidfd); -+ } else { -+ /* handle release for interfaces requested with Red Hat -+ * /sbin/ifup - pidfile will be /var/run/dhclient-$interface.pid -+ */ -+ -+ if ((path_dhclient_pid == NULL) || (*path_dhclient_pid == '\0')) -+ path_dhclient_pid = "/var/run/dhclient.pid"; -+ -+ char *new_path_dhclient_pid; -+ struct interface_info *ip; -+ int pdp_len = strlen(path_dhclient_pid), pfx, dpfx; -+ -+ /* find append point: beginning of any trailing '.pid' -+ * or '-$IF.pid' */ -+ for (pfx=pdp_len; (pfx >= 0) && (path_dhclient_pid[pfx] != '.') && (path_dhclient_pid[pfx] != '/'); pfx--); -+ if (pfx == -1) -+ pfx = pdp_len; -+ -+ if (path_dhclient_pid[pfx] == '/') -+ pfx += 1; -+ -+ for (dpfx=pfx; (dpfx >= 0) && (path_dhclient_pid[dpfx] != '-') && (path_dhclient_pid[dpfx] != '/'); dpfx--); -+ if ((dpfx > -1) && (path_dhclient_pid[dpfx] != '/')) -+ pfx = dpfx; -+ -+ for (ip = interfaces; ip; ip = ip->next) { -+ if (interfaces_requested && (ip->flags & (INTERFACE_REQUESTED))) { -+ int n_len = strlen(ip->name); -+ -+ new_path_dhclient_pid = (char*) malloc(pfx + n_len + 6); -+ strncpy(new_path_dhclient_pid, path_dhclient_pid, pfx); -+ sprintf(new_path_dhclient_pid + pfx, "-%s.pid", ip->name); -+ -+ if ((pidfd = fopen(new_path_dhclient_pid, "r")) != NULL) { -+ e = fscanf(pidfd, "%ld\n", &temp); -+ oldpid = (pid_t)temp; -+ -+ if (e != 0 && e != EOF) { -+ if (oldpid) { -+ if (kill(oldpid, SIGTERM) == 0) -+ unlink(path_dhclient_pid); -+ } -+ } -+ -+ fclose(pidfd); -+ } -+ -+ free(new_path_dhclient_pid); -+ } -+ } -+ } -+ } else { -+ FILE *pidfp = NULL; -+ long temp = 0; -+ pid_t dhcpid = 0; -+ int dhc_running = 0; -+ char procfn[256] = ""; -+ -+ if ((pidfp = fopen(path_dhclient_pid, "r")) != NULL) { -+ if ((fscanf(pidfp, "%ld", &temp)==1) && ((dhcpid=(pid_t)temp) > 0)) { -+ snprintf(procfn,256,"/proc/%u",dhcpid); -+ dhc_running = (access(procfn, F_OK) == 0); -+ } -+ -+ fclose(pidfp); -+ } -+ -+ if (dhc_running) { -+ log_fatal("dhclient(%u) is already running - exiting. ", dhcpid); -+ return(1); - } - } - -+ write_client_pid_file(); -+ - if (!quiet) { - log_info("%s %s", message, PACKAGE_VERSION); - log_info(copyright); diff --git a/src/patches/dhcp/dhcp-remove-bind.patch b/src/patches/dhcp/dhcp-remove-bind.patch deleted file mode 100644 index 5ab0338b3..000000000 --- a/src/patches/dhcp/dhcp-remove-bind.patch +++ /dev/null @@ -1,192 +0,0 @@ -diff -up dhcp-4.3.1b1/client/Makefile.am.brGmwh dhcp-4.3.1b1/client/Makefile.am ---- dhcp-4.3.1b1/client/Makefile.am.brGmwh 2014-07-02 19:58:38.000000000 +0200 -+++ dhcp-4.3.1b1/client/Makefile.am 2014-07-10 17:36:30.484250976 +0200 -@@ -10,8 +10,8 @@ dhclient_SOURCES = clparse.c dhclient.c - scripts/bsdos scripts/freebsd scripts/linux scripts/macos \ - scripts/netbsd scripts/nextstep scripts/openbsd \ - scripts/solaris scripts/openwrt --dhclient_LDADD = ../common/libdhcp.a ../omapip/libomapi.a ../bind/lib/libirs.a \ -- ../bind/lib/libdns.a ../bind/lib/libisccfg.a ../bind/lib/libisc.a -+dhclient_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \ -+ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc - man_MANS = dhclient.8 dhclient-script.8 dhclient.conf.5 dhclient.leases.5 - EXTRA_DIST = $(man_MANS) - -diff -up dhcp-4.3.1b1/common/tests/Makefile.am.brGmwh dhcp-4.3.1b1/common/tests/Makefile.am ---- dhcp-4.3.1b1/common/tests/Makefile.am.brGmwh 2014-07-10 17:36:30.485250962 +0200 -+++ dhcp-4.3.1b1/common/tests/Makefile.am 2014-07-10 17:38:04.010924566 +0200 -@@ -13,21 +13,20 @@ ATF_TESTS += alloc_unittest dns_unittest - alloc_unittest_SOURCES = test_alloc.c $(top_srcdir)/tests/t_api_dhcp.c - alloc_unittest_LDADD = $(ATF_LDFLAGS) - alloc_unittest_LDADD += ../libdhcp.a \ -- ../../omapip/libomapi.a ../../bind/lib/libirs.a \ -- ../../bind/lib/libdns.a ../../bind/lib/libisccfg.a ../../bind/lib/libisc.a -+ ../../omapip/libomapi.a \ -+ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc - - dns_unittest_SOURCES = dns_unittest.c $(top_srcdir)/tests/t_api_dhcp.c - dns_unittest_LDADD = $(ATF_LDFLAGS) - dns_unittest_LDADD += ../libdhcp.a \ -- ../../omapip/libomapi.a ../../bind/lib/libirs.a \ -- ../../bind/lib/libdns.a ../../bind/lib/libisccfg.a ../../bind/lib/libisc.a -+ ../../omapip/libomapi.a \ -+ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc - - misc_unittest_SOURCES = misc_unittest.c $(top_srcdir)/tests/t_api_dhcp.c - misc_unittest_LDADD = $(ATF_LDFLAGS) - misc_unittest_LDADD += ../libdhcp.a \ -- ../../omapip/libomapi.a ../../bind/lib/libirs.a \ -- ../../bind/lib/libdns.a ../../bind/lib/libisccfg.a ../../bind/lib/libisc.a -- -+ ../../omapip/libomapi.a \ -+ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc - check: $(ATF_TESTS) - atf-run | atf-report - -diff -up dhcp-4.3.1b1/configure.ac.brGmwh dhcp-4.3.1b1/configure.ac ---- dhcp-4.3.1b1/configure.ac.brGmwh 2014-07-02 20:01:26.000000000 +0200 -+++ dhcp-4.3.1b1/configure.ac 2014-07-10 17:36:30.485250962 +0200 -@@ -562,20 +562,37 @@ AC_CHECK_MEMBER(struct msghdr.msg_contro - - libbind= - AC_ARG_WITH(libbind, -- AS_HELP_STRING([--with-libbind=PATH],[bind includes and libraries are in PATH -- (default is ./bind)]), -+ AS_HELP_STRING([--with-libbind=PATH],[bind includes are in PATH -+ (default is ./bind/includes)]), - use_libbind="$withval", use_libbind="no") - case "$use_libbind" in -+yes|no) -+ libbind="\${top_srcdir}/bind/include" -+ ;; -+*) -+ libbind="$use_libbind" -+ ;; -+esac -+ -+BIND9_LIBDIR='-L$(top_builddir)/bind/lib' -+AC_ARG_WITH(libbind-libs, -+ AC_HELP_STRING([--with-libbind-libs=PATH], -+ [bind9 export libraries are in PATH]), -+ [libbind_libs="$withval"], [libbind_libs='no']) -+case "$libbind_libs" in - yes) -- libbind="\${top_srcdir}/bind" -+ AC_MSG_ERROR([Specify path to bind9 libraries]) - ;; - no) -- libbind="\${top_srcdir}/bind" -+ BUNDLED_BIND=yes - ;; - *) -- libbind="$use_libbind" -+ BIND9_LIBDIR="-L$libbind_libs" -+ BUNDLED_BIND=no - ;; - esac -+AM_CONDITIONAL([BUNDLED_BIND], [test "$BUNDLED_BIND" = yes]) -+AC_SUBST([BIND9_LIBDIR]) - - # OpenLDAP support. - AC_ARG_WITH(ldap, -@@ -610,7 +627,7 @@ fi - CFLAGS="$CFLAGS $STD_CWARNINGS" - - # Try to add the bind include directory --CFLAGS="$CFLAGS -I$libbind/include" -+CFLAGS="$CFLAGS -I$libbind" - - case "$host" in - *-darwin*) -diff -up dhcp-4.3.1b1/dhcpctl/Makefile.am.brGmwh dhcp-4.3.1b1/dhcpctl/Makefile.am ---- dhcp-4.3.1b1/dhcpctl/Makefile.am.brGmwh 2014-07-02 19:58:38.000000000 +0200 -+++ dhcp-4.3.1b1/dhcpctl/Makefile.am 2014-07-10 17:36:30.485250962 +0200 -@@ -6,12 +6,9 @@ EXTRA_DIST = $(man_MANS) - - omshell_SOURCES = omshell.c - omshell_LDADD = libdhcpctl.a ../common/libdhcp.a ../omapip/libomapi.a \ -- ../bind/lib/libirs.a ../bind/lib/libdns.a \ -- ../bind/lib/libisccfg.a ../bind/lib/libisc.a -- -+ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc - libdhcpctl_a_SOURCES = dhcpctl.c callback.c remote.c - - cltest_SOURCES = cltest.c - cltest_LDADD = libdhcpctl.a ../common/libdhcp.a ../omapip/libomapi.a \ -- ../bind/lib/libirs.a ../bind/lib/libdns.a \ -- ../bind/lib/libisccfg.a ../bind/lib/libisc.a -+ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc -diff -up dhcp-4.3.1b1/Makefile.am.brGmwh dhcp-4.3.1b1/Makefile.am ---- dhcp-4.3.1b1/Makefile.am.brGmwh 2014-07-02 19:58:38.000000000 +0200 -+++ dhcp-4.3.1b1/Makefile.am 2014-07-10 17:36:30.484250976 +0200 -@@ -25,7 +25,13 @@ EXTRA_DIST = RELNOTES LICENSE \ - bind/Makefile bind/bind.tar.gz bind/version.tmp \ - common/tests/Atffile server/tests/Atffile - --SUBDIRS = bind includes tests common dst omapip client dhcpctl relay server -+if BUNDLED_BIND -+SUBDIRS = bind -+else -+SUBDIRS = -+endif -+ -+SUBDIRS += includes tests common dst omapip client dhcpctl relay server - - nobase_include_HEADERS = dhcpctl/dhcpctl.h - -diff -up dhcp-4.3.1b1/omapip/Makefile.am.brGmwh dhcp-4.3.1b1/omapip/Makefile.am ---- dhcp-4.3.1b1/omapip/Makefile.am.brGmwh 2014-07-02 19:58:39.000000000 +0200 -+++ dhcp-4.3.1b1/omapip/Makefile.am 2014-07-10 17:36:30.486250948 +0200 -@@ -10,6 +10,5 @@ man_MANS = omapi.3 - EXTRA_DIST = $(man_MANS) - - svtest_SOURCES = test.c --svtest_LDADD = libomapi.a ../bind/lib/libirs.a ../bind/lib/libdns.a \ -- ../bind/lib/libisccfg.a ../bind/lib/libisc.a -- -+svtest_LDADD = libomapi.a \ -+ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc -diff -up dhcp-4.3.1b1/relay/Makefile.am.brGmwh dhcp-4.3.1b1/relay/Makefile.am ---- dhcp-4.3.1b1/relay/Makefile.am.brGmwh 2014-07-02 19:58:39.000000000 +0200 -+++ dhcp-4.3.1b1/relay/Makefile.am 2014-07-10 17:36:30.486250948 +0200 -@@ -3,8 +3,7 @@ AM_CPPFLAGS = -DLOCALSTATEDIR='"@localst - sbin_PROGRAMS = dhcrelay - dhcrelay_SOURCES = dhcrelay.c - dhcrelay_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \ -- ../bind/lib/libirs.a ../bind/lib/libdns.a \ -- ../bind/lib/libisccfg.a ../bind/lib/libisc.a -+ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc - man_MANS = dhcrelay.8 - EXTRA_DIST = $(man_MANS) - -diff -up dhcp-4.3.1b1/server/Makefile.am.brGmwh dhcp-4.3.1b1/server/Makefile.am ---- dhcp-4.3.1b1/server/Makefile.am.brGmwh 2014-07-02 19:58:39.000000000 +0200 -+++ dhcp-4.3.1b1/server/Makefile.am 2014-07-10 17:36:30.486250948 +0200 -@@ -13,10 +13,8 @@ dhcpd_SOURCES = dhcpd.c dhcp.c bootp.c c - dhcpv6.c mdb6.c ldap.c ldap_casa.c - - dhcpd_CFLAGS = $(LDAP_CFLAGS) --dhcpd_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \ -- ../dhcpctl/libdhcpctl.a ../bind/lib/libirs.a \ -- ../bind/lib/libdns.a ../bind/lib/libisccfg.a ../bind/lib/libisc.a -- -+dhcpd_LDADD = ../common/libdhcp.a ../omapip/libomapi.a ../dhcpctl/libdhcpctl.a \ -+ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc - man_MANS = dhcpd.8 dhcpd.conf.5 dhcpd.leases.5 - EXTRA_DIST = $(man_MANS) - -diff -up dhcp-4.3.1b1/server/tests/Makefile.am.brGmwh dhcp-4.3.1b1/server/tests/Makefile.am ---- dhcp-4.3.1b1/server/tests/Makefile.am.brGmwh 2014-07-02 19:58:40.000000000 +0200 -+++ dhcp-4.3.1b1/server/tests/Makefile.am 2014-07-10 17:36:30.486250948 +0200 -@@ -18,9 +18,8 @@ DHCPSRC = ../dhcp.c ../bootp.c ../confpa - ../ldap.c ../ldap_casa.c ../dhcpd.c - - DHCPLIBS = $(top_builddir)/common/libdhcp.a $(top_builddir)/omapip/libomapi.a \ -- $(top_builddir)/dhcpctl/libdhcpctl.a $(top_builddir)/bind/lib/libirs.a \ -- $(top_builddir)/bind/lib/libdns.a $(top_builddir)/bind/lib/libisccfg.a \ -- $(top_builddir)/bind/lib/libisc.a -+ $(top_builddir)/dhcpctl/libdhcpctl.a \ -+ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc - - ATF_TESTS = - TESTS = diff --git a/src/patches/dhcp/dhcp-rfc3442-classless-static-routes.patch b/src/patches/dhcp/dhcp-rfc3442-classless-static-routes.patch deleted file mode 100644 index 94ed5ba24..000000000 --- a/src/patches/dhcp/dhcp-rfc3442-classless-static-routes.patch +++ /dev/null @@ -1,405 +0,0 @@ -diff -up dhcp-4.3.0rc1/client/clparse.c.rfc3442 dhcp-4.3.0rc1/client/clparse.c ---- dhcp-4.3.0rc1/client/clparse.c.rfc3442 2014-01-29 10:05:48.474400352 +0100 -+++ dhcp-4.3.0rc1/client/clparse.c 2014-01-29 10:05:48.517399955 +0100 -@@ -31,7 +31,7 @@ - - struct client_config top_level_config; - --#define NUM_DEFAULT_REQUESTED_OPTS 14 -+#define NUM_DEFAULT_REQUESTED_OPTS 15 - struct option *default_requested_options[NUM_DEFAULT_REQUESTED_OPTS + 1]; - - static void parse_client_default_duid(struct parse *cfile); -@@ -84,7 +84,11 @@ isc_result_t read_client_conf () - dhcp_universe.code_hash, &code, 0, MDL); - - /* 4 */ -- code = DHO_ROUTERS; -+ /* The Classless Static Routes option code MUST appear in the parameter -+ * request list prior to both the Router option code and the Static -+ * Routes option code, if present. (RFC3442) -+ */ -+ code = DHO_CLASSLESS_STATIC_ROUTES; - option_code_hash_lookup(&default_requested_options[3], - dhcp_universe.code_hash, &code, 0, MDL); - -@@ -138,6 +142,11 @@ isc_result_t read_client_conf () - option_code_hash_lookup(&default_requested_options[13], - dhcp_universe.code_hash, &code, 0, MDL); - -+ /* 15 */ -+ code = DHO_ROUTERS; -+ option_code_hash_lookup(&default_requested_options[14], -+ dhcp_universe.code_hash, &code, 0, MDL); -+ - for (code = 0 ; code < NUM_DEFAULT_REQUESTED_OPTS ; code++) { - if (default_requested_options[code] == NULL) - log_fatal("Unable to find option definition for " -diff -up dhcp-4.3.0rc1/common/dhcp-options.5.rfc3442 dhcp-4.3.0rc1/common/dhcp-options.5 ---- dhcp-4.3.0rc1/common/dhcp-options.5.rfc3442 2014-01-29 10:05:48.466400426 +0100 -+++ dhcp-4.3.0rc1/common/dhcp-options.5 2014-01-29 10:05:48.518399945 +0100 -@@ -111,6 +111,26 @@ hexadecimal, separated by colons. For e - or - option dhcp-client-identifier 43:4c:49:45:54:2d:46:4f:4f; - .fi -+.PP -+The -+.B destination-descriptor -+describe the IP subnet number and subnet mask -+of a particular destination using a compact encoding. This encoding -+consists of one octet describing the width of the subnet mask, -+followed by all the significant octets of the subnet number. -+The following table contains some examples of how various subnet -+number/mask combinations can be encoded: -+.nf -+.sp 1 -+Subnet number Subnet mask Destination descriptor -+0 0 0 -+10.0.0.0 255.0.0.0 8.10 -+10.0.0.0 255.255.255.0 24.10.0.0 -+10.17.0.0 255.255.0.0 16.10.17 -+10.27.129.0 255.255.255.0 24.10.27.129 -+10.229.0.128 255.255.255.128 25.10.229.0.128 -+10.198.122.47 255.255.255.255 32.10.198.122.47 -+.fi - .SH SETTING OPTION VALUES USING EXPRESSIONS - Sometimes it's helpful to be able to set the value of a DHCP option - based on some value that the client has sent. To do this, you can -@@ -972,6 +992,29 @@ dhclient-script will create routes: - .RE - .PP - .nf -+.B option \fBclassless-static-routes\fR \fIdestination-descriptor ip-address\fR -+ [\fB,\fR \fIdestination-descriptor ip-address\fR...]\fB;\fR -+.fi -+.RS 0.25i -+.PP -+This option (see RFC3442) specifies a list of classless static routes -+that the client should install in its routing cache. -+.PP -+This option can contain one or more static routes, each of which -+consists of a destination descriptor and the IP address of the router -+that should be used to reach that destination. -+.PP -+Many clients may not implement the Classless Static Routes option. -+DHCP server administrators should therefore configure their DHCP -+servers to send both a Router option and a Classless Static Routes -+option, and should specify the default router(s) both in the Router -+option and in the Classless Static Routes option. -+.PP -+If the DHCP server returns both a Classless Static Routes option and -+a Router option, the DHCP client ignores the Router option. -+.RE -+.PP -+.nf - .B option \fBstreettalk-directory-assistance-server\fR \fIip-address\fR - [\fB,\fR \fIip-address\fR...]\fB;\fR - .fi -diff -up dhcp-4.3.0rc1/common/inet.c.rfc3442 dhcp-4.3.0rc1/common/inet.c ---- dhcp-4.3.0rc1/common/inet.c.rfc3442 2014-01-26 19:40:44.000000000 +0100 -+++ dhcp-4.3.0rc1/common/inet.c 2014-01-29 10:05:48.519399936 +0100 -@@ -521,6 +521,60 @@ free_iaddrcidrnetlist(struct iaddrcidrne - return ISC_R_SUCCESS; - } - -+static const char * -+inet_ntopdd(const unsigned char *src, unsigned srclen, char *dst, size_t size) -+{ -+ char tmp[sizeof("32.255.255.255.255")]; -+ int len; -+ -+ switch (srclen) { -+ case 2: -+ len = sprintf (tmp, "%u.%u", src[0], src[1]); -+ break; -+ case 3: -+ len = sprintf (tmp, "%u.%u.%u", src[0], src[1], src[2]); -+ break; -+ case 4: -+ len = sprintf (tmp, "%u.%u.%u.%u", src[0], src[1], src[2], src[3]); -+ break; -+ case 5: -+ len = sprintf (tmp, "%u.%u.%u.%u.%u", src[0], src[1], src[2], src[3], src[4]); -+ break; -+ default: -+ return NULL; -+ } -+ if (len < 0) -+ return NULL; -+ -+ if (len > size) { -+ errno = ENOSPC; -+ return NULL; -+ } -+ -+ return strcpy (dst, tmp); -+} -+ -+/* pdestdesc() turns an iaddr structure into a printable dest. descriptor */ -+const char * -+pdestdesc(const struct iaddr addr) { -+ static char pbuf[sizeof("255.255.255.255.255")]; -+ -+ if (addr.len == 0) { -+ return "<null destination descriptor>"; -+ } -+ if (addr.len == 1) { -+ return "0"; -+ } -+ if ((addr.len >= 2) && (addr.len <= 5)) { -+ return inet_ntopdd(addr.iabuf, addr.len, pbuf, sizeof(pbuf)); -+ } -+ -+ log_fatal("pdestdesc():%s:%d: Invalid destination descriptor length %d.", -+ MDL, addr.len); -+ /* quell compiler warnings */ -+ return NULL; -+} -+ - /* piaddr() turns an iaddr structure into a printable address. */ - /* XXX: should use a const pointer rather than passing the structure */ - const char * -diff -up dhcp-4.3.0rc1/common/options.c.rfc3442 dhcp-4.3.0rc1/common/options.c ---- dhcp-4.3.0rc1/common/options.c.rfc3442 2014-01-26 19:40:44.000000000 +0100 -+++ dhcp-4.3.0rc1/common/options.c 2014-01-29 10:05:48.520399927 +0100 -@@ -707,7 +707,11 @@ cons_options(struct packet *inpacket, st - * packet. - */ - priority_list[priority_len++] = DHO_SUBNET_MASK; -- priority_list[priority_len++] = DHO_ROUTERS; -+ if (lookup_option(&dhcp_universe, cfg_options, -+ DHO_CLASSLESS_STATIC_ROUTES)) -+ priority_list[priority_len++] = DHO_CLASSLESS_STATIC_ROUTES; -+ else -+ priority_list[priority_len++] = DHO_ROUTERS; - priority_list[priority_len++] = DHO_DOMAIN_NAME_SERVERS; - priority_list[priority_len++] = DHO_HOST_NAME; - priority_list[priority_len++] = DHO_FQDN; -@@ -1688,6 +1692,7 @@ const char *pretty_print_option (option, - unsigned long tval; - isc_boolean_t a_array = ISC_FALSE; - int len_used; -+ unsigned int octets = 0; - - if (emit_commas) - comma = ','; -@@ -1696,6 +1701,7 @@ const char *pretty_print_option (option, - - memset (enumbuf, 0, sizeof enumbuf); - -+ if (option->format[0] != 'R') { /* see explanation lower */ - /* Figure out the size of the data. */ - for (l = i = 0; option -> format [i]; i++, l++) { - if (l >= sizeof(fmtbuf) - 1) -@@ -1870,6 +1876,33 @@ const char *pretty_print_option (option, - if (numhunk < 0) - numhunk = 1; - -+ } else { /* option->format[i] == 'R') */ -+ /* R (destination descriptor) has variable length. -+ * We can find it only in classless static route option, -+ * so we are for sure parsing classless static route option now. -+ * We go through whole the option to check whether there are no -+ * missing/extra bytes. -+ * I didn't find out how to improve the existing code and that's the -+ * reason for this separate 'else' where I do my own checkings. -+ * I know it's little bit unsystematic, but it works. -+ */ -+ numhunk = 0; -+ numelem = 2; /* RI */ -+ fmtbuf[0]='R'; fmtbuf[1]='I'; fmtbuf[2]=0; -+ for (i =0; i < len; i = i + octets + 5) { -+ if (data[i] > 32) { /* subnet mask width */ -+ log_error ("wrong subnet mask width in destination descriptor"); -+ break; -+ } -+ numhunk++; -+ octets = ((data[i]+7) / 8); -+ } -+ if (i != len) { -+ log_error ("classless static routes option has wrong size or " -+ "there's some garbage in format"); -+ } -+ } -+ - /* Cycle through the array (or hunk) printing the data. */ - for (i = 0; i < numhunk; i++) { - if ((a_array == ISC_TRUE) && (i != 0) && (numelem > 0)) { -@@ -2025,6 +2058,20 @@ const char *pretty_print_option (option, - strcpy(op, piaddr(iaddr)); - dp += 4; - break; -+ -+ case 'R': -+ if (dp[0] <= 32) -+ iaddr.len = (((dp[0]+7)/8)+1); -+ else { -+ log_error ("wrong subnet mask width in destination descriptor"); -+ return "<error>"; -+ } -+ -+ memcpy(iaddr.iabuf, dp, iaddr.len); -+ strcpy(op, pdestdesc(iaddr)); -+ dp += iaddr.len; -+ break; -+ - case '6': - iaddr.len = 16; - memcpy(iaddr.iabuf, dp, 16); -diff -up dhcp-4.3.0rc1/common/parse.c.rfc3442 dhcp-4.3.0rc1/common/parse.c ---- dhcp-4.3.0rc1/common/parse.c.rfc3442 2014-01-29 10:05:48.491400195 +0100 -+++ dhcp-4.3.0rc1/common/parse.c 2014-01-29 10:05:48.522399908 +0100 -@@ -335,6 +335,39 @@ int parse_ip_addr (cfile, addr) - } - - /* -+ * destination-descriptor :== NUMBER DOT NUMBER | -+ * NUMBER DOT NUMBER DOT NUMBER | -+ * NUMBER DOT NUMBER DOT NUMBER DOT NUMBER | -+ * NUMBER DOT NUMBER DOT NUMBER DOT NUMBER DOT NUMBER -+ */ -+ -+int parse_destination_descriptor (cfile, addr) -+ struct parse *cfile; -+ struct iaddr *addr; -+{ -+ unsigned int mask_width, dest_dest_len; -+ addr -> len = 0; -+ if (parse_numeric_aggregate (cfile, addr -> iabuf, -+ &addr -> len, DOT, 10, 8)) { -+ mask_width = (unsigned int)addr->iabuf[0]; -+ dest_dest_len = (((mask_width+7)/8)+1); -+ if (mask_width > 32) { -+ parse_warn (cfile, -+ "subnet mask width (%u) greater than 32.", mask_width); -+ } -+ else if (dest_dest_len != addr->len) { -+ parse_warn (cfile, -+ "destination descriptor with subnet mask width %u " -+ "should have %u octets, but has %u octets.", -+ mask_width, dest_dest_len, addr->len); -+ } -+ -+ return 1; -+ } -+ return 0; -+} -+ -+/* - * Return true if every character in the string is hexadecimal. - */ - static int -@@ -713,8 +746,10 @@ unsigned char *parse_numeric_aggregate ( - if (count) { - token = peek_token (&val, (unsigned *)0, cfile); - if (token != separator) { -- if (!*max) -+ if (!*max) { -+ *max = count; - break; -+ } - if (token != RBRACE && token != LBRACE) - token = next_token (&val, - (unsigned *)0, -@@ -1654,6 +1689,9 @@ int parse_option_code_definition (cfile, - case IP_ADDRESS: - type = 'I'; - break; -+ case DESTINATION_DESCRIPTOR: -+ type = 'R'; -+ break; - case IP6_ADDRESS: - type = '6'; - break; -@@ -5071,6 +5109,15 @@ int parse_option_token (rv, cfile, fmt, - } - break; - -+ case 'R': /* destination descriptor */ -+ if (!parse_destination_descriptor (cfile, &addr)) { -+ return 0; -+ } -+ if (!make_const_data (&t, addr.iabuf, addr.len, 0, 1, MDL)) { -+ return 0; -+ } -+ break; -+ - case '6': /* IPv6 address. */ - if (!parse_ip6_addr(cfile, &addr)) { - return 0; -@@ -5348,6 +5395,13 @@ int parse_option_decl (oc, cfile) - goto exit; - len = ip_addr.len; - dp = ip_addr.iabuf; -+ goto alloc; -+ -+ case 'R': /* destination descriptor */ -+ if (!parse_destination_descriptor (cfile, &ip_addr)) -+ goto exit; -+ len = ip_addr.len; -+ dp = ip_addr.iabuf; - - alloc: - if (hunkix + len > sizeof hunkbuf) { -diff -up dhcp-4.3.0rc1/common/tables.c.rfc3442 dhcp-4.3.0rc1/common/tables.c ---- dhcp-4.3.0rc1/common/tables.c.rfc3442 2014-01-29 10:05:48.485400250 +0100 -+++ dhcp-4.3.0rc1/common/tables.c 2014-01-29 10:06:25.724038563 +0100 -@@ -46,6 +46,7 @@ HASH_FUNCTIONS (option_code, const unsig - Format codes: - - I - IPv4 address -+ R - destination descriptor (RFC3442) - 6 - IPv6 address - l - 32-bit signed integer - L - 32-bit unsigned integer -@@ -214,6 +215,7 @@ static struct option dhcp_options[] = { - #endif - { "subnet-selection", "I", &dhcp_universe, 118, 1 }, - { "domain-search", "D", &dhcp_universe, 119, 1 }, -+ { "classless-static-routes", "RIA", &dhcp_universe, 121, 1 }, - { "vivco", "Evendor-class.", &dhcp_universe, 124, 1 }, - { "vivso", "Evendor.", &dhcp_universe, 125, 1 }, - #if 0 -diff -up dhcp-4.3.0rc1/includes/dhcpd.h.rfc3442 dhcp-4.3.0rc1/includes/dhcpd.h ---- dhcp-4.3.0rc1/includes/dhcpd.h.rfc3442 2014-01-29 10:05:48.470400389 +0100 -+++ dhcp-4.3.0rc1/includes/dhcpd.h 2014-01-29 10:05:48.525399881 +0100 -@@ -2725,6 +2725,7 @@ isc_result_t range2cidr(struct iaddrcidr - const struct iaddr *lo, const struct iaddr *hi); - isc_result_t free_iaddrcidrnetlist(struct iaddrcidrnetlist **result); - const char *piaddr (struct iaddr); -+const char *pdestdesc (struct iaddr); - char *piaddrmask(struct iaddr *, struct iaddr *); - char *piaddrcidr(const struct iaddr *, unsigned int); - u_int16_t validate_port(char *); -@@ -2934,6 +2935,7 @@ void parse_client_lease_declaration (str - int parse_option_decl (struct option_cache **, struct parse *); - void parse_string_list (struct parse *, struct string_list **, int); - int parse_ip_addr (struct parse *, struct iaddr *); -+int parse_destination_descriptor (struct parse *, struct iaddr *); - int parse_ip_addr_with_subnet(struct parse *, struct iaddrmatch *); - void parse_reject_statement (struct parse *, struct client_config *); - -diff -up dhcp-4.3.0rc1/includes/dhcp.h.rfc3442 dhcp-4.3.0rc1/includes/dhcp.h ---- dhcp-4.3.0rc1/includes/dhcp.h.rfc3442 2014-01-26 19:40:44.000000000 +0100 -+++ dhcp-4.3.0rc1/includes/dhcp.h 2014-01-29 10:05:48.524399890 +0100 -@@ -159,6 +159,7 @@ struct dhcp_packet { - #define DHO_ASSOCIATED_IP 92 - #define DHO_SUBNET_SELECTION 118 /* RFC3011! */ - #define DHO_DOMAIN_SEARCH 119 /* RFC3397 */ -+#define DHO_CLASSLESS_STATIC_ROUTES 121 /* RFC3442 */ - #define DHO_VIVCO_SUBOPTIONS 124 - #define DHO_VIVSO_SUBOPTIONS 125 - -diff -up dhcp-4.3.0rc1/includes/dhctoken.h.rfc3442 dhcp-4.3.0rc1/includes/dhctoken.h ---- dhcp-4.3.0rc1/includes/dhctoken.h.rfc3442 2014-01-29 10:05:48.435400713 +0100 -+++ dhcp-4.3.0rc1/includes/dhctoken.h 2014-01-29 10:05:48.526399871 +0100 -@@ -368,7 +368,8 @@ enum dhcp_token { - POOL6 = 669, - V6RELAY = 670, - V6RELOPT = 671, -- BOOTP_BROADCAST_ALWAYS = 672 -+ BOOTP_BROADCAST_ALWAYS = 672, -+ DESTINATION_DESCRIPTOR = 673 - }; - - #define is_identifier(x) ((x) >= FIRST_TOKEN && \ diff --git a/src/patches/dhcp/dhcp-sendDecline.patch b/src/patches/dhcp/dhcp-sendDecline.patch deleted file mode 100644 index e68336634..000000000 --- a/src/patches/dhcp/dhcp-sendDecline.patch +++ /dev/null @@ -1,231 +0,0 @@ -diff -up dhcp-4.3.0a1/client/dhc6.c.sendDecline dhcp-4.3.0a1/client/dhc6.c ---- dhcp-4.3.0a1/client/dhc6.c.sendDecline 2013-12-11 01:25:12.000000000 +0100 -+++ dhcp-4.3.0a1/client/dhc6.c 2013-12-19 15:56:18.297660118 +0100 -@@ -96,6 +96,8 @@ void do_select6(void *input); - void do_refresh6(void *input); - static void do_release6(void *input); - static void start_bound(struct client_state *client); -+static void start_decline6(struct client_state *client); -+static void do_decline6(void *input); - static void start_informed(struct client_state *client); - void informed_handler(struct packet *packet, struct client_state *client); - void bound_handler(struct packet *packet, struct client_state *client); -@@ -2017,6 +2019,7 @@ start_release6(struct client_state *clie - cancel_timeout(do_select6, client); - cancel_timeout(do_refresh6, client); - cancel_timeout(do_release6, client); -+ cancel_timeout(do_decline6, client); - client->state = S_STOPPED; - - /* -@@ -2650,6 +2653,7 @@ dhc6_check_reply(struct client_state *cl - break; - - case S_STOPPED: -+ case S_DECLINED: - action = dhc6_stop_action; - break; - -@@ -2751,6 +2755,7 @@ dhc6_check_reply(struct client_state *cl - break; - - case S_STOPPED: -+ case S_DECLINED: - /* Nothing critical to do at this stage. */ - break; - -@@ -3741,17 +3746,23 @@ reply_handler(struct packet *packet, str - cancel_timeout(do_select6, client); - cancel_timeout(do_refresh6, client); - cancel_timeout(do_release6, client); -+ cancel_timeout(do_decline6, client); - - /* If this is in response to a Release/Decline, clean up and return. */ -- if (client->state == S_STOPPED) { -- if (client->active_lease == NULL) -- return; -+ if ((client->state == S_STOPPED) || -+ (client->state == S_DECLINED)) { -+ -+ if (client->active_lease != NULL) { -+ dhc6_lease_destroy(&client->active_lease, MDL); -+ client->active_lease = NULL; -+ /* We should never wait for nothing!? */ -+ if (stopping_finished()) -+ exit(0); -+ } -+ -+ if (client->state == S_DECLINED) -+ start_init6(client); - -- dhc6_lease_destroy(&client->active_lease, MDL); -- client->active_lease = NULL; -- /* We should never wait for nothing!? */ -- if (stopping_finished()) -- exit(0); - return; - } - -@@ -4279,7 +4290,11 @@ start_bound(struct client_state *client) - dhc6_marshall_values("new_", client, lease, ia, addr); - script_write_requested6(client); - -- script_go(client); -+ // when script returns 3, DAD failed -+ if (script_go(client) == 3) { -+ start_decline6(client); -+ return; -+ } - } - - /* XXX: maybe we should loop on the old values instead? */ -@@ -4327,6 +4342,149 @@ start_bound(struct client_state *client) - dhc6_check_times(client); - } - -+/* -+ * Decline addresses. -+ */ -+void -+start_decline6(struct client_state *client) -+{ -+ /* Cancel any pending transmissions */ -+ cancel_timeout(do_confirm6, client); -+ cancel_timeout(do_select6, client); -+ cancel_timeout(do_refresh6, client); -+ cancel_timeout(do_release6, client); -+ cancel_timeout(do_decline6, client); -+ client->state = S_DECLINED; -+ -+ if (client->active_lease == NULL) -+ return; -+ -+ /* Set timers per RFC3315 section 18.1.7. */ -+ client->IRT = DEC_TIMEOUT * 100; -+ client->MRT = 0; -+ client->MRC = DEC_MAX_RC; -+ client->MRD = 0; -+ -+ dhc6_retrans_init(client); -+ client->v6_handler = reply_handler; -+ -+ client->refresh_type = DHCPV6_DECLINE; -+ do_decline6(client); -+} -+ -+/* -+ * do_decline6() creates a Decline packet and transmits it. -+ */ -+static void -+do_decline6(void *input) -+{ -+ struct client_state *client; -+ struct data_string ds; -+ int send_ret; -+ struct timeval elapsed, tv; -+ -+ client = input; -+ -+ if ((client->active_lease == NULL) || !active_prefix(client)) -+ return; -+ -+ if ((client->MRC != 0) && (client->txcount > client->MRC)) { -+ log_info("Max retransmission count exceeded."); -+ goto decline_done; -+ } -+ -+ /* -+ * Start_time starts at the first transmission. -+ */ -+ if (client->txcount == 0) { -+ client->start_time.tv_sec = cur_tv.tv_sec; -+ client->start_time.tv_usec = cur_tv.tv_usec; -+ } -+ -+ /* elapsed = cur - start */ -+ elapsed.tv_sec = cur_tv.tv_sec - client->start_time.tv_sec; -+ elapsed.tv_usec = cur_tv.tv_usec - client->start_time.tv_usec; -+ if (elapsed.tv_usec < 0) { -+ elapsed.tv_sec -= 1; -+ elapsed.tv_usec += 1000000; -+ } -+ -+ memset(&ds, 0, sizeof(ds)); -+ if (!buffer_allocate(&ds.buffer, 4, MDL)) { -+ log_error("Unable to allocate memory for Decline."); -+ goto decline_done; -+ } -+ -+ ds.data = ds.buffer->data; -+ ds.len = 4; -+ ds.buffer->data[0] = DHCPV6_DECLINE; -+ memcpy(ds.buffer->data + 1, client->dhcpv6_transaction_id, 3); -+ -+ /* Form an elapsed option. */ -+ /* Maximum value is 65535 1/100s coded as 0xffff. */ -+ if ((elapsed.tv_sec < 0) || (elapsed.tv_sec > 655) || -+ ((elapsed.tv_sec == 655) && (elapsed.tv_usec > 350000))) { -+ client->elapsed = 0xffff; -+ } else { -+ client->elapsed = elapsed.tv_sec * 100; -+ client->elapsed += elapsed.tv_usec / 10000; -+ } -+ -+ client->elapsed = htons(client->elapsed); -+ -+ log_debug("XMT: Forming Decline."); -+ make_client6_options(client, &client->sent_options, -+ client->active_lease, DHCPV6_DECLINE); -+ dhcpv6_universe.encapsulate(&ds, NULL, NULL, client, NULL, -+ client->sent_options, &global_scope, -+ &dhcpv6_universe); -+ -+ /* Append IA's (but don't release temporary addresses). */ -+ if (wanted_ia_na && -+ dhc6_add_ia_na(client, &ds, client->active_lease, -+ DHCPV6_DECLINE) != ISC_R_SUCCESS) { -+ data_string_forget(&ds, MDL); -+ goto decline_done; -+ } -+ if (wanted_ia_pd && -+ dhc6_add_ia_pd(client, &ds, client->active_lease, -+ DHCPV6_DECLINE) != ISC_R_SUCCESS) { -+ data_string_forget(&ds, MDL); -+ goto decline_done; -+ } -+ -+ /* Transmit and wait. */ -+ log_info("XMT: Decline on %s, interval %ld0ms.", -+ client->name ? client->name : client->interface->name, -+ (long int)client->RT); -+ -+ send_ret = send_packet6(client->interface, ds.data, ds.len, -+ &DHCPv6DestAddr); -+ if (send_ret != ds.len) { -+ log_error("dhc6: sendpacket6() sent %d of %d bytes", -+ send_ret, ds.len); -+ } -+ -+ data_string_forget(&ds, MDL); -+ -+ /* Wait RT */ -+ tv.tv_sec = cur_tv.tv_sec + client->RT / 100; -+ tv.tv_usec = cur_tv.tv_usec + (client->RT % 100) * 10000; -+ if (tv.tv_usec >= 1000000) { -+ tv.tv_sec += 1; -+ tv.tv_usec -= 1000000; -+ } -+ add_timeout(&tv, do_decline6, client, NULL, NULL); -+ dhc6_retrans_advance(client); -+ return; -+ -+decline_done: -+ dhc6_lease_destroy(&client->active_lease, MDL); -+ client->active_lease = NULL; -+ start_init6(client); -+ return; -+} -+ - /* While bound, ignore packets. In the future we'll want to answer - * Reconfigure-Request messages and the like. - */ diff --git a/src/patches/dhcp/dhcp-sharedlib.patch b/src/patches/dhcp/dhcp-sharedlib.patch deleted file mode 100644 index abb2acc19..000000000 --- a/src/patches/dhcp/dhcp-sharedlib.patch +++ /dev/null @@ -1,107 +0,0 @@ -diff -up dhcp-4.3.1b1/common/tests/Makefile.am.uCWMBl dhcp-4.3.1b1/common/tests/Makefile.am ---- dhcp-4.3.1b1/common/tests/Makefile.am.uCWMBl 2014-07-10 17:38:10.779828569 +0200 -+++ dhcp-4.3.1b1/common/tests/Makefile.am 2014-07-10 17:38:21.355678580 +0200 -@@ -13,19 +13,19 @@ ATF_TESTS += alloc_unittest dns_unittest - alloc_unittest_SOURCES = test_alloc.c $(top_srcdir)/tests/t_api_dhcp.c - alloc_unittest_LDADD = $(ATF_LDFLAGS) - alloc_unittest_LDADD += ../libdhcp.a \ -- ../../omapip/libomapi.a \ -+ ../../omapip/libomapi.la \ - $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc - - dns_unittest_SOURCES = dns_unittest.c $(top_srcdir)/tests/t_api_dhcp.c - dns_unittest_LDADD = $(ATF_LDFLAGS) --dns_unittest_LDADD += ../libdhcp.a \ -+dns_unittest_LDADD += ../libdhcp.la \ - ../../omapip/libomapi.a \ - $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc - - misc_unittest_SOURCES = misc_unittest.c $(top_srcdir)/tests/t_api_dhcp.c - misc_unittest_LDADD = $(ATF_LDFLAGS) - misc_unittest_LDADD += ../libdhcp.a \ -- ../../omapip/libomapi.a \ -+ ../../omapip/libomapi.la \ - $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc - check: $(ATF_TESTS) - atf-run | atf-report -diff -up dhcp-4.3.1b1/configure.ac.uCWMBl dhcp-4.3.1b1/configure.ac ---- dhcp-4.3.1b1/configure.ac.uCWMBl 2014-07-10 17:38:10.766828753 +0200 -+++ dhcp-4.3.1b1/configure.ac 2014-07-10 17:38:10.779828569 +0200 -@@ -39,7 +39,8 @@ fi - # Use this to define _GNU_SOURCE to pull in the IPv6 Advanced Socket API. - AC_USE_SYSTEM_EXTENSIONS - --AC_PROG_RANLIB -+# Use libtool to simplify building of shared libraries -+AC_PROG_LIBTOOL - AC_CONFIG_HEADERS([includes/config.h]) - - # we sometimes need to know byte order for building packets -diff -up dhcp-4.3.1b1/dhcpctl/Makefile.am.uCWMBl dhcp-4.3.1b1/dhcpctl/Makefile.am ---- dhcp-4.3.1b1/dhcpctl/Makefile.am.uCWMBl 2014-07-10 17:36:30.485250962 +0200 -+++ dhcp-4.3.1b1/dhcpctl/Makefile.am 2014-07-10 17:38:10.780828554 +0200 -@@ -1,14 +1,14 @@ - bin_PROGRAMS = omshell --lib_LIBRARIES = libdhcpctl.a -+lib_LTLIBRARIES = libdhcpctl.la - noinst_PROGRAMS = cltest - man_MANS = omshell.1 dhcpctl.3 - EXTRA_DIST = $(man_MANS) - - omshell_SOURCES = omshell.c --omshell_LDADD = libdhcpctl.a ../common/libdhcp.a ../omapip/libomapi.a \ -+omshell_LDADD = libdhcpctl.la ../common/libdhcp.a ../omapip/libomapi.la \ - $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc --libdhcpctl_a_SOURCES = dhcpctl.c callback.c remote.c -+libdhcpctl_la_SOURCES = dhcpctl.c callback.c remote.c - - cltest_SOURCES = cltest.c --cltest_LDADD = libdhcpctl.a ../common/libdhcp.a ../omapip/libomapi.a \ -+cltest_LDADD = libdhcpctl.la ../common/libdhcp.a ../omapip/libomapi.la \ - $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc -diff -up dhcp-4.3.1b1/omapip/Makefile.am.uCWMBl dhcp-4.3.1b1/omapip/Makefile.am ---- dhcp-4.3.1b1/omapip/Makefile.am.uCWMBl 2014-07-10 17:36:30.486250948 +0200 -+++ dhcp-4.3.1b1/omapip/Makefile.am 2014-07-10 17:38:10.780828554 +0200 -@@ -1,7 +1,7 @@ --lib_LIBRARIES = libomapi.a -+lib_LTLIBRARIES = libomapi.la - noinst_PROGRAMS = svtest - --libomapi_a_SOURCES = protocol.c buffer.c alloc.c result.c connection.c \ -+libomapi_la_SOURCES = protocol.c buffer.c alloc.c result.c connection.c \ - errwarn.c listener.c dispatch.c generic.c support.c \ - handle.c message.c convert.c hash.c auth.c inet_addr.c \ - array.c trace.c toisc.c iscprint.c isclib.c -@@ -10,5 +10,5 @@ man_MANS = omapi.3 - EXTRA_DIST = $(man_MANS) - - svtest_SOURCES = test.c --svtest_LDADD = libomapi.a \ -+svtest_LDADD = libomapi.la \ - $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc -diff -up dhcp-4.3.1b1/server/Makefile.am.uCWMBl dhcp-4.3.1b1/server/Makefile.am ---- dhcp-4.3.1b1/server/Makefile.am.uCWMBl 2014-07-10 17:36:30.486250948 +0200 -+++ dhcp-4.3.1b1/server/Makefile.am 2014-07-10 17:38:10.780828554 +0200 -@@ -13,7 +13,7 @@ dhcpd_SOURCES = dhcpd.c dhcp.c bootp.c c - dhcpv6.c mdb6.c ldap.c ldap_casa.c - - dhcpd_CFLAGS = $(LDAP_CFLAGS) --dhcpd_LDADD = ../common/libdhcp.a ../omapip/libomapi.a ../dhcpctl/libdhcpctl.a \ -+dhcpd_LDADD = ../common/libdhcp.a ../omapip/libomapi.la ../dhcpctl/libdhcpctl.la \ - $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc - man_MANS = dhcpd.8 dhcpd.conf.5 dhcpd.leases.5 - EXTRA_DIST = $(man_MANS) -diff -up dhcp-4.3.1b1/server/tests/Makefile.am.uCWMBl dhcp-4.3.1b1/server/tests/Makefile.am ---- dhcp-4.3.1b1/server/tests/Makefile.am.uCWMBl 2014-07-10 17:36:30.486250948 +0200 -+++ dhcp-4.3.1b1/server/tests/Makefile.am 2014-07-10 17:38:10.780828554 +0200 -@@ -17,8 +17,8 @@ DHCPSRC = ../dhcp.c ../bootp.c ../confpa - ../ddns.c ../dhcpleasequery.c ../dhcpv6.c ../mdb6.c \ - ../ldap.c ../ldap_casa.c ../dhcpd.c - --DHCPLIBS = $(top_builddir)/common/libdhcp.a $(top_builddir)/omapip/libomapi.a \ -- $(top_builddir)/dhcpctl/libdhcpctl.a \ -+DHCPLIBS = $(top_builddir)/common/libdhcp.a $(top_builddir)/omapip/libomapi.la \ -+ $(top_builddir)/dhcpctl/libdhcpctl.la \ - $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc - - ATF_TESTS = diff --git a/src/patches/dhcp/dhcp-stateless-DUID-LLT.patch b/src/patches/dhcp/dhcp-stateless-DUID-LLT.patch deleted file mode 100644 index a7f22b539..000000000 --- a/src/patches/dhcp/dhcp-stateless-DUID-LLT.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 61fa3dd9e789997f66e848c7e3fb2f554ee374e2 Mon Sep 17 00:00:00 2001 -From: Jiri Popelka <jpopelka(a)redhat.com> -Date: Thu, 18 Dec 2014 11:53:26 +0100 -Subject: [PATCH] Write DUID_LLT even in stateless mode. - -By default, DHCPv6 dhclient creates DUID-LL -if it is running in stateless mode (-6 -S) and -doesn't write it into leases file, most likely -because the DUID-LL is always generated the same. - -It's however possible to specify DUID to be of type LLT instead of LL -with '-D LLT'. Rfc 3315 says that: -'Clients and servers using this type of DUID MUST -store the DUID-LLT in stable storage.' -That's not fulfiled in this case (-6 -S -D LLT), -because it's generated each time again. - -It's not a big deal because the server doesn't store any -info about 'stateless' clients, so it doesn't matter -that the DUID-LLT is different each time. -But there's a TAHI test which tests this, i.e. that -DUID-LLT is still the same even in stateless mode. -It's a test DHCP_CONF.7.1.9, part B. -https://www.ipv6ready.org/docs/Phase2_DHCPv6_Conformance_Latest.pdf - -Signed-off-by: Jiri Popelka <jpopelka(a)redhat.com> ---- - client/dhclient.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/client/dhclient.c b/client/dhclient.c -index 5ef59cd..026e3fe 100644 ---- a/client/dhclient.c -+++ b/client/dhclient.c -@@ -788,7 +788,9 @@ void run_stateless(int exit_mode) - if (default_duid.buffer != NULL) - data_string_forget(&default_duid, MDL); - -- form_duid(&default_duid, MDL); -+ if (form_duid(&default_duid, MDL) == ISC_R_SUCCESS && -+ duid_type == DUID_LLT) -+ write_duid(&default_duid); - } - - /* Start a configuration state machine. */ --- -2.1.0 - diff --git a/src/patches/dhcp/dhcp-unicast-bootp.patch b/src/patches/dhcp/dhcp-unicast-bootp.patch deleted file mode 100644 index a0db9de69..000000000 --- a/src/patches/dhcp/dhcp-unicast-bootp.patch +++ /dev/null @@ -1,101 +0,0 @@ -diff -up dhcp-4.3.0a1/server/bootp.c.unicast dhcp-4.3.0a1/server/bootp.c ---- dhcp-4.3.0a1/server/bootp.c.unicast 2013-12-11 01:25:12.000000000 +0100 -+++ dhcp-4.3.0a1/server/bootp.c 2013-12-19 15:12:12.974671154 +0100 -@@ -59,6 +59,7 @@ void bootp (packet) - char msgbuf [1024]; - int ignorep; - int peer_has_leases = 0; -+ int norelay = 0; - - if (packet -> raw -> op != BOOTREQUEST) - return; -@@ -74,7 +75,7 @@ void bootp (packet) - ? inet_ntoa (packet -> raw -> giaddr) - : packet -> interface -> name); - -- if (!locate_network (packet)) { -+ if ((norelay = locate_network (packet)) == 0) { - log_info ("%s: network unknown", msgbuf); - return; - } -@@ -396,6 +397,15 @@ void bootp (packet) - - goto out; - } -+ } else if (norelay == 2) { -+ to.sin_addr = raw.ciaddr; -+ to.sin_port = remote_port; -+ if (fallback_interface) { -+ result = send_packet (fallback_interface, NULL, &raw, -+ outgoing.packet_length, from, -+ &to, &hto); -+ goto out; -+ } - - /* If it comes from a client that already knows its address - and is not requesting a broadcast response, and we can -diff -up dhcp-4.3.0a1/server/dhcp.c.unicast dhcp-4.3.0a1/server/dhcp.c ---- dhcp-4.3.0a1/server/dhcp.c.unicast 2013-12-13 21:50:38.000000000 +0100 -+++ dhcp-4.3.0a1/server/dhcp.c 2013-12-19 15:12:12.975671140 +0100 -@@ -4627,6 +4627,7 @@ int locate_network (packet) - struct data_string data; - struct subnet *subnet = (struct subnet *)0; - struct option_cache *oc; -+ int norelay = 0; - - /* See if there's a Relay Agent Link Selection Option, or a - * Subnet Selection Option. The Link-Select and Subnet-Select -@@ -4642,12 +4643,24 @@ int locate_network (packet) - from the interface, if there is one. If not, fail. */ - if (!oc && !packet -> raw -> giaddr.s_addr) { - if (packet -> interface -> shared_network) { -- shared_network_reference -- (&packet -> shared_network, -- packet -> interface -> shared_network, MDL); -- return 1; -+ struct in_addr any_addr; -+ any_addr.s_addr = INADDR_ANY; -+ -+ if (!packet -> packet_type && memcmp(&packet -> raw -> ciaddr, &any_addr, 4)) { -+ struct iaddr cip; -+ memcpy(cip.iabuf, &packet -> raw -> ciaddr, 4); -+ cip.len = 4; -+ if (!find_grouped_subnet(&subnet, packet->interface->shared_network, cip, MDL)) -+ norelay = 2; -+ } -+ -+ if (!norelay) { -+ shared_network_reference(&packet -> shared_network, packet -> interface -> shared_network, MDL); -+ return 1; -+ } -+ } else { -+ return 0; - } -- return 0; - } - - /* If there's an option indicating link connection, and it's valid, -@@ -4670,7 +4683,10 @@ int locate_network (packet) - data_string_forget (&data, MDL); - } else { - ia.len = 4; -- memcpy (ia.iabuf, &packet -> raw -> giaddr, 4); -+ if (norelay) -+ memcpy (ia.iabuf, &packet->raw->ciaddr, 4); -+ else -+ memcpy (ia.iabuf, &packet->raw->giaddr, 4); - } - - /* If we know the subnet on which the IP address lives, use it. */ -@@ -4678,7 +4694,10 @@ int locate_network (packet) - shared_network_reference (&packet -> shared_network, - subnet -> shared_network, MDL); - subnet_dereference (&subnet, MDL); -- return 1; -+ if (norelay) -+ return norelay; -+ else -+ return 1; - } - - /* Otherwise, fail. */ diff --git a/src/patches/dhcp/dhcp-xen-checksum.patch b/src/patches/dhcp/dhcp-xen-checksum.patch deleted file mode 100644 index eabc3c127..000000000 --- a/src/patches/dhcp/dhcp-xen-checksum.patch +++ /dev/null @@ -1,251 +0,0 @@ -diff -up dhcp-4.3.0rc1/common/bpf.c.xen dhcp-4.3.0rc1/common/bpf.c ---- dhcp-4.3.0rc1/common/bpf.c.xen 2014-01-29 10:03:27.503941664 +0100 -+++ dhcp-4.3.0rc1/common/bpf.c 2014-01-29 10:03:37.564812175 +0100 -@@ -481,7 +481,7 @@ ssize_t receive_packet (interface, buf, - /* Decode the IP and UDP headers... */ - offset = decode_udp_ip_header(interface, interface->rbuf, - interface->rbuf_offset, -- from, hdr.bh_caplen, &paylen); -+ from, hdr.bh_caplen, &paylen, 0); - - /* If the IP or UDP checksum was bad, skip the packet... */ - if (offset < 0) { -diff -up dhcp-4.3.0rc1/common/dlpi.c.xen dhcp-4.3.0rc1/common/dlpi.c ---- dhcp-4.3.0rc1/common/dlpi.c.xen 2014-01-25 05:18:03.000000000 +0100 -+++ dhcp-4.3.0rc1/common/dlpi.c 2014-01-29 10:03:27.503941664 +0100 -@@ -691,7 +691,7 @@ ssize_t receive_packet (interface, buf, - length -= offset; - #endif - offset = decode_udp_ip_header (interface, dbuf, bufix, -- from, length, &paylen); -+ from, length, &paylen, 0); - - /* - * If the IP or UDP checksum was bad, skip the packet... -diff -up dhcp-4.3.0rc1/common/lpf.c.xen dhcp-4.3.0rc1/common/lpf.c ---- dhcp-4.3.0rc1/common/lpf.c.xen 2014-01-25 05:18:03.000000000 +0100 -+++ dhcp-4.3.0rc1/common/lpf.c 2014-01-29 10:03:27.504941651 +0100 -@@ -29,14 +29,15 @@ - - #include "dhcpd.h" - #if defined (USE_LPF_SEND) || defined (USE_LPF_RECEIVE) -+#include <sys/socket.h> - #include <sys/uio.h> - #include <errno.h> - - #include <asm/types.h> - #include <linux/filter.h> - #include <linux/if_ether.h> -+#include <linux/if_packet.h> - #include <netinet/in_systm.h> --#include <net/if_packet.h> - #include "includes/netinet/ip.h" - #include "includes/netinet/udp.h" - #include "includes/netinet/if_ether.h" -@@ -51,6 +52,19 @@ - /* Reinitializes the specified interface after an address change. This - is not required for packet-filter APIs. */ - -+#ifndef PACKET_AUXDATA -+#define PACKET_AUXDATA 8 -+ -+struct tpacket_auxdata -+{ -+ __u32 tp_status; -+ __u32 tp_len; -+ __u32 tp_snaplen; -+ __u16 tp_mac; -+ __u16 tp_net; -+}; -+#endif -+ - #ifdef USE_LPF_SEND - void if_reinitialize_send (info) - struct interface_info *info; -@@ -73,10 +87,14 @@ int if_register_lpf (info) - struct interface_info *info; - { - int sock; -- struct sockaddr sa; -+ union { -+ struct sockaddr_ll ll; -+ struct sockaddr common; -+ } sa; -+ struct ifreq ifr; - - /* Make an LPF socket. */ -- if ((sock = socket(PF_PACKET, SOCK_PACKET, -+ if ((sock = socket(PF_PACKET, SOCK_RAW, - htons((short)ETH_P_ALL))) < 0) { - if (errno == ENOPROTOOPT || errno == EPROTONOSUPPORT || - errno == ESOCKTNOSUPPORT || errno == EPFNOSUPPORT || -@@ -91,11 +109,17 @@ int if_register_lpf (info) - log_fatal ("Open a socket for LPF: %m"); - } - -+ memset (&ifr, 0, sizeof ifr); -+ strncpy (ifr.ifr_name, (const char *)info -> ifp, sizeof ifr.ifr_name); -+ ifr.ifr_name[IFNAMSIZ-1] = '\0'; -+ if (ioctl (sock, SIOCGIFINDEX, &ifr)) -+ log_fatal ("Failed to get interface index: %m"); -+ - /* Bind to the interface name */ - memset (&sa, 0, sizeof sa); -- sa.sa_family = AF_PACKET; -- strncpy (sa.sa_data, (const char *)info -> ifp, sizeof sa.sa_data); -- if (bind (sock, &sa, sizeof sa)) { -+ sa.ll.sll_family = AF_PACKET; -+ sa.ll.sll_ifindex = ifr.ifr_ifindex; -+ if (bind (sock, &sa.common, sizeof sa)) { - if (errno == ENOPROTOOPT || errno == EPROTONOSUPPORT || - errno == ESOCKTNOSUPPORT || errno == EPFNOSUPPORT || - errno == EAFNOSUPPORT || errno == EINVAL) { -@@ -177,9 +201,18 @@ static void lpf_gen_filter_setup (struct - void if_register_receive (info) - struct interface_info *info; - { -+ int val; -+ - /* Open a LPF device and hang it on this interface... */ - info -> rfdesc = if_register_lpf (info); - -+ val = 1; -+ if (setsockopt (info -> rfdesc, SOL_PACKET, PACKET_AUXDATA, &val, -+ sizeof val) < 0) { -+ if (errno != ENOPROTOOPT) -+ log_fatal ("Failed to set auxiliary packet data: %m"); -+ } -+ - #if defined (HAVE_TR_SUPPORT) - if (info -> hw_address.hbuf [0] == HTYPE_IEEE802) - lpf_tr_filter_setup (info); -@@ -301,7 +334,6 @@ ssize_t send_packet (interface, packet, - double hh [16]; - double ih [1536 / sizeof (double)]; - unsigned char *buf = (unsigned char *)ih; -- struct sockaddr_pkt sa; - int result; - int fudge; - -@@ -322,17 +354,7 @@ ssize_t send_packet (interface, packet, - (unsigned char *)raw, len); - memcpy (buf + ibufp, raw, len); - -- /* For some reason, SOCK_PACKET sockets can't be connected, -- so we have to do a sentdo every time. */ -- memset (&sa, 0, sizeof sa); -- sa.spkt_family = AF_PACKET; -- strncpy ((char *)sa.spkt_device, -- (const char *)interface -> ifp, sizeof sa.spkt_device); -- sa.spkt_protocol = htons(ETH_P_IP); -- -- result = sendto (interface -> wfdesc, -- buf + fudge, ibufp + len - fudge, 0, -- (const struct sockaddr *)&sa, sizeof sa); -+ result = write (interface -> wfdesc, buf + fudge, ibufp + len - fudge); - if (result < 0) - log_error ("send_packet: %m"); - return result; -@@ -349,14 +371,35 @@ ssize_t receive_packet (interface, buf, - { - int length = 0; - int offset = 0; -+ int nocsum = 0; - unsigned char ibuf [1536]; - unsigned bufix = 0; - unsigned paylen; -+ unsigned char cmsgbuf[CMSG_LEN(sizeof(struct tpacket_auxdata))]; -+ struct iovec iov = { -+ .iov_base = ibuf, -+ .iov_len = sizeof ibuf, -+ }; -+ struct msghdr msg = { -+ .msg_iov = &iov, -+ .msg_iovlen = 1, -+ .msg_control = cmsgbuf, -+ .msg_controllen = sizeof(cmsgbuf), -+ }; -+ struct cmsghdr *cmsg; - -- length = read (interface -> rfdesc, ibuf, sizeof ibuf); -+ length = recvmsg (interface -> rfdesc, &msg, 0); - if (length <= 0) - return length; - -+ for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg)) { -+ if (cmsg->cmsg_level == SOL_PACKET && -+ cmsg->cmsg_type == PACKET_AUXDATA) { -+ struct tpacket_auxdata *aux = (void *)CMSG_DATA(cmsg); -+ nocsum = aux->tp_status & TP_STATUS_CSUMNOTREADY; -+ } -+ } -+ - bufix = 0; - /* Decode the physical header... */ - offset = decode_hw_header (interface, ibuf, bufix, hfrom); -@@ -373,7 +416,7 @@ ssize_t receive_packet (interface, buf, - - /* Decode the IP and UDP headers... */ - offset = decode_udp_ip_header (interface, ibuf, bufix, from, -- (unsigned)length, &paylen); -+ (unsigned)length, &paylen, nocsum); - - /* If the IP or UDP checksum was bad, skip the packet... */ - if (offset < 0) -diff -up dhcp-4.3.0rc1/common/nit.c.xen dhcp-4.3.0rc1/common/nit.c ---- dhcp-4.3.0rc1/common/nit.c.xen 2014-01-26 19:40:44.000000000 +0100 -+++ dhcp-4.3.0rc1/common/nit.c 2014-01-29 10:03:27.504941651 +0100 -@@ -363,7 +363,7 @@ ssize_t receive_packet (interface, buf, - - /* Decode the IP and UDP headers... */ - offset = decode_udp_ip_header (interface, ibuf, bufix, -- from, length, &paylen); -+ from, length, &paylen, 0); - - /* If the IP or UDP checksum was bad, skip the packet... */ - if (offset < 0) -diff -up dhcp-4.3.0rc1/common/packet.c.xen dhcp-4.3.0rc1/common/packet.c ---- dhcp-4.3.0rc1/common/packet.c.xen 2013-12-11 01:01:02.000000000 +0100 -+++ dhcp-4.3.0rc1/common/packet.c 2014-01-29 10:03:27.504941651 +0100 -@@ -226,7 +226,7 @@ ssize_t - decode_udp_ip_header(struct interface_info *interface, - unsigned char *buf, unsigned bufix, - struct sockaddr_in *from, unsigned buflen, -- unsigned *rbuflen) -+ unsigned *rbuflen, int nocsum) - { - unsigned char *data; - struct ip ip; -@@ -337,7 +337,7 @@ decode_udp_ip_header(struct interface_in - 8, IPPROTO_UDP + ulen)))); - - udp_packets_seen++; -- if (usum && usum != sum) { -+ if (!nocsum && usum && usum != sum) { - udp_packets_bad_checksum++; - if (udp_packets_seen > 4 && - (udp_packets_seen / udp_packets_bad_checksum) < 2) { -diff -up dhcp-4.3.0rc1/common/upf.c.xen dhcp-4.3.0rc1/common/upf.c ---- dhcp-4.3.0rc1/common/upf.c.xen 2014-01-26 19:40:44.000000000 +0100 -+++ dhcp-4.3.0rc1/common/upf.c 2014-01-29 10:03:27.505941638 +0100 -@@ -314,7 +314,7 @@ ssize_t receive_packet (interface, buf, - - /* Decode the IP and UDP headers... */ - offset = decode_udp_ip_header (interface, ibuf, bufix, -- from, length, &paylen); -+ from, length, &paylen, 0); - - /* If the IP or UDP checksum was bad, skip the packet... */ - if (offset < 0) -diff -up dhcp-4.3.0rc1/includes/dhcpd.h.xen dhcp-4.3.0rc1/includes/dhcpd.h ---- dhcp-4.3.0rc1/includes/dhcpd.h.xen 2014-01-29 10:03:27.489941844 +0100 -+++ dhcp-4.3.0rc1/includes/dhcpd.h 2014-01-29 10:03:27.506941626 +0100 -@@ -2861,7 +2861,7 @@ ssize_t decode_hw_header (struct interfa - unsigned, struct hardware *); - ssize_t decode_udp_ip_header (struct interface_info *, unsigned char *, - unsigned, struct sockaddr_in *, -- unsigned, unsigned *); -+ unsigned, unsigned *, int); - - /* ethernet.c */ - void assemble_ethernet_header (struct interface_info *, unsigned char *, -- 2.17.0

2 2

Current 'next' won't build
by Matthias Fischer 30 Apr '18

30 Apr '18

Hi! While testing 'dhcp 4.4.1', current 'next' won't build. While 'building packages' it throws a bunch of errors in '_build_packagaes.log': ***SNIP*** ... # Create configuration mkdir -pv /install/harddisk/boot/grub chroot /install/harddisk grub-mkconfig -o /boot/grub/grub.cfg ERROR: ld.so: object '/tools_i586/lib/libpakfire_preload.so' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored. ERROR: ld.so: object '/tools_i586/lib/libpakfire_preload.so' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored. ... device-mapper: table ioctl on failed: No such device or address ... ERROR: ld.so: object '/tools_i586/lib/libpakfire_preload.so' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored. ... # Install GRUB grub-install --force --recheck --no-floppy --target=i386-pc \ --root-directory=/install/harddisk /dev/loop0 device-mapper: table ioctl on failed: No such device or address device-mapper: table ioctl on failed: No such device or address ... ***SNAP*** It ends with: ***SNIP*** ... # Add padding at the end of the image (to fix alignment issues if the image is # not copied to a block device) dd if=/dev/zero bs=1M count=100 >> /install/images/image.img 100+0 records in 100+0 records out 104857600 bytes (105 MB, 100 MiB) copied, 0.897412 s, 117 MB/s # Compress Image pigz -f9 < /install/images/image.img > /install/images/ipfire-2.19.1gb-ext4-scon.i586-full-core121.img.gz rm -rf /install/images/image.img /install/harddisk mv: cannot stat '/home/matz/ipfire-2.x/build/install/images/*.tgz': No such file or directory mv: cannot stat '/home/matz/ipfire-2.x/build/install/images/*.bz2': No such file or directory Apr 29 11:34:18: Building core-updates + cd /usr/src/lfs + MAKETUNING=-j9 + make -f core-updates LFS_BASEDIR=/usr/src install rm -rf /install/packages/package mkdir -p /install/packages/package eval $(cat /usr/src/config/rootfiles/core/121/meta) #Generate ROOTFILES from filelists BUILD_ARCH=i586 BUILDTARGET=i586-pc-linux-gnu KVER=3.14.79 \ /usr/src/src/scripts/archive.files \ /usr/src/config/rootfiles/core/121/filelists \ /usr/src/config/rootfiles/core/121/files \ /usr/src/config/rootfiles/core/121/files.i586 \ > /tmp/ROOTFILES.tmp #remove excluded files from ROOTFILES grep -f /usr/src/config/rootfiles/core/121/exclude -v /tmp/ROOTFILES.tmp > /tmp/ROOTFILES make: *** [core-updates:60: core/121] Error 1 ... ***SNAP*** Anyone else? Any hints? Best, Matthias

3 7

request for info: unbound via https / tls
by Paul Simmons 30 Apr '18

30 Apr '18

For Core119, I'm currently using a patch to /etc/init.d/unbound: https://gitlab.com/snippets/1706804 because my (only available) ISP mangles port 53 traffic, effectively disabling DNS outside of my private firewall. I wonder if configuring unbound so that forward requests use DNSSEC over HTTPS or TLS would be a better (and more secure) solution? Also see: https://forum.ipfire.org/viewtopic.php?f=27&t=20575#p115342 https://forum.ipfire.org/viewtopic.php?f=50&t=20574 Comments and test configurations are welcome! Paul

2 4

[PATCH] BUG11559: There was no possibillity to select single IpSec subnets (if any) in the firewall creation site. Now the dropdown for IpSec is adapted to reflect the single TARGET subnets.
by Alexander Marx 30 Apr '18

30 Apr '18

Another patch will follow to make these changes in the firewall groups with the language changes ("All subnets" instead of "all") fixes: #11559 --- config/firewall/firewall-lib.pl | 19 +++++++++++++++---- html/cgi-bin/firewall.cgi | 36 +++++++++++++++++++++++++++++++++--- 2 files changed, 48 insertions(+), 7 deletions(-) diff --git a/config/firewall/firewall-lib.pl b/config/firewall/firewall-lib.pl index eabd9a4..668eb9e 100644 --- a/config/firewall/firewall-lib.pl +++ b/config/firewall/firewall-lib.pl @@ -150,6 +150,9 @@ sub get_ipsec_net_ip my $val=shift; my $field=shift; foreach my $key (sort {$a <=> $b} keys %ipsecconf){ + #adapt $val to reflect real name without subnet (if rule with only one ipsec subnet is created) + my @tmpval = split (/\|/, $val); + $val = $tmpval[0]; if($ipsecconf{$key}[1] eq $val){ return $ipsecconf{$key}[$field]; } @@ -390,10 +393,18 @@ sub get_address # IPsec networks. } elsif ($key ~~ ["ipsec_net_src", "ipsec_net_tgt", "IpSec Network"]) { - my $network_address = &get_ipsec_net_ip($value, 11); - my @nets = split(/\|/, $network_address); - foreach my $net (@nets) { - push(@ret, [$net, ""]); + #Check if we have multiple subnets and only want one of them + + if ( $value =~ /\|/ ){ + my @parts = split(/\|/, $value); + push(@ret, [$parts[1], ""]); + + }else{ + my $network_address = &get_ipsec_net_ip($value, 11); + my @nets = split(/\|/, $network_address); + foreach my $net (@nets) { + push(@ret, [$net, ""]); + } } # The firewall's own IP addresses. diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi index face0f4..65e43a1 100644 --- a/html/cgi-bin/firewall.cgi +++ b/html/cgi-bin/firewall.cgi @@ -1161,11 +1161,31 @@ END #IPsec netze foreach my $key (sort { ncmp($ipsecconf{$a}[1],$ipsecconf{$b}[1]) } keys %ipsecconf) { if ($ipsecconf{$key}[3] eq 'net' || ($optionsfw{'SHOWDROPDOWN'} eq 'on' && $ipsecconf{$key}[3] ne 'host')){ - print"<tr><td valign='top'><input type='radio' name='$grp' value='ipsec_net_$srctgt' $checked{$grp}{'ipsec_net_'.$srctgt}></td><td >$Lang::tr{'fwhost ipsec net'}</td><td align='right'><select name='ipsec_net_$srctgt' style='width:200px;'>" if ($show eq ''); + print"<tr><td valign='top'><input type='radio' name='$grp' id='ipsec_net_$srctgt' value='ipsec_net_$srctgt' $checked{$grp}{'ipsec_net_'.$srctgt}></td><td >$Lang::tr{'fwhost ipsec net'}</td><td align='right'><select name='ipsec_net_$srctgt' style='width:200px;'>" if ($show eq ''); $show='1'; + + #Check if we have more than one REMOTE subnet in config + my @arr1 = split /\|/, $ipsecconf{$key}[11]; + my $cnt1 += @arr1; + print "<option "; - print "selected='selected'" if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $ipsecconf{$key}[1]); - print ">$ipsecconf{$key}[1]</option>"; + print "value=$ipsecconf{$key}[1]"; + print " selected " if ($fwdfwsettings{$fwdfwsettings{$grp}} eq "$ipsecconf{$key}[1]"); + print ">$ipsecconf{$key}[1] "; + print "$Lang::tr{'all'}" if $cnt1 > 1; #If this Conenction has more than one subnet, print one option for all subnets + print "</option>"; + + if ($cnt1 > 1){ + foreach my $val (@arr1){ + #normalize subnet to cidr notation + my ($val1,$val2) = split /\//, $val; + my $val3 = &General::iporsubtocidr($val2); + print "<option "; + print "value='$ipsecconf{$key}[1]|$val1/$val3'"; + print "selected " if ($fwdfwsettings{$fwdfwsettings{$grp}} eq "$ipsecconf{$key}[1]|$val1/$val3"); + print ">$ipsecconf{$key}[1] $val1/$val3</option>"; + } + } } } if($optionsfw{'SHOWDROPDOWN'} eq 'on' && $show eq ''){ @@ -2575,6 +2595,11 @@ END #SOURCE my $ipfireiface; &getcolor($$hash{$key}[3],$$hash{$key}[4],\%customhost); + # Check SRC Host and replace "|" with space + if ($$hash{$key}[4] =~ /\|/){ + $$hash{$key}[4] =~ s/\|/ (/g; + $$hash{$key}[4] = $$hash{$key}[4].")"; + } print"<td align='center' width='30%' $tdcolor>"; if ($$hash{$key}[3] eq 'ipfire_src'){ $ipfireiface=$Lang::tr{'fwdfw iface'}; @@ -2640,6 +2665,11 @@ END print<<END; <td align='center' $tdcolor> END + # Check TGT Host and replace "|" with space + if ($$hash{$key}[6] =~ /\|/){ + $$hash{$key}[6] =~ s/\|/ (/g; + $$hash{$key}[6] = $$hash{$key}[6].")"; + } #Is this a DNAT rule? my $natstring; if ($$hash{$key}[31] eq 'dnat' && $$hash{$key}[28] eq 'ON'){ -- 2.7.4

2 1

[PATCH] update nagios_nrpe to 3.2.1
by Peter Müller 30 Apr '18

30 Apr '18

Update NRPE to 3.2.1, which fixes various security vulnerabilities and bugs (changelog is available at: https://github.com/NagiosEnterprises/nrpe/blob/master/CHANGELOG.md). Due to changes in ./configure, some options such as initsystem (sysV) need to be specified now. Also, simple "make" does not exist anymore and must be replaced by "make all". This fixes #11700 and partly addresses #11551. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- lfs/nagios_nrpe | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/lfs/nagios_nrpe b/lfs/nagios_nrpe index 369f9335d..bebb80144 100644 --- a/lfs/nagios_nrpe +++ b/lfs/nagios_nrpe @@ -24,7 +24,7 @@ include Config -VER = 2.12 +VER = 3.2.1 THISAPP = nrpe-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = nagios_nrpe -PAK_VER = 4 +PAK_VER = 5 DEPS = "nagios-plugins" @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = b2d75e2962f1e3151ef58794d60c9e97 +$(DL_FILE)_MD5 = 8997e195fea93cdceb8c7ed8ac1d43bc install : $(TARGET) @@ -80,14 +80,15 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && ./configure \ --prefix=/usr \ --libexecdir=/usr/lib/nagios \ + --sysconfdir=/etc/nagios \ + --with-init-type=sysv \ --with-nrpe-user=nobody \ --with-nrpe-group=nobody \ --with-nagios-user=nobody \ - --with-nagios-group=nobody \ - --enable-command-args \ - ac_cv_lib_wrap_main=no + --with-nagios-group=nobody - cd $(DIR_APP) && make $(MAKETUNING) + cd $(DIR_APP) && make all $(MAKETUNING) cd $(DIR_APP) && make install + cd $(DIR_APP) && make install-config @rm -rf $(DIR_APP) @$(POSTBUILD) -- 2.13.6

2 5

[PATCH] update ca-certificates CA bundle
by Peter Müller 30 Apr '18

30 Apr '18

Update the CA certificates list to what Mozilla NSS ships currently (some Turktrust root CAs have been dropped). The original file can be retrieved from: https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/b… Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- config/ca-certificates/certdata.txt | 467 ------------------------------------ lfs/ca-certificates | 2 +- 2 files changed, 1 insertion(+), 468 deletions(-) diff --git a/config/ca-certificates/certdata.txt b/config/ca-certificates/certdata.txt index 5d2baf3a5..d291f28a5 100644 --- a/config/ca-certificates/certdata.txt +++ b/config/ca-certificates/certdata.txt @@ -7241,163 +7241,6 @@ CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # -# Certificate "TC TrustCenter Class 3 CA II" -# -# Issuer: CN=TC TrustCenter Class 3 CA II,OU=TC TrustCenter Class 3 CA,O=TC TrustCenter GmbH,C=DE -# Serial Number:4a:47:00:01:00:02:e5:a0:5d:d6:3f:00:51:bf -# Subject: CN=TC TrustCenter Class 3 CA II,OU=TC TrustCenter Class 3 CA,O=TC TrustCenter GmbH,C=DE -# Not Valid Before: Thu Jan 12 14:41:57 2006 -# Not Valid After : Wed Dec 31 22:59:59 2025 -# Fingerprint (MD5): 56:5F:AA:80:61:12:17:F6:67:21:E6:2B:6D:61:56:8E -# Fingerprint (SHA1): 80:25:EF:F4:6E:70:C8:D4:72:24:65:84:FE:40:3B:8A:8D:6A:DB:F5 -CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE -CKA_TOKEN CK_BBOOL CK_TRUE -CKA_PRIVATE CK_BBOOL CK_FALSE -CKA_MODIFIABLE CK_BBOOL CK_FALSE -CKA_LABEL UTF8 "TC TrustCenter Class 3 CA II" -CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509 -CKA_SUBJECT MULTILINE_OCTAL -\060\166\061\013\060\011\006\003\125\004\006\023\002\104\105\061 -\034\060\032\006\003\125\004\012\023\023\124\103\040\124\162\165 -\163\164\103\145\156\164\145\162\040\107\155\142\110\061\042\060 -\040\006\003\125\004\013\023\031\124\103\040\124\162\165\163\164 -\103\145\156\164\145\162\040\103\154\141\163\163\040\063\040\103 -\101\061\045\060\043\006\003\125\004\003\023\034\124\103\040\124 -\162\165\163\164\103\145\156\164\145\162\040\103\154\141\163\163 -\040\063\040\103\101\040\111\111 -END -CKA_ID UTF8 "0" -CKA_ISSUER MULTILINE_OCTAL -\060\166\061\013\060\011\006\003\125\004\006\023\002\104\105\061 -\034\060\032\006\003\125\004\012\023\023\124\103\040\124\162\165 -\163\164\103\145\156\164\145\162\040\107\155\142\110\061\042\060 -\040\006\003\125\004\013\023\031\124\103\040\124\162\165\163\164 -\103\145\156\164\145\162\040\103\154\141\163\163\040\063\040\103 -\101\061\045\060\043\006\003\125\004\003\023\034\124\103\040\124 -\162\165\163\164\103\145\156\164\145\162\040\103\154\141\163\163 -\040\063\040\103\101\040\111\111 -END -CKA_SERIAL_NUMBER MULTILINE_OCTAL -\002\016\112\107\000\001\000\002\345\240\135\326\077\000\121\277 -END -CKA_VALUE MULTILINE_OCTAL -\060\202\004\252\060\202\003\222\240\003\002\001\002\002\016\112 -\107\000\001\000\002\345\240\135\326\077\000\121\277\060\015\006 -\011\052\206\110\206\367\015\001\001\005\005\000\060\166\061\013 -\060\011\006\003\125\004\006\023\002\104\105\061\034\060\032\006 -\003\125\004\012\023\023\124\103\040\124\162\165\163\164\103\145 -\156\164\145\162\040\107\155\142\110\061\042\060\040\006\003\125 -\004\013\023\031\124\103\040\124\162\165\163\164\103\145\156\164 -\145\162\040\103\154\141\163\163\040\063\040\103\101\061\045\060 -\043\006\003\125\004\003\023\034\124\103\040\124\162\165\163\164 -\103\145\156\164\145\162\040\103\154\141\163\163\040\063\040\103 -\101\040\111\111\060\036\027\015\060\066\060\061\061\062\061\064 -\064\061\065\067\132\027\015\062\065\061\062\063\061\062\062\065 -\071\065\071\132\060\166\061\013\060\011\006\003\125\004\006\023 -\002\104\105\061\034\060\032\006\003\125\004\012\023\023\124\103 -\040\124\162\165\163\164\103\145\156\164\145\162\040\107\155\142 -\110\061\042\060\040\006\003\125\004\013\023\031\124\103\040\124 -\162\165\163\164\103\145\156\164\145\162\040\103\154\141\163\163 -\040\063\040\103\101\061\045\060\043\006\003\125\004\003\023\034 -\124\103\040\124\162\165\163\164\103\145\156\164\145\162\040\103 -\154\141\163\163\040\063\040\103\101\040\111\111\060\202\001\042 -\060\015\006\011\052\206\110\206\367\015\001\001\001\005\000\003 -\202\001\017\000\060\202\001\012\002\202\001\001\000\264\340\273 -\121\273\071\134\213\004\305\114\171\034\043\206\061\020\143\103 -\125\047\077\306\105\307\244\075\354\011\015\032\036\040\302\126 -\036\336\033\067\007\060\042\057\157\361\006\361\253\255\326\310 -\253\141\243\057\103\304\260\262\055\374\303\226\151\173\176\212 -\344\314\300\071\022\220\102\140\311\314\065\150\356\332\137\220 -\126\137\315\034\115\133\130\111\353\016\001\117\144\372\054\074 -\211\130\330\057\056\342\260\150\351\042\073\165\211\326\104\032 -\145\362\033\227\046\035\050\155\254\350\275\131\035\053\044\366 -\326\204\003\146\210\044\000\170\140\361\370\253\376\002\262\153 -\373\042\373\065\346\026\321\255\366\056\022\344\372\065\152\345 -\031\271\135\333\073\036\032\373\323\377\025\024\010\330\011\152 -\272\105\235\024\171\140\175\257\100\212\007\163\263\223\226\323 -\164\064\215\072\067\051\336\134\354\365\356\056\061\302\040\334 -\276\361\117\177\043\122\331\133\342\144\331\234\252\007\010\265 -\105\275\321\320\061\301\253\124\237\251\322\303\142\140\003\361 -\273\071\112\222\112\075\012\271\235\305\240\376\067\002\003\001 -\000\001\243\202\001\064\060\202\001\060\060\017\006\003\125\035 -\023\001\001\377\004\005\060\003\001\001\377\060\016\006\003\125 -\035\017\001\001\377\004\004\003\002\001\006\060\035\006\003\125 -\035\016\004\026\004\024\324\242\374\237\263\303\330\003\323\127 -\134\007\244\320\044\247\300\362\000\324\060\201\355\006\003\125 -\035\037\004\201\345\060\201\342\060\201\337\240\201\334\240\201 -\331\206\065\150\164\164\160\072\057\057\167\167\167\056\164\162 -\165\163\164\143\145\156\164\145\162\056\144\145\057\143\162\154 -\057\166\062\057\164\143\137\143\154\141\163\163\137\063\137\143 -\141\137\111\111\056\143\162\154\206\201\237\154\144\141\160\072 -\057\057\167\167\167\056\164\162\165\163\164\143\145\156\164\145 -\162\056\144\145\057\103\116\075\124\103\045\062\060\124\162\165 -\163\164\103\145\156\164\145\162\045\062\060\103\154\141\163\163 -\045\062\060\063\045\062\060\103\101\045\062\060\111\111\054\117 -\075\124\103\045\062\060\124\162\165\163\164\103\145\156\164\145 -\162\045\062\060\107\155\142\110\054\117\125\075\162\157\157\164 -\143\145\162\164\163\054\104\103\075\164\162\165\163\164\143\145 -\156\164\145\162\054\104\103\075\144\145\077\143\145\162\164\151 -\146\151\143\141\164\145\122\145\166\157\143\141\164\151\157\156 -\114\151\163\164\077\142\141\163\145\077\060\015\006\011\052\206 -\110\206\367\015\001\001\005\005\000\003\202\001\001\000\066\140 -\344\160\367\006\040\103\331\043\032\102\362\370\243\262\271\115 -\212\264\363\302\232\125\061\174\304\073\147\232\264\337\115\016 -\212\223\112\027\213\033\215\312\211\341\317\072\036\254\035\361 -\234\062\264\216\131\166\242\101\205\045\067\240\023\320\365\174 -\116\325\352\226\342\156\162\301\273\052\376\154\156\370\221\230 -\106\374\311\033\127\133\352\310\032\073\077\260\121\230\074\007 -\332\054\131\001\332\213\104\350\341\164\375\247\150\335\124\272 -\203\106\354\310\106\265\370\257\227\300\073\011\034\217\316\162 -\226\075\063\126\160\274\226\313\330\325\175\040\232\203\237\032 -\334\071\361\305\162\243\021\003\375\073\102\122\051\333\350\001 -\367\233\136\214\326\215\206\116\031\372\274\034\276\305\041\245 -\207\236\170\056\066\333\011\161\243\162\064\370\154\343\006\011 -\362\136\126\245\323\335\230\372\324\346\006\364\360\266\040\143 -\113\352\051\275\252\202\146\036\373\201\252\247\067\255\023\030 -\346\222\303\201\301\063\273\210\036\241\347\342\264\275\061\154 -\016\121\075\157\373\226\126\200\342\066\027\321\334\344 -END -CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE - -# Trust for Certificate "TC TrustCenter Class 3 CA II" -# Issuer: CN=TC TrustCenter Class 3 CA II,OU=TC TrustCenter Class 3 CA,O=TC TrustCenter GmbH,C=DE -# Serial Number:4a:47:00:01:00:02:e5:a0:5d:d6:3f:00:51:bf -# Subject: CN=TC TrustCenter Class 3 CA II,OU=TC TrustCenter Class 3 CA,O=TC TrustCenter GmbH,C=DE -# Not Valid Before: Thu Jan 12 14:41:57 2006 -# Not Valid After : Wed Dec 31 22:59:59 2025 -# Fingerprint (MD5): 56:5F:AA:80:61:12:17:F6:67:21:E6:2B:6D:61:56:8E -# Fingerprint (SHA1): 80:25:EF:F4:6E:70:C8:D4:72:24:65:84:FE:40:3B:8A:8D:6A:DB:F5 -CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST -CKA_TOKEN CK_BBOOL CK_TRUE -CKA_PRIVATE CK_BBOOL CK_FALSE -CKA_MODIFIABLE CK_BBOOL CK_FALSE -CKA_LABEL UTF8 "TC TrustCenter Class 3 CA II" -CKA_CERT_SHA1_HASH MULTILINE_OCTAL -\200\045\357\364\156\160\310\324\162\044\145\204\376\100\073\212 -\215\152\333\365 -END -CKA_CERT_MD5_HASH MULTILINE_OCTAL -\126\137\252\200\141\022\027\366\147\041\346\053\155\141\126\216 -END -CKA_ISSUER MULTILINE_OCTAL -\060\166\061\013\060\011\006\003\125\004\006\023\002\104\105\061 -\034\060\032\006\003\125\004\012\023\023\124\103\040\124\162\165 -\163\164\103\145\156\164\145\162\040\107\155\142\110\061\042\060 -\040\006\003\125\004\013\023\031\124\103\040\124\162\165\163\164 -\103\145\156\164\145\162\040\103\154\141\163\163\040\063\040\103 -\101\061\045\060\043\006\003\125\004\003\023\034\124\103\040\124 -\162\165\163\164\103\145\156\164\145\162\040\103\154\141\163\163 -\040\063\040\103\101\040\111\111 -END -CKA_SERIAL_NUMBER MULTILINE_OCTAL -\002\016\112\107\000\001\000\002\345\240\135\326\077\000\121\277 -END -CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST -CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR -CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST -CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE - -# # Certificate "Deutsche Telekom Root CA 2" # # Issuer: CN=Deutsche Telekom Root CA 2,OU=T-TeleSec Trust Center,O=Deutsche Telekom AG,C=DE @@ -17883,155 +17726,6 @@ CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # -# Certificate "S-TRUST Universal Root CA" -# -# Issuer: CN=S-TRUST Universal Root CA,OU=S-TRUST Certification Services,O=Deutscher Sparkassen Verlag GmbH,C=DE -# Serial Number:60:56:c5:4b:23:40:5b:64:d4:ed:25:da:d9:d6:1e:1e -# Subject: CN=S-TRUST Universal Root CA,OU=S-TRUST Certification Services,O=Deutscher Sparkassen Verlag GmbH,C=DE -# Not Valid Before: Tue Oct 22 00:00:00 2013 -# Not Valid After : Thu Oct 21 23:59:59 2038 -# Fingerprint (SHA-256): D8:0F:EF:91:0A:E3:F1:04:72:3B:04:5C:EC:2D:01:9F:44:1C:E6:21:3A:DF:15:67:91:E7:0C:17:90:11:0A:31 -# Fingerprint (SHA1): 1B:3D:11:14:EA:7A:0F:95:58:54:41:95:BF:6B:25:82:AB:40:CE:9A -CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE -CKA_TOKEN CK_BBOOL CK_TRUE -CKA_PRIVATE CK_BBOOL CK_FALSE -CKA_MODIFIABLE CK_BBOOL CK_FALSE -CKA_LABEL UTF8 "S-TRUST Universal Root CA" -CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509 -CKA_SUBJECT MULTILINE_OCTAL -\060\201\205\061\013\060\011\006\003\125\004\006\023\002\104\105 -\061\051\060\047\006\003\125\004\012\023\040\104\145\165\164\163 -\143\150\145\162\040\123\160\141\162\153\141\163\163\145\156\040 -\126\145\162\154\141\147\040\107\155\142\110\061\047\060\045\006 -\003\125\004\013\023\036\123\055\124\122\125\123\124\040\103\145 -\162\164\151\146\151\143\141\164\151\157\156\040\123\145\162\166 -\151\143\145\163\061\042\060\040\006\003\125\004\003\023\031\123 -\055\124\122\125\123\124\040\125\156\151\166\145\162\163\141\154 -\040\122\157\157\164\040\103\101 -END -CKA_ID UTF8 "0" -CKA_ISSUER MULTILINE_OCTAL -\060\201\205\061\013\060\011\006\003\125\004\006\023\002\104\105 -\061\051\060\047\006\003\125\004\012\023\040\104\145\165\164\163 -\143\150\145\162\040\123\160\141\162\153\141\163\163\145\156\040 -\126\145\162\154\141\147\040\107\155\142\110\061\047\060\045\006 -\003\125\004\013\023\036\123\055\124\122\125\123\124\040\103\145 -\162\164\151\146\151\143\141\164\151\157\156\040\123\145\162\166 -\151\143\145\163\061\042\060\040\006\003\125\004\003\023\031\123 -\055\124\122\125\123\124\040\125\156\151\166\145\162\163\141\154 -\040\122\157\157\164\040\103\101 -END -CKA_SERIAL_NUMBER MULTILINE_OCTAL -\002\020\140\126\305\113\043\100\133\144\324\355\045\332\331\326 -\036\036 -END -CKA_VALUE MULTILINE_OCTAL -\060\202\003\330\060\202\002\300\240\003\002\001\002\002\020\140 -\126\305\113\043\100\133\144\324\355\045\332\331\326\036\036\060 -\015\006\011\052\206\110\206\367\015\001\001\013\005\000\060\201 -\205\061\013\060\011\006\003\125\004\006\023\002\104\105\061\051 -\060\047\006\003\125\004\012\023\040\104\145\165\164\163\143\150 -\145\162\040\123\160\141\162\153\141\163\163\145\156\040\126\145 -\162\154\141\147\040\107\155\142\110\061\047\060\045\006\003\125 -\004\013\023\036\123\055\124\122\125\123\124\040\103\145\162\164 -\151\146\151\143\141\164\151\157\156\040\123\145\162\166\151\143 -\145\163\061\042\060\040\006\003\125\004\003\023\031\123\055\124 -\122\125\123\124\040\125\156\151\166\145\162\163\141\154\040\122 -\157\157\164\040\103\101\060\036\027\015\061\063\061\060\062\062 -\060\060\060\060\060\060\132\027\015\063\070\061\060\062\061\062 -\063\065\071\065\071\132\060\201\205\061\013\060\011\006\003\125 -\004\006\023\002\104\105\061\051\060\047\006\003\125\004\012\023 -\040\104\145\165\164\163\143\150\145\162\040\123\160\141\162\153 -\141\163\163\145\156\040\126\145\162\154\141\147\040\107\155\142 -\110\061\047\060\045\006\003\125\004\013\023\036\123\055\124\122 -\125\123\124\040\103\145\162\164\151\146\151\143\141\164\151\157 -\156\040\123\145\162\166\151\143\145\163\061\042\060\040\006\003 -\125\004\003\023\031\123\055\124\122\125\123\124\040\125\156\151 -\166\145\162\163\141\154\040\122\157\157\164\040\103\101\060\202 -\001\042\060\015\006\011\052\206\110\206\367\015\001\001\001\005 -\000\003\202\001\017\000\060\202\001\012\002\202\001\001\000\250 -\343\013\337\021\067\205\202\232\265\154\146\174\141\077\300\107 -\032\035\106\343\260\125\144\345\270\202\071\050\007\176\027\377 -\364\233\212\360\221\201\352\070\077\041\170\154\110\354\153\057 -\242\323\212\162\262\247\327\331\352\177\264\300\111\153\060\045 -\211\214\353\267\325\100\141\230\342\334\074\040\222\315\145\112 -\162\237\032\216\214\372\045\025\277\363\041\203\050\015\213\257 -\131\021\202\103\134\233\115\045\121\177\130\030\143\140\073\263 -\265\212\213\130\143\067\110\110\220\104\302\100\335\135\367\103 -\151\051\230\134\022\145\136\253\220\222\113\146\337\325\165\022 -\123\124\030\246\336\212\326\273\127\003\071\131\231\030\005\014 -\371\375\025\306\220\144\106\027\202\327\302\112\101\075\375\000 -\276\127\162\030\224\167\033\123\132\211\001\366\063\162\016\223 -\072\334\350\036\375\005\005\326\274\163\340\210\334\253\117\354 -\265\030\206\117\171\204\016\110\052\146\052\335\062\310\170\145 -\310\013\235\130\001\005\161\355\201\365\150\027\156\313\015\264 -\113\330\241\354\256\070\353\034\130\057\241\145\003\064\057\002 -\003\001\000\001\243\102\060\100\060\017\006\003\125\035\023\001 -\001\377\004\005\060\003\001\001\377\060\016\006\003\125\035\017 -\001\001\377\004\004\003\002\001\006\060\035\006\003\125\035\016 -\004\026\004\024\232\175\327\353\353\177\124\230\105\051\264\040 -\253\155\013\226\043\031\244\302\060\015\006\011\052\206\110\206 -\367\015\001\001\013\005\000\003\202\001\001\000\116\226\022\333 -\176\167\136\222\047\236\041\027\030\202\166\330\077\274\245\011 -\004\146\210\211\255\333\125\263\063\152\306\145\304\217\115\363 -\062\066\334\171\004\226\251\167\062\321\227\365\030\153\214\272 -\355\316\021\320\104\307\222\361\264\104\216\355\210\122\110\236 -\325\375\131\370\243\036\121\373\001\122\345\137\345\172\335\252 -\044\117\042\213\335\166\106\366\245\240\017\065\330\312\017\230 -\271\060\135\040\157\302\201\036\275\275\300\376\025\323\070\052 -\011\223\230\047\033\223\173\320\053\064\136\150\245\025\117\321 -\122\303\240\312\240\203\105\035\365\365\267\131\163\135\131\001 -\217\252\302\107\057\024\161\325\051\343\020\265\107\223\045\314 -\043\051\332\267\162\330\221\324\354\033\110\212\042\344\301\052 -\367\072\150\223\237\105\031\156\103\267\314\376\270\221\232\141 -\032\066\151\143\144\222\050\363\157\141\222\205\023\237\311\007 -\054\213\127\334\353\236\171\325\302\336\010\325\124\262\127\116 -\052\062\215\241\342\072\321\020\040\042\071\175\064\105\157\161 -\073\303\035\374\377\262\117\250\342\366\060\036 -END -CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE - -# Trust for "S-TRUST Universal Root CA" -# Issuer: CN=S-TRUST Universal Root CA,OU=S-TRUST Certification Services,O=Deutscher Sparkassen Verlag GmbH,C=DE -# Serial Number:60:56:c5:4b:23:40:5b:64:d4:ed:25:da:d9:d6:1e:1e -# Subject: CN=S-TRUST Universal Root CA,OU=S-TRUST Certification Services,O=Deutscher Sparkassen Verlag GmbH,C=DE -# Not Valid Before: Tue Oct 22 00:00:00 2013 -# Not Valid After : Thu Oct 21 23:59:59 2038 -# Fingerprint (SHA-256): D8:0F:EF:91:0A:E3:F1:04:72:3B:04:5C:EC:2D:01:9F:44:1C:E6:21:3A:DF:15:67:91:E7:0C:17:90:11:0A:31 -# Fingerprint (SHA1): 1B:3D:11:14:EA:7A:0F:95:58:54:41:95:BF:6B:25:82:AB:40:CE:9A -CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST -CKA_TOKEN CK_BBOOL CK_TRUE -CKA_PRIVATE CK_BBOOL CK_FALSE -CKA_MODIFIABLE CK_BBOOL CK_FALSE -CKA_LABEL UTF8 "S-TRUST Universal Root CA" -CKA_CERT_SHA1_HASH MULTILINE_OCTAL -\033\075\021\024\352\172\017\225\130\124\101\225\277\153\045\202 -\253\100\316\232 -END -CKA_CERT_MD5_HASH MULTILINE_OCTAL -\130\366\101\001\256\365\133\121\231\116\134\041\350\117\324\146 -END -CKA_ISSUER MULTILINE_OCTAL -\060\201\205\061\013\060\011\006\003\125\004\006\023\002\104\105 -\061\051\060\047\006\003\125\004\012\023\040\104\145\165\164\163 -\143\150\145\162\040\123\160\141\162\153\141\163\163\145\156\040 -\126\145\162\154\141\147\040\107\155\142\110\061\047\060\045\006 -\003\125\004\013\023\036\123\055\124\122\125\123\124\040\103\145 -\162\164\151\146\151\143\141\164\151\157\156\040\123\145\162\166 -\151\143\145\163\061\042\060\040\006\003\125\004\003\023\031\123 -\055\124\122\125\123\124\040\125\156\151\166\145\162\163\141\154 -\040\122\157\157\164\040\103\101 -END -CKA_SERIAL_NUMBER MULTILINE_OCTAL -\002\020\140\126\305\113\043\100\133\144\324\355\045\332\331\326 -\036\036 -END -CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST -CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR -CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST -CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE - -# # Certificate "Entrust Root Certification Authority - G2" # # Issuer: CN=Entrust Root Certification Authority - G2,OU="(c) 2009 Entrust, Inc. - for authorized use only",OU=See www.entrust.net/legal-terms,O="Entrust, Inc.",C=US @@ -18509,167 +18203,6 @@ CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # -# Certificate "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı H5" -# -# Issuer: CN=T..RKTRUST Elektronik Sertifika Hizmet Sa..lay..c..s.. H5,O=T..RKTRUST Bilgi ..leti..im ve Bili..im G..venli..i Hizmetleri A....,L=Ankara,C=TR -# Serial Number:00:8e:17:fe:24:20:81 -# Subject: CN=T..RKTRUST Elektronik Sertifika Hizmet Sa..lay..c..s.. H5,O=T..RKTRUST Bilgi ..leti..im ve Bili..im G..venli..i Hizmetleri A....,L=Ankara,C=TR -# Not Valid Before: Tue Apr 30 08:07:01 2013 -# Not Valid After : Fri Apr 28 08:07:01 2023 -# Fingerprint (SHA-256): 49:35:1B:90:34:44:C1:85:CC:DC:5C:69:3D:24:D8:55:5C:B2:08:D6:A8:14:13:07:69:9F:4A:F0:63:19:9D:78 -# Fingerprint (SHA1): C4:18:F6:4D:46:D1:DF:00:3D:27:30:13:72:43:A9:12:11:C6:75:FB -CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE -CKA_TOKEN CK_BBOOL CK_TRUE -CKA_PRIVATE CK_BBOOL CK_FALSE -CKA_MODIFIABLE CK_BBOOL CK_FALSE -CKA_LABEL UTF8 "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı H5" -CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509 -CKA_SUBJECT MULTILINE_OCTAL -\060\201\261\061\013\060\011\006\003\125\004\006\023\002\124\122 -\061\017\060\015\006\003\125\004\007\014\006\101\156\153\141\162 -\141\061\115\060\113\006\003\125\004\012\014\104\124\303\234\122 -\113\124\122\125\123\124\040\102\151\154\147\151\040\304\260\154 -\145\164\151\305\237\151\155\040\166\145\040\102\151\154\151\305 -\237\151\155\040\107\303\274\166\145\156\154\151\304\237\151\040 -\110\151\172\155\145\164\154\145\162\151\040\101\056\305\236\056 -\061\102\060\100\006\003\125\004\003\014\071\124\303\234\122\113 -\124\122\125\123\124\040\105\154\145\153\164\162\157\156\151\153 -\040\123\145\162\164\151\146\151\153\141\040\110\151\172\155\145 -\164\040\123\141\304\237\154\141\171\304\261\143\304\261\163\304 -\261\040\110\065 -END -CKA_ID UTF8 "0" -CKA_ISSUER MULTILINE_OCTAL -\060\201\261\061\013\060\011\006\003\125\004\006\023\002\124\122 -\061\017\060\015\006\003\125\004\007\014\006\101\156\153\141\162 -\141\061\115\060\113\006\003\125\004\012\014\104\124\303\234\122 -\113\124\122\125\123\124\040\102\151\154\147\151\040\304\260\154 -\145\164\151\305\237\151\155\040\166\145\040\102\151\154\151\305 -\237\151\155\040\107\303\274\166\145\156\154\151\304\237\151\040 -\110\151\172\155\145\164\154\145\162\151\040\101\056\305\236\056 -\061\102\060\100\006\003\125\004\003\014\071\124\303\234\122\113 -\124\122\125\123\124\040\105\154\145\153\164\162\157\156\151\153 -\040\123\145\162\164\151\146\151\153\141\040\110\151\172\155\145 -\164\040\123\141\304\237\154\141\171\304\261\143\304\261\163\304 -\261\040\110\065 -END -CKA_SERIAL_NUMBER MULTILINE_OCTAL -\002\007\000\216\027\376\044\040\201 -END -CKA_VALUE MULTILINE_OCTAL -\060\202\004\047\060\202\003\017\240\003\002\001\002\002\007\000 -\216\027\376\044\040\201\060\015\006\011\052\206\110\206\367\015 -\001\001\013\005\000\060\201\261\061\013\060\011\006\003\125\004 -\006\023\002\124\122\061\017\060\015\006\003\125\004\007\014\006 -\101\156\153\141\162\141\061\115\060\113\006\003\125\004\012\014 -\104\124\303\234\122\113\124\122\125\123\124\040\102\151\154\147 -\151\040\304\260\154\145\164\151\305\237\151\155\040\166\145\040 -\102\151\154\151\305\237\151\155\040\107\303\274\166\145\156\154 -\151\304\237\151\040\110\151\172\155\145\164\154\145\162\151\040 -\101\056\305\236\056\061\102\060\100\006\003\125\004\003\014\071 -\124\303\234\122\113\124\122\125\123\124\040\105\154\145\153\164 -\162\157\156\151\153\040\123\145\162\164\151\146\151\153\141\040 -\110\151\172\155\145\164\040\123\141\304\237\154\141\171\304\261 -\143\304\261\163\304\261\040\110\065\060\036\027\015\061\063\060 -\064\063\060\060\070\060\067\060\061\132\027\015\062\063\060\064 -\062\070\060\070\060\067\060\061\132\060\201\261\061\013\060\011 -\006\003\125\004\006\023\002\124\122\061\017\060\015\006\003\125 -\004\007\014\006\101\156\153\141\162\141\061\115\060\113\006\003 -\125\004\012\014\104\124\303\234\122\113\124\122\125\123\124\040 -\102\151\154\147\151\040\304\260\154\145\164\151\305\237\151\155 -\040\166\145\040\102\151\154\151\305\237\151\155\040\107\303\274 -\166\145\156\154\151\304\237\151\040\110\151\172\155\145\164\154 -\145\162\151\040\101\056\305\236\056\061\102\060\100\006\003\125 -\004\003\014\071\124\303\234\122\113\124\122\125\123\124\040\105 -\154\145\153\164\162\157\156\151\153\040\123\145\162\164\151\146 -\151\153\141\040\110\151\172\155\145\164\040\123\141\304\237\154 -\141\171\304\261\143\304\261\163\304\261\040\110\065\060\202\001 -\042\060\015\006\011\052\206\110\206\367\015\001\001\001\005\000 -\003\202\001\017\000\060\202\001\012\002\202\001\001\000\244\045 -\031\341\145\236\353\110\041\120\112\010\345\021\360\132\272\046 -\377\203\131\316\104\052\057\376\341\316\140\003\374\215\003\245 -\355\377\153\250\272\314\064\006\237\131\065\366\354\054\273\235 -\373\215\122\151\343\234\047\020\123\363\244\002\305\247\371\021 -\032\151\165\156\303\035\213\321\230\215\223\207\247\161\227\015 -\041\307\231\371\122\323\054\143\135\125\274\350\037\001\110\271 -\140\376\102\112\366\310\200\256\315\146\172\236\105\212\150\167 -\342\110\150\237\242\332\361\341\301\020\237\353\074\051\201\247 -\341\062\010\324\240\005\261\214\373\215\226\000\016\076\045\337 -\123\206\042\073\374\364\275\363\011\176\167\354\206\353\017\063 -\345\103\117\364\124\165\155\051\231\056\146\132\103\337\313\134 -\312\310\345\070\361\176\073\065\235\017\364\305\132\241\314\363 -\040\200\044\323\127\354\025\272\165\045\233\350\144\113\263\064 -\204\357\004\270\366\311\154\252\002\076\266\125\342\062\067\137 -\374\146\227\137\315\326\236\307\040\277\115\306\254\077\165\137 -\034\355\062\234\174\151\000\151\221\343\043\030\123\351\002\003 -\001\000\001\243\102\060\100\060\035\006\003\125\035\016\004\026 -\004\024\126\231\007\036\323\254\014\151\144\264\014\120\107\336 -\103\054\276\040\300\373\060\016\006\003\125\035\017\001\001\377 -\004\004\003\002\001\006\060\017\006\003\125\035\023\001\001\377 -\004\005\060\003\001\001\377\060\015\006\011\052\206\110\206\367 -\015\001\001\013\005\000\003\202\001\001\000\236\105\166\173\027 -\110\062\362\070\213\051\275\356\226\112\116\201\030\261\121\107 -\040\315\320\144\261\016\311\331\001\331\011\316\310\231\334\150 -\045\023\324\134\362\243\350\004\376\162\011\307\013\252\035\045 -\125\176\226\232\127\267\272\305\021\172\031\346\247\176\075\205 -\016\365\371\056\051\057\347\371\154\130\026\127\120\045\366\076 -\056\076\252\355\167\161\252\252\231\226\106\012\256\216\354\052 -\121\026\260\136\315\352\147\004\034\130\060\365\140\212\275\246 -\275\115\345\226\264\374\102\211\001\153\366\160\310\120\071\014 -\055\325\146\331\310\322\263\062\267\033\031\155\313\063\371\337 -\245\346\025\204\067\360\302\362\145\226\222\220\167\360\255\364 -\220\351\021\170\327\223\211\300\075\013\272\051\364\350\231\235 -\162\216\355\235\057\356\222\175\241\361\377\135\272\063\140\205 -\142\376\007\002\241\204\126\106\276\226\012\232\023\327\041\114 -\267\174\007\237\116\116\077\221\164\373\047\235\021\314\335\346 -\261\312\161\115\023\027\071\046\305\051\041\053\223\051\152\226 -\372\253\101\341\113\266\065\013\300\233\025 -END -CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE - -# Trust for "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı H5" -# Issuer: CN=T..RKTRUST Elektronik Sertifika Hizmet Sa..lay..c..s.. H5,O=T..RKTRUST Bilgi ..leti..im ve Bili..im G..venli..i Hizmetleri A....,L=Ankara,C=TR -# Serial Number:00:8e:17:fe:24:20:81 -# Subject: CN=T..RKTRUST Elektronik Sertifika Hizmet Sa..lay..c..s.. H5,O=T..RKTRUST Bilgi ..leti..im ve Bili..im G..venli..i Hizmetleri A....,L=Ankara,C=TR -# Not Valid Before: Tue Apr 30 08:07:01 2013 -# Not Valid After : Fri Apr 28 08:07:01 2023 -# Fingerprint (SHA-256): 49:35:1B:90:34:44:C1:85:CC:DC:5C:69:3D:24:D8:55:5C:B2:08:D6:A8:14:13:07:69:9F:4A:F0:63:19:9D:78 -# Fingerprint (SHA1): C4:18:F6:4D:46:D1:DF:00:3D:27:30:13:72:43:A9:12:11:C6:75:FB -CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST -CKA_TOKEN CK_BBOOL CK_TRUE -CKA_PRIVATE CK_BBOOL CK_FALSE -CKA_MODIFIABLE CK_BBOOL CK_FALSE -CKA_LABEL UTF8 "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı H5" -CKA_CERT_SHA1_HASH MULTILINE_OCTAL -\304\030\366\115\106\321\337\000\075\047\060\023\162\103\251\022 -\021\306\165\373 -END -CKA_CERT_MD5_HASH MULTILINE_OCTAL -\332\160\216\360\042\337\223\046\366\137\237\323\025\006\122\116 -END -CKA_ISSUER MULTILINE_OCTAL -\060\201\261\061\013\060\011\006\003\125\004\006\023\002\124\122 -\061\017\060\015\006\003\125\004\007\014\006\101\156\153\141\162 -\141\061\115\060\113\006\003\125\004\012\014\104\124\303\234\122 -\113\124\122\125\123\124\040\102\151\154\147\151\040\304\260\154 -\145\164\151\305\237\151\155\040\166\145\040\102\151\154\151\305 -\237\151\155\040\107\303\274\166\145\156\154\151\304\237\151\040 -\110\151\172\155\145\164\154\145\162\151\040\101\056\305\236\056 -\061\102\060\100\006\003\125\004\003\014\071\124\303\234\122\113 -\124\122\125\123\124\040\105\154\145\153\164\162\157\156\151\153 -\040\123\145\162\164\151\146\151\153\141\040\110\151\172\155\145 -\164\040\123\141\304\237\154\141\171\304\261\143\304\261\163\304 -\261\040\110\065 -END -CKA_SERIAL_NUMBER MULTILINE_OCTAL -\002\007\000\216\027\376\044\040\201 -END -CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR -CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST -CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST -CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE - -# # Certificate "Certinomis - Root CA" # # Issuer: CN=Certinomis - Root CA,OU=0002 433998903,O=Certinomis,C=FR diff --git a/lfs/ca-certificates b/lfs/ca-certificates index 008e588cc..8b6f71fef 100644 --- a/lfs/ca-certificates +++ b/lfs/ca-certificates @@ -24,7 +24,7 @@ include Config -VER = 20180117 +VER = 20180429 THISAPP = ca-certificates DIR_APP = $(DIR_SRC)/$(THISAPP) -- 2.13.6

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development April 2018