[git.ipfire.org] IPFire 2.x development tree tag, v2.17-core88, created. 5f56308fb3f6cf68843f2adeb07c3d44fcb76c4b
by gitï¼ ipfire.org 19 Mar '15
by gitï¼ ipfire.org 19 Mar '15
19 Mar '15
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The tag, v2.17-core88 has been created
at 5f56308fb3f6cf68843f2adeb07c3d44fcb76c4b (commit)
- Log -----------------------------------------------------------------
commit 5f56308fb3f6cf68843f2adeb07c3d44fcb76c4b
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Thu Mar 19 16:03:58 2015 +0100
openssl: Remove "fix parallel build" patch
-----------------------------------------------------------------------
hooks/post-receive
--
IPFire 2.x development tree
1
0
[git.ipfire.org] IPFire 2.x development tree branch, core88, created. 5f56308fb3f6cf68843f2adeb07c3d44fcb76c4b
by gitï¼ ipfire.org 19 Mar '15
by gitï¼ ipfire.org 19 Mar '15
19 Mar '15
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, core88 has been created
at 5f56308fb3f6cf68843f2adeb07c3d44fcb76c4b (commit)
- Log -----------------------------------------------------------------
commit 5f56308fb3f6cf68843f2adeb07c3d44fcb76c4b
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Thu Mar 19 16:03:58 2015 +0100
openssl: Remove "fix parallel build" patch
commit 37cac8501e3e8f5076f9d036cd22275f5c4d26da
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Thu Mar 19 15:54:43 2015 +0100
openssl: Update weak-ciphers and build patches
Conflicts:
lfs/openssl
lfs/openssl-compat
commit 7534584701c6ee4d031490e1cbebff3648e00884
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Thu Mar 19 15:47:13 2015 +0100
openssl: Remove support for cryptodev
The patches won't apply any more and there does not seem
support from upstream for the latest versions of OpenSSL
Conflicts:
lfs/openssl-compat
commit a86a7854866eecf84755b87420b95c263eb78991
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Thu Mar 19 15:13:07 2015 +0100
openssl: Update to version 1.0.1m and 0.9.8zf
http://openssl.org/news/secadv_20150319.txt
OpenSSL Security Advisory [19 Mar 2015]
=======================================
OpenSSL 1.0.2 ClientHello sigalgs DoS (CVE-2015-0291)
=====================================================
Severity: High
If a client connects to an OpenSSL 1.0.2 server and renegotiates with an
invalid signature algorithms extension a NULL pointer dereference will occur.
This can be exploited in a DoS attack against the server.
This issue affects OpenSSL version: 1.0.2
OpenSSL 1.0.2 users should upgrade to 1.0.2a.
This issue was was reported to OpenSSL on 26th February 2015 by David Ramos
of Stanford University. The fix was developed by Stephen Henson and Matt
Caswell of the OpenSSL development team.
Reclassified: RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204)
============================================================================
Severity: High
This security issue was previously announced by the OpenSSL project and
classified as "low" severity. This severity rating has now been changed to
"high".
This was classified low because it was originally thought that server RSA
export ciphersuite support was rare: a client was only vulnerable to a MITM
attack against a server which supports an RSA export ciphersuite. Recent
studies have shown that RSA export ciphersuites support is far more common.
This issue affects OpenSSL versions: 1.0.1, 1.0.0 and 0.9.8.
OpenSSL 1.0.1 users should upgrade to 1.0.1k.
OpenSSL 1.0.0 users should upgrade to 1.0.0p.
OpenSSL 0.9.8 users should upgrade to 0.9.8zd.
This issue was reported to OpenSSL on 22nd October 2014 by Karthikeyan
Bhargavan of the PROSECCO team at INRIA. The fix was developed by Stephen
Henson of the OpenSSL core team. It was previously announced in the OpenSSL
security advisory on 8th January 2015.
Multiblock corrupted pointer (CVE-2015-0290)
============================================
Severity: Moderate
OpenSSL 1.0.2 introduced the "multiblock" performance improvement. This feature
only applies on 64 bit x86 architecture platforms that support AES NI
instructions. A defect in the implementation of "multiblock" can cause OpenSSL's
internal write buffer to become incorrectly set to NULL when using non-blocking
IO. Typically, when the user application is using a socket BIO for writing, this
will only result in a failed connection. However if some other BIO is used then
it is likely that a segmentation fault will be triggered, thus enabling a
potential DoS attack.
This issue affects OpenSSL version: 1.0.2
OpenSSL 1.0.2 users should upgrade to 1.0.2a.
This issue was reported to OpenSSL on 13th February 2015 by Daniel Danner and
Rainer Mueller. The fix was developed by Matt Caswell of the OpenSSL development
team.
Segmentation fault in DTLSv1_listen (CVE-2015-0207)
===================================================
Severity: Moderate
The DTLSv1_listen function is intended to be stateless and processes the initial
ClientHello from many peers. It is common for user code to loop over the call to
DTLSv1_listen until a valid ClientHello is received with an associated cookie. A
defect in the implementation of DTLSv1_listen means that state is preserved in
the SSL object from one invocation to the next that can lead to a segmentation
fault. Errors processing the initial ClientHello can trigger this scenario. An
example of such an error could be that a DTLS1.0 only client is attempting to
connect to a DTLS1.2 only server.
This issue affects OpenSSL version: 1.0.2
OpenSSL 1.0.2 DTLS users should upgrade to 1.0.2a.
This issue was reported to OpenSSL on 27th January 2015 by Per Allansson. The
fix was developed by Matt Caswell of the OpenSSL development team.
Segmentation fault in ASN1_TYPE_cmp (CVE-2015-0286)
===================================================
Severity: Moderate
The function ASN1_TYPE_cmp will crash with an invalid read if an attempt is
made to compare ASN.1 boolean types. Since ASN1_TYPE_cmp is used to check
certificate signature algorithm consistency this can be used to crash any
certificate verification operation and exploited in a DoS attack. Any
application which performs certificate verification is vulnerable including
OpenSSL clients and servers which enable client authentication.
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8.
OpenSSL 1.0.2 users should upgrade to 1.0.2a
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
This issue was discovered and fixed by Stephen Henson of the OpenSSL
development team.
Segmentation fault for invalid PSS parameters (CVE-2015-0208)
=============================================================
Severity: Moderate
The signature verification routines will crash with a NULL pointer
dereference if presented with an ASN.1 signature using the RSA PSS
algorithm and invalid parameters. Since these routines are used to verify
certificate signature algorithms this can be used to crash any
certificate verification operation and exploited in a DoS attack. Any
application which performs certificate verification is vulnerable including
OpenSSL clients and servers which enable client authentication.
This issue affects OpenSSL version: 1.0.2
OpenSSL 1.0.2 users should upgrade to 1.0.2a
This issue was was reported to OpenSSL on 31st January 2015 by Brian Carpenter
and a fix developed by Stephen Henson of the OpenSSL development team.
ASN.1 structure reuse memory corruption (CVE-2015-0287)
=======================================================
Severity: Moderate
Reusing a structure in ASN.1 parsing may allow an attacker to cause
memory corruption via an invalid write. Such reuse is and has been
strongly discouraged and is believed to be rare.
Applications that parse structures containing CHOICE or ANY DEFINED BY
components may be affected. Certificate parsing (d2i_X509 and related
functions) are however not affected. OpenSSL clients and servers are
not affected.
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0
and 0.9.8.
OpenSSL 1.0.2 users should upgrade to 1.0.2a
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
This issue was discovered by Emilia Käsper and a fix developed by
Stephen Henson of the OpenSSL development team.
PKCS7 NULL pointer dereferences (CVE-2015-0289)
===============================================
Severity: Moderate
The PKCS#7 parsing code does not handle missing outer ContentInfo correctly.
An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with
missing content and trigger a NULL pointer dereference on parsing.
Applications that verify PKCS#7 signatures, decrypt PKCS#7 data or
otherwise parse PKCS#7 structures from untrusted sources are
affected. OpenSSL clients and servers are not affected.
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0
and 0.9.8.
OpenSSL 1.0.2 users should upgrade to 1.0.2a
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
This issue was reported to OpenSSL on February 16th 2015 by Michal
Zalewski (Google) and a fix developed by Emilia Käsper of the OpenSSL
development team.
Base64 decode (CVE-2015-0292)
=============================
Severity: Moderate
A vulnerability existed in previous versions of OpenSSL related to the
processing of base64 encoded data. Any code path that reads base64 data from an
untrusted source could be affected (such as the PEM processing routines).
Maliciously crafted base 64 data could trigger a segmenation fault or memory
corruption. This was addressed in previous versions of OpenSSL but has not been
included in any security advisory until now.
This issue affects OpenSSL versions: 1.0.1, 1.0.0 and 0.9.8.
OpenSSL 1.0.1 users should upgrade to 1.0.1h.
OpenSSL 1.0.0 users should upgrade to 1.0.0m.
OpenSSL 0.9.8 users should upgrade to 0.9.8za.
The fix for this issue can be identified by commits d0666f289a (1.0.1),
84fe686173 (1.0.0) and 9febee0272 (0.9.8). This issue was originally reported by
Robert Dugal and subsequently by David Ramos.
DoS via reachable assert in SSLv2 servers (CVE-2015-0293)
=========================================================
Severity: Moderate
A malicious client can trigger an OPENSSL_assert (i.e., an abort) in
servers that both support SSLv2 and enable export cipher suites by sending
a specially crafted SSLv2 CLIENT-MASTER-KEY message.
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0
and 0.9.8.
OpenSSL 1.0.2 users should upgrade to 1.0.2a
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
This issue was discovered by Sean Burford (Google) and Emilia Käsper
(OpenSSL development team) in March 2015 and the fix was developed by
Emilia Käsper.
Empty CKE with client auth and DHE (CVE-2015-1787)
==================================================
Severity: Moderate
If client auth is used then a server can seg fault in the event of a DHE
ciphersuite being selected and a zero length ClientKeyExchange message being
sent by the client. This could be exploited in a DoS attack.
This issue affects OpenSSL version: 1.0.2
OpenSSL 1.0.2 users should upgrade to 1.0.2a.
This issue was discovered and the fix was developed by Matt Caswell of the
OpenSSL development team.
Handshake with unseeded PRNG (CVE-2015-0285)
============================================
Severity: Low
Under certain conditions an OpenSSL 1.0.2 client can complete a handshake with
an unseeded PRNG. The conditions are:
- The client is on a platform where the PRNG has not been seeded automatically,
and the user has not seeded manually
- A protocol specific client method version has been used (i.e. not
SSL_client_methodv23)
- A ciphersuite is used that does not require additional random data from the
PRNG beyond the initial ClientHello client random (e.g. PSK-RC4-SHA).
If the handshake succeeds then the client random that has been used will have
been generated from a PRNG with insufficient entropy and therefore the output
may be predictable.
For example using the following command with an unseeded openssl will succeed on
an unpatched platform:
openssl s_client -psk 1a2b3c4d -tls1_2 -cipher PSK-RC4-SHA
This issue affects OpenSSL version: 1.0.2
OpenSSL 1.0.2 users should upgrade to 1.0.2a.
This issue was discovered and the fix was developed by Matt Caswell of the
OpenSSL development team.
Use After Free following d2i_ECPrivatekey error (CVE-2015-0209)
===============================================================
Severity: Low
A malformed EC private key file consumed via the d2i_ECPrivateKey function could
cause a use after free condition. This, in turn, could cause a double
free in several private key parsing functions (such as d2i_PrivateKey
or EVP_PKCS82PKEY) and could lead to a DoS attack or memory corruption
for applications that receive EC private keys from untrusted
sources. This scenario is considered rare.
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8.
OpenSSL 1.0.2 users should upgrade to 1.0.2a
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
This issue was discovered by the BoringSSL project and fixed in their commit
517073cd4b. The OpenSSL fix was developed by Matt Caswell of the OpenSSL
development team.
X509_to_X509_REQ NULL pointer deref (CVE-2015-0288)
===================================================
Severity: Low
The function X509_to_X509_REQ will crash with a NULL pointer dereference if
the certificate key is invalid. This function is rarely used in practice.
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0
and 0.9.8.
OpenSSL 1.0.2 users should upgrade to 1.0.2a
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
This issue was discovered by Brian Carpenter and a fix developed by Stephen
Henson of the OpenSSL development team.
Note
====
As per our previous announcements and our Release Strategy
(https://www.openssl.org/about/releasestrat.html), support for OpenSSL versions
1.0.0 and 0.9.8 will cease on 31st December 2015. No security updates for these
releases will be provided after that date. Users of these releases are advised
to upgrade.
References
==========
URL for this Security Advisory:
https://www.openssl.org/news/secadv_20150319.txt
Note: the online version of the advisory may be updated with additional
details over time.
For details of OpenSSL severity classifications please see:
https://www.openssl.org/about/secpolicy.html
commit 24224698e85ee3d3cfe6198aa6d79ce769860b2e
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Wed Mar 18 15:51:37 2015 +0100
openssh: Update to version 6.8p1
commit 1e97ffa58bab62d9d150f8ec99a80c65489e21c5
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Tue Mar 17 22:23:13 2015 +0100
fireinfo: Forbid string "Serial"
commit 2150b2cf4172a3f96f0b2145c1d6ac203bc1c33a
Author: Arne Fitzenreiter <arne_f(a)ipfire.org>
Date: Tue Mar 17 14:08:13 2015 +0100
prepare core88.
commit 8e4efee1ea20a0df01cd34bcd25efa15047369e0
Author: Arne Fitzenreiter <arne_f(a)ipfire.org>
Date: Sat Mar 7 10:18:50 2015 +0100
set version to 2.17-core88.
-----------------------------------------------------------------------
hooks/post-receive
--
IPFire 2.x development tree
1
0
[git.ipfire.org] IPFire 2.x development tree branch, core87, updated. 4c33d45cfec7c9b26ba456d27d5f9741e3a9729c
by gitï¼ ipfire.org 19 Mar '15
by gitï¼ ipfire.org 19 Mar '15
19 Mar '15
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, core87 has been updated
via 4c33d45cfec7c9b26ba456d27d5f9741e3a9729c (commit)
from dffcb2f44b2ea8da5d079df96a37e58a5a28178f (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 4c33d45cfec7c9b26ba456d27d5f9741e3a9729c
Author: Arne Fitzenreiter <arne_f(a)ipfire.org>
Date: Mon Feb 23 19:38:28 2015 +0100
core87: fix update on xen.
-----------------------------------------------------------------------
Summary of changes:
config/rootfiles/core/87/update.sh | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
Difference in files:
diff --git a/config/rootfiles/core/87/update.sh b/config/rootfiles/core/87/update.sh
index 172d854..4af0370 100644
--- a/config/rootfiles/core/87/update.sh
+++ b/config/rootfiles/core/87/update.sh
@@ -198,8 +198,9 @@ case "$(uname -m)" in
i?86)
case "$(find_device "/")" in
xvd* )
- echo Skip remove grub2 files, because pygrub fail.
- rm -f /boot/grub/*
+ echo Remove grub2 files, because pygrub fail.
+ rm -rvf /boot/grub/*
+ touch /boot/grub/grub.conf
echo config will recreated by linux-pae install.
;;
* )
hooks/post-receive
--
IPFire 2.x development tree
1
0
[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 506e4b967127485c89272751b7d870a9bd4c7b47
by gitï¼ ipfire.org 19 Mar '15
by gitï¼ ipfire.org 19 Mar '15
19 Mar '15
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, master has been updated
via 506e4b967127485c89272751b7d870a9bd4c7b47 (commit)
via 498b3cd3a85f0f3aba3297cbf786a12fb26bf1f6 (commit)
via a0297133a1f2a6f98efbe2eec353015e2316f45d (commit)
via 03d4ff6007bd06868a7ea6ae4a113a043aa1087b (commit)
from 9ffd1b35db13760ceab2b396230fbc40fa03caec (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 506e4b967127485c89272751b7d870a9bd4c7b47
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Thu Mar 19 16:04:35 2015 +0100
openssl: Rebase "disable SSLv2, SSLv3" patch
commit 498b3cd3a85f0f3aba3297cbf786a12fb26bf1f6
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Thu Mar 19 16:03:58 2015 +0100
openssl: Remove "fix parallel build" patch
commit a0297133a1f2a6f98efbe2eec353015e2316f45d
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Thu Mar 19 15:54:43 2015 +0100
openssl: Update weak-ciphers and build patches
commit 03d4ff6007bd06868a7ea6ae4a113a043aa1087b
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Thu Mar 19 15:47:13 2015 +0100
openssl: Remove support for cryptodev
The patches won't apply any more and there does not seem
support from upstream for the latest versions of OpenSSL
-----------------------------------------------------------------------
Summary of changes:
lfs/openssl | 14 +-
lfs/openssl-compat | 9 +-
src/patches/openssl-0.9.8u-cryptodev.patch | 882 ---------------------
src/patches/openssl-1.0.1-beta2-build.patch | 109 ---
src/patches/openssl-1.0.1e-cryptodev.patch | 712 -----------------
.../openssl-1.0.1e-fix_parallel_build-1.patch | 340 --------
src/patches/openssl-1.0.1e-rpmbuild.patch | 44 +
src/patches/openssl-1.0.1e-weak-ciphers.patch | 12 -
src/patches/openssl-1.0.1m-weak-ciphers.patch | 11 +
src/patches/openssl-disable-sslv2-sslv3.patch | 25 +-
10 files changed, 79 insertions(+), 2079 deletions(-)
delete mode 100644 src/patches/openssl-0.9.8u-cryptodev.patch
delete mode 100644 src/patches/openssl-1.0.1-beta2-build.patch
delete mode 100644 src/patches/openssl-1.0.1e-cryptodev.patch
delete mode 100644 src/patches/openssl-1.0.1e-fix_parallel_build-1.patch
create mode 100644 src/patches/openssl-1.0.1e-rpmbuild.patch
delete mode 100644 src/patches/openssl-1.0.1e-weak-ciphers.patch
create mode 100644 src/patches/openssl-1.0.1m-weak-ciphers.patch
Difference in files:
diff --git a/lfs/openssl b/lfs/openssl
index efc7236..588cf04 100644
--- a/lfs/openssl
+++ b/lfs/openssl
@@ -82,12 +82,14 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
@$(PREBUILD)
@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-1.0.0-beta5-enginesdir.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-1.0.1-beta2-build.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-1.0.1e-cryptodev.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-1.0.1e-fix_parallel_build-1.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-1.0.1e-weak-ciphers.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-1.0.1e-rpmbuild.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-1.0.1m-weak-ciphers.patch
cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-disable-sslv2-sslv3.patch
+ # Apply our CFLAGS
+ cd $(DIR_APP) && sed -i Configure \
+ -e "s/-O3 -fomit-frame-pointer/$(CFLAGS)/g"
+
cd $(DIR_APP) && find crypto/ -name Makefile -exec \
sed 's/^ASFLAGS=/&-Wa,--noexecstack /' -i {} \;
@@ -107,9 +109,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
no-rc5 \
no-srp \
$(CONFIGURE_ARGS) \
- -DSSL_FORBID_ENULL \
- -DHAVE_CRYPTODEV \
- -DUSE_CRYPTODEV_DIGEST
+ -DSSL_FORBID_ENULL
cd $(DIR_APP) && make depend
cd $(DIR_APP) && make
diff --git a/lfs/openssl-compat b/lfs/openssl-compat
index 8206d33..ad5d664 100644
--- a/lfs/openssl-compat
+++ b/lfs/openssl-compat
@@ -71,9 +71,12 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
@$(PREBUILD)
@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-0.9.8u-cryptodev.patch
cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-disable-sslv2-sslv3.patch
+ # Apply our CFLAGS
+ cd $(DIR_APP) && sed -i Configure \
+ -e "s/-O3 -fomit-frame-pointer/$(CFLAGS)/g"
+
cd $(DIR_APP) && sed -i -e 's/mcpu/march/' config
cd $(DIR_APP) && sed -i -e 's/-O3/-O2/' -e 's/-march=i486/-march=i586/' Configure
@@ -87,9 +90,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
zlib-dynamic \
no-engines \
no-asm 386 \
- -DSSL_FORBID_ENULL \
- -DHAVE_CRYPTODEV \
- -DUSE_CRYPTODEV_DIGEST
+ -DSSL_FORBID_ENULL
cd $(DIR_APP) && make depend
cd $(DIR_APP) && make
diff --git a/src/patches/openssl-0.9.8u-cryptodev.patch b/src/patches/openssl-0.9.8u-cryptodev.patch
deleted file mode 100644
index 920648d..0000000
--- a/src/patches/openssl-0.9.8u-cryptodev.patch
+++ /dev/null
@@ -1,882 +0,0 @@
-diff -Naur openssl-0.9.8u.org/crypto/engine/eng_all.c openssl-0.9.8u/crypto/engine/eng_all.c
---- openssl-0.9.8u.org/crypto/engine/eng_all.c 2010-03-01 01:30:11.000000000 +0100
-+++ openssl-0.9.8u/crypto/engine/eng_all.c 2012-03-27 14:07:11.000000000 +0200
-@@ -113,7 +113,6 @@
- #endif
- }
-
--#if defined(__OpenBSD__) || defined(__FreeBSD__)
- void ENGINE_setup_bsd_cryptodev(void) {
- static int bsd_cryptodev_default_loaded = 0;
- if (!bsd_cryptodev_default_loaded) {
-@@ -122,4 +121,3 @@
- }
- bsd_cryptodev_default_loaded=1;
- }
--#endif
-diff -Naur openssl-0.9.8u.org/crypto/engine/eng_cryptodev.c openssl-0.9.8u/crypto/engine/eng_cryptodev.c
---- openssl-0.9.8u.org/crypto/engine/eng_cryptodev.c 2012-03-06 14:22:32.000000000 +0100
-+++ openssl-0.9.8u/crypto/engine/eng_cryptodev.c 2012-03-27 14:02:59.000000000 +0200
-@@ -2,6 +2,7 @@
- * Copyright (c) 2002 Bob Beck <beck(a)openbsd.org>
- * Copyright (c) 2002 Theo de Raadt
- * Copyright (c) 2002 Markus Friedl
-+ * Copyright (c) 2012 Nikos Mavrogiannopoulos
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
-@@ -30,10 +31,6 @@
- #include <openssl/engine.h>
- #include <openssl/evp.h>
- #include <openssl/bn.h>
--#include <openssl/dsa.h>
--#include <openssl/rsa.h>
--#include <openssl/dh.h>
--#include <openssl/err.h>
-
- #if (defined(__unix__) || defined(unix)) && !defined(USG) && \
- (defined(OpenBSD) || defined(__FreeBSD__))
-@@ -59,6 +56,10 @@
-
- #include <sys/types.h>
- #include <crypto/cryptodev.h>
-+#include <crypto/dh/dh.h>
-+#include <crypto/dsa/dsa.h>
-+#include <crypto/err/err.h>
-+#include <crypto/rsa/rsa.h>
- #include <sys/ioctl.h>
- #include <errno.h>
- #include <stdio.h>
-@@ -72,6 +73,12 @@
- struct dev_crypto_state {
- struct session_op d_sess;
- int d_fd;
-+
-+#ifdef USE_CRYPTODEV_DIGESTS
-+ unsigned char digest_res[HASH_MAX_LEN];
-+ char *mac_data;
-+ int mac_len;
-+#endif
- };
-
- static u_int32_t cryptodev_asymfeat = 0;
-@@ -79,15 +86,14 @@
- static int get_asym_dev_crypto(void);
- static int open_dev_crypto(void);
- static int get_dev_crypto(void);
--static int cryptodev_max_iv(int cipher);
--static int cryptodev_key_length_valid(int cipher, int len);
--static int cipher_nid_to_cryptodev(int nid);
- static int get_cryptodev_ciphers(const int **cnids);
--/*static int get_cryptodev_digests(const int **cnids);*/
-+#ifdef USE_CRYPTODEV_DIGESTS
-+static int get_cryptodev_digests(const int **cnids);
-+#endif
- static int cryptodev_usable_ciphers(const int **nids);
- static int cryptodev_usable_digests(const int **nids);
- static int cryptodev_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
-- const unsigned char *in, unsigned int inl);
-+ const unsigned char *in, size_t inl);
- static int cryptodev_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
- const unsigned char *iv, int enc);
- static int cryptodev_cleanup(EVP_CIPHER_CTX *ctx);
-@@ -121,7 +127,7 @@
- static int cryptodev_dh_compute_key(unsigned char *key,
- const BIGNUM *pub_key, DH *dh);
- static int cryptodev_ctrl(ENGINE *e, int cmd, long i, void *p,
-- void (*f)());
-+ void (*f)(void));
- void ENGINE_load_cryptodev(void);
-
- static const ENGINE_CMD_DEFN cryptodev_defns[] = {
-@@ -134,27 +140,38 @@
- int ivmax;
- int keylen;
- } ciphers[] = {
-+ { CRYPTO_ARC4, NID_rc4, 0, 16, },
- { CRYPTO_DES_CBC, NID_des_cbc, 8, 8, },
- { CRYPTO_3DES_CBC, NID_des_ede3_cbc, 8, 24, },
- { CRYPTO_AES_CBC, NID_aes_128_cbc, 16, 16, },
-+ { CRYPTO_AES_CBC, NID_aes_192_cbc, 16, 24, },
-+ { CRYPTO_AES_CBC, NID_aes_256_cbc, 16, 32, },
- { CRYPTO_BLF_CBC, NID_bf_cbc, 8, 16, },
- { CRYPTO_CAST_CBC, NID_cast5_cbc, 8, 16, },
- { CRYPTO_SKIPJACK_CBC, NID_undef, 0, 0, },
- { 0, NID_undef, 0, 0, },
- };
-
--#if 0
-+#ifdef USE_CRYPTODEV_DIGESTS
- static struct {
- int id;
- int nid;
-+ int digestlen;
- } digests[] = {
-- { CRYPTO_SHA1_HMAC, NID_hmacWithSHA1, },
-- { CRYPTO_RIPEMD160_HMAC, NID_ripemd160, },
-- { CRYPTO_MD5_KPDK, NID_undef, },
-- { CRYPTO_SHA1_KPDK, NID_undef, },
-- { CRYPTO_MD5, NID_md5, },
-- { CRYPTO_SHA1, NID_undef, },
-- { 0, NID_undef, },
-+#if 0
-+ /* HMAC is not supported */
-+ { CRYPTO_MD5_HMAC, NID_hmacWithMD5, 16},
-+ { CRYPTO_SHA1_HMAC, NID_hmacWithSHA1, 20},
-+ { CRYPTO_SHA2_256_HMAC, NID_hmacWithSHA256, 32},
-+ { CRYPTO_SHA2_384_HMAC, NID_hmacWithSHA384, 48},
-+ { CRYPTO_SHA2_512_HMAC, NID_hmacWithSHA512, 64},
-+#endif
-+ { CRYPTO_MD5, NID_md5, 16},
-+ { CRYPTO_SHA1, NID_sha1, 20},
-+ { CRYPTO_SHA2_256, NID_sha256, 32},
-+ { CRYPTO_SHA2_384, NID_sha384, 48},
-+ { CRYPTO_SHA2_512, NID_sha512, 64},
-+ { 0, NID_undef, 0},
- };
- #endif
-
-@@ -186,6 +203,7 @@
-
- if ((fd = open_dev_crypto()) == -1)
- return (-1);
-+#ifndef CRIOGET_NOT_NEEDED
- if (ioctl(fd, CRIOGET, &retfd) == -1)
- return (-1);
-
-@@ -194,9 +212,19 @@
- close(retfd);
- return (-1);
- }
-+#else
-+ retfd = fd;
-+#endif
- return (retfd);
- }
-
-+static void put_dev_crypto(int fd)
-+{
-+#ifndef CRIOGET_NOT_NEEDED
-+ close(fd);
-+#endif
-+}
-+
- /* Caching version for asym operations */
- static int
- get_asym_dev_crypto(void)
-@@ -209,50 +237,6 @@
- }
-
- /*
-- * XXXX this needs to be set for each alg - and determined from
-- * a running card.
-- */
--static int
--cryptodev_max_iv(int cipher)
--{
-- int i;
--
-- for (i = 0; ciphers[i].id; i++)
-- if (ciphers[i].id == cipher)
-- return (ciphers[i].ivmax);
-- return (0);
--}
--
--/*
-- * XXXX this needs to be set for each alg - and determined from
-- * a running card. For now, fake it out - but most of these
-- * for real devices should return 1 for the supported key
-- * sizes the device can handle.
-- */
--static int
--cryptodev_key_length_valid(int cipher, int len)
--{
-- int i;
--
-- for (i = 0; ciphers[i].id; i++)
-- if (ciphers[i].id == cipher)
-- return (ciphers[i].keylen == len);
-- return (0);
--}
--
--/* convert libcrypto nids to cryptodev */
--static int
--cipher_nid_to_cryptodev(int nid)
--{
-- int i;
--
-- for (i = 0; ciphers[i].id; i++)
-- if (ciphers[i].nid == nid)
-- return (ciphers[i].id);
-- return (0);
--}
--
--/*
- * Find out what ciphers /dev/crypto will let us have a session for.
- * XXX note, that some of these openssl doesn't deal with yet!
- * returning them here is harmless, as long as we return NULL
-@@ -264,13 +248,14 @@
- static int nids[CRYPTO_ALGORITHM_MAX];
- struct session_op sess;
- int fd, i, count = 0;
-+ unsigned char fake_key[CRYPTO_CIPHER_MAX_KEY_LEN];
-
- if ((fd = get_dev_crypto()) < 0) {
- *cnids = NULL;
- return (0);
- }
- memset(&sess, 0, sizeof(sess));
-- sess.key = (caddr_t)"123456781234567812345678";
-+ sess.key = (void*)fake_key;
-
- for (i = 0; ciphers[i].id && count < CRYPTO_ALGORITHM_MAX; i++) {
- if (ciphers[i].nid == NID_undef)
-@@ -282,7 +267,7 @@
- ioctl(fd, CIOCFSESSION, &sess.ses) != -1)
- nids[count++] = ciphers[i].nid;
- }
-- close(fd);
-+ put_dev_crypto(fd);
-
- if (count > 0)
- *cnids = nids;
-@@ -291,7 +276,7 @@
- return (count);
- }
-
--#if 0 /* unused */
-+#ifdef USE_CRYPTODEV_DIGESTS
- /*
- * Find out what digests /dev/crypto will let us have a session for.
- * XXX note, that some of these openssl doesn't deal with yet!
-@@ -302,6 +287,7 @@
- get_cryptodev_digests(const int **cnids)
- {
- static int nids[CRYPTO_ALGORITHM_MAX];
-+ unsigned char fake_key[CRYPTO_CIPHER_MAX_KEY_LEN];
- struct session_op sess;
- int fd, i, count = 0;
-
-@@ -310,16 +296,18 @@
- return (0);
- }
- memset(&sess, 0, sizeof(sess));
-+ sess.mackey = fake_key;
- for (i = 0; digests[i].id && count < CRYPTO_ALGORITHM_MAX; i++) {
- if (digests[i].nid == NID_undef)
- continue;
- sess.mac = digests[i].id;
-+ sess.mackeylen = 8;
- sess.cipher = 0;
- if (ioctl(fd, CIOCGSESSION, &sess) != -1 &&
- ioctl(fd, CIOCFSESSION, &sess.ses) != -1)
- nids[count++] = digests[i].nid;
- }
-- close(fd);
-+ put_dev_crypto(fd);
-
- if (count > 0)
- *cnids = nids;
-@@ -327,8 +315,7 @@
- *cnids = NULL;
- return (count);
- }
--
--#endif
-+#endif /* 0 */
-
- /*
- * Find the useable ciphers|digests from dev/crypto - this is the first
-@@ -360,6 +347,9 @@
- static int
- cryptodev_usable_digests(const int **nids)
- {
-+#ifdef USE_CRYPTODEV_DIGESTS
-+ return (get_cryptodev_digests(nids));
-+#else
- /*
- * XXXX just disable all digests for now, because it sucks.
- * we need a better way to decide this - i.e. I may not
-@@ -374,11 +364,12 @@
- */
- *nids = NULL;
- return (0);
-+#endif
- }
-
- static int
- cryptodev_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
-- const unsigned char *in, unsigned int inl)
-+ const unsigned char *in, size_t inl)
- {
- struct crypt_op cryp;
- struct dev_crypto_state *state = ctx->cipher_data;
-@@ -398,14 +389,14 @@
- cryp.ses = sess->ses;
- cryp.flags = 0;
- cryp.len = inl;
-- cryp.src = (caddr_t) in;
-- cryp.dst = (caddr_t) out;
-+ cryp.src = (void*) in;
-+ cryp.dst = (void*) out;
- cryp.mac = 0;
-
- cryp.op = ctx->encrypt ? COP_ENCRYPT : COP_DECRYPT;
-
- if (ctx->cipher->iv_len) {
-- cryp.iv = (caddr_t) ctx->iv;
-+ cryp.iv = (void*) ctx->iv;
- if (!ctx->encrypt) {
- iiv = in + inl - ctx->cipher->iv_len;
- memcpy(save_iv, iiv, ctx->cipher->iv_len);
-@@ -436,28 +427,32 @@
- {
- struct dev_crypto_state *state = ctx->cipher_data;
- struct session_op *sess = &state->d_sess;
-- int cipher;
-+ int cipher = -1, i;
-
-- if ((cipher = cipher_nid_to_cryptodev(ctx->cipher->nid)) == NID_undef)
-- return (0);
--
-- if (ctx->cipher->iv_len > cryptodev_max_iv(cipher))
-- return (0);
-+ for (i = 0; ciphers[i].id; i++)
-+ if (ctx->cipher->nid == ciphers[i].nid &&
-+ ctx->cipher->iv_len <= ciphers[i].ivmax &&
-+ ctx->key_len == ciphers[i].keylen) {
-+ cipher = ciphers[i].id;
-+ break;
-+ }
-
-- if (!cryptodev_key_length_valid(cipher, ctx->key_len))
-+ if (!ciphers[i].id) {
-+ state->d_fd = -1;
- return (0);
-+ }
-
- memset(sess, 0, sizeof(struct session_op));
-
- if ((state->d_fd = get_dev_crypto()) < 0)
- return (0);
-
-- sess->key = (char *)key;
-+ sess->key = (void*)key;
- sess->keylen = ctx->key_len;
- sess->cipher = cipher;
-
- if (ioctl(state->d_fd, CIOCGSESSION, sess) == -1) {
-- close(state->d_fd);
-+ put_dev_crypto(state->d_fd);
- state->d_fd = -1;
- return (0);
- }
-@@ -494,7 +489,7 @@
- } else {
- ret = 1;
- }
-- close(state->d_fd);
-+ put_dev_crypto(state->d_fd);
- state->d_fd = -1;
-
- return (ret);
-@@ -505,6 +500,20 @@
- * gets called when libcrypto requests a cipher NID.
- */
-
-+/* RC4 */
-+const EVP_CIPHER cryptodev_rc4 = {
-+ NID_rc4,
-+ 1, 16, 0,
-+ EVP_CIPH_VARIABLE_LENGTH,
-+ cryptodev_init_key,
-+ cryptodev_cipher,
-+ cryptodev_cleanup,
-+ sizeof(struct dev_crypto_state),
-+ NULL,
-+ NULL,
-+ NULL
-+};
-+
- /* DES CBC EVP */
- const EVP_CIPHER cryptodev_des_cbc = {
- NID_des_cbc,
-@@ -572,6 +581,32 @@
- NULL
- };
-
-+const EVP_CIPHER cryptodev_aes_192_cbc = {
-+ NID_aes_192_cbc,
-+ 16, 24, 16,
-+ EVP_CIPH_CBC_MODE,
-+ cryptodev_init_key,
-+ cryptodev_cipher,
-+ cryptodev_cleanup,
-+ sizeof(struct dev_crypto_state),
-+ EVP_CIPHER_set_asn1_iv,
-+ EVP_CIPHER_get_asn1_iv,
-+ NULL
-+};
-+
-+const EVP_CIPHER cryptodev_aes_256_cbc = {
-+ NID_aes_256_cbc,
-+ 16, 32, 16,
-+ EVP_CIPH_CBC_MODE,
-+ cryptodev_init_key,
-+ cryptodev_cipher,
-+ cryptodev_cleanup,
-+ sizeof(struct dev_crypto_state),
-+ EVP_CIPHER_set_asn1_iv,
-+ EVP_CIPHER_get_asn1_iv,
-+ NULL
-+};
-+
- /*
- * Registered by the ENGINE when used to find out how to deal with
- * a particular NID in the ENGINE. this says what we'll do at the
-@@ -585,6 +620,9 @@
- return (cryptodev_usable_ciphers(nids));
-
- switch (nid) {
-+ case NID_rc4:
-+ *cipher = &cryptodev_rc4;
-+ break;
- case NID_des_ede3_cbc:
- *cipher = &cryptodev_3des_cbc;
- break;
-@@ -600,6 +638,12 @@
- case NID_aes_128_cbc:
- *cipher = &cryptodev_aes_cbc;
- break;
-+ case NID_aes_192_cbc:
-+ *cipher = &cryptodev_aes_192_cbc;
-+ break;
-+ case NID_aes_256_cbc:
-+ *cipher = &cryptodev_aes_256_cbc;
-+ break;
- default:
- *cipher = NULL;
- break;
-@@ -607,6 +651,286 @@
- return (*cipher != NULL);
- }
-
-+
-+#ifdef USE_CRYPTODEV_DIGESTS
-+
-+/* convert digest type to cryptodev */
-+static int
-+digest_nid_to_cryptodev(int nid)
-+{
-+ int i;
-+
-+ for (i = 0; digests[i].id; i++)
-+ if (digests[i].nid == nid)
-+ return (digests[i].id);
-+ return (0);
-+}
-+
-+
-+static int cryptodev_digest_init(EVP_MD_CTX *ctx)
-+{
-+ struct dev_crypto_state *state = ctx->md_data;
-+ struct session_op *sess = &state->d_sess;
-+ int digest;
-+
-+ if ((digest = digest_nid_to_cryptodev(ctx->digest->type)) == NID_undef){
-+ printf("cryptodev_digest_init: Can't get digest \n");
-+ return (0);
-+ }
-+ memset(state, 0, sizeof(struct dev_crypto_state));
-+
-+ if ((state->d_fd = get_dev_crypto()) < 0) {
-+ printf("cryptodev_digest_init: Can't get Dev \n");
-+ return (0);
-+ }
-+
-+ sess->mackey = NULL;
-+ sess->mackeylen = 0;
-+ sess->mac = digest;
-+
-+ if (ioctl(state->d_fd, CIOCGSESSION, sess) < 0) {
-+ put_dev_crypto(state->d_fd);
-+ state->d_fd = -1;
-+ printf("cryptodev_digest_init: Open session failed\n");
-+ return (0);
-+ }
-+
-+ return (1);
-+}
-+
-+static int cryptodev_digest_update(EVP_MD_CTX *ctx, const void *data,
-+ size_t count)
-+{
-+ struct dev_crypto_state *state = ctx->md_data;
-+ struct crypt_op cryp;
-+ struct session_op *sess = &state->d_sess;
-+
-+ if (!data || state->d_fd < 0) {
-+ printf("cryptodev_digest_update: illegal inputs \n");
-+ return (0);
-+ }
-+
-+ if (!count) {
-+ return (1);
-+ }
-+
-+ if (!(ctx->flags & EVP_MD_CTX_FLAG_ONESHOT)) {
-+ /* if application doesn't support one buffer */
-+ state->mac_data = OPENSSL_realloc(state->mac_data, state->mac_len + count);
-+
-+ if (!state->mac_data) {
-+ printf("cryptodev_digest_update: realloc failed\n");
-+ return (0);
-+ }
-+
-+ memcpy(state->mac_data + state->mac_len, data, count);
-+ state->mac_len += count;
-+
-+ return (1);
-+ }
-+
-+ memset(&cryp, 0, sizeof(cryp));
-+
-+ cryp.ses = sess->ses;
-+ cryp.flags = 0;
-+ cryp.len = count;
-+ cryp.src = (void*) data;
-+ cryp.dst = NULL;
-+ cryp.mac = (void*) state->digest_res;
-+ if (ioctl(state->d_fd, CIOCCRYPT, &cryp) < 0) {
-+ printf("cryptodev_digest_update: digest failed\n");
-+ return (0);
-+ }
-+ return (1);
-+}
-+
-+
-+static int cryptodev_digest_final(EVP_MD_CTX *ctx, unsigned char *md)
-+{
-+ struct crypt_op cryp;
-+ struct dev_crypto_state *state = ctx->md_data;
-+ struct session_op *sess = &state->d_sess;
-+
-+ if (!md || state->d_fd < 0) {
-+ printf("cryptodev_digest_final: illegal input\n");
-+ return(0);
-+ }
-+
-+ if (! (ctx->flags & EVP_MD_CTX_FLAG_ONESHOT) ) {
-+ /* if application doesn't support one buffer */
-+ memset(&cryp, 0, sizeof(cryp));
-+ cryp.ses = sess->ses;
-+ cryp.flags = 0;
-+ cryp.len = state->mac_len;
-+ cryp.src = state->mac_data;
-+ cryp.dst = NULL;
-+ cryp.mac = (void*)md;
-+ if (ioctl(state->d_fd, CIOCCRYPT, &cryp) < 0) {
-+ printf("cryptodev_digest_final: digest failed\n");
-+ return (0);
-+ }
-+
-+ return 1;
-+ }
-+
-+ memcpy(md, state->digest_res, ctx->digest->md_size);
-+
-+ return 1;
-+}
-+
-+
-+static int cryptodev_digest_cleanup(EVP_MD_CTX *ctx)
-+{
-+ int ret = 1;
-+ struct dev_crypto_state *state = ctx->md_data;
-+ struct session_op *sess = &state->d_sess;
-+
-+ if (state == NULL)
-+ return 0;
-+
-+ if (state->d_fd < 0) {
-+ printf("cryptodev_digest_cleanup: illegal input\n");
-+ return (0);
-+ }
-+
-+ if (state->mac_data) {
-+ OPENSSL_free(state->mac_data);
-+ state->mac_data = NULL;
-+ state->mac_len = 0;
-+ }
-+
-+ if (ioctl(state->d_fd, CIOCFSESSION, &sess->ses) < 0) {
-+ printf("cryptodev_digest_cleanup: failed to close session\n");
-+ ret = 0;
-+ } else {
-+ ret = 1;
-+ }
-+ put_dev_crypto(state->d_fd);
-+ state->d_fd = -1;
-+
-+ return (ret);
-+}
-+
-+static int cryptodev_digest_copy(EVP_MD_CTX *to,const EVP_MD_CTX *from)
-+{
-+ struct dev_crypto_state *fstate = from->md_data;
-+ struct dev_crypto_state *dstate = to->md_data;
-+ struct session_op *sess;
-+ int digest;
-+
-+ if (dstate == NULL || fstate == NULL)
-+ return 1;
-+
-+ memcpy(dstate, fstate, sizeof(struct dev_crypto_state));
-+
-+ sess = &dstate->d_sess;
-+
-+ digest = digest_nid_to_cryptodev(to->digest->type);
-+
-+ sess->mackey = NULL;
-+ sess->mackeylen = 0;
-+ sess->mac = digest;
-+
-+ dstate->d_fd = get_dev_crypto();
-+
-+ if (ioctl(dstate->d_fd, CIOCGSESSION, sess) < 0) {
-+ put_dev_crypto(dstate->d_fd);
-+ dstate->d_fd = -1;
-+ printf("cryptodev_digest_init: Open session failed\n");
-+ return (0);
-+ }
-+
-+ if (fstate->mac_len != 0) {
-+ if (fstate->mac_data != NULL)
-+ {
-+ dstate->mac_data = OPENSSL_malloc(fstate->mac_len);
-+ memcpy(dstate->mac_data, fstate->mac_data, fstate->mac_len);
-+ dstate->mac_len = fstate->mac_len;
-+ }
-+ }
-+
-+ return 1;
-+}
-+
-+
-+static const EVP_MD cryptodev_sha1 = {
-+ NID_sha1,
-+ NID_sha1WithRSAEncryption,
-+ SHA_DIGEST_LENGTH,
-+ EVP_MD_FLAG_PKEY_METHOD_SIGNATURE|EVP_MD_FLAG_DIGALGID_ABSENT|EVP_MD_FLAG_ONESHOT,
-+ cryptodev_digest_init,
-+ cryptodev_digest_update,
-+ cryptodev_digest_final,
-+ cryptodev_digest_copy,
-+ cryptodev_digest_cleanup,
-+ EVP_PKEY_RSA_method,
-+ SHA_CBLOCK,
-+ sizeof(EVP_MD *)+sizeof(struct dev_crypto_state),
-+};
-+
-+static const EVP_MD cryptodev_sha256 = {
-+ NID_sha256,
-+ NID_sha256WithRSAEncryption,
-+ SHA256_DIGEST_LENGTH,
-+ EVP_MD_FLAG_PKEY_METHOD_SIGNATURE|EVP_MD_FLAG_DIGALGID_ABSENT|EVP_MD_FLAG_ONESHOT,
-+ cryptodev_digest_init,
-+ cryptodev_digest_update,
-+ cryptodev_digest_final,
-+ cryptodev_digest_copy,
-+ cryptodev_digest_cleanup,
-+ EVP_PKEY_RSA_method,
-+ SHA256_CBLOCK,
-+ sizeof(EVP_MD *)+sizeof(struct dev_crypto_state),
-+};
-+
-+static const EVP_MD cryptodev_sha384 = {
-+ NID_sha384,
-+ NID_sha384WithRSAEncryption,
-+ SHA384_DIGEST_LENGTH,
-+ EVP_MD_FLAG_PKEY_METHOD_SIGNATURE|EVP_MD_FLAG_DIGALGID_ABSENT|EVP_MD_FLAG_ONESHOT,
-+ cryptodev_digest_init,
-+ cryptodev_digest_update,
-+ cryptodev_digest_final,
-+ cryptodev_digest_copy,
-+ cryptodev_digest_cleanup,
-+ EVP_PKEY_RSA_method,
-+ SHA512_CBLOCK,
-+ sizeof(EVP_MD *)+sizeof(struct dev_crypto_state),
-+};
-+
-+static const EVP_MD cryptodev_sha512 = {
-+ NID_sha512,
-+ NID_sha512WithRSAEncryption,
-+ SHA512_DIGEST_LENGTH,
-+ EVP_MD_FLAG_PKEY_METHOD_SIGNATURE|EVP_MD_FLAG_DIGALGID_ABSENT|EVP_MD_FLAG_ONESHOT,
-+ cryptodev_digest_init,
-+ cryptodev_digest_update,
-+ cryptodev_digest_final,
-+ cryptodev_digest_copy,
-+ cryptodev_digest_cleanup,
-+ EVP_PKEY_RSA_method,
-+ SHA512_CBLOCK,
-+ sizeof(EVP_MD *)+sizeof(struct dev_crypto_state),
-+};
-+
-+static const EVP_MD cryptodev_md5 = {
-+ NID_md5,
-+ NID_md5WithRSAEncryption,
-+ 16 /* MD5_DIGEST_LENGTH */,
-+ EVP_MD_FLAG_PKEY_METHOD_SIGNATURE|EVP_MD_FLAG_DIGALGID_ABSENT|EVP_MD_FLAG_ONESHOT,
-+ cryptodev_digest_init,
-+ cryptodev_digest_update,
-+ cryptodev_digest_final,
-+ cryptodev_digest_copy,
-+ cryptodev_digest_cleanup,
-+ EVP_PKEY_RSA_method,
-+ 64 /* MD5_CBLOCK */,
-+ sizeof(EVP_MD *)+sizeof(struct dev_crypto_state),
-+};
-+
-+#endif /* USE_CRYPTODEV_DIGESTS */
-+
-+
- static int
- cryptodev_engine_digests(ENGINE *e, const EVP_MD **digest,
- const int **nids, int nid)
-@@ -615,10 +939,24 @@
- return (cryptodev_usable_digests(nids));
-
- switch (nid) {
-+#ifdef USE_CRYPTODEV_DIGESTS
- case NID_md5:
-- *digest = NULL; /* need to make a clean md5 critter */
-+ *digest = &cryptodev_md5;
- break;
-+ case NID_sha1:
-+ *digest = &cryptodev_sha1;
-+ break;
-+ case NID_sha256:
-+ *digest = &cryptodev_sha256;
-+ break;
-+ case NID_sha384:
-+ *digest = &cryptodev_sha384;
-+ break;
-+ case NID_sha512:
-+ *digest = &cryptodev_sha512;
-+ break;
- default:
-+#endif /* USE_CRYPTODEV_DIGESTS */
- *digest = NULL;
- break;
- }
-@@ -646,8 +984,9 @@
- b = malloc(bytes);
- if (b == NULL)
- return (1);
-+ memset(b, 0, bytes);
-
-- crp->crp_p = (char *)b;
-+ crp->crp_p = (void*) b;
- crp->crp_nbits = bits;
-
- for (i = 0, j = 0; i < a->top; i++) {
-@@ -690,7 +1029,7 @@
- {
- int i;
-
-- for (i = 0; i <= kop->crk_iparams + kop->crk_oparams; i++) {
-+ for (i = 0; i < kop->crk_iparams + kop->crk_oparams; i++) {
- if (kop->crk_param[i].crp_p)
- free(kop->crk_param[i].crp_p);
- kop->crk_param[i].crp_p = NULL;
-@@ -776,8 +1115,9 @@
- cryptodev_rsa_nocrt_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
- {
- int r;
--
-+ ctx = BN_CTX_new();
- r = cryptodev_bn_mod_exp(r0, I, rsa->d, rsa->n, ctx, NULL);
-+ BN_CTX_free(ctx);
- return (r);
- }
-
-@@ -899,7 +1239,7 @@
- kop.crk_op = CRK_DSA_SIGN;
-
- /* inputs: dgst dsa->p dsa->q dsa->g dsa->priv_key */
-- kop.crk_param[0].crp_p = (caddr_t)dgst;
-+ kop.crk_param[0].crp_p = (void*)dgst;
- kop.crk_param[0].crp_nbits = dlen * 8;
- if (bn2crparam(dsa->p, &kop.crk_param[1]))
- goto err;
-@@ -939,7 +1279,7 @@
- kop.crk_op = CRK_DSA_VERIFY;
-
- /* inputs: dgst dsa->p dsa->q dsa->g dsa->pub_key sig->r sig->s */
-- kop.crk_param[0].crp_p = (caddr_t)dgst;
-+ kop.crk_param[0].crp_p = (void*)dgst;
- kop.crk_param[0].crp_nbits = dlen * 8;
- if (bn2crparam(dsa->p, &kop.crk_param[1]))
- goto err;
-@@ -1017,7 +1357,7 @@
- goto err;
- kop.crk_iparams = 3;
-
-- kop.crk_param[3].crp_p = (char *)key;
-+ kop.crk_param[3].crp_p = (void*) key;
- kop.crk_param[3].crp_nbits = keylen * 8;
- kop.crk_oparams = 1;
-
-@@ -1048,7 +1388,7 @@
- * but I expect we'll want some options soon.
- */
- static int
--cryptodev_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)())
-+cryptodev_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))
- {
- #ifdef HAVE_SYSLOG_R
- struct syslog_data sd = SYSLOG_DATA_INIT;
-@@ -1084,14 +1424,14 @@
- * find out what asymmetric crypto algorithms we support
- */
- if (ioctl(fd, CIOCASYMFEAT, &cryptodev_asymfeat) == -1) {
-- close(fd);
-+ put_dev_crypto(fd);
- ENGINE_free(engine);
- return;
- }
-- close(fd);
-+ put_dev_crypto(fd);
-
- if (!ENGINE_set_id(engine, "cryptodev") ||
-- !ENGINE_set_name(engine, "BSD cryptodev engine") ||
-+ !ENGINE_set_name(engine, "cryptodev engine") ||
- !ENGINE_set_ciphers(engine, cryptodev_engine_ciphers) ||
- !ENGINE_set_digests(engine, cryptodev_engine_digests) ||
- !ENGINE_set_ctrl_function(engine, cryptodev_ctrl) ||
-diff -Naur openssl-0.9.8u.org/crypto/engine/engine.h openssl-0.9.8u/crypto/engine/engine.h
---- openssl-0.9.8u.org/crypto/engine/engine.h 2010-02-09 15:18:15.000000000 +0100
-+++ openssl-0.9.8u/crypto/engine/engine.h 2012-03-27 14:05:15.000000000 +0200
-@@ -705,9 +705,7 @@
- * values. */
- void *ENGINE_get_static_state(void);
-
--#if defined(__OpenBSD__) || defined(__FreeBSD__)
- void ENGINE_setup_bsd_cryptodev(void);
--#endif
-
- /* BEGIN ERROR CODES */
- /* The following lines are auto generated by the script mkerr.pl. Any changes
-diff -Naur openssl-0.9.8u.org/crypto/evp/c_all.c openssl-0.9.8u/crypto/evp/c_all.c
---- openssl-0.9.8u.org/crypto/evp/c_all.c 2004-08-29 18:36:04.000000000 +0200
-+++ openssl-0.9.8u/crypto/evp/c_all.c 2012-03-27 14:05:15.000000000 +0200
-@@ -83,8 +83,6 @@
- OpenSSL_add_all_ciphers();
- OpenSSL_add_all_digests();
- #ifndef OPENSSL_NO_ENGINE
--# if defined(__OpenBSD__) || defined(__FreeBSD__)
- ENGINE_setup_bsd_cryptodev();
--# endif
- #endif
- }
diff --git a/src/patches/openssl-1.0.1-beta2-build.patch b/src/patches/openssl-1.0.1-beta2-build.patch
deleted file mode 100644
index 0a5cef1..0000000
--- a/src/patches/openssl-1.0.1-beta2-build.patch
+++ /dev/null
@@ -1,109 +0,0 @@
-diff -up openssl-1.0.1-beta2/Configure.rpmbuild openssl-1.0.1-beta2/Configure
---- openssl-1.0.1-beta2/Configure.rpmbuild 2012-01-05 01:07:34.000000000 +0100
-+++ openssl-1.0.1-beta2/Configure 2012-02-02 12:43:56.547409325 +0100
-@@ -343,23 +343,23 @@ my %table=(
- ####
- # *-generic* is endian-neutral target, but ./config is free to
- # throw in -D[BL]_ENDIAN, whichever appropriate...
--"linux-generic32","gcc:-DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
--"linux-ppc", "gcc:-DB_ENDIAN -DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${ppc32_asm}:linux32:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"linux-generic32","gcc:-DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)",
-+"linux-ppc", "gcc:-DB_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${ppc32_asm}:linux32:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)",
- # It's believed that majority of ARM toolchains predefine appropriate -march.
- # If you compiler does not, do complement config command line with one!
--"linux-armv4", "gcc:-DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${armv4_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"linux-armv4", "gcc:-DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${armv4_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)",
- #### IA-32 targets...
- "linux-ia32-icc", "icc:-DL_ENDIAN -DTERMIO -O2 -no_cpprt::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-KPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
--"linux-elf", "gcc:-DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"linux-elf", "gcc:-DL_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)",
- "linux-aout", "gcc:-DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -march=i486 -Wall::(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_asm}:a.out",
- ####
--"linux-generic64","gcc:-DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
--"linux-ppc64", "gcc:-m64 -DB_ENDIAN -DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${ppc64_asm}:linux64:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
--"linux-ia64", "gcc:-DL_ENDIAN -DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_UNROLL DES_INT:${ia64_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"linux-generic64","gcc:-DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)",
-+"linux-ppc64", "gcc:-m64 -DB_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${ppc64_asm}:linux64:dlfcn:linux-shared:-fPIC:-m64 \$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER):::64",
-+"linux-ia64", "gcc:-DL_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_UNROLL DES_INT:${ia64_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)",
- "linux-ia64-ecc","ecc:-DL_ENDIAN -DTERMIO -O2 -Wall -no_cpprt::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT:${ia64_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
- "linux-ia64-icc","icc:-DL_ENDIAN -DTERMIO -O2 -Wall -no_cpprt::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_RISC1 DES_INT:${ia64_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
--"linux-x86_64", "gcc:-m64 -DL_ENDIAN -DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
--"linux64-s390x", "gcc:-m64 -DB_ENDIAN -DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL:${s390x_asm}:64:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
-+"linux-x86_64", "gcc:-m64 -DL_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64 \$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER):::64",
-+"linux64-s390x", "gcc:-m64 -DB_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL:${s390x_asm}:64:dlfcn:linux-shared:-fPIC:-m64 \$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER):::64",
- #### So called "highgprs" target for z/Architecture CPUs
- # "Highgprs" is kernel feature first implemented in Linux 2.6.32, see
- # /proc/cpuinfo. The idea is to preserve most significant bits of
-@@ -373,16 +373,16 @@ my %table=(
- # ldconfig and run-time linker to autodiscover. Unfortunately it
- # doesn't work just yet, because of couple of bugs in glibc
- # sysdeps/s390/dl-procinfo.c affecting ldconfig and ld.so.1...
--"linux32-s390x", "gcc:-m31 -Wa,-mzarch -DB_ENDIAN -DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL:".eval{my $asm=$s390x_asm;$asm=~s/bn\-s390x\.o/bn_asm.o/;$asm}.":31:dlfcn:linux-shared:-fPIC:-m31:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::/highgprs",
-+"linux32-s390x", "gcc:-m31 -Wa,-mzarch -DB_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL:".eval{my $asm=$s390x_asm;$asm=~s/bn\-s390x\.o/bn_asm.o/;$asm}.":31:dlfcn:linux-shared:-fPIC:-m31 \$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER):::/highgprs",
- #### SPARC Linux setups
- # Ray Miller <ray.miller(a)computing-services.oxford.ac.uk> has patiently
- # assisted with debugging of following two configs.
--"linux-sparcv8","gcc:-mv8 -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall -DBN_DIV2W::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${sparcv8_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"linux-sparcv8","gcc:-DB_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS) -DBN_DIV2W::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${sparcv8_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)",
- # it's a real mess with -mcpu=ultrasparc option under Linux, but
- # -Wa,-Av8plus should do the trick no matter what.
--"linux-sparcv9","gcc:-m32 -mcpu=ultrasparc -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall -Wa,-Av8plus -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${sparcv9_asm}:dlfcn:linux-shared:-fPIC:-m32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"linux-sparcv9","gcc:-DB_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS) -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${sparcv9_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)",
- # GCC 3.1 is a requirement
--"linux64-sparcv9","gcc:-m64 -mcpu=ultrasparc -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT:ULTRASPARC:-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL BF_PTR:${sparcv9_asm}:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
-+"linux64-sparcv9","gcc:-DB_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT:ULTRASPARC:-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL BF_PTR:${sparcv9_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER):::64",
- #### Alpha Linux with GNU C and Compaq C setups
- # Special notes:
- # - linux-alpha+bwx-gcc is ment to be used from ./config only. If you
-@@ -396,8 +396,8 @@ my %table=(
- #
- # <appro(a)fy.chalmers.se>
- #
--"linux-alpha-gcc","gcc:-O3 -DL_ENDIAN -DTERMIO::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_RISC1 DES_UNROLL:${alpha_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
--"linux-alpha+bwx-gcc","gcc:-O3 -DL_ENDIAN -DTERMIO::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${alpha_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"linux-alpha-gcc","gcc:-DL_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_RISC1 DES_UNROLL:${alpha_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)",
-+"linux-alpha+bwx-gcc","gcc:-DL_ENDIAN -DTERMIO -Wall \$(RPM_OPT_FLAGS)::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${alpha_asm}:dlfcn:linux-shared:-fPIC:\$(RPM_OPT_FLAGS):.so.\$(SHLIB_SONAMEVER)",
- "linux-alpha-ccc","ccc:-fast -readonly_strings -DL_ENDIAN -DTERMIO::-D_REENTRANT:::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL:${alpha_asm}",
- "linux-alpha+bwx-ccc","ccc:-fast -readonly_strings -DL_ENDIAN -DTERMIO::-D_REENTRANT:::SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL:${alpha_asm}",
-
-@@ -1678,7 +1678,7 @@ while (<IN>)
- elsif ($shared_extension ne "" && $shared_extension =~ /^\.s([ol])\.[^\.]*\.[^\.]*$/)
- {
- my $sotmp = $1;
-- s/^SHARED_LIBS_LINK_EXTS=.*/SHARED_LIBS_LINK_EXTS=.s$sotmp.\$(SHLIB_MAJOR) .s$sotmp/;
-+ s/^SHARED_LIBS_LINK_EXTS=.*/SHARED_LIBS_LINK_EXTS=.s$sotmp.\$(SHLIB_SONAMEVER) .s$sotmp/;
- }
- elsif ($shared_extension ne "" && $shared_extension =~ /^\.[^\.]*\.[^\.]*\.dylib$/)
- {
-diff -up openssl-1.0.1-beta2/Makefile.org.rpmbuild openssl-1.0.1-beta2/Makefile.org
---- openssl-1.0.1-beta2/Makefile.org.rpmbuild 2011-12-27 16:17:50.000000000 +0100
-+++ openssl-1.0.1-beta2/Makefile.org 2012-02-02 12:30:23.652495435 +0100
-@@ -10,6 +10,7 @@ SHLIB_VERSION_HISTORY=
- SHLIB_MAJOR=
- SHLIB_MINOR=
- SHLIB_EXT=
-+SHLIB_SONAMEVER=10
- PLATFORM=dist
- OPTIONS=
- CONFIGURE_ARGS=
-@@ -333,10 +334,9 @@ clean-shared:
- link-shared:
- @ set -e; for i in $(SHLIBDIRS); do \
- $(MAKE) -f $(HERE)/Makefile.shared -e $(BUILDENV) \
-- LIBNAME=$$i LIBVERSION=$(SHLIB_MAJOR).$(SHLIB_MINOR) \
-+ LIBNAME=$$i LIBVERSION=$(SHLIB_SONAMEVER) \
- LIBCOMPATVERSIONS=";$(SHLIB_VERSION_HISTORY)" \
- symlink.$(SHLIB_TARGET); \
-- libs="$$libs -l$$i"; \
- done
-
- build-shared: do_$(SHLIB_TARGET) link-shared
-@@ -347,7 +347,7 @@ do_$(SHLIB_TARGET):
- libs="$(LIBKRB5) $$libs"; \
- fi; \
- $(CLEARENV) && $(MAKE) -f Makefile.shared -e $(BUILDENV) \
-- LIBNAME=$$i LIBVERSION=$(SHLIB_MAJOR).$(SHLIB_MINOR) \
-+ LIBNAME=$$i LIBVERSION=$(SHLIB_SONAMEVER) \
- LIBCOMPATVERSIONS=";$(SHLIB_VERSION_HISTORY)" \
- LIBDEPS="$$libs $(EX_LIBS)" \
- link_a.$(SHLIB_TARGET); \
diff --git a/src/patches/openssl-1.0.1e-cryptodev.patch b/src/patches/openssl-1.0.1e-cryptodev.patch
deleted file mode 100644
index 29b6f77..0000000
--- a/src/patches/openssl-1.0.1e-cryptodev.patch
+++ /dev/null
@@ -1,712 +0,0 @@
-Patch created by Michael Tremer <michael.tremer(a)ipfire.org> from
- http://download.gna.org/cryptodev-linux/cryptodev-linux-1.6.tar.gz
-
-diff -Nur openssl-1.0.1e-vanilla/crypto/cryptodev.h openssl-1.0.1e/crypto/cryptodev.h
---- openssl-1.0.1e-vanilla/crypto/cryptodev.h 1970-01-01 00:00:00.000000000 +0000
-+++ openssl-1.0.1e/crypto/cryptodev.h 2013-12-25 14:27:20.907326820 +0000
-@@ -0,0 +1,292 @@
-+/* This is a source compatible implementation with the original API of
-+ * cryptodev by Angelos D. Keromytis, found at openbsd cryptodev.h.
-+ * Placed under public domain */
-+
-+#ifndef L_CRYPTODEV_H
-+#define L_CRYPTODEV_H
-+
-+#include <linux/types.h>
-+#ifndef __KERNEL__
-+#define __user
-+#endif
-+
-+/* API extensions for linux */
-+#define CRYPTO_HMAC_MAX_KEY_LEN 512
-+#define CRYPTO_CIPHER_MAX_KEY_LEN 64
-+
-+/* All the supported algorithms
-+ */
-+enum cryptodev_crypto_op_t {
-+ CRYPTO_DES_CBC = 1,
-+ CRYPTO_3DES_CBC = 2,
-+ CRYPTO_BLF_CBC = 3,
-+ CRYPTO_CAST_CBC = 4,
-+ CRYPTO_SKIPJACK_CBC = 5,
-+ CRYPTO_MD5_HMAC = 6,
-+ CRYPTO_SHA1_HMAC = 7,
-+ CRYPTO_RIPEMD160_HMAC = 8,
-+ CRYPTO_MD5_KPDK = 9,
-+ CRYPTO_SHA1_KPDK = 10,
-+ CRYPTO_RIJNDAEL128_CBC = 11,
-+ CRYPTO_AES_CBC = CRYPTO_RIJNDAEL128_CBC,
-+ CRYPTO_ARC4 = 12,
-+ CRYPTO_MD5 = 13,
-+ CRYPTO_SHA1 = 14,
-+ CRYPTO_DEFLATE_COMP = 15,
-+ CRYPTO_NULL = 16,
-+ CRYPTO_LZS_COMP = 17,
-+ CRYPTO_SHA2_256_HMAC = 18,
-+ CRYPTO_SHA2_384_HMAC = 19,
-+ CRYPTO_SHA2_512_HMAC = 20,
-+ CRYPTO_AES_CTR = 21,
-+ CRYPTO_AES_XTS = 22,
-+ CRYPTO_AES_ECB = 23,
-+ CRYPTO_AES_GCM = 50,
-+
-+ CRYPTO_CAMELLIA_CBC = 101,
-+ CRYPTO_RIPEMD160,
-+ CRYPTO_SHA2_224,
-+ CRYPTO_SHA2_256,
-+ CRYPTO_SHA2_384,
-+ CRYPTO_SHA2_512,
-+ CRYPTO_SHA2_224_HMAC,
-+ CRYPTO_ALGORITHM_ALL, /* Keep updated - see below */
-+};
-+
-+#define CRYPTO_ALGORITHM_MAX (CRYPTO_ALGORITHM_ALL - 1)
-+
-+/* Values for ciphers */
-+#define DES_BLOCK_LEN 8
-+#define DES3_BLOCK_LEN 8
-+#define RIJNDAEL128_BLOCK_LEN 16
-+#define AES_BLOCK_LEN RIJNDAEL128_BLOCK_LEN
-+#define CAMELLIA_BLOCK_LEN 16
-+#define BLOWFISH_BLOCK_LEN 8
-+#define SKIPJACK_BLOCK_LEN 8
-+#define CAST128_BLOCK_LEN 8
-+
-+/* the maximum of the above */
-+#define EALG_MAX_BLOCK_LEN 16
-+
-+/* Values for hashes/MAC */
-+#define AALG_MAX_RESULT_LEN 64
-+
-+/* maximum length of verbose alg names (depends on CRYPTO_MAX_ALG_NAME) */
-+#define CRYPTODEV_MAX_ALG_NAME 64
-+
-+#define HASH_MAX_LEN 64
-+
-+/* input of CIOCGSESSION */
-+struct session_op {
-+ /* Specify either cipher or mac
-+ */
-+ __u32 cipher; /* cryptodev_crypto_op_t */
-+ __u32 mac; /* cryptodev_crypto_op_t */
-+
-+ __u32 keylen;
-+ __u8 __user *key;
-+ __u32 mackeylen;
-+ __u8 __user *mackey;
-+
-+ __u32 ses; /* session identifier */
-+};
-+
-+struct session_info_op {
-+ __u32 ses; /* session identifier */
-+
-+ /* verbose names for the requested ciphers */
-+ struct alg_info {
-+ char cra_name[CRYPTODEV_MAX_ALG_NAME];
-+ char cra_driver_name[CRYPTODEV_MAX_ALG_NAME];
-+ } cipher_info, hash_info;
-+
-+ __u16 alignmask; /* alignment constraints */
-+ __u32 flags; /* SIOP_FLAGS_* */
-+};
-+
-+/* If this flag is set then this algorithm uses
-+ * a driver only available in kernel (software drivers,
-+ * or drivers based on instruction sets do not set this flag).
-+ *
-+ * If multiple algorithms are involved (as in AEAD case), then
-+ * if one of them is kernel-driver-only this flag will be set.
-+ */
-+#define SIOP_FLAG_KERNEL_DRIVER_ONLY 1
-+
-+#define COP_ENCRYPT 0
-+#define COP_DECRYPT 1
-+
-+/* input of CIOCCRYPT */
-+struct crypt_op {
-+ __u32 ses; /* session identifier */
-+ __u16 op; /* COP_ENCRYPT or COP_DECRYPT */
-+ __u16 flags; /* see COP_FLAG_* */
-+ __u32 len; /* length of source data */
-+ __u8 __user *src; /* source data */
-+ __u8 __user *dst; /* pointer to output data */
-+ /* pointer to output data for hash/MAC operations */
-+ __u8 __user *mac;
-+ /* initialization vector for encryption operations */
-+ __u8 __user *iv;
-+};
-+
-+/* input of CIOCAUTHCRYPT */
-+struct crypt_auth_op {
-+ __u32 ses; /* session identifier */
-+ __u16 op; /* COP_ENCRYPT or COP_DECRYPT */
-+ __u16 flags; /* see COP_FLAG_AEAD_* */
-+ __u32 len; /* length of source data */
-+ __u32 auth_len; /* length of auth data */
-+ __u8 __user *auth_src; /* authenticated-only data */
-+
-+ /* The current implementation is more efficient if data are
-+ * encrypted in-place (src==dst). */
-+ __u8 __user *src; /* data to be encrypted and authenticated */
-+ __u8 __user *dst; /* pointer to output data. Must have
-+ * space for tag. For TLS this should be at least
-+ * len + tag_size + block_size for padding */
-+
-+ __u8 __user *tag; /* where the tag will be copied to. TLS mode
-+ * doesn't use that as tag is copied to dst.
-+ * SRTP mode copies tag there. */
-+ __u32 tag_len; /* the length of the tag. Use zero for digest size or max tag. */
-+
-+ /* initialization vector for encryption operations */
-+ __u8 __user *iv;
-+ __u32 iv_len;
-+};
-+
-+/* In plain AEAD mode the following are required:
-+ * flags : 0
-+ * iv : the initialization vector (12 bytes)
-+ * auth_len: the length of the data to be authenticated
-+ * auth_src: the data to be authenticated
-+ * len : length of data to be encrypted
-+ * src : the data to be encrypted
-+ * dst : space to hold encrypted data. It must have
-+ * at least a size of len + tag_size.
-+ * tag_size: the size of the desired authentication tag or zero to use
-+ * the maximum tag output.
-+ *
-+ * Note tag isn't being used because the Linux AEAD interface
-+ * copies the tag just after data.
-+ */
-+
-+/* In TLS mode (used for CBC ciphers that required padding)
-+ * the following are required:
-+ * flags : COP_FLAG_AEAD_TLS_TYPE
-+ * iv : the initialization vector
-+ * auth_len: the length of the data to be authenticated only
-+ * len : length of data to be encrypted
-+ * auth_src: the data to be authenticated
-+ * src : the data to be encrypted
-+ * dst : space to hold encrypted data (preferably in-place). It must have
-+ * at least a size of len + tag_size + blocksize.
-+ * tag_size: the size of the desired authentication tag or zero to use
-+ * the default mac output.
-+ *
-+ * Note that the padding used is the minimum padding.
-+ */
-+
-+/* In SRTP mode the following are required:
-+ * flags : COP_FLAG_AEAD_SRTP_TYPE
-+ * iv : the initialization vector
-+ * auth_len: the length of the data to be authenticated. This must
-+ * include the SRTP header + SRTP payload (data to be encrypted) + rest
-+ *
-+ * len : length of data to be encrypted
-+ * auth_src: pointer the data to be authenticated. Should point at the same buffer as src.
-+ * src : pointer to the data to be encrypted.
-+ * dst : This is mandatory to be the same as src (in-place only).
-+ * tag_size: the size of the desired authentication tag or zero to use
-+ * the default mac output.
-+ * tag : Pointer to an address where the authentication tag will be copied.
-+ */
-+
-+
-+/* struct crypt_op flags */
-+
-+#define COP_FLAG_NONE (0 << 0) /* totally no flag */
-+#define COP_FLAG_UPDATE (1 << 0) /* multi-update hash mode */
-+#define COP_FLAG_FINAL (1 << 1) /* multi-update final hash mode */
-+#define COP_FLAG_WRITE_IV (1 << 2) /* update the IV during operation */
-+#define COP_FLAG_NO_ZC (1 << 3) /* do not zero-copy */
-+#define COP_FLAG_AEAD_TLS_TYPE (1 << 4) /* authenticate and encrypt using the
-+ * TLS protocol rules */
-+#define COP_FLAG_AEAD_SRTP_TYPE (1 << 5) /* authenticate and encrypt using the
-+ * SRTP protocol rules */
-+#define COP_FLAG_RESET (1 << 6) /* multi-update reset the state.
-+ * should be used in combination
-+ * with COP_FLAG_UPDATE */
-+
-+
-+/* Stuff for bignum arithmetic and public key
-+ * cryptography - not supported yet by linux
-+ * cryptodev.
-+ */
-+
-+#define CRYPTO_ALG_FLAG_SUPPORTED 1
-+#define CRYPTO_ALG_FLAG_RNG_ENABLE 2
-+#define CRYPTO_ALG_FLAG_DSA_SHA 4
-+
-+struct crparam {
-+ __u8 *crp_p;
-+ __u32 crp_nbits;
-+};
-+
-+#define CRK_MAXPARAM 8
-+
-+/* input of CIOCKEY */
-+struct crypt_kop {
-+ __u32 crk_op; /* cryptodev_crk_ot_t */
-+ __u32 crk_status;
-+ __u16 crk_iparams;
-+ __u16 crk_oparams;
-+ __u32 crk_pad1;
-+ struct crparam crk_param[CRK_MAXPARAM];
-+};
-+
-+enum cryptodev_crk_op_t {
-+ CRK_MOD_EXP = 0,
-+ CRK_MOD_EXP_CRT = 1,
-+ CRK_DSA_SIGN = 2,
-+ CRK_DSA_VERIFY = 3,
-+ CRK_DH_COMPUTE_KEY = 4,
-+ CRK_ALGORITHM_ALL
-+};
-+
-+#define CRK_ALGORITHM_MAX (CRK_ALGORITHM_ALL-1)
-+
-+/* features to be queried with CIOCASYMFEAT ioctl
-+ */
-+#define CRF_MOD_EXP (1 << CRK_MOD_EXP)
-+#define CRF_MOD_EXP_CRT (1 << CRK_MOD_EXP_CRT)
-+#define CRF_DSA_SIGN (1 << CRK_DSA_SIGN)
-+#define CRF_DSA_VERIFY (1 << CRK_DSA_VERIFY)
-+#define CRF_DH_COMPUTE_KEY (1 << CRK_DH_COMPUTE_KEY)
-+
-+
-+/* ioctl's. Compatible with old linux cryptodev.h
-+ */
-+#define CRIOGET _IOWR('c', 101, __u32)
-+#define CIOCGSESSION _IOWR('c', 102, struct session_op)
-+#define CIOCFSESSION _IOW('c', 103, __u32)
-+#define CIOCCRYPT _IOWR('c', 104, struct crypt_op)
-+#define CIOCKEY _IOWR('c', 105, struct crypt_kop)
-+#define CIOCASYMFEAT _IOR('c', 106, __u32)
-+#define CIOCGSESSINFO _IOWR('c', 107, struct session_info_op)
-+
-+/* to indicate that CRIOGET is not required in linux
-+ */
-+#define CRIOGET_NOT_NEEDED 1
-+
-+/* additional ioctls for AEAD */
-+#define CIOCAUTHCRYPT _IOWR('c', 109, struct crypt_auth_op)
-+
-+/* additional ioctls for asynchronous operation.
-+ * These are conditionally enabled since version 1.6.
-+ */
-+#define CIOCASYNCCRYPT _IOW('c', 110, struct crypt_op)
-+#define CIOCASYNCFETCH _IOR('c', 111, struct crypt_op)
-+
-+#endif /* L_CRYPTODEV_H */
-diff -Nur openssl-1.0.1e-vanilla/crypto/engine/eng_cryptodev.c openssl-1.0.1e/crypto/engine/eng_cryptodev.c
---- openssl-1.0.1e-vanilla/crypto/engine/eng_cryptodev.c 2013-02-11 15:26:04.000000000 +0000
-+++ openssl-1.0.1e/crypto/engine/eng_cryptodev.c 2013-12-25 14:27:06.968877039 +0000
-@@ -2,6 +2,7 @@
- * Copyright (c) 2002 Bob Beck <beck(a)openbsd.org>
- * Copyright (c) 2002 Theo de Raadt
- * Copyright (c) 2002 Markus Friedl
-+ * Copyright (c) 2012 Nikos Mavrogiannopoulos
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
-@@ -74,8 +75,6 @@
- int d_fd;
-
- #ifdef USE_CRYPTODEV_DIGESTS
-- char dummy_mac_key[HASH_MAX_LEN];
--
- unsigned char digest_res[HASH_MAX_LEN];
- char *mac_data;
- int mac_len;
-@@ -157,15 +156,21 @@
- static struct {
- int id;
- int nid;
-- int keylen;
-+ int digestlen;
- } digests[] = {
-+#if 0
-+ /* HMAC is not supported */
- { CRYPTO_MD5_HMAC, NID_hmacWithMD5, 16},
- { CRYPTO_SHA1_HMAC, NID_hmacWithSHA1, 20},
-- { CRYPTO_RIPEMD160_HMAC, NID_ripemd160, 16/*?*/},
-- { CRYPTO_MD5_KPDK, NID_undef, 0},
-- { CRYPTO_SHA1_KPDK, NID_undef, 0},
-+ { CRYPTO_SHA2_256_HMAC, NID_hmacWithSHA256, 32},
-+ { CRYPTO_SHA2_384_HMAC, NID_hmacWithSHA384, 48},
-+ { CRYPTO_SHA2_512_HMAC, NID_hmacWithSHA512, 64},
-+#endif
- { CRYPTO_MD5, NID_md5, 16},
- { CRYPTO_SHA1, NID_sha1, 20},
-+ { CRYPTO_SHA2_256, NID_sha256, 32},
-+ { CRYPTO_SHA2_384, NID_sha384, 48},
-+ { CRYPTO_SHA2_512, NID_sha512, 64},
- { 0, NID_undef, 0},
- };
- #endif
-@@ -243,13 +248,14 @@
- static int nids[CRYPTO_ALGORITHM_MAX];
- struct session_op sess;
- int fd, i, count = 0;
-+ unsigned char fake_key[CRYPTO_CIPHER_MAX_KEY_LEN];
-
- if ((fd = get_dev_crypto()) < 0) {
- *cnids = NULL;
- return (0);
- }
- memset(&sess, 0, sizeof(sess));
-- sess.key = (caddr_t)"123456789abcdefghijklmno";
-+ sess.key = (void*)fake_key;
-
- for (i = 0; ciphers[i].id && count < CRYPTO_ALGORITHM_MAX; i++) {
- if (ciphers[i].nid == NID_undef)
-@@ -281,6 +287,7 @@
- get_cryptodev_digests(const int **cnids)
- {
- static int nids[CRYPTO_ALGORITHM_MAX];
-+ unsigned char fake_key[CRYPTO_CIPHER_MAX_KEY_LEN];
- struct session_op sess;
- int fd, i, count = 0;
-
-@@ -289,12 +296,12 @@
- return (0);
- }
- memset(&sess, 0, sizeof(sess));
-- sess.mackey = (caddr_t)"123456789abcdefghijklmno";
-+ sess.mackey = fake_key;
- for (i = 0; digests[i].id && count < CRYPTO_ALGORITHM_MAX; i++) {
- if (digests[i].nid == NID_undef)
- continue;
- sess.mac = digests[i].id;
-- sess.mackeylen = digests[i].keylen;
-+ sess.mackeylen = 8;
- sess.cipher = 0;
- if (ioctl(fd, CIOCGSESSION, &sess) != -1 &&
- ioctl(fd, CIOCFSESSION, &sess.ses) != -1)
-@@ -382,14 +389,14 @@
- cryp.ses = sess->ses;
- cryp.flags = 0;
- cryp.len = inl;
-- cryp.src = (caddr_t) in;
-- cryp.dst = (caddr_t) out;
-+ cryp.src = (void*) in;
-+ cryp.dst = (void*) out;
- cryp.mac = 0;
-
- cryp.op = ctx->encrypt ? COP_ENCRYPT : COP_DECRYPT;
-
- if (ctx->cipher->iv_len) {
-- cryp.iv = (caddr_t) ctx->iv;
-+ cryp.iv = (void*) ctx->iv;
- if (!ctx->encrypt) {
- iiv = in + inl - ctx->cipher->iv_len;
- memcpy(save_iv, iiv, ctx->cipher->iv_len);
-@@ -440,7 +447,7 @@
- if ((state->d_fd = get_dev_crypto()) < 0)
- return (0);
-
-- sess->key = (caddr_t)key;
-+ sess->key = (void*)key;
- sess->keylen = ctx->key_len;
- sess->cipher = cipher;
-
-@@ -660,18 +667,6 @@
- }
-
-
--static int
--digest_key_length(int nid)
--{
-- int i;
--
-- for (i = 0; digests[i].id; i++)
-- if (digests[i].nid == nid)
-- return digests[i].keylen;
-- return (0);
--}
--
--
- static int cryptodev_digest_init(EVP_MD_CTX *ctx)
- {
- struct dev_crypto_state *state = ctx->md_data;
-@@ -682,7 +677,6 @@
- printf("cryptodev_digest_init: Can't get digest \n");
- return (0);
- }
--
- memset(state, 0, sizeof(struct dev_crypto_state));
-
- if ((state->d_fd = get_dev_crypto()) < 0) {
-@@ -690,8 +684,8 @@
- return (0);
- }
-
-- sess->mackey = state->dummy_mac_key;
-- sess->mackeylen = digest_key_length(ctx->digest->type);
-+ sess->mackey = NULL;
-+ sess->mackeylen = 0;
- sess->mac = digest;
-
- if (ioctl(state->d_fd, CIOCGSESSION, sess) < 0) {
-@@ -707,8 +701,8 @@
- static int cryptodev_digest_update(EVP_MD_CTX *ctx, const void *data,
- size_t count)
- {
-- struct crypt_op cryp;
- struct dev_crypto_state *state = ctx->md_data;
-+ struct crypt_op cryp;
- struct session_op *sess = &state->d_sess;
-
- if (!data || state->d_fd < 0) {
-@@ -717,7 +711,7 @@
- }
-
- if (!count) {
-- return (0);
-+ return (1);
- }
-
- if (!(ctx->flags & EVP_MD_CTX_FLAG_ONESHOT)) {
-@@ -740,9 +734,9 @@
- cryp.ses = sess->ses;
- cryp.flags = 0;
- cryp.len = count;
-- cryp.src = (caddr_t) data;
-+ cryp.src = (void*) data;
- cryp.dst = NULL;
-- cryp.mac = (caddr_t) state->digest_res;
-+ cryp.mac = (void*) state->digest_res;
- if (ioctl(state->d_fd, CIOCCRYPT, &cryp) < 0) {
- printf("cryptodev_digest_update: digest failed\n");
- return (0);
-@@ -757,8 +751,6 @@
- struct dev_crypto_state *state = ctx->md_data;
- struct session_op *sess = &state->d_sess;
-
-- int ret = 1;
--
- if (!md || state->d_fd < 0) {
- printf("cryptodev_digest_final: illegal input\n");
- return(0);
-@@ -772,7 +764,7 @@
- cryp.len = state->mac_len;
- cryp.src = state->mac_data;
- cryp.dst = NULL;
-- cryp.mac = (caddr_t)md;
-+ cryp.mac = (void*)md;
- if (ioctl(state->d_fd, CIOCCRYPT, &cryp) < 0) {
- printf("cryptodev_digest_final: digest failed\n");
- return (0);
-@@ -783,7 +775,7 @@
-
- memcpy(md, state->digest_res, ctx->digest->md_size);
-
-- return (ret);
-+ return 1;
- }
-
-
-@@ -835,8 +827,8 @@
-
- digest = digest_nid_to_cryptodev(to->digest->type);
-
-- sess->mackey = dstate->dummy_mac_key;
-- sess->mackeylen = digest_key_length(to->digest->type);
-+ sess->mackey = NULL;
-+ sess->mackeylen = 0;
- sess->mac = digest;
-
- dstate->d_fd = get_dev_crypto();
-@@ -861,34 +853,117 @@
- }
-
-
--const EVP_MD cryptodev_sha1 = {
-+static const EVP_MD cryptodev_sha1 = {
- NID_sha1,
-- NID_undef,
-+ NID_sha1WithRSAEncryption,
- SHA_DIGEST_LENGTH,
-+#if defined(EVP_MD_FLAG_PKEY_METHOD_SIGNATURE) && defined(EVP_MD_FLAG_DIGALGID_ABSENT)
-+ EVP_MD_FLAG_PKEY_METHOD_SIGNATURE|
-+ EVP_MD_FLAG_DIGALGID_ABSENT|
-+#endif
- EVP_MD_FLAG_ONESHOT,
- cryptodev_digest_init,
- cryptodev_digest_update,
- cryptodev_digest_final,
- cryptodev_digest_copy,
- cryptodev_digest_cleanup,
-- EVP_PKEY_NULL_method,
-+ EVP_PKEY_RSA_method,
- SHA_CBLOCK,
-- sizeof(struct dev_crypto_state),
-+ sizeof(EVP_MD *)+sizeof(struct dev_crypto_state),
-+};
-+
-+static const EVP_MD cryptodev_sha256 = {
-+ NID_sha256,
-+ NID_sha256WithRSAEncryption,
-+ SHA256_DIGEST_LENGTH,
-+#if defined(EVP_MD_FLAG_PKEY_METHOD_SIGNATURE) && defined(EVP_MD_FLAG_DIGALGID_ABSENT)
-+ EVP_MD_FLAG_PKEY_METHOD_SIGNATURE|
-+ EVP_MD_FLAG_DIGALGID_ABSENT|
-+#endif
-+ EVP_MD_FLAG_ONESHOT,
-+ cryptodev_digest_init,
-+ cryptodev_digest_update,
-+ cryptodev_digest_final,
-+ cryptodev_digest_copy,
-+ cryptodev_digest_cleanup,
-+ EVP_PKEY_RSA_method,
-+ SHA256_CBLOCK,
-+ sizeof(EVP_MD *)+sizeof(struct dev_crypto_state),
-+};
-+static const EVP_MD cryptodev_sha224 = {
-+ NID_sha224,
-+ NID_sha224WithRSAEncryption,
-+ SHA224_DIGEST_LENGTH,
-+#if defined(EVP_MD_FLAG_PKEY_METHOD_SIGNATURE) && defined(EVP_MD_FLAG_DIGALGID_ABSENT)
-+ EVP_MD_FLAG_PKEY_METHOD_SIGNATURE|
-+ EVP_MD_FLAG_DIGALGID_ABSENT|
-+#endif
-+ EVP_MD_FLAG_ONESHOT,
-+ cryptodev_digest_init,
-+ cryptodev_digest_update,
-+ cryptodev_digest_final,
-+ cryptodev_digest_copy,
-+ cryptodev_digest_cleanup,
-+ EVP_PKEY_RSA_method,
-+ SHA256_CBLOCK,
-+ sizeof(EVP_MD *)+sizeof(struct dev_crypto_state),
-+};
-+
-+static const EVP_MD cryptodev_sha384 = {
-+ NID_sha384,
-+ NID_sha384WithRSAEncryption,
-+ SHA384_DIGEST_LENGTH,
-+#if defined(EVP_MD_FLAG_PKEY_METHOD_SIGNATURE) && defined(EVP_MD_FLAG_DIGALGID_ABSENT)
-+ EVP_MD_FLAG_PKEY_METHOD_SIGNATURE|
-+ EVP_MD_FLAG_DIGALGID_ABSENT|
-+#endif
-+ EVP_MD_FLAG_ONESHOT,
-+ cryptodev_digest_init,
-+ cryptodev_digest_update,
-+ cryptodev_digest_final,
-+ cryptodev_digest_copy,
-+ cryptodev_digest_cleanup,
-+ EVP_PKEY_RSA_method,
-+ SHA512_CBLOCK,
-+ sizeof(EVP_MD *)+sizeof(struct dev_crypto_state),
-+};
-+
-+static const EVP_MD cryptodev_sha512 = {
-+ NID_sha512,
-+ NID_sha512WithRSAEncryption,
-+ SHA512_DIGEST_LENGTH,
-+#if defined(EVP_MD_FLAG_PKEY_METHOD_SIGNATURE) && defined(EVP_MD_FLAG_DIGALGID_ABSENT)
-+ EVP_MD_FLAG_PKEY_METHOD_SIGNATURE|
-+ EVP_MD_FLAG_DIGALGID_ABSENT|
-+#endif
-+ EVP_MD_FLAG_ONESHOT,
-+ cryptodev_digest_init,
-+ cryptodev_digest_update,
-+ cryptodev_digest_final,
-+ cryptodev_digest_copy,
-+ cryptodev_digest_cleanup,
-+ EVP_PKEY_RSA_method,
-+ SHA512_CBLOCK,
-+ sizeof(EVP_MD *)+sizeof(struct dev_crypto_state),
- };
-
--const EVP_MD cryptodev_md5 = {
-+static const EVP_MD cryptodev_md5 = {
- NID_md5,
-- NID_undef,
-+ NID_md5WithRSAEncryption,
- 16 /* MD5_DIGEST_LENGTH */,
-+#if defined(EVP_MD_FLAG_PKEY_METHOD_SIGNATURE) && defined(EVP_MD_FLAG_DIGALGID_ABSENT)
-+ EVP_MD_FLAG_PKEY_METHOD_SIGNATURE|
-+ EVP_MD_FLAG_DIGALGID_ABSENT|
-+#endif
- EVP_MD_FLAG_ONESHOT,
- cryptodev_digest_init,
- cryptodev_digest_update,
- cryptodev_digest_final,
- cryptodev_digest_copy,
- cryptodev_digest_cleanup,
-- EVP_PKEY_NULL_method,
-+ EVP_PKEY_RSA_method,
- 64 /* MD5_CBLOCK */,
-- sizeof(struct dev_crypto_state),
-+ sizeof(EVP_MD *)+sizeof(struct dev_crypto_state),
- };
-
- #endif /* USE_CRYPTODEV_DIGESTS */
-@@ -909,6 +984,18 @@
- case NID_sha1:
- *digest = &cryptodev_sha1;
- break;
-+ case NID_sha224:
-+ *digest = &cryptodev_sha224;
-+ break;
-+ case NID_sha256:
-+ *digest = &cryptodev_sha256;
-+ break;
-+ case NID_sha384:
-+ *digest = &cryptodev_sha384;
-+ break;
-+ case NID_sha512:
-+ *digest = &cryptodev_sha512;
-+ break;
- default:
- #endif /* USE_CRYPTODEV_DIGESTS */
- *digest = NULL;
-@@ -940,7 +1027,7 @@
- return (1);
- memset(b, 0, bytes);
-
-- crp->crp_p = (caddr_t) b;
-+ crp->crp_p = (void*) b;
- crp->crp_nbits = bits;
-
- for (i = 0, j = 0; i < a->top; i++) {
-@@ -1193,7 +1280,7 @@
- kop.crk_op = CRK_DSA_SIGN;
-
- /* inputs: dgst dsa->p dsa->q dsa->g dsa->priv_key */
-- kop.crk_param[0].crp_p = (caddr_t)dgst;
-+ kop.crk_param[0].crp_p = (void*)dgst;
- kop.crk_param[0].crp_nbits = dlen * 8;
- if (bn2crparam(dsa->p, &kop.crk_param[1]))
- goto err;
-@@ -1233,7 +1320,7 @@
- kop.crk_op = CRK_DSA_VERIFY;
-
- /* inputs: dgst dsa->p dsa->q dsa->g dsa->pub_key sig->r sig->s */
-- kop.crk_param[0].crp_p = (caddr_t)dgst;
-+ kop.crk_param[0].crp_p = (void*)dgst;
- kop.crk_param[0].crp_nbits = dlen * 8;
- if (bn2crparam(dsa->p, &kop.crk_param[1]))
- goto err;
-@@ -1311,9 +1398,10 @@
- goto err;
- kop.crk_iparams = 3;
-
-- kop.crk_param[3].crp_p = (caddr_t) key;
-- kop.crk_param[3].crp_nbits = keylen * 8;
-+ kop.crk_param[3].crp_p = (void*) key;
-+ kop.crk_param[3].crp_nbits = keylen;
- kop.crk_oparams = 1;
-+ dhret = keylen/8;
-
- if (ioctl(fd, CIOCKEY, &kop) == -1) {
- const DH_METHOD *meth = DH_OpenSSL();
-@@ -1385,7 +1473,7 @@
- put_dev_crypto(fd);
-
- if (!ENGINE_set_id(engine, "cryptodev") ||
-- !ENGINE_set_name(engine, "BSD cryptodev engine") ||
-+ !ENGINE_set_name(engine, "cryptodev engine") ||
- !ENGINE_set_ciphers(engine, cryptodev_engine_ciphers) ||
- !ENGINE_set_digests(engine, cryptodev_engine_digests) ||
- !ENGINE_set_ctrl_function(engine, cryptodev_ctrl) ||
diff --git a/src/patches/openssl-1.0.1e-fix_parallel_build-1.patch b/src/patches/openssl-1.0.1e-fix_parallel_build-1.patch
deleted file mode 100644
index 855e4fe..0000000
--- a/src/patches/openssl-1.0.1e-fix_parallel_build-1.patch
+++ /dev/null
@@ -1,340 +0,0 @@
-Submitted By: Armin K. <krejzi at email dot com>
-Date: 2013-05-05
-Initial Package Version: 1.0.1e
-Upstream Status: Unknown
-Origin: https://github.com/Alexpux/Qt-builds/tree/master/patches/openssl
-Description: Fixes build with make -jx, where x is greater than 1.
-
---- a/crypto/Makefile 2013-02-11 16:26:04.000000000 +0100
-+++ b/crypto/Makefile 2013-05-05 20:06:34.872208113 +0200
-@@ -86,11 +86,11 @@
- @if [ -z "$(THIS)" ]; then $(MAKE) -f $(TOP)/Makefile reflect THIS=$@; fi
-
- subdirs:
-- @target=all; $(RECURSIVE_MAKE)
-+ +@target=all; $(RECURSIVE_MAKE)
-
- files:
- $(PERL) $(TOP)/util/files.pl Makefile >> $(TOP)/MINFO
-- @target=files; $(RECURSIVE_MAKE)
-+ +@target=files; $(RECURSIVE_MAKE)
-
- links:
- @$(PERL) $(TOP)/util/mklink.pl ../include/openssl $(EXHEADER)
-@@ -101,7 +101,7 @@
- # lib: $(LIB): are splitted to avoid end-less loop
- lib: $(LIB)
- @touch lib
--$(LIB): $(LIBOBJ)
-+$(LIB): $(LIBOBJ) | subdirs
- $(AR) $(LIB) $(LIBOBJ)
- [ -z "$(FIPSLIBDIR)" ] || $(AR) $(LIB) $(FIPSLIBDIR)fipscanister.o
- $(RANLIB) $(LIB) || echo Never mind.
-@@ -112,7 +112,7 @@
- fi
-
- libs:
-- @target=lib; $(RECURSIVE_MAKE)
-+ +@target=lib; $(RECURSIVE_MAKE)
-
- install:
- @[ -n "$(INSTALLTOP)" ] # should be set by top Makefile...
-@@ -121,7 +121,7 @@
- (cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \
- chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i ); \
- done;
-- @target=install; $(RECURSIVE_MAKE)
-+ +@target=install; $(RECURSIVE_MAKE)
-
- lint:
- @target=lint; $(RECURSIVE_MAKE)
---- a/engines/Makefile 2013-02-11 16:26:04.000000000 +0100
-+++ b/engines/Makefile 2013-05-05 20:06:34.872208113 +0200
-@@ -72,7 +72,7 @@
-
- all: lib subdirs
-
--lib: $(LIBOBJ)
-+lib: $(LIBOBJ) | subdirs
- @if [ -n "$(SHARED_LIBS)" ]; then \
- set -e; \
- for l in $(LIBNAMES); do \
-@@ -89,7 +89,7 @@
-
- subdirs:
- echo $(EDIRS)
-- @target=all; $(RECURSIVE_MAKE)
-+ +@target=all; $(RECURSIVE_MAKE)
-
- files:
- $(PERL) $(TOP)/util/files.pl Makefile >> $(TOP)/MINFO
-@@ -128,7 +128,7 @@
- mv -f $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$$pfx$$l$$sfx.new $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$$pfx$$l$$sfx ); \
- done; \
- fi
-- @target=install; $(RECURSIVE_MAKE)
-+ +@target=install; $(RECURSIVE_MAKE)
-
- tags:
- ctags $(SRC)
---- a/Makefile.org 2013-02-11 16:26:04.000000000 +0100
-+++ b/Makefile.org 2013-05-05 20:06:34.862207917 +0200
-@@ -273,17 +273,17 @@
- build_libs: build_crypto build_ssl build_engines
-
- build_crypto:
-- @dir=crypto; target=all; $(BUILD_ONE_CMD)
--build_ssl:
-- @dir=ssl; target=all; $(BUILD_ONE_CMD)
--build_engines:
-- @dir=engines; target=all; $(BUILD_ONE_CMD)
--build_apps:
-- @dir=apps; target=all; $(BUILD_ONE_CMD)
--build_tests:
-- @dir=test; target=all; $(BUILD_ONE_CMD)
--build_tools:
-- @dir=tools; target=all; $(BUILD_ONE_CMD)
-+ +@dir=crypto; target=all; $(BUILD_ONE_CMD)
-+build_ssl: build_crypto
-+ +@dir=ssl; target=all; $(BUILD_ONE_CMD)
-+build_engines: build_crypto
-+ +@dir=engines; target=all; $(BUILD_ONE_CMD)
-+build_apps: build_libs
-+ +@dir=apps; target=all; $(BUILD_ONE_CMD)
-+build_tests: build_libs
-+ +@dir=test; target=all; $(BUILD_ONE_CMD)
-+build_tools: build_libs
-+ +@dir=tools; target=all; $(BUILD_ONE_CMD)
-
- all_testapps: build_libs build_testapps
- build_testapps:
-@@ -537,9 +537,9 @@
- dist_pem_h:
- (cd crypto/pem; $(MAKE) -e $(BUILDENV) pem.h; $(MAKE) clean)
-
--install: all install_docs install_sw
-+install: install_docs install_sw
-
--install_sw:
-+install_dirs:
- @$(PERL) $(TOP)/util/mkdir-p.pl $(INSTALL_PREFIX)$(INSTALLTOP)/bin \
- $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR) \
- $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines \
-@@ -548,12 +548,19 @@
- $(INSTALL_PREFIX)$(OPENSSLDIR)/misc \
- $(INSTALL_PREFIX)$(OPENSSLDIR)/certs \
- $(INSTALL_PREFIX)$(OPENSSLDIR)/private
-+ @$(PERL) $(TOP)/util/mkdir-p.pl \
-+ $(INSTALL_PREFIX)$(MANDIR)/man1 \
-+ $(INSTALL_PREFIX)$(MANDIR)/man3 \
-+ $(INSTALL_PREFIX)$(MANDIR)/man5 \
-+ $(INSTALL_PREFIX)$(MANDIR)/man7
-+
-+install_sw: install_dirs
- @set -e; headerlist="$(EXHEADER)"; for i in $$headerlist;\
- do \
- (cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \
- chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i ); \
- done;
-- @set -e; target=install; $(RECURSIVE_BUILD_CMD)
-+ +@set -e; target=install; $(RECURSIVE_BUILD_CMD)
- @set -e; liblist="$(LIBS)"; for i in $$liblist ;\
- do \
- if [ -f "$$i" ]; then \
-@@ -633,12 +640,7 @@
- done; \
- done
-
--install_docs:
-- @$(PERL) $(TOP)/util/mkdir-p.pl \
-- $(INSTALL_PREFIX)$(MANDIR)/man1 \
-- $(INSTALL_PREFIX)$(MANDIR)/man3 \
-- $(INSTALL_PREFIX)$(MANDIR)/man5 \
-- $(INSTALL_PREFIX)$(MANDIR)/man7
-+install_docs: install_dirs
- @pod2man="`cd ./util; ./pod2mantest $(PERL)`"; \
- here="`pwd`"; \
- filecase=; \
---- a/Makefile.shared 2013-02-11 16:26:04.000000000 +0100
-+++ b/Makefile.shared 2013-05-05 20:06:34.872208113 +0200
-@@ -105,6 +105,7 @@
- SHAREDFLAGS="$${SHAREDFLAGS:-$(CFLAGS) $(SHARED_LDFLAGS)}"; \
- LIBPATH=`for x in $$LIBDEPS; do echo $$x; done | sed -e 's/^ *-L//;t' -e d | uniq`; \
- LIBPATH=`echo $$LIBPATH | sed -e 's/ /:/g'`; \
-+ [ -e $$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX ] && exit 0; \
- LD_LIBRARY_PATH=$$LIBPATH:$$LD_LIBRARY_PATH \
- $${SHAREDCMD} $${SHAREDFLAGS} \
- -o $$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX \
-@@ -122,6 +123,7 @@
- done; \
- fi; \
- if [ -n "$$SHLIB_SOVER" ]; then \
-+ [ -e "$$SHLIB$$SHLIB_SUFFIX" ] || \
- ( $(SET_X); rm -f $$SHLIB$$SHLIB_SUFFIX; \
- ln -s $$prev $$SHLIB$$SHLIB_SUFFIX ); \
- fi; \
---- a/test/Makefile 2013-02-11 16:26:04.000000000 +0100
-+++ b/test/Makefile 2013-05-05 20:06:34.872208113 +0200
-@@ -124,7 +124,7 @@
- tags:
- ctags $(SRC)
-
--tests: exe apps $(TESTS)
-+tests: exe $(TESTS)
-
- apps:
- @(cd ..; $(MAKE) DIRS=apps all)
-@@ -365,109 +365,109 @@
- link_app.$${shlib_target}
-
- $(RSATEST)$(EXE_EXT): $(RSATEST).o $(DLIBCRYPTO)
-- @target=$(RSATEST); $(BUILD_CMD)
-+ +@target=$(RSATEST); $(BUILD_CMD)
-
- $(BNTEST)$(EXE_EXT): $(BNTEST).o $(DLIBCRYPTO)
-- @target=$(BNTEST); $(BUILD_CMD)
-+ +@target=$(BNTEST); $(BUILD_CMD)
-
- $(ECTEST)$(EXE_EXT): $(ECTEST).o $(DLIBCRYPTO)
-- @target=$(ECTEST); $(BUILD_CMD)
-+ +@target=$(ECTEST); $(BUILD_CMD)
-
- $(EXPTEST)$(EXE_EXT): $(EXPTEST).o $(DLIBCRYPTO)
-- @target=$(EXPTEST); $(BUILD_CMD)
-+ +@target=$(EXPTEST); $(BUILD_CMD)
-
- $(IDEATEST)$(EXE_EXT): $(IDEATEST).o $(DLIBCRYPTO)
-- @target=$(IDEATEST); $(BUILD_CMD)
-+ +@target=$(IDEATEST); $(BUILD_CMD)
-
- $(MD2TEST)$(EXE_EXT): $(MD2TEST).o $(DLIBCRYPTO)
-- @target=$(MD2TEST); $(BUILD_CMD)
-+ +@target=$(MD2TEST); $(BUILD_CMD)
-
- $(SHATEST)$(EXE_EXT): $(SHATEST).o $(DLIBCRYPTO)
-- @target=$(SHATEST); $(BUILD_CMD)
-+ +@target=$(SHATEST); $(BUILD_CMD)
-
- $(SHA1TEST)$(EXE_EXT): $(SHA1TEST).o $(DLIBCRYPTO)
-- @target=$(SHA1TEST); $(BUILD_CMD)
-+ +@target=$(SHA1TEST); $(BUILD_CMD)
-
- $(SHA256TEST)$(EXE_EXT): $(SHA256TEST).o $(DLIBCRYPTO)
-- @target=$(SHA256TEST); $(BUILD_CMD)
-+ +@target=$(SHA256TEST); $(BUILD_CMD)
-
- $(SHA512TEST)$(EXE_EXT): $(SHA512TEST).o $(DLIBCRYPTO)
-- @target=$(SHA512TEST); $(BUILD_CMD)
-+ +@target=$(SHA512TEST); $(BUILD_CMD)
-
- $(RMDTEST)$(EXE_EXT): $(RMDTEST).o $(DLIBCRYPTO)
-- @target=$(RMDTEST); $(BUILD_CMD)
-+ +@target=$(RMDTEST); $(BUILD_CMD)
-
- $(MDC2TEST)$(EXE_EXT): $(MDC2TEST).o $(DLIBCRYPTO)
-- @target=$(MDC2TEST); $(BUILD_CMD)
-+ +@target=$(MDC2TEST); $(BUILD_CMD)
-
- $(MD4TEST)$(EXE_EXT): $(MD4TEST).o $(DLIBCRYPTO)
-- @target=$(MD4TEST); $(BUILD_CMD)
-+ +@target=$(MD4TEST); $(BUILD_CMD)
-
- $(MD5TEST)$(EXE_EXT): $(MD5TEST).o $(DLIBCRYPTO)
-- @target=$(MD5TEST); $(BUILD_CMD)
-+ +@target=$(MD5TEST); $(BUILD_CMD)
-
- $(HMACTEST)$(EXE_EXT): $(HMACTEST).o $(DLIBCRYPTO)
-- @target=$(HMACTEST); $(BUILD_CMD)
-+ +@target=$(HMACTEST); $(BUILD_CMD)
-
- $(WPTEST)$(EXE_EXT): $(WPTEST).o $(DLIBCRYPTO)
-- @target=$(WPTEST); $(BUILD_CMD)
-+ +@target=$(WPTEST); $(BUILD_CMD)
-
- $(RC2TEST)$(EXE_EXT): $(RC2TEST).o $(DLIBCRYPTO)
-- @target=$(RC2TEST); $(BUILD_CMD)
-+ +@target=$(RC2TEST); $(BUILD_CMD)
-
- $(BFTEST)$(EXE_EXT): $(BFTEST).o $(DLIBCRYPTO)
-- @target=$(BFTEST); $(BUILD_CMD)
-+ +@target=$(BFTEST); $(BUILD_CMD)
-
- $(CASTTEST)$(EXE_EXT): $(CASTTEST).o $(DLIBCRYPTO)
-- @target=$(CASTTEST); $(BUILD_CMD)
-+ +@target=$(CASTTEST); $(BUILD_CMD)
-
- $(RC4TEST)$(EXE_EXT): $(RC4TEST).o $(DLIBCRYPTO)
-- @target=$(RC4TEST); $(BUILD_CMD)
-+ +@target=$(RC4TEST); $(BUILD_CMD)
-
- $(RC5TEST)$(EXE_EXT): $(RC5TEST).o $(DLIBCRYPTO)
-- @target=$(RC5TEST); $(BUILD_CMD)
-+ +@target=$(RC5TEST); $(BUILD_CMD)
-
- $(DESTEST)$(EXE_EXT): $(DESTEST).o $(DLIBCRYPTO)
-- @target=$(DESTEST); $(BUILD_CMD)
-+ +@target=$(DESTEST); $(BUILD_CMD)
-
- $(RANDTEST)$(EXE_EXT): $(RANDTEST).o $(DLIBCRYPTO)
-- @target=$(RANDTEST); $(BUILD_CMD)
-+ +@target=$(RANDTEST); $(BUILD_CMD)
-
- $(DHTEST)$(EXE_EXT): $(DHTEST).o $(DLIBCRYPTO)
-- @target=$(DHTEST); $(BUILD_CMD)
-+ +@target=$(DHTEST); $(BUILD_CMD)
-
- $(DSATEST)$(EXE_EXT): $(DSATEST).o $(DLIBCRYPTO)
-- @target=$(DSATEST); $(BUILD_CMD)
-+ +@target=$(DSATEST); $(BUILD_CMD)
-
- $(METHTEST)$(EXE_EXT): $(METHTEST).o $(DLIBCRYPTO)
-- @target=$(METHTEST); $(BUILD_CMD)
-+ +@target=$(METHTEST); $(BUILD_CMD)
-
- $(SSLTEST)$(EXE_EXT): $(SSLTEST).o $(DLIBSSL) $(DLIBCRYPTO)
-- @target=$(SSLTEST); $(FIPS_BUILD_CMD)
-+ +@target=$(SSLTEST); $(FIPS_BUILD_CMD)
-
- $(ENGINETEST)$(EXE_EXT): $(ENGINETEST).o $(DLIBCRYPTO)
-- @target=$(ENGINETEST); $(BUILD_CMD)
-+ +@target=$(ENGINETEST); $(BUILD_CMD)
-
- $(EVPTEST)$(EXE_EXT): $(EVPTEST).o $(DLIBCRYPTO)
-- @target=$(EVPTEST); $(BUILD_CMD)
-+ +@target=$(EVPTEST); $(BUILD_CMD)
-
- $(ECDSATEST)$(EXE_EXT): $(ECDSATEST).o $(DLIBCRYPTO)
-- @target=$(ECDSATEST); $(BUILD_CMD)
-+ +@target=$(ECDSATEST); $(BUILD_CMD)
-
- $(ECDHTEST)$(EXE_EXT): $(ECDHTEST).o $(DLIBCRYPTO)
-- @target=$(ECDHTEST); $(BUILD_CMD)
-+ +@target=$(ECDHTEST); $(BUILD_CMD)
-
- $(IGETEST)$(EXE_EXT): $(IGETEST).o $(DLIBCRYPTO)
-- @target=$(IGETEST); $(BUILD_CMD)
-+ +@target=$(IGETEST); $(BUILD_CMD)
-
- $(JPAKETEST)$(EXE_EXT): $(JPAKETEST).o $(DLIBCRYPTO)
-- @target=$(JPAKETEST); $(BUILD_CMD)
-+ +@target=$(JPAKETEST); $(BUILD_CMD)
-
- $(ASN1TEST)$(EXE_EXT): $(ASN1TEST).o $(DLIBCRYPTO)
-- @target=$(ASN1TEST); $(BUILD_CMD)
-+ +@target=$(ASN1TEST); $(BUILD_CMD)
-
- $(SRPTEST)$(EXE_EXT): $(SRPTEST).o $(DLIBCRYPTO)
-- @target=$(SRPTEST); $(BUILD_CMD)
-+ +@target=$(SRPTEST); $(BUILD_CMD)
-
- #$(AESTEST).o: $(AESTEST).c
- # $(CC) -c $(CFLAGS) -DINTERMEDIATE_VALUE_KAT -DTRACE_KAT_MCT $(AESTEST).c
-@@ -480,7 +480,7 @@
- # fi
-
- dummytest$(EXE_EXT): dummytest.o $(DLIBCRYPTO)
-- @target=dummytest; $(BUILD_CMD)
-+ +@target=dummytest; $(BUILD_CMD)
-
- # DO NOT DELETE THIS LINE -- make depend depends on it.
-
diff --git a/src/patches/openssl-1.0.1e-rpmbuild.patch b/src/patches/openssl-1.0.1e-rpmbuild.patch
new file mode 100644
index 0000000..3fb3c64
--- /dev/null
+++ b/src/patches/openssl-1.0.1e-rpmbuild.patch
@@ -0,0 +1,44 @@
+diff -up openssl-1.0.1e/Configure.rpmbuild openssl-1.0.1e/Configure
+--- openssl-1.0.1e/Configure.rpmbuild 2014-08-13 19:19:53.211005598 +0200
++++ openssl-1.0.1e/Configure 2014-08-13 19:29:21.704099285 +0200
+@@ -1675,7 +1676,7 @@ while (<IN>)
+ elsif ($shared_extension ne "" && $shared_extension =~ /^\.s([ol])\.[^\.]*\.[^\.]*$/)
+ {
+ my $sotmp = $1;
+- s/^SHARED_LIBS_LINK_EXTS=.*/SHARED_LIBS_LINK_EXTS=.s$sotmp.\$(SHLIB_MAJOR) .s$sotmp/;
++ s/^SHARED_LIBS_LINK_EXTS=.*/SHARED_LIBS_LINK_EXTS=.s$sotmp.\$(SHLIB_SONAMEVER) .s$sotmp/;
+ }
+ elsif ($shared_extension ne "" && $shared_extension =~ /^\.[^\.]*\.[^\.]*\.dylib$/)
+ {
+diff -up openssl-1.0.1e/Makefile.org.rpmbuild openssl-1.0.1e/Makefile.org
+--- openssl-1.0.1e/Makefile.org.rpmbuild 2013-02-11 16:26:04.000000000 +0100
++++ openssl-1.0.1e/Makefile.org 2014-08-13 19:19:53.218005759 +0200
+@@ -10,6 +10,7 @@ SHLIB_VERSION_HISTORY=
+ SHLIB_MAJOR=
+ SHLIB_MINOR=
+ SHLIB_EXT=
++SHLIB_SONAMEVER=10
+ PLATFORM=dist
+ OPTIONS=
+ CONFIGURE_ARGS=
+@@ -333,10 +334,9 @@ clean-shared:
+ link-shared:
+ @ set -e; for i in $(SHLIBDIRS); do \
+ $(MAKE) -f $(HERE)/Makefile.shared -e $(BUILDENV) \
+- LIBNAME=$$i LIBVERSION=$(SHLIB_MAJOR).$(SHLIB_MINOR) \
++ LIBNAME=$$i LIBVERSION=$(SHLIB_SONAMEVER) \
+ LIBCOMPATVERSIONS=";$(SHLIB_VERSION_HISTORY)" \
+ symlink.$(SHLIB_TARGET); \
+- libs="$$libs -l$$i"; \
+ done
+
+ build-shared: do_$(SHLIB_TARGET) link-shared
+@@ -347,7 +347,7 @@ do_$(SHLIB_TARGET):
+ libs="$(LIBKRB5) $$libs"; \
+ fi; \
+ $(CLEARENV) && $(MAKE) -f Makefile.shared -e $(BUILDENV) \
+- LIBNAME=$$i LIBVERSION=$(SHLIB_MAJOR).$(SHLIB_MINOR) \
++ LIBNAME=$$i LIBVERSION=$(SHLIB_SONAMEVER) \
+ LIBCOMPATVERSIONS=";$(SHLIB_VERSION_HISTORY)" \
+ LIBDEPS="$$libs $(EX_LIBS)" \
+ link_a.$(SHLIB_TARGET); \
diff --git a/src/patches/openssl-1.0.1e-weak-ciphers.patch b/src/patches/openssl-1.0.1e-weak-ciphers.patch
deleted file mode 100644
index 8657345..0000000
--- a/src/patches/openssl-1.0.1e-weak-ciphers.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -up openssl-1.0.1e/ssl/ssl.h.weak-ciphers openssl-1.0.1e/ssl/ssl.h
---- openssl-1.0.1e/ssl/ssl.h.weak-ciphers 2013-12-18 15:50:40.881620314 +0100
-+++ openssl-1.0.1e/ssl/ssl.h 2013-12-18 14:25:25.596566704 +0100
-@@ -331,7 +331,7 @@ extern "C" {
- /* The following cipher list is used by default.
- * It also is substituted when an application-defined cipher list string
- * starts with 'DEFAULT'. */
--#define SSL_DEFAULT_CIPHER_LIST "ALL:!aNULL:!eNULL:!SSLv2"
-+#define SSL_DEFAULT_CIPHER_LIST "ALL:!aNULL:!eNULL:!SSLv2:!EXPORT:!RC2:!DES"
- /* As of OpenSSL 1.0.0, ssl_create_cipher_list() in ssl/ssl_ciph.c always
- * starts with a reasonable order, and all we have to do for DEFAULT is
- * throwing out anonymous and unencrypted ciphersuites!
diff --git a/src/patches/openssl-1.0.1m-weak-ciphers.patch b/src/patches/openssl-1.0.1m-weak-ciphers.patch
new file mode 100644
index 0000000..f57b978
--- /dev/null
+++ b/src/patches/openssl-1.0.1m-weak-ciphers.patch
@@ -0,0 +1,11 @@
+--- openssl-1.0.1m/ssl/ssl.h.old 2015-03-19 15:25:20.646533583 +0100
++++ openssl-1.0.1m/ssl/ssl.h 2015-03-19 15:25:31.229875691 +0100
+@@ -334,7 +334,7 @@
+ * The following cipher list is used by default. It also is substituted when
+ * an application-defined cipher list string starts with 'DEFAULT'.
+ */
+-# define SSL_DEFAULT_CIPHER_LIST "ALL:!EXPORT:!aNULL:!eNULL:!SSLv2"
++# define SSL_DEFAULT_CIPHER_LIST "ALL:!EXPORT:!aNULL:!eNULL:!SSLv2:!RC2:!DES"
+ /*
+ * As of OpenSSL 1.0.0, ssl_create_cipher_list() in ssl/ssl_ciph.c always
+ * starts with a reasonable order, and all we have to do for DEFAULT is
diff --git a/src/patches/openssl-disable-sslv2-sslv3.patch b/src/patches/openssl-disable-sslv2-sslv3.patch
index ebf5429..e42dfac 100644
--- a/src/patches/openssl-disable-sslv2-sslv3.patch
+++ b/src/patches/openssl-disable-sslv2-sslv3.patch
@@ -1,13 +1,12 @@
-diff -up openssl-1.0.1h/ssl/ssl_lib.c.v2v3 openssl-1.0.1h/ssl/ssl_lib.c
---- openssl-1.0.1h/ssl/ssl_lib.c.v2v3 2014-06-11 16:02:52.000000000 +0200
-+++ openssl-1.0.1h/ssl/ssl_lib.c 2014-06-30 14:18:04.290248080 +0200
-@@ -1875,6 +1875,9 @@ SSL_CTX *SSL_CTX_new(const SSL_METHOD *m
- */
- ret->options |= SSL_OP_LEGACY_SERVER_CONNECT;
-
-+ /* Disable SSLv2 and SSLv3 by default (affects the SSLv23_method() only) */
-+ ret->options |= SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;
-+
- return(ret);
- err:
- SSLerr(SSL_F_SSL_CTX_NEW,ERR_R_MALLOC_FAILURE);
+--- openssl-1.0.1m/ssl/ssl_lib.c.old 2015-03-19 15:56:40.966287977 +0100
++++ openssl-1.0.1m/ssl/ssl_lib.c 2015-03-19 15:57:07.976160846 +0100
+@@ -1892,6 +1892,9 @@
+ */
+ ret->options |= SSL_OP_LEGACY_SERVER_CONNECT;
+
++ /* Disable SSLv2 and SSLv3 by default (affects the SSLv23_method() only) */
++ ret->options |= SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;
++
+ return (ret);
+ err:
+ SSLerr(SSL_F_SSL_CTX_NEW, ERR_R_MALLOC_FAILURE);
hooks/post-receive
--
IPFire 2.x development tree
1
0
[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 9ffd1b35db13760ceab2b396230fbc40fa03caec
by gitï¼ ipfire.org 19 Mar '15
by gitï¼ ipfire.org 19 Mar '15
19 Mar '15
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, master has been updated
via 9ffd1b35db13760ceab2b396230fbc40fa03caec (commit)
from 102825b673eaed53e2e07eda75b2341f42e479d7 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 9ffd1b35db13760ceab2b396230fbc40fa03caec
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Thu Mar 19 15:13:07 2015 +0100
openssl: Update to version 1.0.1m and 0.9.8zf
http://openssl.org/news/secadv_20150319.txt
OpenSSL Security Advisory [19 Mar 2015]
=======================================
OpenSSL 1.0.2 ClientHello sigalgs DoS (CVE-2015-0291)
=====================================================
Severity: High
If a client connects to an OpenSSL 1.0.2 server and renegotiates with an
invalid signature algorithms extension a NULL pointer dereference will occur.
This can be exploited in a DoS attack against the server.
This issue affects OpenSSL version: 1.0.2
OpenSSL 1.0.2 users should upgrade to 1.0.2a.
This issue was was reported to OpenSSL on 26th February 2015 by David Ramos
of Stanford University. The fix was developed by Stephen Henson and Matt
Caswell of the OpenSSL development team.
Reclassified: RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204)
============================================================================
Severity: High
This security issue was previously announced by the OpenSSL project and
classified as "low" severity. This severity rating has now been changed to
"high".
This was classified low because it was originally thought that server RSA
export ciphersuite support was rare: a client was only vulnerable to a MITM
attack against a server which supports an RSA export ciphersuite. Recent
studies have shown that RSA export ciphersuites support is far more common.
This issue affects OpenSSL versions: 1.0.1, 1.0.0 and 0.9.8.
OpenSSL 1.0.1 users should upgrade to 1.0.1k.
OpenSSL 1.0.0 users should upgrade to 1.0.0p.
OpenSSL 0.9.8 users should upgrade to 0.9.8zd.
This issue was reported to OpenSSL on 22nd October 2014 by Karthikeyan
Bhargavan of the PROSECCO team at INRIA. The fix was developed by Stephen
Henson of the OpenSSL core team. It was previously announced in the OpenSSL
security advisory on 8th January 2015.
Multiblock corrupted pointer (CVE-2015-0290)
============================================
Severity: Moderate
OpenSSL 1.0.2 introduced the "multiblock" performance improvement. This feature
only applies on 64 bit x86 architecture platforms that support AES NI
instructions. A defect in the implementation of "multiblock" can cause OpenSSL's
internal write buffer to become incorrectly set to NULL when using non-blocking
IO. Typically, when the user application is using a socket BIO for writing, this
will only result in a failed connection. However if some other BIO is used then
it is likely that a segmentation fault will be triggered, thus enabling a
potential DoS attack.
This issue affects OpenSSL version: 1.0.2
OpenSSL 1.0.2 users should upgrade to 1.0.2a.
This issue was reported to OpenSSL on 13th February 2015 by Daniel Danner and
Rainer Mueller. The fix was developed by Matt Caswell of the OpenSSL development
team.
Segmentation fault in DTLSv1_listen (CVE-2015-0207)
===================================================
Severity: Moderate
The DTLSv1_listen function is intended to be stateless and processes the initial
ClientHello from many peers. It is common for user code to loop over the call to
DTLSv1_listen until a valid ClientHello is received with an associated cookie. A
defect in the implementation of DTLSv1_listen means that state is preserved in
the SSL object from one invocation to the next that can lead to a segmentation
fault. Errors processing the initial ClientHello can trigger this scenario. An
example of such an error could be that a DTLS1.0 only client is attempting to
connect to a DTLS1.2 only server.
This issue affects OpenSSL version: 1.0.2
OpenSSL 1.0.2 DTLS users should upgrade to 1.0.2a.
This issue was reported to OpenSSL on 27th January 2015 by Per Allansson. The
fix was developed by Matt Caswell of the OpenSSL development team.
Segmentation fault in ASN1_TYPE_cmp (CVE-2015-0286)
===================================================
Severity: Moderate
The function ASN1_TYPE_cmp will crash with an invalid read if an attempt is
made to compare ASN.1 boolean types. Since ASN1_TYPE_cmp is used to check
certificate signature algorithm consistency this can be used to crash any
certificate verification operation and exploited in a DoS attack. Any
application which performs certificate verification is vulnerable including
OpenSSL clients and servers which enable client authentication.
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8.
OpenSSL 1.0.2 users should upgrade to 1.0.2a
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
This issue was discovered and fixed by Stephen Henson of the OpenSSL
development team.
Segmentation fault for invalid PSS parameters (CVE-2015-0208)
=============================================================
Severity: Moderate
The signature verification routines will crash with a NULL pointer
dereference if presented with an ASN.1 signature using the RSA PSS
algorithm and invalid parameters. Since these routines are used to verify
certificate signature algorithms this can be used to crash any
certificate verification operation and exploited in a DoS attack. Any
application which performs certificate verification is vulnerable including
OpenSSL clients and servers which enable client authentication.
This issue affects OpenSSL version: 1.0.2
OpenSSL 1.0.2 users should upgrade to 1.0.2a
This issue was was reported to OpenSSL on 31st January 2015 by Brian Carpenter
and a fix developed by Stephen Henson of the OpenSSL development team.
ASN.1 structure reuse memory corruption (CVE-2015-0287)
=======================================================
Severity: Moderate
Reusing a structure in ASN.1 parsing may allow an attacker to cause
memory corruption via an invalid write. Such reuse is and has been
strongly discouraged and is believed to be rare.
Applications that parse structures containing CHOICE or ANY DEFINED BY
components may be affected. Certificate parsing (d2i_X509 and related
functions) are however not affected. OpenSSL clients and servers are
not affected.
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0
and 0.9.8.
OpenSSL 1.0.2 users should upgrade to 1.0.2a
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
This issue was discovered by Emilia Käsper and a fix developed by
Stephen Henson of the OpenSSL development team.
PKCS7 NULL pointer dereferences (CVE-2015-0289)
===============================================
Severity: Moderate
The PKCS#7 parsing code does not handle missing outer ContentInfo correctly.
An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with
missing content and trigger a NULL pointer dereference on parsing.
Applications that verify PKCS#7 signatures, decrypt PKCS#7 data or
otherwise parse PKCS#7 structures from untrusted sources are
affected. OpenSSL clients and servers are not affected.
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0
and 0.9.8.
OpenSSL 1.0.2 users should upgrade to 1.0.2a
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
This issue was reported to OpenSSL on February 16th 2015 by Michal
Zalewski (Google) and a fix developed by Emilia Käsper of the OpenSSL
development team.
Base64 decode (CVE-2015-0292)
=============================
Severity: Moderate
A vulnerability existed in previous versions of OpenSSL related to the
processing of base64 encoded data. Any code path that reads base64 data from an
untrusted source could be affected (such as the PEM processing routines).
Maliciously crafted base 64 data could trigger a segmenation fault or memory
corruption. This was addressed in previous versions of OpenSSL but has not been
included in any security advisory until now.
This issue affects OpenSSL versions: 1.0.1, 1.0.0 and 0.9.8.
OpenSSL 1.0.1 users should upgrade to 1.0.1h.
OpenSSL 1.0.0 users should upgrade to 1.0.0m.
OpenSSL 0.9.8 users should upgrade to 0.9.8za.
The fix for this issue can be identified by commits d0666f289a (1.0.1),
84fe686173 (1.0.0) and 9febee0272 (0.9.8). This issue was originally reported by
Robert Dugal and subsequently by David Ramos.
DoS via reachable assert in SSLv2 servers (CVE-2015-0293)
=========================================================
Severity: Moderate
A malicious client can trigger an OPENSSL_assert (i.e., an abort) in
servers that both support SSLv2 and enable export cipher suites by sending
a specially crafted SSLv2 CLIENT-MASTER-KEY message.
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0
and 0.9.8.
OpenSSL 1.0.2 users should upgrade to 1.0.2a
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
This issue was discovered by Sean Burford (Google) and Emilia Käsper
(OpenSSL development team) in March 2015 and the fix was developed by
Emilia Käsper.
Empty CKE with client auth and DHE (CVE-2015-1787)
==================================================
Severity: Moderate
If client auth is used then a server can seg fault in the event of a DHE
ciphersuite being selected and a zero length ClientKeyExchange message being
sent by the client. This could be exploited in a DoS attack.
This issue affects OpenSSL version: 1.0.2
OpenSSL 1.0.2 users should upgrade to 1.0.2a.
This issue was discovered and the fix was developed by Matt Caswell of the
OpenSSL development team.
Handshake with unseeded PRNG (CVE-2015-0285)
============================================
Severity: Low
Under certain conditions an OpenSSL 1.0.2 client can complete a handshake with
an unseeded PRNG. The conditions are:
- The client is on a platform where the PRNG has not been seeded automatically,
and the user has not seeded manually
- A protocol specific client method version has been used (i.e. not
SSL_client_methodv23)
- A ciphersuite is used that does not require additional random data from the
PRNG beyond the initial ClientHello client random (e.g. PSK-RC4-SHA).
If the handshake succeeds then the client random that has been used will have
been generated from a PRNG with insufficient entropy and therefore the output
may be predictable.
For example using the following command with an unseeded openssl will succeed on
an unpatched platform:
openssl s_client -psk 1a2b3c4d -tls1_2 -cipher PSK-RC4-SHA
This issue affects OpenSSL version: 1.0.2
OpenSSL 1.0.2 users should upgrade to 1.0.2a.
This issue was discovered and the fix was developed by Matt Caswell of the
OpenSSL development team.
Use After Free following d2i_ECPrivatekey error (CVE-2015-0209)
===============================================================
Severity: Low
A malformed EC private key file consumed via the d2i_ECPrivateKey function could
cause a use after free condition. This, in turn, could cause a double
free in several private key parsing functions (such as d2i_PrivateKey
or EVP_PKCS82PKEY) and could lead to a DoS attack or memory corruption
for applications that receive EC private keys from untrusted
sources. This scenario is considered rare.
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8.
OpenSSL 1.0.2 users should upgrade to 1.0.2a
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
This issue was discovered by the BoringSSL project and fixed in their commit
517073cd4b. The OpenSSL fix was developed by Matt Caswell of the OpenSSL
development team.
X509_to_X509_REQ NULL pointer deref (CVE-2015-0288)
===================================================
Severity: Low
The function X509_to_X509_REQ will crash with a NULL pointer dereference if
the certificate key is invalid. This function is rarely used in practice.
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0
and 0.9.8.
OpenSSL 1.0.2 users should upgrade to 1.0.2a
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
This issue was discovered by Brian Carpenter and a fix developed by Stephen
Henson of the OpenSSL development team.
Note
====
As per our previous announcements and our Release Strategy
(https://www.openssl.org/about/releasestrat.html), support for OpenSSL versions
1.0.0 and 0.9.8 will cease on 31st December 2015. No security updates for these
releases will be provided after that date. Users of these releases are advised
to upgrade.
References
==========
URL for this Security Advisory:
https://www.openssl.org/news/secadv_20150319.txt
Note: the online version of the advisory may be updated with additional
details over time.
For details of OpenSSL severity classifications please see:
https://www.openssl.org/about/secpolicy.html
-----------------------------------------------------------------------
Summary of changes:
lfs/openssl | 4 ++--
lfs/openssl-compat | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
Difference in files:
diff --git a/lfs/openssl b/lfs/openssl
index df068f3..efc7236 100644
--- a/lfs/openssl
+++ b/lfs/openssl
@@ -24,7 +24,7 @@
include Config
-VER = 1.0.1k
+VER = 1.0.1m
THISAPP = openssl-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -51,7 +51,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_MD5 = d4f002bd22a56881340105028842ae1f
+$(DL_FILE)_MD5 = d143d1555d842a069cb7cc34ba745a06
install : $(TARGET)
diff --git a/lfs/openssl-compat b/lfs/openssl-compat
index 8e22a34..8206d33 100644
--- a/lfs/openssl-compat
+++ b/lfs/openssl-compat
@@ -24,7 +24,7 @@
include Config
-VER = 0.9.8zd
+VER = 0.9.8zf
THISAPP = openssl-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_MD5 = e9b9ee12f2911e1a378e2458d9bfff77
+$(DL_FILE)_MD5 = c69a4a679233f7df189e1ad6659511ec
install : $(TARGET)
hooks/post-receive
--
IPFire 2.x development tree
1
0
[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 102825b673eaed53e2e07eda75b2341f42e479d7
by gitï¼ ipfire.org 18 Mar '15
by gitï¼ ipfire.org 18 Mar '15
18 Mar '15
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, master has been updated
via 102825b673eaed53e2e07eda75b2341f42e479d7 (commit)
from 13ed354420129239911bd9ec3229957caf8a7fd5 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 102825b673eaed53e2e07eda75b2341f42e479d7
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Wed Mar 18 15:51:37 2015 +0100
openssh: Update to version 6.8p1
-----------------------------------------------------------------------
Summary of changes:
lfs/openssh | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
Difference in files:
diff --git a/lfs/openssh b/lfs/openssh
index bc6fa3c..d8f337b 100644
--- a/lfs/openssh
+++ b/lfs/openssh
@@ -24,7 +24,7 @@
include Config
-VER = 6.6p1
+VER = 6.8p1
THISAPP = openssh-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_MD5 = 3e9800e6bca1fbac0eea4d41baa7f239
+$(DL_FILE)_MD5 = 08f72de6751acfbd0892b5f003922701
install : $(TARGET)
hooks/post-receive
--
IPFire 2.x development tree
1
0
[git.ipfire.org] IPFire 2.x development tree branch, next, updated. c3c2e81c6fd50e102b10891c980e515d1bb072a0
by gitï¼ ipfire.org 18 Mar '15
by gitï¼ ipfire.org 18 Mar '15
18 Mar '15
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, next has been updated
via c3c2e81c6fd50e102b10891c980e515d1bb072a0 (commit)
via 261121f1dff82f158289368bafedc9a1c89e9261 (commit)
from 3847730c176a3ff5a710ec5400d13c35f8d16fd1 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit c3c2e81c6fd50e102b10891c980e515d1bb072a0
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Wed Mar 18 15:51:37 2015 +0100
openssh: Update to version 6.8p1
commit 261121f1dff82f158289368bafedc9a1c89e9261
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Wed Mar 18 15:18:14 2015 +0100
Remove some left-over files
-----------------------------------------------------------------------
Summary of changes:
config/backup/includes/esniper | 5 -----
config/httpd/vhosts.d/esniper.conf | 22 ----------------------
config/httpd/vhosts.d/phpaj.conf | 16 ----------------
lfs/openssh | 4 ++--
4 files changed, 2 insertions(+), 45 deletions(-)
delete mode 100644 config/backup/includes/esniper
delete mode 100644 config/httpd/vhosts.d/esniper.conf
delete mode 100644 config/httpd/vhosts.d/phpaj.conf
Difference in files:
diff --git a/config/backup/includes/esniper b/config/backup/includes/esniper
deleted file mode 100644
index 14434aa..0000000
--- a/config/backup/includes/esniper
+++ /dev/null
@@ -1,5 +0,0 @@
-/srv/web/esniper/.htaccess
-/srv/web/esniper/.config.php
-/srv/web/esniper/.config.state.php
-/srv/web/esniper/local/
-/srv/web/esniper/.run/
diff --git a/config/httpd/vhosts.d/esniper.conf b/config/httpd/vhosts.d/esniper.conf
deleted file mode 100644
index e1c4dd4..0000000
--- a/config/httpd/vhosts.d/esniper.conf
+++ /dev/null
@@ -1,22 +0,0 @@
-Listen 1006
-
-<VirtualHost *:1006>
-
- SSLEngine on
- SSLProtocol all -SSLv2
- SSLCipherSuite ALL:!ADH:!EXPORT56:!eNULL:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW:+EXP
- SSLCertificateFile /etc/httpd/server.crt
- SSLCertificateKeyFile /etc/httpd/server.key
-
- DocumentRoot /srv/web/esniper
-
- Include /etc/httpd/conf/conf.d/php*.conf
-
- <Directory /srv/web/esniper>
- Options None
- AllowOverride None
- Order allow,deny
- Allow from all
- </Directory>
-
-</VirtualHost>
diff --git a/config/httpd/vhosts.d/phpaj.conf b/config/httpd/vhosts.d/phpaj.conf
deleted file mode 100644
index a6b764e..0000000
--- a/config/httpd/vhosts.d/phpaj.conf
+++ /dev/null
@@ -1,16 +0,0 @@
-Listen 1002
-
-<VirtualHost *:1002>
-
- DocumentRoot /srv/web/phpaj
-
- Include /etc/httpd/conf/conf.d/php*.conf
-
- <Directory /srv/web/phpaj>
- Options None
- AllowOverride None
- Order allow,deny
- Allow from all
- </Directory>
-
-</VirtualHost>
diff --git a/lfs/openssh b/lfs/openssh
index bc6fa3c..d8f337b 100644
--- a/lfs/openssh
+++ b/lfs/openssh
@@ -24,7 +24,7 @@
include Config
-VER = 6.6p1
+VER = 6.8p1
THISAPP = openssh-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_MD5 = 3e9800e6bca1fbac0eea4d41baa7f239
+$(DL_FILE)_MD5 = 08f72de6751acfbd0892b5f003922701
install : $(TARGET)
hooks/post-receive
--
IPFire 2.x development tree
1
0
[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 13ed354420129239911bd9ec3229957caf8a7fd5
by gitï¼ ipfire.org 17 Mar '15
by gitï¼ ipfire.org 17 Mar '15
17 Mar '15
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, master has been updated
via 13ed354420129239911bd9ec3229957caf8a7fd5 (commit)
from 0fbf41404c75702d73b5234c6dde210c346ae0e6 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 13ed354420129239911bd9ec3229957caf8a7fd5
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Tue Mar 17 22:23:13 2015 +0100
fireinfo: Forbid string "Serial"
-----------------------------------------------------------------------
Summary of changes:
.../{oldcore/87 => core/88}/filelists/fireinfo | 0
lfs/fireinfo | 1 +
...info-Add-an-other-forbidden-string-Serial.patch | 25 ++++++++++++++++++++++
3 files changed, 26 insertions(+)
copy config/rootfiles/{oldcore/87 => core/88}/filelists/fireinfo (100%)
create mode 100644 src/patches/fireinfo-Add-an-other-forbidden-string-Serial.patch
Difference in files:
diff --git a/config/rootfiles/core/88/filelists/fireinfo b/config/rootfiles/core/88/filelists/fireinfo
new file mode 120000
index 0000000..c461155
--- /dev/null
+++ b/config/rootfiles/core/88/filelists/fireinfo
@@ -0,0 +1 @@
+../../../common/fireinfo
\ No newline at end of file
diff --git a/lfs/fireinfo b/lfs/fireinfo
index 3295388..e63bdc8 100644
--- a/lfs/fireinfo
+++ b/lfs/fireinfo
@@ -70,6 +70,7 @@ $(subst %,%_MD5,$(objects)) :
$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
@$(PREBUILD)
@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/fireinfo-Add-an-other-forbidden-string-Serial.patch
cd $(DIR_APP) && [ -x "configure" ] || sh ./autogen.sh
cd $(DIR_APP) && ./configure --prefix=/usr
diff --git a/src/patches/fireinfo-Add-an-other-forbidden-string-Serial.patch b/src/patches/fireinfo-Add-an-other-forbidden-string-Serial.patch
new file mode 100644
index 0000000..d710852
--- /dev/null
+++ b/src/patches/fireinfo-Add-an-other-forbidden-string-Serial.patch
@@ -0,0 +1,25 @@
+From edacae4b2cdc41f1c0bfc93e041532ff6c49f60c Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Tue, 17 Mar 2015 22:19:17 +0100
+Subject: [PATCH] Add an other forbidden string: "Serial"
+
+---
+ src/fireinfo/system.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/fireinfo/system.py b/src/fireinfo/system.py
+index daf77b399d20..9d7872822b85 100644
+--- a/src/fireinfo/system.py
++++ b/src/fireinfo/system.py
+@@ -45,7 +45,7 @@ INVALID_ID_STRINGS = (
+ "EVAL",
+ "Not Applicable",
+ "None", "empty",
+- "System Serial Number",
++ "Serial", "System Serial Number",
+ "XXXXX",
+ "01010101-0101-0101-0101-010101010101",
+ "00020003-0004-0005-0006-000700080009",
+--
+2.1.0
+
hooks/post-receive
--
IPFire 2.x development tree
1
0
[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 3847730c176a3ff5a710ec5400d13c35f8d16fd1
by gitï¼ ipfire.org 17 Mar '15
by gitï¼ ipfire.org 17 Mar '15
17 Mar '15
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, next has been updated
via 3847730c176a3ff5a710ec5400d13c35f8d16fd1 (commit)
via 6f49ea2ea269b1ef456f7594f67296fd86776dc5 (commit)
via 07f0e777f015303f1921f4d7e582890e8268563a (commit)
via d4ce4207ce49701b70a60114a1777e75118c9aa4 (commit)
via 2f2b5105c47db6b8b9ec42e2bbfa28d967fe1178 (commit)
via 1342aaf8dd0a0c55d960817e88cac5d379029054 (commit)
via a8fda3e94150bc3087e09b141b5f2c73721a4517 (commit)
via b339fb7f142ac96d440b0951728d194f0c2a5fc2 (commit)
via 32470b20b1728075af1bc641a38b98bb51e8d2b8 (commit)
via d478b830bb792256fad7ae821101bbb7099d1f90 (commit)
via adb742c03b962b013233789cd8799090bca0b8ab (commit)
via 6e9fc7b868c52a6d2991d9878e1e96a7eb1eb4b4 (commit)
via 23a42d00de983ba50f1caecbb0719e2d4fdefbc9 (commit)
via 3db2633165c196c0ae4537199596201b940e71eb (commit)
via 53103ab55c63eda3cd302c9b8af743429b62726c (commit)
via 535e2ce295d8fb2d27c743ebe560e7e3b9a5e35b (commit)
via 1e6f74df8923eb09455248fd5940996f02cc7202 (commit)
via 3672decfa350c29b4ce5da3f0932286cae7164f2 (commit)
via c1e9ba671ef74ad305067e4d82e81bcd3b5863a2 (commit)
via 899a422790a6fc56a7eeaf5070332232af0d6879 (commit)
via 2b7fe21aa71ff782dc36e0400cc3367d2f106e47 (commit)
via d5781436789241a7891dbdd80d4b256c76d9aedf (commit)
via 8996f5a3bb3f6daa9df6190042bb0927d5f5b470 (commit)
via eea2501f5fe935eabd34781baff06beb7e275898 (commit)
via e0f8464866f71590e7f5c9a43a59a60e633a6c8f (commit)
via 2e7c1bcb98af17284681b86435f8f753209aa292 (commit)
via 6a71b0b013fbc0fa73319e4ed1daa34524a17a4f (commit)
via 15809a0166b58ce30d39c40603d01cc783cf8f3d (commit)
via 4acb9a1a9b8ef9e51635de6545609d3a6455dd83 (commit)
via a44790b647b40130187fdaff4cec710bbaad7ed9 (commit)
from c366dbb4337921e3e581498bc2b85f787a6913f4 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 3847730c176a3ff5a710ec5400d13c35f8d16fd1
Author: Wolfgang Apolinarski <wolfgang.apolinarski(a)uni-due.de>
Date: Sat Mar 14 15:33:35 2015 +0100
Applied patches for not using md5. Additionally, the root CA is no 4096 bits, host/clients are 2048 bits (both RSA). Openssl is now choosing the random seed automatically, removed the '-rand' parameter.
commit 6f49ea2ea269b1ef456f7594f67296fd86776dc5
Merge: 07f0e77 c366dbb
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Tue Mar 17 20:42:17 2015 +0100
Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next
commit 07f0e777f015303f1921f4d7e582890e8268563a
Merge: d4ce420 4acb9a1
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Mar 16 18:01:39 2015 +0100
Merge remote-tracking branch 'mfischer/logrotate' into next
Conflicts:
config/rootfiles/common/logrotate
commit d4ce4207ce49701b70a60114a1777e75118c9aa4
Merge: 2f2b510 535e2ce
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Mar 16 18:01:04 2015 +0100
Merge remote-tracking branch 'mfischer/logwatch' into next
commit 2f2b5105c47db6b8b9ec42e2bbfa28d967fe1178
Merge: 1342aaf d578143
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Mar 16 18:00:40 2015 +0100
Merge remote-tracking branch 'mfischer/libjpeg' into next
commit 1342aaf8dd0a0c55d960817e88cac5d379029054
Merge: a8fda3e 15809a0
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Mar 16 18:00:22 2015 +0100
Merge remote-tracking branch 'mfischer/iputils' into next
commit a8fda3e94150bc3087e09b141b5f2c73721a4517
Author: Matthias Fischer <fischerm(a)ipfire.org>
Date: Sun Feb 8 15:30:30 2015 +0100
openssl-compat: Update to 0.9.8ze
commit b339fb7f142ac96d440b0951728d194f0c2a5fc2
Merge: 32470b2 2b7fe21
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Mar 16 17:54:28 2015 +0100
Merge remote-tracking branch 'mfischer/nasm' into next
commit 32470b20b1728075af1bc641a38b98bb51e8d2b8
Merge: d478b83 eea2501
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Mar 16 17:54:07 2015 +0100
Merge remote-tracking branch 'mfischer/groff' into next
commit d478b830bb792256fad7ae821101bbb7099d1f90
Merge: adb742c 2e7c1bc
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Mar 16 17:53:50 2015 +0100
Merge remote-tracking branch 'mfischer/expat' into next
commit adb742c03b962b013233789cd8799090bca0b8ab
Merge: 6e9fc7b 899a422
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Mar 16 17:53:23 2015 +0100
Merge remote-tracking branch 'mfischer/dhcpcd' into next
commit 6e9fc7b868c52a6d2991d9878e1e96a7eb1eb4b4
Merge: 23a42d0 c1e9ba6
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Mar 16 17:53:15 2015 +0100
Merge remote-tracking branch 'mfischer/dhcp' into next
commit 23a42d00de983ba50f1caecbb0719e2d4fdefbc9
Merge: 3db2633 6a71b0b
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Mar 16 17:51:59 2015 +0100
Merge remote-tracking branch 'mfischer/curl' into next
commit 3db2633165c196c0ae4537199596201b940e71eb
Merge: 53103ab 8996f5a
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Mar 16 17:50:34 2015 +0100
Merge remote-tracking branch 'mfischer/acpid' into next
commit 53103ab55c63eda3cd302c9b8af743429b62726c
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Mar 16 16:10:03 2015 +0100
installer: Don't accept the license in unattended mode
commit 535e2ce295d8fb2d27c743ebe560e7e3b9a5e35b
Author: Matthias Fischer <fischerm(a)ipfire.org>
Date: Sun Mar 8 09:57:17 2015 +0100
logwatch: Fix symbolic link
commit 1e6f74df8923eb09455248fd5940996f02cc7202
Merge: 3672dec 5604dc7
Author: Matthias Fischer <fischerm(a)ipfire.org>
Date: Sun Mar 8 09:49:44 2015 +0100
Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into logwatch
commit 3672decfa350c29b4ce5da3f0932286cae7164f2
Author: Matthias Fischer <fischerm(a)ipfire.org>
Date: Tue Mar 3 14:11:49 2015 +0100
logwatch: Update auf 7.4.1
commit c1e9ba671ef74ad305067e4d82e81bcd3b5863a2
Author: Matthias Fischer <fischerm(a)ipfire.org>
Date: Wed Feb 18 12:47:37 2015 +0100
dhcp: Update to 4.3.1
commit 899a422790a6fc56a7eeaf5070332232af0d6879
Author: Matthias Fischer <fischerm(a)ipfire.org>
Date: Wed Feb 18 12:24:10 2015 +0100
dhcpcd: Update to 6.7.1
commit 2b7fe21aa71ff782dc36e0400cc3367d2f106e47
Author: Matthias Fischer <fischerm(a)ipfire.org>
Date: Sun Feb 8 15:04:35 2015 +0100
nasm: Update to 2.11.06
commit d5781436789241a7891dbdd80d4b256c76d9aedf
Author: Matthias Fischer <fischerm(a)ipfire.org>
Date: Sun Feb 8 14:35:49 2015 +0100
libjpeg: Update to 1.3.1
commit 8996f5a3bb3f6daa9df6190042bb0927d5f5b470
Author: Matthias Fischer <fischerm(a)ipfire.org>
Date: Sun Feb 8 14:22:03 2015 +0100
acpid: Update to 2.0.23
commit eea2501f5fe935eabd34781baff06beb7e275898
Author: Matthias Fischer <fischerm(a)ipfire.org>
Date: Sun Feb 1 17:23:28 2015 +0100
groff: Update to 1.22.3
commit e0f8464866f71590e7f5c9a43a59a60e633a6c8f
Merge: a44790b 06f451c
Author: Matthias Fischer <fischerm(a)ipfire.org>
Date: Sun Feb 1 17:22:09 2015 +0100
Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into groff
commit 2e7c1bcb98af17284681b86435f8f753209aa292
Author: Matthias Fischer <fischerm(a)ipfire.org>
Date: Sun Feb 1 17:17:32 2015 +0100
expat: Update to 2.1.0
commit 6a71b0b013fbc0fa73319e4ed1daa34524a17a4f
Author: Matthias Fischer <fischerm(a)ipfire.org>
Date: Mon Jan 19 20:16:41 2015 +0100
curl: Update to 7.40.0
commit 15809a0166b58ce30d39c40603d01cc783cf8f3d
Author: Matthias Fischer <fischerm(a)ipfire.org>
Date: Fri Dec 26 07:46:13 2014 +0100
iputils: Update to s20121221
commit 4acb9a1a9b8ef9e51635de6545609d3a6455dd83
Author: Matthias Fischer <fischerm(a)ipfire.org>
Date: Sun Dec 14 00:46:13 2014 +0100
logrotate: Update to 3.8.1
commit a44790b647b40130187fdaff4cec710bbaad7ed9
Author: Matthias Fischer <fischerm(a)ipfire.org>
Date: Tue Dec 2 18:49:07 2014 +0100
groff: Update to 1.22.3
-----------------------------------------------------------------------
Summary of changes:
config/rootfiles/common/curl | 227 ++++-
config/rootfiles/common/dhcp | 3 +-
config/rootfiles/common/dhcpcd | 5 +
config/rootfiles/common/expat | 15 +-
config/rootfiles/common/groff | 1000 +++++++++++---------
config/rootfiles/common/logrotate | 1 +
config/rootfiles/common/logwatch | 66 +-
config/ssl/openssl.cnf | 4 +-
html/cgi-bin/vpnmain.cgi | 20 +-
lfs/acpid | 6 +-
lfs/curl | 6 +-
lfs/dhcp | 65 +-
lfs/dhcpcd | 6 +-
lfs/expat | 10 +-
lfs/groff | 6 +-
lfs/iputils | 15 +-
lfs/libjpeg | 6 +-
lfs/logrotate | 6 +-
lfs/logwatch | 8 +-
lfs/nasm | 6 +-
lfs/openssl-compat | 6 +-
src/installer/main.c | 7 +-
src/patches/dhcp-4.2.0-add_timeout_when_NULL.patch | 14 -
src/patches/dhcp-4.2.0-errwarn-message.patch | 30 -
src/patches/dhcp-4.2.0-garbage-chars.patch | 12 -
src/patches/dhcp-4.2.0-inherit-leases.patch | 34 -
src/patches/dhcp-4.2.0-logpid.patch | 12 -
.../dhcp-4.2.0-missing-ipv6-not-fatal.patch | 40 -
src/patches/dhcp-4.2.0-noprefixavail.patch | 140 ---
src/patches/dhcp-4.2.1-64_bit_lease_parse.patch | 94 --
src/patches/dhcp-4.2.1-invalid-dhclient-conf.patch | 12 -
src/patches/dhcp-4.2.1-retransmission.patch | 48 -
src/patches/dhcp-4.2.2-dhclient-usage.patch | 14 -
src/patches/dhcp-4.2.2-remove-bind.patch | 149 ---
src/patches/dhcp-4.2.2-sharedlib.patch | 119 ---
src/patches/dhcp/dhcp-64_bit_lease_parse.patch | 75 ++
.../dhcp-CLOEXEC.patch} | 239 ++---
.../{dhcp-4.2.0-PPP.patch => dhcp/dhcp-PPP.patch} | 124 +--
.../dhcp-UseMulticast.patch} | 58 +-
src/patches/dhcp/dhcp-add_timeout_when_NULL.patch | 14 +
.../dhcp-capability.patch} | 165 +---
.../dhcp-default-requested-options.patch} | 8 +-
.../dhcp-dhclient-decline-backoff.patch} | 36 +-
.../dhcp-dhclient-options.patch} | 220 +++--
src/patches/dhcp/dhcp-errwarn-message.patch | 22 +
src/patches/dhcp/dhcp-garbage-chars.patch | 12 +
.../dhcp-gpxe-cid.patch} | 79 +-
.../dhcp-honor-expired.patch} | 10 +-
.../dhcp-improved-xid.patch} | 40 +-
src/patches/dhcp/dhcp-logpid.patch | 11 +
.../dhcp-lpf-ib.patch} | 277 +++---
.../dhcp-manpages.patch} | 223 ++---
src/patches/dhcp/dhcp-paranoia.patch | 156 +++
.../dhcp-paths.patch} | 11 +-
.../dhcp-release-by-ifup.patch} | 10 +-
src/patches/dhcp/dhcp-remove-bind.patch | 192 ++++
.../dhcp-rfc3442-classless-static-routes.patch} | 124 +--
.../dhcp-sendDecline.patch} | 22 +-
src/patches/dhcp/dhcp-sharedlib.patch | 107 +++
src/patches/dhcp/dhcp-stateless-DUID-LLT.patch | 48 +
.../dhcp-unicast-bootp.patch} | 32 +-
.../dhcp-xen-checksum.patch} | 90 +-
62 files changed, 2367 insertions(+), 2250 deletions(-)
delete mode 100644 src/patches/dhcp-4.2.0-add_timeout_when_NULL.patch
delete mode 100644 src/patches/dhcp-4.2.0-errwarn-message.patch
delete mode 100644 src/patches/dhcp-4.2.0-garbage-chars.patch
delete mode 100644 src/patches/dhcp-4.2.0-inherit-leases.patch
delete mode 100644 src/patches/dhcp-4.2.0-logpid.patch
delete mode 100644 src/patches/dhcp-4.2.0-missing-ipv6-not-fatal.patch
delete mode 100644 src/patches/dhcp-4.2.0-noprefixavail.patch
delete mode 100644 src/patches/dhcp-4.2.1-64_bit_lease_parse.patch
delete mode 100644 src/patches/dhcp-4.2.1-invalid-dhclient-conf.patch
delete mode 100644 src/patches/dhcp-4.2.1-retransmission.patch
delete mode 100644 src/patches/dhcp-4.2.2-dhclient-usage.patch
delete mode 100644 src/patches/dhcp-4.2.2-remove-bind.patch
delete mode 100644 src/patches/dhcp-4.2.2-sharedlib.patch
create mode 100644 src/patches/dhcp/dhcp-64_bit_lease_parse.patch
rename src/patches/{dhcp-4.2.2-CLOEXEC.patch => dhcp/dhcp-CLOEXEC.patch} (52%)
rename src/patches/{dhcp-4.2.0-PPP.patch => dhcp/dhcp-PPP.patch} (59%)
rename src/patches/{dhcp-4.2.0-UseMulticast.patch => dhcp/dhcp-UseMulticast.patch} (83%)
create mode 100644 src/patches/dhcp/dhcp-add_timeout_when_NULL.patch
rename src/patches/{dhcp-4.2.2-capability.patch => dhcp/dhcp-capability.patch} (51%)
rename src/patches/{dhcp-4.2.0-default-requested-options.patch => dhcp/dhcp-default-requested-options.patch} (81%)
rename src/patches/{dhcp-4.2.0-dhclient-decline-backoff.patch => dhcp/dhcp-dhclient-decline-backoff.patch} (58%)
rename src/patches/{dhcp-4.2.2-options.patch => dhcp/dhcp-dhclient-options.patch} (65%)
create mode 100644 src/patches/dhcp/dhcp-errwarn-message.patch
create mode 100644 src/patches/dhcp/dhcp-garbage-chars.patch
rename src/patches/{dhcp-4.2.2-gpxe-cid.patch => dhcp/dhcp-gpxe-cid.patch} (50%)
rename src/patches/{dhcp-4.2.0-honor-expired.patch => dhcp/dhcp-honor-expired.patch} (77%)
rename src/patches/{dhcp-4.2.2-improved-xid.patch => dhcp/dhcp-improved-xid.patch} (78%)
create mode 100644 src/patches/dhcp/dhcp-logpid.patch
rename src/patches/{dhcp-4.2.2-lpf-ib.patch => dhcp/dhcp-lpf-ib.patch} (67%)
rename src/patches/{dhcp-4.2.1-manpages.patch => dhcp/dhcp-manpages.patch} (53%)
create mode 100644 src/patches/dhcp/dhcp-paranoia.patch
rename src/patches/{dhcp-4.2.0-paths.patch => dhcp/dhcp-paths.patch} (72%)
rename src/patches/{dhcp-4.2.0-release-by-ifup.patch => dhcp/dhcp-release-by-ifup.patch} (88%)
create mode 100644 src/patches/dhcp/dhcp-remove-bind.patch
rename src/patches/{dhcp-4.2.2-rfc3442-classless-static-routes.patch => dhcp/dhcp-rfc3442-classless-static-routes.patch} (74%)
rename src/patches/{dhcp-4.2.1-sendDecline.patch => dhcp/dhcp-sendDecline.patch} (89%)
create mode 100644 src/patches/dhcp/dhcp-sharedlib.patch
create mode 100644 src/patches/dhcp/dhcp-stateless-DUID-LLT.patch
rename src/patches/{dhcp-4.2.0-unicast-bootp.patch => dhcp/dhcp-unicast-bootp.patch} (72%)
rename src/patches/{dhcp-4.2.2-xen-checksum.patch => dhcp/dhcp-xen-checksum.patch} (71%)
Difference in files:
diff --git a/config/rootfiles/common/curl b/config/rootfiles/common/curl
index c556751..af32dfa 100644
--- a/config/rootfiles/common/curl
+++ b/config/rootfiles/common/curl
@@ -10,7 +10,6 @@ usr/bin/curl
#usr/include/curl/multi.h
#usr/include/curl/stdcheaders.h
#usr/include/curl/typecheck-gcc.h
-#usr/include/curl/types.h
#usr/lib/libcurl.a
#usr/lib/libcurl.la
usr/lib/libcurl.so
@@ -18,9 +17,233 @@ usr/lib/libcurl.so.3
usr/lib/libcurl.so.4
usr/lib/libcurl.so.4.3.0
#usr/lib/pkgconfig/libcurl.pc
+#usr/share/aclocal/libcurl.m4
#usr/share/man/man1/curl-config.1
#usr/share/man/man1/curl.1
-#usr/share/man/man1/mk-ca-bundle.1
+#usr/share/man/man3/CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE.3
+#usr/share/man/man3/CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE.3
+#usr/share/man/man3/CURLMOPT_MAXCONNECTS.3
+#usr/share/man/man3/CURLMOPT_MAX_HOST_CONNECTIONS.3
+#usr/share/man/man3/CURLMOPT_MAX_PIPELINE_LENGTH.3
+#usr/share/man/man3/CURLMOPT_MAX_TOTAL_CONNECTIONS.3
+#usr/share/man/man3/CURLMOPT_PIPELINING.3
+#usr/share/man/man3/CURLMOPT_PIPELINING_SERVER_BL.3
+#usr/share/man/man3/CURLMOPT_PIPELINING_SITE_BL.3
+#usr/share/man/man3/CURLMOPT_SOCKETDATA.3
+#usr/share/man/man3/CURLMOPT_SOCKETFUNCTION.3
+#usr/share/man/man3/CURLMOPT_TIMERDATA.3
+#usr/share/man/man3/CURLMOPT_TIMERFUNCTION.3
+#usr/share/man/man3/CURLOPT_ACCEPTTIMEOUT_MS.3
+#usr/share/man/man3/CURLOPT_ACCEPT_ENCODING.3
+#usr/share/man/man3/CURLOPT_ADDRESS_SCOPE.3
+#usr/share/man/man3/CURLOPT_APPEND.3
+#usr/share/man/man3/CURLOPT_AUTOREFERER.3
+#usr/share/man/man3/CURLOPT_BUFFERSIZE.3
+#usr/share/man/man3/CURLOPT_CAINFO.3
+#usr/share/man/man3/CURLOPT_CAPATH.3
+#usr/share/man/man3/CURLOPT_CERTINFO.3
+#usr/share/man/man3/CURLOPT_CHUNK_BGN_FUNCTION.3
+#usr/share/man/man3/CURLOPT_CHUNK_DATA.3
+#usr/share/man/man3/CURLOPT_CHUNK_END_FUNCTION.3
+#usr/share/man/man3/CURLOPT_CLOSESOCKETDATA.3
+#usr/share/man/man3/CURLOPT_CLOSESOCKETFUNCTION.3
+#usr/share/man/man3/CURLOPT_CONNECTTIMEOUT.3
+#usr/share/man/man3/CURLOPT_CONNECTTIMEOUT_MS.3
+#usr/share/man/man3/CURLOPT_CONNECT_ONLY.3
+#usr/share/man/man3/CURLOPT_CONV_FROM_NETWORK_FUNCTION.3
+#usr/share/man/man3/CURLOPT_CONV_FROM_UTF8_FUNCTION.3
+#usr/share/man/man3/CURLOPT_CONV_TO_NETWORK_FUNCTION.3
+#usr/share/man/man3/CURLOPT_COOKIE.3
+#usr/share/man/man3/CURLOPT_COOKIEFILE.3
+#usr/share/man/man3/CURLOPT_COOKIEJAR.3
+#usr/share/man/man3/CURLOPT_COOKIELIST.3
+#usr/share/man/man3/CURLOPT_COOKIESESSION.3
+#usr/share/man/man3/CURLOPT_COPYPOSTFIELDS.3
+#usr/share/man/man3/CURLOPT_CRLF.3
+#usr/share/man/man3/CURLOPT_CRLFILE.3
+#usr/share/man/man3/CURLOPT_CUSTOMREQUEST.3
+#usr/share/man/man3/CURLOPT_DEBUGDATA.3
+#usr/share/man/man3/CURLOPT_DEBUGFUNCTION.3
+#usr/share/man/man3/CURLOPT_DIRLISTONLY.3
+#usr/share/man/man3/CURLOPT_DNS_CACHE_TIMEOUT.3
+#usr/share/man/man3/CURLOPT_DNS_INTERFACE.3
+#usr/share/man/man3/CURLOPT_DNS_LOCAL_IP4.3
+#usr/share/man/man3/CURLOPT_DNS_LOCAL_IP6.3
+#usr/share/man/man3/CURLOPT_DNS_SERVERS.3
+#usr/share/man/man3/CURLOPT_DNS_USE_GLOBAL_CACHE.3
+#usr/share/man/man3/CURLOPT_EGDSOCKET.3
+#usr/share/man/man3/CURLOPT_ERRORBUFFER.3
+#usr/share/man/man3/CURLOPT_EXPECT_100_TIMEOUT_MS.3
+#usr/share/man/man3/CURLOPT_FAILONERROR.3
+#usr/share/man/man3/CURLOPT_FILETIME.3
+#usr/share/man/man3/CURLOPT_FNMATCH_DATA.3
+#usr/share/man/man3/CURLOPT_FNMATCH_FUNCTION.3
+#usr/share/man/man3/CURLOPT_FOLLOWLOCATION.3
+#usr/share/man/man3/CURLOPT_FORBID_REUSE.3
+#usr/share/man/man3/CURLOPT_FRESH_CONNECT.3
+#usr/share/man/man3/CURLOPT_FTPPORT.3
+#usr/share/man/man3/CURLOPT_FTPSSLAUTH.3
+#usr/share/man/man3/CURLOPT_FTP_ACCOUNT.3
+#usr/share/man/man3/CURLOPT_FTP_ALTERNATIVE_TO_USER.3
+#usr/share/man/man3/CURLOPT_FTP_CREATE_MISSING_DIRS.3
+#usr/share/man/man3/CURLOPT_FTP_FILEMETHOD.3
+#usr/share/man/man3/CURLOPT_FTP_RESPONSE_TIMEOUT.3
+#usr/share/man/man3/CURLOPT_FTP_SKIP_PASV_IP.3
+#usr/share/man/man3/CURLOPT_FTP_SSL_CCC.3
+#usr/share/man/man3/CURLOPT_FTP_USE_EPRT.3
+#usr/share/man/man3/CURLOPT_FTP_USE_EPSV.3
+#usr/share/man/man3/CURLOPT_FTP_USE_PRET.3
+#usr/share/man/man3/CURLOPT_GSSAPI_DELEGATION.3
+#usr/share/man/man3/CURLOPT_HEADER.3
+#usr/share/man/man3/CURLOPT_HEADERDATA.3
+#usr/share/man/man3/CURLOPT_HEADERFUNCTION.3
+#usr/share/man/man3/CURLOPT_HEADEROPT.3
+#usr/share/man/man3/CURLOPT_HTTP200ALIASES.3
+#usr/share/man/man3/CURLOPT_HTTPAUTH.3
+#usr/share/man/man3/CURLOPT_HTTPGET.3
+#usr/share/man/man3/CURLOPT_HTTPHEADER.3
+#usr/share/man/man3/CURLOPT_HTTPPOST.3
+#usr/share/man/man3/CURLOPT_HTTPPROXYTUNNEL.3
+#usr/share/man/man3/CURLOPT_HTTP_CONTENT_DECODING.3
+#usr/share/man/man3/CURLOPT_HTTP_TRANSFER_DECODING.3
+#usr/share/man/man3/CURLOPT_HTTP_VERSION.3
+#usr/share/man/man3/CURLOPT_IGNORE_CONTENT_LENGTH.3
+#usr/share/man/man3/CURLOPT_INFILESIZE.3
+#usr/share/man/man3/CURLOPT_INFILESIZE_LARGE.3
+#usr/share/man/man3/CURLOPT_INTERFACE.3
+#usr/share/man/man3/CURLOPT_INTERLEAVEDATA.3
+#usr/share/man/man3/CURLOPT_INTERLEAVEFUNCTION.3
+#usr/share/man/man3/CURLOPT_IOCTLDATA.3
+#usr/share/man/man3/CURLOPT_IOCTLFUNCTION.3
+#usr/share/man/man3/CURLOPT_IPRESOLVE.3
+#usr/share/man/man3/CURLOPT_ISSUERCERT.3
+#usr/share/man/man3/CURLOPT_KEYPASSWD.3
+#usr/share/man/man3/CURLOPT_KRBLEVEL.3
+#usr/share/man/man3/CURLOPT_LOCALPORT.3
+#usr/share/man/man3/CURLOPT_LOCALPORTRANGE.3
+#usr/share/man/man3/CURLOPT_LOGIN_OPTIONS.3
+#usr/share/man/man3/CURLOPT_LOW_SPEED_LIMIT.3
+#usr/share/man/man3/CURLOPT_LOW_SPEED_TIME.3
+#usr/share/man/man3/CURLOPT_MAIL_AUTH.3
+#usr/share/man/man3/CURLOPT_MAIL_FROM.3
+#usr/share/man/man3/CURLOPT_MAIL_RCPT.3
+#usr/share/man/man3/CURLOPT_MAXCONNECTS.3
+#usr/share/man/man3/CURLOPT_MAXFILESIZE.3
+#usr/share/man/man3/CURLOPT_MAXFILESIZE_LARGE.3
+#usr/share/man/man3/CURLOPT_MAXREDIRS.3
+#usr/share/man/man3/CURLOPT_MAX_RECV_SPEED_LARGE.3
+#usr/share/man/man3/CURLOPT_MAX_SEND_SPEED_LARGE.3
+#usr/share/man/man3/CURLOPT_NETRC.3
+#usr/share/man/man3/CURLOPT_NETRC_FILE.3
+#usr/share/man/man3/CURLOPT_NEW_DIRECTORY_PERMS.3
+#usr/share/man/man3/CURLOPT_NEW_FILE_PERMS.3
+#usr/share/man/man3/CURLOPT_NOBODY.3
+#usr/share/man/man3/CURLOPT_NOPROGRESS.3
+#usr/share/man/man3/CURLOPT_NOPROXY.3
+#usr/share/man/man3/CURLOPT_NOSIGNAL.3
+#usr/share/man/man3/CURLOPT_OPENSOCKETDATA.3
+#usr/share/man/man3/CURLOPT_OPENSOCKETFUNCTION.3
+#usr/share/man/man3/CURLOPT_PASSWORD.3
+#usr/share/man/man3/CURLOPT_PORT.3
+#usr/share/man/man3/CURLOPT_POST.3
+#usr/share/man/man3/CURLOPT_POSTFIELDS.3
+#usr/share/man/man3/CURLOPT_POSTFIELDSIZE.3
+#usr/share/man/man3/CURLOPT_POSTFIELDSIZE_LARGE.3
+#usr/share/man/man3/CURLOPT_POSTQUOTE.3
+#usr/share/man/man3/CURLOPT_POSTREDIR.3
+#usr/share/man/man3/CURLOPT_PREQUOTE.3
+#usr/share/man/man3/CURLOPT_PRIVATE.3
+#usr/share/man/man3/CURLOPT_PROGRESSDATA.3
+#usr/share/man/man3/CURLOPT_PROGRESSFUNCTION.3
+#usr/share/man/man3/CURLOPT_PROTOCOLS.3
+#usr/share/man/man3/CURLOPT_PROXY.3
+#usr/share/man/man3/CURLOPT_PROXYAUTH.3
+#usr/share/man/man3/CURLOPT_PROXYHEADER.3
+#usr/share/man/man3/CURLOPT_PROXYPASSWORD.3
+#usr/share/man/man3/CURLOPT_PROXYPORT.3
+#usr/share/man/man3/CURLOPT_PROXYTYPE.3
+#usr/share/man/man3/CURLOPT_PROXYUSERNAME.3
+#usr/share/man/man3/CURLOPT_PROXYUSERPWD.3
+#usr/share/man/man3/CURLOPT_PROXY_TRANSFER_MODE.3
+#usr/share/man/man3/CURLOPT_PUT.3
+#usr/share/man/man3/CURLOPT_QUOTE.3
+#usr/share/man/man3/CURLOPT_RANDOM_FILE.3
+#usr/share/man/man3/CURLOPT_RANGE.3
+#usr/share/man/man3/CURLOPT_READDATA.3
+#usr/share/man/man3/CURLOPT_READFUNCTION.3
+#usr/share/man/man3/CURLOPT_REDIR_PROTOCOLS.3
+#usr/share/man/man3/CURLOPT_REFERER.3
+#usr/share/man/man3/CURLOPT_RESOLVE.3
+#usr/share/man/man3/CURLOPT_RESUME_FROM.3
+#usr/share/man/man3/CURLOPT_RESUME_FROM_LARGE.3
+#usr/share/man/man3/CURLOPT_RTSP_CLIENT_CSEQ.3
+#usr/share/man/man3/CURLOPT_RTSP_REQUEST.3
+#usr/share/man/man3/CURLOPT_RTSP_SERVER_CSEQ.3
+#usr/share/man/man3/CURLOPT_RTSP_SESSION_ID.3
+#usr/share/man/man3/CURLOPT_RTSP_STREAM_URI.3
+#usr/share/man/man3/CURLOPT_RTSP_TRANSPORT.3
+#usr/share/man/man3/CURLOPT_SASL_IR.3
+#usr/share/man/man3/CURLOPT_SEEKDATA.3
+#usr/share/man/man3/CURLOPT_SEEKFUNCTION.3
+#usr/share/man/man3/CURLOPT_SHARE.3
+#usr/share/man/man3/CURLOPT_SOCKOPTDATA.3
+#usr/share/man/man3/CURLOPT_SOCKOPTFUNCTION.3
+#usr/share/man/man3/CURLOPT_SOCKS5_GSSAPI_NEC.3
+#usr/share/man/man3/CURLOPT_SOCKS5_GSSAPI_SERVICE.3
+#usr/share/man/man3/CURLOPT_SSH_AUTH_TYPES.3
+#usr/share/man/man3/CURLOPT_SSH_HOST_PUBLIC_KEY_MD5.3
+#usr/share/man/man3/CURLOPT_SSH_KEYDATA.3
+#usr/share/man/man3/CURLOPT_SSH_KEYFUNCTION.3
+#usr/share/man/man3/CURLOPT_SSH_KNOWNHOSTS.3
+#usr/share/man/man3/CURLOPT_SSH_PRIVATE_KEYFILE.3
+#usr/share/man/man3/CURLOPT_SSH_PUBLIC_KEYFILE.3
+#usr/share/man/man3/CURLOPT_SSLCERT.3
+#usr/share/man/man3/CURLOPT_SSLCERTTYPE.3
+#usr/share/man/man3/CURLOPT_SSLENGINE.3
+#usr/share/man/man3/CURLOPT_SSLENGINE_DEFAULT.3
+#usr/share/man/man3/CURLOPT_SSLKEY.3
+#usr/share/man/man3/CURLOPT_SSLKEYTYPE.3
+#usr/share/man/man3/CURLOPT_SSLVERSION.3
+#usr/share/man/man3/CURLOPT_SSL_CIPHER_LIST.3
+#usr/share/man/man3/CURLOPT_SSL_CTX_DATA.3
+#usr/share/man/man3/CURLOPT_SSL_CTX_FUNCTION.3
+#usr/share/man/man3/CURLOPT_SSL_ENABLE_ALPN.3
+#usr/share/man/man3/CURLOPT_SSL_ENABLE_NPN.3
+#usr/share/man/man3/CURLOPT_SSL_OPTIONS.3
+#usr/share/man/man3/CURLOPT_SSL_SESSIONID_CACHE.3
+#usr/share/man/man3/CURLOPT_SSL_VERIFYHOST.3
+#usr/share/man/man3/CURLOPT_SSL_VERIFYPEER.3
+#usr/share/man/man3/CURLOPT_STDERR.3
+#usr/share/man/man3/CURLOPT_TCP_KEEPALIVE.3
+#usr/share/man/man3/CURLOPT_TCP_KEEPIDLE.3
+#usr/share/man/man3/CURLOPT_TCP_KEEPINTVL.3
+#usr/share/man/man3/CURLOPT_TCP_NODELAY.3
+#usr/share/man/man3/CURLOPT_TELNETOPTIONS.3
+#usr/share/man/man3/CURLOPT_TFTP_BLKSIZE.3
+#usr/share/man/man3/CURLOPT_TIMECONDITION.3
+#usr/share/man/man3/CURLOPT_TIMEOUT.3
+#usr/share/man/man3/CURLOPT_TIMEOUT_MS.3
+#usr/share/man/man3/CURLOPT_TIMEVALUE.3
+#usr/share/man/man3/CURLOPT_TLSAUTH_PASSWORD.3
+#usr/share/man/man3/CURLOPT_TLSAUTH_TYPE.3
+#usr/share/man/man3/CURLOPT_TLSAUTH_USERNAME.3
+#usr/share/man/man3/CURLOPT_TRANSFERTEXT.3
+#usr/share/man/man3/CURLOPT_TRANSFER_ENCODING.3
+#usr/share/man/man3/CURLOPT_UNIX_SOCKET_PATH.3
+#usr/share/man/man3/CURLOPT_UNRESTRICTED_AUTH.3
+#usr/share/man/man3/CURLOPT_UPLOAD.3
+#usr/share/man/man3/CURLOPT_URL.3
+#usr/share/man/man3/CURLOPT_USERAGENT.3
+#usr/share/man/man3/CURLOPT_USERNAME.3
+#usr/share/man/man3/CURLOPT_USERPWD.3
+#usr/share/man/man3/CURLOPT_USE_SSL.3
+#usr/share/man/man3/CURLOPT_VERBOSE.3
+#usr/share/man/man3/CURLOPT_WILDCARDMATCH.3
+#usr/share/man/man3/CURLOPT_WRITEDATA.3
+#usr/share/man/man3/CURLOPT_WRITEFUNCTION.3
+#usr/share/man/man3/CURLOPT_XFERINFODATA.3
+#usr/share/man/man3/CURLOPT_XFERINFOFUNCTION.3
+#usr/share/man/man3/CURLOPT_XOAUTH2_BEARER.3
#usr/share/man/man3/curl_easy_cleanup.3
#usr/share/man/man3/curl_easy_duphandle.3
#usr/share/man/man3/curl_easy_escape.3
diff --git a/config/rootfiles/common/dhcp b/config/rootfiles/common/dhcp
index 2c2cfee..ff225a5 100644
--- a/config/rootfiles/common/dhcp
+++ b/config/rootfiles/common/dhcp
@@ -1,6 +1,7 @@
#etc/dhcp
-#etc/dhcp/dhclient.conf
+#etc/dhcp/dhclient.conf.example
etc/dhcp/dhcpd.conf
+#etc/dhcp/dhcpd.conf.example
#usr/bin/omshell
#usr/include/dhcpctl
#usr/include/dhcpctl/dhcpctl.h
diff --git a/config/rootfiles/common/dhcpcd b/config/rootfiles/common/dhcpcd
index 3f62fc6..ffbe04a 100644
--- a/config/rootfiles/common/dhcpcd
+++ b/config/rootfiles/common/dhcpcd
@@ -1,3 +1,6 @@
+#lib/dhcpcd
+#lib/dhcpcd/dev
+#lib/dhcpcd/dev/udev.so
sbin/dhcpcd
#usr/share/man/man5/dhcpcd.conf.5
#usr/share/man/man8/dhcpcd-run-hooks.8
@@ -6,6 +9,8 @@ var/ipfire/dhcpc/dhcpcd-hooks
#var/ipfire/dhcpc/dhcpcd-hooks/01-test
#var/ipfire/dhcpc/dhcpcd-hooks/02-dump
#var/ipfire/dhcpc/dhcpcd-hooks/10-mtu
+#var/ipfire/dhcpc/dhcpcd-hooks/10-wpa_supplicant
+#var/ipfire/dhcpc/dhcpcd-hooks/15-timezone
#var/ipfire/dhcpc/dhcpcd-hooks/29-lookup-hostname
#var/ipfire/dhcpc/dhcpcd-hooks/30-hostname
#var/ipfire/dhcpc/dhcpcd-hooks/70-dhcpcd.exe
diff --git a/config/rootfiles/common/expat b/config/rootfiles/common/expat
index 17081c4..aaa8265 100644
--- a/config/rootfiles/common/expat
+++ b/config/rootfiles/common/expat
@@ -5,10 +5,11 @@
#usr/lib/libexpat.la
usr/lib/libexpat.so
usr/lib/libexpat.so.1
-usr/lib/libexpat.so.1.5.0
-#usr/man/man1/xmlwf.1
-#usr/share/doc/expat-2.0.0
-#usr/share/doc/expat-2.0.0/expat.png
-#usr/share/doc/expat-2.0.0/reference.html
-#usr/share/doc/expat-2.0.0/style.css
-#usr/share/doc/expat-2.0.0/valid-xhtml10.png
+usr/lib/libexpat.so.1.6.0
+#usr/lib/pkgconfig/expat.pc
+#usr/share/doc/expat-2.1.0
+#usr/share/doc/expat-2.1.0/expat.png
+#usr/share/doc/expat-2.1.0/reference.html
+#usr/share/doc/expat-2.1.0/style.css
+#usr/share/doc/expat-2.1.0/valid-xhtml10.png
+#usr/share/man/man1/xmlwf.1
diff --git a/config/rootfiles/common/groff b/config/rootfiles/common/groff
index c27e594..de59084 100644
--- a/config/rootfiles/common/groff
+++ b/config/rootfiles/common/groff
@@ -5,6 +5,9 @@
#usr/bin/eqn2graph
#usr/bin/gdiffmk
#usr/bin/geqn
+#usr/bin/glilypond
+#usr/bin/gperl
+#usr/bin/gpinyin
#usr/bin/grap2graph
#usr/bin/grn
#usr/bin/grodvi
@@ -13,6 +16,7 @@
#usr/bin/grog
#usr/bin/grolbp
#usr/bin/grolj4
+#usr/bin/gropdf
#usr/bin/grops
#usr/bin/grotty
#usr/bin/gtbl
@@ -23,6 +27,7 @@
#usr/bin/mmroff
#usr/bin/neqn
#usr/bin/nroff
+#usr/bin/pdfmom
#usr/bin/pdfroff
#usr/bin/pfbtops
#usr/bin/pic
@@ -42,482 +47,530 @@
#usr/bin/tfmtodit
#usr/bin/troff
#usr/lib/groff
+#usr/lib/groff/glilypond
+#usr/lib/groff/glilypond/args.pl
+#usr/lib/groff/glilypond/oop_fh.pl
+#usr/lib/groff/glilypond/subs.pl
+#usr/lib/groff/gpinyin
+#usr/lib/groff/gpinyin/subs.pl
+#usr/lib/groff/groff_opts_no_arg.txt
+#usr/lib/groff/groff_opts_with_arg.txt
#usr/lib/groff/groffer
-#usr/lib/groff/groffer/func.pl
+#usr/lib/groff/groffer/main_subs.pl
#usr/lib/groff/groffer/man.pl
-#usr/lib/groff/groffer/perl_test.pl
#usr/lib/groff/groffer/split_env.sh
+#usr/lib/groff/groffer/subs.pl
#usr/lib/groff/groffer/version.sh
+#usr/lib/groff/grog
+#usr/lib/groff/grog/subs.pl
+#usr/lib/groff/refer
#usr/lib/groff/site-tmac
-#usr/share/doc/groff-1.21
-#usr/share/doc/groff-1.21/examples
-#usr/share/doc/groff-1.21/examples/chem
-#usr/share/doc/groff-1.21/examples/chem/122
-#usr/share/doc/groff-1.21/examples/chem/122/README
-#usr/share/doc/groff-1.21/examples/chem/122/ch2a_ethyl.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch2b_benzene.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch2c_benzene_right.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch4a_stick.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch4b_methyl_acetate.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch4c_colon.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch4d_HCl.H2O.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch4e_CaSO4.2H2O.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch4f_C.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch4g_BP.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch4h_methacrylate.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch4i_cyclo.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch4j_ring4.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch4k_ring3.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch4l_vertex.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch4m_double.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch4n_triple.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch4o_aromatic.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch4p_cholestanol.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch4q_rings.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch4r_spiro.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch4s_heteroatoms.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch4t_polycyclic.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch4u_nicotine.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch4v_histidine.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch4w_lsd.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch4x_anisole.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch4y_reserpine.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch4z1_eqn_glutamic.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch4z2_text.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch5a_size.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch6a_pic.chem
-#usr/share/doc/groff-1.21/examples/chem/122/ch6b_dna.chem
-#usr/share/doc/groff-1.21/examples/chem/122/chAa_polymer.chem
-#usr/share/doc/groff-1.21/examples/chem/122/chAb_vinyl_chloro.chem
-#usr/share/doc/groff-1.21/examples/chem/122/chAc_morphine.chem
-#usr/share/doc/groff-1.21/examples/chem/122/chAd_chlorophyll.chem
-#usr/share/doc/groff-1.21/examples/chem/122/chAe_chair.chem
-#usr/share/doc/groff-1.21/examples/chem/122/chAf_arrow.chem
-#usr/share/doc/groff-1.21/examples/chem/122/chAg_circle.chem
-#usr/share/doc/groff-1.21/examples/chem/122/chAh_brackets.chem
-#usr/share/doc/groff-1.21/examples/chem/122/chAi_poly_vinyl_chloride.chem
-#usr/share/doc/groff-1.21/examples/chem/122/chBa_jump.chem
-#usr/share/doc/groff-1.21/examples/chem/122/chBb_bonds.chem
-#usr/share/doc/groff-1.21/examples/chem/122/chBc_rings.chem
-#usr/share/doc/groff-1.21/examples/chem/README
-#usr/share/doc/groff-1.21/examples/chem/atp.chem
-#usr/share/doc/groff-1.21/examples/chem/cholesterin.chem
-#usr/share/doc/groff-1.21/examples/chem/ethamivan.chem
-#usr/share/doc/groff-1.21/examples/chem/lsd.chem
-#usr/share/doc/groff-1.21/examples/chem/morphine.chem
-#usr/share/doc/groff-1.21/examples/chem/penicillin.chem
-#usr/share/doc/groff-1.21/examples/chem/reserpine.chem
-#usr/share/doc/groff-1.21/examples/gnu.eps
-#usr/share/doc/groff-1.21/examples/grnexmpl.g
-#usr/share/doc/groff-1.21/examples/grnexmpl.me
-#usr/share/doc/groff-1.21/examples/grnexmpl.ps
-#usr/share/doc/groff-1.21/examples/groff.css
-#usr/share/doc/groff-1.21/examples/hdtbl
-#usr/share/doc/groff-1.21/examples/hdtbl/chess_board.ps
-#usr/share/doc/groff-1.21/examples/hdtbl/chess_board.roff
-#usr/share/doc/groff-1.21/examples/hdtbl/col_rowspan_colors.ps
-#usr/share/doc/groff-1.21/examples/hdtbl/col_rowspan_colors.roff
-#usr/share/doc/groff-1.21/examples/hdtbl/color_boxes.ps
-#usr/share/doc/groff-1.21/examples/hdtbl/color_boxes.roff
-#usr/share/doc/groff-1.21/examples/hdtbl/color_nested_tables.ps
-#usr/share/doc/groff-1.21/examples/hdtbl/color_nested_tables.roff
-#usr/share/doc/groff-1.21/examples/hdtbl/color_table_cells.ps
-#usr/share/doc/groff-1.21/examples/hdtbl/color_table_cells.roff
-#usr/share/doc/groff-1.21/examples/hdtbl/color_transitions.ps
-#usr/share/doc/groff-1.21/examples/hdtbl/color_transitions.roff
-#usr/share/doc/groff-1.21/examples/hdtbl/common.roff
-#usr/share/doc/groff-1.21/examples/hdtbl/fonts_n.ps
-#usr/share/doc/groff-1.21/examples/hdtbl/fonts_n.roff
-#usr/share/doc/groff-1.21/examples/hdtbl/fonts_x.ps
-#usr/share/doc/groff-1.21/examples/hdtbl/fonts_x.roff
-#usr/share/doc/groff-1.21/examples/hdtbl/gnu.eps
-#usr/share/doc/groff-1.21/examples/hdtbl/mixed_pickles.ps
-#usr/share/doc/groff-1.21/examples/hdtbl/mixed_pickles.roff
-#usr/share/doc/groff-1.21/examples/hdtbl/rainbow.ps
-#usr/share/doc/groff-1.21/examples/hdtbl/rainbow.roff
-#usr/share/doc/groff-1.21/examples/hdtbl/short_reference.ps
-#usr/share/doc/groff-1.21/examples/hdtbl/short_reference.roff
-#usr/share/doc/groff-1.21/examples/mom
-#usr/share/doc/groff-1.21/examples/mom/README.txt
-#usr/share/doc/groff-1.21/examples/mom/elvis_syntax
-#usr/share/doc/groff-1.21/examples/mom/elvis_syntax.new
-#usr/share/doc/groff-1.21/examples/mom/letter.mom
-#usr/share/doc/groff-1.21/examples/mom/letter.ps
-#usr/share/doc/groff-1.21/examples/mom/penguin.ps
-#usr/share/doc/groff-1.21/examples/mom/sample_docs.mom
-#usr/share/doc/groff-1.21/examples/mom/sample_docs.ps
-#usr/share/doc/groff-1.21/examples/mom/typesetting.mom
-#usr/share/doc/groff-1.21/examples/mom/typesetting.ps
-#usr/share/doc/groff-1.21/examples/webpage.ms
-#usr/share/doc/groff-1.21/examples/webpage.ps
-#usr/share/doc/groff-1.21/html
-#usr/share/doc/groff-1.21/html/mom
-#usr/share/doc/groff-1.21/html/mom/appendices.html
-#usr/share/doc/groff-1.21/html/mom/color.html
-#usr/share/doc/groff-1.21/html/mom/cover.html
-#usr/share/doc/groff-1.21/html/mom/definitions.html
-#usr/share/doc/groff-1.21/html/mom/docelement.html
-#usr/share/doc/groff-1.21/html/mom/docprocessing.html
-#usr/share/doc/groff-1.21/html/mom/goodies.html
-#usr/share/doc/groff-1.21/html/mom/graphical.html
-#usr/share/doc/groff-1.21/html/mom/headfootpage.html
-#usr/share/doc/groff-1.21/html/mom/images.html
-#usr/share/doc/groff-1.21/html/mom/inlines.html
-#usr/share/doc/groff-1.21/html/mom/intro.html
-#usr/share/doc/groff-1.21/html/mom/letters.html
-#usr/share/doc/groff-1.21/html/mom/macrolist.html
-#usr/share/doc/groff-1.21/html/mom/rectoverso.html
-#usr/share/doc/groff-1.21/html/mom/refer.html
-#usr/share/doc/groff-1.21/html/mom/reserved.html
-#usr/share/doc/groff-1.21/html/mom/stylesheet.css
-#usr/share/doc/groff-1.21/html/mom/tables-of-contents.html
-#usr/share/doc/groff-1.21/html/mom/toc.html
-#usr/share/doc/groff-1.21/html/mom/typesetting.html
-#usr/share/doc/groff-1.21/html/mom/using.html
-#usr/share/doc/groff-1.21/meintro.me
-#usr/share/doc/groff-1.21/meintro.ps
-#usr/share/doc/groff-1.21/meref.me
-#usr/share/doc/groff-1.21/meref.ps
-#usr/share/doc/groff-1.21/pic.ms
-#usr/share/doc/groff-1.21/pic.ps
+#usr/share/doc/groff-1.22.3
+#usr/share/doc/groff-1.22.3/examples
+#usr/share/doc/groff-1.22.3/examples/chem
+#usr/share/doc/groff-1.22.3/examples/chem/122
+#usr/share/doc/groff-1.22.3/examples/chem/122/README
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch2a_ethyl.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch2b_benzene.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch2c_benzene_right.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch4a_stick.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch4b_methyl_acetate.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch4c_colon.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch4d_HCl.H2O.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch4e_CaSO4.2H2O.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch4f_C.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch4g_BP.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch4h_methacrylate.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch4i_cyclo.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch4j_ring4.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch4k_ring3.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch4l_vertex.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch4m_double.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch4n_triple.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch4o_aromatic.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch4p_cholestanol.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch4q_rings.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch4r_spiro.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch4s_heteroatoms.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch4t_polycyclic.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch4u_nicotine.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch4v_histidine.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch4w_lsd.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch4x_anisole.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch4y_reserpine.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch4z1_eqn_glutamic.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch4z2_text.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch5a_size.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch6a_pic.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/ch6b_dna.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/chAa_polymer.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/chAb_vinyl_chloro.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/chAc_morphine.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/chAd_chlorophyll.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/chAe_chair.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/chAf_arrow.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/chAg_circle.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/chAh_brackets.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/chAi_poly_vinyl_chloride.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/chBa_jump.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/chBb_bonds.chem
+#usr/share/doc/groff-1.22.3/examples/chem/122/chBc_rings.chem
+#usr/share/doc/groff-1.22.3/examples/chem/README
+#usr/share/doc/groff-1.22.3/examples/chem/atp.chem
+#usr/share/doc/groff-1.22.3/examples/chem/cholesterin.chem
+#usr/share/doc/groff-1.22.3/examples/chem/ethamivan.chem
+#usr/share/doc/groff-1.22.3/examples/chem/lsd.chem
+#usr/share/doc/groff-1.22.3/examples/chem/morphine.chem
+#usr/share/doc/groff-1.22.3/examples/chem/penicillin.chem
+#usr/share/doc/groff-1.22.3/examples/chem/reserpine.chem
+#usr/share/doc/groff-1.22.3/examples/gnu.eps
+#usr/share/doc/groff-1.22.3/examples/grnexmpl.g
+#usr/share/doc/groff-1.22.3/examples/grnexmpl.me
+#usr/share/doc/groff-1.22.3/examples/grnexmpl.ps
+#usr/share/doc/groff-1.22.3/examples/groff.css
+#usr/share/doc/groff-1.22.3/examples/hdtbl
+#usr/share/doc/groff-1.22.3/examples/hdtbl/chess_board.ps
+#usr/share/doc/groff-1.22.3/examples/hdtbl/chess_board.roff
+#usr/share/doc/groff-1.22.3/examples/hdtbl/col_rowspan_colors.ps
+#usr/share/doc/groff-1.22.3/examples/hdtbl/col_rowspan_colors.roff
+#usr/share/doc/groff-1.22.3/examples/hdtbl/color_boxes.ps
+#usr/share/doc/groff-1.22.3/examples/hdtbl/color_boxes.roff
+#usr/share/doc/groff-1.22.3/examples/hdtbl/color_nested_tables.ps
+#usr/share/doc/groff-1.22.3/examples/hdtbl/color_nested_tables.roff
+#usr/share/doc/groff-1.22.3/examples/hdtbl/color_table_cells.ps
+#usr/share/doc/groff-1.22.3/examples/hdtbl/color_table_cells.roff
+#usr/share/doc/groff-1.22.3/examples/hdtbl/color_transitions.ps
+#usr/share/doc/groff-1.22.3/examples/hdtbl/color_transitions.roff
+#usr/share/doc/groff-1.22.3/examples/hdtbl/common.roff
+#usr/share/doc/groff-1.22.3/examples/hdtbl/fonts_n.ps
+#usr/share/doc/groff-1.22.3/examples/hdtbl/fonts_n.roff
+#usr/share/doc/groff-1.22.3/examples/hdtbl/fonts_x.ps
+#usr/share/doc/groff-1.22.3/examples/hdtbl/fonts_x.roff
+#usr/share/doc/groff-1.22.3/examples/hdtbl/gnu.eps
+#usr/share/doc/groff-1.22.3/examples/hdtbl/mixed_pickles.ps
+#usr/share/doc/groff-1.22.3/examples/hdtbl/mixed_pickles.roff
+#usr/share/doc/groff-1.22.3/examples/hdtbl/rainbow.ps
+#usr/share/doc/groff-1.22.3/examples/hdtbl/rainbow.roff
+#usr/share/doc/groff-1.22.3/examples/hdtbl/short_reference.ps
+#usr/share/doc/groff-1.22.3/examples/hdtbl/short_reference.roff
+#usr/share/doc/groff-1.22.3/examples/mom
+#usr/share/doc/groff-1.22.3/examples/mom/README.txt
+#usr/share/doc/groff-1.22.3/examples/mom/elvis_syntax
+#usr/share/doc/groff-1.22.3/examples/mom/elvis_syntax.new
+#usr/share/doc/groff-1.22.3/examples/mom/letter.mom
+#usr/share/doc/groff-1.22.3/examples/mom/mom-pdf.mom
+#usr/share/doc/groff-1.22.3/examples/mom/mom.vim
+#usr/share/doc/groff-1.22.3/examples/mom/penguin.pdf
+#usr/share/doc/groff-1.22.3/examples/mom/penguin.ps
+#usr/share/doc/groff-1.22.3/examples/mom/sample_docs.mom
+#usr/share/doc/groff-1.22.3/examples/mom/typesetting.mom
+#usr/share/doc/groff-1.22.3/examples/webpage.ms
+#usr/share/doc/groff-1.22.3/examples/webpage.ps
+#usr/share/doc/groff-1.22.3/html
+#usr/share/doc/groff-1.22.3/html/mom
+#usr/share/doc/groff-1.22.3/html/mom/appendices.html
+#usr/share/doc/groff-1.22.3/html/mom/color.html
+#usr/share/doc/groff-1.22.3/html/mom/cover.html
+#usr/share/doc/groff-1.22.3/html/mom/definitions.html
+#usr/share/doc/groff-1.22.3/html/mom/docelement.html
+#usr/share/doc/groff-1.22.3/html/mom/docprocessing.html
+#usr/share/doc/groff-1.22.3/html/mom/goodies.html
+#usr/share/doc/groff-1.22.3/html/mom/graphical.html
+#usr/share/doc/groff-1.22.3/html/mom/headfootpage.html
+#usr/share/doc/groff-1.22.3/html/mom/images.html
+#usr/share/doc/groff-1.22.3/html/mom/inlines.html
+#usr/share/doc/groff-1.22.3/html/mom/intro.html
+#usr/share/doc/groff-1.22.3/html/mom/letters.html
+#usr/share/doc/groff-1.22.3/html/mom/macrolist.html
+#usr/share/doc/groff-1.22.3/html/mom/rectoverso.html
+#usr/share/doc/groff-1.22.3/html/mom/refer.html
+#usr/share/doc/groff-1.22.3/html/mom/reserved.html
+#usr/share/doc/groff-1.22.3/html/mom/stylesheet.css
+#usr/share/doc/groff-1.22.3/html/mom/tables-of-contents.html
+#usr/share/doc/groff-1.22.3/html/mom/toc.html
+#usr/share/doc/groff-1.22.3/html/mom/typesetting.html
+#usr/share/doc/groff-1.22.3/html/mom/using.html
+#usr/share/doc/groff-1.22.3/html/mom/version-2.html
+#usr/share/doc/groff-1.22.3/meintro.me
+#usr/share/doc/groff-1.22.3/meintro.ps
+#usr/share/doc/groff-1.22.3/meintro_fr.me
+#usr/share/doc/groff-1.22.3/meintro_fr.ps
+#usr/share/doc/groff-1.22.3/meref.me
+#usr/share/doc/groff-1.22.3/meref.ps
+#usr/share/doc/groff-1.22.3/pic.ms
+#usr/share/doc/groff-1.22.3/pic.ps
#usr/share/groff
-#usr/share/groff/1.21
-#usr/share/groff/1.21/eign
-#usr/share/groff/1.21/font
-#usr/share/groff/1.21/font/devascii
-#usr/share/groff/1.21/font/devascii/B
-#usr/share/groff/1.21/font/devascii/BI
-#usr/share/groff/1.21/font/devascii/DESC
-#usr/share/groff/1.21/font/devascii/I
-#usr/share/groff/1.21/font/devascii/R
-#usr/share/groff/1.21/font/devdvi
-#usr/share/groff/1.21/font/devdvi/CW
-#usr/share/groff/1.21/font/devdvi/CWEC
-#usr/share/groff/1.21/font/devdvi/CWI
-#usr/share/groff/1.21/font/devdvi/CWIEC
-#usr/share/groff/1.21/font/devdvi/CWITC
-#usr/share/groff/1.21/font/devdvi/CWTC
-#usr/share/groff/1.21/font/devdvi/DESC
-#usr/share/groff/1.21/font/devdvi/EX
-#usr/share/groff/1.21/font/devdvi/HB
-#usr/share/groff/1.21/font/devdvi/HBEC
-#usr/share/groff/1.21/font/devdvi/HBI
-#usr/share/groff/1.21/font/devdvi/HBIEC
-#usr/share/groff/1.21/font/devdvi/HBITC
-#usr/share/groff/1.21/font/devdvi/HBTC
-#usr/share/groff/1.21/font/devdvi/HI
-#usr/share/groff/1.21/font/devdvi/HIEC
-#usr/share/groff/1.21/font/devdvi/HITC
-#usr/share/groff/1.21/font/devdvi/HR
-#usr/share/groff/1.21/font/devdvi/HREC
-#usr/share/groff/1.21/font/devdvi/HRTC
-#usr/share/groff/1.21/font/devdvi/MI
-#usr/share/groff/1.21/font/devdvi/S
-#usr/share/groff/1.21/font/devdvi/SA
-#usr/share/groff/1.21/font/devdvi/SB
-#usr/share/groff/1.21/font/devdvi/SC
-#usr/share/groff/1.21/font/devdvi/TB
-#usr/share/groff/1.21/font/devdvi/TBEC
-#usr/share/groff/1.21/font/devdvi/TBI
-#usr/share/groff/1.21/font/devdvi/TBIEC
-#usr/share/groff/1.21/font/devdvi/TBITC
-#usr/share/groff/1.21/font/devdvi/TBTC
-#usr/share/groff/1.21/font/devdvi/TI
-#usr/share/groff/1.21/font/devdvi/TIEC
-#usr/share/groff/1.21/font/devdvi/TITC
-#usr/share/groff/1.21/font/devdvi/TR
-#usr/share/groff/1.21/font/devdvi/TREC
-#usr/share/groff/1.21/font/devdvi/TRTC
-#usr/share/groff/1.21/font/devdvi/generate
-#usr/share/groff/1.21/font/devdvi/generate/CompileFonts
-#usr/share/groff/1.21/font/devdvi/generate/Makefile
-#usr/share/groff/1.21/font/devdvi/generate/ec.map
-#usr/share/groff/1.21/font/devdvi/generate/msam.map
-#usr/share/groff/1.21/font/devdvi/generate/msbm.map
-#usr/share/groff/1.21/font/devdvi/generate/tc.map
-#usr/share/groff/1.21/font/devdvi/generate/texb.map
-#usr/share/groff/1.21/font/devdvi/generate/texex.map
-#usr/share/groff/1.21/font/devdvi/generate/texi.map
-#usr/share/groff/1.21/font/devdvi/generate/texmi.map
-#usr/share/groff/1.21/font/devdvi/generate/texr.map
-#usr/share/groff/1.21/font/devdvi/generate/texsy.map
-#usr/share/groff/1.21/font/devdvi/generate/textex.map
-#usr/share/groff/1.21/font/devdvi/generate/textt.map
-#usr/share/groff/1.21/font/devhtml
-#usr/share/groff/1.21/font/devhtml/B
-#usr/share/groff/1.21/font/devhtml/BI
-#usr/share/groff/1.21/font/devhtml/CB
-#usr/share/groff/1.21/font/devhtml/CBI
-#usr/share/groff/1.21/font/devhtml/CI
-#usr/share/groff/1.21/font/devhtml/CR
-#usr/share/groff/1.21/font/devhtml/DESC
-#usr/share/groff/1.21/font/devhtml/I
-#usr/share/groff/1.21/font/devhtml/R
-#usr/share/groff/1.21/font/devhtml/S
-#usr/share/groff/1.21/font/devlatin1
-#usr/share/groff/1.21/font/devlatin1/B
-#usr/share/groff/1.21/font/devlatin1/BI
-#usr/share/groff/1.21/font/devlatin1/DESC
-#usr/share/groff/1.21/font/devlatin1/I
-#usr/share/groff/1.21/font/devlatin1/R
-#usr/share/groff/1.21/font/devlbp
-#usr/share/groff/1.21/font/devlbp/CB
-#usr/share/groff/1.21/font/devlbp/CI
-#usr/share/groff/1.21/font/devlbp/CR
-#usr/share/groff/1.21/font/devlbp/DESC
-#usr/share/groff/1.21/font/devlbp/EB
-#usr/share/groff/1.21/font/devlbp/EI
-#usr/share/groff/1.21/font/devlbp/ER
-#usr/share/groff/1.21/font/devlbp/HB
-#usr/share/groff/1.21/font/devlbp/HBI
-#usr/share/groff/1.21/font/devlbp/HI
-#usr/share/groff/1.21/font/devlbp/HNB
-#usr/share/groff/1.21/font/devlbp/HNBI
-#usr/share/groff/1.21/font/devlbp/HNI
-#usr/share/groff/1.21/font/devlbp/HNR
-#usr/share/groff/1.21/font/devlbp/HR
-#usr/share/groff/1.21/font/devlbp/TB
-#usr/share/groff/1.21/font/devlbp/TBI
-#usr/share/groff/1.21/font/devlbp/TI
-#usr/share/groff/1.21/font/devlbp/TR
-#usr/share/groff/1.21/font/devlj4
-#usr/share/groff/1.21/font/devlj4/AB
-#usr/share/groff/1.21/font/devlj4/ABI
-#usr/share/groff/1.21/font/devlj4/AI
-#usr/share/groff/1.21/font/devlj4/ALBB
-#usr/share/groff/1.21/font/devlj4/ALBR
-#usr/share/groff/1.21/font/devlj4/AOB
-#usr/share/groff/1.21/font/devlj4/AOI
-#usr/share/groff/1.21/font/devlj4/AOR
-#usr/share/groff/1.21/font/devlj4/AR
-#usr/share/groff/1.21/font/devlj4/CB
-#usr/share/groff/1.21/font/devlj4/CBI
-#usr/share/groff/1.21/font/devlj4/CI
-#usr/share/groff/1.21/font/devlj4/CLARENDON
-#usr/share/groff/1.21/font/devlj4/CORONET
-#usr/share/groff/1.21/font/devlj4/CR
-#usr/share/groff/1.21/font/devlj4/DESC
-#usr/share/groff/1.21/font/devlj4/GB
-#usr/share/groff/1.21/font/devlj4/GBI
-#usr/share/groff/1.21/font/devlj4/GI
-#usr/share/groff/1.21/font/devlj4/GR
-#usr/share/groff/1.21/font/devlj4/LGB
-#usr/share/groff/1.21/font/devlj4/LGI
-#usr/share/groff/1.21/font/devlj4/LGR
-#usr/share/groff/1.21/font/devlj4/MARIGOLD
-#usr/share/groff/1.21/font/devlj4/OB
-#usr/share/groff/1.21/font/devlj4/OBI
-#usr/share/groff/1.21/font/devlj4/OI
-#usr/share/groff/1.21/font/devlj4/OR
-#usr/share/groff/1.21/font/devlj4/S
-#usr/share/groff/1.21/font/devlj4/SYMBOL
-#usr/share/groff/1.21/font/devlj4/TB
-#usr/share/groff/1.21/font/devlj4/TBI
-#usr/share/groff/1.21/font/devlj4/TI
-#usr/share/groff/1.21/font/devlj4/TNRB
-#usr/share/groff/1.21/font/devlj4/TNRBI
-#usr/share/groff/1.21/font/devlj4/TNRI
-#usr/share/groff/1.21/font/devlj4/TNRR
-#usr/share/groff/1.21/font/devlj4/TR
-#usr/share/groff/1.21/font/devlj4/UB
-#usr/share/groff/1.21/font/devlj4/UBI
-#usr/share/groff/1.21/font/devlj4/UCB
-#usr/share/groff/1.21/font/devlj4/UCBI
-#usr/share/groff/1.21/font/devlj4/UCI
-#usr/share/groff/1.21/font/devlj4/UCR
-#usr/share/groff/1.21/font/devlj4/UI
-#usr/share/groff/1.21/font/devlj4/UR
-#usr/share/groff/1.21/font/devlj4/WINGDINGS
-#usr/share/groff/1.21/font/devlj4/generate
-#usr/share/groff/1.21/font/devlj4/generate/Makefile
-#usr/share/groff/1.21/font/devlj4/generate/special.awk
-#usr/share/groff/1.21/font/devlj4/generate/special.map
-#usr/share/groff/1.21/font/devlj4/generate/symbol.map
-#usr/share/groff/1.21/font/devlj4/generate/text.map
-#usr/share/groff/1.21/font/devlj4/generate/wingdings.map
-#usr/share/groff/1.21/font/devps
-#usr/share/groff/1.21/font/devps/AB
-#usr/share/groff/1.21/font/devps/ABI
-#usr/share/groff/1.21/font/devps/AI
-#usr/share/groff/1.21/font/devps/AR
-#usr/share/groff/1.21/font/devps/BMB
-#usr/share/groff/1.21/font/devps/BMBI
-#usr/share/groff/1.21/font/devps/BMI
-#usr/share/groff/1.21/font/devps/BMR
-#usr/share/groff/1.21/font/devps/CB
-#usr/share/groff/1.21/font/devps/CBI
-#usr/share/groff/1.21/font/devps/CI
-#usr/share/groff/1.21/font/devps/CR
-#usr/share/groff/1.21/font/devps/DESC
-#usr/share/groff/1.21/font/devps/EURO
-#usr/share/groff/1.21/font/devps/HB
-#usr/share/groff/1.21/font/devps/HBI
-#usr/share/groff/1.21/font/devps/HI
-#usr/share/groff/1.21/font/devps/HNB
-#usr/share/groff/1.21/font/devps/HNBI
-#usr/share/groff/1.21/font/devps/HNI
-#usr/share/groff/1.21/font/devps/HNR
-#usr/share/groff/1.21/font/devps/HR
-#usr/share/groff/1.21/font/devps/NB
-#usr/share/groff/1.21/font/devps/NBI
-#usr/share/groff/1.21/font/devps/NI
-#usr/share/groff/1.21/font/devps/NR
-#usr/share/groff/1.21/font/devps/PB
-#usr/share/groff/1.21/font/devps/PBI
-#usr/share/groff/1.21/font/devps/PI
-#usr/share/groff/1.21/font/devps/PR
-#usr/share/groff/1.21/font/devps/S
-#usr/share/groff/1.21/font/devps/SS
-#usr/share/groff/1.21/font/devps/TB
-#usr/share/groff/1.21/font/devps/TBI
-#usr/share/groff/1.21/font/devps/TI
-#usr/share/groff/1.21/font/devps/TR
-#usr/share/groff/1.21/font/devps/ZCMI
-#usr/share/groff/1.21/font/devps/ZD
-#usr/share/groff/1.21/font/devps/ZDR
-#usr/share/groff/1.21/font/devps/download
-#usr/share/groff/1.21/font/devps/freeeuro.afm
-#usr/share/groff/1.21/font/devps/freeeuro.pfa
-#usr/share/groff/1.21/font/devps/generate
-#usr/share/groff/1.21/font/devps/generate/Makefile
-#usr/share/groff/1.21/font/devps/generate/afmname
-#usr/share/groff/1.21/font/devps/generate/dingbats.map
-#usr/share/groff/1.21/font/devps/generate/dingbats.rmap
-#usr/share/groff/1.21/font/devps/generate/lgreekmap
-#usr/share/groff/1.21/font/devps/generate/symbol.sed
-#usr/share/groff/1.21/font/devps/generate/symbolchars
-#usr/share/groff/1.21/font/devps/generate/symbolsl.afm
-#usr/share/groff/1.21/font/devps/generate/textmap
-#usr/share/groff/1.21/font/devps/prologue
-#usr/share/groff/1.21/font/devps/symbolsl.pfa
-#usr/share/groff/1.21/font/devps/text.enc
-#usr/share/groff/1.21/font/devps/zapfdr.pfa
-#usr/share/groff/1.21/font/devutf8
-#usr/share/groff/1.21/font/devutf8/B
-#usr/share/groff/1.21/font/devutf8/BI
-#usr/share/groff/1.21/font/devutf8/DESC
-#usr/share/groff/1.21/font/devutf8/I
-#usr/share/groff/1.21/font/devutf8/R
-#usr/share/groff/1.21/oldfont
-#usr/share/groff/1.21/oldfont/devps
-#usr/share/groff/1.21/oldfont/devps/CB
-#usr/share/groff/1.21/oldfont/devps/CBI
-#usr/share/groff/1.21/oldfont/devps/CI
-#usr/share/groff/1.21/oldfont/devps/CR
-#usr/share/groff/1.21/oldfont/devps/HB
-#usr/share/groff/1.21/oldfont/devps/HBI
-#usr/share/groff/1.21/oldfont/devps/HI
-#usr/share/groff/1.21/oldfont/devps/HNB
-#usr/share/groff/1.21/oldfont/devps/HNBI
-#usr/share/groff/1.21/oldfont/devps/HNI
-#usr/share/groff/1.21/oldfont/devps/HNR
-#usr/share/groff/1.21/oldfont/devps/HR
-#usr/share/groff/1.21/oldfont/devps/NB
-#usr/share/groff/1.21/oldfont/devps/NBI
-#usr/share/groff/1.21/oldfont/devps/NI
-#usr/share/groff/1.21/oldfont/devps/NR
-#usr/share/groff/1.21/oldfont/devps/PB
-#usr/share/groff/1.21/oldfont/devps/PBI
-#usr/share/groff/1.21/oldfont/devps/PI
-#usr/share/groff/1.21/oldfont/devps/PR
-#usr/share/groff/1.21/oldfont/devps/S
-#usr/share/groff/1.21/oldfont/devps/SS
-#usr/share/groff/1.21/oldfont/devps/TB
-#usr/share/groff/1.21/oldfont/devps/TBI
-#usr/share/groff/1.21/oldfont/devps/TI
-#usr/share/groff/1.21/oldfont/devps/TR
-#usr/share/groff/1.21/oldfont/devps/symbol.afm
-#usr/share/groff/1.21/oldfont/devps/symbolsl.afm
-#usr/share/groff/1.21/oldfont/devps/zapfdr.afm
-#usr/share/groff/1.21/oldfont/devps/zapfdr.ps
-#usr/share/groff/1.21/pic
-#usr/share/groff/1.21/pic/chem.pic
-#usr/share/groff/1.21/tmac
-#usr/share/groff/1.21/tmac/62bit.tmac
-#usr/share/groff/1.21/tmac/X.tmac
-#usr/share/groff/1.21/tmac/Xps.tmac
-#usr/share/groff/1.21/tmac/a4.tmac
-#usr/share/groff/1.21/tmac/an-ext.tmac
-#usr/share/groff/1.21/tmac/an-old.tmac
-#usr/share/groff/1.21/tmac/an.tmac
-#usr/share/groff/1.21/tmac/andoc.tmac
-#usr/share/groff/1.21/tmac/composite.tmac
-#usr/share/groff/1.21/tmac/cp1047.tmac
-#usr/share/groff/1.21/tmac/cs.tmac
-#usr/share/groff/1.21/tmac/de.tmac
-#usr/share/groff/1.21/tmac/den.tmac
-#usr/share/groff/1.21/tmac/devtag.tmac
-#usr/share/groff/1.21/tmac/doc-old.tmac
-#usr/share/groff/1.21/tmac/doc.tmac
-#usr/share/groff/1.21/tmac/dvi.tmac
-#usr/share/groff/1.21/tmac/e.tmac
-#usr/share/groff/1.21/tmac/ec.tmac
-#usr/share/groff/1.21/tmac/eqnrc
-#usr/share/groff/1.21/tmac/europs.tmac
-#usr/share/groff/1.21/tmac/fr.tmac
-#usr/share/groff/1.21/tmac/hdmisc.tmac
-#usr/share/groff/1.21/tmac/hdtbl.tmac
-#usr/share/groff/1.21/tmac/html-end.tmac
-#usr/share/groff/1.21/tmac/html.tmac
-#usr/share/groff/1.21/tmac/hyphen.cs
-#usr/share/groff/1.21/tmac/hyphen.den
-#usr/share/groff/1.21/tmac/hyphen.det
-#usr/share/groff/1.21/tmac/hyphen.fr
-#usr/share/groff/1.21/tmac/hyphen.sv
-#usr/share/groff/1.21/tmac/hyphen.us
-#usr/share/groff/1.21/tmac/hyphenex.cs
-#usr/share/groff/1.21/tmac/hyphenex.det
-#usr/share/groff/1.21/tmac/hyphenex.us
-#usr/share/groff/1.21/tmac/ja.tmac
-#usr/share/groff/1.21/tmac/latin1.tmac
-#usr/share/groff/1.21/tmac/latin2.tmac
-#usr/share/groff/1.21/tmac/latin5.tmac
-#usr/share/groff/1.21/tmac/latin9.tmac
-#usr/share/groff/1.21/tmac/lbp.tmac
-#usr/share/groff/1.21/tmac/lj4.tmac
-#usr/share/groff/1.21/tmac/m.tmac
-#usr/share/groff/1.21/tmac/man.tmac
-#usr/share/groff/1.21/tmac/mandoc.tmac
-#usr/share/groff/1.21/tmac/mdoc
-#usr/share/groff/1.21/tmac/mdoc.tmac
-#usr/share/groff/1.21/tmac/mdoc/doc-common
-#usr/share/groff/1.21/tmac/mdoc/doc-ditroff
-#usr/share/groff/1.21/tmac/mdoc/doc-nroff
-#usr/share/groff/1.21/tmac/mdoc/doc-syms
-#usr/share/groff/1.21/tmac/me.tmac
-#usr/share/groff/1.21/tmac/mm
-#usr/share/groff/1.21/tmac/mm.tmac
-#usr/share/groff/1.21/tmac/mm/0.MT
-#usr/share/groff/1.21/tmac/mm/4.MT
-#usr/share/groff/1.21/tmac/mm/5.MT
-#usr/share/groff/1.21/tmac/mm/locale
-#usr/share/groff/1.21/tmac/mm/ms.cov
-#usr/share/groff/1.21/tmac/mm/se_locale
-#usr/share/groff/1.21/tmac/mm/se_ms.cov
-#usr/share/groff/1.21/tmac/mmse.tmac
-#usr/share/groff/1.21/tmac/mom.tmac
-#usr/share/groff/1.21/tmac/ms.tmac
-#usr/share/groff/1.21/tmac/mse.tmac
-#usr/share/groff/1.21/tmac/om.tmac
-#usr/share/groff/1.21/tmac/papersize.tmac
-#usr/share/groff/1.21/tmac/pdfmark.tmac
-#usr/share/groff/1.21/tmac/pic.tmac
-#usr/share/groff/1.21/tmac/ps.tmac
-#usr/share/groff/1.21/tmac/psatk.tmac
-#usr/share/groff/1.21/tmac/psold.tmac
-#usr/share/groff/1.21/tmac/pspic.tmac
-#usr/share/groff/1.21/tmac/s.tmac
-#usr/share/groff/1.21/tmac/safer.tmac
-#usr/share/groff/1.21/tmac/spdf.tmac
-#usr/share/groff/1.21/tmac/sv.tmac
-#usr/share/groff/1.21/tmac/trace.tmac
-#usr/share/groff/1.21/tmac/trans.tmac
-#usr/share/groff/1.21/tmac/troffrc
-#usr/share/groff/1.21/tmac/troffrc-end
-#usr/share/groff/1.21/tmac/tty-char.tmac
-#usr/share/groff/1.21/tmac/tty.tmac
-#usr/share/groff/1.21/tmac/unicode.tmac
-#usr/share/groff/1.21/tmac/www.tmac
+#usr/share/groff/1.22.3
+#usr/share/groff/1.22.3/eign
+#usr/share/groff/1.22.3/font
+#usr/share/groff/1.22.3/font/devascii
+#usr/share/groff/1.22.3/font/devascii/B
+#usr/share/groff/1.22.3/font/devascii/BI
+#usr/share/groff/1.22.3/font/devascii/DESC
+#usr/share/groff/1.22.3/font/devascii/I
+#usr/share/groff/1.22.3/font/devascii/R
+#usr/share/groff/1.22.3/font/devdvi
+#usr/share/groff/1.22.3/font/devdvi/CW
+#usr/share/groff/1.22.3/font/devdvi/CWEC
+#usr/share/groff/1.22.3/font/devdvi/CWI
+#usr/share/groff/1.22.3/font/devdvi/CWIEC
+#usr/share/groff/1.22.3/font/devdvi/CWITC
+#usr/share/groff/1.22.3/font/devdvi/CWTC
+#usr/share/groff/1.22.3/font/devdvi/DESC
+#usr/share/groff/1.22.3/font/devdvi/EX
+#usr/share/groff/1.22.3/font/devdvi/HB
+#usr/share/groff/1.22.3/font/devdvi/HBEC
+#usr/share/groff/1.22.3/font/devdvi/HBI
+#usr/share/groff/1.22.3/font/devdvi/HBIEC
+#usr/share/groff/1.22.3/font/devdvi/HBITC
+#usr/share/groff/1.22.3/font/devdvi/HBTC
+#usr/share/groff/1.22.3/font/devdvi/HI
+#usr/share/groff/1.22.3/font/devdvi/HIEC
+#usr/share/groff/1.22.3/font/devdvi/HITC
+#usr/share/groff/1.22.3/font/devdvi/HR
+#usr/share/groff/1.22.3/font/devdvi/HREC
+#usr/share/groff/1.22.3/font/devdvi/HRTC
+#usr/share/groff/1.22.3/font/devdvi/MI
+#usr/share/groff/1.22.3/font/devdvi/S
+#usr/share/groff/1.22.3/font/devdvi/SA
+#usr/share/groff/1.22.3/font/devdvi/SB
+#usr/share/groff/1.22.3/font/devdvi/SC
+#usr/share/groff/1.22.3/font/devdvi/TB
+#usr/share/groff/1.22.3/font/devdvi/TBEC
+#usr/share/groff/1.22.3/font/devdvi/TBI
+#usr/share/groff/1.22.3/font/devdvi/TBIEC
+#usr/share/groff/1.22.3/font/devdvi/TBITC
+#usr/share/groff/1.22.3/font/devdvi/TBTC
+#usr/share/groff/1.22.3/font/devdvi/TI
+#usr/share/groff/1.22.3/font/devdvi/TIEC
+#usr/share/groff/1.22.3/font/devdvi/TITC
+#usr/share/groff/1.22.3/font/devdvi/TR
+#usr/share/groff/1.22.3/font/devdvi/TREC
+#usr/share/groff/1.22.3/font/devdvi/TRTC
+#usr/share/groff/1.22.3/font/devdvi/generate
+#usr/share/groff/1.22.3/font/devdvi/generate/CompileFonts
+#usr/share/groff/1.22.3/font/devdvi/generate/Makefile
+#usr/share/groff/1.22.3/font/devdvi/generate/ec.map
+#usr/share/groff/1.22.3/font/devdvi/generate/msam.map
+#usr/share/groff/1.22.3/font/devdvi/generate/msbm.map
+#usr/share/groff/1.22.3/font/devdvi/generate/tc.map
+#usr/share/groff/1.22.3/font/devdvi/generate/texb.map
+#usr/share/groff/1.22.3/font/devdvi/generate/texex.map
+#usr/share/groff/1.22.3/font/devdvi/generate/texi.map
+#usr/share/groff/1.22.3/font/devdvi/generate/texmi.map
+#usr/share/groff/1.22.3/font/devdvi/generate/texr.map
+#usr/share/groff/1.22.3/font/devdvi/generate/texsy.map
+#usr/share/groff/1.22.3/font/devdvi/generate/textex.map
+#usr/share/groff/1.22.3/font/devdvi/generate/textt.map
+#usr/share/groff/1.22.3/font/devhtml
+#usr/share/groff/1.22.3/font/devhtml/B
+#usr/share/groff/1.22.3/font/devhtml/BI
+#usr/share/groff/1.22.3/font/devhtml/CB
+#usr/share/groff/1.22.3/font/devhtml/CBI
+#usr/share/groff/1.22.3/font/devhtml/CI
+#usr/share/groff/1.22.3/font/devhtml/CR
+#usr/share/groff/1.22.3/font/devhtml/DESC
+#usr/share/groff/1.22.3/font/devhtml/I
+#usr/share/groff/1.22.3/font/devhtml/R
+#usr/share/groff/1.22.3/font/devhtml/S
+#usr/share/groff/1.22.3/font/devlatin1
+#usr/share/groff/1.22.3/font/devlatin1/B
+#usr/share/groff/1.22.3/font/devlatin1/BI
+#usr/share/groff/1.22.3/font/devlatin1/DESC
+#usr/share/groff/1.22.3/font/devlatin1/I
+#usr/share/groff/1.22.3/font/devlatin1/R
+#usr/share/groff/1.22.3/font/devlbp
+#usr/share/groff/1.22.3/font/devlbp/CB
+#usr/share/groff/1.22.3/font/devlbp/CI
+#usr/share/groff/1.22.3/font/devlbp/CR
+#usr/share/groff/1.22.3/font/devlbp/DESC
+#usr/share/groff/1.22.3/font/devlbp/EB
+#usr/share/groff/1.22.3/font/devlbp/EI
+#usr/share/groff/1.22.3/font/devlbp/ER
+#usr/share/groff/1.22.3/font/devlbp/HB
+#usr/share/groff/1.22.3/font/devlbp/HBI
+#usr/share/groff/1.22.3/font/devlbp/HI
+#usr/share/groff/1.22.3/font/devlbp/HNB
+#usr/share/groff/1.22.3/font/devlbp/HNBI
+#usr/share/groff/1.22.3/font/devlbp/HNI
+#usr/share/groff/1.22.3/font/devlbp/HNR
+#usr/share/groff/1.22.3/font/devlbp/HR
+#usr/share/groff/1.22.3/font/devlbp/TB
+#usr/share/groff/1.22.3/font/devlbp/TBI
+#usr/share/groff/1.22.3/font/devlbp/TI
+#usr/share/groff/1.22.3/font/devlbp/TR
+#usr/share/groff/1.22.3/font/devlj4
+#usr/share/groff/1.22.3/font/devlj4/AB
+#usr/share/groff/1.22.3/font/devlj4/ABI
+#usr/share/groff/1.22.3/font/devlj4/AI
+#usr/share/groff/1.22.3/font/devlj4/ALBB
+#usr/share/groff/1.22.3/font/devlj4/ALBR
+#usr/share/groff/1.22.3/font/devlj4/AOB
+#usr/share/groff/1.22.3/font/devlj4/AOI
+#usr/share/groff/1.22.3/font/devlj4/AOR
+#usr/share/groff/1.22.3/font/devlj4/AR
+#usr/share/groff/1.22.3/font/devlj4/CB
+#usr/share/groff/1.22.3/font/devlj4/CBI
+#usr/share/groff/1.22.3/font/devlj4/CI
+#usr/share/groff/1.22.3/font/devlj4/CLARENDON
+#usr/share/groff/1.22.3/font/devlj4/CORONET
+#usr/share/groff/1.22.3/font/devlj4/CR
+#usr/share/groff/1.22.3/font/devlj4/DESC
+#usr/share/groff/1.22.3/font/devlj4/GB
+#usr/share/groff/1.22.3/font/devlj4/GBI
+#usr/share/groff/1.22.3/font/devlj4/GI
+#usr/share/groff/1.22.3/font/devlj4/GR
+#usr/share/groff/1.22.3/font/devlj4/LGB
+#usr/share/groff/1.22.3/font/devlj4/LGI
+#usr/share/groff/1.22.3/font/devlj4/LGR
+#usr/share/groff/1.22.3/font/devlj4/MARIGOLD
+#usr/share/groff/1.22.3/font/devlj4/OB
+#usr/share/groff/1.22.3/font/devlj4/OBI
+#usr/share/groff/1.22.3/font/devlj4/OI
+#usr/share/groff/1.22.3/font/devlj4/OR
+#usr/share/groff/1.22.3/font/devlj4/S
+#usr/share/groff/1.22.3/font/devlj4/SYMBOL
+#usr/share/groff/1.22.3/font/devlj4/TB
+#usr/share/groff/1.22.3/font/devlj4/TBI
+#usr/share/groff/1.22.3/font/devlj4/TI
+#usr/share/groff/1.22.3/font/devlj4/TNRB
+#usr/share/groff/1.22.3/font/devlj4/TNRBI
+#usr/share/groff/1.22.3/font/devlj4/TNRI
+#usr/share/groff/1.22.3/font/devlj4/TNRR
+#usr/share/groff/1.22.3/font/devlj4/TR
+#usr/share/groff/1.22.3/font/devlj4/UB
+#usr/share/groff/1.22.3/font/devlj4/UBI
+#usr/share/groff/1.22.3/font/devlj4/UCB
+#usr/share/groff/1.22.3/font/devlj4/UCBI
+#usr/share/groff/1.22.3/font/devlj4/UCI
+#usr/share/groff/1.22.3/font/devlj4/UCR
+#usr/share/groff/1.22.3/font/devlj4/UI
+#usr/share/groff/1.22.3/font/devlj4/UR
+#usr/share/groff/1.22.3/font/devlj4/WINGDINGS
+#usr/share/groff/1.22.3/font/devlj4/generate
+#usr/share/groff/1.22.3/font/devlj4/generate/Makefile
+#usr/share/groff/1.22.3/font/devlj4/generate/special.awk
+#usr/share/groff/1.22.3/font/devlj4/generate/special.map
+#usr/share/groff/1.22.3/font/devlj4/generate/symbol.map
+#usr/share/groff/1.22.3/font/devlj4/generate/text.map
+#usr/share/groff/1.22.3/font/devlj4/generate/wingdings.map
+#usr/share/groff/1.22.3/font/devpdf
+#usr/share/groff/1.22.3/font/devpdf/CB
+#usr/share/groff/1.22.3/font/devpdf/CBI
+#usr/share/groff/1.22.3/font/devpdf/CI
+#usr/share/groff/1.22.3/font/devpdf/CR
+#usr/share/groff/1.22.3/font/devpdf/DESC
+#usr/share/groff/1.22.3/font/devpdf/EURO
+#usr/share/groff/1.22.3/font/devpdf/Foundry
+#usr/share/groff/1.22.3/font/devpdf/HB
+#usr/share/groff/1.22.3/font/devpdf/HBI
+#usr/share/groff/1.22.3/font/devpdf/HI
+#usr/share/groff/1.22.3/font/devpdf/HR
+#usr/share/groff/1.22.3/font/devpdf/S
+#usr/share/groff/1.22.3/font/devpdf/TB
+#usr/share/groff/1.22.3/font/devpdf/TBI
+#usr/share/groff/1.22.3/font/devpdf/TI
+#usr/share/groff/1.22.3/font/devpdf/TR
+#usr/share/groff/1.22.3/font/devpdf/ZD
+#usr/share/groff/1.22.3/font/devpdf/download
+#usr/share/groff/1.22.3/font/devpdf/enc
+#usr/share/groff/1.22.3/font/devpdf/enc/text.enc
+#usr/share/groff/1.22.3/font/devpdf/map
+#usr/share/groff/1.22.3/font/devpdf/map/dingbats.map
+#usr/share/groff/1.22.3/font/devpdf/map/symbolchars
+#usr/share/groff/1.22.3/font/devpdf/map/symbolmap
+#usr/share/groff/1.22.3/font/devpdf/map/textmap
+#usr/share/groff/1.22.3/font/devpdf/util
+#usr/share/groff/1.22.3/font/devpdf/util/BuildFoundries
+#usr/share/groff/1.22.3/font/devps
+#usr/share/groff/1.22.3/font/devps/AB
+#usr/share/groff/1.22.3/font/devps/ABI
+#usr/share/groff/1.22.3/font/devps/AI
+#usr/share/groff/1.22.3/font/devps/AR
+#usr/share/groff/1.22.3/font/devps/BMB
+#usr/share/groff/1.22.3/font/devps/BMBI
+#usr/share/groff/1.22.3/font/devps/BMI
+#usr/share/groff/1.22.3/font/devps/BMR
+#usr/share/groff/1.22.3/font/devps/CB
+#usr/share/groff/1.22.3/font/devps/CBI
+#usr/share/groff/1.22.3/font/devps/CI
+#usr/share/groff/1.22.3/font/devps/CR
+#usr/share/groff/1.22.3/font/devps/DESC
+#usr/share/groff/1.22.3/font/devps/EURO
+#usr/share/groff/1.22.3/font/devps/HB
+#usr/share/groff/1.22.3/font/devps/HBI
+#usr/share/groff/1.22.3/font/devps/HI
+#usr/share/groff/1.22.3/font/devps/HNB
+#usr/share/groff/1.22.3/font/devps/HNBI
+#usr/share/groff/1.22.3/font/devps/HNI
+#usr/share/groff/1.22.3/font/devps/HNR
+#usr/share/groff/1.22.3/font/devps/HR
+#usr/share/groff/1.22.3/font/devps/NB
+#usr/share/groff/1.22.3/font/devps/NBI
+#usr/share/groff/1.22.3/font/devps/NI
+#usr/share/groff/1.22.3/font/devps/NR
+#usr/share/groff/1.22.3/font/devps/PB
+#usr/share/groff/1.22.3/font/devps/PBI
+#usr/share/groff/1.22.3/font/devps/PI
+#usr/share/groff/1.22.3/font/devps/PR
+#usr/share/groff/1.22.3/font/devps/S
+#usr/share/groff/1.22.3/font/devps/SS
+#usr/share/groff/1.22.3/font/devps/TB
+#usr/share/groff/1.22.3/font/devps/TBI
+#usr/share/groff/1.22.3/font/devps/TI
+#usr/share/groff/1.22.3/font/devps/TR
+#usr/share/groff/1.22.3/font/devps/ZCMI
+#usr/share/groff/1.22.3/font/devps/ZD
+#usr/share/groff/1.22.3/font/devps/ZDR
+#usr/share/groff/1.22.3/font/devps/download
+#usr/share/groff/1.22.3/font/devps/freeeuro.afm
+#usr/share/groff/1.22.3/font/devps/freeeuro.pfa
+#usr/share/groff/1.22.3/font/devps/generate
+#usr/share/groff/1.22.3/font/devps/generate/Makefile
+#usr/share/groff/1.22.3/font/devps/generate/afmname
+#usr/share/groff/1.22.3/font/devps/generate/dingbats.map
+#usr/share/groff/1.22.3/font/devps/generate/dingbats.rmap
+#usr/share/groff/1.22.3/font/devps/generate/lgreekmap
+#usr/share/groff/1.22.3/font/devps/generate/symbol.sed
+#usr/share/groff/1.22.3/font/devps/generate/symbolchars
+#usr/share/groff/1.22.3/font/devps/generate/symbolsl.afm
+#usr/share/groff/1.22.3/font/devps/generate/textmap
+#usr/share/groff/1.22.3/font/devps/prologue
+#usr/share/groff/1.22.3/font/devps/symbolsl.pfa
+#usr/share/groff/1.22.3/font/devps/text.enc
+#usr/share/groff/1.22.3/font/devps/zapfdr.pfa
+#usr/share/groff/1.22.3/font/devutf8
+#usr/share/groff/1.22.3/font/devutf8/B
+#usr/share/groff/1.22.3/font/devutf8/BI
+#usr/share/groff/1.22.3/font/devutf8/DESC
+#usr/share/groff/1.22.3/font/devutf8/I
+#usr/share/groff/1.22.3/font/devutf8/R
+#usr/share/groff/1.22.3/oldfont
+#usr/share/groff/1.22.3/oldfont/devps
+#usr/share/groff/1.22.3/oldfont/devps/CB
+#usr/share/groff/1.22.3/oldfont/devps/CBI
+#usr/share/groff/1.22.3/oldfont/devps/CI
+#usr/share/groff/1.22.3/oldfont/devps/CR
+#usr/share/groff/1.22.3/oldfont/devps/HB
+#usr/share/groff/1.22.3/oldfont/devps/HBI
+#usr/share/groff/1.22.3/oldfont/devps/HI
+#usr/share/groff/1.22.3/oldfont/devps/HNB
+#usr/share/groff/1.22.3/oldfont/devps/HNBI
+#usr/share/groff/1.22.3/oldfont/devps/HNI
+#usr/share/groff/1.22.3/oldfont/devps/HNR
+#usr/share/groff/1.22.3/oldfont/devps/HR
+#usr/share/groff/1.22.3/oldfont/devps/NB
+#usr/share/groff/1.22.3/oldfont/devps/NBI
+#usr/share/groff/1.22.3/oldfont/devps/NI
+#usr/share/groff/1.22.3/oldfont/devps/NR
+#usr/share/groff/1.22.3/oldfont/devps/PB
+#usr/share/groff/1.22.3/oldfont/devps/PBI
+#usr/share/groff/1.22.3/oldfont/devps/PI
+#usr/share/groff/1.22.3/oldfont/devps/PR
+#usr/share/groff/1.22.3/oldfont/devps/S
+#usr/share/groff/1.22.3/oldfont/devps/SS
+#usr/share/groff/1.22.3/oldfont/devps/TB
+#usr/share/groff/1.22.3/oldfont/devps/TBI
+#usr/share/groff/1.22.3/oldfont/devps/TI
+#usr/share/groff/1.22.3/oldfont/devps/TR
+#usr/share/groff/1.22.3/oldfont/devps/symbol.afm
+#usr/share/groff/1.22.3/oldfont/devps/symbolsl.afm
+#usr/share/groff/1.22.3/oldfont/devps/zapfdr.afm
+#usr/share/groff/1.22.3/oldfont/devps/zapfdr.ps
+#usr/share/groff/1.22.3/pic
+#usr/share/groff/1.22.3/pic/chem.pic
+#usr/share/groff/1.22.3/tmac
+#usr/share/groff/1.22.3/tmac/62bit.tmac
+#usr/share/groff/1.22.3/tmac/X.tmac
+#usr/share/groff/1.22.3/tmac/Xps.tmac
+#usr/share/groff/1.22.3/tmac/a4.tmac
+#usr/share/groff/1.22.3/tmac/an-ext.tmac
+#usr/share/groff/1.22.3/tmac/an-old.tmac
+#usr/share/groff/1.22.3/tmac/an.tmac
+#usr/share/groff/1.22.3/tmac/andoc.tmac
+#usr/share/groff/1.22.3/tmac/composite.tmac
+#usr/share/groff/1.22.3/tmac/cp1047.tmac
+#usr/share/groff/1.22.3/tmac/cs.tmac
+#usr/share/groff/1.22.3/tmac/de.tmac
+#usr/share/groff/1.22.3/tmac/den.tmac
+#usr/share/groff/1.22.3/tmac/devtag.tmac
+#usr/share/groff/1.22.3/tmac/doc-old.tmac
+#usr/share/groff/1.22.3/tmac/doc.tmac
+#usr/share/groff/1.22.3/tmac/dvi.tmac
+#usr/share/groff/1.22.3/tmac/e.tmac
+#usr/share/groff/1.22.3/tmac/ec.tmac
+#usr/share/groff/1.22.3/tmac/eqnrc
+#usr/share/groff/1.22.3/tmac/europs.tmac
+#usr/share/groff/1.22.3/tmac/fallbacks.tmac
+#usr/share/groff/1.22.3/tmac/fr.tmac
+#usr/share/groff/1.22.3/tmac/hdmisc.tmac
+#usr/share/groff/1.22.3/tmac/hdtbl.tmac
+#usr/share/groff/1.22.3/tmac/html-end.tmac
+#usr/share/groff/1.22.3/tmac/html.tmac
+#usr/share/groff/1.22.3/tmac/hyphen.cs
+#usr/share/groff/1.22.3/tmac/hyphen.den
+#usr/share/groff/1.22.3/tmac/hyphen.det
+#usr/share/groff/1.22.3/tmac/hyphen.fr
+#usr/share/groff/1.22.3/tmac/hyphen.sv
+#usr/share/groff/1.22.3/tmac/hyphen.us
+#usr/share/groff/1.22.3/tmac/hyphenex.cs
+#usr/share/groff/1.22.3/tmac/hyphenex.det
+#usr/share/groff/1.22.3/tmac/hyphenex.us
+#usr/share/groff/1.22.3/tmac/ja.tmac
+#usr/share/groff/1.22.3/tmac/latin1.tmac
+#usr/share/groff/1.22.3/tmac/latin2.tmac
+#usr/share/groff/1.22.3/tmac/latin5.tmac
+#usr/share/groff/1.22.3/tmac/latin9.tmac
+#usr/share/groff/1.22.3/tmac/lbp.tmac
+#usr/share/groff/1.22.3/tmac/lj4.tmac
+#usr/share/groff/1.22.3/tmac/m.tmac
+#usr/share/groff/1.22.3/tmac/man.tmac
+#usr/share/groff/1.22.3/tmac/mandoc.tmac
+#usr/share/groff/1.22.3/tmac/mdoc
+#usr/share/groff/1.22.3/tmac/mdoc.tmac
+#usr/share/groff/1.22.3/tmac/mdoc/doc-common
+#usr/share/groff/1.22.3/tmac/mdoc/doc-ditroff
+#usr/share/groff/1.22.3/tmac/mdoc/doc-nroff
+#usr/share/groff/1.22.3/tmac/mdoc/doc-syms
+#usr/share/groff/1.22.3/tmac/me.tmac
+#usr/share/groff/1.22.3/tmac/mm
+#usr/share/groff/1.22.3/tmac/mm.tmac
+#usr/share/groff/1.22.3/tmac/mm/0.MT
+#usr/share/groff/1.22.3/tmac/mm/4.MT
+#usr/share/groff/1.22.3/tmac/mm/5.MT
+#usr/share/groff/1.22.3/tmac/mm/locale
+#usr/share/groff/1.22.3/tmac/mm/ms.cov
+#usr/share/groff/1.22.3/tmac/mm/se_locale
+#usr/share/groff/1.22.3/tmac/mm/se_ms.cov
+#usr/share/groff/1.22.3/tmac/mmse.tmac
+#usr/share/groff/1.22.3/tmac/mom.tmac
+#usr/share/groff/1.22.3/tmac/ms.tmac
+#usr/share/groff/1.22.3/tmac/mse.tmac
+#usr/share/groff/1.22.3/tmac/om.tmac
+#usr/share/groff/1.22.3/tmac/papersize.tmac
+#usr/share/groff/1.22.3/tmac/pdf.tmac
+#usr/share/groff/1.22.3/tmac/pdfmark.tmac
+#usr/share/groff/1.22.3/tmac/pic.tmac
+#usr/share/groff/1.22.3/tmac/ps.tmac
+#usr/share/groff/1.22.3/tmac/psatk.tmac
+#usr/share/groff/1.22.3/tmac/psold.tmac
+#usr/share/groff/1.22.3/tmac/pspic.tmac
+#usr/share/groff/1.22.3/tmac/refer-me.tmac
+#usr/share/groff/1.22.3/tmac/refer-mm.tmac
+#usr/share/groff/1.22.3/tmac/refer-ms.tmac
+#usr/share/groff/1.22.3/tmac/refer.tmac
+#usr/share/groff/1.22.3/tmac/s.tmac
+#usr/share/groff/1.22.3/tmac/safer.tmac
+#usr/share/groff/1.22.3/tmac/spdf.tmac
+#usr/share/groff/1.22.3/tmac/sv.tmac
+#usr/share/groff/1.22.3/tmac/trace.tmac
+#usr/share/groff/1.22.3/tmac/trans.tmac
+#usr/share/groff/1.22.3/tmac/troffrc
+#usr/share/groff/1.22.3/tmac/troffrc-end
+#usr/share/groff/1.22.3/tmac/tty-char.tmac
+#usr/share/groff/1.22.3/tmac/tty.tmac
+#usr/share/groff/1.22.3/tmac/unicode.tmac
+#usr/share/groff/1.22.3/tmac/www.tmac
#usr/share/groff/current
#usr/share/groff/site-font
#usr/share/groff/site-tmac
@@ -526,13 +579,15 @@
#usr/share/info/groff.info
#usr/share/info/groff.info-1
#usr/share/info/groff.info-2
-#usr/share/info/groff.info-3
#usr/share/man/man1/addftinfo.1
#usr/share/man/man1/afmtodit.1
#usr/share/man/man1/chem.1
#usr/share/man/man1/eqn.1
#usr/share/man/man1/eqn2graph.1
#usr/share/man/man1/gdiffmk.1
+#usr/share/man/man1/glilypond.1
+#usr/share/man/man1/gperl.1
+#usr/share/man/man1/gpinyin.1
#usr/share/man/man1/grap2graph.1
#usr/share/man/man1/grn.1
#usr/share/man/man1/grodvi.1
@@ -542,6 +597,7 @@
#usr/share/man/man1/grohtml.1
#usr/share/man/man1/grolbp.1
#usr/share/man/man1/grolj4.1
+#usr/share/man/man1/gropdf.1
#usr/share/man/man1/grops.1
#usr/share/man/man1/grotty.1
#usr/share/man/man1/hpftodit.1
@@ -551,6 +607,7 @@
#usr/share/man/man1/mmroff.1
#usr/share/man/man1/neqn.1
#usr/share/man/man1/nroff.1
+#usr/share/man/man1/pdfmom.1
#usr/share/man/man1/pdfroff.1
#usr/share/man/man1/pfbtops.1
#usr/share/man/man1/pic.1
@@ -575,6 +632,7 @@
#usr/share/man/man7/groff.7
#usr/share/man/man7/groff_char.7
#usr/share/man/man7/groff_diff.7
+#usr/share/man/man7/groff_filenames.7
#usr/share/man/man7/groff_hdtbl.7
#usr/share/man/man7/groff_man.7
#usr/share/man/man7/groff_mdoc.7
diff --git a/config/rootfiles/common/logrotate b/config/rootfiles/common/logrotate
index 7f3e709..5800a04 100644
--- a/config/rootfiles/common/logrotate
+++ b/config/rootfiles/common/logrotate
@@ -1,5 +1,6 @@
#etc/logrotate.d
etc/logrotate.d/.empty
+#usr/man/man5/logrotate.5
#usr/man/man8/logrotate.8
usr/sbin/logrotate
var/lib/logrotate.status
diff --git a/config/rootfiles/common/logwatch b/config/rootfiles/common/logwatch
index 59d3a7a..998ab8a 100644
--- a/config/rootfiles/common/logwatch
+++ b/config/rootfiles/common/logwatch
@@ -1,6 +1,6 @@
#etc/logwatch
etc/logwatch/conf
-#etc/logwatch/conf/html
+#etc/logwatch/logwatch.cron
#etc/logwatch/conf/ignore.conf
#etc/logwatch/conf/logfiles
#etc/logwatch/conf/logwatch.conf
@@ -18,13 +18,17 @@ usr/sbin/logwatch
#usr/share/logwatch/default.conf/html/header.html
usr/share/logwatch/default.conf/ignore.conf
#usr/share/logwatch/default.conf/logfiles
+#usr/share/logwatch/default.conf/logfiles/audit_log.conf
#usr/share/logwatch/default.conf/logfiles/autorpm.conf
#usr/share/logwatch/default.conf/logfiles/bfd.conf
#usr/share/logwatch/default.conf/logfiles/cisco.conf
+#usr/share/logwatch/default.conf/logfiles/citadel.conf
usr/share/logwatch/default.conf/logfiles/clam-update.conf
+#usr/share/logwatch/default.conf/logfiles/clamav.conf
usr/share/logwatch/default.conf/logfiles/cron.conf
#usr/share/logwatch/default.conf/logfiles/daemon.conf
#usr/share/logwatch/default.conf/logfiles/denyhosts.conf
+#usr/share/logwatch/default.conf/logfiles/dirsrv.conf
#usr/share/logwatch/default.conf/logfiles/dnssec.conf
#usr/share/logwatch/default.conf/logfiles/dpkg.conf
#usr/share/logwatch/default.conf/logfiles/emerge.conf
@@ -32,15 +36,20 @@ usr/share/logwatch/default.conf/logfiles/cron.conf
#usr/share/logwatch/default.conf/logfiles/exim.conf
#usr/share/logwatch/default.conf/logfiles/extreme-networks.conf
#usr/share/logwatch/default.conf/logfiles/fail2ban.conf
+#usr/share/logwatch/default.conf/logfiles/freeradius.conf
+#usr/share/logwatch/default.conf/logfiles/http-error.conf
usr/share/logwatch/default.conf/logfiles/http.conf
usr/share/logwatch/default.conf/logfiles/iptables.conf
usr/share/logwatch/default.conf/logfiles/kernel.conf
usr/share/logwatch/default.conf/logfiles/maillog.conf
usr/share/logwatch/default.conf/logfiles/messages.conf
+#usr/share/logwatch/default.conf/logfiles/mysql-mmm.conf
+#usr/share/logwatch/default.conf/logfiles/mysql.conf
#usr/share/logwatch/default.conf/logfiles/netopia.conf
#usr/share/logwatch/default.conf/logfiles/netscreen.conf
usr/share/logwatch/default.conf/logfiles/php.conf
#usr/share/logwatch/default.conf/logfiles/pix.conf
+#usr/share/logwatch/default.conf/logfiles/postgresql.conf
#usr/share/logwatch/default.conf/logfiles/pureftp.conf
#usr/share/logwatch/default.conf/logfiles/qmail-pop3d-current.conf
#usr/share/logwatch/default.conf/logfiles/qmail-pop3ds-current.conf
@@ -51,13 +60,17 @@ usr/share/logwatch/default.conf/logfiles/resolver.conf
usr/share/logwatch/default.conf/logfiles/samba.conf
#usr/share/logwatch/default.conf/logfiles/secure.conf
#usr/share/logwatch/default.conf/logfiles/sonicwall.conf
+#usr/share/logwatch/default.conf/logfiles/spamassassin.conf
usr/share/logwatch/default.conf/logfiles/syslog.conf
#usr/share/logwatch/default.conf/logfiles/tac_acc.conf
+#usr/share/logwatch/default.conf/logfiles/tivoli-smc.conf
#usr/share/logwatch/default.conf/logfiles/up2date.conf
+#usr/share/logwatch/default.conf/logfiles/vdr.conf
usr/share/logwatch/default.conf/logfiles/vsftpd.conf
usr/share/logwatch/default.conf/logfiles/windows.conf
usr/share/logwatch/default.conf/logfiles/xferlog.conf
#usr/share/logwatch/default.conf/logfiles/yum.conf
+#usr/share/logwatch/default.conf/logfiles/zypp.conf
usr/share/logwatch/default.conf/logwatch.conf
usr/share/logwatch/default.conf/services
#usr/share/logwatch/default.conf/services/afpd.conf
@@ -66,8 +79,10 @@ usr/share/logwatch/default.conf/services/amavis.conf
#usr/share/logwatch/default.conf/services/audit.conf
#usr/share/logwatch/default.conf/services/automount.conf
#usr/share/logwatch/default.conf/services/autorpm.conf
+#usr/share/logwatch/default.conf/services/barracuda.conf
#usr/share/logwatch/default.conf/services/bfd.conf
#usr/share/logwatch/default.conf/services/cisco.conf
+#usr/share/logwatch/default.conf/services/citadel.conf
usr/share/logwatch/default.conf/services/clam-update.conf
#usr/share/logwatch/default.conf/services/clamav-milter.conf
usr/share/logwatch/default.conf/services/clamav.conf
@@ -75,6 +90,7 @@ usr/share/logwatch/default.conf/services/clamav.conf
usr/share/logwatch/default.conf/services/cron.conf
#usr/share/logwatch/default.conf/services/denyhosts.conf
usr/share/logwatch/default.conf/services/dhcpd.conf
+#usr/share/logwatch/default.conf/services/dirsrv.conf
#usr/share/logwatch/default.conf/services/dnssec.conf
#usr/share/logwatch/default.conf/services/dovecot.conf
#usr/share/logwatch/default.conf/services/dpkg.conf
@@ -86,8 +102,11 @@ usr/share/logwatch/default.conf/services/dhcpd.conf
#usr/share/logwatch/default.conf/services/eximstats.conf
#usr/share/logwatch/default.conf/services/extreme-networks.conf
#usr/share/logwatch/default.conf/services/fail2ban.conf
+#usr/share/logwatch/default.conf/services/fetchmail.conf
+#usr/share/logwatch/default.conf/services/freeradius.conf
#usr/share/logwatch/default.conf/services/ftpd-messages.conf
#usr/share/logwatch/default.conf/services/ftpd-xferlog.conf
+#usr/share/logwatch/default.conf/services/http-error.conf
usr/share/logwatch/default.conf/services/http.conf
#usr/share/logwatch/default.conf/services/identd.conf
usr/share/logwatch/default.conf/services/imapd.conf
@@ -96,13 +115,20 @@ usr/share/logwatch/default.conf/services/init.conf
usr/share/logwatch/default.conf/services/ipop3d.conf
usr/share/logwatch/default.conf/services/iptables.conf
usr/share/logwatch/default.conf/services/kernel.conf
+#usr/share/logwatch/default.conf/services/knockd.conf
+#usr/share/logwatch/default.conf/services/lvm.conf
#usr/share/logwatch/default.conf/services/mailscanner.conf
+#usr/share/logwatch/default.conf/services/mdadm.conf
+#usr/share/logwatch/default.conf/services/mod_security2.conf
usr/share/logwatch/default.conf/services/modprobe.conf
#usr/share/logwatch/default.conf/services/mountd.conf
+#usr/share/logwatch/default.conf/services/mysql-mmm.conf
+#usr/share/logwatch/default.conf/services/mysql.conf
#usr/share/logwatch/default.conf/services/named.conf
#usr/share/logwatch/default.conf/services/netopia.conf
#usr/share/logwatch/default.conf/services/netscreen.conf
#usr/share/logwatch/default.conf/services/oidentd.conf
+#usr/share/logwatch/default.conf/services/omsa.conf
usr/share/logwatch/default.conf/services/openvpn.conf
usr/share/logwatch/default.conf/services/pam.conf
usr/share/logwatch/default.conf/services/pam_pwdb.conf
@@ -113,8 +139,10 @@ usr/share/logwatch/default.conf/services/pluto.conf
usr/share/logwatch/default.conf/services/pop3.conf
#usr/share/logwatch/default.conf/services/portsentry.conf
usr/share/logwatch/default.conf/services/postfix.conf
+#usr/share/logwatch/default.conf/services/postgresql.conf
#usr/share/logwatch/default.conf/services/pound.conf
#usr/share/logwatch/default.conf/services/proftpd-messages.conf
+#usr/share/logwatch/default.conf/services/puppet.conf
#usr/share/logwatch/default.conf/services/pureftpd.conf
#usr/share/logwatch/default.conf/services/qmail-pop3d.conf
#usr/share/logwatch/default.conf/services/qmail-pop3ds.conf
@@ -123,6 +151,7 @@ usr/share/logwatch/default.conf/services/postfix.conf
#usr/share/logwatch/default.conf/services/qmail.conf
#usr/share/logwatch/default.conf/services/raid.conf
usr/share/logwatch/default.conf/services/resolver.conf
+#usr/share/logwatch/default.conf/services/rsyslogd.conf
#usr/share/logwatch/default.conf/services/rt314.conf
usr/share/logwatch/default.conf/services/samba.conf
usr/share/logwatch/default.conf/services/saslauthd.conf
@@ -134,23 +163,30 @@ usr/share/logwatch/default.conf/services/scsi.conf
#usr/share/logwatch/default.conf/services/slon.conf
#usr/share/logwatch/default.conf/services/smartd.conf
#usr/share/logwatch/default.conf/services/sonicwall.conf
+#usr/share/logwatch/default.conf/services/spamassassin.conf
usr/share/logwatch/default.conf/services/sshd.conf
usr/share/logwatch/default.conf/services/sshd2.conf
#usr/share/logwatch/default.conf/services/stunnel.conf
usr/share/logwatch/default.conf/services/sudo.conf
+#usr/share/logwatch/default.conf/services/syslog-ng.conf
usr/share/logwatch/default.conf/services/syslogd.conf
#usr/share/logwatch/default.conf/services/tac_acc.conf
+#usr/share/logwatch/default.conf/services/tivoli-smc.conf
#usr/share/logwatch/default.conf/services/up2date.conf
+#usr/share/logwatch/default.conf/services/vdr.conf
#usr/share/logwatch/default.conf/services/vpopmail.conf
usr/share/logwatch/default.conf/services/vsftpd.conf
usr/share/logwatch/default.conf/services/windows.conf
#usr/share/logwatch/default.conf/services/xntpd.conf
#usr/share/logwatch/default.conf/services/yum.conf
+#usr/share/logwatch/default.conf/services/zypp.conf
usr/share/logwatch/default.conf/services/zz-disk_space.conf
#usr/share/logwatch/default.conf/services/zz-fortune.conf
+#usr/share/logwatch/default.conf/services/zz-lm_sensors.conf
usr/share/logwatch/default.conf/services/zz-network.conf
usr/share/logwatch/default.conf/services/zz-runtime.conf
#usr/share/logwatch/default.conf/services/zz-sys.conf
+#usr/share/logwatch/default.conf/services/zz-zfs.conf
#usr/share/logwatch/dist.conf
usr/share/logwatch/dist.conf/logfiles
usr/share/logwatch/dist.conf/services
@@ -184,8 +220,10 @@ usr/share/logwatch/scripts/services/amavis
#usr/share/logwatch/scripts/services/audit
#usr/share/logwatch/scripts/services/automount
#usr/share/logwatch/scripts/services/autorpm
+#usr/share/logwatch/scripts/services/barracuda
#usr/share/logwatch/scripts/services/bfd
#usr/share/logwatch/scripts/services/cisco
+#usr/share/logwatch/scripts/services/citadel
usr/share/logwatch/scripts/services/clam-update
usr/share/logwatch/scripts/services/clamav
#usr/share/logwatch/scripts/services/clamav-milter
@@ -194,6 +232,7 @@ usr/share/logwatch/scripts/services/cron
#usr/share/logwatch/scripts/services/denyhosts
usr/share/logwatch/scripts/services/dhcpd
usr/share/logwatch/scripts/services/dialup
+#usr/share/logwatch/scripts/services/dirsrv
#usr/share/logwatch/scripts/services/dnssec
#usr/share/logwatch/scripts/services/dovecot
#usr/share/logwatch/scripts/services/dpkg
@@ -205,9 +244,12 @@ usr/share/logwatch/scripts/services/dialup
#usr/share/logwatch/scripts/services/eximstats
#usr/share/logwatch/scripts/services/extreme-networks
#usr/share/logwatch/scripts/services/fail2ban
+#usr/share/logwatch/scripts/services/fetchmail
+#usr/share/logwatch/scripts/services/freeradius
#usr/share/logwatch/scripts/services/ftpd-messages
#usr/share/logwatch/scripts/services/ftpd-xferlog
usr/share/logwatch/scripts/services/http
+#usr/share/logwatch/scripts/services/http-error
#usr/share/logwatch/scripts/services/identd
usr/share/logwatch/scripts/services/imapd
#usr/share/logwatch/scripts/services/in.qpopper
@@ -215,13 +257,20 @@ usr/share/logwatch/scripts/services/init
usr/share/logwatch/scripts/services/ipop3d
usr/share/logwatch/scripts/services/iptables
usr/share/logwatch/scripts/services/kernel
+#usr/share/logwatch/scripts/services/knockd
+#usr/share/logwatch/scripts/services/lvm
#usr/share/logwatch/scripts/services/mailscanner
+#usr/share/logwatch/scripts/services/mdadm
+#usr/share/logwatch/scripts/services/mod_security2
usr/share/logwatch/scripts/services/modprobe
#usr/share/logwatch/scripts/services/mountd
+#usr/share/logwatch/scripts/services/mysql
+#usr/share/logwatch/scripts/services/mysql-mmm
#usr/share/logwatch/scripts/services/named
#usr/share/logwatch/scripts/services/netopia
#usr/share/logwatch/scripts/services/netscreen
#usr/share/logwatch/scripts/services/oidentd
+#usr/share/logwatch/scripts/services/omsa
usr/share/logwatch/scripts/services/openvpn
usr/share/logwatch/scripts/services/pam
usr/share/logwatch/scripts/services/pam_pwdb
@@ -232,8 +281,10 @@ usr/share/logwatch/scripts/services/pluto
usr/share/logwatch/scripts/services/pop3
#usr/share/logwatch/scripts/services/portsentry
usr/share/logwatch/scripts/services/postfix
+#usr/share/logwatch/scripts/services/postgresql
#usr/share/logwatch/scripts/services/pound
#usr/share/logwatch/scripts/services/proftpd-messages
+#usr/share/logwatch/scripts/services/puppet
#usr/share/logwatch/scripts/services/pureftpd
#usr/share/logwatch/scripts/services/qmail
#usr/share/logwatch/scripts/services/qmail-pop3d
@@ -242,6 +293,7 @@ usr/share/logwatch/scripts/services/postfix
#usr/share/logwatch/scripts/services/qmail-smtpd
#usr/share/logwatch/scripts/services/raid
#usr/share/logwatch/scripts/services/resolver
+#usr/share/logwatch/scripts/services/rsyslogd
#usr/share/logwatch/scripts/services/rt314
usr/share/logwatch/scripts/services/samba
usr/share/logwatch/scripts/services/saslauthd
@@ -253,23 +305,30 @@ usr/share/logwatch/scripts/services/scsi
#usr/share/logwatch/scripts/services/slon
#usr/share/logwatch/scripts/services/smartd
#usr/share/logwatch/scripts/services/sonicwall
+#usr/share/logwatch/scripts/services/spamassassin
usr/share/logwatch/scripts/services/sshd
usr/share/logwatch/scripts/services/sshd2
#usr/share/logwatch/scripts/services/stunnel
usr/share/logwatch/scripts/services/sudo
+#usr/share/logwatch/scripts/services/syslog-ng
usr/share/logwatch/scripts/services/syslogd
#usr/share/logwatch/scripts/services/tac_acc
+#usr/share/logwatch/scripts/services/tivoli-smc
#usr/share/logwatch/scripts/services/up2date
+#usr/share/logwatch/scripts/services/vdr
#usr/share/logwatch/scripts/services/vpopmail
usr/share/logwatch/scripts/services/vsftpd
usr/share/logwatch/scripts/services/windows
#usr/share/logwatch/scripts/services/xntpd
#usr/share/logwatch/scripts/services/yum
+#usr/share/logwatch/scripts/services/zypp
usr/share/logwatch/scripts/services/zz-disk_space
#usr/share/logwatch/scripts/services/zz-fortune
+#usr/share/logwatch/scripts/services/zz-lm_sensors
usr/share/logwatch/scripts/services/zz-network
usr/share/logwatch/scripts/services/zz-runtime
#usr/share/logwatch/scripts/services/zz-sys
+#usr/share/logwatch/scripts/services/zz-zfs
#usr/share/logwatch/scripts/shared
usr/share/logwatch/scripts/shared/applybinddate
usr/share/logwatch/scripts/shared/applyeurodate
@@ -289,6 +348,11 @@ usr/share/logwatch/scripts/shared/onlyservice
usr/share/logwatch/scripts/shared/remove
usr/share/logwatch/scripts/shared/removeheaders
usr/share/logwatch/scripts/shared/removeservice
+#usr/share/man/man1/amavis-logwatch.1
+#usr/share/man/man1/postfix-logwatch.1
+#usr/share/man/man5/ignore.conf.5
+#usr/share/man/man5/logwatch.conf.5
+#usr/share/man/man5/override.conf.5
#usr/share/man/man8/logwatch.8
var/cache/logwatch
var/log/logwatch
diff --git a/config/ssl/openssl.cnf b/config/ssl/openssl.cnf
index f0906e5..9d1e6e1 100644
--- a/config/ssl/openssl.cnf
+++ b/config/ssl/openssl.cnf
@@ -21,7 +21,7 @@ RANDFILE = $dir/tmp/.rand
x509_extensions = usr_cert
default_days = 999999
default_crl_days= 30
-default_md = md5
+default_md = sha256
preserve = no
policy = policy_match
email_in_dn = no
@@ -35,7 +35,7 @@ commonName = supplied
emailAddress = optional
[ req ]
-default_bits = 1024
+default_bits = 2048
default_keyfile = privkey.pem
distinguished_name = req_distinguished_name
attributes = req_attributes
diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
index 26f6f53..b0041ef 100644
--- a/html/cgi-bin/vpnmain.cgi
+++ b/html/cgi-bin/vpnmain.cgi
@@ -961,9 +961,9 @@ END
if (!$errormessage) {
&General::log("ipsec", "Creating cacert...");
if (open(STDIN, "-|")) {
- my $opt = " req -x509 -nodes -rand /proc/interrupts:/proc/net/rt_cache";
+ my $opt = " req -x509 -sha256 -nodes";
$opt .= " -days 999999";
- $opt .= " -newkey rsa:2048";
+ $opt .= " -newkey rsa:4096";
$opt .= " -keyout ${General::swroot}/private/cakey.pem";
$opt .= " -out ${General::swroot}/ca/cacert.pem";
@@ -984,8 +984,8 @@ END
if (!$errormessage) {
&General::log("ipsec", "Creating host cert...");
if (open(STDIN, "-|")) {
- my $opt = " req -nodes -rand /proc/interrupts:/proc/net/rt_cache";
- $opt .= " -newkey rsa:1024";
+ my $opt = " req -sha256 -nodes";
+ $opt .= " -newkey rsa:2048";
$opt .= " -keyout ${General::swroot}/certs/hostkey.pem";
$opt .= " -out ${General::swroot}/certs/hostreq.pem";
$errormessage = &callssl ($opt);
@@ -1020,7 +1020,7 @@ END
print $fh "subjectAltName=$cgiparams{'SUBJECTALTNAME'}" if ($cgiparams{'SUBJECTALTNAME'});
close ($fh);
- my $opt = " ca -days 999999";
+ my $opt = " ca -md sha256 -days 999999";
$opt .= " -batch -notext";
$opt .= " -in ${General::swroot}/certs/hostreq.pem";
$opt .= " -out ${General::swroot}/certs/hostcert.pem";
@@ -1443,7 +1443,7 @@ END
# Sign the certificate request
&General::log("ipsec", "Signing your cert $cgiparams{'NAME'}...");
- my $opt = " ca -days 999999";
+ my $opt = " ca -md sha256 -days 999999";
$opt .= " -batch -notext";
$opt .= " -in $filename";
$opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}cert.pem";
@@ -1678,7 +1678,7 @@ END
if (open(STDIN, "-|")) {
my $opt = " req -nodes -rand /proc/interrupts:/proc/net/rt_cache";
- $opt .= " -newkey rsa:1024";
+ $opt .= " -newkey rsa:2048";
$opt .= " -keyout ${General::swroot}/certs/$cgiparams{'NAME'}key.pem";
$opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}req.pem";
@@ -1715,7 +1715,7 @@ END
print $fh "subjectAltName=$cgiparams{'SUBJECTALTNAME'}" if ($cgiparams{'SUBJECTALTNAME'});
close ($fh);
- my $opt = " ca -days 999999 -batch -notext";
+ my $opt = " ca -md sha256 -days 999999 -batch -notext";
$opt .= " -in ${General::swroot}/certs/$cgiparams{'NAME'}req.pem";
$opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}cert.pem";
$opt .= " -extfile $v3extname";
@@ -2148,7 +2148,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
goto ADVANCED_ERROR;
}
foreach my $val (@temp) {
- if ($val !~ /^(sha2_512|sha2_384|sha2_256|sha|md5|aesxcbc)$/) {
+ if ($val !~ /^(sha2_(512|384|256)|sha|md5|aesxcbc)$/) {
$errormessage = $Lang::tr{'invalid input'};
goto ADVANCED_ERROR;
}
@@ -2189,7 +2189,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
goto ADVANCED_ERROR;
}
foreach my $val (@temp) {
- if ($val !~ /^(sha2_512|sha2_384|sha2_256|sha1|md5|aesxcbc)$/) {
+ if ($val !~ /^(sha2_(512|384|256)|sha1|md5|aesxcbc)$/) {
$errormessage = $Lang::tr{'invalid input'};
goto ADVANCED_ERROR;
}
diff --git a/lfs/acpid b/lfs/acpid
index ff85e1c..686fada 100644
--- a/lfs/acpid
+++ b/lfs/acpid
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007 Michael Tremer & Christian Schmidt #
+# Copyright (C) 2015 Michael Tremer & Christian Schmidt #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -24,7 +24,7 @@
include Config
-VER = 2.0.16
+VER = 2.0.23
THISAPP = acpid-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -41,7 +41,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_MD5 = d59fc02c9c34f0d5c137495302e2c074
+$(DL_FILE)_MD5 = d7bcdcdefcd53b03730e50ba842554ea
install : $(TARGET)
diff --git a/lfs/curl b/lfs/curl
index 715d79d..0fd92c1 100644
--- a/lfs/curl
+++ b/lfs/curl
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007 Michael Tremer & Christian Schmidt #
+# Copyright (C) 2015 Michael Tremer & Christian Schmidt #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -24,7 +24,7 @@
include Config
-VER = 7.31.0
+VER = 7.40.0
THISAPP = curl-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_MD5 = 6f26843f7e3a2fb06e02f68a55efe8c7
+$(DL_FILE)_MD5 = 58943642ea0ed050ab0431ea1caf3a6f
install : $(TARGET)
diff --git a/lfs/dhcp b/lfs/dhcp
index 083c31f..9a89d40 100644
--- a/lfs/dhcp
+++ b/lfs/dhcp
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2012 IPFire Team <info(a)ipfire.org> #
+# Copyright (C) 2007-2015 IPFire Team <info(a)ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -24,7 +24,7 @@
include Config
-VER = 4.2.2
+VER = 4.3.1
THISAPP = dhcp-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_MD5 = bb0f0434cd796f76aa7cead391d71f31
+$(DL_FILE)_MD5 = b3a42ece3c7f2cd2e74a3e12ca881d20
install : $(TARGET)
@@ -71,38 +71,33 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
@$(PREBUILD)
@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.2-remove-bind.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-errwarn-message.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.2-options.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-release-by-ifup.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-dhclient-decline-backoff.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-unicast-bootp.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.2-dhclient-usage.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-default-requested-options.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.2-xen-checksum.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.1-manpages.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-paths.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.2-CLOEXEC.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-inherit-leases.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-garbage-chars.patch
- # ???
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-missing-ipv6-not-fatal.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-add_timeout_when_NULL.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.1-64_bit_lease_parse.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.2-capability.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-logpid.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-UseMulticast.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.1-sendDecline.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.1-retransmission.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.2-rfc3442-classless-static-routes.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-honor-expired.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-noprefixavail.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.2-sharedlib.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.0-PPP.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.2-lpf-ib.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.2-improved-xid.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.2-gpxe-cid.patch
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp-4.2.1-invalid-dhclient-conf.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-remove-bind.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-errwarn-message.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-dhclient-options.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-release-by-ifup.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-dhclient-decline-backoff.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-unicast-bootp.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-default-requested-options.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-xen-checksum.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-manpages.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-paths.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-CLOEXEC.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-garbage-chars.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-add_timeout_when_NULL.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-64_bit_lease_parse.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-capability.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-logpid.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-UseMulticast.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-sendDecline.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-rfc3442-classless-static-routes.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-honor-expired.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-sharedlib.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-PPP.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-paranoia.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-lpf-ib.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-improved-xid.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-gpxe-cid.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcp/dhcp-stateless-DUID-LLT.patch
# Remove bundled BIND stuff.
# (requires newer autoconf)
diff --git a/lfs/dhcpcd b/lfs/dhcpcd
index f7a8c36..e73d99c 100644
--- a/lfs/dhcpcd
+++ b/lfs/dhcpcd
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2012 IPFire Team <info(a)ipfire.org> #
+# Copyright (C) 2015 IPFire Team <info(a)ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -24,7 +24,7 @@
include Config
-VER = 5.2.9
+VER = 6.7.1
THISAPP = dhcpcd-$(VER)
DL_FILE = $(THISAPP).tar.bz2
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_MD5 = aabe4a3c1f23c55f2c99a416c9085de9
+$(DL_FILE)_MD5 = ffb716b0e9327968e7200d519e1d4c0d
install : $(TARGET)
diff --git a/lfs/expat b/lfs/expat
index 8e4db75..99e458d 100644
--- a/lfs/expat
+++ b/lfs/expat
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007 Michael Tremer & Christian Schmidt #
+# Copyright (C) 2014 Michael Tremer & Christian Schmidt #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -24,7 +24,7 @@
include Config
-VER = 2.0.0
+VER = 2.1.0
THISAPP = expat-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_MD5 = d945df7f1c0868c5c73cf66ba9596f3f
+$(DL_FILE)_MD5 = dd7dab7a5fea97d2a6a43f511449b7cd
install : $(TARGET)
@@ -73,7 +73,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
cd $(DIR_APP) && ./configure --prefix=/usr --disable-nls
cd $(DIR_APP) && make $(MAKETUNING)
cd $(DIR_APP) && make install
- cd $(DIR_APP) && install -v -m755 -d /usr/share/doc/expat-2.0.0
- cd $(DIR_APP) && install -v -m644 doc/*.{html,png,css} /usr/share/doc/expat-2.0.0
+ cd $(DIR_APP) && install -v -m755 -d /usr/share/doc/expat-2.1.0
+ cd $(DIR_APP) && install -v -m644 doc/*.{html,png,css} /usr/share/doc/expat-2.1.0
@rm -rf $(DIR_APP)
@$(POSTBUILD)
diff --git a/lfs/groff b/lfs/groff
index 1739fee..a0bb0bd 100644
--- a/lfs/groff
+++ b/lfs/groff
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2011 IPFire Team <info(a)ipfire.org> #
+# Copyright (C) 2007-2015 IPFire Team <info(a)ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -24,7 +24,7 @@
include Config
-VER = 1.21
+VER = 1.22.3
THISAPP = groff-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_MD5 = 8b8cd29385b97616a0f0d96d0951c5bf
+$(DL_FILE)_MD5 = cc825fa64bc7306a885f2fb2268d3ec5
install : $(TARGET)
diff --git a/lfs/iputils b/lfs/iputils
index 7741c0e..bb08793 100644
--- a/lfs/iputils
+++ b/lfs/iputils
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007 Michael Tremer & Christian Schmidt #
+# Copyright (C) 2014 Michael Tremer & Christian Schmidt #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -24,12 +24,12 @@
include Config
-VER = ss020927
+VER = s20121221
THISAPP = iputils-$(VER)
-DL_FILE = $(THISAPP).tar.gz
+DL_FILE = $(THISAPP).tar.bz2
DL_FROM = $(URL_IPFIRE)
-DIR_APP = $(DIR_SRC)/iputils
+DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
###############################################################################
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_MD5 = b5493f7a2997130a4f86c486c9993b86
+$(DL_FILE)_MD5 = 6072aef64205720dd1893b375e184171
install : $(TARGET)
@@ -69,10 +69,7 @@ $(subst %,%_MD5,$(objects)) :
$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
@$(PREBUILD)
- @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
- cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/iputils-20020927-headers.patch
- cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/iputils-20020927-rh.patch
- cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/iputils-glibckernheaders.patch
+ @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE)
cd $(DIR_APP) && make ping tracepath
cd $(DIR_APP) && install -m 4755 ping /usr/bin
cd $(DIR_APP) && install -m 0755 tracepath /usr/bin
diff --git a/lfs/libjpeg b/lfs/libjpeg
index 5e07859..8b4c077 100644
--- a/lfs/libjpeg
+++ b/lfs/libjpeg
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007 Michael Tremer & Christian Schmidt #
+# Copyright (C) 2015 Michael Tremer & Christian Schmidt #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -24,7 +24,7 @@
include Config
-VER = 1.3.0
+VER = 1.3.1
THISAPP = libjpeg-turbo-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -42,7 +42,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_MD5 = e1e65cc711a1ade1322c06ad4a647741
+$(DL_FILE)_MD5 = 2c3a68129dac443a72815ff5bb374b05
install : $(TARGET)
diff --git a/lfs/logrotate b/lfs/logrotate
index 8f81b2d..0904074 100644
--- a/lfs/logrotate
+++ b/lfs/logrotate
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007 Michael Tremer & Christian Schmidt #
+# Copyright (C) 2014 Michael Tremer & Christian Schmidt #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -24,7 +24,7 @@
include Config
-VER = 3.7.1
+VER = 3.8.1
THISAPP = logrotate-$(VER)
DL_FILE = logrotate_$(VER).orig.tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_MD5 = 552639142e163745f6bcd4f1f3816d8a
+$(DL_FILE)_MD5 = bd2e20d8dc644291b08f9215397d28a5
install : $(TARGET)
diff --git a/lfs/logwatch b/lfs/logwatch
index 755557a..7144d07 100644
--- a/lfs/logwatch
+++ b/lfs/logwatch
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007 Michael Tremer & Christian Schmidt #
+# Copyright (C) 2015 Michael Tremer & Christian Schmidt #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -24,7 +24,7 @@
include Config
-VER = 7.3.6
+VER = 7.4.1
THISAPP = logwatch-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_MD5 = 937d982006b2a76a83edfcfd2e5a9d7d
+$(DL_FILE)_MD5 = a0c3d8721f877bdcd4a9089eb1b4691b
install : $(TARGET)
@@ -99,7 +99,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
-mkdir -p /var/log/logwatch
chmod -v 755 /var/log/logwatch
-rm -rf /etc/logwatch/conf
- ln -vsf /usr/share/logwatch/default.config /etc/logwatch/conf
+ ln -vsf /usr/share/logwatch/default.conf /etc/logwatch/conf
@rm -rf $(DIR_APP)
@$(POSTBUILD)
diff --git a/lfs/nasm b/lfs/nasm
index f6aeac7..b77e7cb 100644
--- a/lfs/nasm
+++ b/lfs/nasm
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007 Michael Tremer & Christian Schmidt #
+# Copyright (C) 2015 Michael Tremer & Christian Schmidt #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -24,7 +24,7 @@
include Config
-VER = 2.10.03
+VER = 2.11.06
THISAPP = nasm-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_MD5 = a5d0ed070476a7c5b4f0893dc4a4ea4b
+$(DL_FILE)_MD5 = 2b958e9f5d200641e6fc9564977aecc5
install : $(TARGET)
diff --git a/lfs/openssl-compat b/lfs/openssl-compat
index 8e22a34..a722f59 100644
--- a/lfs/openssl-compat
+++ b/lfs/openssl-compat
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2014 IPFire Team <info(a)ipfire.org> #
+# Copyright (C) 2007-2015 IPFire Team <info(a)ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -24,7 +24,7 @@
include Config
-VER = 0.9.8zd
+VER = 0.9.8ze
THISAPP = openssl-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_MD5 = e9b9ee12f2911e1a378e2458d9bfff77
+$(DL_FILE)_MD5 = edcca64ac2fbf2b03461936d5e42a262
install : $(TARGET)
diff --git a/src/installer/main.c b/src/installer/main.c
index 358b2c4..75c8c5a 100644
--- a/src/installer/main.c
+++ b/src/installer/main.c
@@ -833,8 +833,11 @@ int main(int argc, char *argv[]) {
newtPopWindow();
- /* Set marker that the user has already accepted the gpl */
- mysystem(logfile, "/usr/bin/touch /harddisk/var/ipfire/main/gpl_accepted");
+ /* Set marker that the user has already accepted the GPL if the license has been shown
+ * in the installation process. In unatteded mode, the user will be presented the
+ * license when he or she logs on to the web user interface for the first time. */
+ if (!config.unattended)
+ mysystem(logfile, "/usr/bin/touch /harddisk/var/ipfire/main/gpl_accepted");
/* Copy restore file from cdrom */
char* backup_file = hw_find_backup_file(logfile, SOURCE_MOUNT_PATH);
diff --git a/src/patches/dhcp-4.2.0-PPP.patch b/src/patches/dhcp-4.2.0-PPP.patch
deleted file mode 100644
index bef2be7..0000000
--- a/src/patches/dhcp-4.2.0-PPP.patch
+++ /dev/null
@@ -1,150 +0,0 @@
-diff -up dhcp-4.2.0-P1/client/dhc6.c.PPP dhcp-4.2.0-P1/client/dhc6.c
---- dhcp-4.2.0-P1/client/dhc6.c.PPP 2010-11-05 10:47:37.000000000 +0100
-+++ dhcp-4.2.0-P1/client/dhc6.c 2010-11-09 15:54:12.000000000 +0100
-@@ -129,7 +129,7 @@ extern int stateless;
- * is not how it is intended. Upcoming rearchitecting the client should
- * address this "one daemon model."
- */
--void
-+isc_result_t
- form_duid(struct data_string *duid, const char *file, int line)
- {
- struct interface_info *ip;
-@@ -141,6 +141,15 @@ form_duid(struct data_string *duid, cons
- if (ip == NULL)
- log_fatal("Impossible condition at %s:%d.", MDL);
-
-+ while (ip && ip->hw_address.hbuf[0] == HTYPE_RESERVED) {
-+ /* Try the other interfaces */
-+ log_debug("Cannot form default DUID from interface %s.", ip->name);
-+ ip = ip->next;
-+ }
-+ if (ip == NULL) {
-+ return ISC_R_UNEXPECTED;
-+ }
-+
- if ((ip->hw_address.hlen == 0) ||
- (ip->hw_address.hlen > sizeof(ip->hw_address.hbuf)))
- log_fatal("Impossible hardware address length at %s:%d.", MDL);
-@@ -176,6 +185,8 @@ form_duid(struct data_string *duid, cons
- memcpy(duid->buffer->data + 4, ip->hw_address.hbuf + 1,
- ip->hw_address.hlen - 1);
- }
-+
-+ return ISC_R_SUCCESS;
- }
-
- /*
-@@ -5289,7 +5300,8 @@ make_client6_options(struct client_state
- */
- if ((oc = lookup_option(&dhcpv6_universe, *op,
- D6O_CLIENTID)) == NULL) {
-- if (!option_cache(&oc, &default_duid, NULL, clientid_option,
-+ if (default_duid.len == 0 ||
-+ !option_cache(&oc, &default_duid, NULL, clientid_option,
- MDL))
- log_fatal("Failure assembling a DUID.");
-
-diff -up dhcp-4.2.0-P1/client/dhclient.c.PPP dhcp-4.2.0-P1/client/dhclient.c
---- dhcp-4.2.0-P1/client/dhclient.c.PPP 2010-11-05 10:47:37.000000000 +0100
-+++ dhcp-4.2.0-P1/client/dhclient.c 2010-11-09 15:37:26.000000000 +0100
-@@ -911,8 +911,8 @@ main(int argc, char **argv) {
- if (default_duid.buffer != NULL)
- data_string_forget(&default_duid, MDL);
-
-- form_duid(&default_duid, MDL);
-- write_duid(&default_duid);
-+ if (form_duid(&default_duid, MDL) == ISC_R_SUCCESS)
-+ write_duid(&default_duid);
- }
-
- for (ip = interfaces ; ip != NULL ; ip = ip->next) {
-diff -up dhcp-4.2.0-P1/common/bpf.c.PPP dhcp-4.2.0-P1/common/bpf.c
---- dhcp-4.2.0-P1/common/bpf.c.PPP 2010-11-05 10:47:37.000000000 +0100
-+++ dhcp-4.2.0-P1/common/bpf.c 2010-11-09 15:42:42.000000000 +0100
-@@ -599,6 +599,22 @@ get_hw_addr(const char *name, struct har
- memcpy(&hw->hbuf[1], LLADDR(sa), sa->sdl_alen);
- break;
- #endif /* IFT_FDDI */
-+#if defined(IFT_PPP)
-+ case IFT_PPP:
-+ if (local_family != AF_INET6)
-+ log_fatal("Unsupported device type %d for \"%s\"",
-+ sa->sdl_type, name);
-+ hw->hlen = 0;
-+ hw->hbuf[0] = HTYPE_RESERVED;
-+ /* 0xdeadbeef should never occur on the wire,
-+ * and is a signature that something went wrong.
-+ */
-+ hw->hbuf[1] = 0xde;
-+ hw->hbuf[2] = 0xad;
-+ hw->hbuf[3] = 0xbe;
-+ hw->hbuf[4] = 0xef;
-+ break;
-+#endif
- default:
- log_fatal("Unsupported device type %d for \"%s\"",
- sa->sdl_type, name);
-diff -up dhcp-4.2.0-P1/common/lpf.c.PPP dhcp-4.2.0-P1/common/lpf.c
---- dhcp-4.2.0-P1/common/lpf.c.PPP 2010-11-05 10:47:37.000000000 +0100
-+++ dhcp-4.2.0-P1/common/lpf.c 2010-11-09 15:45:40.000000000 +0100
-@@ -502,6 +502,22 @@ get_hw_addr(const char *name, struct har
- hw->hbuf[0] = HTYPE_FDDI;
- memcpy(&hw->hbuf[1], sa->sa_data, 16);
- break;
-+#if defined(ARPHRD_PPP)
-+ case ARPHRD_PPP:
-+ if (local_family != AF_INET6)
-+ log_fatal("Unsupported device type %d for \"%s\"",
-+ sa->sa_family, name);
-+ hw->hlen = 0;
-+ hw->hbuf[0] = HTYPE_RESERVED;
-+ /* 0xdeadbeef should never occur on the wire,
-+ * and is a signature that something went wrong.
-+ */
-+ hw->hbuf[1] = 0xde;
-+ hw->hbuf[2] = 0xad;
-+ hw->hbuf[3] = 0xbe;
-+ hw->hbuf[4] = 0xef;
-+ break;
-+#endif
- default:
- log_fatal("Unsupported device type %ld for \"%s\"",
- (long int)sa->sa_family, name);
-diff -up dhcp-4.2.0-P1/includes/dhcpd.h.PPP dhcp-4.2.0-P1/includes/dhcpd.h
---- dhcp-4.2.0-P1/includes/dhcpd.h.PPP 2010-11-05 10:47:37.000000000 +0100
-+++ dhcp-4.2.0-P1/includes/dhcpd.h 2010-11-09 15:46:58.000000000 +0100
-@@ -2733,7 +2733,7 @@ void dhcpv4_client_assignments(void);
- void dhcpv6_client_assignments(void);
-
- /* dhc6.c */
--void form_duid(struct data_string *duid, const char *file, int line);
-+isc_result_t form_duid(struct data_string *duid, const char *file, int line);
- void dhc6_lease_destroy(struct dhc6_lease **src, const char *file, int line);
- void start_init6(struct client_state *client);
- void start_info_request6(struct client_state *client);
-diff -up dhcp-4.2.0-P1/includes/dhcp.h.PPP dhcp-4.2.0-P1/includes/dhcp.h
---- dhcp-4.2.0-P1/includes/dhcp.h.PPP 2010-11-05 10:47:37.000000000 +0100
-+++ dhcp-4.2.0-P1/includes/dhcp.h 2010-11-09 15:48:53.000000000 +0100
-@@ -80,6 +80,8 @@ struct dhcp_packet {
- #define HTYPE_IEEE802 6 /* IEEE 802.2 Token Ring... */
- #define HTYPE_FDDI 8 /* FDDI... */
-
-+#define HTYPE_RESERVED 0 /* RFC 5494 */
-+
- /* Magic cookie validating dhcp options field (and bootp vendor
- extensions field). */
- #define DHCP_OPTIONS_COOKIE "\143\202\123\143"
-diff -up dhcp-4.2.0-P1/server/dhcpv6.c.PPP dhcp-4.2.0-P1/server/dhcpv6.c
---- dhcp-4.2.0-P1/server/dhcpv6.c.PPP 2010-11-05 10:47:37.000000000 +0100
-+++ dhcp-4.2.0-P1/server/dhcpv6.c 2010-11-09 15:50:17.000000000 +0100
-@@ -300,6 +300,9 @@ generate_new_server_duid(void) {
- if (p->hw_address.hlen > 0) {
- break;
- }
-+ if (p->next == NULL && p->hw_address.hbuf[0] == HTYPE_RESERVED) {
-+ log_error("Can not generate DUID from interfaces which do not have hardware addresses, please configure server-duid!");
-+ }
- }
- if (p == NULL) {
- return ISC_R_UNEXPECTED;
diff --git a/src/patches/dhcp-4.2.0-UseMulticast.patch b/src/patches/dhcp-4.2.0-UseMulticast.patch
deleted file mode 100644
index 319344a..0000000
--- a/src/patches/dhcp-4.2.0-UseMulticast.patch
+++ /dev/null
@@ -1,229 +0,0 @@
-diff -up dhcp-4.2.0/server/dhcpv6.c.UseMulticast dhcp-4.2.0/server/dhcpv6.c
---- dhcp-4.2.0/server/dhcpv6.c.UseMulticast 2010-06-01 19:30:00.000000000 +0200
-+++ dhcp-4.2.0/server/dhcpv6.c 2010-07-21 16:17:30.000000000 +0200
-@@ -346,6 +346,48 @@ generate_new_server_duid(void) {
- }
-
- /*
-+ * Is the D6O_UNICAST option defined in dhcpd.conf ?
-+ */
-+static isc_boolean_t unicast_option_defined;
-+
-+/*
-+ * Did we already search dhcpd.conf for D6O_UNICAST option ?
-+ * We need to store it here to not parse dhcpd.conf repeatedly.
-+ */
-+static isc_boolean_t unicast_option_parsed = ISC_FALSE;
-+
-+
-+/*
-+ * Is the D6O_UNICAST option defined in dhcpd.conf ?
-+ */
-+isc_boolean_t
-+is_unicast_option_defined(void) {
-+ struct option_state *opt_state;
-+ struct option_cache *oc;
-+
-+ /*
-+ * If we are looking for the unicast option for the first time
-+ */
-+ if (unicast_option_parsed == ISC_FALSE) {
-+ unicast_option_parsed = ISC_TRUE;
-+ opt_state = NULL;
-+ if (!option_state_allocate(&opt_state, MDL)) {
-+ log_fatal("No memory for option state.");
-+ }
-+
-+ execute_statements_in_scope(NULL, NULL, NULL, NULL, NULL,
-+ opt_state, &global_scope, root_group, NULL);
-+
-+ oc = lookup_option(&dhcpv6_universe, opt_state, D6O_UNICAST);
-+ unicast_option_defined = (oc != NULL);
-+
-+ option_state_dereference(&opt_state, MDL);
-+ }
-+
-+ return (unicast_option_defined);
-+}
-+
-+/*
- * Get the client identifier from the packet.
- */
- isc_result_t
-@@ -1405,6 +1447,56 @@ lease_to_client(struct data_string *repl
- reply.shared->group);
- }
-
-+ /* reject unicast message, unless we set unicast option */
-+ if ((packet->unicast == ISC_TRUE) && !is_unicast_option_defined())
-+ /*
-+ * RFC3315 section 18.2.1 (Request):
-+ *
-+ * When the server receives a Request message via unicast from a client
-+ * to which the server has not sent a unicast option, the server
-+ * discards the Request message and responds with a Reply message
-+ * containing a Status Code option with the value UseMulticast, a Server
-+ * Identifier option containing the server's DUID, the Client Identifier
-+ * option from the client message, and no other options.
-+ *
-+ * Section 18.2.3 (Renew):
-+ *
-+ * When the server receives a Renew message via unicast from a client to
-+ * which the server has not sent a unicast option, the server discards
-+ * the Renew message and responds with a Reply message containing a
-+ * Status Code option with the value UseMulticast, a Server Identifier
-+ * option containing the server's DUID, the Client Identifier option
-+ * from the client message, and no other options.
-+ */
-+ {
-+ /* Set the UseMulticast status code. */
-+ if (!set_status_code(STATUS_UseMulticast,
-+ "Unicast not allowed by server.",
-+ reply.opt_state)) {
-+ log_error("lease_to_client: Unable to set "
-+ "UseMulticast status code.");
-+ goto exit;
-+ }
-+
-+ /* Rewind the cursor to the start. */
-+ reply.cursor = REPLY_OPTIONS_INDEX;
-+
-+ /*
-+ * Produce an reply that includes only:
-+ *
-+ * Status code.
-+ * Server DUID.
-+ * Client DUID.
-+ */
-+ reply.cursor += store_options6((char *)reply.buf.data +
-+ reply.cursor,
-+ sizeof(reply.buf) -
-+ reply.cursor,
-+ reply.opt_state, reply.packet,
-+ required_opts_NAA,
-+ NULL);
-+ } else if (no_resources_avail && (reply.ia_count != 0) &&
-+ (reply.packet->dhcpv6_msg_type == DHCPV6_SOLICIT))
- /*
- * RFC3315 section 17.2.2 (Solicit):
- *
-@@ -1429,8 +1521,6 @@ lease_to_client(struct data_string *repl
- * the server.
- * Sends a Renew/Rebind if the IA is not in the Reply message.
- */
-- if (no_resources_avail && (reply.ia_count != 0) &&
-- (reply.packet->dhcpv6_msg_type == DHCPV6_SOLICIT))
- {
- /* Set the NoAddrsAvail status code. */
- if (!set_status_code(STATUS_NoAddrsAvail,
-@@ -4128,7 +4218,6 @@ dhcpv6_solicit(struct data_string *reply
- * Very similar to Solicit handling, except the server DUID is required.
- */
-
--/* TODO: reject unicast messages, unless we set unicast option */
- static void
- dhcpv6_request(struct data_string *reply_ret, struct packet *packet) {
- struct data_string client_id;
-@@ -4443,7 +4532,6 @@ exit:
- * except for the error code of when addresses don't match.
- */
-
--/* TODO: reject unicast messages, unless we set unicast option */
- static void
- dhcpv6_renew(struct data_string *reply, struct packet *packet) {
- struct data_string client_id;
-@@ -4688,18 +4776,60 @@ iterate_over_ia_na(struct data_string *r
- goto exit;
- }
-
-- snprintf(status_msg, sizeof(status_msg), "%s received.", packet_type);
-- if (!set_status_code(STATUS_Success, status_msg, opt_state)) {
-- goto exit;
-- }
-+ /* reject unicast message, unless we set unicast option */
-+ if ((packet->unicast == ISC_TRUE) && !is_unicast_option_defined()) {
-+ /*
-+ * RFC3315 section 18.2.6 (Release):
-+ *
-+ * When the server receives a Release message via unicast from a client
-+ * to which the server has not sent a unicast option, the server
-+ * discards the Release message and responds with a Reply message
-+ * containing a Status Code option with value UseMulticast, a Server
-+ * Identifier option containing the server's DUID, the Client Identifier
-+ * option from the client message, and no other options.
-+ *
-+ * Section 18.2.7 (Decline):
-+ *
-+ * When the server receives a Decline message via unicast from a client
-+ * to which the server has not sent a unicast option, the server
-+ * discards the Decline message and responds with a Reply message
-+ * containing a Status Code option with the value UseMulticast, a Server
-+ * Identifier option containing the server's DUID, the Client Identifier
-+ * option from the client message, and no other options.
-+ */
-+ snprintf(status_msg, sizeof(status_msg),
-+ "%s received unicast.", packet_type);
-+ if (!set_status_code(STATUS_UseMulticast, status_msg, opt_state)) {
-+ goto exit;
-+ }
-
-- /*
-- * Add our options that are not associated with any IA_NA or IA_TA.
-- */
-- reply_ofs += store_options6(reply_data+reply_ofs,
-- sizeof(reply_data)-reply_ofs,
-+ /*
-+ * Produce an reply that includes only:
-+ *
-+ * Status code.
-+ * Server DUID.
-+ * Client DUID.
-+ */
-+ reply_ofs += store_options6(reply_data+reply_ofs,
-+ sizeof(reply_data)-reply_ofs,
- opt_state, packet,
-- required_opts, NULL);
-+ required_opts_NAA, NULL);
-+
-+ goto return_reply;
-+ } else {
-+ snprintf(status_msg, sizeof(status_msg), "%s received.", packet_type);
-+ if (!set_status_code(STATUS_Success, status_msg, opt_state)) {
-+ goto exit;
-+ }
-+
-+ /*
-+ * Add our options that are not associated with any IA_NA or IA_TA.
-+ */
-+ reply_ofs += store_options6(reply_data+reply_ofs,
-+ sizeof(reply_data)-reply_ofs,
-+ opt_state, packet,
-+ required_opts, NULL);
-+ }
-
- /*
- * Loop through the IA_NA reported by the client, and deal with
-@@ -4838,6 +4968,7 @@ iterate_over_ia_na(struct data_string *r
- /*
- * Return our reply to the caller.
- */
-+return_reply:
- reply_ret->len = reply_ofs;
- reply_ret->buffer = NULL;
- if (!buffer_allocate(&reply_ret->buffer, reply_ofs, MDL)) {
-@@ -4883,7 +5014,6 @@ exit:
- * we still need to be aware of this possibility.
- */
-
--/* TODO: reject unicast messages, unless we set unicast option */
- /* TODO: IA_TA */
- static void
- dhcpv6_decline(struct data_string *reply, struct packet *packet) {
-@@ -5355,7 +5485,6 @@ exit:
- * Release means a client is done with the leases.
- */
-
--/* TODO: reject unicast messages, unless we set unicast option */
- static void
- dhcpv6_release(struct data_string *reply, struct packet *packet) {
- struct data_string client_id;
diff --git a/src/patches/dhcp-4.2.0-add_timeout_when_NULL.patch b/src/patches/dhcp-4.2.0-add_timeout_when_NULL.patch
deleted file mode 100644
index 4784d5a..0000000
--- a/src/patches/dhcp-4.2.0-add_timeout_when_NULL.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff -up dhcp-4.2.0/common/dispatch.c.dracut dhcp-4.2.0/common/dispatch.c
---- dhcp-4.2.0/common/dispatch.c.dracut 2010-06-01 19:29:59.000000000 +0200
-+++ dhcp-4.2.0/common/dispatch.c 2010-07-21 16:10:09.000000000 +0200
-@@ -189,6 +189,10 @@ void add_timeout (when, where, what, ref
- isc_interval_t interval;
- isc_time_t expires;
-
-+ if (when == NULL) {
-+ return;
-+ }
-+
- /* See if this timeout supersedes an existing timeout. */
- t = (struct timeout *)0;
- for (q = timeouts; q; q = q->next) {
diff --git a/src/patches/dhcp-4.2.0-default-requested-options.patch b/src/patches/dhcp-4.2.0-default-requested-options.patch
deleted file mode 100644
index fea8a4b..0000000
--- a/src/patches/dhcp-4.2.0-default-requested-options.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-diff -up dhcp-4.2.0/client/clparse.c.requested dhcp-4.2.0/client/clparse.c
---- dhcp-4.2.0/client/clparse.c.requested 2010-07-21 13:29:05.000000000 +0200
-+++ dhcp-4.2.0/client/clparse.c 2010-07-21 13:50:29.000000000 +0200
-@@ -37,7 +37,7 @@
-
- struct client_config top_level_config;
-
--#define NUM_DEFAULT_REQUESTED_OPTS 9
-+#define NUM_DEFAULT_REQUESTED_OPTS 14
- struct option *default_requested_options[NUM_DEFAULT_REQUESTED_OPTS + 1];
-
- static void parse_client_default_duid(struct parse *cfile);
-@@ -111,6 +111,31 @@ isc_result_t read_client_conf ()
- option_code_hash_lookup(&default_requested_options[8],
- dhcpv6_universe.code_hash, &code, 0, MDL);
-
-+ /* 10 */
-+ code = DHO_NIS_DOMAIN;
-+ option_code_hash_lookup(&default_requested_options[9],
-+ dhcp_universe.code_hash, &code, 0, MDL);
-+
-+ /* 11 */
-+ code = DHO_NIS_SERVERS;
-+ option_code_hash_lookup(&default_requested_options[10],
-+ dhcp_universe.code_hash, &code, 0, MDL);
-+
-+ /* 12 */
-+ code = DHO_NTP_SERVERS;
-+ option_code_hash_lookup(&default_requested_options[11],
-+ dhcp_universe.code_hash, &code, 0, MDL);
-+
-+ /* 13 */
-+ code = DHO_INTERFACE_MTU;
-+ option_code_hash_lookup(&default_requested_options[12],
-+ dhcp_universe.code_hash, &code, 0, MDL);
-+
-+ /* 14 */
-+ code = DHO_DOMAIN_SEARCH;
-+ option_code_hash_lookup(&default_requested_options[13],
-+ dhcp_universe.code_hash, &code, 0, MDL);
-+
- for (code = 0 ; code < NUM_DEFAULT_REQUESTED_OPTS ; code++) {
- if (default_requested_options[code] == NULL)
- log_fatal("Unable to find option definition for "
diff --git a/src/patches/dhcp-4.2.0-dhclient-decline-backoff.patch b/src/patches/dhcp-4.2.0-dhclient-decline-backoff.patch
deleted file mode 100644
index 81bec7b..0000000
--- a/src/patches/dhcp-4.2.0-dhclient-decline-backoff.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-diff -up dhcp-4.2.0/client/dhclient.c.backoff dhcp-4.2.0/client/dhclient.c
---- dhcp-4.2.0/client/dhclient.c.backoff 2010-07-21 13:37:03.000000000 +0200
-+++ dhcp-4.2.0/client/dhclient.c 2010-07-21 13:38:31.000000000 +0200
-@@ -1208,6 +1208,8 @@ void state_init (cpp)
- void *cpp;
- {
- struct client_state *client = cpp;
-+ enum dhcp_state init_state = client->state;
-+ struct timeval tv;
-
- ASSERT_STATE(state, S_INIT);
-
-@@ -1220,9 +1222,18 @@ void state_init (cpp)
- client -> first_sending = cur_time;
- client -> interval = client -> config -> initial_interval;
-
-- /* Add an immediate timeout to cause the first DHCPDISCOVER packet
-- to go out. */
-- send_discover (client);
-+ if (init_state != S_DECLINED) {
-+ /* Add an immediate timeout to cause the first DHCPDISCOVER packet
-+ to go out. */
-+ send_discover(client);
-+ } else {
-+ /* We've received an OFFER and it has been DECLINEd by dhclient-script.
-+ * wait for a random time between 1 and backoff_cutoff seconds before
-+ * trying again. */
-+ tv . tv_sec = cur_time + ((1 + (random() >> 2)) % client->config->backoff_cutoff);
-+ tv . tv_usec = 0;
-+ add_timeout(&tv, send_discover, client, 0, 0);
-+ }
- }
-
- /*
-@@ -1501,6 +1512,7 @@ void bind_lease (client)
- send_decline (client);
- destroy_client_lease (client -> new);
- client -> new = (struct client_lease *)0;
-+ client -> state = S_DECLINED;
- state_init (client);
- return;
- }
-@@ -3711,6 +3723,7 @@ void client_location_changed ()
- case S_INIT:
- case S_REBINDING:
- case S_STOPPED:
-+ case S_DECLINED:
- break;
- }
- client -> state = S_INIT;
-diff -up dhcp-4.2.0/includes/dhcpd.h.backoff dhcp-4.2.0/includes/dhcpd.h
---- dhcp-4.2.0/includes/dhcpd.h.backoff 2010-07-21 13:29:05.000000000 +0200
-+++ dhcp-4.2.0/includes/dhcpd.h 2010-07-21 13:38:31.000000000 +0200
-@@ -1056,7 +1056,8 @@ enum dhcp_state {
- S_BOUND = 5,
- S_RENEWING = 6,
- S_REBINDING = 7,
-- S_STOPPED = 8
-+ S_STOPPED = 8,
-+ S_DECLINED = 9
- };
-
- /* Authentication and BOOTP policy possibilities (not all values work
diff --git a/src/patches/dhcp-4.2.0-errwarn-message.patch b/src/patches/dhcp-4.2.0-errwarn-message.patch
deleted file mode 100644
index a0f70cd..0000000
--- a/src/patches/dhcp-4.2.0-errwarn-message.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-diff -up dhcp-4.2.0/omapip/errwarn.c.errwarn dhcp-4.2.0/omapip/errwarn.c
---- dhcp-4.2.0/omapip/errwarn.c.errwarn 2009-07-23 20:52:21.000000000 +0200
-+++ dhcp-4.2.0/omapip/errwarn.c 2010-07-21 13:23:47.000000000 +0200
-@@ -76,20 +76,13 @@ void log_fatal (const char * fmt, ... )
-
- #if !defined (NOMINUM)
- log_error ("%s", "");
-- log_error ("If you did not get this software from ftp.isc.org, please");
-- log_error ("get the latest from ftp.isc.org and install that before");
-- log_error ("requesting help.");
-+ log_error ("This version of ISC DHCP is based on the release available");
-+ log_error ("on ftp.isc.org. Features have been added and other changes");
-+ log_error ("have been made to the base software release in order to make");
-+ log_error ("it work better with this distribution.");
- log_error ("%s", "");
-- log_error ("If you did get this software from ftp.isc.org and have not");
-- log_error ("yet read the README, please read it before requesting help.");
-- log_error ("If you intend to request help from the dhcp-server(a)isc.org");
-- log_error ("mailing list, please read the section on the README about");
-- log_error ("submitting bug reports and requests for help.");
-- log_error ("%s", "");
-- log_error ("Please do not under any circumstances send requests for");
-- log_error ("help directly to the authors of this software - please");
-- log_error ("send them to the appropriate mailing list as described in");
-- log_error ("the README file.");
-+ log_error ("Please report for this software via the Red Hat Bugzilla site:");
-+ log_error (" http://bugzilla.redhat.com");
- log_error ("%s", "");
- log_error ("exiting.");
- #endif
diff --git a/src/patches/dhcp-4.2.0-garbage-chars.patch b/src/patches/dhcp-4.2.0-garbage-chars.patch
deleted file mode 100644
index 118ff3f..0000000
--- a/src/patches/dhcp-4.2.0-garbage-chars.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -up dhcp-4.2.0/common/tables.c.garbage dhcp-4.2.0/common/tables.c
---- dhcp-4.2.0/common/tables.c.garbage 2009-11-20 02:49:01.000000000 +0100
-+++ dhcp-4.2.0/common/tables.c 2010-07-21 14:40:56.000000000 +0200
-@@ -207,7 +207,7 @@ static struct option dhcp_options[] = {
- { "netinfo-server-tag", "t", &dhcp_universe, 113, 1 },
- { "default-url", "t", &dhcp_universe, 114, 1 },
- { "subnet-selection", "I", &dhcp_universe, 118, 1 },
-- { "domain-search", "Dc", &dhcp_universe, 119, 1 },
-+ { "domain-search", "D", &dhcp_universe, 119, 1 },
- { "vivco", "Evendor-class.", &dhcp_universe, 124, 1 },
- { "vivso", "Evendor.", &dhcp_universe, 125, 1 },
- #if 0
diff --git a/src/patches/dhcp-4.2.0-honor-expired.patch b/src/patches/dhcp-4.2.0-honor-expired.patch
deleted file mode 100644
index 0ae9128..0000000
--- a/src/patches/dhcp-4.2.0-honor-expired.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-diff -up dhcp-4.2.0/client/dhc6.c.honor-expired dhcp-4.2.0/client/dhc6.c
---- dhcp-4.2.0/client/dhc6.c.honor-expired 2010-10-07 12:55:37.000000000 +0200
-+++ dhcp-4.2.0/client/dhc6.c 2010-10-07 12:56:43.000000000 +0200
-@@ -1405,6 +1405,32 @@ start_info_request6(struct client_state
- go_daemon();
- }
-
-+/* Run through the addresses in lease and return true if there's any unexpired.
-+ * Return false otherwise.
-+ */
-+isc_boolean_t
-+unexpired_address_in_lease(struct dhc6_lease *lease)
-+{
-+ struct dhc6_ia *ia;
-+ struct dhc6_addr *addr;
-+
-+ for (ia = lease->bindings ; ia != NULL ; ia = ia->next) {
-+ for (addr = ia->addrs ; addr != NULL ; addr = addr->next) {
-+ if (addr->flags & DHC6_ADDR_EXPIRED)
-+ continue;
-+
-+ if (addr->starts + addr->max_life > cur_time) {
-+ return ISC_TRUE;
-+ }
-+ }
-+ }
-+
-+ log_info("PRC: Previous lease is devoid of active addresses."
-+ " Re-initializing.");
-+
-+ return ISC_FALSE;
-+}
-+
- /*
- * start_confirm6() kicks off an "init-reboot" version of the process, at
- * startup to find out if old bindings are 'fair' and at runtime whenever
-@@ -1417,8 +1446,10 @@ start_confirm6(struct client_state *clie
-
- /* If there is no active lease, there is nothing to check. */
- if ((client->active_lease == NULL) ||
-- !active_prefix(client) ||
-- client->active_lease->released) {
-+ !active_prefix(client) ||
-+ client->active_lease->released ||
-+ !unexpired_address_in_lease(client->active_lease)) {
-+ dhc6_lease_destroy(&client->active_lease, MDL);
- start_init6(client);
- return;
- }
diff --git a/src/patches/dhcp-4.2.0-inherit-leases.patch b/src/patches/dhcp-4.2.0-inherit-leases.patch
deleted file mode 100644
index 052f642..0000000
--- a/src/patches/dhcp-4.2.0-inherit-leases.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-diff -up dhcp-4.2.0/client/dhclient.c.inherit dhcp-4.2.0/client/dhclient.c
---- dhcp-4.2.0/client/dhclient.c.inherit 2010-07-21 14:33:44.000000000 +0200
-+++ dhcp-4.2.0/client/dhclient.c 2010-07-21 14:40:05.000000000 +0200
-@@ -2322,6 +2322,7 @@ void send_request (cpp)
- {
- struct client_state *client = cpp;
-
-+ int i;
- int result;
- int interval;
- struct sockaddr_in destination;
-@@ -2381,6 +2382,22 @@ void send_request (cpp)
- /* Now do a preinit on the interface so that we can
- discover a new address. */
- script_init (client, "PREINIT", (struct string_list *)0);
-+
-+ /* Has an active lease */
-+ if (client -> interface -> addresses != NULL) {
-+ for (i = 0; i < client -> interface -> address_count; i++) {
-+ if (client -> active &&
-+ client -> active -> is_bootp &&
-+ client -> active -> expiry > cur_time &&
-+ client -> interface -> addresses[i].s_addr != 0 &&
-+ client -> active -> address.len == 4 &&
-+ memcpy (client -> active -> address.iabuf, &(client -> interface -> addresses[i]), 4) == 0) {
-+ client_envadd (client, "", "keep_old_ip", "%s", "yes");
-+ break;
-+ }
-+ }
-+ }
-+
- if (client -> alias)
- script_write_params (client, "alias_",
- client -> alias);
diff --git a/src/patches/dhcp-4.2.0-logpid.patch b/src/patches/dhcp-4.2.0-logpid.patch
deleted file mode 100644
index c24adb1..0000000
--- a/src/patches/dhcp-4.2.0-logpid.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -up dhcp-4.2.0/client/dhclient.c.logpid dhcp-4.2.0/client/dhclient.c
---- dhcp-4.2.0/client/dhclient.c.logpid 2010-07-21 16:13:52.000000000 +0200
-+++ dhcp-4.2.0/client/dhclient.c 2010-07-21 16:16:51.000000000 +0200
-@@ -154,7 +154,7 @@ main(int argc, char **argv) {
- else if (fd != -1)
- close(fd);
-
-- openlog("dhclient", LOG_NDELAY, LOG_DAEMON);
-+ openlog("dhclient", LOG_NDELAY | LOG_PID, LOG_DAEMON);
-
- #if !(defined(DEBUG) || defined(__CYGWIN32__))
- setlogmask(LOG_UPTO(LOG_INFO));
diff --git a/src/patches/dhcp-4.2.0-missing-ipv6-not-fatal.patch b/src/patches/dhcp-4.2.0-missing-ipv6-not-fatal.patch
deleted file mode 100644
index b604115..0000000
--- a/src/patches/dhcp-4.2.0-missing-ipv6-not-fatal.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-diff -up dhcp-4.2.0/common/discover.c.noipv6 dhcp-4.2.0/common/discover.c
---- dhcp-4.2.0/common/discover.c.noipv6 2010-07-21 14:31:13.000000000 +0200
-+++ dhcp-4.2.0/common/discover.c 2010-07-21 16:04:57.000000000 +0200
-@@ -443,7 +443,7 @@ begin_iface_scan(struct iface_conf_list
- }
-
- #ifdef DHCPv6
-- if (local_family == AF_INET6) {
-+ if ((local_family == AF_INET6) && !access("/proc/net/if_inet6", R_OK)) {
- ifaces->fp6 = fopen("/proc/net/if_inet6", "re");
- if (ifaces->fp6 == NULL) {
- log_error("Error opening '/proc/net/if_inet6' to "
-@@ -454,6 +454,8 @@ begin_iface_scan(struct iface_conf_list
- ifaces->fp = NULL;
- return 0;
- }
-+ } else {
-+ ifaces->fp6 = NULL;
- }
- #endif
-
-@@ -721,7 +723,7 @@ next_iface(struct iface_info *info, int
- return 1;
- }
- #ifdef DHCPv6
-- if (!(*err)) {
-+ if (!(*err) && ifaces->fp6) {
- if (local_family == AF_INET6)
- return next_iface6(info, err, ifaces);
- }
-@@ -740,7 +742,8 @@ end_iface_scan(struct iface_conf_list *i
- ifaces->sock = -1;
- #ifdef DHCPv6
- if (local_family == AF_INET6) {
-- fclose(ifaces->fp6);
-+ if (ifaces->fp6)
-+ fclose(ifaces->fp6);
- ifaces->fp6 = NULL;
- }
- #endif
diff --git a/src/patches/dhcp-4.2.0-noprefixavail.patch b/src/patches/dhcp-4.2.0-noprefixavail.patch
deleted file mode 100644
index 729a172..0000000
--- a/src/patches/dhcp-4.2.0-noprefixavail.patch
+++ /dev/null
@@ -1,140 +0,0 @@
-diff -up dhcp-4.2.0/server/dhcpv6.c.noprefixavail dhcp-4.2.0/server/dhcpv6.c
---- dhcp-4.2.0/server/dhcpv6.c.noprefixavail 2010-10-07 13:48:45.000000000 +0200
-+++ dhcp-4.2.0/server/dhcpv6.c 2010-10-13 11:00:25.000000000 +0200
-@@ -1134,7 +1134,7 @@ try_client_v6_prefix(struct iasubopt **p
- return DHCP_R_INVALIDARG;
- }
- tmp_plen = (int) requested_pref->data[0];
-- if ((tmp_plen < 3) || (tmp_plen > 128)) {
-+ if ((tmp_plen < 3) || (tmp_plen > 128) ||((int)tmp_plen != pool->units)) {
- return ISC_R_FAILURE;
- }
- memcpy(&tmp_pref, requested_pref->data + 1, sizeof(tmp_pref));
-@@ -1147,9 +1147,8 @@ try_client_v6_prefix(struct iasubopt **p
- return ISC_R_FAILURE;
- }
-
-- if (((int)tmp_plen != pool->units) ||
-- !ipv6_in_pool(&tmp_pref, pool)) {
-- return ISC_R_FAILURE;
-+ if (!ipv6_in_pool(&tmp_pref, pool)) {
-+ return ISC_R_ADDRNOTAVAIL;
- }
-
- if (prefix6_exists(pool, &tmp_pref, tmp_plen)) {
-@@ -1409,13 +1408,6 @@ lease_to_client(struct data_string *repl
- if ((status != ISC_R_SUCCESS) &&
- (status != ISC_R_NORESOURCES))
- goto exit;
--
-- /*
-- * If any prefix cannot be given to any IA_PD, then
-- * set the NoPrefixAvail status code.
-- */
-- if (reply.client_resources == 0)
-- no_resources_avail = ISC_TRUE;
- }
-
- /*
-@@ -1549,36 +1541,6 @@ lease_to_client(struct data_string *repl
- reply.opt_state, reply.packet,
- required_opts_NAA,
- NULL);
-- } else if (no_resources_avail && (reply.ia_count == 0) &&
-- (reply.packet->dhcpv6_msg_type == DHCPV6_SOLICIT))
-- {
-- /* Set the NoPrefixAvail status code. */
-- if (!set_status_code(STATUS_NoPrefixAvail,
-- "No prefixes available for this "
-- "interface.", reply.opt_state)) {
-- log_error("lease_to_client: Unable to set "
-- "NoPrefixAvail status code.");
-- goto exit;
-- }
--
-- /* Rewind the cursor to the start. */
-- reply.cursor = REPLY_OPTIONS_INDEX;
--
-- /*
-- * Produce an advertise that includes only:
-- *
-- * Status code.
-- * Server DUID.
-- * Client DUID.
-- */
-- reply.buf.reply.msg_type = DHCPV6_ADVERTISE;
-- reply.cursor += store_options6((char *)reply.buf.data +
-- reply.cursor,
-- sizeof(reply.buf) -
-- reply.cursor,
-- reply.opt_state, reply.packet,
-- required_opts_NAA,
-- NULL);
- } else {
- /*
- * Having stored the client's IA's, store any options that
-@@ -2793,16 +2755,18 @@ find_client_temporaries(struct reply_sta
- */
- static isc_result_t
- reply_process_try_addr(struct reply_state *reply, struct iaddr *addr) {
-- isc_result_t status = ISC_R_NORESOURCES;
-+ isc_result_t status = ISC_R_ADDRNOTAVAIL;
- struct ipv6_pool *pool;
- int i;
- struct data_string data_addr;
-
- if ((reply == NULL) || (reply->shared == NULL) ||
-- (reply->shared->ipv6_pools == NULL) || (addr == NULL) ||
-- (reply->lease != NULL))
-+ (addr == NULL) || (reply->lease != NULL))
- return DHCP_R_INVALIDARG;
-
-+ if (reply->shared->ipv6_pools == NULL)
-+ return ISC_R_ADDRNOTAVAIL;
-+
- memset(&data_addr, 0, sizeof(data_addr));
- data_addr.len = addr->len;
- data_addr.data = addr->iabuf;
-@@ -3314,7 +3278,9 @@ reply_process_ia_pd(struct reply_state *
- if (status == ISC_R_CANCELED)
- break;
-
-- if ((status != ISC_R_SUCCESS) && (status != ISC_R_ADDRINUSE))
-+ if ((status != ISC_R_SUCCESS) &&
-+ (status != ISC_R_ADDRINUSE) &&
-+ (status != ISC_R_ADDRNOTAVAIL))
- goto cleanup;
- }
-
-@@ -3594,7 +3560,8 @@ reply_process_prefix(struct reply_state
-
- /* Either error out or skip this prefix. */
- if ((status != ISC_R_SUCCESS) &&
-- (status != ISC_R_ADDRINUSE))
-+ (status != ISC_R_ADDRINUSE) &&
-+ (status != ISC_R_ADDRNOTAVAIL))
- goto cleanup;
-
- if (reply->lease == NULL) {
-@@ -3773,16 +3740,18 @@ prefix_is_owned(struct reply_state *repl
- static isc_result_t
- reply_process_try_prefix(struct reply_state *reply,
- struct iaddrcidrnet *pref) {
-- isc_result_t status = ISC_R_NORESOURCES;
-+ isc_result_t status = ISC_R_ADDRNOTAVAIL;
- struct ipv6_pool *pool;
- int i;
- struct data_string data_pref;
-
- if ((reply == NULL) || (reply->shared == NULL) ||
-- (reply->shared->ipv6_pools == NULL) || (pref == NULL) ||
-- (reply->lease != NULL))
-+ (pref == NULL) || (reply->lease != NULL))
- return DHCP_R_INVALIDARG;
-
-+ if (reply->shared->ipv6_pools == NULL)
-+ return ISC_R_ADDRNOTAVAIL;
-+
- memset(&data_pref, 0, sizeof(data_pref));
- data_pref.len = 17;
- if (!buffer_allocate(&data_pref.buffer, data_pref.len, MDL)) {
diff --git a/src/patches/dhcp-4.2.0-paths.patch b/src/patches/dhcp-4.2.0-paths.patch
deleted file mode 100644
index 54c7aba..0000000
--- a/src/patches/dhcp-4.2.0-paths.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-diff -up dhcp-4.2.0/includes/dhcpd.h.paths dhcp-4.2.0/includes/dhcpd.h
---- dhcp-4.2.0/includes/dhcpd.h.paths 2010-07-21 13:55:42.000000000 +0200
-+++ dhcp-4.2.0/includes/dhcpd.h 2010-07-21 14:29:57.000000000 +0200
-@@ -1390,15 +1390,15 @@ typedef unsigned char option_mask [16];
- #else /* !DEBUG */
-
- #ifndef _PATH_DHCPD_CONF
--#define _PATH_DHCPD_CONF "/etc/dhcpd.conf"
-+#define _PATH_DHCPD_CONF "/etc/dhcp/dhcpd.conf"
- #endif /* DEBUG */
-
- #ifndef _PATH_DHCPD_DB
--#define _PATH_DHCPD_DB LOCALSTATEDIR"/db/dhcpd.leases"
-+#define _PATH_DHCPD_DB LOCALSTATEDIR"/dhcpd/dhcpd.leases"
- #endif
-
- #ifndef _PATH_DHCPD6_DB
--#define _PATH_DHCPD6_DB LOCALSTATEDIR"/db/dhcpd6.leases"
-+#define _PATH_DHCPD6_DB LOCALSTATEDIR"/dhcpd/dhcpd6.leases"
- #endif
-
- #ifndef _PATH_DHCPD_PID
-@@ -1412,7 +1412,7 @@ typedef unsigned char option_mask [16];
- #endif /* DEBUG */
-
- #ifndef _PATH_DHCLIENT_CONF
--#define _PATH_DHCLIENT_CONF "/etc/dhclient.conf"
-+#define _PATH_DHCLIENT_CONF "/etc/dhcp/dhclient.conf"
- #endif
-
- #ifndef _PATH_DHCLIENT_SCRIPT
-@@ -1428,11 +1428,11 @@ typedef unsigned char option_mask [16];
- #endif
-
- #ifndef _PATH_DHCLIENT_DB
--#define _PATH_DHCLIENT_DB LOCALSTATEDIR"/db/dhclient.leases"
-+#define _PATH_DHCLIENT_DB LOCALSTATEDIR"/dhclient/dhclient.leases"
- #endif
-
- #ifndef _PATH_DHCLIENT6_DB
--#define _PATH_DHCLIENT6_DB LOCALSTATEDIR"/db/dhclient6.leases"
-+#define _PATH_DHCLIENT6_DB LOCALSTATEDIR"/dhclient/dhclient6.leases"
- #endif
-
- #ifndef _PATH_RESOLV_CONF
diff --git a/src/patches/dhcp-4.2.0-release-by-ifup.patch b/src/patches/dhcp-4.2.0-release-by-ifup.patch
deleted file mode 100644
index 300c5f3..0000000
--- a/src/patches/dhcp-4.2.0-release-by-ifup.patch
+++ /dev/null
@@ -1,85 +0,0 @@
-diff -up dhcp-4.2.0/client/dhclient.c.ifup dhcp-4.2.0/client/dhclient.c
---- dhcp-4.2.0/client/dhclient.c.ifup 2010-07-21 13:30:10.000000000 +0200
-+++ dhcp-4.2.0/client/dhclient.c 2010-07-21 13:37:03.000000000 +0200
-@@ -497,9 +497,81 @@ main(int argc, char **argv) {
- kill(oldpid, SIGTERM);
- }
- fclose(pidfd);
-+ } else {
-+ /* handle release for interfaces requested with Red Hat
-+ * /sbin/ifup - pidfile will be /var/run/dhclient-$interface.pid
-+ */
-+
-+ if ((path_dhclient_pid == NULL) || (*path_dhclient_pid == '\0'))
-+ path_dhclient_pid = "/var/run/dhclient.pid";
-+
-+ char *new_path_dhclient_pid;
-+ struct interface_info *ip;
-+ int pdp_len = strlen(path_dhclient_pid), pfx, dpfx;
-+
-+ /* find append point: beginning of any trailing '.pid'
-+ * or '-$IF.pid' */
-+ for (pfx=pdp_len; (pfx >= 0) && (path_dhclient_pid[pfx] != '.') && (path_dhclient_pid[pfx] != '/'); pfx--);
-+ if (pfx == -1)
-+ pfx = pdp_len;
-+
-+ if (path_dhclient_pid[pfx] == '/')
-+ pfx += 1;
-+
-+ for (dpfx=pfx; (dpfx >= 0) && (path_dhclient_pid[dpfx] != '-') && (path_dhclient_pid[dpfx] != '/'); dpfx--);
-+ if ((dpfx > -1) && (path_dhclient_pid[dpfx] != '/'))
-+ pfx = dpfx;
-+
-+ for (ip = interfaces; ip; ip = ip->next) {
-+ if (interfaces_requested && (ip->flags & (INTERFACE_REQUESTED))) {
-+ int n_len = strlen(ip->name);
-+
-+ new_path_dhclient_pid = (char*) malloc(pfx + n_len + 6);
-+ strncpy(new_path_dhclient_pid, path_dhclient_pid, pfx);
-+ sprintf(new_path_dhclient_pid + pfx, "-%s.pid", ip->name);
-+
-+ if ((pidfd = fopen(new_path_dhclient_pid, "r")) != NULL) {
-+ e = fscanf(pidfd, "%ld\n", &temp);
-+ oldpid = (pid_t)temp;
-+
-+ if (e != 0 && e != EOF) {
-+ if (oldpid) {
-+ if (kill(oldpid, SIGTERM) == 0)
-+ unlink(path_dhclient_pid);
-+ }
-+ }
-+
-+ fclose(pidfd);
-+ }
-+
-+ free(new_path_dhclient_pid);
-+ }
-+ }
-+ }
-+ } else {
-+ FILE *pidfp = NULL;
-+ long temp = 0;
-+ pid_t dhcpid = 0;
-+ int dhc_running = 0;
-+ char procfn[256] = "";
-+
-+ if ((pidfp = fopen(path_dhclient_pid, "r")) != NULL) {
-+ if ((fscanf(pidfp, "%ld", &temp)==1) && ((dhcpid=(pid_t)temp) > 0)) {
-+ snprintf(procfn,256,"/proc/%u",dhcpid);
-+ dhc_running = (access(procfn, F_OK) == 0);
-+ }
-+
-+ fclose(pidfp);
-+ }
-+
-+ if (dhc_running) {
-+ log_fatal("dhclient(%u) is already running - exiting. ", dhcpid);
-+ return(1);
- }
- }
-
-+ write_client_pid_file();
-+
- if (!quiet) {
- log_info("%s %s", message, PACKAGE_VERSION);
- log_info(copyright);
diff --git a/src/patches/dhcp-4.2.0-unicast-bootp.patch b/src/patches/dhcp-4.2.0-unicast-bootp.patch
deleted file mode 100644
index 78bc078..0000000
--- a/src/patches/dhcp-4.2.0-unicast-bootp.patch
+++ /dev/null
@@ -1,99 +0,0 @@
-diff -up dhcp-4.2.0/server/bootp.c.unicast dhcp-4.2.0/server/bootp.c
---- dhcp-4.2.0/server/bootp.c.unicast 2009-11-20 02:49:03.000000000 +0100
-+++ dhcp-4.2.0/server/bootp.c 2010-07-21 13:40:25.000000000 +0200
-@@ -58,6 +58,7 @@ void bootp (packet)
- char msgbuf [1024];
- int ignorep;
- int peer_has_leases = 0;
-+ int norelay = 0;
-
- if (packet -> raw -> op != BOOTREQUEST)
- return;
-@@ -73,7 +74,7 @@ void bootp (packet)
- ? inet_ntoa (packet -> raw -> giaddr)
- : packet -> interface -> name);
-
-- if (!locate_network (packet)) {
-+ if ((norelay = locate_network (packet)) == 0) {
- log_info ("%s: network unknown", msgbuf);
- return;
- }
-@@ -390,6 +391,13 @@ void bootp (packet)
- from, &to, &hto);
- goto out;
- }
-+ } else if (norelay == 2) {
-+ to.sin_addr = raw.ciaddr;
-+ to.sin_port = remote_port;
-+ if (fallback_interface) {
-+ result = send_packet (fallback_interface, (struct packet *)0, &raw, outgoing.packet_length, from, &to, &hto);
-+ goto out;
-+ }
-
- /* If it comes from a client that already knows its address
- and is not requesting a broadcast response, and we can
-diff -up dhcp-4.2.0/server/dhcp.c.unicast dhcp-4.2.0/server/dhcp.c
---- dhcp-4.2.0/server/dhcp.c.unicast 2010-06-01 19:29:59.000000000 +0200
-+++ dhcp-4.2.0/server/dhcp.c 2010-07-21 13:40:25.000000000 +0200
-@@ -4185,6 +4185,7 @@ int locate_network (packet)
- struct data_string data;
- struct subnet *subnet = (struct subnet *)0;
- struct option_cache *oc;
-+ int norelay = 0;
-
- /* See if there's a Relay Agent Link Selection Option, or a
- * Subnet Selection Option. The Link-Select and Subnet-Select
-@@ -4200,12 +4201,24 @@ int locate_network (packet)
- from the interface, if there is one. If not, fail. */
- if (!oc && !packet -> raw -> giaddr.s_addr) {
- if (packet -> interface -> shared_network) {
-- shared_network_reference
-- (&packet -> shared_network,
-- packet -> interface -> shared_network, MDL);
-- return 1;
-+ struct in_addr any_addr;
-+ any_addr.s_addr = INADDR_ANY;
-+
-+ if (!packet -> packet_type && memcmp(&packet -> raw -> ciaddr, &any_addr, 4)) {
-+ struct iaddr cip;
-+ memcpy(cip.iabuf, &packet -> raw -> ciaddr, 4);
-+ cip.len = 4;
-+ if (!find_grouped_subnet(&subnet, packet->interface->shared_network, cip, MDL))
-+ norelay = 2;
-+ }
-+
-+ if (!norelay) {
-+ shared_network_reference(&packet -> shared_network, packet -> interface -> shared_network, MDL);
-+ return 1;
-+ }
-+ } else {
-+ return 0;
- }
-- return 0;
- }
-
- /* If there's an option indicating link connection, and it's valid,
-@@ -4228,7 +4241,10 @@ int locate_network (packet)
- data_string_forget (&data, MDL);
- } else {
- ia.len = 4;
-- memcpy (ia.iabuf, &packet -> raw -> giaddr, 4);
-+ if (norelay)
-+ memcpy (ia.iabuf, &packet->raw->ciaddr, 4);
-+ else
-+ memcpy (ia.iabuf, &packet->raw->giaddr, 4);
- }
-
- /* If we know the subnet on which the IP address lives, use it. */
-@@ -4236,7 +4252,10 @@ int locate_network (packet)
- shared_network_reference (&packet -> shared_network,
- subnet -> shared_network, MDL);
- subnet_dereference (&subnet, MDL);
-- return 1;
-+ if (norelay)
-+ return norelay;
-+ else
-+ return 1;
- }
-
- /* Otherwise, fail. */
diff --git a/src/patches/dhcp-4.2.1-64_bit_lease_parse.patch b/src/patches/dhcp-4.2.1-64_bit_lease_parse.patch
deleted file mode 100644
index a540bc1..0000000
--- a/src/patches/dhcp-4.2.1-64_bit_lease_parse.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-diff -up dhcp-4.2.1b1/common/dispatch.c.64-bit_lease_parse dhcp-4.2.1b1/common/dispatch.c
-diff -up dhcp-4.2.1b1/common/parse.c.64-bit_lease_parse dhcp-4.2.1b1/common/parse.c
---- dhcp-4.2.1b1/common/parse.c.64-bit_lease_parse 2010-12-30 00:01:42.000000000 +0100
-+++ dhcp-4.2.1b1/common/parse.c 2011-01-28 08:01:10.000000000 +0100
-@@ -909,8 +909,8 @@ TIME
- parse_date_core(cfile)
- struct parse *cfile;
- {
-- int guess;
-- int tzoff, wday, year, mon, mday, hour, min, sec;
-+ TIME guess;
-+ long int tzoff, wday, year, mon, mday, hour, min, sec;
- const char *val;
- enum dhcp_token token;
- static int months[11] = { 31, 59, 90, 120, 151, 181,
-@@ -936,7 +936,7 @@ parse_date_core(cfile)
- }
-
- token = next_token(&val, NULL, cfile); /* consume number */
-- guess = atoi(val);
-+ guess = atol(val);
-
- return((TIME)guess);
- }
-@@ -948,7 +948,7 @@ parse_date_core(cfile)
- return((TIME)0);
- }
- token = next_token(&val, NULL, cfile); /* consume day of week */
-- wday = atoi(val);
-+ wday = atol(val);
-
- /* Year... */
- token = peek_token(&val, NULL, cfile);
-@@ -964,7 +964,7 @@ parse_date_core(cfile)
- somebody invents a time machine, I think we can safely disregard
- it. This actually works around a stupid Y2K bug that was present
- in a very early beta release of dhcpd. */
-- year = atoi(val);
-+ year = atol(val);
- if (year > 1900)
- year -= 1900;
-
-@@ -988,7 +988,7 @@ parse_date_core(cfile)
- return((TIME)0);
- }
- token = next_token(&val, NULL, cfile); /* consume month */
-- mon = atoi(val) - 1;
-+ mon = atol(val) - 1;
-
- /* Slash separating month from day... */
- token = peek_token(&val, NULL, cfile);
-@@ -1010,7 +1010,7 @@ parse_date_core(cfile)
- return((TIME)0);
- }
- token = next_token(&val, NULL, cfile); /* consume day of month */
-- mday = atoi(val);
-+ mday = atol(val);
-
- /* Hour... */
- token = peek_token(&val, NULL, cfile);
-@@ -1021,7 +1021,7 @@ parse_date_core(cfile)
- return((TIME)0);
- }
- token = next_token(&val, NULL, cfile); /* consume hour */
-- hour = atoi(val);
-+ hour = atol(val);
-
- /* Colon separating hour from minute... */
- token = peek_token(&val, NULL, cfile);
-@@ -1043,7 +1043,7 @@ parse_date_core(cfile)
- return((TIME)0);
- }
- token = next_token(&val, NULL, cfile); /* consume minute */
-- min = atoi(val);
-+ min = atol(val);
-
- /* Colon separating minute from second... */
- token = peek_token(&val, NULL, cfile);
-@@ -1065,13 +1065,13 @@ parse_date_core(cfile)
- return((TIME)0);
- }
- token = next_token(&val, NULL, cfile); /* consume second */
-- sec = atoi(val);
-+ sec = atol(val);
-
- tzoff = 0;
- token = peek_token(&val, NULL, cfile);
- if (token == NUMBER) {
- token = next_token(&val, NULL, cfile); /* consume tzoff */
-- tzoff = atoi(val);
-+ tzoff = atol(val);
- } else if (token != SEMI) {
- token = next_token(&val, NULL, cfile);
- parse_warn(cfile,
diff --git a/src/patches/dhcp-4.2.1-invalid-dhclient-conf.patch b/src/patches/dhcp-4.2.1-invalid-dhclient-conf.patch
deleted file mode 100644
index eeeea84..0000000
--- a/src/patches/dhcp-4.2.1-invalid-dhclient-conf.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -up dhcp-4.2.1b1/client/dhclient.conf.supersede dhcp-4.2.1b1/client/dhclient.conf
---- dhcp-4.2.1b1/client/dhclient.conf.supersede 2010-09-15 01:03:56.000000000 +0200
-+++ dhcp-4.2.1b1/client/dhclient.conf 2011-01-27 18:38:28.000000000 +0100
-@@ -4,7 +4,7 @@ send dhcp-lease-time 3600;
- supersede domain-search "fugue.com", "home.vix.com";
- prepend domain-name-servers 127.0.0.1;
- request subnet-mask, broadcast-address, time-offset, routers,
-- domain-name, domain-name-servers, host-name;
-+ domain-search, domain-name-servers, host-name;
- require subnet-mask, domain-name-servers;
- timeout 60;
- retry 60;
diff --git a/src/patches/dhcp-4.2.1-manpages.patch b/src/patches/dhcp-4.2.1-manpages.patch
deleted file mode 100644
index 9a42b7f..0000000
--- a/src/patches/dhcp-4.2.1-manpages.patch
+++ /dev/null
@@ -1,264 +0,0 @@
-diff -up dhcp-4.2.1b1/client/dhclient.8.man dhcp-4.2.1b1/client/dhclient.8
---- dhcp-4.2.1b1/client/dhclient.8.man 2010-07-14 22:09:34.000000000 +0200
-+++ dhcp-4.2.1b1/client/dhclient.8 2011-01-27 18:19:07.000000000 +0100
-@@ -115,6 +115,33 @@ dhclient - Dynamic Host Configuration Pr
- .B -w
- ]
- [
-+.B -B
-+]
-+[
-+.B -I
-+.I dhcp-client-identifier
-+]
-+[
-+.B -H
-+.I host-name
-+]
-+[
-+.B -F
-+.I fqdn.fqdn
-+]
-+[
-+.B -V
-+.I vendor-class-identifier
-+]
-+[
-+.B -R
-+.I request-option-list
-+]
-+[
-+.B -timeout
-+.I timeout
-+]
-+[
- .B -v
- ]
- [
-@@ -264,6 +291,69 @@ not to exit when it doesn't find any suc
- program can then be used to notify the client when a network interface
- has been added or removed, so that the client can attempt to configure an IP
- address on that interface.
-+
-+.TP
-+.BI \-B
-+Set the BOOTP broadcast flag in request packets so servers will always
-+broadcast replies.
-+
-+.TP
-+.BI \-I\ <dhcp-client-identifier>
-+Specify the dhcp-client-identifier option to send to the DHCP server.
-+
-+.TP
-+.BI \-H\ <host-name>
-+Specify the host-name option to send to the DHCP server. The host-name
-+string only contains the client's hostname prefix, to which the server will
-+append the ddns-domainname or domain-name options, if any, to derive the
-+fully qualified domain name of the client. The
-+.B -H
-+option cannot be used with the
-+.B -F
-+option.
-+
-+.TP
-+.BI \-F\ <fqdn.fqdn>
-+Specify the fqdn.fqdn option to send to the DHCP server. This option cannot
-+be used with the
-+.B -H
-+option. The fqdn.fqdn option must specify the complete domain name of the
-+client host, which the server may use for dynamic DNS updates.
-+
-+.TP
-+.BI \-V\ <vendor-class-identifier>
-+Specify the vendor-class-identifier option to send to the DHCP server.
-+
-+.TP
-+.BI \-R\ <option>[,<option>...]
-+Specify the list of options the client is to request from the server. The
-+option list must be a single string consisting of option names separated
-+by at least one command and optional space characters. The default option
-+list is:
-+
-+.BR
-+ subnet-mask, broadcast-address, time-offset, routers,
-+.BR
-+ domain-search, domain-name, domain-name-servers, host-name,
-+.BR
-+ nis-domain, nis-servers, ntp-servers, interface-mtu
-+
-+.TP
-+.B -R
-+option does not append options to the default request, it overrides the
-+default request list. Keep this in mind if you want to request an
-+additional option besides the default request list. You will have to
-+specify all option names for the
-+.B -R
-+parameter.
-+
-+.TP
-+.BI \-timeout\ <timeout>
-+Specify the time after which
-+.B dhclient
-+will decide that no DHCP servers can be contacted when no responses have been
-+received.
-+
- .TP
- .BI \-n
- Do not configure any interfaces. This is most likely to be useful in
-diff -up dhcp-4.2.1b1/client/dhclient.conf.5.man dhcp-4.2.1b1/client/dhclient.conf.5
---- dhcp-4.2.1b1/client/dhclient.conf.5.man 2010-09-15 01:03:56.000000000 +0200
-+++ dhcp-4.2.1b1/client/dhclient.conf.5 2011-01-27 18:22:56.000000000 +0100
-@@ -186,7 +186,8 @@ responding to the client send the client
- options. Only the option names should be specified in the request
- statement - not option parameters. By default, the DHCPv4 client
- requests the subnet-mask, broadcast-address, time-offset, routers,
--domain-name, domain-name-servers and host-name options while the DHCPv6
-+domain-search, domain-name, domain-name-servers, host-name, nis-domain,
-+nis-servers, ntp-servers and interface-mtu options while the DHCPv6
- client requests the dhcp6 name-servers and domain-search options. Note
- that if you enter a \'request\' statement, you over-ride these defaults
- and these options will not be requested.
-@@ -672,6 +673,17 @@ know the DHCP service(s) anycast MAC add
- client. The \fIlink-type\fR and \fImac-address\fR parameters are configured
- in a similar manner to the \fBhardware\fR statement.
- .PP
-+ \fBbootp-broadcast-always;\fR
-+.PP
-+The
-+.B bootp-broadcast-always
-+statement instructs dhclient to always set the bootp broadcast flag in
-+request packets, so that servers will always broadcast replies.
-+This is equivalent to supplying the dhclient -B argument, and has
-+the same effect as specifying 'always-broadcast' in the server's dhcpd.conf.
-+This option is provided as an extension to enable dhclient to work
-+on IBM s390 Linux guests.
-+.PP
- .SH SAMPLE
- The following configuration file is used on a laptop running NetBSD
- 1.3. The laptop has an IP alias of 192.5.5.213, and has one
-@@ -697,7 +709,7 @@ interface "ep0" {
- supersede domain-search "fugue.com", "rc.vix.com", "home.vix.com";
- prepend domain-name-servers 127.0.0.1;
- request subnet-mask, broadcast-address, time-offset, routers,
-- domain-name, domain-name-servers, host-name;
-+ domain-search, domain-name, domain-name-servers, host-name;
- require subnet-mask, domain-name-servers;
- script "CLIENTBINDIR/dhclient-script";
- media "media 10baseT/UTP", "media 10base2/BNC";
-diff -up dhcp-4.2.1b1/client/dhclient-script.8.man dhcp-4.2.1b1/client/dhclient-script.8
---- dhcp-4.2.1b1/client/dhclient-script.8.man 2010-07-06 21:03:11.000000000 +0200
-+++ dhcp-4.2.1b1/client/dhclient-script.8 2011-01-27 18:24:44.000000000 +0100
-@@ -47,7 +47,7 @@ customizations are needed, they should b
- exit hooks provided (see HOOKS for details). These hooks will allow the
- user to override the default behaviour of the client in creating a
- .B /etc/resolv.conf
--file.
-+file, and to handle DHCP options not handled by default.
- .PP
- No standard client script exists for some operating systems, even though
- the actual client may work, so a pioneering user may well need to create
-@@ -91,6 +91,26 @@ present. The
- .B ETCDIR/dhclient-exit-hooks
- script can modify the valid of exit_status to change the exit status
- of dhclient-script.
-+.PP
-+Immediately after dhclient brings an interface UP with a new IP address,
-+subnet mask, and routes, in the REBOOT/BOUND states, it will check for the
-+existence of an executable
-+.B ETCDIR/dhclient-up-hooks
-+script, and source it if found. This script can handle DHCP options in
-+the environment that are not handled by default. A per-interface.
-+.B ETCDIR/dhclient-${IF}-up-hooks
-+script will override the generic script and be sourced when interface
-+$IF has been brought up.
-+.PP
-+Immediately before dhclient brings an interface DOWN, removing its IP
-+address, subnet mask, and routes, in the STOP/RELEASE states, it will
-+check for the existence of an executable
-+.B ETCDIR/dhclient-down-hooks
-+script, and source it if found. This script can handle DHCP options in
-+the environment that are not handled by default. A per-interface
-+.B ETCDIR/dhclient-${IF}-down-hooks
-+script will override the generic script and be sourced when interface
-+$IF is about to be brought down.
- .SH OPERATION
- When dhclient needs to invoke the client configuration script, it
- defines a set of variables in the environment, and then invokes
-diff -up dhcp-4.2.1b1/common/dhcp-options.5.man dhcp-4.2.1b1/common/dhcp-options.5
---- dhcp-4.2.1b1/common/dhcp-options.5.man 2010-07-13 22:56:56.000000000 +0200
-+++ dhcp-4.2.1b1/common/dhcp-options.5 2011-01-27 18:25:57.000000000 +0100
-@@ -913,6 +913,21 @@ classless IP routing - it does not inclu
- classless IP routing is now the most widely deployed routing standard,
- this option is virtually useless, and is not implemented by any of the
- popular DHCP clients, for example the Microsoft DHCP client.
-+.PP
-+NOTE to Fedora dhclient users:
-+.br
-+dhclient-script interprets trailing 0 octets of the target as indicating
-+the subnet class of the route, so for the following static-routes value:
-+.br
-+ option static-routes 172.0.0.0 172.16.2.254,
-+.br
-+ 192.168.0.0 192.168.2.254;
-+.br
-+dhclient-script will create routes:
-+.br
-+ 172/8 via 172.16.2.254 dev $interface
-+.br
-+ 192.168/16 via 192.168.2.254 dev $interface
- .RE
- .PP
- .nf
-diff -up dhcp-4.2.1b1/server/dhcpd.conf.5.man dhcp-4.2.1b1/server/dhcpd.conf.5
---- dhcp-4.2.1b1/server/dhcpd.conf.5.man 2010-07-06 21:03:12.000000000 +0200
-+++ dhcp-4.2.1b1/server/dhcpd.conf.5 2011-01-27 18:29:12.000000000 +0100
-@@ -519,6 +519,9 @@ pool {
- };
- .fi
- .PP
-+Dynamic BOOTP leases are not compatible with failover, and, as such,
-+you need to disallow BOOTP in pools that you are using failover for.
-+.PP
- The server currently does very little sanity checking, so if you
- configure it wrong, it will just fail in odd ways. I would recommend
- therefore that you either do failover or don't do failover, but don't
-@@ -533,9 +536,9 @@ primary server might look like this:
- failover peer "foo" {
- primary;
- address anthrax.rc.vix.com;
-- port 519;
-+ port 647;
- peer address trantor.rc.vix.com;
-- peer port 520;
-+ peer port 847;
- max-response-delay 60;
- max-unacked-updates 10;
- mclt 3600;
-@@ -1305,7 +1308,7 @@ the zone containing PTR records - for IS
- .PP
- .nf
- key DHCP_UPDATER {
-- algorithm HMAC-MD5.SIG-ALG.REG.INT;
-+ algorithm hmac-md5;
- secret pRP5FapFoJ95JEL06sv4PQ==;
- };
-
-@@ -1328,7 +1331,7 @@ dhcpd.conf file:
- .PP
- .nf
- key DHCP_UPDATER {
-- algorithm HMAC-MD5.SIG-ALG.REG.INT;
-+ algorithm hmac-md5;
- secret pRP5FapFoJ95JEL06sv4PQ==;
- };
-
-@@ -2540,7 +2543,8 @@ statement
- The \fInext-server\fR statement is used to specify the host address of
- the server from which the initial boot file (specified in the
- \fIfilename\fR statement) is to be loaded. \fIServer-name\fR should
--be a numeric IP address or a domain name.
-+be a numeric IP address or a domain name. If no \fInext-server\fR statement
-+applies to a given client, the address 0.0.0.0 is used.
- .RE
- .PP
- The
diff --git a/src/patches/dhcp-4.2.1-retransmission.patch b/src/patches/dhcp-4.2.1-retransmission.patch
deleted file mode 100644
index 18e447f..0000000
--- a/src/patches/dhcp-4.2.1-retransmission.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-diff -up dhcp-4.2.1b1/client/dhc6.c.retransmission dhcp-4.2.1b1/client/dhc6.c
---- dhcp-4.2.1b1/client/dhc6.c.retransmission 2011-01-28 08:40:56.000000000 +0100
-+++ dhcp-4.2.1b1/client/dhc6.c 2011-01-28 08:39:22.000000000 +0100
-@@ -361,7 +361,7 @@ dhc6_retrans_init(struct client_state *c
- static void
- dhc6_retrans_advance(struct client_state *client)
- {
-- struct timeval elapsed;
-+ struct timeval elapsed, elapsed_after_RT;
-
- /* elapsed = cur - start */
- elapsed.tv_sec = cur_tv.tv_sec - client->start_time.tv_sec;
-@@ -378,6 +378,8 @@ dhc6_retrans_advance(struct client_state
- elapsed.tv_sec += 1;
- elapsed.tv_usec -= 1000000;
- }
-+ elapsed_after_RT.tv_sec = elapsed.tv_sec;
-+ elapsed_after_RT.tv_usec = elapsed.tv_usec;
-
- /*
- * RT for each subsequent message transmission is based on the previous
-@@ -415,13 +417,10 @@ dhc6_retrans_advance(struct client_state
- elapsed.tv_usec -= 1000000;
- }
- if (elapsed.tv_sec >= client->MRD) {
-- /*
-- * wake at RT + cur = start + MRD
-- */
-- client->RT = client->MRD +
-- (client->start_time.tv_sec - cur_tv.tv_sec);
-- client->RT = client->RT * 100 +
-- (client->start_time.tv_usec - cur_tv.tv_usec) / 10000;
-+ client->RT = client->MRD - elapsed_after_RT.tv_sec;
-+ client->RT = client->RT * 100 - elapsed_after_RT.tv_usec / 10000;
-+ if (client->RT < 0)
-+ client->RT = 0;
- }
- client->txcount++;
- }
-@@ -1497,7 +1496,7 @@ check_timing6 (struct client_state *clie
- }
-
- /* Check if finished (-1 argument). */
-- if ((client->MRD != 0) && (elapsed.tv_sec > client->MRD)) {
-+ if ((client->MRD != 0) && (elapsed.tv_sec >= client->MRD)) {
- log_info("Max retransmission duration exceeded.");
- return(CHK_TIM_MRD_EXCEEDED);
- }
diff --git a/src/patches/dhcp-4.2.1-sendDecline.patch b/src/patches/dhcp-4.2.1-sendDecline.patch
deleted file mode 100644
index b2fa4af..0000000
--- a/src/patches/dhcp-4.2.1-sendDecline.patch
+++ /dev/null
@@ -1,231 +0,0 @@
-diff -up dhcp-4.2.1-P1/client/dhc6.c.sendDecline dhcp-4.2.1-P1/client/dhc6.c
---- dhcp-4.2.1-P1/client/dhc6.c.sendDecline 2010-09-10 22:27:11.000000000 +0200
-+++ dhcp-4.2.1-P1/client/dhc6.c 2011-06-17 14:19:48.992099868 +0200
-@@ -95,6 +95,8 @@ void do_select6(void *input);
- void do_refresh6(void *input);
- static void do_release6(void *input);
- static void start_bound(struct client_state *client);
-+static void start_decline6(struct client_state *client);
-+static void do_decline6(void *input);
- static void start_informed(struct client_state *client);
- void informed_handler(struct packet *packet, struct client_state *client);
- void bound_handler(struct packet *packet, struct client_state *client);
-@@ -2075,6 +2077,7 @@ start_release6(struct client_state *clie
- cancel_timeout(do_select6, client);
- cancel_timeout(do_refresh6, client);
- cancel_timeout(do_release6, client);
-+ cancel_timeout(do_decline6, client);
- client->state = S_STOPPED;
-
- /*
-@@ -2708,6 +2711,7 @@ dhc6_check_reply(struct client_state *cl
- break;
-
- case S_STOPPED:
-+ case S_DECLINED:
- action = dhc6_stop_action;
- break;
-
-@@ -2809,6 +2813,7 @@ dhc6_check_reply(struct client_state *cl
- break;
-
- case S_STOPPED:
-+ case S_DECLINED:
- /* Nothing critical to do at this stage. */
- break;
-
-@@ -3799,17 +3804,23 @@ reply_handler(struct packet *packet, str
- cancel_timeout(do_select6, client);
- cancel_timeout(do_refresh6, client);
- cancel_timeout(do_release6, client);
-+ cancel_timeout(do_decline6, client);
-
- /* If this is in response to a Release/Decline, clean up and return. */
-- if (client->state == S_STOPPED) {
-- if (client->active_lease == NULL)
-- return;
-+ if ((client->state == S_STOPPED) ||
-+ (client->state == S_DECLINED)) {
-+
-+ if (client->active_lease != NULL) {
-+ dhc6_lease_destroy(&client->active_lease, MDL);
-+ client->active_lease = NULL;
-+ /* We should never wait for nothing!? */
-+ if (stopping_finished())
-+ exit(0);
-+ }
-+
-+ if (client->state == S_DECLINED)
-+ start_init6(client);
-
-- dhc6_lease_destroy(&client->active_lease, MDL);
-- client->active_lease = NULL;
-- /* We should never wait for nothing!? */
-- if (stopping_finished())
-- exit(0);
- return;
- }
-
-@@ -4336,7 +4347,11 @@ start_bound(struct client_state *client)
- oldia, oldaddr);
- dhc6_marshall_values("new_", client, lease, ia, addr);
-
-- script_go(client);
-+ // when script returns 3, DAD failed
-+ if (script_go(client) == 3) {
-+ start_decline6(client);
-+ return;
-+ }
- }
-
- /* XXX: maybe we should loop on the old values instead? */
-@@ -4382,6 +4397,149 @@ start_bound(struct client_state *client)
- dhc6_check_times(client);
- }
-
-+/*
-+ * Decline addresses.
-+ */
-+void
-+start_decline6(struct client_state *client)
-+{
-+ /* Cancel any pending transmissions */
-+ cancel_timeout(do_confirm6, client);
-+ cancel_timeout(do_select6, client);
-+ cancel_timeout(do_refresh6, client);
-+ cancel_timeout(do_release6, client);
-+ cancel_timeout(do_decline6, client);
-+ client->state = S_DECLINED;
-+
-+ if (client->active_lease == NULL)
-+ return;
-+
-+ /* Set timers per RFC3315 section 18.1.7. */
-+ client->IRT = DEC_TIMEOUT * 100;
-+ client->MRT = 0;
-+ client->MRC = DEC_MAX_RC;
-+ client->MRD = 0;
-+
-+ dhc6_retrans_init(client);
-+ client->v6_handler = reply_handler;
-+
-+ client->refresh_type = DHCPV6_DECLINE;
-+ do_decline6(client);
-+}
-+
-+/*
-+ * do_decline6() creates a Decline packet and transmits it.
-+ */
-+static void
-+do_decline6(void *input)
-+{
-+ struct client_state *client;
-+ struct data_string ds;
-+ int send_ret;
-+ struct timeval elapsed, tv;
-+
-+ client = input;
-+
-+ if ((client->active_lease == NULL) || !active_prefix(client))
-+ return;
-+
-+ if ((client->MRC != 0) && (client->txcount > client->MRC)) {
-+ log_info("Max retransmission count exceeded.");
-+ goto decline_done;
-+ }
-+
-+ /*
-+ * Start_time starts at the first transmission.
-+ */
-+ if (client->txcount == 0) {
-+ client->start_time.tv_sec = cur_tv.tv_sec;
-+ client->start_time.tv_usec = cur_tv.tv_usec;
-+ }
-+
-+ /* elapsed = cur - start */
-+ elapsed.tv_sec = cur_tv.tv_sec - client->start_time.tv_sec;
-+ elapsed.tv_usec = cur_tv.tv_usec - client->start_time.tv_usec;
-+ if (elapsed.tv_usec < 0) {
-+ elapsed.tv_sec -= 1;
-+ elapsed.tv_usec += 1000000;
-+ }
-+
-+ memset(&ds, 0, sizeof(ds));
-+ if (!buffer_allocate(&ds.buffer, 4, MDL)) {
-+ log_error("Unable to allocate memory for Decline.");
-+ goto decline_done;
-+ }
-+
-+ ds.data = ds.buffer->data;
-+ ds.len = 4;
-+ ds.buffer->data[0] = DHCPV6_DECLINE;
-+ memcpy(ds.buffer->data + 1, client->dhcpv6_transaction_id, 3);
-+
-+ /* Form an elapsed option. */
-+ /* Maximum value is 65535 1/100s coded as 0xffff. */
-+ if ((elapsed.tv_sec < 0) || (elapsed.tv_sec > 655) ||
-+ ((elapsed.tv_sec == 655) && (elapsed.tv_usec > 350000))) {
-+ client->elapsed = 0xffff;
-+ } else {
-+ client->elapsed = elapsed.tv_sec * 100;
-+ client->elapsed += elapsed.tv_usec / 10000;
-+ }
-+
-+ client->elapsed = htons(client->elapsed);
-+
-+ log_debug("XMT: Forming Decline.");
-+ make_client6_options(client, &client->sent_options,
-+ client->active_lease, DHCPV6_DECLINE);
-+ dhcpv6_universe.encapsulate(&ds, NULL, NULL, client, NULL,
-+ client->sent_options, &global_scope,
-+ &dhcpv6_universe);
-+
-+ /* Append IA's (but don't release temporary addresses). */
-+ if (wanted_ia_na &&
-+ dhc6_add_ia_na(client, &ds, client->active_lease,
-+ DHCPV6_DECLINE) != ISC_R_SUCCESS) {
-+ data_string_forget(&ds, MDL);
-+ goto decline_done;
-+ }
-+ if (wanted_ia_pd &&
-+ dhc6_add_ia_pd(client, &ds, client->active_lease,
-+ DHCPV6_DECLINE) != ISC_R_SUCCESS) {
-+ data_string_forget(&ds, MDL);
-+ goto decline_done;
-+ }
-+
-+ /* Transmit and wait. */
-+ log_info("XMT: Decline on %s, interval %ld0ms.",
-+ client->name ? client->name : client->interface->name,
-+ (long int)client->RT);
-+
-+ send_ret = send_packet6(client->interface, ds.data, ds.len,
-+ &DHCPv6DestAddr);
-+ if (send_ret != ds.len) {
-+ log_error("dhc6: sendpacket6() sent %d of %d bytes",
-+ send_ret, ds.len);
-+ }
-+
-+ data_string_forget(&ds, MDL);
-+
-+ /* Wait RT */
-+ tv.tv_sec = cur_tv.tv_sec + client->RT / 100;
-+ tv.tv_usec = cur_tv.tv_usec + (client->RT % 100) * 10000;
-+ if (tv.tv_usec >= 1000000) {
-+ tv.tv_sec += 1;
-+ tv.tv_usec -= 1000000;
-+ }
-+ add_timeout(&tv, do_decline6, client, NULL, NULL);
-+ dhc6_retrans_advance(client);
-+ return;
-+
-+decline_done:
-+ dhc6_lease_destroy(&client->active_lease, MDL);
-+ client->active_lease = NULL;
-+ start_init6(client);
-+ return;
-+}
-+
- /* While bound, ignore packets. In the future we'll want to answer
- * Reconfigure-Request messages and the like.
- */
diff --git a/src/patches/dhcp-4.2.2-CLOEXEC.patch b/src/patches/dhcp-4.2.2-CLOEXEC.patch
deleted file mode 100644
index b07e2ff..0000000
--- a/src/patches/dhcp-4.2.2-CLOEXEC.patch
+++ /dev/null
@@ -1,423 +0,0 @@
-diff -up dhcp-4.2.2b1/client/clparse.c.cloexec dhcp-4.2.2b1/client/clparse.c
---- dhcp-4.2.2b1/client/clparse.c.cloexec 2011-07-01 14:13:30.973887714 +0200
-+++ dhcp-4.2.2b1/client/clparse.c 2011-07-01 14:15:15.021580693 +0200
-@@ -246,7 +246,7 @@ int read_client_conf_file (const char *n
- int token;
- isc_result_t status;
-
-- if ((file = open (name, O_RDONLY)) < 0)
-+ if ((file = open (name, O_RDONLY | O_CLOEXEC)) < 0)
- return uerr2isc (errno);
-
- cfile = NULL;
-@@ -283,7 +283,7 @@ void read_client_leases ()
-
- /* Open the lease file. If we can't open it, just return -
- we can safely trust the server to remember our state. */
-- if ((file = open (path_dhclient_db, O_RDONLY)) < 0)
-+ if ((file = open (path_dhclient_db, O_RDONLY | O_CLOEXEC)) < 0)
- return;
-
- cfile = NULL;
-diff -up dhcp-4.2.2b1/client/dhclient.c.cloexec dhcp-4.2.2b1/client/dhclient.c
---- dhcp-4.2.2b1/client/dhclient.c.cloexec 2011-07-01 14:13:30.970887717 +0200
-+++ dhcp-4.2.2b1/client/dhclient.c 2011-07-01 14:16:51.485930388 +0200
-@@ -148,11 +148,11 @@ main(int argc, char **argv) {
- /* Make sure that file descriptors 0 (stdin), 1, (stdout), and
- 2 (stderr) are open. To do this, we assume that when we
- open a file the lowest available file descriptor is used. */
-- fd = open("/dev/null", O_RDWR);
-+ fd = open("/dev/null", O_RDWR | O_CLOEXEC);
- if (fd == 0)
-- fd = open("/dev/null", O_RDWR);
-+ fd = open("/dev/null", O_RDWR | O_CLOEXEC);
- if (fd == 1)
-- fd = open("/dev/null", O_RDWR);
-+ fd = open("/dev/null", O_RDWR | O_CLOEXEC);
- if (fd == 2)
- log_perror = 0; /* No sense logging to /dev/null. */
- else if (fd != -1)
-@@ -506,7 +506,7 @@ main(int argc, char **argv) {
- int e;
-
- oldpid = 0;
-- if ((pidfd = fopen(path_dhclient_pid, "r")) != NULL) {
-+ if ((pidfd = fopen(path_dhclient_pid, "re")) != NULL) {
- e = fscanf(pidfd, "%ld\n", &temp);
- oldpid = (pid_t)temp;
-
-@@ -548,7 +548,7 @@ main(int argc, char **argv) {
- strncpy(new_path_dhclient_pid, path_dhclient_pid, pfx);
- sprintf(new_path_dhclient_pid + pfx, "-%s.pid", ip->name);
-
-- if ((pidfd = fopen(new_path_dhclient_pid, "r")) != NULL) {
-+ if ((pidfd = fopen(new_path_dhclient_pid, "re")) != NULL) {
- e = fscanf(pidfd, "%ld\n", &temp);
- oldpid = (pid_t)temp;
-
-@@ -573,7 +573,7 @@ main(int argc, char **argv) {
- int dhc_running = 0;
- char procfn[256] = "";
-
-- if ((pidfp = fopen(path_dhclient_pid, "r")) != NULL) {
-+ if ((pidfp = fopen(path_dhclient_pid, "re")) != NULL) {
- if ((fscanf(pidfp, "%ld", &temp)==1) && ((dhcpid=(pid_t)temp) > 0)) {
- snprintf(procfn,256,"/proc/%u",dhcpid);
- dhc_running = (access(procfn, F_OK) == 0);
-@@ -2995,7 +2995,7 @@ void rewrite_client_leases ()
-
- if (leaseFile != NULL)
- fclose (leaseFile);
-- leaseFile = fopen (path_dhclient_db, "w");
-+ leaseFile = fopen (path_dhclient_db, "we");
- if (leaseFile == NULL) {
- log_error ("can't create %s: %m", path_dhclient_db);
- return;
-@@ -3105,7 +3105,7 @@ write_duid(struct data_string *duid)
- return DHCP_R_INVALIDARG;
-
- if (leaseFile == NULL) { /* XXX? */
-- leaseFile = fopen(path_dhclient_db, "w");
-+ leaseFile = fopen(path_dhclient_db, "we");
- if (leaseFile == NULL) {
- log_error("can't create %s: %m", path_dhclient_db);
- return ISC_R_IOERROR;
-@@ -3285,7 +3285,7 @@ int write_client_lease (client, lease, r
- return 1;
-
- if (leaseFile == NULL) { /* XXX */
-- leaseFile = fopen (path_dhclient_db, "w");
-+ leaseFile = fopen (path_dhclient_db, "we");
- if (leaseFile == NULL) {
- log_error ("can't create %s: %m", path_dhclient_db);
- return 0;
-@@ -3772,9 +3772,9 @@ void go_daemon ()
- close(2);
-
- /* Reopen them on /dev/null. */
-- open("/dev/null", O_RDWR);
-- open("/dev/null", O_RDWR);
-- open("/dev/null", O_RDWR);
-+ open("/dev/null", O_RDWR | O_CLOEXEC);
-+ open("/dev/null", O_RDWR | O_CLOEXEC);
-+ open("/dev/null", O_RDWR | O_CLOEXEC);
-
- write_client_pid_file ();
-
-@@ -3791,14 +3791,14 @@ void write_client_pid_file ()
- return;
- }
-
-- pfdesc = open (path_dhclient_pid, O_CREAT | O_TRUNC | O_WRONLY, 0644);
-+ pfdesc = open (path_dhclient_pid, O_CREAT | O_TRUNC | O_WRONLY | O_CLOEXEC, 0644);
-
- if (pfdesc < 0) {
- log_error ("Can't create %s: %m", path_dhclient_pid);
- return;
- }
-
-- pf = fdopen (pfdesc, "w");
-+ pf = fdopen (pfdesc, "we");
- if (!pf) {
- close(pfdesc);
- log_error ("Can't fdopen %s: %m", path_dhclient_pid);
-diff -up dhcp-4.2.2b1/common/bpf.c.cloexec dhcp-4.2.2b1/common/bpf.c
---- dhcp-4.2.2b1/common/bpf.c.cloexec 2011-07-01 14:13:30.976887712 +0200
-+++ dhcp-4.2.2b1/common/bpf.c 2011-07-01 14:13:31.030887673 +0200
-@@ -94,7 +94,7 @@ int if_register_bpf (info)
- for (b = 0; 1; b++) {
- /* %Audit% 31 bytes max. %2004.06.17,Safe% */
- sprintf(filename, BPF_FORMAT, b);
-- sock = open (filename, O_RDWR, 0);
-+ sock = open (filename, O_RDWR | O_CLOEXEC, 0);
- if (sock < 0) {
- if (errno == EBUSY) {
- continue;
-diff -up dhcp-4.2.2b1/common/discover.c.cloexec dhcp-4.2.2b1/common/discover.c
---- dhcp-4.2.2b1/common/discover.c.cloexec 2011-06-27 18:18:20.000000000 +0200
-+++ dhcp-4.2.2b1/common/discover.c 2011-07-01 14:13:31.031887673 +0200
-@@ -421,7 +421,7 @@ begin_iface_scan(struct iface_conf_list
- int len;
- int i;
-
-- ifaces->fp = fopen("/proc/net/dev", "r");
-+ ifaces->fp = fopen("/proc/net/dev", "re");
- if (ifaces->fp == NULL) {
- log_error("Error opening '/proc/net/dev' to list interfaces");
- return 0;
-@@ -456,7 +456,7 @@ begin_iface_scan(struct iface_conf_list
-
- #ifdef DHCPv6
- if (local_family == AF_INET6) {
-- ifaces->fp6 = fopen("/proc/net/if_inet6", "r");
-+ ifaces->fp6 = fopen("/proc/net/if_inet6", "re");
- if (ifaces->fp6 == NULL) {
- log_error("Error opening '/proc/net/if_inet6' to "
- "list IPv6 interfaces; %m");
-diff -up dhcp-4.2.2b1/common/dlpi.c.cloexec dhcp-4.2.2b1/common/dlpi.c
---- dhcp-4.2.2b1/common/dlpi.c.cloexec 2011-07-01 14:13:30.977887712 +0200
-+++ dhcp-4.2.2b1/common/dlpi.c 2011-07-01 14:13:31.032887673 +0200
-@@ -806,7 +806,7 @@ dlpiopen(const char *ifname) {
- }
- *dp = '\0';
-
-- return open (devname, O_RDWR, 0);
-+ return open (devname, O_RDWR | O_CLOEXEC, 0);
- }
-
- /*
-diff -up dhcp-4.2.2b1/common/nit.c.cloexec dhcp-4.2.2b1/common/nit.c
---- dhcp-4.2.2b1/common/nit.c.cloexec 2011-07-01 14:13:30.978887712 +0200
-+++ dhcp-4.2.2b1/common/nit.c 2011-07-01 14:13:31.033887672 +0200
-@@ -81,7 +81,7 @@ int if_register_nit (info)
- struct strioctl sio;
-
- /* Open a NIT device */
-- sock = open ("/dev/nit", O_RDWR);
-+ sock = open ("/dev/nit", O_RDWR | O_CLOEXEC);
- if (sock < 0)
- log_fatal ("Can't open NIT device for %s: %m", info -> name);
-
-diff -up dhcp-4.2.2b1/common/resolv.c.cloexec dhcp-4.2.2b1/common/resolv.c
---- dhcp-4.2.2b1/common/resolv.c.cloexec 2009-11-20 02:49:01.000000000 +0100
-+++ dhcp-4.2.2b1/common/resolv.c 2011-07-01 14:13:31.033887672 +0200
-@@ -49,7 +49,7 @@ void read_resolv_conf (parse_time)
- struct domain_search_list *dp, *dl, *nd;
- isc_result_t status;
-
-- if ((file = open (path_resolv_conf, O_RDONLY)) < 0) {
-+ if ((file = open (path_resolv_conf, O_RDONLY | O_CLOEXEC)) < 0) {
- log_error ("Can't open %s: %m", path_resolv_conf);
- return;
- }
-diff -up dhcp-4.2.2b1/common/upf.c.cloexec dhcp-4.2.2b1/common/upf.c
---- dhcp-4.2.2b1/common/upf.c.cloexec 2011-07-01 14:13:30.979887712 +0200
-+++ dhcp-4.2.2b1/common/upf.c 2011-07-01 14:13:31.034887671 +0200
-@@ -77,7 +77,7 @@ int if_register_upf (info)
- /* %Audit% Cannot exceed 36 bytes. %2004.06.17,Safe% */
- sprintf(filename, "/dev/pf/pfilt%d", b);
-
-- sock = open (filename, O_RDWR, 0);
-+ sock = open (filename, O_RDWR | O_CLOEXEC, 0);
- if (sock < 0) {
- if (errno == EBUSY) {
- continue;
-diff -up dhcp-4.2.2b1/dst/dst_api.c.cloexec dhcp-4.2.2b1/dst/dst_api.c
---- dhcp-4.2.2b1/dst/dst_api.c.cloexec 2009-10-29 01:46:48.000000000 +0100
-+++ dhcp-4.2.2b1/dst/dst_api.c 2011-07-01 14:13:31.035887670 +0200
-@@ -437,7 +437,7 @@ dst_s_write_private_key(const DST_KEY *k
- PRIVATE_KEY, PATH_MAX);
-
- /* Do not overwrite an existing file */
-- if ((fp = dst_s_fopen(file, "w", 0600)) != NULL) {
-+ if ((fp = dst_s_fopen(file, "we", 0600)) != NULL) {
- int nn;
- if ((nn = fwrite(encoded_block, 1, len, fp)) != len) {
- EREPORT(("dst_write_private_key(): Write failure on %s %d != %d errno=%d\n",
-@@ -494,7 +494,7 @@ dst_s_read_public_key(const char *in_nam
- * flags, proto, alg stored as decimal (or hex numbers FIXME).
- * (FIXME: handle parentheses for line continuation.)
- */
-- if ((fp = dst_s_fopen(name, "r", 0)) == NULL) {
-+ if ((fp = dst_s_fopen(name, "re", 0)) == NULL) {
- EREPORT(("dst_read_public_key(): Public Key not found %s\n",
- name));
- return (NULL);
-@@ -620,7 +620,7 @@ dst_s_write_public_key(const DST_KEY *ke
- return (0);
- }
- /* create public key file */
-- if ((fp = dst_s_fopen(filename, "w+", 0644)) == NULL) {
-+ if ((fp = dst_s_fopen(filename, "w+e", 0644)) == NULL) {
- EREPORT(("DST_write_public_key: open of file:%s failed (errno=%d)\n",
- filename, errno));
- return (0);
-@@ -854,7 +854,7 @@ dst_s_read_private_key_file(char *name,
- return (0);
- }
- /* first check if we can find the key file */
-- if ((fp = dst_s_fopen(filename, "r", 0)) == NULL) {
-+ if ((fp = dst_s_fopen(filename, "re", 0)) == NULL) {
- EREPORT(("dst_s_read_private_key_file: Could not open file %s in directory %s\n",
- filename, dst_path[0] ? dst_path :
- (char *) getcwd(NULL, PATH_MAX - 1)));
-diff -up dhcp-4.2.2b1/dst/prandom.c.cloexec dhcp-4.2.2b1/dst/prandom.c
---- dhcp-4.2.2b1/dst/prandom.c.cloexec 2009-11-20 02:49:01.000000000 +0100
-+++ dhcp-4.2.2b1/dst/prandom.c 2011-07-01 14:13:31.035887670 +0200
-@@ -269,7 +269,7 @@ get_dev_random(u_char *output, unsigned
-
- s = stat("/dev/random", &st);
- if (s == 0 && S_ISCHR(st.st_mode)) {
-- if ((fd = open("/dev/random", O_RDONLY | O_NONBLOCK)) != -1) {
-+ if ((fd = open("/dev/random", O_RDONLY | O_NONBLOCK | O_CLOEXEC)) != -1) {
- if ((n = read(fd, output, size)) < 0)
- n = 0;
- close(fd);
-@@ -480,7 +480,7 @@ digest_file(dst_work *work)
- work->file_digest = dst_free_key(work->file_digest);
- return (0);
- }
-- if ((fp = fopen(name, "r")) == NULL)
-+ if ((fp = fopen(name, "re")) == NULL)
- return (0);
- for (no = 0; (i = fread(buf, sizeof(*buf), sizeof(buf), fp)) > 0;
- no += i)
-diff -up dhcp-4.2.2b1/omapip/trace.c.cloexec dhcp-4.2.2b1/omapip/trace.c
---- dhcp-4.2.2b1/omapip/trace.c.cloexec 2010-05-27 02:34:57.000000000 +0200
-+++ dhcp-4.2.2b1/omapip/trace.c 2011-07-01 14:13:31.036887669 +0200
-@@ -141,10 +141,10 @@ isc_result_t trace_begin (const char *fi
- return DHCP_R_INVALIDARG;
- }
-
-- traceoutfile = open (filename, O_CREAT | O_WRONLY | O_EXCL, 0600);
-+ traceoutfile = open (filename, O_CREAT | O_WRONLY | O_EXCL | O_CLOEXEC, 0600);
- if (traceoutfile < 0 && errno == EEXIST) {
- log_error ("WARNING: Overwriting trace file \"%s\"", filename);
-- traceoutfile = open (filename, O_WRONLY | O_EXCL | O_TRUNC,
-+ traceoutfile = open (filename, O_WRONLY | O_EXCL | O_TRUNC | O_CLOEXEC,
- 0600);
- }
-
-@@ -431,7 +431,7 @@ void trace_file_replay (const char *file
- isc_result_t result;
- int len;
-
-- traceinfile = fopen (filename, "r");
-+ traceinfile = fopen (filename, "re");
- if (!traceinfile) {
- log_error("Can't open tracefile %s: %m", filename);
- return;
-diff -up dhcp-4.2.2b1/relay/dhcrelay.c.cloexec dhcp-4.2.2b1/relay/dhcrelay.c
---- dhcp-4.2.2b1/relay/dhcrelay.c.cloexec 2011-05-10 15:07:37.000000000 +0200
-+++ dhcp-4.2.2b1/relay/dhcrelay.c 2011-07-01 14:18:07.630209767 +0200
-@@ -183,11 +183,11 @@ main(int argc, char **argv) {
- /* Make sure that file descriptors 0(stdin), 1,(stdout), and
- 2(stderr) are open. To do this, we assume that when we
- open a file the lowest available file descriptor is used. */
-- fd = open("/dev/null", O_RDWR);
-+ fd = open("/dev/null", O_RDWR | O_CLOEXEC);
- if (fd == 0)
-- fd = open("/dev/null", O_RDWR);
-+ fd = open("/dev/null", O_RDWR | O_CLOEXEC);
- if (fd == 1)
-- fd = open("/dev/null", O_RDWR);
-+ fd = open("/dev/null", O_RDWR | O_CLOEXEC);
- if (fd == 2)
- log_perror = 0; /* No sense logging to /dev/null. */
- else if (fd != -1)
-@@ -540,13 +540,13 @@ main(int argc, char **argv) {
-
- if (no_pid_file == ISC_FALSE) {
- pfdesc = open(path_dhcrelay_pid,
-- O_CREAT | O_TRUNC | O_WRONLY, 0644);
-+ O_CREAT | O_TRUNC | O_WRONLY | O_CLOEXEC, 0644);
-
- if (pfdesc < 0) {
- log_error("Can't create %s: %m",
- path_dhcrelay_pid);
- } else {
-- pf = fdopen(pfdesc, "w");
-+ pf = fdopen(pfdesc, "we");
- if (!pf)
- log_error("Can't fdopen %s: %m",
- path_dhcrelay_pid);
-diff -up dhcp-4.2.2b1/server/confpars.c.cloexec dhcp-4.2.2b1/server/confpars.c
---- dhcp-4.2.2b1/server/confpars.c.cloexec 2010-10-14 00:34:45.000000000 +0200
-+++ dhcp-4.2.2b1/server/confpars.c 2011-07-01 14:13:31.039887666 +0200
-@@ -116,7 +116,7 @@ isc_result_t read_conf_file (const char
- }
- #endif
-
-- if ((file = open (filename, O_RDONLY)) < 0) {
-+ if ((file = open (filename, O_RDONLY | O_CLOEXEC)) < 0) {
- if (leasep) {
- log_error ("Can't open lease database %s: %m --",
- path_dhcpd_db);
-diff -up dhcp-4.2.2b1/server/db.c.cloexec dhcp-4.2.2b1/server/db.c
---- dhcp-4.2.2b1/server/db.c.cloexec 2010-09-14 00:15:26.000000000 +0200
-+++ dhcp-4.2.2b1/server/db.c 2011-07-01 14:13:31.040887665 +0200
-@@ -1035,7 +1035,7 @@ void db_startup (testp)
- }
- #endif
- if (!testp) {
-- db_file = fopen (path_dhcpd_db, "a");
-+ db_file = fopen (path_dhcpd_db, "ae");
- if (!db_file)
- log_fatal ("Can't open %s for append.", path_dhcpd_db);
- expire_all_pools ();
-@@ -1083,12 +1083,12 @@ int new_lease_file ()
- path_dhcpd_db, (int)t) >= sizeof newfname)
- log_fatal("new_lease_file: lease file path too long");
-
-- db_fd = open (newfname, O_WRONLY | O_TRUNC | O_CREAT, 0664);
-+ db_fd = open (newfname, O_WRONLY | O_TRUNC | O_CREAT | O_CLOEXEC, 0664);
- if (db_fd < 0) {
- log_error ("Can't create new lease file: %m");
- return 0;
- }
-- if ((new_db_file = fdopen(db_fd, "w")) == NULL) {
-+ if ((new_db_file = fdopen(db_fd, "we")) == NULL) {
- log_error("Can't fdopen new lease file: %m");
- close(db_fd);
- goto fdfail;
-diff -up dhcp-4.2.2b1/server/dhcpd.c.cloexec dhcp-4.2.2b1/server/dhcpd.c
---- dhcp-4.2.2b1/server/dhcpd.c.cloexec 2011-04-21 16:08:15.000000000 +0200
-+++ dhcp-4.2.2b1/server/dhcpd.c 2011-07-01 14:19:40.354124505 +0200
-@@ -270,11 +270,11 @@ main(int argc, char **argv) {
- /* Make sure that file descriptors 0 (stdin), 1, (stdout), and
- 2 (stderr) are open. To do this, we assume that when we
- open a file the lowest available file descriptor is used. */
-- fd = open("/dev/null", O_RDWR);
-+ fd = open("/dev/null", O_RDWR | O_CLOEXEC);
- if (fd == 0)
-- fd = open("/dev/null", O_RDWR);
-+ fd = open("/dev/null", O_RDWR | O_CLOEXEC);
- if (fd == 1)
-- fd = open("/dev/null", O_RDWR);
-+ fd = open("/dev/null", O_RDWR | O_CLOEXEC);
- if (fd == 2)
- log_perror = 0; /* No sense logging to /dev/null. */
- else if (fd != -1)
-@@ -793,7 +793,7 @@ main(int argc, char **argv) {
- */
- if (no_pid_file == ISC_FALSE) {
- /*Read previous pid file. */
-- if ((i = open (path_dhcpd_pid, O_RDONLY)) >= 0) {
-+ if ((i = open (path_dhcpd_pid, O_RDONLY | O_CLOEXEC)) >= 0) {
- status = read(i, pbuf, (sizeof pbuf) - 1);
- close (i);
- if (status > 0) {
-@@ -812,7 +812,7 @@ main(int argc, char **argv) {
- }
-
- /* Write new pid file. */
-- i = open(path_dhcpd_pid, O_WRONLY|O_CREAT|O_TRUNC, 0644);
-+ i = open(path_dhcpd_pid, O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0644);
- if (i >= 0) {
- sprintf(pbuf, "%d\n", (int) getpid());
- IGNORE_RET (write(i, pbuf, strlen(pbuf)));
-@@ -840,9 +840,9 @@ main(int argc, char **argv) {
- close(2);
-
- /* Reopen them on /dev/null. */
-- open("/dev/null", O_RDWR);
-- open("/dev/null", O_RDWR);
-- open("/dev/null", O_RDWR);
-+ open("/dev/null", O_RDWR | O_CLOEXEC);
-+ open("/dev/null", O_RDWR | O_CLOEXEC);
-+ open("/dev/null", O_RDWR | O_CLOEXEC);
- log_perror = 0; /* No sense logging to /dev/null. */
-
- IGNORE_RET (chdir("/"));
-diff -up dhcp-4.2.2b1/server/ldap.c.cloexec dhcp-4.2.2b1/server/ldap.c
---- dhcp-4.2.2b1/server/ldap.c.cloexec 2010-03-25 16:26:58.000000000 +0100
-+++ dhcp-4.2.2b1/server/ldap.c 2011-07-01 14:13:31.043887665 +0200
-@@ -685,7 +685,7 @@ ldap_start (void)
-
- if (ldap_debug_file != NULL && ldap_debug_fd == -1)
- {
-- if ((ldap_debug_fd = open (ldap_debug_file, O_CREAT | O_TRUNC | O_WRONLY,
-+ if ((ldap_debug_fd = open (ldap_debug_file, O_CREAT | O_TRUNC | O_WRONLY | O_CLOEXEC,
- S_IRUSR | S_IWUSR)) < 0)
- log_error ("Error opening debug LDAP log file %s: %s", ldap_debug_file,
- strerror (errno));
diff --git a/src/patches/dhcp-4.2.2-capability.patch b/src/patches/dhcp-4.2.2-capability.patch
deleted file mode 100644
index 79af036..0000000
--- a/src/patches/dhcp-4.2.2-capability.patch
+++ /dev/null
@@ -1,323 +0,0 @@
-diff -up dhcp-4.2.2b1/client/dhclient.8.capability dhcp-4.2.2b1/client/dhclient.8
---- dhcp-4.2.2b1/client/dhclient.8.capability 2011-07-01 15:09:06.603784531 +0200
-+++ dhcp-4.2.2b1/client/dhclient.8 2011-07-01 15:09:06.663783913 +0200
-@@ -118,6 +118,9 @@ dhclient - Dynamic Host Configuration Pr
- .B -w
- ]
- [
-+.B -nc
-+]
-+[
- .B -B
- ]
- [
-@@ -296,6 +299,32 @@ has been added or removed, so that the c
- address on that interface.
-
- .TP
-+.BI \-nc
-+Do not drop capabilities.
-+
-+Normally, if
-+.B dhclient
-+was compiled with libcap-ng support,
-+.B dhclient
-+drops most capabilities immediately upon startup. While more secure,
-+this greatly restricts the additional actions that hooks in
-+.B dhclient-script (8)
-+can take. (For example, any daemons that
-+.B dhclient-script (8)
-+starts or restarts will inherit the restricted capabilities as well,
-+which may interfere with their correct operation.) Thus, the
-+.BI \-nc
-+option can be used to prevent
-+.B dhclient
-+from dropping capabilities.
-+
-+The
-+.BI \-nc
-+option is ignored if
-+.B dhclient
-+was not compiled with libcap-ng support.
-+
-+.TP
- .BI \-B
- Set the BOOTP broadcast flag in request packets so servers will always
- broadcast replies.
-diff -up dhcp-4.2.2b1/client/dhclient.c.capability dhcp-4.2.2b1/client/dhclient.c
---- dhcp-4.2.2b1/client/dhclient.c.capability 2011-07-01 15:09:06.644784107 +0200
-+++ dhcp-4.2.2b1/client/dhclient.c 2011-07-01 15:09:06.664783903 +0200
-@@ -39,6 +39,10 @@
- #include <limits.h>
- #include <dns/result.h>
-
-+#ifdef HAVE_LIBCAP_NG
-+#include <cap-ng.h>
-+#endif
-+
- /*
- * Defined in stdio.h when _GNU_SOURCE is set, but we don't want to define
- * that when building ISC code.
-@@ -141,6 +145,9 @@ main(int argc, char **argv) {
- int timeout_arg = 0;
- char *arg_conf = NULL;
- int arg_conf_len = 0;
-+#ifdef HAVE_LIBCAP_NG
-+ int keep_capabilities = 0;
-+#endif
-
- /* Initialize client globals. */
- memset(&default_duid, 0, sizeof(default_duid));
-@@ -410,6 +417,10 @@ main(int argc, char **argv) {
- }
-
- dhclient_request_options = argv[i];
-+ } else if (!strcmp(argv[i], "-nc")) {
-+#ifdef HAVE_LIBCAP_NG
-+ keep_capabilities = 1;
-+#endif
- } else if (argv[i][0] == '-') {
- usage();
- } else if (interfaces_requested < 0) {
-@@ -458,6 +469,19 @@ main(int argc, char **argv) {
- path_dhclient_script = s;
- }
-
-+#ifdef HAVE_LIBCAP_NG
-+ /* Drop capabilities */
-+ if (!keep_capabilities) {
-+ capng_clear(CAPNG_SELECT_CAPS);
-+ capng_update(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED,
-+ CAP_DAC_OVERRIDE); // Drop this someday
-+ capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED,
-+ CAP_NET_ADMIN, CAP_NET_RAW,
-+ CAP_NET_BIND_SERVICE, CAP_SYS_ADMIN, -1);
-+ capng_apply(CAPNG_SELECT_CAPS);
-+ }
-+#endif
-+
- /* Set up the initial dhcp option universe. */
- initialize_common_option_spaces();
-
-diff -up dhcp-4.2.2b1/client/dhclient-script.8.capability dhcp-4.2.2b1/client/dhclient-script.8
---- dhcp-4.2.2b1/client/dhclient-script.8.capability 2011-07-01 15:09:06.604784521 +0200
-+++ dhcp-4.2.2b1/client/dhclient-script.8 2011-07-01 15:09:06.666783883 +0200
-@@ -239,6 +239,16 @@ repeatedly initialized to the values pro
- the other. Assuming the information provided by both servers is
- valid, this shouldn't cause any real problems, but it could be
- confusing.
-+.PP
-+Normally, if dhclient was compiled with libcap-ng support,
-+dhclient drops most capabilities immediately upon startup.
-+While more secure, this greatly restricts the additional actions that
-+hooks in dhclient-script can take. For example, any daemons that
-+dhclient-script starts or restarts will inherit the restricted
-+capabilities as well, which may interfere with their correct operation.
-+Thus, the
-+.BI \-nc
-+option can be used to prevent dhclient from dropping capabilities.
- .SH SEE ALSO
- dhclient(8), dhcpd(8), dhcrelay(8), dhclient.conf(5) and
- dhclient.leases(5).
-diff -up dhcp-4.2.2b1/client/Makefile.am.capability dhcp-4.2.2b1/client/Makefile.am
---- dhcp-4.2.2b1/client/Makefile.am.capability 2011-07-01 15:09:06.526785327 +0200
-+++ dhcp-4.2.2b1/client/Makefile.am 2011-07-01 15:09:06.667783873 +0200
-@@ -5,7 +5,7 @@ dhclient_SOURCES = clparse.c dhclient.c
- scripts/netbsd scripts/nextstep scripts/openbsd \
- scripts/solaris scripts/openwrt
- dhclient_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \
-- $(BIND9_LIBDIR) -ldns-export -lisc-export
-+ $(BIND9_LIBDIR) -ldns-export -lisc-export $(CAPNG_LDADD)
- man_MANS = dhclient.8 dhclient-script.8 dhclient.conf.5 dhclient.leases.5
- EXTRA_DIST = $(man_MANS)
-
-diff -up dhcp-4.2.2b1/configure.ac.capability dhcp-4.2.2b1/configure.ac
---- dhcp-4.2.2b1/configure.ac.capability 2011-07-01 15:09:06.527785317 +0200
-+++ dhcp-4.2.2b1/configure.ac 2011-07-01 15:09:06.667783873 +0200
-@@ -449,6 +449,41 @@ AC_TRY_LINK(
- # Look for optional headers.
- AC_CHECK_HEADERS(sys/socket.h net/if_dl.h net/if6.h regex.h)
-
-+# look for capabilities library
-+AC_ARG_WITH(libcap-ng,
-+ [ --with-libcap-ng=[auto/yes/no] Add Libcap-ng support [default=auto]],,
-+ with_libcap_ng=auto)
-+
-+# Check for Libcap-ng API
-+#
-+# libcap-ng detection
-+if test x$with_libcap_ng = xno ; then
-+ have_libcap_ng=no;
-+else
-+ # Start by checking for header file
-+ AC_CHECK_HEADER(cap-ng.h, capng_headers=yes, capng_headers=no)
-+
-+ # See if we have libcap-ng library
-+ AC_CHECK_LIB(cap-ng, capng_clear,
-+ CAPNG_LDADD=-lcap-ng,)
-+
-+ # Check results are usable
-+ if test x$with_libcap_ng = xyes -a x$CAPNG_LDADD = x ; then
-+ AC_MSG_ERROR(libcap-ng support was requested and the library was not found)
-+ fi
-+ if test x$CAPNG_LDADD != x -a $capng_headers = no ; then
-+ AC_MSG_ERROR(libcap-ng libraries found but headers are missing)
-+ fi
-+fi
-+AC_SUBST(CAPNG_LDADD)
-+AC_MSG_CHECKING(whether to use libcap-ng)
-+if test x$CAPNG_LDADD != x ; then
-+ AC_DEFINE(HAVE_LIBCAP_NG,1,[libcap-ng support])
-+ AC_MSG_RESULT(yes)
-+else
-+ AC_MSG_RESULT(no)
-+fi
-+
- # Solaris needs some libraries for functions
- AC_SEARCH_LIBS(socket, [socket])
- AC_SEARCH_LIBS(inet_ntoa, [nsl])
-diff -up dhcp-4.2.2b1/relay/dhcrelay.c.capability dhcp-4.2.2b1/relay/dhcrelay.c
---- dhcp-4.2.2b1/relay/dhcrelay.c.capability 2011-07-01 15:09:06.626784295 +0200
-+++ dhcp-4.2.2b1/relay/dhcrelay.c 2011-07-01 15:12:05.362223794 +0200
-@@ -36,6 +36,11 @@
- #include <syslog.h>
- #include <sys/time.h>
-
-+#ifdef HAVE_LIBCAP_NG
-+# include <cap-ng.h>
-+ int keep_capabilities = 0;
-+#endif
-+
- TIME default_lease_time = 43200; /* 12 hours... */
- TIME max_lease_time = 86400; /* 24 hours... */
- struct tree_cache *global_options[256];
-@@ -356,6 +361,10 @@ main(int argc, char **argv) {
- sl->next = upstreams;
- upstreams = sl;
- #endif
-+ } else if (!strcmp(argv[i], "-nc")) {
-+#ifdef HAVE_LIBCAP_NG
-+ keep_capabilities = 1;
-+#endif
- } else if (!strcmp(argv[i], "-pf")) {
- if (++i == argc)
- usage();
-@@ -426,6 +435,17 @@ main(int argc, char **argv) {
- #endif
- }
-
-+#ifdef HAVE_LIBCAP_NG
-+ /* Drop capabilities */
-+ if (!keep_capabilities) {
-+ capng_clear(CAPNG_SELECT_BOTH);
-+ capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED,
-+ CAP_NET_RAW, CAP_NET_BIND_SERVICE, -1);
-+ capng_apply(CAPNG_SELECT_BOTH);
-+ log_info ("Dropped all unnecessary capabilities.");
-+ }
-+#endif
-+
- if (!quiet) {
- log_info("%s %s", message, PACKAGE_VERSION);
- log_info(copyright);
-@@ -573,6 +593,15 @@ main(int argc, char **argv) {
- dhcpv6_packet_handler = do_packet6;
- #endif
-
-+#ifdef HAVE_LIBCAP_NG
-+ /* Drop all capabilities */
-+ if (!keep_capabilities) {
-+ capng_clear(CAPNG_SELECT_BOTH);
-+ capng_apply(CAPNG_SELECT_BOTH);
-+ log_info ("Dropped all capabilities.");
-+ }
-+#endif
-+
- /* Start dispatching packets and timeouts... */
- dispatch();
-
-diff -up dhcp-4.2.2b1/relay/Makefile.am.capability dhcp-4.2.2b1/relay/Makefile.am
---- dhcp-4.2.2b1/relay/Makefile.am.capability 2011-07-01 15:09:06.546785121 +0200
-+++ dhcp-4.2.2b1/relay/Makefile.am 2011-07-01 15:09:06.670783841 +0200
-@@ -3,7 +3,7 @@ AM_CPPFLAGS = -DLOCALSTATEDIR='"@localst
- sbin_PROGRAMS = dhcrelay
- dhcrelay_SOURCES = dhcrelay.c
- dhcrelay_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \
-- $(BIND9_LIBDIR) -ldns-export -lisc-export
-+ $(BIND9_LIBDIR) -ldns-export -lisc-export $(CAPNG_LDADD)
- man_MANS = dhcrelay.8
- EXTRA_DIST = $(man_MANS)
-
-diff -up dhcp-4.2.2b1/server/dhcpd.c.capability dhcp-4.2.2b1/server/dhcpd.c
---- dhcp-4.2.2b1/server/dhcpd.c.capability 2011-07-01 15:09:06.636784192 +0200
-+++ dhcp-4.2.2b1/server/dhcpd.c 2011-07-01 15:09:06.670783841 +0200
-@@ -58,6 +58,11 @@ static const char url [] =
- # undef group
- #endif /* PARANOIA */
-
-+#ifdef HAVE_LIBCAP_NG
-+# include <cap-ng.h>
-+ int keep_capabilities = 0;
-+#endif
-+
- static void usage(void);
-
- struct iaddr server_identifier;
-@@ -403,6 +408,10 @@ main(int argc, char **argv) {
- traceinfile = argv [i];
- trace_replay_init ();
- #endif /* TRACING */
-+ } else if (!strcmp(argv[i], "-nc")) {
-+#ifdef HAVE_LIBCAP_NG
-+ keep_capabilities = 1;
-+#endif
- } else if (argv [i][0] == '-') {
- usage ();
- } else {
-@@ -459,6 +468,17 @@ main(int argc, char **argv) {
- }
- #endif /* DHCPv6 */
-
-+#ifdef HAVE_LIBCAP_NG
-+ /* Drop capabilities */
-+ if (!keep_capabilities) {
-+ capng_clear(CAPNG_SELECT_BOTH);
-+ capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED,
-+ CAP_NET_RAW, CAP_NET_BIND_SERVICE, CAP_SYS_CHROOT, CAP_SETUID, CAP_SETGID, -1);
-+ capng_apply(CAPNG_SELECT_BOTH);
-+ log_info ("Dropped all unnecessary capabilities.");
-+ }
-+#endif
-+
- /*
- * convert relative path names to absolute, for files that need
- * to be reopened after chdir() has been called
-@@ -859,6 +879,15 @@ main(int argc, char **argv) {
- omapi_set_int_value ((omapi_object_t *)dhcp_control_object,
- (omapi_object_t *)0, "state", server_running);
-
-+#ifdef HAVE_LIBCAP_NG
-+ /* Drop all capabilities */
-+ if (!keep_capabilities) {
-+ capng_clear(CAPNG_SELECT_BOTH);
-+ capng_apply(CAPNG_SELECT_BOTH);
-+ log_info ("Dropped all capabilities.");
-+ }
-+#endif
-+
- /* Receive packets and dispatch them... */
- dispatch ();
-
-diff -up dhcp-4.2.2b1/server/Makefile.am.capability dhcp-4.2.2b1/server/Makefile.am
---- dhcp-4.2.2b1/server/Makefile.am.capability 2011-07-01 15:09:06.546785121 +0200
-+++ dhcp-4.2.2b1/server/Makefile.am 2011-07-01 15:09:06.671783830 +0200
-@@ -8,7 +8,8 @@ dhcpd_SOURCES = dhcpd.c dhcp.c bootp.c c
-
- dhcpd_CFLAGS = $(LDAP_CFLAGS)
- dhcpd_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \
-- ../dhcpctl/libdhcpctl.a $(BIND9_LIBDIR) -ldns-export -lisc-export
-+ ../dhcpctl/libdhcpctl.a $(BIND9_LIBDIR) -ldns-export -lisc-export \
-+ $(CAPNG_LDADD)
-
- man_MANS = dhcpd.8 dhcpd.conf.5 dhcpd.leases.5
- EXTRA_DIST = $(man_MANS)
diff --git a/src/patches/dhcp-4.2.2-dhclient-usage.patch b/src/patches/dhcp-4.2.2-dhclient-usage.patch
deleted file mode 100644
index 0d41943..0000000
--- a/src/patches/dhcp-4.2.2-dhclient-usage.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff -up dhcp-4.2.2b1/client/dhclient.c.usage dhcp-4.2.2b1/client/dhclient.c
---- dhcp-4.2.2b1/client/dhclient.c.usage 2011-07-01 13:55:16.000000000 +0200
-+++ dhcp-4.2.2b1/client/dhclient.c 2011-07-01 13:58:55.243800602 +0200
-@@ -1047,6 +1047,10 @@ static void usage()
- " [-s server-addr] [-cf config-file] "
- "[-lf lease-file]\n"
- " [-pf pid-file] [--no-pid] [-e VAR=val]\n"
-+ " [-I <dhcp-client-identifier>] [-B]\n"
-+ " [-H <host-name> | -F <fqdn.fqdn>] [-timeout <timeout>]\n"
-+ " [-V <vendor-class-identifier>]\n"
-+ " [-R <request option list>]\n"
- " [-sf script-file] [interface]");
- }
-
diff --git a/src/patches/dhcp-4.2.2-gpxe-cid.patch b/src/patches/dhcp-4.2.2-gpxe-cid.patch
deleted file mode 100644
index c0be4c2..0000000
--- a/src/patches/dhcp-4.2.2-gpxe-cid.patch
+++ /dev/null
@@ -1,132 +0,0 @@
-diff -up dhcp-4.2.2/client/dhclient.c.gpxe-cid dhcp-4.2.2/client/dhclient.c
---- dhcp-4.2.2/client/dhclient.c.gpxe-cid 2011-09-16 18:23:20.190453902 +0200
-+++ dhcp-4.2.2/client/dhclient.c 2011-09-16 18:27:15.568463599 +0200
-@@ -58,6 +58,13 @@ const char *path_dhclient_pid = NULL;
- static char path_dhclient_script_array[] = _PATH_DHCLIENT_SCRIPT;
- char *path_dhclient_script = path_dhclient_script_array;
-
-+/* Default Prefix */
-+static unsigned char default_prefix[12] = {
-+ 0xff, 0x00, 0x00, 0x00,
-+ 0x00, 0x00, 0x02, 0x00,
-+ 0x00, 0x02, 0xc9, 0x00
-+};
-+
- /* False (default) => we write and use a pid file */
- isc_boolean_t no_pid_file = ISC_FALSE;
-
-@@ -1250,6 +1257,12 @@ int find_subnet (struct subnet **sp,
- static void setup_ib_interface(struct interface_info *ip)
- {
- struct group *g;
-+ struct hardware *hw = &ip->hw_address;
-+ char client_id[64];
-+ char *arg_conf = NULL;
-+ int arg_conf_len = 0;
-+ isc_result_t status;
-+ struct parse *cfile = (struct parse *)0;
-
- /* Set the broadcast flag */
- ip->client->config->bootp_broadcast_always = 1;
-@@ -1266,8 +1279,39 @@ static void setup_ib_interface(struct in
- }
- }
-
-- /* No client ID specified */
-- log_fatal("dhcp-client-identifier must be specified for InfiniBand");
-+ /*
-+ * No client ID specified, make up one based on a default
-+ * "prefix" and the port GUID.
-+ *
-+ * NOTE: This is compatible with what gpxe does.
-+ */
-+ sprintf(client_id, "%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x",
-+ default_prefix[0], default_prefix[1], default_prefix[2],
-+ default_prefix[3], default_prefix[4], default_prefix[5],
-+ default_prefix[6], default_prefix[7], default_prefix[8],
-+ default_prefix[9], default_prefix[10], default_prefix[11],
-+ hw->hbuf[1], hw->hbuf[2], hw->hbuf[3], hw->hbuf[4],
-+ hw->hbuf[5], hw->hbuf[6], hw->hbuf[7], hw->hbuf[8]);
-+
-+ arg_conf_len = asprintf(&arg_conf,
-+ "send dhcp-client-identifier %s;",
-+ client_id);
-+
-+ if ((arg_conf == 0) || (arg_conf_len <= 0))
-+ log_fatal("Unable to send option dhcp-client-identifier");
-+
-+ status = new_parse(&cfile, -1, arg_conf, arg_conf_len,
-+ "Automatic Infiniband client identifier", 0);
-+
-+ if ((status != ISC_R_SUCCESS) || (cfile->warnings_occurred))
-+ log_fatal("Failed to parse Infiniband client identifier");
-+
-+ parse_client_statement(cfile, NULL, ip->client->config);
-+
-+ if (cfile->warnings_occurred)
-+ log_fatal("Failed to parse Infiniband client identifier");
-+
-+ end_parse(&cfile);
- }
-
- /* Individual States:
-diff -up dhcp-4.2.2/common/lpf.c.gpxe-cid dhcp-4.2.2/common/lpf.c
---- dhcp-4.2.2/common/lpf.c.gpxe-cid 2011-09-16 18:23:20.183453996 +0200
-+++ dhcp-4.2.2/common/lpf.c 2011-09-16 18:25:28.235804421 +0200
-@@ -591,6 +591,37 @@ void maybe_setup_fallback ()
- }
- }
-
-+static unsigned char * get_ib_hw_addr(char * name)
-+{
-+ struct ifaddrs *ifaddrs;
-+ struct ifaddrs *ifa;
-+ struct sockaddr_ll *sll = NULL;
-+ static unsigned char hw_addr[8];
-+
-+ if (getifaddrs(&ifaddrs) == -1)
-+ return NULL;
-+
-+ for (ifa = ifaddrs; ifa != NULL; ifa = ifa->ifa_next) {
-+ if (ifa->ifa_addr == NULL)
-+ continue;
-+ if (ifa->ifa_addr->sa_family != AF_PACKET)
-+ continue;
-+ if (ifa->ifa_flags & IFF_LOOPBACK)
-+ continue;
-+ if (strcmp(ifa->ifa_name, name) == 0) {
-+ sll = (struct sockaddr_ll *)(void *)ifa->ifa_addr;
-+ break;
-+ }
-+ }
-+ if (sll == NULL) {
-+ freeifaddrs(ifaddrs);
-+ return NULL;
-+ }
-+ memcpy(hw_addr, &sll->sll_addr[sll->sll_halen - 8], 8);
-+ freeifaddrs(ifaddrs);
-+ return (unsigned char *)&hw_addr;
-+}
-+
- void
- get_hw_addr(struct interface_info *info)
- {
-@@ -599,6 +630,7 @@ get_hw_addr(struct interface_info *info)
- struct ifaddrs *ifaddrs;
- struct ifaddrs *ifa;
- struct sockaddr_ll *sll = NULL;
-+ unsigned char *hw_addr;
-
- if (getifaddrs(&ifaddrs) == -1)
- log_fatal("Failed to get interfaces");
-@@ -660,6 +692,10 @@ get_hw_addr(struct interface_info *info)
-
- hw->hlen = 1;
- hw->hbuf[0] = HTYPE_INFINIBAND;
-+ hw_addr = get_ib_hw_addr(name);
-+ if (!hw_addr)
-+ log_fatal("Failed getting %s hw addr", name);
-+ memcpy (&hw->hbuf [1], hw_addr, 8);
- break;
- #if defined(ARPHRD_PPP)
- case ARPHRD_PPP:
diff --git a/src/patches/dhcp-4.2.2-improved-xid.patch b/src/patches/dhcp-4.2.2-improved-xid.patch
deleted file mode 100644
index f49fc78..0000000
--- a/src/patches/dhcp-4.2.2-improved-xid.patch
+++ /dev/null
@@ -1,138 +0,0 @@
-diff -up dhcp-4.2.2/client/dhclient.c.improved-xid dhcp-4.2.2/client/dhclient.c
---- dhcp-4.2.2/client/dhclient.c.improved-xid 2011-09-16 18:18:00.649730661 +0200
-+++ dhcp-4.2.2/client/dhclient.c 2011-09-16 18:22:36.815035513 +0200
-@@ -898,6 +898,26 @@ main(int argc, char **argv) {
- }
- }
-
-+ /* We create a backup seed before rediscovering interfaces in order to
-+ have a seed built using all of the available interfaces
-+ It's interesting if required interfaces doesn't let us defined
-+ a really unique seed due to a lack of valid HW addr later
-+ (this is the case with DHCP over IB)
-+ We only use the last device as using a sum could broke the
-+ uniqueness of the seed among multiple nodes
-+ */
-+ unsigned backup_seed = 0;
-+ for (ip = interfaces; ip; ip = ip -> next) {
-+ int junk;
-+ if ( ip -> hw_address.hlen <= sizeof seed )
-+ continue;
-+ memcpy (&junk,
-+ &ip -> hw_address.hbuf [ip -> hw_address.hlen -
-+ sizeof seed], sizeof seed);
-+ backup_seed = junk;
-+ }
-+
-+
- /* At this point, all the interfaces that the script thinks
- are relevant should be running, so now we once again call
- discover_interfaces(), and this time ask it to actually set
-@@ -912,14 +932,36 @@ main(int argc, char **argv) {
- Not much entropy, but we're booting, so we're not likely to
- find anything better. */
- seed = 0;
-+ int seed_flag = 0;
- for (ip = interfaces; ip; ip = ip->next) {
- int junk;
-+ if ( ip -> hw_address.hlen <= sizeof seed )
-+ continue;
- memcpy(&junk,
- &ip->hw_address.hbuf[ip->hw_address.hlen -
- sizeof seed], sizeof seed);
- seed += junk;
-+ seed_flag = 1;
- }
-- srandom(seed + cur_time + (unsigned)getpid());
-+ if ( seed_flag == 0 ) {
-+ if ( backup_seed != 0 ) {
-+ seed = backup_seed;
-+ log_info ("xid: rand init seed (0x%x) built using all"
-+ " available interfaces",seed);
-+ }
-+ else {
-+ seed = cur_time^((unsigned) gethostid()) ;
-+ log_info ("xid: warning: no netdev with useable HWADDR found"
-+ " for seed's uniqueness enforcement");
-+ log_info ("xid: rand init seed (0x%x) built using gethostid",
-+ seed);
-+ }
-+ /* we only use seed and no current time as a broadcast reply */
-+ /* will certainly be used by the hwaddrless interface */
-+ srandom(seed);
-+ }
-+ else
-+ srandom(seed + cur_time + (unsigned)getpid());
-
- /* Setup specific Infiniband options */
- for (ip = interfaces; ip; ip = ip->next) {
-@@ -1457,7 +1499,7 @@ void dhcpack (packet)
- return;
- }
-
-- log_info ("DHCPACK from %s", piaddr (packet -> client_addr));
-+ log_info ("DHCPACK from %s (xid=0x%x)", piaddr (packet -> client_addr), client -> xid);
-
- lease = packet_to_lease (packet, client);
- if (!lease) {
-@@ -2174,7 +2216,7 @@ void dhcpnak (packet)
- return;
- }
-
-- log_info ("DHCPNAK from %s", piaddr (packet -> client_addr));
-+ log_info ("DHCPNAK from %s (xid=0x%x)", piaddr (packet -> client_addr), client -> xid);
-
- if (!client -> active) {
- #if defined (DEBUG)
-@@ -2300,10 +2342,10 @@ void send_discover (cpp)
- client -> packet.secs = htons (65535);
- client -> secs = client -> packet.secs;
-
-- log_info ("DHCPDISCOVER on %s to %s port %d interval %ld",
-+ log_info ("DHCPDISCOVER on %s to %s port %d interval %ld (xid=0x%x)",
- client -> name ? client -> name : client -> interface -> name,
- inet_ntoa (sockaddr_broadcast.sin_addr),
-- ntohs (sockaddr_broadcast.sin_port), (long)(client -> interval));
-+ ntohs (sockaddr_broadcast.sin_port), (long)(client -> interval), client -> xid);
-
- /* Send out a packet. */
- result = send_packet (client -> interface, (struct packet *)0,
-@@ -2584,10 +2626,10 @@ void send_request (cpp)
- client -> packet.secs = htons (65535);
- }
-
-- log_info ("DHCPREQUEST on %s to %s port %d",
-+ log_info ("DHCPREQUEST on %s to %s port %d (xid=0x%x)",
- client -> name ? client -> name : client -> interface -> name,
- inet_ntoa (destination.sin_addr),
-- ntohs (destination.sin_port));
-+ ntohs (destination.sin_port), client -> xid);
-
- if (destination.sin_addr.s_addr != INADDR_BROADCAST &&
- fallback_interface)
-@@ -2618,10 +2660,10 @@ void send_decline (cpp)
-
- int result;
-
-- log_info ("DHCPDECLINE on %s to %s port %d",
-+ log_info ("DHCPDECLINE on %s to %s port %d (xid=0x%x)",
- client -> name ? client -> name : client -> interface -> name,
- inet_ntoa (sockaddr_broadcast.sin_addr),
-- ntohs (sockaddr_broadcast.sin_port));
-+ ntohs (sockaddr_broadcast.sin_port), client -> xid);
-
- /* Send out a packet. */
- result = send_packet (client -> interface, (struct packet *)0,
-@@ -2661,10 +2703,10 @@ void send_release (cpp)
- return;
- }
-
-- log_info ("DHCPRELEASE on %s to %s port %d",
-+ log_info ("DHCPRELEASE on %s to %s port %d (xid=0x%x)",
- client -> name ? client -> name : client -> interface -> name,
- inet_ntoa (destination.sin_addr),
-- ntohs (destination.sin_port));
-+ ntohs (destination.sin_port), client -> xid);
-
- if (fallback_interface)
- result = send_packet (fallback_interface,
diff --git a/src/patches/dhcp-4.2.2-lpf-ib.patch b/src/patches/dhcp-4.2.2-lpf-ib.patch
deleted file mode 100644
index 4034028..0000000
--- a/src/patches/dhcp-4.2.2-lpf-ib.patch
+++ /dev/null
@@ -1,538 +0,0 @@
-diff -up dhcp-4.2.2/client/dhclient.c.lpf-ib dhcp-4.2.2/client/dhclient.c
---- dhcp-4.2.2/client/dhclient.c.lpf-ib 2011-09-19 11:24:08.693775799 +0200
-+++ dhcp-4.2.2/client/dhclient.c 2011-09-19 11:24:08.703775541 +0200
-@@ -113,6 +113,8 @@ static int check_domain_name_list(const
- static int check_option_values(struct universe *universe, unsigned int opt,
- const char *ptr, size_t len);
-
-+static void setup_ib_interface(struct interface_info *ip);
-+
- int
- main(int argc, char **argv) {
- int fd;
-@@ -919,6 +921,14 @@ main(int argc, char **argv) {
- }
- srandom(seed + cur_time + (unsigned)getpid());
-
-+ /* Setup specific Infiniband options */
-+ for (ip = interfaces; ip; ip = ip->next) {
-+ if (ip->client &&
-+ (ip->hw_address.hbuf[0] == HTYPE_INFINIBAND)) {
-+ setup_ib_interface(ip);
-+ }
-+ }
-+
- /* Start a configuration state machine for each interface. */
- #ifdef DHCPv6
- if (local_family == AF_INET6) {
-@@ -1195,6 +1205,29 @@ int find_subnet (struct subnet **sp,
- return 0;
- }
-
-+static void setup_ib_interface(struct interface_info *ip)
-+{
-+ struct group *g;
-+
-+ /* Set the broadcast flag */
-+ ip->client->config->bootp_broadcast_always = 1;
-+
-+ /*
-+ * Find out if a dhcp-client-identifier option was specified either
-+ * in the config file or on the command line
-+ */
-+ for (g = ip->client->config->on_transmission; g != NULL; g = g->next) {
-+ if ((g->statements != NULL) &&
-+ (strcmp(g->statements->data.option->option->name,
-+ "dhcp-client-identifier") == 0)) {
-+ return;
-+ }
-+ }
-+
-+ /* No client ID specified */
-+ log_fatal("dhcp-client-identifier must be specified for InfiniBand");
-+}
-+
- /* Individual States:
- *
- * Each routine is called from the dhclient_state_machine() in one of
-diff -up dhcp-4.2.2/common/bpf.c.lpf-ib dhcp-4.2.2/common/bpf.c
---- dhcp-4.2.2/common/bpf.c.lpf-ib 2011-09-19 11:24:08.694775773 +0200
-+++ dhcp-4.2.2/common/bpf.c 2011-09-19 11:24:08.704775516 +0200
-@@ -198,11 +198,44 @@ struct bpf_insn dhcp_bpf_filter [] = {
- BPF_STMT(BPF_RET+BPF_K, 0),
- };
-
-+/* Packet filter program for DHCP over Infiniband.
-+ *
-+ * XXX
-+ * Changes to the filter program may require changes to the constant offsets
-+ * used in lpf_gen_filter_setup to patch the port in the BPF program!
-+ * XXX
-+ */
-+struct bpf_insn dhcp_ib_bpf_filter [] = {
-+ /* Packet filter for Infiniband */
-+ /* Make sure it's a UDP packet... */
-+ BPF_STMT(BPF_LD + BPF_B + BPF_ABS, 9),
-+ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, IPPROTO_UDP, 0, 6),
-+
-+ /* Make sure this isn't a fragment... */
-+ BPF_STMT(BPF_LD + BPF_H + BPF_ABS, 6),
-+ BPF_JUMP(BPF_JMP + BPF_JSET + BPF_K, 0x1fff, 4, 0),
-+
-+ /* Get the IP header length... */
-+ BPF_STMT(BPF_LDX + BPF_B + BPF_MSH, 0),
-+
-+ /* Make sure it's to the right port... */
-+ BPF_STMT(BPF_LD + BPF_H + BPF_IND, 2),
-+ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, 67, 0, 1),
-+
-+ /* If we passed all the tests, ask for the whole packet. */
-+ BPF_STMT(BPF_RET + BPF_K, (u_int)-1),
-+
-+ /* Otherwise, drop it. */
-+ BPF_STMT(BPF_RET + BPF_K, 0),
-+};
-+
- #if defined (DEC_FDDI)
- struct bpf_insn *bpf_fddi_filter;
- #endif
-
- int dhcp_bpf_filter_len = sizeof dhcp_bpf_filter / sizeof (struct bpf_insn);
-+int dhcp_ib_bpf_filter_len = sizeof dhcp_ib_bpf_filter / sizeof (struct bpf_insn);
-+
- #if defined (HAVE_TR_SUPPORT)
- struct bpf_insn dhcp_bpf_tr_filter [] = {
- /* accept all token ring packets due to variable length header */
-diff -up dhcp-4.2.2/common/lpf.c.lpf-ib dhcp-4.2.2/common/lpf.c
---- dhcp-4.2.2/common/lpf.c.lpf-ib 2011-09-19 11:24:08.694775773 +0200
-+++ dhcp-4.2.2/common/lpf.c 2011-09-19 11:26:15.107109935 +0200
-@@ -42,6 +42,7 @@
- #include "includes/netinet/udp.h"
- #include "includes/netinet/if_ether.h"
- #include <net/if.h>
-+#include <ifaddrs.h>
-
- #ifndef PACKET_AUXDATA
- #define PACKET_AUXDATA 8
-@@ -59,6 +60,15 @@ struct tpacket_auxdata
- /* Reinitializes the specified interface after an address change. This
- is not required for packet-filter APIs. */
-
-+/* Default broadcast address for IPoIB */
-+static unsigned char default_ib_bcast_addr[20] = {
-+ 0x00, 0xff, 0xff, 0xff,
-+ 0xff, 0x12, 0x40, 0x1b,
-+ 0x00, 0x00, 0x00, 0x00,
-+ 0x00, 0x00, 0x00, 0x00,
-+ 0xff, 0xff, 0xff, 0xff
-+};
-+
- #ifdef USE_LPF_SEND
- void if_reinitialize_send (info)
- struct interface_info *info;
-@@ -86,10 +96,21 @@ int if_register_lpf (info)
- struct sockaddr common;
- } sa;
- struct ifreq ifr;
-+ int type;
-+ int protocol;
-
- /* Make an LPF socket. */
-- if ((sock = socket(PF_PACKET, SOCK_RAW,
-- htons((short)ETH_P_ALL))) < 0) {
-+ get_hw_addr(info);
-+
-+ if (info->hw_address.hbuf[0] == HTYPE_INFINIBAND) {
-+ type = SOCK_DGRAM;
-+ protocol = ETHERTYPE_IP;
-+ } else {
-+ type = SOCK_RAW;
-+ protocol = ETH_P_ALL;
-+ }
-+
-+ if ((sock = socket(PF_PACKET, type, htons((short)protocol))) < 0) {
- if (errno == ENOPROTOOPT || errno == EPROTONOSUPPORT ||
- errno == ESOCKTNOSUPPORT || errno == EPFNOSUPPORT ||
- errno == EAFNOSUPPORT || errno == EINVAL) {
-@@ -112,6 +133,7 @@ int if_register_lpf (info)
- /* Bind to the interface name */
- memset (&sa, 0, sizeof sa);
- sa.ll.sll_family = AF_PACKET;
-+ sa.ll.sll_protocol = htons(protocol);
- sa.ll.sll_ifindex = ifr.ifr_ifindex;
- if (bind (sock, &sa.common, sizeof sa)) {
- if (errno == ENOPROTOOPT || errno == EPROTONOSUPPORT ||
-@@ -127,8 +149,6 @@ int if_register_lpf (info)
- log_fatal ("Bind socket to interface: %m");
- }
-
-- get_hw_addr(info->name, &info->hw_address);
--
- return sock;
- }
- #endif /* USE_LPF_SEND || USE_LPF_RECEIVE */
-@@ -183,6 +203,8 @@ void if_deregister_send (info)
- in bpf includes... */
- extern struct sock_filter dhcp_bpf_filter [];
- extern int dhcp_bpf_filter_len;
-+extern struct sock_filter dhcp_ib_bpf_filter [];
-+extern int dhcp_ib_bpf_filter_len;
-
- #if defined (HAVE_TR_SUPPORT)
- extern struct sock_filter dhcp_bpf_tr_filter [];
-@@ -200,11 +222,13 @@ void if_register_receive (info)
- /* Open a LPF device and hang it on this interface... */
- info -> rfdesc = if_register_lpf (info);
-
-- val = 1;
-- if (setsockopt (info -> rfdesc, SOL_PACKET, PACKET_AUXDATA, &val,
-- sizeof val) < 0) {
-- if (errno != ENOPROTOOPT)
-- log_fatal ("Failed to set auxiliary packet data: %m");
-+ if (info->hw_address.hbuf[0] != HTYPE_INFINIBAND) {
-+ val = 1;
-+ if (setsockopt (info -> rfdesc, SOL_PACKET, PACKET_AUXDATA,
-+ &val, sizeof val) < 0) {
-+ if (errno != ENOPROTOOPT)
-+ log_fatal ("Failed to set auxiliary packet data: %m");
-+ }
- }
-
- #if defined (HAVE_TR_SUPPORT)
-@@ -250,15 +274,28 @@ static void lpf_gen_filter_setup (info)
-
- memset(&p, 0, sizeof(p));
-
-- /* Set up the bpf filter program structure. This is defined in
-- bpf.c */
-- p.len = dhcp_bpf_filter_len;
-- p.filter = dhcp_bpf_filter;
--
-- /* Patch the server port into the LPF program...
-- XXX changes to filter program may require changes
-- to the insn number(s) used below! XXX */
-- dhcp_bpf_filter [8].k = ntohs ((short)local_port);
-+ if (info->hw_address.hbuf[0] == HTYPE_INFINIBAND) {
-+ /* Set up the bpf filter program structure. */
-+ p.len = dhcp_ib_bpf_filter_len;
-+ p.filter = dhcp_ib_bpf_filter;
-+
-+ /* Patch the server port into the LPF program...
-+ XXX
-+ changes to filter program may require changes
-+ to the insn number(s) used below!
-+ XXX */
-+ dhcp_ib_bpf_filter[6].k = ntohs ((short)local_port);
-+ } else {
-+ /* Set up the bpf filter program structure.
-+ This is defined in bpf.c */
-+ p.len = dhcp_bpf_filter_len;
-+ p.filter = dhcp_bpf_filter;
-+
-+ /* Patch the server port into the LPF program...
-+ XXX changes to filter program may require changes
-+ to the insn number(s) used below! XXX */
-+ dhcp_bpf_filter [8].k = ntohs ((short)local_port);
-+ }
-
- if (setsockopt (info -> rfdesc, SOL_SOCKET, SO_ATTACH_FILTER, &p,
- sizeof p) < 0) {
-@@ -315,6 +352,54 @@ static void lpf_tr_filter_setup (info)
- #endif /* USE_LPF_RECEIVE */
-
- #ifdef USE_LPF_SEND
-+ssize_t send_packet_ib(interface, packet, raw, len, from, to, hto)
-+ struct interface_info *interface;
-+ struct packet *packet;
-+ struct dhcp_packet *raw;
-+ size_t len;
-+ struct in_addr from;
-+ struct sockaddr_in *to;
-+ struct hardware *hto;
-+{
-+ unsigned ibufp = 0;
-+ double ih [1536 / sizeof (double)];
-+ unsigned char *buf = (unsigned char *)ih;
-+ ssize_t result;
-+
-+ union sockunion {
-+ struct sockaddr sa;
-+ struct sockaddr_ll sll;
-+ struct sockaddr_storage ss;
-+ } su;
-+
-+ assemble_udp_ip_header (interface, buf, &ibufp, from.s_addr,
-+ to->sin_addr.s_addr, to->sin_port,
-+ (unsigned char *)raw, len);
-+ memcpy (buf + ibufp, raw, len);
-+
-+ memset(&su, 0, sizeof(su));
-+ su.sll.sll_family = AF_PACKET;
-+ su.sll.sll_protocol = htons(ETHERTYPE_IP);
-+
-+ if (!(su.sll.sll_ifindex = if_nametoindex(interface->name))) {
-+ errno = ENOENT;
-+ log_error ("send_packet_ib: %m - failed to get if index");
-+ return -1;
-+ }
-+
-+ su.sll.sll_hatype = htons(HTYPE_INFINIBAND);
-+ su.sll.sll_halen = sizeof(interface->bcast_addr);
-+ memcpy(&su.sll.sll_addr, interface->bcast_addr, 20);
-+
-+ result = sendto(interface->wfdesc, buf, ibufp + len, 0,
-+ &su.sa, sizeof(su));
-+
-+ if (result < 0)
-+ log_error ("send_packet_ib: %m");
-+
-+ return result;
-+}
-+
- ssize_t send_packet (interface, packet, raw, len, from, to, hto)
- struct interface_info *interface;
- struct packet *packet;
-@@ -335,6 +420,11 @@ ssize_t send_packet (interface, packet,
- return send_fallback (interface, packet, raw,
- len, from, to, hto);
-
-+ if (interface->hw_address.hbuf[0] == HTYPE_INFINIBAND) {
-+ return send_packet_ib(interface, packet, raw, len, from,
-+ to, hto);
-+ }
-+
- if (hto == NULL && interface->anycast_mac_addr.hlen)
- hto = &interface->anycast_mac_addr;
-
-@@ -356,6 +446,42 @@ ssize_t send_packet (interface, packet,
- #endif /* USE_LPF_SEND */
-
- #ifdef USE_LPF_RECEIVE
-+ssize_t receive_packet_ib (interface, buf, len, from, hfrom)
-+ struct interface_info *interface;
-+ unsigned char *buf;
-+ size_t len;
-+ struct sockaddr_in *from;
-+ struct hardware *hfrom;
-+{
-+ int length = 0;
-+ int offset = 0;
-+ unsigned char ibuf [1536];
-+ unsigned bufix = 0;
-+ unsigned paylen;
-+
-+ length = read(interface->rfdesc, ibuf, sizeof(ibuf));
-+
-+ if (length <= 0)
-+ return length;
-+
-+ offset = decode_udp_ip_header(interface, ibuf, bufix, from,
-+ (unsigned)length, &paylen, 0);
-+
-+ if (offset < 0)
-+ return 0;
-+
-+ bufix += offset;
-+ length -= offset;
-+
-+ if (length < paylen)
-+ log_fatal("Internal inconsistency at %s:%d.", MDL);
-+
-+ /* Copy out the data in the packet... */
-+ memcpy(buf, &ibuf[bufix], paylen);
-+
-+ return (ssize_t)paylen;
-+}
-+
- ssize_t receive_packet (interface, buf, len, from, hfrom)
- struct interface_info *interface;
- unsigned char *buf;
-@@ -382,6 +508,10 @@ ssize_t receive_packet (interface, buf,
- };
- struct cmsghdr *cmsg;
-
-+ if (interface->hw_address.hbuf[0] == HTYPE_INFINIBAND) {
-+ return receive_packet_ib(interface, buf, len, from, hfrom);
-+ }
-+
- length = recvmsg (interface -> rfdesc, &msg, 0);
- if (length <= 0)
- return length;
-@@ -462,33 +592,44 @@ void maybe_setup_fallback ()
- }
-
- void
--get_hw_addr(const char *name, struct hardware *hw) {
-- int sock;
-- struct ifreq tmp;
-- struct sockaddr *sa;
-+get_hw_addr(struct interface_info *info)
-+{
-+ struct hardware *hw = &info->hw_address;
-+ char *name = info->name;
-+ struct ifaddrs *ifaddrs;
-+ struct ifaddrs *ifa;
-+ struct sockaddr_ll *sll = NULL;
-
-- if (strlen(name) >= sizeof(tmp.ifr_name)) {
-- log_fatal("Device name too long: \"%s\"", name);
-- }
-+ if (getifaddrs(&ifaddrs) == -1)
-+ log_fatal("Failed to get interfaces");
-
-- sock = socket(AF_INET, SOCK_DGRAM, 0);
-- if (sock < 0) {
-- log_fatal("Can't create socket for \"%s\": %m", name);
-+ for (ifa = ifaddrs; ifa != NULL; ifa = ifa->ifa_next) {
-+
-+ if (ifa->ifa_addr == NULL)
-+ continue;
-+
-+ if (ifa->ifa_addr->sa_family != AF_PACKET)
-+ continue;
-+
-+ if (ifa->ifa_flags & IFF_LOOPBACK)
-+ continue;
-+
-+ if (strcmp(ifa->ifa_name, name) == 0) {
-+ sll = (struct sockaddr_ll *)(void *)ifa->ifa_addr;
-+ break;
-+ }
- }
-
-- memset(&tmp, 0, sizeof(tmp));
-- strcpy(tmp.ifr_name, name);
-- if (ioctl(sock, SIOCGIFHWADDR, &tmp) < 0) {
-- log_fatal("Error getting hardware address for \"%s\": %m",
-- name);
-+ if (sll == NULL) {
-+ freeifaddrs(ifaddrs);
-+ log_fatal("Failed to get HW address for %s\n", name);
- }
-
-- sa = &tmp.ifr_hwaddr;
-- switch (sa->sa_family) {
-+ switch (sll->sll_hatype) {
- case ARPHRD_ETHER:
- hw->hlen = 7;
- hw->hbuf[0] = HTYPE_ETHER;
-- memcpy(&hw->hbuf[1], sa->sa_data, 6);
-+ memcpy(&hw->hbuf[1], sll->sll_addr, 6);
- break;
- case ARPHRD_IEEE802:
- #ifdef ARPHRD_IEEE802_TR
-@@ -496,18 +637,35 @@ get_hw_addr(const char *name, struct har
- #endif /* ARPHRD_IEEE802_TR */
- hw->hlen = 7;
- hw->hbuf[0] = HTYPE_IEEE802;
-- memcpy(&hw->hbuf[1], sa->sa_data, 6);
-+ memcpy(&hw->hbuf[1], sll->sll_addr, 6);
- break;
- case ARPHRD_FDDI:
- hw->hlen = 17;
- hw->hbuf[0] = HTYPE_FDDI;
-- memcpy(&hw->hbuf[1], sa->sa_data, 16);
-+ memcpy(&hw->hbuf[1], sll->sll_addr, 16);
-+ break;
-+ case ARPHRD_INFINIBAND:
-+ /* For Infiniband, save the broadcast address and store
-+ * the port GUID into the hardware address.
-+ */
-+ if (ifa->ifa_flags & IFF_BROADCAST) {
-+ struct sockaddr_ll *bll;
-+
-+ bll = (struct sockaddr_ll *)ifa->ifa_broadaddr;
-+ memcpy(&info->bcast_addr, bll->sll_addr, 20);
-+ } else {
-+ memcpy(&info->bcast_addr, default_ib_bcast_addr,
-+ 20);
-+ }
-+
-+ hw->hlen = 1;
-+ hw->hbuf[0] = HTYPE_INFINIBAND;
- break;
- #if defined(ARPHRD_PPP)
- case ARPHRD_PPP:
- if (local_family != AF_INET6)
-- log_fatal("Unsupported device type %d for \"%s\"",
-- sa->sa_family, name);
-+ log_fatal("Unsupported device type %ld for \"%s\"",
-+ (long int)sll->sll_family, name);
- hw->hlen = 0;
- hw->hbuf[0] = HTYPE_RESERVED;
- /* 0xdeadbeef should never occur on the wire,
-@@ -520,10 +678,11 @@ get_hw_addr(const char *name, struct har
- break;
- #endif
- default:
-+ freeifaddrs(ifaddrs);
- log_fatal("Unsupported device type %ld for \"%s\"",
-- (long int)sa->sa_family, name);
-+ (long int)sll->sll_family, name);
- }
-
-- close(sock);
-+ freeifaddrs(ifaddrs);
- }
- #endif
-diff -up dhcp-4.2.2/common/socket.c.lpf-ib dhcp-4.2.2/common/socket.c
---- dhcp-4.2.2/common/socket.c.lpf-ib 2011-06-27 18:18:20.000000000 +0200
-+++ dhcp-4.2.2/common/socket.c 2011-09-19 11:24:08.705775490 +0200
-@@ -324,7 +324,7 @@ void if_register_send (info)
- info->wfdesc = if_register_socket(info, AF_INET, 0);
- /* If this is a normal IPv4 address, get the hardware address. */
- if (strcmp(info->name, "fallback") != 0)
-- get_hw_addr(info->name, &info->hw_address);
-+ get_hw_addr(info);
- #if defined (USE_SOCKET_FALLBACK)
- /* Fallback only registers for send, but may need to receive as
- well. */
-@@ -387,7 +387,7 @@ void if_register_receive (info)
- #endif /* IP_PKTINFO... */
- /* If this is a normal IPv4 address, get the hardware address. */
- if (strcmp(info->name, "fallback") != 0)
-- get_hw_addr(info->name, &info->hw_address);
-+ get_hw_addr(info);
-
- if (!quiet_interface_discovery)
- log_info ("Listening on Socket/%s%s%s",
-@@ -497,7 +497,7 @@ if_register6(struct interface_info *info
- if (req_multi)
- if_register_multicast(info);
-
-- get_hw_addr(info->name, &info->hw_address);
-+ get_hw_addr(info);
-
- if (!quiet_interface_discovery) {
- if (info->shared_network != NULL) {
-diff -up dhcp-4.2.2/includes/dhcpd.h.lpf-ib dhcp-4.2.2/includes/dhcpd.h
---- dhcp-4.2.2/includes/dhcpd.h.lpf-ib 2011-09-19 11:24:08.696775721 +0200
-+++ dhcp-4.2.2/includes/dhcpd.h 2011-09-19 11:24:08.707775438 +0200
-@@ -1243,6 +1243,7 @@ struct interface_info {
- struct shared_network *shared_network;
- /* Networks connected to this interface. */
- struct hardware hw_address; /* Its physical address. */
-+ u_int8_t bcast_addr[20]; /* Infiniband broadcast address */
- struct in_addr *addresses; /* Addresses associated with this
- * interface.
- */
-@@ -2356,7 +2357,7 @@ void print_dns_status (int, struct dhcp_
- #endif
- const char *print_time(TIME);
-
--void get_hw_addr(const char *name, struct hardware *hw);
-+void get_hw_addr(struct interface_info *info);
-
- /* socket.c */
- #if defined (USE_SOCKET_SEND) || defined (USE_SOCKET_RECEIVE) \
-diff -up dhcp-4.2.2/includes/dhcp.h.lpf-ib dhcp-4.2.2/includes/dhcp.h
---- dhcp-4.2.2/includes/dhcp.h.lpf-ib 2011-09-19 11:24:08.696775721 +0200
-+++ dhcp-4.2.2/includes/dhcp.h 2011-09-19 11:24:08.707775438 +0200
-@@ -79,6 +79,7 @@ struct dhcp_packet {
- #define HTYPE_ETHER 1 /* Ethernet 10Mbps */
- #define HTYPE_IEEE802 6 /* IEEE 802.2 Token Ring... */
- #define HTYPE_FDDI 8 /* FDDI... */
-+#define HTYPE_INFINIBAND 32 /* Infiniband IPoIB */
-
- #define HTYPE_RESERVED 0 /* RFC 5494 */
-
diff --git a/src/patches/dhcp-4.2.2-options.patch b/src/patches/dhcp-4.2.2-options.patch
deleted file mode 100644
index 32e2add..0000000
--- a/src/patches/dhcp-4.2.2-options.patch
+++ /dev/null
@@ -1,401 +0,0 @@
-diff -up dhcp-4.2.2b1/client/clparse.c.options dhcp-4.2.2b1/client/clparse.c
---- dhcp-4.2.2b1/client/clparse.c.options 2011-04-21 16:08:14.000000000 +0200
-+++ dhcp-4.2.2b1/client/clparse.c 2011-07-01 13:51:52.935755570 +0200
-@@ -146,6 +146,7 @@ isc_result_t read_client_conf ()
- /* Requested lease time, used by DHCPv6 (DHCPv4 uses the option cache)
- */
- top_level_config.requested_lease = 7200;
-+ top_level_config.bootp_broadcast_always = 0;
-
- group_allocate (&top_level_config.on_receipt, MDL);
- if (!top_level_config.on_receipt)
-@@ -313,7 +314,8 @@ void read_client_leases ()
- interface-declaration |
- LEASE client-lease-statement |
- ALIAS client-lease-statement |
-- KEY key-definition */
-+ KEY key-definition |
-+ BOOTP_BROADCAST_ALWAYS */
-
- void parse_client_statement (cfile, ip, config)
- struct parse *cfile;
-@@ -732,6 +734,12 @@ void parse_client_statement (cfile, ip,
- parse_reject_statement (cfile, config);
- return;
-
-+ case BOOTP_BROADCAST_ALWAYS:
-+ token = next_token(&val, (unsigned*)0, cfile);
-+ config -> bootp_broadcast_always = 1;
-+ parse_semi (cfile);
-+ return;
-+
- default:
- lose = 0;
- stmt = (struct executable_statement *)0;
-diff -up dhcp-4.2.2b1/client/dhclient.c.options dhcp-4.2.2b1/client/dhclient.c
---- dhcp-4.2.2b1/client/dhclient.c.options 2011-05-11 16:20:59.000000000 +0200
-+++ dhcp-4.2.2b1/client/dhclient.c 2011-07-01 13:51:52.936755545 +0200
-@@ -39,6 +39,12 @@
- #include <limits.h>
- #include <dns/result.h>
-
-+/*
-+ * Defined in stdio.h when _GNU_SOURCE is set, but we don't want to define
-+ * that when building ISC code.
-+ */
-+extern int asprintf(char **strp, const char *fmt, ...);
-+
- TIME default_lease_time = 43200; /* 12 hours... */
- TIME max_lease_time = 86400; /* 24 hours... */
-
-@@ -87,6 +93,9 @@ int wanted_ia_na = -1; /* the absolute
- int wanted_ia_ta = 0;
- int wanted_ia_pd = 0;
- char *mockup_relay = NULL;
-+int bootp_broadcast_always = 0;
-+
-+extern u_int32_t default_requested_options[];
-
- void run_stateless(int exit_mode);
-
-@@ -123,6 +132,15 @@ main(int argc, char **argv) {
- int local_family_set = 0;
- #endif /* DHCPv6 */
- char *s;
-+ char *dhcp_client_identifier_arg = NULL;
-+ char *dhcp_host_name_arg = NULL;
-+ char *dhcp_fqdn_arg = NULL;
-+ char *dhcp_vendor_class_identifier_arg = NULL;
-+ char *dhclient_request_options = NULL;
-+
-+ int timeout_arg = 0;
-+ char *arg_conf = NULL;
-+ int arg_conf_len = 0;
-
- /* Initialize client globals. */
- memset(&default_duid, 0, sizeof(default_duid));
-@@ -310,6 +328,88 @@ main(int argc, char **argv) {
- } else if (!strcmp(argv[i], "--version")) {
- log_info("isc-dhclient-%s", PACKAGE_VERSION);
- exit(0);
-+ } else if (!strcmp(argv[i], "-I")) {
-+ if ((++i == argc) || (argv[i] == NULL) || (*(argv[i])=='\0')) {
-+ usage();
-+ exit(1);
-+ }
-+
-+ if (strlen(argv[i]) >= DHCP_MAX_OPTION_LEN) {
-+ log_error("-I option dhcp-client-identifier string \"%s\" is too long - maximum length is: %d", argv[i], DHCP_MAX_OPTION_LEN-1);
-+ exit(1);
-+ }
-+
-+ dhcp_client_identifier_arg = argv[i];
-+ } else if (!strcmp(argv[i], "-B")) {
-+ bootp_broadcast_always = 1;
-+ } else if (!strcmp(argv[i], "-H")) {
-+ if ((++i == argc) || (argv[i] == NULL) || (*(argv[i])=='\0')) {
-+ usage();
-+ exit(1);
-+ }
-+
-+ if (strlen(argv[i]) >= DHCP_MAX_OPTION_LEN) {
-+ log_error("-H option host-name string \"%s\" is too long - maximum length is: %d", argv[i], DHCP_MAX_OPTION_LEN-1);
-+ exit(1);
-+ }
-+
-+ if (dhcp_host_name_arg != NULL) {
-+ log_error("The -H <host-name> and -F <fqdn> arguments are mutually exclusive");
-+ exit(1);
-+ }
-+
-+ dhcp_host_name_arg = argv[i];
-+ } else if (!strcmp(argv[i], "-F")) {
-+ if ((++i == argc) || (argv[i] == NULL) || (*(argv[i])=='\0')) {
-+ usage();
-+ exit(1);
-+ }
-+
-+ if (strlen(argv[i]) >= DHCP_MAX_OPTION_LEN) {
-+ log_error("-F option fqdn.fqdn string \"%s\" is too long - maximum length is: %d", argv[i], DHCP_MAX_OPTION_LEN-1);
-+ exit(1);
-+ }
-+
-+ if (dhcp_fqdn_arg != NULL) {
-+ log_error("Only one -F <fqdn> argument can be specified");
-+ exit(1);
-+ }
-+
-+ if (dhcp_host_name_arg != NULL) {
-+ log_error("The -F <fqdn> and -H <host-name> arguments are mutually exclusive");
-+ exit(1);
-+ }
-+
-+ dhcp_fqdn_arg = argv[i];
-+ } else if (!strcmp(argv[i], "-timeout")) {
-+ if ((++i == argc) || (argv[i] == NULL) || (*(argv[i])=='\0')) {
-+ usage();
-+ exit(1);
-+ }
-+
-+ if ((timeout_arg = atoi(argv[i])) <= 0) {
-+ log_error("-T timeout option must be > 0 - bad value: %s",argv[i]);
-+ exit(1);
-+ }
-+ } else if (!strcmp(argv[i], "-V")) {
-+ if ((++i == argc) || (argv[i] == NULL) || (*(argv[i])=='\0')) {
-+ usage();
-+ exit(1);
-+ }
-+
-+ if (strlen(argv[i]) >= DHCP_MAX_OPTION_LEN) {
-+ log_error("-V option vendor-class-identifier string \"%s\" is too long - maximum length is: %d", argv[i], DHCP_MAX_OPTION_LEN-1);
-+ exit(1);
-+ }
-+
-+ dhcp_vendor_class_identifier_arg = argv[i];
-+ } else if (!strcmp(argv[i], "-R")) {
-+ if ((++i == argc) || (argv[i] == NULL) || (*(argv[i])=='\0')) {
-+ usage();
-+ exit(1);
-+ }
-+
-+ dhclient_request_options = argv[i];
- } else if (argv[i][0] == '-') {
- usage();
- } else if (interfaces_requested < 0) {
-@@ -484,6 +584,166 @@ main(int argc, char **argv) {
- /* Parse the dhclient.conf file. */
- read_client_conf();
-
-+ /* Parse any extra command line configuration arguments: */
-+ if ((dhcp_client_identifier_arg != NULL) && (*dhcp_client_identifier_arg != '\0')) {
-+ arg_conf_len = asprintf(&arg_conf, "send dhcp-client-identifier \"%s\";", dhcp_client_identifier_arg);
-+
-+ if ((arg_conf == 0) || (arg_conf_len <= 0))
-+ log_fatal("Unable to send -I option dhcp-client-identifier");
-+ }
-+
-+ if ((dhcp_host_name_arg != NULL) && (*dhcp_host_name_arg != '\0')) {
-+ if (arg_conf == 0) {
-+ arg_conf_len = asprintf(&arg_conf, "send host-name \"%s\";", dhcp_host_name_arg);
-+
-+ if ((arg_conf == 0) || (arg_conf_len <= 0))
-+ log_fatal("Unable to send -H option host-name");
-+ } else {
-+ char *last_arg_conf = arg_conf;
-+ arg_conf = NULL;
-+ arg_conf_len = asprintf(&arg_conf, "%s\nsend host-name \"%s\";", last_arg_conf, dhcp_host_name_arg);
-+
-+ if ((arg_conf == 0) || (arg_conf_len <= 0))
-+ log_fatal("Unable to send -H option host-name");
-+
-+ free(last_arg_conf);
-+ }
-+ }
-+
-+ if ((dhcp_fqdn_arg != NULL) && (*dhcp_fqdn_arg != '\0')) {
-+ if (arg_conf == 0) {
-+ arg_conf_len = asprintf(&arg_conf, "send fqdn.fqdn \"%s\";", dhcp_fqdn_arg);
-+
-+ if ((arg_conf == 0) || (arg_conf_len <= 0))
-+ log_fatal("Unable to send -F option fqdn.fqdn");
-+ } else {
-+ char *last_arg_conf = arg_conf;
-+ arg_conf = NULL;
-+ arg_conf_len = asprintf(&arg_conf, "%s\nsend fqdn.fqdn \"%s\";", last_arg_conf, dhcp_fqdn_arg);
-+
-+ if ((arg_conf == 0) || (arg_conf_len <= 0))
-+ log_fatal("Unable to send -F option fqdn.fqdn");
-+
-+ free(last_arg_conf);
-+ }
-+ }
-+
-+ if (timeout_arg) {
-+ if (arg_conf == 0) {
-+ arg_conf_len = asprintf(&arg_conf, "timeout %d;", timeout_arg);
-+
-+ if ((arg_conf == 0) || (arg_conf_len <= 0))
-+ log_fatal("Unable to process -timeout timeout argument");
-+ } else {
-+ char *last_arg_conf = arg_conf;
-+ arg_conf = NULL;
-+ arg_conf_len = asprintf(&arg_conf, "%s\ntimeout %d;", last_arg_conf, timeout_arg);
-+
-+ if ((arg_conf == 0) || (arg_conf_len == 0))
-+ log_fatal("Unable to process -timeout timeout argument");
-+
-+ free(last_arg_conf);
-+ }
-+ }
-+
-+ if ((dhcp_vendor_class_identifier_arg != NULL) && (*dhcp_vendor_class_identifier_arg != '\0')) {
-+ if (arg_conf == 0) {
-+ arg_conf_len = asprintf(&arg_conf, "send vendor-class-identifier \"%s\";", dhcp_vendor_class_identifier_arg);
-+
-+ if ((arg_conf == 0) || (arg_conf_len <= 0))
-+ log_fatal("Unable to send -V option vendor-class-identifier");
-+ } else {
-+ char *last_arg_conf = arg_conf;
-+ arg_conf = NULL;
-+ arg_conf_len = asprintf(&arg_conf, "%s\nsend vendor-class-identifier \"%s\";", last_arg_conf, dhcp_vendor_class_identifier_arg);
-+
-+ if ((arg_conf == 0) || (arg_conf_len <= 0))
-+ log_fatal("Unable to send -V option vendor-class-identifier");
-+
-+ free(last_arg_conf);
-+ }
-+ }
-+
-+ if (dhclient_request_options != NULL) {
-+ if (arg_conf == 0) {
-+ arg_conf_len = asprintf(&arg_conf, "request %s;", dhclient_request_options);
-+
-+ if ((arg_conf == 0) || (arg_conf_len <= 0))
-+ log_fatal("Unable to parse -R <request options list> argument");
-+ } else {
-+ char *last_arg_conf = arg_conf;
-+ arg_conf = NULL;
-+ arg_conf_len = asprintf(&arg_conf, "%s\nrequest %s;", last_arg_conf, dhclient_request_options);
-+
-+ if ((arg_conf == 0) || (arg_conf_len <= 0))
-+ log_fatal("Unable to parse -R <request options list> argument");
-+
-+ free(last_arg_conf);
-+ }
-+ }
-+
-+ if (arg_conf) {
-+ if (arg_conf_len == 0)
-+ if ((arg_conf_len = strlen(arg_conf)) == 0)
-+ /* huh ? cannot happen ! */
-+ log_fatal("Unable to process -I/-H/-F/-timeout/-V/-R configuration arguments");
-+
-+ /* parse the extra dhclient.conf configuration arguments
-+ * into top level config: */
-+ struct parse *cfile = (struct parse *)0;
-+ const char *val = NULL;
-+ int token;
-+
-+ status = new_parse(&cfile, -1, arg_conf, arg_conf_len, "extra dhclient -I/-H/-F/-timeout/-V/-R configuration arguments", 0);
-+
-+ if ((status != ISC_R_SUCCESS) || (cfile -> warnings_occurred))
-+ log_fatal("Cannot parse -I/-H/-F/-timeout/-V/-R configuration arguments !");
-+ /* more detailed parse failures will be logged */
-+
-+ do {
-+ token = peek_token(&val, (unsigned *)0, cfile);
-+ if (token == END_OF_FILE)
-+ break;
-+
-+ parse_client_statement(cfile, (struct interface_info *)0, &top_level_config);
-+ } while (1);
-+
-+ if (cfile -> warnings_occurred)
-+ log_fatal("Cannot parse -I/-H/-F/-timeout/-V/-R configuration arguments !");
-+ end_parse(&cfile);
-+
-+ if (timeout_arg) {
-+ /* we just set the toplevel timeout, but per-client
-+ * timeouts may still be at defaults. Also, it makes no
-+ * sense having the reboot_timeout or backoff_cutoff
-+ * greater than the timeout:
-+ */
-+ if ((top_level_config.backoff_cutoff == 15) && (top_level_config.backoff_cutoff > (timeout_arg / 2)))
-+ top_level_config.backoff_cutoff = (((unsigned long)(timeout_arg / 2)) == 0) ? timeout_arg : (unsigned long)(timeout_arg / 2);
-+
-+ for (ip=interfaces; ip; ip = ip->next) {
-+ if (ip->client->config->timeout == 60)
-+ ip->client->config->timeout = timeout_arg;
-+
-+ if ((ip->client->config->reboot_timeout == 10) && (ip->client->config->reboot_timeout > ip->client->config->timeout))
-+ ip->client->config->reboot_timeout = ip->client->config->timeout;
-+ if ((ip->client->config->backoff_cutoff == 15) && (ip->client->config->backoff_cutoff > top_level_config.backoff_cutoff))
-+ ip->client->config->backoff_cutoff = top_level_config.backoff_cutoff;
-+ }
-+ }
-+
-+ if ((dhclient_request_options != 0) && (top_level_config.requested_options != default_requested_options)) {
-+ for (ip=interfaces; ip; ip = ip->next) {
-+ if (ip->client->config->requested_options == default_requested_options)
-+ ip->client->config->requested_options = top_level_config.requested_options;
-+ }
-+ }
-+
-+ free(arg_conf);
-+ arg_conf = NULL;
-+ arg_conf_len = 0;
-+ }
-+
- /* Parse the lease database. */
- read_client_leases();
-
-@@ -2397,7 +2657,8 @@ void make_discover (client, lease)
- client -> packet.xid = random ();
- client -> packet.secs = 0; /* filled in by send_discover. */
-
-- if (can_receive_unicast_unconfigured (client -> interface))
-+ if ((!(bootp_broadcast_always || client->config->bootp_broadcast_always))
-+ && can_receive_unicast_unconfigured(client->interface))
- client -> packet.flags = 0;
- else
- client -> packet.flags = htons (BOOTP_BROADCAST);
-@@ -2481,7 +2742,9 @@ void make_request (client, lease)
- } else {
- memset (&client -> packet.ciaddr, 0,
- sizeof client -> packet.ciaddr);
-- if (can_receive_unicast_unconfigured (client -> interface))
-+ if ((!(bootp_broadcast_always ||
-+ client ->config->bootp_broadcast_always)) &&
-+ can_receive_unicast_unconfigured (client -> interface))
- client -> packet.flags = 0;
- else
- client -> packet.flags = htons (BOOTP_BROADCAST);
-@@ -2543,7 +2806,8 @@ void make_decline (client, lease)
- client -> packet.hops = 0;
- client -> packet.xid = client -> xid;
- client -> packet.secs = 0; /* Filled in by send_request. */
-- if (can_receive_unicast_unconfigured (client -> interface))
-+ if ((!(bootp_broadcast_always || client->config-> bootp_broadcast_always))
-+ && can_receive_unicast_unconfigured (client->interface))
- client -> packet.flags = 0;
- else
- client -> packet.flags = htons (BOOTP_BROADCAST);
-diff -up dhcp-4.2.2b1/common/conflex.c.options dhcp-4.2.2b1/common/conflex.c
---- dhcp-4.2.2b1/common/conflex.c.options 2011-05-11 16:20:59.000000000 +0200
-+++ dhcp-4.2.2b1/common/conflex.c 2011-07-01 13:51:52.938755494 +0200
-@@ -808,6 +808,8 @@ intern(char *atom, enum dhcp_token dfv)
- return BALANCE;
- if (!strcasecmp (atom + 1, "ound"))
- return BOUND;
-+ if (!strcasecmp (atom + 1, "ootp-broadcast-always"))
-+ return BOOTP_BROADCAST_ALWAYS;
- break;
- case 'c':
- if (!strcasecmp(atom + 1, "ase"))
-diff -up dhcp-4.2.2b1/includes/dhcpd.h.options dhcp-4.2.2b1/includes/dhcpd.h
---- dhcp-4.2.2b1/includes/dhcpd.h.options 2011-05-20 16:21:11.000000000 +0200
-+++ dhcp-4.2.2b1/includes/dhcpd.h 2011-07-01 13:51:52.940755442 +0200
-@@ -1147,6 +1147,9 @@ struct client_config {
- int do_forward_update; /* If nonzero, and if we have the
- information we need, update the
- A record for the address we get. */
-+
-+ int bootp_broadcast_always; /* If nonzero, always set the BOOTP_BROADCAST
-+ flag in requests */
- };
-
- /* Per-interface state used in the dhcp client... */
-diff -up dhcp-4.2.2b1/includes/dhctoken.h.options dhcp-4.2.2b1/includes/dhctoken.h
---- dhcp-4.2.2b1/includes/dhctoken.h.options 2011-05-12 14:02:47.000000000 +0200
-+++ dhcp-4.2.2b1/includes/dhctoken.h 2011-07-01 13:53:43.316861637 +0200
-@@ -361,7 +361,8 @@ enum dhcp_token {
- GETHOSTNAME = 662,
- REWIND = 663,
- INITIAL_DELAY = 664,
-- GETHOSTBYNAME = 665
-+ GETHOSTBYNAME = 665,
-+ BOOTP_BROADCAST_ALWAYS = 666
- };
-
- #define is_identifier(x) ((x) >= FIRST_TOKEN && \
diff --git a/src/patches/dhcp-4.2.2-remove-bind.patch b/src/patches/dhcp-4.2.2-remove-bind.patch
deleted file mode 100644
index 6297772..0000000
--- a/src/patches/dhcp-4.2.2-remove-bind.patch
+++ /dev/null
@@ -1,149 +0,0 @@
-diff -up dhcp-4.2.2/client/Makefile.am.rh637017 dhcp-4.2.2/client/Makefile.am
---- dhcp-4.2.2/client/Makefile.am.rh637017 2010-09-15 00:32:36.000000000 +0200
-+++ dhcp-4.2.2/client/Makefile.am 2011-08-11 17:28:58.923897561 +0200
-@@ -5,7 +5,7 @@ dhclient_SOURCES = clparse.c dhclient.c
- scripts/netbsd scripts/nextstep scripts/openbsd \
- scripts/solaris scripts/openwrt
- dhclient_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \
-- ../bind/lib/libdns.a ../bind/lib/libisc.a
-+ $(BIND9_LIBDIR) -ldns-export -lisc-export
- man_MANS = dhclient.8 dhclient-script.8 dhclient.conf.5 dhclient.leases.5
- EXTRA_DIST = $(man_MANS)
-
-diff -up dhcp-4.2.2/common/tests/Makefile.am.rh637017 dhcp-4.2.2/common/tests/Makefile.am
---- dhcp-4.2.2/common/tests/Makefile.am.rh637017 2009-10-28 05:12:30.000000000 +0100
-+++ dhcp-4.2.2/common/tests/Makefile.am 2011-08-11 17:33:45.258637236 +0200
-@@ -6,6 +6,5 @@ TESTS = test_alloc
-
- test_alloc_SOURCES = test_alloc.c
- test_alloc_LDADD = ../libdhcp.a ../../tests/libt_api.a \
-- ../../omapip/libomapi.a ../../bind/lib/libdns.a \
-- ../../bind/lib/libisc.a
--
-+ ../../omapip/libomapi.a \
-+ $(BIND9_LIBDIR) -ldns-export -lisc-export
-diff -up dhcp-4.2.2/configure.ac.rh637017 dhcp-4.2.2/configure.ac
---- dhcp-4.2.2/configure.ac.rh637017 2011-07-20 02:32:18.000000000 +0200
-+++ dhcp-4.2.2/configure.ac 2011-08-11 17:28:58.924897535 +0200
-@@ -512,20 +512,37 @@ AC_CHECK_MEMBER(struct msghdr.msg_contro
- libbind=
- AC_ARG_WITH(libbind,
- AC_HELP_STRING([--with-libbind=PATH],
-- [bind includes and libraries are in PATH
-- (default is ./bind)]),
-+ [bind includes are in PATH
-+ (default is ./bind/includes)]),
- use_libbind="$withval", use_libbind="no")
- case "$use_libbind" in
-+yes|no)
-+ libbind="\${top_srcdir}/bind/include"
-+ ;;
-+*)
-+ libbind="$use_libbind"
-+ ;;
-+esac
-+
-+BIND9_LIBDIR='-L$(top_builddir)/bind/lib'
-+AC_ARG_WITH(libbind-libs,
-+ AC_HELP_STRING([--with-libbind-libs=PATH],
-+ [bind9 export libraries are in PATH]),
-+ [libbind_libs="$withval"], [libbind_libs='no'])
-+case "$libbind_libs" in
- yes)
-- libbind="\${top_srcdir}/bind"
-+ AC_MSG_ERROR([Specify path to bind9 libraries])
- ;;
- no)
-- libbind="\${top_srcdir}/bind"
-+ BUNDLED_BIND=yes
- ;;
- *)
-- libbind="$use_libbind"
-+ BIND9_LIBDIR="-L$libbind_libs"
-+ BUNDLED_BIND=no
- ;;
- esac
-+AM_CONDITIONAL([BUNDLED_BIND], [test "$BUNDLED_BIND" = yes])
-+AC_SUBST([BIND9_LIBDIR])
-
- # OpenLDAP support.
- AC_ARG_WITH(ldap,
-@@ -562,7 +579,7 @@ fi
- CFLAGS="$CFLAGS $STD_CWARNINGS"
-
- # Try to add the bind include directory
--CFLAGS="$CFLAGS -I$libbind/include"
-+CFLAGS="$CFLAGS -I$libbind"
-
- AC_C_FLEXIBLE_ARRAY_MEMBER
-
-diff -up dhcp-4.2.2/dhcpctl/Makefile.am.rh637017 dhcp-4.2.2/dhcpctl/Makefile.am
---- dhcp-4.2.2/dhcpctl/Makefile.am.rh637017 2009-10-28 05:12:30.000000000 +0100
-+++ dhcp-4.2.2/dhcpctl/Makefile.am 2011-08-11 17:28:58.924897535 +0200
-@@ -6,10 +6,10 @@ EXTRA_DIST = $(man_MANS)
-
- omshell_SOURCES = omshell.c
- omshell_LDADD = libdhcpctl.a ../common/libdhcp.a ../omapip/libomapi.a \
-- ../bind/lib/libdns.a ../bind/lib/libisc.a
-+ $(BIND9_LIBDIR) -ldns-export -lisc-export
-
- libdhcpctl_a_SOURCES = dhcpctl.c callback.c remote.c
-
- cltest_SOURCES = cltest.c
- cltest_LDADD = libdhcpctl.a ../common/libdhcp.a ../omapip/libomapi.a \
-- ../bind/lib/libdns.a ../bind/lib/libisc.a
-\ No newline at end of file
-+ $(BIND9_LIBDIR) -ldns-export -lisc-export
-diff -up dhcp-4.2.2/Makefile.am.rh637017 dhcp-4.2.2/Makefile.am
---- dhcp-4.2.2/Makefile.am.rh637017 2010-03-25 00:30:38.000000000 +0100
-+++ dhcp-4.2.2/Makefile.am 2011-08-11 17:28:58.925897509 +0200
-@@ -21,7 +21,13 @@ EXTRA_DIST = RELNOTES LICENSE \
- util/bindvar.sh \
- bind/Makefile bind/bind.tar.gz bind/version.tmp
-
--SUBDIRS = bind includes tests common dst omapip client dhcpctl relay server
-+if BUNDLED_BIND
-+SUBDIRS = bind
-+else
-+SUBDIRS =
-+endif
-+
-+SUBDIRS += includes tests common dst omapip client dhcpctl relay server
-
- nobase_include_HEADERS = dhcpctl/dhcpctl.h
-
-diff -up dhcp-4.2.2/omapip/Makefile.am.rh637017 dhcp-4.2.2/omapip/Makefile.am
---- dhcp-4.2.2/omapip/Makefile.am.rh637017 2010-02-12 01:13:54.000000000 +0100
-+++ dhcp-4.2.2/omapip/Makefile.am 2011-08-11 17:28:58.939897149 +0200
-@@ -10,5 +10,5 @@ man_MANS = omapi.3
- EXTRA_DIST = $(man_MANS)
-
- svtest_SOURCES = test.c
--svtest_LDADD = libomapi.a ../bind/lib/libdns.a ../bind/lib/libisc.a
-+svtest_LDADD = libomapi.a $(BIND9_LIBDIR) -ldns-export -lisc-export
-
-diff -up dhcp-4.2.2/relay/Makefile.am.rh637017 dhcp-4.2.2/relay/Makefile.am
---- dhcp-4.2.2/relay/Makefile.am.rh637017 2009-10-28 05:12:30.000000000 +0100
-+++ dhcp-4.2.2/relay/Makefile.am 2011-08-11 17:28:58.940897123 +0200
-@@ -3,7 +3,7 @@ AM_CPPFLAGS = -DLOCALSTATEDIR='"@localst
- sbin_PROGRAMS = dhcrelay
- dhcrelay_SOURCES = dhcrelay.c
- dhcrelay_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \
-- ../bind/lib/libdns.a ../bind/lib/libisc.a
-+ $(BIND9_LIBDIR) -ldns-export -lisc-export
- man_MANS = dhcrelay.8
- EXTRA_DIST = $(man_MANS)
-
-diff -up dhcp-4.2.2/server/Makefile.am.rh637017 dhcp-4.2.2/server/Makefile.am
---- dhcp-4.2.2/server/Makefile.am.rh637017 2010-03-24 22:49:47.000000000 +0100
-+++ dhcp-4.2.2/server/Makefile.am 2011-08-11 17:28:58.944897021 +0200
-@@ -8,8 +8,7 @@ dhcpd_SOURCES = dhcpd.c dhcp.c bootp.c c
-
- dhcpd_CFLAGS = $(LDAP_CFLAGS)
- dhcpd_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \
-- ../dhcpctl/libdhcpctl.a ../bind/lib/libdns.a \
-- ../bind/lib/libisc.a
-+ ../dhcpctl/libdhcpctl.a $(BIND9_LIBDIR) -ldns-export -lisc-export
-
- man_MANS = dhcpd.8 dhcpd.conf.5 dhcpd.leases.5
- EXTRA_DIST = $(man_MANS)
diff --git a/src/patches/dhcp-4.2.2-rfc3442-classless-static-routes.patch b/src/patches/dhcp-4.2.2-rfc3442-classless-static-routes.patch
deleted file mode 100644
index 0a0bfcb..0000000
--- a/src/patches/dhcp-4.2.2-rfc3442-classless-static-routes.patch
+++ /dev/null
@@ -1,405 +0,0 @@
-diff -up dhcp-4.2.2b1/client/clparse.c.rfc3442 dhcp-4.2.2b1/client/clparse.c
---- dhcp-4.2.2b1/client/clparse.c.rfc3442 2011-07-01 14:22:38.031534508 +0200
-+++ dhcp-4.2.2b1/client/clparse.c 2011-07-01 14:22:38.128532940 +0200
-@@ -37,7 +37,7 @@
-
- struct client_config top_level_config;
-
--#define NUM_DEFAULT_REQUESTED_OPTS 14
-+#define NUM_DEFAULT_REQUESTED_OPTS 15
- struct option *default_requested_options[NUM_DEFAULT_REQUESTED_OPTS + 1];
-
- static void parse_client_default_duid(struct parse *cfile);
-@@ -82,7 +82,11 @@ isc_result_t read_client_conf ()
- dhcp_universe.code_hash, &code, 0, MDL);
-
- /* 4 */
-- code = DHO_ROUTERS;
-+ /* The Classless Static Routes option code MUST appear in the parameter
-+ * request list prior to both the Router option code and the Static
-+ * Routes option code, if present. (RFC3442)
-+ */
-+ code = DHO_CLASSLESS_STATIC_ROUTES;
- option_code_hash_lookup(&default_requested_options[3],
- dhcp_universe.code_hash, &code, 0, MDL);
-
-@@ -136,6 +140,11 @@ isc_result_t read_client_conf ()
- option_code_hash_lookup(&default_requested_options[13],
- dhcp_universe.code_hash, &code, 0, MDL);
-
-+ /* 15 */
-+ code = DHO_ROUTERS;
-+ option_code_hash_lookup(&default_requested_options[14],
-+ dhcp_universe.code_hash, &code, 0, MDL);
-+
- for (code = 0 ; code < NUM_DEFAULT_REQUESTED_OPTS ; code++) {
- if (default_requested_options[code] == NULL)
- log_fatal("Unable to find option definition for "
-diff -up dhcp-4.2.2b1/common/dhcp-options.5.rfc3442 dhcp-4.2.2b1/common/dhcp-options.5
---- dhcp-4.2.2b1/common/dhcp-options.5.rfc3442 2011-07-01 14:22:38.020534686 +0200
-+++ dhcp-4.2.2b1/common/dhcp-options.5 2011-07-01 14:22:38.129532924 +0200
-@@ -115,6 +115,26 @@ hexadecimal, separated by colons. For
- or
- option dhcp-client-identifier 43:4c:49:45:54:2d:46:4f:4f;
- .fi
-+.PP
-+The
-+.B destination-descriptor
-+describe the IP subnet number and subnet mask
-+of a particular destination using a compact encoding. This encoding
-+consists of one octet describing the width of the subnet mask,
-+followed by all the significant octets of the subnet number.
-+The following table contains some examples of how various subnet
-+number/mask combinations can be encoded:
-+.nf
-+.sp 1
-+Subnet number Subnet mask Destination descriptor
-+0 0 0
-+10.0.0.0 255.0.0.0 8.10
-+10.0.0.0 255.255.255.0 24.10.0.0
-+10.17.0.0 255.255.0.0 16.10.17
-+10.27.129.0 255.255.255.0 24.10.27.129
-+10.229.0.128 255.255.255.128 25.10.229.0.128
-+10.198.122.47 255.255.255.255 32.10.198.122.47
-+.fi
- .SH SETTING OPTION VALUES USING EXPRESSIONS
- Sometimes it's helpful to be able to set the value of a DHCP option
- based on some value that the client has sent. To do this, you can
-@@ -931,6 +951,29 @@ dhclient-script will create routes:
- .RE
- .PP
- .nf
-+.B option \fBclassless-static-routes\fR \fIdestination-descriptor ip-address\fR
-+ [\fB,\fR \fIdestination-descriptor ip-address\fR...]\fB;\fR
-+.fi
-+.RS 0.25i
-+.PP
-+This option (see RFC3442) specifies a list of classless static routes
-+that the client should install in its routing cache.
-+.PP
-+This option can contain one or more static routes, each of which
-+consists of a destination descriptor and the IP address of the router
-+that should be used to reach that destination.
-+.PP
-+Many clients may not implement the Classless Static Routes option.
-+DHCP server administrators should therefore configure their DHCP
-+servers to send both a Router option and a Classless Static Routes
-+option, and should specify the default router(s) both in the Router
-+option and in the Classless Static Routes option.
-+.PP
-+If the DHCP server returns both a Classless Static Routes option and
-+a Router option, the DHCP client ignores the Router option.
-+.RE
-+.PP
-+.nf
- .B option \fBstreettalk-directory-assistance-server\fR \fIip-address\fR
- [\fB,\fR \fIip-address\fR...]\fB;\fR
- .fi
-diff -up dhcp-4.2.2b1/common/inet.c.rfc3442 dhcp-4.2.2b1/common/inet.c
---- dhcp-4.2.2b1/common/inet.c.rfc3442 2011-05-11 02:47:22.000000000 +0200
-+++ dhcp-4.2.2b1/common/inet.c 2011-07-01 14:22:38.130532908 +0200
-@@ -528,6 +528,60 @@ free_iaddrcidrnetlist(struct iaddrcidrne
- return ISC_R_SUCCESS;
- }
-
-+static const char *
-+inet_ntopdd(const unsigned char *src, unsigned srclen, char *dst, size_t size)
-+{
-+ char tmp[sizeof("32.255.255.255.255")];
-+ int len;
-+
-+ switch (srclen) {
-+ case 2:
-+ len = sprintf (tmp, "%u.%u", src[0], src[1]);
-+ break;
-+ case 3:
-+ len = sprintf (tmp, "%u.%u.%u", src[0], src[1], src[2]);
-+ break;
-+ case 4:
-+ len = sprintf (tmp, "%u.%u.%u.%u", src[0], src[1], src[2], src[3]);
-+ break;
-+ case 5:
-+ len = sprintf (tmp, "%u.%u.%u.%u.%u", src[0], src[1], src[2], src[3], src[4]);
-+ break;
-+ default:
-+ return NULL;
-+ }
-+ if (len < 0)
-+ return NULL;
-+
-+ if (len > size) {
-+ errno = ENOSPC;
-+ return NULL;
-+ }
-+
-+ return strcpy (dst, tmp);
-+}
-+
-+/* pdestdesc() turns an iaddr structure into a printable dest. descriptor */
-+const char *
-+pdestdesc(const struct iaddr addr) {
-+ static char pbuf[sizeof("255.255.255.255.255")];
-+
-+ if (addr.len == 0) {
-+ return "<null destination descriptor>";
-+ }
-+ if (addr.len == 1) {
-+ return "0";
-+ }
-+ if ((addr.len >= 2) && (addr.len <= 5)) {
-+ return inet_ntopdd(addr.iabuf, addr.len, pbuf, sizeof(pbuf));
-+ }
-+
-+ log_fatal("pdestdesc():%s:%d: Invalid destination descriptor length %d.",
-+ MDL, addr.len);
-+ /* quell compiler warnings */
-+ return NULL;
-+}
-+
- /* piaddr() turns an iaddr structure into a printable address. */
- /* XXX: should use a const pointer rather than passing the structure */
- const char *
-diff -up dhcp-4.2.2b1/common/options.c.rfc3442 dhcp-4.2.2b1/common/options.c
---- dhcp-4.2.2b1/common/options.c.rfc3442 2011-03-24 22:57:13.000000000 +0100
-+++ dhcp-4.2.2b1/common/options.c 2011-07-01 14:22:38.132532876 +0200
-@@ -706,7 +706,11 @@ cons_options(struct packet *inpacket, st
- * packet.
- */
- priority_list[priority_len++] = DHO_SUBNET_MASK;
-- priority_list[priority_len++] = DHO_ROUTERS;
-+ if (lookup_option(&dhcp_universe, cfg_options,
-+ DHO_CLASSLESS_STATIC_ROUTES))
-+ priority_list[priority_len++] = DHO_CLASSLESS_STATIC_ROUTES;
-+ else
-+ priority_list[priority_len++] = DHO_ROUTERS;
- priority_list[priority_len++] = DHO_DOMAIN_NAME_SERVERS;
- priority_list[priority_len++] = DHO_HOST_NAME;
- priority_list[priority_len++] = DHO_FQDN;
-@@ -1683,6 +1687,7 @@ const char *pretty_print_option (option,
- const unsigned char *dp = data;
- char comma;
- unsigned long tval;
-+ unsigned int octets = 0;
-
- if (emit_commas)
- comma = ',';
-@@ -1691,6 +1696,7 @@ const char *pretty_print_option (option,
-
- memset (enumbuf, 0, sizeof enumbuf);
-
-+ if (option->format[0] != 'R') { /* see explanation lower */
- /* Figure out the size of the data. */
- for (l = i = 0; option -> format [i]; i++, l++) {
- if (l >= sizeof(fmtbuf) - 1)
-@@ -1840,6 +1846,33 @@ const char *pretty_print_option (option,
- if (numhunk < 0)
- numhunk = 1;
-
-+ } else { /* option->format[i] == 'R') */
-+ /* R (destination descriptor) has variable length.
-+ * We can find it only in classless static route option,
-+ * so we are for sure parsing classless static route option now.
-+ * We go through whole the option to check whether there are no
-+ * missing/extra bytes.
-+ * I didn't find out how to improve the existing code and that's the
-+ * reason for this separate 'else' where I do my own checkings.
-+ * I know it's little bit unsystematic, but it works.
-+ */
-+ numhunk = 0;
-+ numelem = 2; /* RI */
-+ fmtbuf[0]='R'; fmtbuf[1]='I'; fmtbuf[2]=0;
-+ for (i =0; i < len; i = i + octets + 5) {
-+ if (data[i] > 32) { /* subnet mask width */
-+ log_error ("wrong subnet mask width in destination descriptor");
-+ break;
-+ }
-+ numhunk++;
-+ octets = ((data[i]+7) / 8);
-+ }
-+ if (i != len) {
-+ log_error ("classless static routes option has wrong size or "
-+ "there's some garbage in format");
-+ }
-+ }
-+
- /* Cycle through the array (or hunk) printing the data. */
- for (i = 0; i < numhunk; i++) {
- for (j = 0; j < numelem; j++) {
-@@ -1978,6 +2011,20 @@ const char *pretty_print_option (option,
- strcpy(op, piaddr(iaddr));
- dp += 4;
- break;
-+
-+ case 'R':
-+ if (dp[0] <= 32)
-+ iaddr.len = (((dp[0]+7)/8)+1);
-+ else {
-+ log_error ("wrong subnet mask width in destination descriptor");
-+ return "<error>";
-+ }
-+
-+ memcpy(iaddr.iabuf, dp, iaddr.len);
-+ strcpy(op, pdestdesc(iaddr));
-+ dp += iaddr.len;
-+ break;
-+
- case '6':
- iaddr.len = 16;
- memcpy(iaddr.iabuf, dp, 16);
-diff -up dhcp-4.2.2b1/common/parse.c.rfc3442 dhcp-4.2.2b1/common/parse.c
---- dhcp-4.2.2b1/common/parse.c.rfc3442 2011-07-01 14:22:38.097533441 +0200
-+++ dhcp-4.2.2b1/common/parse.c 2011-07-01 14:22:38.135532828 +0200
-@@ -341,6 +341,39 @@ int parse_ip_addr (cfile, addr)
- }
-
- /*
-+ * destination-descriptor :== NUMBER DOT NUMBER |
-+ * NUMBER DOT NUMBER DOT NUMBER |
-+ * NUMBER DOT NUMBER DOT NUMBER DOT NUMBER |
-+ * NUMBER DOT NUMBER DOT NUMBER DOT NUMBER DOT NUMBER
-+ */
-+
-+int parse_destination_descriptor (cfile, addr)
-+ struct parse *cfile;
-+ struct iaddr *addr;
-+{
-+ unsigned int mask_width, dest_dest_len;
-+ addr -> len = 0;
-+ if (parse_numeric_aggregate (cfile, addr -> iabuf,
-+ &addr -> len, DOT, 10, 8)) {
-+ mask_width = (unsigned int)addr->iabuf[0];
-+ dest_dest_len = (((mask_width+7)/8)+1);
-+ if (mask_width > 32) {
-+ parse_warn (cfile,
-+ "subnet mask width (%u) greater than 32.", mask_width);
-+ }
-+ else if (dest_dest_len != addr->len) {
-+ parse_warn (cfile,
-+ "destination descriptor with subnet mask width %u "
-+ "should have %u octets, but has %u octets.",
-+ mask_width, dest_dest_len, addr->len);
-+ }
-+
-+ return 1;
-+ }
-+ return 0;
-+}
-+
-+/*
- * Return true if every character in the string is hexadecimal.
- */
- static int
-@@ -700,8 +733,10 @@ unsigned char *parse_numeric_aggregate (
- if (count) {
- token = peek_token (&val, (unsigned *)0, cfile);
- if (token != separator) {
-- if (!*max)
-+ if (!*max) {
-+ *max = count;
- break;
-+ }
- if (token != RBRACE && token != LBRACE)
- token = next_token (&val,
- (unsigned *)0,
-@@ -1624,6 +1659,9 @@ int parse_option_code_definition (cfile,
- case IP_ADDRESS:
- type = 'I';
- break;
-+ case DESTINATION_DESCRIPTOR:
-+ type = 'R';
-+ break;
- case IP6_ADDRESS:
- type = '6';
- break;
-@@ -5288,6 +5326,15 @@ int parse_option_token (rv, cfile, fmt,
- }
- break;
-
-+ case 'R': /* destination descriptor */
-+ if (!parse_destination_descriptor (cfile, &addr)) {
-+ return 0;
-+ }
-+ if (!make_const_data (&t, addr.iabuf, addr.len, 0, 1, MDL)) {
-+ return 0;
-+ }
-+ break;
-+
- case '6': /* IPv6 address. */
- if (!parse_ip6_addr(cfile, &addr)) {
- return 0;
-@@ -5548,6 +5595,13 @@ int parse_option_decl (oc, cfile)
- goto exit;
- len = ip_addr.len;
- dp = ip_addr.iabuf;
-+ goto alloc;
-+
-+ case 'R': /* destination descriptor */
-+ if (!parse_destination_descriptor (cfile, &ip_addr))
-+ goto exit;
-+ len = ip_addr.len;
-+ dp = ip_addr.iabuf;
-
- alloc:
- if (hunkix + len > sizeof hunkbuf) {
-diff -up dhcp-4.2.2b1/common/tables.c.rfc3442 dhcp-4.2.2b1/common/tables.c
---- dhcp-4.2.2b1/common/tables.c.rfc3442 2011-07-01 14:22:38.087533601 +0200
-+++ dhcp-4.2.2b1/common/tables.c 2011-07-01 14:22:38.137532796 +0200
-@@ -51,6 +51,7 @@ HASH_FUNCTIONS (option_code, const unsig
- Format codes:
-
- I - IPv4 address
-+ R - destination descriptor (RFC3442)
- 6 - IPv6 address
- l - 32-bit signed integer
- L - 32-bit unsigned integer
-@@ -208,6 +209,7 @@ static struct option dhcp_options[] = {
- { "default-url", "t", &dhcp_universe, 114, 1 },
- { "subnet-selection", "I", &dhcp_universe, 118, 1 },
- { "domain-search", "D", &dhcp_universe, 119, 1 },
-+ { "classless-static-routes", "RIA", &dhcp_universe, 121, 1 },
- { "vivco", "Evendor-class.", &dhcp_universe, 124, 1 },
- { "vivso", "Evendor.", &dhcp_universe, 125, 1 },
- #if 0
-diff -up dhcp-4.2.2b1/includes/dhcpd.h.rfc3442 dhcp-4.2.2b1/includes/dhcpd.h
---- dhcp-4.2.2b1/includes/dhcpd.h.rfc3442 2011-07-01 14:22:38.000000000 +0200
-+++ dhcp-4.2.2b1/includes/dhcpd.h 2011-07-01 14:24:19.999810333 +0200
-@@ -2662,6 +2662,7 @@ isc_result_t range2cidr(struct iaddrcidr
- const struct iaddr *lo, const struct iaddr *hi);
- isc_result_t free_iaddrcidrnetlist(struct iaddrcidrnetlist **result);
- const char *piaddr (struct iaddr);
-+const char *pdestdesc (struct iaddr);
- char *piaddrmask(struct iaddr *, struct iaddr *);
- char *piaddrcidr(const struct iaddr *, unsigned int);
- u_int16_t validate_port(char *);
-@@ -2869,6 +2870,7 @@ void parse_client_lease_declaration (str
- int parse_option_decl (struct option_cache **, struct parse *);
- void parse_string_list (struct parse *, struct string_list **, int);
- int parse_ip_addr (struct parse *, struct iaddr *);
-+int parse_destination_descriptor (struct parse *, struct iaddr *);
- int parse_ip_addr_with_subnet(struct parse *, struct iaddrmatch *);
- void parse_reject_statement (struct parse *, struct client_config *);
-
-diff -up dhcp-4.2.2b1/includes/dhcp.h.rfc3442 dhcp-4.2.2b1/includes/dhcp.h
---- dhcp-4.2.2b1/includes/dhcp.h.rfc3442 2009-11-20 02:49:01.000000000 +0100
-+++ dhcp-4.2.2b1/includes/dhcp.h 2011-07-01 14:22:38.145532665 +0200
-@@ -158,6 +158,7 @@ struct dhcp_packet {
- #define DHO_ASSOCIATED_IP 92
- #define DHO_SUBNET_SELECTION 118 /* RFC3011! */
- #define DHO_DOMAIN_SEARCH 119 /* RFC3397 */
-+#define DHO_CLASSLESS_STATIC_ROUTES 121 /* RFC3442 */
- #define DHO_VIVCO_SUBOPTIONS 124
- #define DHO_VIVSO_SUBOPTIONS 125
-
-diff -up dhcp-4.2.2b1/includes/dhctoken.h.rfc3442 dhcp-4.2.2b1/includes/dhctoken.h
---- dhcp-4.2.2b1/includes/dhctoken.h.rfc3442 2011-07-01 14:22:37.000000000 +0200
-+++ dhcp-4.2.2b1/includes/dhctoken.h 2011-07-01 14:25:12.541867623 +0200
-@@ -362,7 +362,8 @@ enum dhcp_token {
- REWIND = 663,
- INITIAL_DELAY = 664,
- GETHOSTBYNAME = 665,
-- BOOTP_BROADCAST_ALWAYS = 666
-+ BOOTP_BROADCAST_ALWAYS = 666,
-+ DESTINATION_DESCRIPTOR = 667
- };
-
- #define is_identifier(x) ((x) >= FIRST_TOKEN && \
diff --git a/src/patches/dhcp-4.2.2-sharedlib.patch b/src/patches/dhcp-4.2.2-sharedlib.patch
deleted file mode 100644
index 74fe9f1..0000000
--- a/src/patches/dhcp-4.2.2-sharedlib.patch
+++ /dev/null
@@ -1,119 +0,0 @@
-diff -up dhcp-4.2.2/client/Makefile.am.sharedlib dhcp-4.2.2/client/Makefile.am
---- dhcp-4.2.2/client/Makefile.am.sharedlib 2011-09-09 16:35:56.000000000 +0200
-+++ dhcp-4.2.2/client/Makefile.am 2011-09-09 16:36:29.849007951 +0200
-@@ -4,7 +4,7 @@ dhclient_SOURCES = clparse.c dhclient.c
- scripts/bsdos scripts/freebsd scripts/linux scripts/macos \
- scripts/netbsd scripts/nextstep scripts/openbsd \
- scripts/solaris scripts/openwrt
--dhclient_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \
-+dhclient_LDADD = ../common/libdhcp.a ../omapip/libomapi.la \
- $(BIND9_LIBDIR) -ldns-export -lisc-export $(CAPNG_LDADD)
- man_MANS = dhclient.8 dhclient-script.8 dhclient.conf.5 dhclient.leases.5
- EXTRA_DIST = $(man_MANS)
-diff -up dhcp-4.2.2/configure.ac.sharedlib dhcp-4.2.2/configure.ac
---- dhcp-4.2.2/configure.ac.sharedlib 2011-09-09 16:35:56.097000001 +0200
-+++ dhcp-4.2.2/configure.ac 2011-09-09 16:35:56.383000000 +0200
-@@ -30,7 +30,8 @@ fi
- # Use this to define _GNU_SOURCE to pull in the IPv6 Advanced Socket API.
- AC_USE_SYSTEM_EXTENSIONS
-
--AC_PROG_RANLIB
-+# Use libtool to simplify building of shared libraries
-+AC_PROG_LIBTOOL
- AC_CONFIG_HEADERS([includes/config.h])
-
- # we sometimes need to know byte order for building packets
-diff -up dhcp-4.2.2/dhcpctl/Makefile.am.sharedlib dhcp-4.2.2/dhcpctl/Makefile.am
---- dhcp-4.2.2/dhcpctl/Makefile.am.sharedlib 2011-09-09 16:35:55.459000001 +0200
-+++ dhcp-4.2.2/dhcpctl/Makefile.am 2011-09-09 16:35:56.384000000 +0200
-@@ -1,15 +1,15 @@
- bin_PROGRAMS = omshell
--lib_LIBRARIES = libdhcpctl.a
-+lib_LTLIBRARIES = libdhcpctl.la
- noinst_PROGRAMS = cltest
- man_MANS = omshell.1 dhcpctl.3
- EXTRA_DIST = $(man_MANS)
-
- omshell_SOURCES = omshell.c
--omshell_LDADD = libdhcpctl.a ../common/libdhcp.a ../omapip/libomapi.a \
-+omshell_LDADD = libdhcpctl.la ../common/libdhcp.a ../omapip/libomapi.la \
- $(BIND9_LIBDIR) -ldns-export -lisc-export
-
--libdhcpctl_a_SOURCES = dhcpctl.c callback.c remote.c
-+libdhcpctl_la_SOURCES = dhcpctl.c callback.c remote.c
-
- cltest_SOURCES = cltest.c
--cltest_LDADD = libdhcpctl.a ../common/libdhcp.a ../omapip/libomapi.a \
-+cltest_LDADD = libdhcpctl.la ../common/libdhcp.a ../omapip/libomapi.la \
- $(BIND9_LIBDIR) -ldns-export -lisc-export
-diff -up dhcp-4.2.2/dst/base64.c.sharedlib dhcp-4.2.2/dst/base64.c
---- dhcp-4.2.2/dst/base64.c.sharedlib 2009-11-20 02:49:01.000000000 +0100
-+++ dhcp-4.2.2/dst/base64.c 2011-09-09 16:35:56.385000000 +0200
-@@ -64,6 +64,7 @@ static const char rcsid[] = "$Id: base64
-
- #include <sys/socket.h>
-
-+#include "dst_internal.h"
- #include "cdefs.h"
- #include "osdep.h"
- #include "arpa/nameser.h"
-diff -up dhcp-4.2.2/dst/Makefile.am.sharedlib dhcp-4.2.2/dst/Makefile.am
---- dhcp-4.2.2/dst/Makefile.am.sharedlib 2007-05-29 18:32:10.000000000 +0200
-+++ dhcp-4.2.2/dst/Makefile.am 2011-09-09 16:35:56.386000000 +0200
-@@ -1,8 +1,8 @@
- AM_CPPFLAGS = -DMINIRES_LIB -DHMAC_MD5
-
--lib_LIBRARIES = libdst.a
-+lib_LTLIBRARIES = libdst.la
-
--libdst_a_SOURCES = dst_support.c dst_api.c hmac_link.c md5_dgst.c \
-+libdst_la_SOURCES = dst_support.c dst_api.c hmac_link.c md5_dgst.c \
- base64.c prandom.c
-
- EXTRA_DIST = dst_internal.h md5.h md5_locl.h
-diff -up dhcp-4.2.2/omapip/Makefile.am.sharedlib dhcp-4.2.2/omapip/Makefile.am
---- dhcp-4.2.2/omapip/Makefile.am.sharedlib 2011-09-09 16:35:55.000000000 +0200
-+++ dhcp-4.2.2/omapip/Makefile.am 2011-09-09 16:37:36.734000324 +0200
-@@ -1,7 +1,7 @@
--lib_LIBRARIES = libomapi.a
-+lib_LTLIBRARIES = libomapi.la
- noinst_PROGRAMS = svtest
-
--libomapi_a_SOURCES = protocol.c buffer.c alloc.c result.c connection.c \
-+libomapi_la_SOURCES = protocol.c buffer.c alloc.c result.c connection.c \
- errwarn.c listener.c dispatch.c generic.c support.c \
- handle.c message.c convert.c hash.c auth.c inet_addr.c \
- array.c trace.c toisc.c iscprint.c isclib.c
-@@ -10,5 +10,5 @@ man_MANS = omapi.3
- EXTRA_DIST = $(man_MANS)
-
- svtest_SOURCES = test.c
--svtest_LDADD = libomapi.a $(BIND9_LIBDIR) -ldns-export -lisc-export
-+svtest_LDADD = libomapi.la $(BIND9_LIBDIR) -ldns-export -lisc-export
-
-diff -up dhcp-4.2.2/relay/Makefile.am.sharedlib dhcp-4.2.2/relay/Makefile.am
---- dhcp-4.2.2/relay/Makefile.am.sharedlib 2011-09-09 16:35:56.000000000 +0200
-+++ dhcp-4.2.2/relay/Makefile.am 2011-09-09 16:37:57.058019749 +0200
-@@ -2,7 +2,7 @@ AM_CPPFLAGS = -DLOCALSTATEDIR='"@localst
-
- sbin_PROGRAMS = dhcrelay
- dhcrelay_SOURCES = dhcrelay.c
--dhcrelay_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \
-+dhcrelay_LDADD = ../common/libdhcp.a ../omapip/libomapi.la \
- $(BIND9_LIBDIR) -ldns-export -lisc-export $(CAPNG_LDADD)
- man_MANS = dhcrelay.8
- EXTRA_DIST = $(man_MANS)
-diff -up dhcp-4.2.2/server/Makefile.am.sharedlib dhcp-4.2.2/server/Makefile.am
---- dhcp-4.2.2/server/Makefile.am.sharedlib 2011-09-09 16:35:56.000000000 +0200
-+++ dhcp-4.2.2/server/Makefile.am 2011-09-09 16:38:56.291004599 +0200
-@@ -7,8 +7,8 @@ dhcpd_SOURCES = dhcpd.c dhcp.c bootp.c c
- dhcpv6.c mdb6.c ldap.c ldap_casa.c
-
- dhcpd_CFLAGS = $(LDAP_CFLAGS)
--dhcpd_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \
-- ../dhcpctl/libdhcpctl.a $(BIND9_LIBDIR) -ldns-export -lisc-export \
-+dhcpd_LDADD = ../common/libdhcp.a ../omapip/libomapi.la \
-+ ../dhcpctl/libdhcpctl.la $(BIND9_LIBDIR) -ldns-export -lisc-export \
- $(CAPNG_LDADD)
-
- man_MANS = dhcpd.8 dhcpd.conf.5 dhcpd.leases.5
diff --git a/src/patches/dhcp-4.2.2-xen-checksum.patch b/src/patches/dhcp-4.2.2-xen-checksum.patch
deleted file mode 100644
index 038d346..0000000
--- a/src/patches/dhcp-4.2.2-xen-checksum.patch
+++ /dev/null
@@ -1,249 +0,0 @@
-diff -up dhcp-4.2.2b1/common/bpf.c.xen dhcp-4.2.2b1/common/bpf.c
---- dhcp-4.2.2b1/common/bpf.c.xen 2009-11-20 02:48:59.000000000 +0100
-+++ dhcp-4.2.2b1/common/bpf.c 2011-07-01 14:00:16.936959001 +0200
-@@ -485,7 +485,7 @@ ssize_t receive_packet (interface, buf,
- offset = decode_udp_ip_header (interface,
- interface -> rbuf,
- interface -> rbuf_offset,
-- from, hdr.bh_caplen, &paylen);
-+ from, hdr.bh_caplen, &paylen, 0);
-
- /* If the IP or UDP checksum was bad, skip the packet... */
- if (offset < 0) {
-diff -up dhcp-4.2.2b1/common/dlpi.c.xen dhcp-4.2.2b1/common/dlpi.c
---- dhcp-4.2.2b1/common/dlpi.c.xen 2011-05-11 16:20:59.000000000 +0200
-+++ dhcp-4.2.2b1/common/dlpi.c 2011-07-01 14:00:16.937958997 +0200
-@@ -693,7 +693,7 @@ ssize_t receive_packet (interface, buf,
- length -= offset;
- #endif
- offset = decode_udp_ip_header (interface, dbuf, bufix,
-- from, length, &paylen);
-+ from, length, &paylen, 0);
-
- /*
- * If the IP or UDP checksum was bad, skip the packet...
-diff -up dhcp-4.2.2b1/common/lpf.c.xen dhcp-4.2.2b1/common/lpf.c
---- dhcp-4.2.2b1/common/lpf.c.xen 2011-05-10 16:38:58.000000000 +0200
-+++ dhcp-4.2.2b1/common/lpf.c 2011-07-01 14:11:24.725748028 +0200
-@@ -29,19 +29,33 @@
- #include "dhcpd.h"
- #if defined (USE_LPF_SEND) || defined (USE_LPF_RECEIVE)
- #include <sys/ioctl.h>
-+#include <sys/socket.h>
- #include <sys/uio.h>
- #include <errno.h>
-
- #include <asm/types.h>
- #include <linux/filter.h>
- #include <linux/if_ether.h>
-+#include <linux/if_packet.h>
- #include <netinet/in_systm.h>
--#include <net/if_packet.h>
- #include "includes/netinet/ip.h"
- #include "includes/netinet/udp.h"
- #include "includes/netinet/if_ether.h"
- #include <net/if.h>
-
-+#ifndef PACKET_AUXDATA
-+#define PACKET_AUXDATA 8
-+
-+struct tpacket_auxdata
-+{
-+ __u32 tp_status;
-+ __u32 tp_len;
-+ __u32 tp_snaplen;
-+ __u16 tp_mac;
-+ __u16 tp_net;
-+};
-+#endif
-+
- /* Reinitializes the specified interface after an address change. This
- is not required for packet-filter APIs. */
-
-@@ -67,10 +81,14 @@ int if_register_lpf (info)
- struct interface_info *info;
- {
- int sock;
-- struct sockaddr sa;
-+ union {
-+ struct sockaddr_ll ll;
-+ struct sockaddr common;
-+ } sa;
-+ struct ifreq ifr;
-
- /* Make an LPF socket. */
-- if ((sock = socket(PF_PACKET, SOCK_PACKET,
-+ if ((sock = socket(PF_PACKET, SOCK_RAW,
- htons((short)ETH_P_ALL))) < 0) {
- if (errno == ENOPROTOOPT || errno == EPROTONOSUPPORT ||
- errno == ESOCKTNOSUPPORT || errno == EPFNOSUPPORT ||
-@@ -85,11 +103,17 @@ int if_register_lpf (info)
- log_fatal ("Open a socket for LPF: %m");
- }
-
-+ memset (&ifr, 0, sizeof ifr);
-+ strncpy (ifr.ifr_name, (const char *)info -> ifp, sizeof ifr.ifr_name);
-+ ifr.ifr_name[IFNAMSIZ-1] = '\0';
-+ if (ioctl (sock, SIOCGIFINDEX, &ifr))
-+ log_fatal ("Failed to get interface index: %m");
-+
- /* Bind to the interface name */
- memset (&sa, 0, sizeof sa);
-- sa.sa_family = AF_PACKET;
-- strncpy (sa.sa_data, (const char *)info -> ifp, sizeof sa.sa_data);
-- if (bind (sock, &sa, sizeof sa)) {
-+ sa.ll.sll_family = AF_PACKET;
-+ sa.ll.sll_ifindex = ifr.ifr_ifindex;
-+ if (bind (sock, &sa.common, sizeof sa)) {
- if (errno == ENOPROTOOPT || errno == EPROTONOSUPPORT ||
- errno == ESOCKTNOSUPPORT || errno == EPFNOSUPPORT ||
- errno == EAFNOSUPPORT || errno == EINVAL) {
-@@ -171,9 +195,18 @@ static void lpf_gen_filter_setup (struct
- void if_register_receive (info)
- struct interface_info *info;
- {
-+ int val;
-+
- /* Open a LPF device and hang it on this interface... */
- info -> rfdesc = if_register_lpf (info);
-
-+ val = 1;
-+ if (setsockopt (info -> rfdesc, SOL_PACKET, PACKET_AUXDATA, &val,
-+ sizeof val) < 0) {
-+ if (errno != ENOPROTOOPT)
-+ log_fatal ("Failed to set auxiliary packet data: %m");
-+ }
-+
- #if defined (HAVE_TR_SUPPORT)
- if (info -> hw_address.hbuf [0] == HTYPE_IEEE802)
- lpf_tr_filter_setup (info);
-@@ -295,7 +328,6 @@ ssize_t send_packet (interface, packet,
- double hh [16];
- double ih [1536 / sizeof (double)];
- unsigned char *buf = (unsigned char *)ih;
-- struct sockaddr_pkt sa;
- int result;
- int fudge;
-
-@@ -316,17 +348,7 @@ ssize_t send_packet (interface, packet,
- (unsigned char *)raw, len);
- memcpy (buf + ibufp, raw, len);
-
-- /* For some reason, SOCK_PACKET sockets can't be connected,
-- so we have to do a sentdo every time. */
-- memset (&sa, 0, sizeof sa);
-- sa.spkt_family = AF_PACKET;
-- strncpy ((char *)sa.spkt_device,
-- (const char *)interface -> ifp, sizeof sa.spkt_device);
-- sa.spkt_protocol = htons(ETH_P_IP);
--
-- result = sendto (interface -> wfdesc,
-- buf + fudge, ibufp + len - fudge, 0,
-- (const struct sockaddr *)&sa, sizeof sa);
-+ result = write (interface -> wfdesc, buf + fudge, ibufp + len - fudge);
- if (result < 0)
- log_error ("send_packet: %m");
- return result;
-@@ -343,14 +365,35 @@ ssize_t receive_packet (interface, buf,
- {
- int length = 0;
- int offset = 0;
-+ int nocsum = 0;
- unsigned char ibuf [1536];
- unsigned bufix = 0;
- unsigned paylen;
-+ unsigned char cmsgbuf[CMSG_LEN(sizeof(struct tpacket_auxdata))];
-+ struct iovec iov = {
-+ .iov_base = ibuf,
-+ .iov_len = sizeof ibuf,
-+ };
-+ struct msghdr msg = {
-+ .msg_iov = &iov,
-+ .msg_iovlen = 1,
-+ .msg_control = cmsgbuf,
-+ .msg_controllen = sizeof(cmsgbuf),
-+ };
-+ struct cmsghdr *cmsg;
-
-- length = read (interface -> rfdesc, ibuf, sizeof ibuf);
-+ length = recvmsg (interface -> rfdesc, &msg, 0);
- if (length <= 0)
- return length;
-
-+ for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg)) {
-+ if (cmsg->cmsg_level == SOL_PACKET &&
-+ cmsg->cmsg_type == PACKET_AUXDATA) {
-+ struct tpacket_auxdata *aux = (void *)CMSG_DATA(cmsg);
-+ nocsum = aux->tp_status & TP_STATUS_CSUMNOTREADY;
-+ }
-+ }
-+
- bufix = 0;
- /* Decode the physical header... */
- offset = decode_hw_header (interface, ibuf, bufix, hfrom);
-@@ -367,7 +410,7 @@ ssize_t receive_packet (interface, buf,
-
- /* Decode the IP and UDP headers... */
- offset = decode_udp_ip_header (interface, ibuf, bufix, from,
-- (unsigned)length, &paylen);
-+ (unsigned)length, &paylen, nocsum);
-
- /* If the IP or UDP checksum was bad, skip the packet... */
- if (offset < 0)
-diff -up dhcp-4.2.2b1/common/nit.c.xen dhcp-4.2.2b1/common/nit.c
---- dhcp-4.2.2b1/common/nit.c.xen 2009-11-20 02:49:01.000000000 +0100
-+++ dhcp-4.2.2b1/common/nit.c 2011-07-01 14:00:16.939958989 +0200
-@@ -369,7 +369,7 @@ ssize_t receive_packet (interface, buf,
-
- /* Decode the IP and UDP headers... */
- offset = decode_udp_ip_header (interface, ibuf, bufix,
-- from, length, &paylen);
-+ from, length, &paylen, 0);
-
- /* If the IP or UDP checksum was bad, skip the packet... */
- if (offset < 0)
-diff -up dhcp-4.2.2b1/common/packet.c.xen dhcp-4.2.2b1/common/packet.c
---- dhcp-4.2.2b1/common/packet.c.xen 2009-07-23 20:52:20.000000000 +0200
-+++ dhcp-4.2.2b1/common/packet.c 2011-07-01 14:00:16.939958989 +0200
-@@ -211,7 +211,7 @@ ssize_t
- decode_udp_ip_header(struct interface_info *interface,
- unsigned char *buf, unsigned bufix,
- struct sockaddr_in *from, unsigned buflen,
-- unsigned *rbuflen)
-+ unsigned *rbuflen, int nocsum)
- {
- unsigned char *data;
- struct ip ip;
-@@ -322,7 +322,7 @@ decode_udp_ip_header(struct interface_in
- 8, IPPROTO_UDP + ulen))));
-
- udp_packets_seen++;
-- if (usum && usum != sum) {
-+ if (!nocsum && usum && usum != sum) {
- udp_packets_bad_checksum++;
- if (udp_packets_seen > 4 &&
- (udp_packets_seen / udp_packets_bad_checksum) < 2) {
-diff -up dhcp-4.2.2b1/common/upf.c.xen dhcp-4.2.2b1/common/upf.c
---- dhcp-4.2.2b1/common/upf.c.xen 2009-11-20 02:49:01.000000000 +0100
-+++ dhcp-4.2.2b1/common/upf.c 2011-07-01 14:00:16.940958986 +0200
-@@ -320,7 +320,7 @@ ssize_t receive_packet (interface, buf,
-
- /* Decode the IP and UDP headers... */
- offset = decode_udp_ip_header (interface, ibuf, bufix,
-- from, length, &paylen);
-+ from, length, &paylen, 0);
-
- /* If the IP or UDP checksum was bad, skip the packet... */
- if (offset < 0)
-diff -up dhcp-4.2.2b1/includes/dhcpd.h.xen dhcp-4.2.2b1/includes/dhcpd.h
---- dhcp-4.2.2b1/includes/dhcpd.h.xen 2011-07-01 14:00:16.000000000 +0200
-+++ dhcp-4.2.2b1/includes/dhcpd.h 2011-07-01 14:12:18.069642470 +0200
-@@ -2796,7 +2796,7 @@ ssize_t decode_hw_header (struct interfa
- unsigned, struct hardware *);
- ssize_t decode_udp_ip_header (struct interface_info *, unsigned char *,
- unsigned, struct sockaddr_in *,
-- unsigned, unsigned *);
-+ unsigned, unsigned *, int);
-
- /* ethernet.c */
- void assemble_ethernet_header (struct interface_info *, unsigned char *,
diff --git a/src/patches/dhcp/dhcp-64_bit_lease_parse.patch b/src/patches/dhcp/dhcp-64_bit_lease_parse.patch
new file mode 100644
index 0000000..a07b5b0
--- /dev/null
+++ b/src/patches/dhcp/dhcp-64_bit_lease_parse.patch
@@ -0,0 +1,75 @@
+diff -up dhcp-4.3.0a1/common/parse.c.64-bit_lease_parse dhcp-4.3.0a1/common/parse.c
+--- dhcp-4.3.0a1/common/parse.c.64-bit_lease_parse 2013-12-11 01:25:12.000000000 +0100
++++ dhcp-4.3.0a1/common/parse.c 2013-12-19 15:45:25.990771814 +0100
+@@ -938,8 +938,8 @@ TIME
+ parse_date_core(cfile)
+ struct parse *cfile;
+ {
+- int guess;
+- int tzoff, year, mon, mday, hour, min, sec;
++ TIME guess;
++ long int tzoff, year, mon, mday, hour, min, sec;
+ const char *val;
+ enum dhcp_token token;
+ static int months[11] = { 31, 59, 90, 120, 151, 181,
+@@ -965,7 +965,7 @@ parse_date_core(cfile)
+ }
+
+ skip_token(&val, NULL, cfile); /* consume number */
+- guess = atoi(val);
++ guess = atol(val);
+
+ return((TIME)guess);
+ }
+@@ -993,7 +993,7 @@ parse_date_core(cfile)
+ somebody invents a time machine, I think we can safely disregard
+ it. This actually works around a stupid Y2K bug that was present
+ in a very early beta release of dhcpd. */
+- year = atoi(val);
++ year = atol(val);
+ if (year > 1900)
+ year -= 1900;
+
+@@ -1039,7 +1039,7 @@ parse_date_core(cfile)
+ return((TIME)0);
+ }
+ skip_token(&val, NULL, cfile); /* consume day of month */
+- mday = atoi(val);
++ mday = atol(val);
+
+ /* Hour... */
+ token = peek_token(&val, NULL, cfile);
+@@ -1050,7 +1050,7 @@ parse_date_core(cfile)
+ return((TIME)0);
+ }
+ skip_token(&val, NULL, cfile); /* consume hour */
+- hour = atoi(val);
++ hour = atol(val);
+
+ /* Colon separating hour from minute... */
+ token = peek_token(&val, NULL, cfile);
+@@ -1072,7 +1072,7 @@ parse_date_core(cfile)
+ return((TIME)0);
+ }
+ skip_token(&val, NULL, cfile); /* consume minute */
+- min = atoi(val);
++ min = atol(val);
+
+ /* Colon separating minute from second... */
+ token = peek_token(&val, NULL, cfile);
+@@ -1094,13 +1094,13 @@ parse_date_core(cfile)
+ return((TIME)0);
+ }
+ skip_token(&val, NULL, cfile); /* consume second */
+- sec = atoi(val);
++ sec = atol(val);
+
+ tzoff = 0;
+ token = peek_token(&val, NULL, cfile);
+ if (token == NUMBER) {
+ skip_token(&val, NULL, cfile); /* consume tzoff */
+- tzoff = atoi(val);
++ tzoff = atol(val);
+ } else if (token != SEMI) {
+ skip_token(&val, NULL, cfile);
+ parse_warn(cfile,
diff --git a/src/patches/dhcp/dhcp-CLOEXEC.patch b/src/patches/dhcp/dhcp-CLOEXEC.patch
new file mode 100644
index 0000000..722865e
--- /dev/null
+++ b/src/patches/dhcp/dhcp-CLOEXEC.patch
@@ -0,0 +1,342 @@
+diff -up dhcp-4.3.0a1/client/clparse.c.cloexec dhcp-4.3.0a1/client/clparse.c
+--- dhcp-4.3.0a1/client/clparse.c.cloexec 2013-12-19 15:34:41.638886256 +0100
++++ dhcp-4.3.0a1/client/clparse.c 2013-12-19 15:34:41.657885985 +0100
+@@ -253,7 +253,7 @@ int read_client_conf_file (const char *n
+ int token;
+ isc_result_t status;
+
+- if ((file = open (name, O_RDONLY)) < 0)
++ if ((file = open (name, O_RDONLY | O_CLOEXEC)) < 0)
+ return uerr2isc (errno);
+
+ cfile = NULL;
+@@ -290,7 +290,7 @@ void read_client_leases ()
+
+ /* Open the lease file. If we can't open it, just return -
+ we can safely trust the server to remember our state. */
+- if ((file = open (path_dhclient_db, O_RDONLY)) < 0)
++ if ((file = open (path_dhclient_db, O_RDONLY | O_CLOEXEC)) < 0)
+ return;
+
+ cfile = NULL;
+diff -up dhcp-4.3.0a1/client/dhclient.c.cloexec dhcp-4.3.0a1/client/dhclient.c
+--- dhcp-4.3.0a1/client/dhclient.c.cloexec 2013-12-19 15:34:41.629886384 +0100
++++ dhcp-4.3.0a1/client/dhclient.c 2013-12-19 15:36:41.608180467 +0100
+@@ -148,11 +148,11 @@ main(int argc, char **argv) {
+ /* Make sure that file descriptors 0 (stdin), 1, (stdout), and
+ 2 (stderr) are open. To do this, we assume that when we
+ open a file the lowest available file descriptor is used. */
+- fd = open("/dev/null", O_RDWR);
++ fd = open("/dev/null", O_RDWR | O_CLOEXEC);
+ if (fd == 0)
+- fd = open("/dev/null", O_RDWR);
++ fd = open("/dev/null", O_RDWR | O_CLOEXEC);
+ if (fd == 1)
+- fd = open("/dev/null", O_RDWR);
++ fd = open("/dev/null", O_RDWR | O_CLOEXEC);
+ if (fd == 2)
+ log_perror = 0; /* No sense logging to /dev/null. */
+ else if (fd != -1)
+@@ -504,7 +504,7 @@ main(int argc, char **argv) {
+ long temp;
+ int e;
+
+- if ((pidfd = fopen(path_dhclient_pid, "r")) != NULL) {
++ if ((pidfd = fopen(path_dhclient_pid, "re")) != NULL) {
+ e = fscanf(pidfd, "%ld\n", &temp);
+ oldpid = (pid_t)temp;
+
+@@ -554,7 +554,7 @@ main(int argc, char **argv) {
+ strncpy(new_path_dhclient_pid, path_dhclient_pid, pfx);
+ sprintf(new_path_dhclient_pid + pfx, "-%s.pid", ip->name);
+
+- if ((pidfd = fopen(new_path_dhclient_pid, "r")) != NULL) {
++ if ((pidfd = fopen(new_path_dhclient_pid, "re")) != NULL) {
+ e = fscanf(pidfd, "%ld\n", &temp);
+ oldpid = (pid_t)temp;
+
+@@ -579,7 +579,7 @@ main(int argc, char **argv) {
+ int dhc_running = 0;
+ char procfn[256] = "";
+
+- if ((pidfp = fopen(path_dhclient_pid, "r")) != NULL) {
++ if ((pidfp = fopen(path_dhclient_pid, "re")) != NULL) {
+ if ((fscanf(pidfp, "%ld", &temp)==1) && ((dhcpid=(pid_t)temp) > 0)) {
+ snprintf(procfn,256,"/proc/%u",dhcpid);
+ dhc_running = (access(procfn, F_OK) == 0);
+@@ -3077,7 +3077,7 @@ void rewrite_client_leases ()
+
+ if (leaseFile != NULL)
+ fclose (leaseFile);
+- leaseFile = fopen (path_dhclient_db, "w");
++ leaseFile = fopen (path_dhclient_db, "we");
+ if (leaseFile == NULL) {
+ log_error ("can't create %s: %m", path_dhclient_db);
+ return;
+@@ -3261,7 +3261,7 @@ write_duid(struct data_string *duid)
+ return DHCP_R_INVALIDARG;
+
+ if (leaseFile == NULL) { /* XXX? */
+- leaseFile = fopen(path_dhclient_db, "w");
++ leaseFile = fopen(path_dhclient_db, "we");
+ if (leaseFile == NULL) {
+ log_error("can't create %s: %m", path_dhclient_db);
+ return ISC_R_IOERROR;
+@@ -3441,7 +3441,7 @@ int write_client_lease (client, lease, r
+ return 1;
+
+ if (leaseFile == NULL) { /* XXX */
+- leaseFile = fopen (path_dhclient_db, "w");
++ leaseFile = fopen (path_dhclient_db, "we");
+ if (leaseFile == NULL) {
+ log_error ("can't create %s: %m", path_dhclient_db);
+ return 0;
+@@ -3952,9 +3952,9 @@ void go_daemon ()
+ (void) close(2);
+
+ /* Reopen them on /dev/null. */
+- (void) open("/dev/null", O_RDWR);
+- (void) open("/dev/null", O_RDWR);
+- (void) open("/dev/null", O_RDWR);
++ (void) open("/dev/null", O_RDWR | O_CLOEXEC);
++ (void) open("/dev/null", O_RDWR | O_CLOEXEC);
++ (void) open("/dev/null", O_RDWR | O_CLOEXEC);
+
+ write_client_pid_file ();
+
+@@ -3971,14 +3971,14 @@ void write_client_pid_file ()
+ return;
+ }
+
+- pfdesc = open (path_dhclient_pid, O_CREAT | O_TRUNC | O_WRONLY, 0644);
++ pfdesc = open (path_dhclient_pid, O_CREAT | O_TRUNC | O_WRONLY | O_CLOEXEC, 0644);
+
+ if (pfdesc < 0) {
+ log_error ("Can't create %s: %m", path_dhclient_pid);
+ return;
+ }
+
+- pf = fdopen (pfdesc, "w");
++ pf = fdopen (pfdesc, "we");
+ if (!pf) {
+ close(pfdesc);
+ log_error ("Can't fdopen %s: %m", path_dhclient_pid);
+diff -up dhcp-4.3.0a1/common/bpf.c.cloexec dhcp-4.3.0a1/common/bpf.c
+--- dhcp-4.3.0a1/common/bpf.c.cloexec 2013-12-19 15:34:41.640886227 +0100
++++ dhcp-4.3.0a1/common/bpf.c 2013-12-19 15:34:41.661885928 +0100
+@@ -95,7 +95,7 @@ int if_register_bpf (info)
+ for (b = 0; 1; b++) {
+ /* %Audit% 31 bytes max. %2004.06.17,Safe% */
+ sprintf(filename, BPF_FORMAT, b);
+- sock = open (filename, O_RDWR, 0);
++ sock = open (filename, O_RDWR | O_CLOEXEC, 0);
+ if (sock < 0) {
+ if (errno == EBUSY) {
+ continue;
+diff -up dhcp-4.3.0a1/common/dlpi.c.cloexec dhcp-4.3.0a1/common/dlpi.c
+--- dhcp-4.3.0a1/common/dlpi.c.cloexec 2013-12-19 15:34:41.641886213 +0100
++++ dhcp-4.3.0a1/common/dlpi.c 2013-12-19 15:34:41.662885914 +0100
+@@ -804,7 +804,7 @@ dlpiopen(const char *ifname) {
+ }
+ *dp = '\0';
+
+- return open (devname, O_RDWR, 0);
++ return open (devname, O_RDWR | O_CLOEXEC, 0);
+ }
+
+ /*
+diff -up dhcp-4.3.0a1/common/nit.c.cloexec dhcp-4.3.0a1/common/nit.c
+--- dhcp-4.3.0a1/common/nit.c.cloexec 2013-12-19 15:34:41.642886199 +0100
++++ dhcp-4.3.0a1/common/nit.c 2013-12-19 15:34:41.662885914 +0100
+@@ -81,7 +81,7 @@ int if_register_nit (info)
+ struct strioctl sio;
+
+ /* Open a NIT device */
+- sock = open ("/dev/nit", O_RDWR);
++ sock = open ("/dev/nit", O_RDWR | O_CLOEXEC);
+ if (sock < 0)
+ log_fatal ("Can't open NIT device for %s: %m", info -> name);
+
+diff -up dhcp-4.3.0a1/common/resolv.c.cloexec dhcp-4.3.0a1/common/resolv.c
+--- dhcp-4.3.0a1/common/resolv.c.cloexec 2013-12-11 01:25:12.000000000 +0100
++++ dhcp-4.3.0a1/common/resolv.c 2013-12-19 15:34:41.663885900 +0100
+@@ -50,7 +50,7 @@ void read_resolv_conf (parse_time)
+ struct domain_search_list *dp, *dl, *nd;
+ isc_result_t status;
+
+- if ((file = open (path_resolv_conf, O_RDONLY)) < 0) {
++ if ((file = open (path_resolv_conf, O_RDONLY | O_CLOEXEC)) < 0) {
+ log_error ("Can't open %s: %m", path_resolv_conf);
+ return;
+ }
+diff -up dhcp-4.3.0a1/common/upf.c.cloexec dhcp-4.3.0a1/common/upf.c
+--- dhcp-4.3.0a1/common/upf.c.cloexec 2013-12-19 15:34:41.642886199 +0100
++++ dhcp-4.3.0a1/common/upf.c 2013-12-19 15:34:41.663885900 +0100
+@@ -77,7 +77,7 @@ int if_register_upf (info)
+ /* %Audit% Cannot exceed 36 bytes. %2004.06.17,Safe% */
+ sprintf(filename, "/dev/pf/pfilt%d", b);
+
+- sock = open (filename, O_RDWR, 0);
++ sock = open (filename, O_RDWR | O_CLOEXEC, 0);
+ if (sock < 0) {
+ if (errno == EBUSY) {
+ continue;
+diff -up dhcp-4.3.0a1/omapip/trace.c.cloexec dhcp-4.3.0a1/omapip/trace.c
+--- dhcp-4.3.0a1/omapip/trace.c.cloexec 2013-12-11 01:01:03.000000000 +0100
++++ dhcp-4.3.0a1/omapip/trace.c 2013-12-19 15:34:41.663885900 +0100
+@@ -142,10 +142,10 @@ isc_result_t trace_begin (const char *fi
+ return DHCP_R_INVALIDARG;
+ }
+
+- traceoutfile = open (filename, O_CREAT | O_WRONLY | O_EXCL, 0600);
++ traceoutfile = open (filename, O_CREAT | O_WRONLY | O_EXCL | O_CLOEXEC, 0600);
+ if (traceoutfile < 0 && errno == EEXIST) {
+ log_error ("WARNING: Overwriting trace file \"%s\"", filename);
+- traceoutfile = open (filename, O_WRONLY | O_EXCL | O_TRUNC,
++ traceoutfile = open (filename, O_WRONLY | O_EXCL | O_TRUNC | O_CLOEXEC,
+ 0600);
+ }
+
+@@ -433,7 +433,7 @@ void trace_file_replay (const char *file
+ isc_result_t result;
+ int len;
+
+- traceinfile = fopen (filename, "r");
++ traceinfile = fopen (filename, "re");
+ if (!traceinfile) {
+ log_error("Can't open tracefile %s: %m", filename);
+ return;
+diff -up dhcp-4.3.0a1/relay/dhcrelay.c.cloexec dhcp-4.3.0a1/relay/dhcrelay.c
+--- dhcp-4.3.0a1/relay/dhcrelay.c.cloexec 2013-12-13 22:26:21.000000000 +0100
++++ dhcp-4.3.0a1/relay/dhcrelay.c 2013-12-19 15:34:41.664885886 +0100
+@@ -193,11 +193,11 @@ main(int argc, char **argv) {
+ /* Make sure that file descriptors 0(stdin), 1,(stdout), and
+ 2(stderr) are open. To do this, we assume that when we
+ open a file the lowest available file descriptor is used. */
+- fd = open("/dev/null", O_RDWR);
++ fd = open("/dev/null", O_RDWR | O_CLOEXEC);
+ if (fd == 0)
+- fd = open("/dev/null", O_RDWR);
++ fd = open("/dev/null", O_RDWR | O_CLOEXEC);
+ if (fd == 1)
+- fd = open("/dev/null", O_RDWR);
++ fd = open("/dev/null", O_RDWR | O_CLOEXEC);
+ if (fd == 2)
+ log_perror = 0; /* No sense logging to /dev/null. */
+ else if (fd != -1)
+@@ -564,13 +564,13 @@ main(int argc, char **argv) {
+
+ if (no_pid_file == ISC_FALSE) {
+ pfdesc = open(path_dhcrelay_pid,
+- O_CREAT | O_TRUNC | O_WRONLY, 0644);
++ O_CREAT | O_TRUNC | O_WRONLY | O_CLOEXEC, 0644);
+
+ if (pfdesc < 0) {
+ log_error("Can't create %s: %m",
+ path_dhcrelay_pid);
+ } else {
+- pf = fdopen(pfdesc, "w");
++ pf = fdopen(pfdesc, "we");
+ if (!pf)
+ log_error("Can't fdopen %s: %m",
+ path_dhcrelay_pid);
+diff -up dhcp-4.3.0a1/server/confpars.c.cloexec dhcp-4.3.0a1/server/confpars.c
+--- dhcp-4.3.0a1/server/confpars.c.cloexec 2013-12-11 01:25:12.000000000 +0100
++++ dhcp-4.3.0a1/server/confpars.c 2013-12-19 15:34:41.665885871 +0100
+@@ -117,7 +117,7 @@ isc_result_t read_conf_file (const char
+ }
+ #endif
+
+- if ((file = open (filename, O_RDONLY)) < 0) {
++ if ((file = open (filename, O_RDONLY | O_CLOEXEC)) < 0) {
+ if (leasep) {
+ log_error ("Can't open lease database %s: %m --",
+ path_dhcpd_db);
+diff -up dhcp-4.3.0a1/server/db.c.cloexec dhcp-4.3.0a1/server/db.c
+--- dhcp-4.3.0a1/server/db.c.cloexec 2013-12-11 01:25:12.000000000 +0100
++++ dhcp-4.3.0a1/server/db.c 2013-12-19 15:34:41.666885857 +0100
+@@ -1081,7 +1081,7 @@ void db_startup (testp)
+ }
+ #endif
+ if (!testp) {
+- db_file = fopen (path_dhcpd_db, "a");
++ db_file = fopen (path_dhcpd_db, "ae");
+ if (!db_file)
+ log_fatal ("Can't open %s for append.", path_dhcpd_db);
+ expire_all_pools ();
+@@ -1129,12 +1129,12 @@ int new_lease_file ()
+ path_dhcpd_db, (int)t) >= sizeof newfname)
+ log_fatal("new_lease_file: lease file path too long");
+
+- db_fd = open (newfname, O_WRONLY | O_TRUNC | O_CREAT, 0664);
++ db_fd = open (newfname, O_WRONLY | O_TRUNC | O_CREAT | O_CLOEXEC, 0664);
+ if (db_fd < 0) {
+ log_error ("Can't create new lease file: %m");
+ return 0;
+ }
+- if ((new_db_file = fdopen(db_fd, "w")) == NULL) {
++ if ((new_db_file = fdopen(db_fd, "we")) == NULL) {
+ log_error("Can't fdopen new lease file: %m");
+ close(db_fd);
+ goto fdfail;
+diff -up dhcp-4.3.0a1/server/dhcpd.c.cloexec dhcp-4.3.0a1/server/dhcpd.c
+--- dhcp-4.3.0a1/server/dhcpd.c.cloexec 2013-12-13 22:26:01.000000000 +0100
++++ dhcp-4.3.0a1/server/dhcpd.c 2013-12-19 15:37:17.258674472 +0100
+@@ -193,11 +193,11 @@ main(int argc, char **argv) {
+ /* Make sure that file descriptors 0 (stdin), 1, (stdout), and
+ 2 (stderr) are open. To do this, we assume that when we
+ open a file the lowest available file descriptor is used. */
+- fd = open("/dev/null", O_RDWR);
++ fd = open("/dev/null", O_RDWR | O_CLOEXEC);
+ if (fd == 0)
+- fd = open("/dev/null", O_RDWR);
++ fd = open("/dev/null", O_RDWR | O_CLOEXEC);
+ if (fd == 1)
+- fd = open("/dev/null", O_RDWR);
++ fd = open("/dev/null", O_RDWR | O_CLOEXEC);
+ if (fd == 2)
+ log_perror = 0; /* No sense logging to /dev/null. */
+ else if (fd != -1)
+@@ -716,7 +716,7 @@ main(int argc, char **argv) {
+ */
+ if (no_pid_file == ISC_FALSE) {
+ /*Read previous pid file. */
+- if ((i = open (path_dhcpd_pid, O_RDONLY)) >= 0) {
++ if ((i = open (path_dhcpd_pid, O_RDONLY | O_CLOEXEC)) >= 0) {
+ status = read(i, pbuf, (sizeof pbuf) - 1);
+ close (i);
+ if (status > 0) {
+@@ -735,7 +735,7 @@ main(int argc, char **argv) {
+ }
+
+ /* Write new pid file. */
+- i = open(path_dhcpd_pid, O_WRONLY|O_CREAT|O_TRUNC, 0644);
++ i = open(path_dhcpd_pid, O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0644);
+ if (i >= 0) {
+ sprintf(pbuf, "%d\n", (int) getpid());
+ IGNORE_RET (write(i, pbuf, strlen(pbuf)));
+@@ -763,9 +763,9 @@ main(int argc, char **argv) {
+ (void) close(2);
+
+ /* Reopen them on /dev/null. */
+- (void) open("/dev/null", O_RDWR);
+- (void) open("/dev/null", O_RDWR);
+- (void) open("/dev/null", O_RDWR);
++ (void) open("/dev/null", O_RDWR | O_CLOEXEC);
++ (void) open("/dev/null", O_RDWR | O_CLOEXEC);
++ (void) open("/dev/null", O_RDWR | O_CLOEXEC);
+ log_perror = 0; /* No sense logging to /dev/null. */
+
+ IGNORE_RET (chdir("/"));
+diff -up dhcp-4.3.0a1/server/ldap.c.cloexec dhcp-4.3.0a1/server/ldap.c
+--- dhcp-4.3.0a1/server/ldap.c.cloexec 2013-12-11 01:25:12.000000000 +0100
++++ dhcp-4.3.0a1/server/ldap.c 2013-12-19 15:34:41.667885843 +0100
+@@ -684,7 +684,7 @@ ldap_start (void)
+
+ if (ldap_debug_file != NULL && ldap_debug_fd == -1)
+ {
+- if ((ldap_debug_fd = open (ldap_debug_file, O_CREAT | O_TRUNC | O_WRONLY,
++ if ((ldap_debug_fd = open (ldap_debug_file, O_CREAT | O_TRUNC | O_WRONLY | O_CLOEXEC,
+ S_IRUSR | S_IWUSR)) < 0)
+ log_error ("Error opening debug LDAP log file %s: %s", ldap_debug_file,
+ strerror (errno));
diff --git a/src/patches/dhcp/dhcp-PPP.patch b/src/patches/dhcp/dhcp-PPP.patch
new file mode 100644
index 0000000..5d022e4
--- /dev/null
+++ b/src/patches/dhcp/dhcp-PPP.patch
@@ -0,0 +1,150 @@
+diff -up dhcp-4.3.1b1/client/dhc6.c.mRfpsB dhcp-4.3.1b1/client/dhc6.c
+--- dhcp-4.3.1b1/client/dhc6.c.mRfpsB 2014-07-10 17:48:03.779424870 +0200
++++ dhcp-4.3.1b1/client/dhc6.c 2014-07-10 17:48:03.795424644 +0200
+@@ -5088,7 +5088,8 @@ make_client6_options(struct client_state
+ */
+ if ((oc = lookup_option(&dhcpv6_universe, *op,
+ D6O_CLIENTID)) == NULL) {
+- if (!option_cache(&oc, &default_duid, NULL, clientid_option,
++ if (default_duid.len == 0 ||
++ !option_cache(&oc, &default_duid, NULL, clientid_option,
+ MDL))
+ log_fatal("Failure assembling a DUID.");
+
+diff -up dhcp-4.3.1b1/client/dhclient.c.mRfpsB dhcp-4.3.1b1/client/dhclient.c
+--- dhcp-4.3.1b1/client/dhclient.c.mRfpsB 2014-07-10 17:39:25.853763858 +0200
++++ dhcp-4.3.1b1/client/dhclient.c 2014-07-10 17:49:49.882925843 +0200
+@@ -948,8 +948,8 @@ main(int argc, char **argv) {
+ if (default_duid.buffer != NULL)
+ data_string_forget(&default_duid, MDL);
+
+- form_duid(&default_duid, MDL);
+- write_duid(&default_duid);
++ if (form_duid(&default_duid, MDL) == ISC_R_SUCCESS)
++ write_duid(&default_duid);
+ }
+ }
+
+@@ -3267,7 +3267,7 @@ write_options(struct client_state *clien
+ * is not how it is intended. Upcoming rearchitecting the client should
+ * address this "one daemon model."
+ */
+-void
++isc_result_t
+ form_duid(struct data_string *duid, const char *file, int line)
+ {
+ struct interface_info *ip;
+@@ -3280,6 +3280,15 @@ form_duid(struct data_string *duid, cons
+ if (ip == NULL)
+ log_fatal("Impossible condition at %s:%d.", MDL);
+
++ while (ip && ip->hw_address.hbuf[0] == HTYPE_RESERVED) {
++ /* Try the other interfaces */
++ log_debug("Cannot form default DUID from interface %s.", ip->name);
++ ip = ip->next;
++ }
++ if (ip == NULL) {
++ return ISC_R_UNEXPECTED;
++ }
++
+ if ((ip->hw_address.hlen == 0) ||
+ (ip->hw_address.hlen > sizeof(ip->hw_address.hbuf)))
+ log_fatal("Impossible hardware address length at %s:%d.", MDL);
+@@ -3323,6 +3332,8 @@ form_duid(struct data_string *duid, cons
+ log_info("Created duid %s.", str);
+ dfree(str, MDL);
+ }
++
++ return ISC_R_SUCCESS;
+ }
+
+ /* Write the default DUID to the lease store. */
+diff -up dhcp-4.3.1b1/common/bpf.c.mRfpsB dhcp-4.3.1b1/common/bpf.c
+--- dhcp-4.3.1b1/common/bpf.c.mRfpsB 2014-07-10 17:39:25.797764653 +0200
++++ dhcp-4.3.1b1/common/bpf.c 2014-07-10 17:48:03.797424616 +0200
+@@ -600,6 +600,22 @@ get_hw_addr(const char *name, struct har
+ memcpy(&hw->hbuf[1], LLADDR(sa), sa->sdl_alen);
+ break;
+ #endif /* IFT_FDDI */
++#if defined(IFT_PPP)
++ case IFT_PPP:
++ if (local_family != AF_INET6)
++ log_fatal("Unsupported device type %d for \"%s\"",
++ sa->sdl_type, name);
++ hw->hlen = 0;
++ hw->hbuf[0] = HTYPE_RESERVED;
++ /* 0xdeadbeef should never occur on the wire,
++ * and is a signature that something went wrong.
++ */
++ hw->hbuf[1] = 0xde;
++ hw->hbuf[2] = 0xad;
++ hw->hbuf[3] = 0xbe;
++ hw->hbuf[4] = 0xef;
++ break;
++#endif
+ default:
+ log_fatal("Unsupported device type %d for \"%s\"",
+ sa->sdl_type, name);
+diff -up dhcp-4.3.1b1/common/lpf.c.mRfpsB dhcp-4.3.1b1/common/lpf.c
+--- dhcp-4.3.1b1/common/lpf.c.mRfpsB 2014-07-10 17:39:25.744765404 +0200
++++ dhcp-4.3.1b1/common/lpf.c 2014-07-10 17:48:03.797424616 +0200
+@@ -511,6 +511,22 @@ get_hw_addr(const char *name, struct har
+ hw->hbuf[0] = HTYPE_FDDI;
+ memcpy(&hw->hbuf[1], sa->sa_data, 6);
+ break;
++#if defined(ARPHRD_PPP)
++ case ARPHRD_PPP:
++ if (local_family != AF_INET6)
++ log_fatal("Unsupported device type %d for \"%s\"",
++ sa->sa_family, name);
++ hw->hlen = 0;
++ hw->hbuf[0] = HTYPE_RESERVED;
++ /* 0xdeadbeef should never occur on the wire,
++ * and is a signature that something went wrong.
++ */
++ hw->hbuf[1] = 0xde;
++ hw->hbuf[2] = 0xad;
++ hw->hbuf[3] = 0xbe;
++ hw->hbuf[4] = 0xef;
++ break;
++#endif
+ default:
+ log_fatal("Unsupported device type %ld for \"%s\"",
+ (long int)sa->sa_family, name);
+diff -up dhcp-4.3.1b1/includes/dhcpd.h.mRfpsB dhcp-4.3.1b1/includes/dhcpd.h
+--- dhcp-4.3.1b1/includes/dhcpd.h.mRfpsB 2014-07-10 17:48:03.761425124 +0200
++++ dhcp-4.3.1b1/includes/dhcpd.h 2014-07-10 17:48:03.798424601 +0200
+@@ -2839,7 +2839,7 @@ void client_dns_remove(struct client_sta
+
+ void dhcpv4_client_assignments(void);
+ void dhcpv6_client_assignments(void);
+-void form_duid(struct data_string *duid, const char *file, int line);
++isc_result_t form_duid(struct data_string *duid, const char *file, int line);
+
+ /* dhc6.c */
+ void dhc6_lease_destroy(struct dhc6_lease **src, const char *file, int line);
+diff -up dhcp-4.3.1b1/includes/dhcp.h.mRfpsB dhcp-4.3.1b1/includes/dhcp.h
+--- dhcp-4.3.1b1/includes/dhcp.h.mRfpsB 2014-07-10 17:48:03.761425124 +0200
++++ dhcp-4.3.1b1/includes/dhcp.h 2014-07-10 17:48:03.798424601 +0200
+@@ -81,6 +81,8 @@ struct dhcp_packet {
+ * is no standard for this so we
+ * just steal a type */
+
++#define HTYPE_RESERVED 0 /* RFC 5494 */
++
+ /* Magic cookie validating dhcp options field (and bootp vendor
+ extensions field). */
+ #define DHCP_OPTIONS_COOKIE "\143\202\123\143"
+diff -up dhcp-4.3.1b1/server/dhcpv6.c.mRfpsB dhcp-4.3.1b1/server/dhcpv6.c
+--- dhcp-4.3.1b1/server/dhcpv6.c.mRfpsB 2014-07-10 17:47:31.464881409 +0200
++++ dhcp-4.3.1b1/server/dhcpv6.c 2014-07-10 17:48:03.800424573 +0200
+@@ -330,6 +330,9 @@ generate_new_server_duid(void) {
+ if (p->hw_address.hlen > 0) {
+ break;
+ }
++ if (p->next == NULL && p->hw_address.hbuf[0] == HTYPE_RESERVED) {
++ log_error("Can not generate DUID from interfaces which do not have hardware addresses, please configure server-duid!");
++ }
+ }
+ if (p == NULL) {
+ return ISC_R_UNEXPECTED;
diff --git a/src/patches/dhcp/dhcp-UseMulticast.patch b/src/patches/dhcp/dhcp-UseMulticast.patch
new file mode 100644
index 0000000..ee0ea6b
--- /dev/null
+++ b/src/patches/dhcp/dhcp-UseMulticast.patch
@@ -0,0 +1,241 @@
+diff -up dhcp-4.3.1b1/server/dhcpv6.c.UseMulticast dhcp-4.3.1b1/server/dhcpv6.c
+--- dhcp-4.3.1b1/server/dhcpv6.c.UseMulticast 2014-07-02 19:58:40.000000000 +0200
++++ dhcp-4.3.1b1/server/dhcpv6.c 2014-07-10 18:20:03.066256219 +0200
+@@ -376,6 +376,48 @@ generate_new_server_duid(void) {
+ }
+
+ /*
++ * Is the D6O_UNICAST option defined in dhcpd.conf ?
++ */
++static isc_boolean_t unicast_option_defined;
++
++/*
++ * Did we already search dhcpd.conf for D6O_UNICAST option ?
++ * We need to store it here to not parse dhcpd.conf repeatedly.
++ */
++static isc_boolean_t unicast_option_parsed = ISC_FALSE;
++
++
++/*
++ * Is the D6O_UNICAST option defined in dhcpd.conf ?
++ */
++isc_boolean_t
++is_unicast_option_defined(void) {
++ struct option_state *opt_state;
++ struct option_cache *oc;
++
++ /*
++ * If we are looking for the unicast option for the first time
++ */
++ if (unicast_option_parsed == ISC_FALSE) {
++ unicast_option_parsed = ISC_TRUE;
++ opt_state = NULL;
++ if (!option_state_allocate(&opt_state, MDL)) {
++ log_fatal("No memory for option state.");
++ }
++
++ execute_statements_in_scope(NULL, NULL, NULL, NULL, NULL,
++ opt_state, &global_scope, root_group, NULL, NULL);
++
++ oc = lookup_option(&dhcpv6_universe, opt_state, D6O_UNICAST);
++ unicast_option_defined = (oc != NULL);
++
++ option_state_dereference(&opt_state, MDL);
++ }
++
++ return (unicast_option_defined);
++}
++
++/*
+ * Get the client identifier from the packet.
+ */
+ isc_result_t
+@@ -706,6 +748,12 @@ static const int required_opts[] = {
+ D6O_PREFERENCE,
+ 0
+ };
++static const int required_opts_NAA[] = {
++ D6O_CLIENTID,
++ D6O_SERVERID,
++ D6O_STATUS_CODE,
++ 0
++};
+ static const int required_opts_solicit[] = {
+ D6O_CLIENTID,
+ D6O_SERVERID,
+@@ -1587,6 +1635,56 @@ lease_to_client(struct data_string *repl
+ reply.shared->group, NULL);
+ }
+
++ /* reject unicast message, unless we set unicast option */
++ if ((packet->unicast == ISC_TRUE) && !is_unicast_option_defined())
++ /*
++ * RFC3315 section 18.2.1 (Request):
++ *
++ * When the server receives a Request message via unicast from a client
++ * to which the server has not sent a unicast option, the server
++ * discards the Request message and responds with a Reply message
++ * containing a Status Code option with the value UseMulticast, a Server
++ * Identifier option containing the server's DUID, the Client Identifier
++ * option from the client message, and no other options.
++ *
++ * Section 18.2.3 (Renew):
++ *
++ * When the server receives a Renew message via unicast from a client to
++ * which the server has not sent a unicast option, the server discards
++ * the Renew message and responds with a Reply message containing a
++ * Status Code option with the value UseMulticast, a Server Identifier
++ * option containing the server's DUID, the Client Identifier option
++ * from the client message, and no other options.
++ */
++ {
++ /* Set the UseMulticast status code. */
++ if (!set_status_code(STATUS_UseMulticast,
++ "Unicast not allowed by server.",
++ reply.opt_state)) {
++ log_error("lease_to_client: Unable to set "
++ "UseMulticast status code.");
++ goto exit;
++ }
++
++ /* Rewind the cursor to the start. */
++ reply.cursor = REPLY_OPTIONS_INDEX;
++
++ /*
++ * Produce an reply that includes only:
++ *
++ * Status code.
++ * Server DUID.
++ * Client DUID.
++ */
++ reply.cursor += store_options6((char *)reply.buf.data +
++ reply.cursor,
++ sizeof(reply.buf) -
++ reply.cursor,
++ reply.opt_state, reply.packet,
++ required_opts_NAA,
++ NULL);
++ }
++
+ /*
+ * RFC3315 section 17.2.2 (Solicit):
+ *
+@@ -1619,6 +1717,7 @@ lease_to_client(struct data_string *repl
+ * Having stored the client's IA's, store any options that
+ * will fit in the remaining space.
+ */
++ else
+ reply.cursor += store_options6((char *)reply.buf.data + reply.cursor,
+ sizeof(reply.buf) - reply.cursor,
+ reply.opt_state, reply.packet,
+@@ -4748,7 +4847,6 @@ dhcpv6_solicit(struct data_string *reply
+ * Very similar to Solicit handling, except the server DUID is required.
+ */
+
+-/* TODO: reject unicast messages, unless we set unicast option */
+ static void
+ dhcpv6_request(struct data_string *reply_ret, struct packet *packet) {
+ struct data_string client_id;
+@@ -5078,7 +5176,6 @@ exit:
+ * except for the error code of when addresses don't match.
+ */
+
+-/* TODO: reject unicast messages, unless we set unicast option */
+ static void
+ dhcpv6_renew(struct data_string *reply, struct packet *packet) {
+ struct data_string client_id;
+@@ -5322,18 +5419,60 @@ iterate_over_ia_na(struct data_string *r
+ goto exit;
+ }
+
+- snprintf(status_msg, sizeof(status_msg), "%s received.", packet_type);
+- if (!set_status_code(STATUS_Success, status_msg, opt_state)) {
+- goto exit;
+- }
++ /* reject unicast message, unless we set unicast option */
++ if ((packet->unicast == ISC_TRUE) && !is_unicast_option_defined()) {
++ /*
++ * RFC3315 section 18.2.6 (Release):
++ *
++ * When the server receives a Release message via unicast from a client
++ * to which the server has not sent a unicast option, the server
++ * discards the Release message and responds with a Reply message
++ * containing a Status Code option with value UseMulticast, a Server
++ * Identifier option containing the server's DUID, the Client Identifier
++ * option from the client message, and no other options.
++ *
++ * Section 18.2.7 (Decline):
++ *
++ * When the server receives a Decline message via unicast from a client
++ * to which the server has not sent a unicast option, the server
++ * discards the Decline message and responds with a Reply message
++ * containing a Status Code option with the value UseMulticast, a Server
++ * Identifier option containing the server's DUID, the Client Identifier
++ * option from the client message, and no other options.
++ */
++ snprintf(status_msg, sizeof(status_msg),
++ "%s received unicast.", packet_type);
++ if (!set_status_code(STATUS_UseMulticast, status_msg, opt_state)) {
++ goto exit;
++ }
+
+- /*
+- * Add our options that are not associated with any IA_NA or IA_TA.
+- */
+- reply_ofs += store_options6(reply_data+reply_ofs,
+- sizeof(reply_data)-reply_ofs,
++ /*
++ * Produce an reply that includes only:
++ *
++ * Status code.
++ * Server DUID.
++ * Client DUID.
++ */
++ reply_ofs += store_options6(reply_data+reply_ofs,
++ sizeof(reply_data)-reply_ofs,
+ opt_state, packet,
+- required_opts, NULL);
++ required_opts_NAA, NULL);
++
++ goto return_reply;
++ } else {
++ snprintf(status_msg, sizeof(status_msg), "%s received.", packet_type);
++ if (!set_status_code(STATUS_Success, status_msg, opt_state)) {
++ goto exit;
++ }
++
++ /*
++ * Add our options that are not associated with any IA_NA or IA_TA.
++ */
++ reply_ofs += store_options6(reply_data+reply_ofs,
++ sizeof(reply_data)-reply_ofs,
++ opt_state, packet,
++ required_opts, NULL);
++ }
+
+ /*
+ * Loop through the IA_NA reported by the client, and deal with
+@@ -5471,6 +5610,7 @@ iterate_over_ia_na(struct data_string *r
+ /*
+ * Return our reply to the caller.
+ */
++return_reply:
+ reply_ret->len = reply_ofs;
+ reply_ret->buffer = NULL;
+ if (!buffer_allocate(&reply_ret->buffer, reply_ofs, MDL)) {
+@@ -5516,7 +5656,6 @@ exit:
+ * we still need to be aware of this possibility.
+ */
+
+-/* TODO: reject unicast messages, unless we set unicast option */
+ /* TODO: IA_TA */
+ static void
+ dhcpv6_decline(struct data_string *reply, struct packet *packet) {
+@@ -5986,7 +6125,6 @@ exit:
+ * Release means a client is done with the leases.
+ */
+
+-/* TODO: reject unicast messages, unless we set unicast option */
+ static void
+ dhcpv6_release(struct data_string *reply, struct packet *packet) {
+ struct data_string client_id;
diff --git a/src/patches/dhcp/dhcp-add_timeout_when_NULL.patch b/src/patches/dhcp/dhcp-add_timeout_when_NULL.patch
new file mode 100644
index 0000000..103824c
--- /dev/null
+++ b/src/patches/dhcp/dhcp-add_timeout_when_NULL.patch
@@ -0,0 +1,14 @@
+diff -up dhcp-4.3.0a1/common/dispatch.c.dracut dhcp-4.3.0a1/common/dispatch.c
+--- dhcp-4.3.0a1/common/dispatch.c.dracut 2013-12-11 01:25:12.000000000 +0100
++++ dhcp-4.3.0a1/common/dispatch.c 2013-12-19 15:39:50.350505860 +0100
+@@ -210,6 +210,10 @@ void add_timeout (when, where, what, ref
+ isc_interval_t interval;
+ isc_time_t expires;
+
++ if (when == NULL) {
++ return;
++ }
++
+ /* See if this timeout supersedes an existing timeout. */
+ t = (struct timeout *)0;
+ for (q = timeouts; q; q = q->next) {
diff --git a/src/patches/dhcp/dhcp-capability.patch b/src/patches/dhcp/dhcp-capability.patch
new file mode 100644
index 0000000..91a1bae
--- /dev/null
+++ b/src/patches/dhcp/dhcp-capability.patch
@@ -0,0 +1,250 @@
+diff -up dhcp-4.3.1b1/client/dhclient.8.zzftXp dhcp-4.3.1b1/client/dhclient.8
+--- dhcp-4.3.1b1/client/dhclient.8.zzftXp 2014-07-10 17:38:26.938599402 +0200
++++ dhcp-4.3.1b1/client/dhclient.8 2014-07-10 17:39:25.852763873 +0200
+@@ -128,6 +128,9 @@ dhclient - Dynamic Host Configuration Pr
+ .B -w
+ ]
+ [
++.B -nc
++]
++[
+ .B -B
+ ]
+ [
+@@ -304,6 +307,32 @@ has been added or removed, so that the c
+ address on that interface.
+
+ .TP
++.BI \-nc
++Do not drop capabilities.
++
++Normally, if
++.B dhclient
++was compiled with libcap-ng support,
++.B dhclient
++drops most capabilities immediately upon startup. While more secure,
++this greatly restricts the additional actions that hooks in
++.B dhclient-script (8)
++can take. (For example, any daemons that
++.B dhclient-script (8)
++starts or restarts will inherit the restricted capabilities as well,
++which may interfere with their correct operation.) Thus, the
++.BI \-nc
++option can be used to prevent
++.B dhclient
++from dropping capabilities.
++
++The
++.BI \-nc
++option is ignored if
++.B dhclient
++was not compiled with libcap-ng support.
++
++.TP
+ .BI \-B
+ Set the BOOTP broadcast flag in request packets so servers will always
+ broadcast replies.
+diff -up dhcp-4.3.1b1/client/dhclient.c.zzftXp dhcp-4.3.1b1/client/dhclient.c
+--- dhcp-4.3.1b1/client/dhclient.c.zzftXp 2014-07-10 17:39:25.797764653 +0200
++++ dhcp-4.3.1b1/client/dhclient.c 2014-07-10 17:39:25.853763858 +0200
+@@ -39,6 +39,10 @@
+ #include <limits.h>
+ #include <dns/result.h>
+
++#ifdef HAVE_LIBCAP_NG
++#include <cap-ng.h>
++#endif
++
+ /*
+ * Defined in stdio.h when _GNU_SOURCE is set, but we don't want to define
+ * that when building ISC code.
+@@ -143,6 +147,9 @@ main(int argc, char **argv) {
+ int timeout_arg = 0;
+ char *arg_conf = NULL;
+ int arg_conf_len = 0;
++#ifdef HAVE_LIBCAP_NG
++ int keep_capabilities = 0;
++#endif
+
+ /* Initialize client globals. */
+ memset(&default_duid, 0, sizeof(default_duid));
+@@ -425,6 +432,10 @@ main(int argc, char **argv) {
+ }
+
+ dhclient_request_options = argv[i];
++ } else if (!strcmp(argv[i], "-nc")) {
++#ifdef HAVE_LIBCAP_NG
++ keep_capabilities = 1;
++#endif
+ } else if (argv[i][0] == '-') {
+ usage();
+ } else if (interfaces_requested < 0) {
+@@ -473,6 +484,19 @@ main(int argc, char **argv) {
+ path_dhclient_script = s;
+ }
+
++#ifdef HAVE_LIBCAP_NG
++ /* Drop capabilities */
++ if (!keep_capabilities) {
++ capng_clear(CAPNG_SELECT_CAPS);
++ capng_update(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED,
++ CAP_DAC_OVERRIDE); // Drop this someday
++ capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED,
++ CAP_NET_ADMIN, CAP_NET_RAW,
++ CAP_NET_BIND_SERVICE, CAP_SYS_ADMIN, -1);
++ capng_apply(CAPNG_SELECT_CAPS);
++ }
++#endif
++
+ /* Set up the initial dhcp option universe. */
+ initialize_common_option_spaces();
+
+diff -up dhcp-4.3.1b1/client/dhclient-script.8.zzftXp dhcp-4.3.1b1/client/dhclient-script.8
+--- dhcp-4.3.1b1/client/dhclient-script.8.zzftXp 2014-07-10 17:39:25.761765163 +0200
++++ dhcp-4.3.1b1/client/dhclient-script.8 2014-07-10 17:39:25.851763887 +0200
+@@ -243,6 +243,16 @@ repeatedly initialized to the values pro
+ the other. Assuming the information provided by both servers is
+ valid, this shouldn't cause any real problems, but it could be
+ confusing.
++.PP
++Normally, if dhclient was compiled with libcap-ng support,
++dhclient drops most capabilities immediately upon startup.
++While more secure, this greatly restricts the additional actions that
++hooks in dhclient-script can take. For example, any daemons that
++dhclient-script starts or restarts will inherit the restricted
++capabilities as well, which may interfere with their correct operation.
++Thus, the
++.BI \-nc
++option can be used to prevent dhclient from dropping capabilities.
+ .SH SEE ALSO
+ dhclient(8), dhcpd(8), dhcrelay(8), dhclient.conf(5) and
+ dhclient.leases(5).
+diff -up dhcp-4.3.1b1/client/Makefile.am.zzftXp dhcp-4.3.1b1/client/Makefile.am
+--- dhcp-4.3.1b1/client/Makefile.am.zzftXp 2014-07-10 17:38:10.778828583 +0200
++++ dhcp-4.3.1b1/client/Makefile.am 2014-07-10 17:39:25.851763887 +0200
+@@ -10,7 +10,7 @@ dhclient_SOURCES = clparse.c dhclient.c
+ scripts/bsdos scripts/freebsd scripts/linux scripts/macos \
+ scripts/netbsd scripts/nextstep scripts/openbsd \
+ scripts/solaris scripts/openwrt
+-dhclient_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \
++dhclient_LDADD = ../common/libdhcp.a ../omapip/libomapi.la $(CAPNG_LDADD) \
+ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+ man_MANS = dhclient.8 dhclient-script.8 dhclient.conf.5 dhclient.leases.5
+ EXTRA_DIST = $(man_MANS)
+diff -up dhcp-4.3.1b1/configure.ac.zzftXp dhcp-4.3.1b1/configure.ac
+--- dhcp-4.3.1b1/configure.ac.zzftXp 2014-07-10 17:38:10.779828569 +0200
++++ dhcp-4.3.1b1/configure.ac 2014-07-10 17:39:25.854763844 +0200
+@@ -499,6 +499,41 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[]],
+ # Look for optional headers.
+ AC_CHECK_HEADERS(sys/socket.h net/if_dl.h net/if6.h regex.h)
+
++# look for capabilities library
++AC_ARG_WITH(libcap-ng,
++ [ --with-libcap-ng=[auto/yes/no] Add Libcap-ng support [default=auto]],,
++ with_libcap_ng=auto)
++
++# Check for Libcap-ng API
++#
++# libcap-ng detection
++if test x$with_libcap_ng = xno ; then
++ have_libcap_ng=no;
++else
++ # Start by checking for header file
++ AC_CHECK_HEADER(cap-ng.h, capng_headers=yes, capng_headers=no)
++
++ # See if we have libcap-ng library
++ AC_CHECK_LIB(cap-ng, capng_clear,
++ CAPNG_LDADD=-lcap-ng,)
++
++ # Check results are usable
++ if test x$with_libcap_ng = xyes -a x$CAPNG_LDADD = x ; then
++ AC_MSG_ERROR(libcap-ng support was requested and the library was not found)
++ fi
++ if test x$CAPNG_LDADD != x -a $capng_headers = no ; then
++ AC_MSG_ERROR(libcap-ng libraries found but headers are missing)
++ fi
++fi
++AC_SUBST(CAPNG_LDADD)
++AC_MSG_CHECKING(whether to use libcap-ng)
++if test x$CAPNG_LDADD != x ; then
++ AC_DEFINE(HAVE_LIBCAP_NG,1,[libcap-ng support])
++ AC_MSG_RESULT(yes)
++else
++ AC_MSG_RESULT(no)
++fi
++
+ # Solaris needs some libraries for functions
+ AC_SEARCH_LIBS(socket, [socket])
+ AC_SEARCH_LIBS(inet_ntoa, [nsl])
+diff -up dhcp-4.3.1b1/relay/dhcrelay.c.zzftXp dhcp-4.3.1b1/relay/dhcrelay.c
+--- dhcp-4.3.1b1/relay/dhcrelay.c.zzftXp 2014-07-10 17:39:25.799764624 +0200
++++ dhcp-4.3.1b1/relay/dhcrelay.c 2014-07-10 17:40:19.191007421 +0200
+@@ -31,6 +31,11 @@
+ #include <signal.h>
+ #include <sys/time.h>
+
++#ifdef HAVE_LIBCAP_NG
++# include <cap-ng.h>
++ int keep_capabilities = 0;
++#endif
++
+ TIME default_lease_time = 43200; /* 12 hours... */
+ TIME max_lease_time = 86400; /* 24 hours... */
+ struct tree_cache *global_options[256];
+@@ -376,6 +381,10 @@ main(int argc, char **argv) {
+ usage();
+ dhcrelay_sub_id = argv[i];
+ #endif
++ } else if (!strcmp(argv[i], "-nc")) {
++#ifdef HAVE_LIBCAP_NG
++ keep_capabilities = 1;
++#endif
+ } else if (!strcmp(argv[i], "-pf")) {
+ if (++i == argc)
+ usage();
+@@ -446,6 +455,17 @@ main(int argc, char **argv) {
+ #endif
+ }
+
++#ifdef HAVE_LIBCAP_NG
++ /* Drop capabilities */
++ if (!keep_capabilities) {
++ capng_clear(CAPNG_SELECT_BOTH);
++ capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED,
++ CAP_NET_RAW, CAP_NET_BIND_SERVICE, -1);
++ capng_apply(CAPNG_SELECT_BOTH);
++ log_info ("Dropped all unnecessary capabilities.");
++ }
++#endif
++
+ if (!quiet) {
+ log_info("%s %s", message, PACKAGE_VERSION);
+ log_info(copyright);
+@@ -598,6 +618,15 @@ main(int argc, char **argv) {
+ signal(SIGTERM, dhcp_signal_handler); /* kill */
+ #endif
+
++#ifdef HAVE_LIBCAP_NG
++ /* Drop all capabilities */
++ if (!keep_capabilities) {
++ capng_clear(CAPNG_SELECT_BOTH);
++ capng_apply(CAPNG_SELECT_BOTH);
++ log_info ("Dropped all capabilities.");
++ }
++#endif
++
+ /* Start dispatching packets and timeouts... */
+ dispatch();
+
+diff -up dhcp-4.3.1b1/relay/Makefile.am.zzftXp dhcp-4.3.1b1/relay/Makefile.am
+--- dhcp-4.3.1b1/relay/Makefile.am.zzftXp 2014-07-10 17:38:10.780828554 +0200
++++ dhcp-4.3.1b1/relay/Makefile.am 2014-07-10 17:39:25.854763844 +0200
+@@ -2,7 +2,7 @@ AM_CPPFLAGS = -DLOCALSTATEDIR='"@localst
+
+ sbin_PROGRAMS = dhcrelay
+ dhcrelay_SOURCES = dhcrelay.c
+-dhcrelay_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \
++dhcrelay_LDADD = ../common/libdhcp.a ../omapip/libomapi.la $(CAPNG_LDADD) \
+ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+ man_MANS = dhcrelay.8
+ EXTRA_DIST = $(man_MANS)
diff --git a/src/patches/dhcp/dhcp-default-requested-options.patch b/src/patches/dhcp/dhcp-default-requested-options.patch
new file mode 100644
index 0000000..afda222
--- /dev/null
+++ b/src/patches/dhcp/dhcp-default-requested-options.patch
@@ -0,0 +1,44 @@
+diff -up dhcp-4.3.0a1/client/clparse.c.requested dhcp-4.3.0a1/client/clparse.c
+--- dhcp-4.3.0a1/client/clparse.c.requested 2013-12-19 15:13:27.276631307 +0100
++++ dhcp-4.3.0a1/client/clparse.c 2013-12-19 15:13:27.313630789 +0100
+@@ -37,7 +37,7 @@
+
+ struct client_config top_level_config;
+
+-#define NUM_DEFAULT_REQUESTED_OPTS 9
++#define NUM_DEFAULT_REQUESTED_OPTS 14
+ struct option *default_requested_options[NUM_DEFAULT_REQUESTED_OPTS + 1];
+
+ static void parse_client_default_duid(struct parse *cfile);
+@@ -119,6 +119,31 @@ isc_result_t read_client_conf ()
+ option_code_hash_lookup(&default_requested_options[8],
+ dhcpv6_universe.code_hash, &code, 0, MDL);
+
++ /* 10 */
++ code = DHO_NIS_DOMAIN;
++ option_code_hash_lookup(&default_requested_options[9],
++ dhcp_universe.code_hash, &code, 0, MDL);
++
++ /* 11 */
++ code = DHO_NIS_SERVERS;
++ option_code_hash_lookup(&default_requested_options[10],
++ dhcp_universe.code_hash, &code, 0, MDL);
++
++ /* 12 */
++ code = DHO_NTP_SERVERS;
++ option_code_hash_lookup(&default_requested_options[11],
++ dhcp_universe.code_hash, &code, 0, MDL);
++
++ /* 13 */
++ code = DHO_INTERFACE_MTU;
++ option_code_hash_lookup(&default_requested_options[12],
++ dhcp_universe.code_hash, &code, 0, MDL);
++
++ /* 14 */
++ code = DHO_DOMAIN_SEARCH;
++ option_code_hash_lookup(&default_requested_options[13],
++ dhcp_universe.code_hash, &code, 0, MDL);
++
+ for (code = 0 ; code < NUM_DEFAULT_REQUESTED_OPTS ; code++) {
+ if (default_requested_options[code] == NULL)
+ log_fatal("Unable to find option definition for "
diff --git a/src/patches/dhcp/dhcp-dhclient-decline-backoff.patch b/src/patches/dhcp/dhcp-dhclient-decline-backoff.patch
new file mode 100644
index 0000000..3e52e64
--- /dev/null
+++ b/src/patches/dhcp/dhcp-dhclient-decline-backoff.patch
@@ -0,0 +1,63 @@
+diff -up dhcp-4.3.1b1/client/dhclient.c.JwFUZj dhcp-4.3.1b1/client/dhclient.c
+--- dhcp-4.3.1b1/client/dhclient.c.JwFUZj 2014-07-10 17:38:50.511265091 +0200
++++ dhcp-4.3.1b1/client/dhclient.c 2014-07-10 17:39:16.164901267 +0200
+@@ -1281,6 +1281,8 @@ void state_init (cpp)
+ void *cpp;
+ {
+ struct client_state *client = cpp;
++ enum dhcp_state init_state = client->state;
++ struct timeval tv;
+
+ ASSERT_STATE(state, S_INIT);
+
+@@ -1293,9 +1295,18 @@ void state_init (cpp)
+ client -> first_sending = cur_time;
+ client -> interval = client -> config -> initial_interval;
+
+- /* Add an immediate timeout to cause the first DHCPDISCOVER packet
+- to go out. */
+- send_discover (client);
++ if (init_state != S_DECLINED) {
++ /* Add an immediate timeout to cause the first DHCPDISCOVER packet
++ to go out. */
++ send_discover(client);
++ } else {
++ /* We've received an OFFER and it has been DECLINEd by dhclient-script.
++ * wait for a random time between 1 and backoff_cutoff seconds before
++ * trying again. */
++ tv . tv_sec = cur_time + ((1 + (random() >> 2)) % client->config->backoff_cutoff);
++ tv . tv_usec = 0;
++ add_timeout(&tv, send_discover, client, 0, 0);
++ }
+ }
+
+ /*
+@@ -1592,6 +1603,7 @@ void bind_lease (client)
+ "try (declined). Exiting.");
+ exit(2);
+ } else {
++ client -> state = S_DECLINED;
+ state_init(client);
+ return;
+ }
+@@ -4059,6 +4071,7 @@ void client_location_changed ()
+ case S_INIT:
+ case S_REBINDING:
+ case S_STOPPED:
++ case S_DECLINED:
+ break;
+ }
+ client -> state = S_INIT;
+diff -up dhcp-4.3.1b1/includes/dhcpd.h.JwFUZj dhcp-4.3.1b1/includes/dhcpd.h
+--- dhcp-4.3.1b1/includes/dhcpd.h.JwFUZj 2014-07-10 17:38:26.941599360 +0200
++++ dhcp-4.3.1b1/includes/dhcpd.h 2014-07-10 17:38:50.526264878 +0200
+@@ -1087,7 +1087,8 @@ enum dhcp_state {
+ S_BOUND = 5,
+ S_RENEWING = 6,
+ S_REBINDING = 7,
+- S_STOPPED = 8
++ S_STOPPED = 8,
++ S_DECLINED = 9
+ };
+
+ /* Authentication and BOOTP policy possibilities (not all values work
diff --git a/src/patches/dhcp/dhcp-dhclient-options.patch b/src/patches/dhcp/dhcp-dhclient-options.patch
new file mode 100644
index 0000000..67f144e
--- /dev/null
+++ b/src/patches/dhcp/dhcp-dhclient-options.patch
@@ -0,0 +1,509 @@
+diff -up dhcp-4.3.1b1/client/clparse.c.fLPqYB dhcp-4.3.1b1/client/clparse.c
+--- dhcp-4.3.1b1/client/clparse.c.fLPqYB 2014-07-02 19:58:38.000000000 +0200
++++ dhcp-4.3.1b1/client/clparse.c 2014-07-10 17:38:26.938599402 +0200
+@@ -148,6 +148,7 @@ isc_result_t read_client_conf ()
+ /* Requested lease time, used by DHCPv6 (DHCPv4 uses the option cache)
+ */
+ top_level_config.requested_lease = 7200;
++ top_level_config.bootp_broadcast_always = 0;
+
+ group_allocate (&top_level_config.on_receipt, MDL);
+ if (!top_level_config.on_receipt)
+@@ -353,7 +354,8 @@ void read_client_leases ()
+ interface-declaration |
+ LEASE client-lease-statement |
+ ALIAS client-lease-statement |
+- KEY key-definition */
++ KEY key-definition |
++ BOOTP_BROADCAST_ALWAYS */
+
+ void parse_client_statement (cfile, ip, config)
+ struct parse *cfile;
+@@ -771,6 +773,12 @@ void parse_client_statement (cfile, ip,
+ parse_reject_statement (cfile, config);
+ return;
+
++ case BOOTP_BROADCAST_ALWAYS:
++ token = next_token(&val, (unsigned*)0, cfile);
++ config -> bootp_broadcast_always = 1;
++ parse_semi (cfile);
++ return;
++
+ default:
+ lose = 0;
+ stmt = (struct executable_statement *)0;
+diff -up dhcp-4.3.1b1/client/dhclient.8.fLPqYB dhcp-4.3.1b1/client/dhclient.8
+--- dhcp-4.3.1b1/client/dhclient.8.fLPqYB 2014-07-02 19:58:38.000000000 +0200
++++ dhcp-4.3.1b1/client/dhclient.8 2014-07-10 17:38:26.938599402 +0200
+@@ -128,6 +128,33 @@ dhclient - Dynamic Host Configuration Pr
+ .B -w
+ ]
+ [
++.B -B
++]
++[
++.B -C
++.I dhcp-client-identifier
++]
++[
++.B -H
++.I host-name
++]
++[
++.B -F
++.I fqdn.fqdn
++]
++[
++.B -V
++.I vendor-class-identifier
++]
++[
++.B -R
++.I request-option-list
++]
++[
++.B -timeout
++.I timeout
++]
++[
+ .B -v
+ ]
+ [
+@@ -275,6 +302,69 @@ not to exit when it doesn't find any suc
+ program can then be used to notify the client when a network interface
+ has been added or removed, so that the client can attempt to configure an IP
+ address on that interface.
++
++.TP
++.BI \-B
++Set the BOOTP broadcast flag in request packets so servers will always
++broadcast replies.
++
++.TP
++.BI \-C\ <dhcp-client-identifier>
++Specify the dhcp-client-identifier option to send to the DHCP server.
++
++.TP
++.BI \-H\ <host-name>
++Specify the host-name option to send to the DHCP server. The host-name
++string only contains the client's hostname prefix, to which the server will
++append the ddns-domainname or domain-name options, if any, to derive the
++fully qualified domain name of the client. The
++.B -H
++option cannot be used with the
++.B -F
++option.
++
++.TP
++.BI \-F\ <fqdn.fqdn>
++Specify the fqdn.fqdn option to send to the DHCP server. This option cannot
++be used with the
++.B -H
++option. The fqdn.fqdn option must specify the complete domain name of the
++client host, which the server may use for dynamic DNS updates.
++
++.TP
++.BI \-V\ <vendor-class-identifier>
++Specify the vendor-class-identifier option to send to the DHCP server.
++
++.TP
++.BI \-R\ <option>[,<option>...]
++Specify the list of options the client is to request from the server. The
++option list must be a single string consisting of option names separated
++by at least one command and optional space characters. The default option
++list is:
++
++.BR
++ subnet-mask, broadcast-address, time-offset, routers,
++.BR
++ domain-search, domain-name, domain-name-servers, host-name,
++.BR
++ nis-domain, nis-servers, ntp-servers, interface-mtu
++
++.TP
++.B -R
++option does not append options to the default request, it overrides the
++default request list. Keep this in mind if you want to request an
++additional option besides the default request list. You will have to
++specify all option names for the
++.B -R
++parameter.
++
++.TP
++.BI \-timeout\ <timeout>
++Specify the time after which
++.B dhclient
++will decide that no DHCP servers can be contacted when no responses have been
++received.
++
+ .TP
+ .BI \-n
+ Do not configure any interfaces. This is most likely to be useful in
+diff -up dhcp-4.3.1b1/client/dhclient.c.fLPqYB dhcp-4.3.1b1/client/dhclient.c
+--- dhcp-4.3.1b1/client/dhclient.c.fLPqYB 2014-07-02 19:58:38.000000000 +0200
++++ dhcp-4.3.1b1/client/dhclient.c 2014-07-10 17:38:44.520350055 +0200
+@@ -39,6 +39,12 @@
+ #include <limits.h>
+ #include <dns/result.h>
+
++/*
++ * Defined in stdio.h when _GNU_SOURCE is set, but we don't want to define
++ * that when building ISC code.
++ */
++extern int asprintf(char **strp, const char *fmt, ...);
++
+ TIME default_lease_time = 43200; /* 12 hours... */
+ TIME max_lease_time = 86400; /* 24 hours... */
+
+@@ -88,6 +94,9 @@ int wanted_ia_na = -1; /* the absolute
+ int wanted_ia_ta = 0;
+ int wanted_ia_pd = 0;
+ char *mockup_relay = NULL;
++int bootp_broadcast_always = 0;
++
++extern struct option *default_requested_options[];
+
+ void run_stateless(int exit_mode);
+
+@@ -125,6 +134,15 @@ main(int argc, char **argv) {
+ int local_family_set = 0;
+ #endif /* DHCPv6 */
+ char *s;
++ char *dhcp_client_identifier_arg = NULL;
++ char *dhcp_host_name_arg = NULL;
++ char *dhcp_fqdn_arg = NULL;
++ char *dhcp_vendor_class_identifier_arg = NULL;
++ char *dhclient_request_options = NULL;
++
++ int timeout_arg = 0;
++ char *arg_conf = NULL;
++ int arg_conf_len = 0;
+
+ /* Initialize client globals. */
+ memset(&default_duid, 0, sizeof(default_duid));
+@@ -325,6 +343,88 @@ main(int argc, char **argv) {
+ strlen(PACKAGE_VERSION)));
+ IGNORE_RET(write(STDERR_FILENO, "\n", 1));
+ exit(0);
++ } else if (!strcmp(argv[i], "-C")) {
++ if ((++i == argc) || (argv[i] == NULL) || (*(argv[i])=='\0')) {
++ usage();
++ exit(1);
++ }
++
++ if (strlen(argv[i]) >= DHCP_MAX_OPTION_LEN) {
++ log_error("-C option dhcp-client-identifier string \"%s\" is too long - maximum length is: %d", argv[i], DHCP_MAX_OPTION_LEN-1);
++ exit(1);
++ }
++
++ dhcp_client_identifier_arg = argv[i];
++ } else if (!strcmp(argv[i], "-B")) {
++ bootp_broadcast_always = 1;
++ } else if (!strcmp(argv[i], "-H")) {
++ if ((++i == argc) || (argv[i] == NULL) || (*(argv[i])=='\0')) {
++ usage();
++ exit(1);
++ }
++
++ if (strlen(argv[i]) >= DHCP_MAX_OPTION_LEN) {
++ log_error("-H option host-name string \"%s\" is too long - maximum length is: %d", argv[i], DHCP_MAX_OPTION_LEN-1);
++ exit(1);
++ }
++
++ if (dhcp_host_name_arg != NULL) {
++ log_error("The -H <host-name> and -F <fqdn> arguments are mutually exclusive");
++ exit(1);
++ }
++
++ dhcp_host_name_arg = argv[i];
++ } else if (!strcmp(argv[i], "-F")) {
++ if ((++i == argc) || (argv[i] == NULL) || (*(argv[i])=='\0')) {
++ usage();
++ exit(1);
++ }
++
++ if (strlen(argv[i]) >= DHCP_MAX_OPTION_LEN) {
++ log_error("-F option fqdn.fqdn string \"%s\" is too long - maximum length is: %d", argv[i], DHCP_MAX_OPTION_LEN-1);
++ exit(1);
++ }
++
++ if (dhcp_fqdn_arg != NULL) {
++ log_error("Only one -F <fqdn> argument can be specified");
++ exit(1);
++ }
++
++ if (dhcp_host_name_arg != NULL) {
++ log_error("The -F <fqdn> and -H <host-name> arguments are mutually exclusive");
++ exit(1);
++ }
++
++ dhcp_fqdn_arg = argv[i];
++ } else if (!strcmp(argv[i], "-timeout")) {
++ if ((++i == argc) || (argv[i] == NULL) || (*(argv[i])=='\0')) {
++ usage();
++ exit(1);
++ }
++
++ if ((timeout_arg = atoi(argv[i])) <= 0) {
++ log_error("timeout option must be > 0 - bad value: %s",argv[i]);
++ exit(1);
++ }
++ } else if (!strcmp(argv[i], "-V")) {
++ if ((++i == argc) || (argv[i] == NULL) || (*(argv[i])=='\0')) {
++ usage();
++ exit(1);
++ }
++
++ if (strlen(argv[i]) >= DHCP_MAX_OPTION_LEN) {
++ log_error("-V option vendor-class-identifier string \"%s\" is too long - maximum length is: %d", argv[i], DHCP_MAX_OPTION_LEN-1);
++ exit(1);
++ }
++
++ dhcp_vendor_class_identifier_arg = argv[i];
++ } else if (!strcmp(argv[i], "-R")) {
++ if ((++i == argc) || (argv[i] == NULL) || (*(argv[i])=='\0')) {
++ usage();
++ exit(1);
++ }
++
++ dhclient_request_options = argv[i];
+ } else if (argv[i][0] == '-') {
+ usage();
+ } else if (interfaces_requested < 0) {
+@@ -507,6 +607,156 @@ main(int argc, char **argv) {
+ /* Parse the dhclient.conf file. */
+ read_client_conf();
+
++ /* Parse any extra command line configuration arguments: */
++ if ((dhcp_client_identifier_arg != NULL) && (*dhcp_client_identifier_arg != '\0')) {
++ arg_conf_len = asprintf(&arg_conf, "send dhcp-client-identifier \"%s\";", dhcp_client_identifier_arg);
++
++ if ((arg_conf == 0) || (arg_conf_len <= 0))
++ log_fatal("Unable to send -C option dhcp-client-identifier");
++ }
++
++ if ((dhcp_host_name_arg != NULL) && (*dhcp_host_name_arg != '\0')) {
++ if (arg_conf == 0) {
++ arg_conf_len = asprintf(&arg_conf, "send host-name \"%s\";", dhcp_host_name_arg);
++
++ if ((arg_conf == 0) || (arg_conf_len <= 0))
++ log_fatal("Unable to send -H option host-name");
++ } else {
++ char *last_arg_conf = arg_conf;
++ arg_conf = NULL;
++ arg_conf_len = asprintf(&arg_conf, "%s\nsend host-name \"%s\";", last_arg_conf, dhcp_host_name_arg);
++
++ if ((arg_conf == 0) || (arg_conf_len <= 0))
++ log_fatal("Unable to send -H option host-name");
++
++ free(last_arg_conf);
++ }
++ }
++
++ if ((dhcp_fqdn_arg != NULL) && (*dhcp_fqdn_arg != '\0')) {
++ if (arg_conf == 0) {
++ arg_conf_len = asprintf(&arg_conf, "send fqdn.fqdn \"%s\";", dhcp_fqdn_arg);
++
++ if ((arg_conf == 0) || (arg_conf_len <= 0))
++ log_fatal("Unable to send -F option fqdn.fqdn");
++ } else {
++ char *last_arg_conf = arg_conf;
++ arg_conf = NULL;
++ arg_conf_len = asprintf(&arg_conf, "%s\nsend fqdn.fqdn \"%s\";", last_arg_conf, dhcp_fqdn_arg);
++
++ if ((arg_conf == 0) || (arg_conf_len <= 0))
++ log_fatal("Unable to send -F option fqdn.fqdn");
++
++ free(last_arg_conf);
++ }
++ }
++
++ if (timeout_arg) {
++ if (arg_conf == 0) {
++ arg_conf_len = asprintf(&arg_conf, "timeout %d;", timeout_arg);
++
++ if ((arg_conf == 0) || (arg_conf_len <= 0))
++ log_fatal("Unable to process -timeout timeout argument");
++ } else {
++ char *last_arg_conf = arg_conf;
++ arg_conf = NULL;
++ arg_conf_len = asprintf(&arg_conf, "%s\ntimeout %d;", last_arg_conf, timeout_arg);
++
++ if ((arg_conf == 0) || (arg_conf_len == 0))
++ log_fatal("Unable to process -timeout timeout argument");
++
++ free(last_arg_conf);
++ }
++ }
++
++ if ((dhcp_vendor_class_identifier_arg != NULL) && (*dhcp_vendor_class_identifier_arg != '\0')) {
++ if (arg_conf == 0) {
++ arg_conf_len = asprintf(&arg_conf, "send vendor-class-identifier \"%s\";", dhcp_vendor_class_identifier_arg);
++
++ if ((arg_conf == 0) || (arg_conf_len <= 0))
++ log_fatal("Unable to send -V option vendor-class-identifier");
++ } else {
++ char *last_arg_conf = arg_conf;
++ arg_conf = NULL;
++ arg_conf_len = asprintf(&arg_conf, "%s\nsend vendor-class-identifier \"%s\";", last_arg_conf, dhcp_vendor_class_identifier_arg);
++
++ if ((arg_conf == 0) || (arg_conf_len <= 0))
++ log_fatal("Unable to send -V option vendor-class-identifier");
++
++ free(last_arg_conf);
++ }
++ }
++
++ if (dhclient_request_options != NULL) {
++ if (arg_conf == 0) {
++ arg_conf_len = asprintf(&arg_conf, "request %s;", dhclient_request_options);
++
++ if ((arg_conf == 0) || (arg_conf_len <= 0))
++ log_fatal("Unable to parse -R <request options list> argument");
++ } else {
++ char *last_arg_conf = arg_conf;
++ arg_conf = NULL;
++ arg_conf_len = asprintf(&arg_conf, "%s\nrequest %s;", last_arg_conf, dhclient_request_options);
++
++ if ((arg_conf == 0) || (arg_conf_len <= 0))
++ log_fatal("Unable to parse -R <request options list> argument");
++
++ free(last_arg_conf);
++ }
++ }
++
++ if (arg_conf) {
++ if (arg_conf_len == 0)
++ if ((arg_conf_len = strlen(arg_conf)) == 0)
++ /* huh ? cannot happen ! */
++ log_fatal("Unable to process -C/-H/-F/-timeout/-V/-R configuration arguments");
++
++ /* parse the extra dhclient.conf configuration arguments
++ * into top level config: */
++ struct parse *cfile = (struct parse *)0;
++ const char *val = NULL;
++ int token;
++
++ status = new_parse(&cfile, -1, arg_conf, arg_conf_len, "extra dhclient -C/-H/-F/-timeout/-V/-R configuration arguments", 0);
++
++ if ((status != ISC_R_SUCCESS) || (cfile -> warnings_occurred))
++ log_fatal("Cannot parse -C/-H/-F/-timeout/-V/-R configuration arguments !");
++ /* more detailed parse failures will be logged */
++
++ do {
++ token = peek_token(&val, (unsigned *)0, cfile);
++ if (token == END_OF_FILE)
++ break;
++
++ parse_client_statement(cfile, (struct interface_info *)0, &top_level_config);
++ } while (1);
++
++ if (cfile -> warnings_occurred)
++ log_fatal("Cannot parse -C/-H/-F/-timeout/-V/-R configuration arguments !");
++ end_parse(&cfile);
++
++ if (timeout_arg) {
++ /* we just set the toplevel timeout, but per-client
++ * timeouts may still be at defaults.
++ */
++ for (ip=interfaces; ip; ip = ip->next) {
++ if (ip->client->config->timeout == 60)
++ ip->client->config->timeout = timeout_arg;
++ }
++ }
++
++ if ((dhclient_request_options != 0) && (top_level_config.requested_options != default_requested_options)) {
++ for (ip=interfaces; ip; ip = ip->next) {
++ if (ip->client->config->requested_options == default_requested_options)
++ ip->client->config->requested_options = top_level_config.requested_options;
++ }
++ }
++
++ free(arg_conf);
++ arg_conf = NULL;
++ arg_conf_len = 0;
++ }
++
+ /* Parse the lease database. */
+ read_client_leases();
+
+@@ -756,6 +1006,10 @@ static void usage()
+ " [-s server-addr] [-cf config-file]\n"
+ " [-df duid-file] [-lf lease-file]\n"
+ " [-pf pid-file] [--no-pid] [-e VAR=val]\n"
++ " [-C <dhcp-client-identifier>] [-B]\n"
++ " [-H <host-name> | -F <fqdn.fqdn>] [-timeout <timeout>]\n"
++ " [-V <vendor-class-identifier>]\n"
++ " [-R <request option list>]\n"
+ " [-sf script-file] [interface]");
+ }
+
+@@ -2531,7 +2785,8 @@ void make_discover (client, lease)
+ client -> packet.xid = random ();
+ client -> packet.secs = 0; /* filled in by send_discover. */
+
+- if (can_receive_unicast_unconfigured (client -> interface))
++ if ((!(bootp_broadcast_always || client->config->bootp_broadcast_always))
++ && can_receive_unicast_unconfigured(client->interface))
+ client -> packet.flags = 0;
+ else
+ client -> packet.flags = htons (BOOTP_BROADCAST);
+@@ -2615,7 +2870,9 @@ void make_request (client, lease)
+ } else {
+ memset (&client -> packet.ciaddr, 0,
+ sizeof client -> packet.ciaddr);
+- if (can_receive_unicast_unconfigured (client -> interface))
++ if ((!(bootp_broadcast_always ||
++ client ->config->bootp_broadcast_always)) &&
++ can_receive_unicast_unconfigured (client -> interface))
+ client -> packet.flags = 0;
+ else
+ client -> packet.flags = htons (BOOTP_BROADCAST);
+@@ -2677,7 +2934,8 @@ void make_decline (client, lease)
+ client -> packet.hops = 0;
+ client -> packet.xid = client -> xid;
+ client -> packet.secs = 0; /* Filled in by send_request. */
+- if (can_receive_unicast_unconfigured (client -> interface))
++ if ((!(bootp_broadcast_always || client->config-> bootp_broadcast_always))
++ && can_receive_unicast_unconfigured (client->interface))
+ client -> packet.flags = 0;
+ else
+ client -> packet.flags = htons (BOOTP_BROADCAST);
+diff -up dhcp-4.3.1b1/common/conflex.c.fLPqYB dhcp-4.3.1b1/common/conflex.c
+--- dhcp-4.3.1b1/common/conflex.c.fLPqYB 2014-07-02 19:58:38.000000000 +0200
++++ dhcp-4.3.1b1/common/conflex.c 2014-07-10 17:38:26.940599374 +0200
+@@ -811,6 +811,8 @@ intern(char *atom, enum dhcp_token dfv)
+ return BALANCE;
+ if (!strcasecmp (atom + 1, "ound"))
+ return BOUND;
++ if (!strcasecmp (atom + 1, "ootp-broadcast-always"))
++ return BOOTP_BROADCAST_ALWAYS;
+ break;
+ case 'c':
+ if (!strcasecmp(atom + 1, "ase"))
+diff -up dhcp-4.3.1b1/includes/dhcpd.h.fLPqYB dhcp-4.3.1b1/includes/dhcpd.h
+--- dhcp-4.3.1b1/includes/dhcpd.h.fLPqYB 2014-07-02 19:58:39.000000000 +0200
++++ dhcp-4.3.1b1/includes/dhcpd.h 2014-07-10 17:38:26.941599360 +0200
+@@ -1152,6 +1152,9 @@ struct client_config {
+ int do_forward_update; /* If nonzero, and if we have the
+ information we need, update the
+ A record for the address we get. */
++
++ int bootp_broadcast_always; /* If nonzero, always set the BOOTP_BROADCAST
++ flag in requests */
+ };
+
+ /* Per-interface state used in the dhcp client... */
+diff -up dhcp-4.3.1b1/includes/dhctoken.h.fLPqYB dhcp-4.3.1b1/includes/dhctoken.h
+--- dhcp-4.3.1b1/includes/dhctoken.h.fLPqYB 2014-07-02 19:58:39.000000000 +0200
++++ dhcp-4.3.1b1/includes/dhctoken.h 2014-07-10 17:38:26.942599346 +0200
+@@ -367,7 +367,8 @@ enum dhcp_token {
+ TOKEN_INFINIBAND = 668,
+ POOL6 = 669,
+ V6RELAY = 670,
+- V6RELOPT = 671
++ V6RELOPT = 671,
++ BOOTP_BROADCAST_ALWAYS = 672
+ };
+
+ #define is_identifier(x) ((x) >= FIRST_TOKEN && \
diff --git a/src/patches/dhcp/dhcp-errwarn-message.patch b/src/patches/dhcp/dhcp-errwarn-message.patch
new file mode 100644
index 0000000..a65c2c2
--- /dev/null
+++ b/src/patches/dhcp/dhcp-errwarn-message.patch
@@ -0,0 +1,22 @@
+diff -up dhcp-4.3.0b1/omapip/errwarn.c.errwarn dhcp-4.3.0b1/omapip/errwarn.c
+--- dhcp-4.3.0b1/omapip/errwarn.c.errwarn 2014-01-21 09:31:47.301334249 +0100
++++ dhcp-4.3.0b1/omapip/errwarn.c 2014-01-21 09:33:20.569039072 +0100
+@@ -76,11 +76,13 @@ void log_fatal (const char * fmt, ... )
+ }
+
+ log_error ("%s", "");
+- log_error ("If you think you have received this message due to a bug rather");
+- log_error ("than a configuration issue please read the section on submitting");
+- log_error ("bugs on either our web page at www.isc.org or in the README file");
+- log_error ("before submitting a bug. These pages explain the proper");
+- log_error ("process and the information we find helpful for debugging..");
++ log_error ("This version of ISC DHCP is based on the release available");
++ log_error ("on ftp.isc.org. Features have been added and other changes");
++ log_error ("have been made to the base software release in order to make");
++ log_error ("it work better with this distribution.");
++ log_error ("%s", "");
++ log_error ("Please report for this software via the Red Hat Bugzilla site:");
++ log_error (" http://bugzilla.redhat.com");
+ log_error ("%s", "");
+ log_error ("exiting.");
+
diff --git a/src/patches/dhcp/dhcp-garbage-chars.patch b/src/patches/dhcp/dhcp-garbage-chars.patch
new file mode 100644
index 0000000..131360b
--- /dev/null
+++ b/src/patches/dhcp/dhcp-garbage-chars.patch
@@ -0,0 +1,12 @@
+diff -up dhcp-4.3.0rc1/common/tables.c.garbage dhcp-4.3.0rc1/common/tables.c
+--- dhcp-4.3.0rc1/common/tables.c.garbage 2014-01-29 10:03:52.132624677 +0100
++++ dhcp-4.3.0rc1/common/tables.c 2014-01-29 10:04:51.413875343 +0100
+@@ -213,7 +213,7 @@ static struct option dhcp_options[] = {
+ { "name-service-search", "Sa", &dhcp_universe, 117, 1 },
+ #endif
+ { "subnet-selection", "I", &dhcp_universe, 118, 1 },
+- { "domain-search", "Dc", &dhcp_universe, 119, 1 },
++ { "domain-search", "D", &dhcp_universe, 119, 1 },
+ { "vivco", "Evendor-class.", &dhcp_universe, 124, 1 },
+ { "vivso", "Evendor.", &dhcp_universe, 125, 1 },
+ #if 0
diff --git a/src/patches/dhcp/dhcp-gpxe-cid.patch b/src/patches/dhcp/dhcp-gpxe-cid.patch
new file mode 100644
index 0000000..c8c2b84
--- /dev/null
+++ b/src/patches/dhcp/dhcp-gpxe-cid.patch
@@ -0,0 +1,73 @@
+diff -up dhcp-4.3.0a1/client/dhclient.c.gpxe-cid dhcp-4.3.0a1/client/dhclient.c
+--- dhcp-4.3.0a1/client/dhclient.c.gpxe-cid 2013-12-20 13:28:45.105048317 +0100
++++ dhcp-4.3.0a1/client/dhclient.c 2013-12-20 13:28:45.109048261 +0100
+@@ -47,6 +47,14 @@
+ const char *path_dhclient_pid = NULL;
+ static char path_dhclient_script_array[] = _PATH_DHCLIENT_SCRIPT;
+ char *path_dhclient_script = path_dhclient_script_array;
++
++/* Default Prefix */
++static unsigned char default_prefix[12] = {
++ 0xff, 0x00, 0x00, 0x00,
++ 0x00, 0x00, 0x02, 0x00,
++ 0x00, 0x02, 0xc9, 0x00
++};
++
+ const char *path_dhclient_duid = NULL;
+
+ /* False (default) => we write and use a pid file */
+@@ -1253,6 +1260,12 @@ int find_subnet (struct subnet **sp,
+ static void setup_ib_interface(struct interface_info *ip)
+ {
+ struct group *g;
++ struct hardware *hw = &ip->hw_address;
++ char client_id[64];
++ char *arg_conf = NULL;
++ int arg_conf_len = 0;
++ isc_result_t status;
++ struct parse *cfile = (struct parse *)0;
+
+ /* Set the broadcast flag */
+ ip->client->config->bootp_broadcast_always = 1;
+@@ -1269,8 +1282,39 @@ static void setup_ib_interface(struct in
+ }
+ }
+
+- /* No client ID specified */
+- log_fatal("dhcp-client-identifier must be specified for InfiniBand");
++ /*
++ * No client ID specified, make up one based on a default
++ * "prefix" and the port GUID.
++ *
++ * NOTE: This is compatible with what gpxe does.
++ */
++ sprintf(client_id, "%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x:%.2x",
++ default_prefix[0], default_prefix[1], default_prefix[2],
++ default_prefix[3], default_prefix[4], default_prefix[5],
++ default_prefix[6], default_prefix[7], default_prefix[8],
++ default_prefix[9], default_prefix[10], default_prefix[11],
++ hw->hbuf[1], hw->hbuf[2], hw->hbuf[3], hw->hbuf[4],
++ hw->hbuf[5], hw->hbuf[6], hw->hbuf[7], hw->hbuf[8]);
++
++ arg_conf_len = asprintf(&arg_conf,
++ "send dhcp-client-identifier %s;",
++ client_id);
++
++ if ((arg_conf == 0) || (arg_conf_len <= 0))
++ log_fatal("Unable to send option dhcp-client-identifier");
++
++ status = new_parse(&cfile, -1, arg_conf, arg_conf_len,
++ "Automatic Infiniband client identifier", 0);
++
++ if ((status != ISC_R_SUCCESS) || (cfile->warnings_occurred))
++ log_fatal("Failed to parse Infiniband client identifier");
++
++ parse_client_statement(cfile, NULL, ip->client->config);
++
++ if (cfile->warnings_occurred)
++ log_fatal("Failed to parse Infiniband client identifier");
++
++ end_parse(&cfile);
+ }
+
+ /* Individual States:
diff --git a/src/patches/dhcp/dhcp-honor-expired.patch b/src/patches/dhcp/dhcp-honor-expired.patch
new file mode 100644
index 0000000..bd89297
--- /dev/null
+++ b/src/patches/dhcp/dhcp-honor-expired.patch
@@ -0,0 +1,49 @@
+diff -up dhcp-4.3.0a1/client/dhc6.c.honor-expired dhcp-4.3.0a1/client/dhc6.c
+--- dhcp-4.3.0a1/client/dhc6.c.honor-expired 2013-12-19 16:00:28.062183037 +0100
++++ dhcp-4.3.0a1/client/dhc6.c 2013-12-19 16:00:28.076182842 +0100
+@@ -1351,6 +1351,32 @@ start_info_request6(struct client_state
+ go_daemon();
+ }
+
++/* Run through the addresses in lease and return true if there's any unexpired.
++ * Return false otherwise.
++ */
++isc_boolean_t
++unexpired_address_in_lease(struct dhc6_lease *lease)
++{
++ struct dhc6_ia *ia;
++ struct dhc6_addr *addr;
++
++ for (ia = lease->bindings ; ia != NULL ; ia = ia->next) {
++ for (addr = ia->addrs ; addr != NULL ; addr = addr->next) {
++ if (addr->flags & DHC6_ADDR_EXPIRED)
++ continue;
++
++ if (addr->starts + addr->max_life > cur_time) {
++ return ISC_TRUE;
++ }
++ }
++ }
++
++ log_info("PRC: Previous lease is devoid of active addresses."
++ " Re-initializing.");
++
++ return ISC_FALSE;
++}
++
+ /*
+ * start_confirm6() kicks off an "init-reboot" version of the process, at
+ * startup to find out if old bindings are 'fair' and at runtime whenever
+@@ -1363,8 +1389,10 @@ start_confirm6(struct client_state *clie
+
+ /* If there is no active lease, there is nothing to check. */
+ if ((client->active_lease == NULL) ||
+- !active_prefix(client) ||
+- client->active_lease->released) {
++ !active_prefix(client) ||
++ client->active_lease->released ||
++ !unexpired_address_in_lease(client->active_lease)) {
++ dhc6_lease_destroy(&client->active_lease, MDL);
+ start_init6(client);
+ return;
+ }
diff --git a/src/patches/dhcp/dhcp-improved-xid.patch b/src/patches/dhcp/dhcp-improved-xid.patch
new file mode 100644
index 0000000..eccff49
--- /dev/null
+++ b/src/patches/dhcp/dhcp-improved-xid.patch
@@ -0,0 +1,138 @@
+diff -up dhcp-4.3.0a1/client/dhclient.c.improved-xid dhcp-4.3.0a1/client/dhclient.c
+--- dhcp-4.3.0a1/client/dhclient.c.improved-xid 2013-12-20 13:29:41.836260810 +0100
++++ dhcp-4.3.0a1/client/dhclient.c 2013-12-20 13:29:41.843260713 +0100
+@@ -894,6 +894,26 @@ main(int argc, char **argv) {
+ }
+ }
+
++ /* We create a backup seed before rediscovering interfaces in order to
++ have a seed built using all of the available interfaces
++ It's interesting if required interfaces doesn't let us defined
++ a really unique seed due to a lack of valid HW addr later
++ (this is the case with DHCP over IB)
++ We only use the last device as using a sum could broke the
++ uniqueness of the seed among multiple nodes
++ */
++ unsigned backup_seed = 0;
++ for (ip = interfaces; ip; ip = ip -> next) {
++ int junk;
++ if ( ip -> hw_address.hlen <= sizeof seed )
++ continue;
++ memcpy (&junk,
++ &ip -> hw_address.hbuf [ip -> hw_address.hlen -
++ sizeof seed], sizeof seed);
++ backup_seed = junk;
++ }
++
++
+ /* At this point, all the interfaces that the script thinks
+ are relevant should be running, so now we once again call
+ discover_interfaces(), and this time ask it to actually set
+@@ -908,14 +928,36 @@ main(int argc, char **argv) {
+ Not much entropy, but we're booting, so we're not likely to
+ find anything better. */
+ seed = 0;
++ int seed_flag = 0;
+ for (ip = interfaces; ip; ip = ip->next) {
+ int junk;
++ if ( ip -> hw_address.hlen <= sizeof seed )
++ continue;
+ memcpy(&junk,
+ &ip->hw_address.hbuf[ip->hw_address.hlen -
+ sizeof seed], sizeof seed);
+ seed += junk;
++ seed_flag = 1;
+ }
+- srandom(seed + cur_time + (unsigned)getpid());
++ if ( seed_flag == 0 ) {
++ if ( backup_seed != 0 ) {
++ seed = backup_seed;
++ log_info ("xid: rand init seed (0x%x) built using all"
++ " available interfaces",seed);
++ }
++ else {
++ seed = cur_time^((unsigned) gethostid()) ;
++ log_info ("xid: warning: no netdev with useable HWADDR found"
++ " for seed's uniqueness enforcement");
++ log_info ("xid: rand init seed (0x%x) built using gethostid",
++ seed);
++ }
++ /* we only use seed and no current time as a broadcast reply */
++ /* will certainly be used by the hwaddrless interface */
++ srandom(seed);
++ }
++ else
++ srandom(seed + cur_time + (unsigned)getpid());
+
+ /* Setup specific Infiniband options */
+ for (ip = interfaces; ip; ip = ip->next) {
+@@ -1460,7 +1502,7 @@ void dhcpack (packet)
+ return;
+ }
+
+- log_info ("DHCPACK from %s", piaddr (packet -> client_addr));
++ log_info ("DHCPACK from %s (xid=0x%x)", piaddr (packet -> client_addr), client -> xid);
+
+ lease = packet_to_lease (packet, client);
+ if (!lease) {
+@@ -2171,7 +2213,7 @@ void dhcpnak (packet)
+ return;
+ }
+
+- log_info ("DHCPNAK from %s", piaddr (packet -> client_addr));
++ log_info ("DHCPNAK from %s (xid=0x%x)", piaddr (packet -> client_addr), client -> xid);
+
+ if (!client -> active) {
+ #if defined (DEBUG)
+@@ -2298,10 +2340,10 @@ void send_discover (cpp)
+ client -> packet.secs = htons (65535);
+ client -> secs = client -> packet.secs;
+
+- log_info ("DHCPDISCOVER on %s to %s port %d interval %ld",
++ log_info ("DHCPDISCOVER on %s to %s port %d interval %ld (xid=0x%x)",
+ client -> name ? client -> name : client -> interface -> name,
+ inet_ntoa (sockaddr_broadcast.sin_addr),
+- ntohs (sockaddr_broadcast.sin_port), (long)(client -> interval));
++ ntohs (sockaddr_broadcast.sin_port), (long)(client -> interval), client -> xid);
+
+ /* Send out a packet. */
+ result = send_packet(client->interface, NULL, &client->packet,
+@@ -2570,10 +2612,10 @@ void send_request (cpp)
+ client -> packet.secs = htons (65535);
+ }
+
+- log_info ("DHCPREQUEST on %s to %s port %d",
++ log_info ("DHCPREQUEST on %s to %s port %d (xid=0x%x)",
+ client -> name ? client -> name : client -> interface -> name,
+ inet_ntoa (destination.sin_addr),
+- ntohs (destination.sin_port));
++ ntohs (destination.sin_port), client -> xid);
+
+ if (destination.sin_addr.s_addr != INADDR_BROADCAST &&
+ fallback_interface) {
+@@ -2613,10 +2655,10 @@ void send_decline (cpp)
+
+ int result;
+
+- log_info ("DHCPDECLINE on %s to %s port %d",
++ log_info ("DHCPDECLINE on %s to %s port %d (xid=0x%x)",
+ client->name ? client->name : client->interface->name,
+ inet_ntoa(sockaddr_broadcast.sin_addr),
+- ntohs(sockaddr_broadcast.sin_port));
++ ntohs(sockaddr_broadcast.sin_port), client -> xid);
+
+ /* Send out a packet. */
+ result = send_packet(client->interface, NULL, &client->packet,
+@@ -2659,10 +2701,10 @@ void send_release (cpp)
+ return;
+ }
+
+- log_info ("DHCPRELEASE on %s to %s port %d",
++ log_info ("DHCPRELEASE on %s to %s port %d (xid=0x%x)",
+ client -> name ? client -> name : client -> interface -> name,
+ inet_ntoa (destination.sin_addr),
+- ntohs (destination.sin_port));
++ ntohs (destination.sin_port), client -> xid);
+
+ if (fallback_interface) {
+ result = send_packet(fallback_interface, NULL, &client->packet,
diff --git a/src/patches/dhcp/dhcp-logpid.patch b/src/patches/dhcp/dhcp-logpid.patch
new file mode 100644
index 0000000..e1a6ebd
--- /dev/null
+++ b/src/patches/dhcp/dhcp-logpid.patch
@@ -0,0 +1,11 @@
+--- expanded_org/client/dhclient.c Wed Aug 06 23:35:00 2014
++++ expanded_logpid/client/dhclient.c Mon Feb 16 13:35:31 2015
+@@ -142,7 +142,7 @@
+ else if (fd != -1)
+ close(fd);
+
+- openlog("dhclient", DHCP_LOG_OPTIONS, LOG_DAEMON);
++ openlog("dhclient", LOG_NDELAY | LOG_PID, LOG_DAEMON);
+
+ #if !(defined(DEBUG) || defined(__CYGWIN32__))
+ setlogmask(LOG_UPTO(LOG_INFO));
diff --git a/src/patches/dhcp/dhcp-lpf-ib.patch b/src/patches/dhcp/dhcp-lpf-ib.patch
new file mode 100644
index 0000000..8e094d6
--- /dev/null
+++ b/src/patches/dhcp/dhcp-lpf-ib.patch
@@ -0,0 +1,585 @@
+diff -up dhcp-4.3.1b1/client/dhclient.c.bmgpWV dhcp-4.3.1b1/client/dhclient.c
+--- dhcp-4.3.1b1/client/dhclient.c.bmgpWV 2014-07-10 17:50:26.922402550 +0200
++++ dhcp-4.3.1b1/client/dhclient.c 2014-07-10 17:53:43.629623477 +0200
+@@ -114,6 +114,8 @@ static int check_domain_name_list(const
+ static int check_option_values(struct universe *universe, unsigned int opt,
+ const char *ptr, size_t len);
+
++static void setup_ib_interface(struct interface_info *ip);
++
+ #ifndef UNIT_TEST
+ int
+ main(int argc, char **argv) {
+@@ -937,6 +939,13 @@ main(int argc, char **argv) {
+ }
+ srandom(seed + cur_time + (unsigned)getpid());
+
++ /* Setup specific Infiniband options */
++ for (ip = interfaces; ip; ip = ip->next) {
++ if (ip->client &&
++ (ip->hw_address.hbuf[0] == HTYPE_INFINIBAND)) {
++ setup_ib_interface(ip);
++ }
++ }
+
+ /*
+ * Establish a default DUID. We always do so for v6 and
+@@ -1230,6 +1239,29 @@ int find_subnet (struct subnet **sp,
+ return 0;
+ }
+
++static void setup_ib_interface(struct interface_info *ip)
++{
++ struct group *g;
++
++ /* Set the broadcast flag */
++ ip->client->config->bootp_broadcast_always = 1;
++
++ /*
++ * Find out if a dhcp-client-identifier option was specified either
++ * in the config file or on the command line
++ */
++ for (g = ip->client->config->on_transmission; g != NULL; g = g->next) {
++ if ((g->statements != NULL) &&
++ (strcmp(g->statements->data.option->option->name,
++ "dhcp-client-identifier") == 0)) {
++ return;
++ }
++ }
++
++ /* No client ID specified */
++ log_fatal("dhcp-client-identifier must be specified for InfiniBand");
++}
++
+ /* Individual States:
+ *
+ * Each routine is called from the dhclient_state_machine() in one of
+diff -up dhcp-4.3.1b1/common/bpf.c.bmgpWV dhcp-4.3.1b1/common/bpf.c
+--- dhcp-4.3.1b1/common/bpf.c.bmgpWV 2014-07-10 17:48:03.797424616 +0200
++++ dhcp-4.3.1b1/common/bpf.c 2014-07-10 17:52:57.705272295 +0200
+@@ -199,11 +199,44 @@ struct bpf_insn dhcp_bpf_filter [] = {
+ BPF_STMT(BPF_RET+BPF_K, 0),
+ };
+
++/* Packet filter program for DHCP over Infiniband.
++ *
++ * XXX
++ * Changes to the filter program may require changes to the constant offsets
++ * used in lpf_gen_filter_setup to patch the port in the BPF program!
++ * XXX
++ */
++struct bpf_insn dhcp_ib_bpf_filter [] = {
++ /* Packet filter for Infiniband */
++ /* Make sure it's a UDP packet... */
++ BPF_STMT(BPF_LD + BPF_B + BPF_ABS, 9),
++ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, IPPROTO_UDP, 0, 6),
++
++ /* Make sure this isn't a fragment... */
++ BPF_STMT(BPF_LD + BPF_H + BPF_ABS, 6),
++ BPF_JUMP(BPF_JMP + BPF_JSET + BPF_K, 0x1fff, 4, 0),
++
++ /* Get the IP header length... */
++ BPF_STMT(BPF_LDX + BPF_B + BPF_MSH, 0),
++
++ /* Make sure it's to the right port... */
++ BPF_STMT(BPF_LD + BPF_H + BPF_IND, 2),
++ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, 67, 0, 1),
++
++ /* If we passed all the tests, ask for the whole packet. */
++ BPF_STMT(BPF_RET + BPF_K, (u_int)-1),
++
++ /* Otherwise, drop it. */
++ BPF_STMT(BPF_RET + BPF_K, 0),
++};
++
+ #if defined (DEC_FDDI)
+ struct bpf_insn *bpf_fddi_filter;
+ #endif
+
+ int dhcp_bpf_filter_len = sizeof dhcp_bpf_filter / sizeof (struct bpf_insn);
++int dhcp_ib_bpf_filter_len = sizeof dhcp_ib_bpf_filter / sizeof (struct bpf_insn);
++
+ #if defined (HAVE_TR_SUPPORT)
+ struct bpf_insn dhcp_bpf_tr_filter [] = {
+ /* accept all token ring packets due to variable length header */
+diff -up dhcp-4.3.1b1/common/lpf.c.bmgpWV dhcp-4.3.1b1/common/lpf.c
+--- dhcp-4.3.1b1/common/lpf.c.bmgpWV 2014-07-10 17:48:03.797424616 +0200
++++ dhcp-4.3.1b1/common/lpf.c 2014-07-10 17:52:57.706272281 +0200
+@@ -46,6 +46,17 @@
+ #if defined (USE_LPF_RECEIVE) || defined (USE_LPF_HWADDR)
+ #include <sys/ioctl.h>
+ #include <net/if.h>
++#include <ifaddrs.h>
++
++/* Default broadcast address for IPoIB */
++static unsigned char default_ib_bcast_addr[20] = {
++ 0x00, 0xff, 0xff, 0xff,
++ 0xff, 0x12, 0x40, 0x1b,
++ 0x00, 0x00, 0x00, 0x00,
++ 0x00, 0x00, 0x00, 0x00,
++ 0xff, 0xff, 0xff, 0xff
++};
++
+ #endif
+
+ #if defined (USE_LPF_SEND) || defined (USE_LPF_RECEIVE)
+@@ -92,10 +103,21 @@ int if_register_lpf (info)
+ struct sockaddr common;
+ } sa;
+ struct ifreq ifr;
++ int type;
++ int protocol;
+
+ /* Make an LPF socket. */
+- if ((sock = socket(PF_PACKET, SOCK_RAW,
+- htons((short)ETH_P_ALL))) < 0) {
++ get_hw_addr(info);
++
++ if (info->hw_address.hbuf[0] == HTYPE_INFINIBAND) {
++ type = SOCK_DGRAM;
++ protocol = ETHERTYPE_IP;
++ } else {
++ type = SOCK_RAW;
++ protocol = ETH_P_ALL;
++ }
++
++ if ((sock = socket(PF_PACKET, type, htons((short)protocol))) < 0) {
+ if (errno == ENOPROTOOPT || errno == EPROTONOSUPPORT ||
+ errno == ESOCKTNOSUPPORT || errno == EPFNOSUPPORT ||
+ errno == EAFNOSUPPORT || errno == EINVAL) {
+@@ -118,6 +140,7 @@ int if_register_lpf (info)
+ /* Bind to the interface name */
+ memset (&sa, 0, sizeof sa);
+ sa.ll.sll_family = AF_PACKET;
++ sa.ll.sll_protocol = htons(protocol);
+ sa.ll.sll_ifindex = ifr.ifr_ifindex;
+ if (bind (sock, &sa.common, sizeof sa)) {
+ if (errno == ENOPROTOOPT || errno == EPROTONOSUPPORT ||
+@@ -133,8 +156,6 @@ int if_register_lpf (info)
+ log_fatal ("Bind socket to interface: %m");
+ }
+
+- get_hw_addr(info->name, &info->hw_address);
+-
+ return sock;
+ }
+ #endif /* USE_LPF_SEND || USE_LPF_RECEIVE */
+@@ -189,6 +210,8 @@ void if_deregister_send (info)
+ in bpf includes... */
+ extern struct sock_filter dhcp_bpf_filter [];
+ extern int dhcp_bpf_filter_len;
++extern struct sock_filter dhcp_ib_bpf_filter [];
++extern int dhcp_ib_bpf_filter_len;
+
+ #if defined (HAVE_TR_SUPPORT)
+ extern struct sock_filter dhcp_bpf_tr_filter [];
+@@ -206,11 +229,13 @@ void if_register_receive (info)
+ /* Open a LPF device and hang it on this interface... */
+ info -> rfdesc = if_register_lpf (info);
+
+- val = 1;
+- if (setsockopt (info -> rfdesc, SOL_PACKET, PACKET_AUXDATA, &val,
+- sizeof val) < 0) {
+- if (errno != ENOPROTOOPT)
+- log_fatal ("Failed to set auxiliary packet data: %m");
++ if (info->hw_address.hbuf[0] != HTYPE_INFINIBAND) {
++ val = 1;
++ if (setsockopt (info -> rfdesc, SOL_PACKET, PACKET_AUXDATA,
++ &val, sizeof val) < 0) {
++ if (errno != ENOPROTOOPT)
++ log_fatal ("Failed to set auxiliary packet data: %m");
++ }
+ }
+
+ #if defined (HAVE_TR_SUPPORT)
+@@ -256,15 +281,28 @@ static void lpf_gen_filter_setup (info)
+
+ memset(&p, 0, sizeof(p));
+
+- /* Set up the bpf filter program structure. This is defined in
+- bpf.c */
+- p.len = dhcp_bpf_filter_len;
+- p.filter = dhcp_bpf_filter;
+-
+- /* Patch the server port into the LPF program...
+- XXX changes to filter program may require changes
+- to the insn number(s) used below! XXX */
+- dhcp_bpf_filter [8].k = ntohs ((short)local_port);
++ if (info->hw_address.hbuf[0] == HTYPE_INFINIBAND) {
++ /* Set up the bpf filter program structure. */
++ p.len = dhcp_ib_bpf_filter_len;
++ p.filter = dhcp_ib_bpf_filter;
++
++ /* Patch the server port into the LPF program...
++ XXX
++ changes to filter program may require changes
++ to the insn number(s) used below!
++ XXX */
++ dhcp_ib_bpf_filter[6].k = ntohs ((short)local_port);
++ } else {
++ /* Set up the bpf filter program structure.
++ This is defined in bpf.c */
++ p.len = dhcp_bpf_filter_len;
++ p.filter = dhcp_bpf_filter;
++
++ /* Patch the server port into the LPF program...
++ XXX changes to filter program may require changes
++ to the insn number(s) used below! XXX */
++ dhcp_bpf_filter [8].k = ntohs ((short)local_port);
++ }
+
+ if (setsockopt (info -> rfdesc, SOL_SOCKET, SO_ATTACH_FILTER, &p,
+ sizeof p) < 0) {
+@@ -321,6 +359,54 @@ static void lpf_tr_filter_setup (info)
+ #endif /* USE_LPF_RECEIVE */
+
+ #ifdef USE_LPF_SEND
++ssize_t send_packet_ib(interface, packet, raw, len, from, to, hto)
++ struct interface_info *interface;
++ struct packet *packet;
++ struct dhcp_packet *raw;
++ size_t len;
++ struct in_addr from;
++ struct sockaddr_in *to;
++ struct hardware *hto;
++{
++ unsigned ibufp = 0;
++ double ih [1536 / sizeof (double)];
++ unsigned char *buf = (unsigned char *)ih;
++ ssize_t result;
++
++ union sockunion {
++ struct sockaddr sa;
++ struct sockaddr_ll sll;
++ struct sockaddr_storage ss;
++ } su;
++
++ assemble_udp_ip_header (interface, buf, &ibufp, from.s_addr,
++ to->sin_addr.s_addr, to->sin_port,
++ (unsigned char *)raw, len);
++ memcpy (buf + ibufp, raw, len);
++
++ memset(&su, 0, sizeof(su));
++ su.sll.sll_family = AF_PACKET;
++ su.sll.sll_protocol = htons(ETHERTYPE_IP);
++
++ if (!(su.sll.sll_ifindex = if_nametoindex(interface->name))) {
++ errno = ENOENT;
++ log_error ("send_packet_ib: %m - failed to get if index");
++ return -1;
++ }
++
++ su.sll.sll_hatype = htons(HTYPE_INFINIBAND);
++ su.sll.sll_halen = sizeof(interface->bcast_addr);
++ memcpy(&su.sll.sll_addr, interface->bcast_addr, 20);
++
++ result = sendto(interface->wfdesc, buf, ibufp + len, 0,
++ &su.sa, sizeof(su));
++
++ if (result < 0)
++ log_error ("send_packet_ib: %m");
++
++ return result;
++}
++
+ ssize_t send_packet (interface, packet, raw, len, from, to, hto)
+ struct interface_info *interface;
+ struct packet *packet;
+@@ -341,6 +427,11 @@ ssize_t send_packet (interface, packet,
+ return send_fallback (interface, packet, raw,
+ len, from, to, hto);
+
++ if (interface->hw_address.hbuf[0] == HTYPE_INFINIBAND) {
++ return send_packet_ib(interface, packet, raw, len, from,
++ to, hto);
++ }
++
+ if (hto == NULL && interface->anycast_mac_addr.hlen)
+ hto = &interface->anycast_mac_addr;
+
+@@ -362,6 +453,42 @@ ssize_t send_packet (interface, packet,
+ #endif /* USE_LPF_SEND */
+
+ #ifdef USE_LPF_RECEIVE
++ssize_t receive_packet_ib (interface, buf, len, from, hfrom)
++ struct interface_info *interface;
++ unsigned char *buf;
++ size_t len;
++ struct sockaddr_in *from;
++ struct hardware *hfrom;
++{
++ int length = 0;
++ int offset = 0;
++ unsigned char ibuf [1536];
++ unsigned bufix = 0;
++ unsigned paylen;
++
++ length = read(interface->rfdesc, ibuf, sizeof(ibuf));
++
++ if (length <= 0)
++ return length;
++
++ offset = decode_udp_ip_header(interface, ibuf, bufix, from,
++ (unsigned)length, &paylen, 0);
++
++ if (offset < 0)
++ return 0;
++
++ bufix += offset;
++ length -= offset;
++
++ if (length < paylen)
++ log_fatal("Internal inconsistency at %s:%d.", MDL);
++
++ /* Copy out the data in the packet... */
++ memcpy(buf, &ibuf[bufix], paylen);
++
++ return (ssize_t)paylen;
++}
++
+ ssize_t receive_packet (interface, buf, len, from, hfrom)
+ struct interface_info *interface;
+ unsigned char *buf;
+@@ -388,6 +515,10 @@ ssize_t receive_packet (interface, buf,
+ };
+ struct cmsghdr *cmsg;
+
++ if (interface->hw_address.hbuf[0] == HTYPE_INFINIBAND) {
++ return receive_packet_ib(interface, buf, len, from, hfrom);
++ }
++
+ length = recvmsg (interface -> rfdesc, &msg, 0);
+ if (length <= 0)
+ return length;
+@@ -469,11 +600,33 @@ void maybe_setup_fallback ()
+ #endif
+
+ #if defined (USE_LPF_RECEIVE) || defined (USE_LPF_HWADDR)
+-void
+-get_hw_addr(const char *name, struct hardware *hw) {
++struct sockaddr_ll *
++get_ll (struct ifaddrs *ifaddrs, struct ifaddrs **ifa, char *name)
++{
++ for (*ifa = ifaddrs; *ifa != NULL; *ifa = (*ifa)->ifa_next) {
++ if ((*ifa)->ifa_addr == NULL)
++ continue;
++
++ if ((*ifa)->ifa_addr->sa_family != AF_PACKET)
++ continue;
++
++ if ((*ifa)->ifa_flags & IFF_LOOPBACK)
++ continue;
++
++ if (strcmp((*ifa)->ifa_name, name) == 0)
++ return (struct sockaddr_ll *)(void *)(*ifa)->ifa_addr;
++ }
++ *ifa = NULL;
++ return NULL;
++}
++
++struct sockaddr_ll *
++ioctl_get_ll(char *name)
++{
+ int sock;
+ struct ifreq tmp;
+- struct sockaddr *sa;
++ struct sockaddr *sa = NULL;
++ struct sockaddr_ll *sll = NULL;
+
+ if (strlen(name) >= sizeof(tmp.ifr_name)) {
+ log_fatal("Device name too long: \"%s\"", name);
+@@ -487,16 +640,62 @@ get_hw_addr(const char *name, struct har
+ memset(&tmp, 0, sizeof(tmp));
+ strcpy(tmp.ifr_name, name);
+ if (ioctl(sock, SIOCGIFHWADDR, &tmp) < 0) {
+- log_fatal("Error getting hardware address for \"%s\": %m",
++ log_fatal("Error getting hardware address for \"%s\": %m",
+ name);
+ }
++ close(sock);
+
+ sa = &tmp.ifr_hwaddr;
+- switch (sa->sa_family) {
++ // needs to be freed outside this function
++ sll = dmalloc (sizeof (struct sockaddr_ll), MDL);
++ if (!sll)
++ log_fatal("Unable to allocate memory for link layer address");
++ memcpy(&sll->sll_hatype, &sa->sa_family, sizeof (sll->sll_hatype));
++ memcpy(sll->sll_addr, sa->sa_data, sizeof (sll->sll_addr));
++ switch (sll->sll_hatype) {
++ case ARPHRD_INFINIBAND:
++ /* ioctl limits hardware addresses to 8 bytes */
++ sll->sll_halen = 8;
++ break;
++ default:
++ break;
++ }
++ return sll;
++}
++
++void
++get_hw_addr(struct interface_info *info)
++{
++ struct hardware *hw = &info->hw_address;
++ char *name = info->name;
++ struct ifaddrs *ifaddrs = NULL;
++ struct ifaddrs *ifa = NULL;
++ struct sockaddr_ll *sll = NULL;
++ int sll_allocated = 0;
++ char *dup = NULL;
++ char *colon = NULL;
++
++ if (getifaddrs(&ifaddrs) == -1)
++ log_fatal("Failed to get interfaces");
++
++ if ((sll = get_ll(ifaddrs, &ifa, name)) == NULL) {
++ /*
++ * We were unable to get link-layer address for name.
++ * Fall back to ioctl(SIOCGIFHWADDR).
++ */
++ sll = ioctl_get_ll(name);
++ if (sll != NULL)
++ sll_allocated = 1;
++ else
++ // shouldn't happen
++ log_fatal("Unexpected internal error");
++ }
++
++ switch (sll->sll_hatype) {
+ case ARPHRD_ETHER:
+ hw->hlen = 7;
+ hw->hbuf[0] = HTYPE_ETHER;
+- memcpy(&hw->hbuf[1], sa->sa_data, 6);
++ memcpy(&hw->hbuf[1], sll->sll_addr, 6);
+ break;
+ case ARPHRD_IEEE802:
+ #ifdef ARPHRD_IEEE802_TR
+@@ -504,18 +703,48 @@ get_hw_addr(const char *name, struct har
+ #endif /* ARPHRD_IEEE802_TR */
+ hw->hlen = 7;
+ hw->hbuf[0] = HTYPE_IEEE802;
+- memcpy(&hw->hbuf[1], sa->sa_data, 6);
++ memcpy(&hw->hbuf[1], sll->sll_addr, 6);
+ break;
+ case ARPHRD_FDDI:
+ hw->hlen = 7;
+ hw->hbuf[0] = HTYPE_FDDI;
+- memcpy(&hw->hbuf[1], sa->sa_data, 6);
++ memcpy(&hw->hbuf[1], sll->sll_addr, 6);
++ break;
++ case ARPHRD_INFINIBAND:
++ dup = strdup(name);
++ /* Aliased infiniband interface is special case where
++ * neither get_ll() nor ioctl_get_ll() get's correct hw
++ * address, so we have to truncate the :0 and run
++ * get_ll() again for the rest.
++ */
++ if ((colon = strchr(dup, ':')) != NULL) {
++ *colon = '\0';
++ if ((sll = get_ll(ifaddrs, &ifa, dup)) == NULL)
++ log_fatal("Error getting hardware address for \"%s\": %m", name);
++ }
++ free (dup);
++ /* For Infiniband, save the broadcast address and store
++ * the port GUID into the hardware address.
++ */
++ if (ifa && (ifa->ifa_flags & IFF_BROADCAST)) {
++ struct sockaddr_ll *bll;
++
++ bll = (struct sockaddr_ll *)ifa->ifa_broadaddr;
++ memcpy(&info->bcast_addr, bll->sll_addr, 20);
++ } else {
++ memcpy(&info->bcast_addr, default_ib_bcast_addr,
++ 20);
++ }
++
++ hw->hlen = 1;
++ hw->hbuf[0] = HTYPE_INFINIBAND;
++ memcpy(&hw->hbuf[1], &sll->sll_addr[sll->sll_halen - 8], 8);
+ break;
+ #if defined(ARPHRD_PPP)
+ case ARPHRD_PPP:
+ if (local_family != AF_INET6)
+- log_fatal("Unsupported device type %d for \"%s\"",
+- sa->sa_family, name);
++ log_fatal("local_family != AF_INET6 for \"%s\"",
++ name);
+ hw->hlen = 0;
+ hw->hbuf[0] = HTYPE_RESERVED;
+ /* 0xdeadbeef should never occur on the wire,
+@@ -528,10 +757,13 @@ get_hw_addr(const char *name, struct har
+ break;
+ #endif
+ default:
+- log_fatal("Unsupported device type %ld for \"%s\"",
+- (long int)sa->sa_family, name);
++ freeifaddrs(ifaddrs);
++ log_fatal("Unsupported device type %hu for \"%s\"",
++ sll->sll_hatype, name);
+ }
+
+- close(sock);
++ if (sll_allocated)
++ dfree(sll, MDL);
++ freeifaddrs(ifaddrs);
+ }
+ #endif
+diff -up dhcp-4.3.1b1/common/socket.c.bmgpWV dhcp-4.3.1b1/common/socket.c
+--- dhcp-4.3.1b1/common/socket.c.bmgpWV 2014-07-02 19:58:38.000000000 +0200
++++ dhcp-4.3.1b1/common/socket.c 2014-07-10 17:52:57.706272281 +0200
+@@ -322,7 +322,7 @@ void if_register_send (info)
+ info->wfdesc = if_register_socket(info, AF_INET, 0, NULL);
+ /* If this is a normal IPv4 address, get the hardware address. */
+ if (strcmp(info->name, "fallback") != 0)
+- get_hw_addr(info->name, &info->hw_address);
++ get_hw_addr(info);
+ #if defined (USE_SOCKET_FALLBACK)
+ /* Fallback only registers for send, but may need to receive as
+ well. */
+@@ -385,7 +385,7 @@ void if_register_receive (info)
+ #endif /* IP_PKTINFO... */
+ /* If this is a normal IPv4 address, get the hardware address. */
+ if (strcmp(info->name, "fallback") != 0)
+- get_hw_addr(info->name, &info->hw_address);
++ get_hw_addr(info);
+
+ if (!quiet_interface_discovery)
+ log_info ("Listening on Socket/%s%s%s",
+@@ -499,7 +499,7 @@ if_register6(struct interface_info *info
+ if (req_multi)
+ if_register_multicast(info);
+
+- get_hw_addr(info->name, &info->hw_address);
++ get_hw_addr(info);
+
+ if (!quiet_interface_discovery) {
+ if (info->shared_network != NULL) {
+@@ -555,7 +555,7 @@ if_register_linklocal6(struct interface_
+ info->rfdesc = sock;
+ info->wfdesc = sock;
+
+- get_hw_addr(info->name, &info->hw_address);
++ get_hw_addr(info);
+
+ if (!quiet_interface_discovery) {
+ if (info->shared_network != NULL) {
+diff -up dhcp-4.3.1b1/includes/dhcpd.h.bmgpWV dhcp-4.3.1b1/includes/dhcpd.h
+--- dhcp-4.3.1b1/includes/dhcpd.h.bmgpWV 2014-07-10 17:50:26.923402536 +0200
++++ dhcp-4.3.1b1/includes/dhcpd.h 2014-07-10 17:52:57.707272266 +0200
+@@ -1248,6 +1248,7 @@ struct interface_info {
+ struct shared_network *shared_network;
+ /* Networks connected to this interface. */
+ struct hardware hw_address; /* Its physical address. */
++ u_int8_t bcast_addr[20]; /* Infiniband broadcast address */
+ struct in_addr *addresses; /* Addresses associated with this
+ * interface.
+ */
+@@ -2439,7 +2440,7 @@ void print_dns_status (int, struct dhcp_
+ #endif
+ const char *print_time(TIME);
+
+-void get_hw_addr(const char *name, struct hardware *hw);
++void get_hw_addr(struct interface_info *info);
+
+ /* socket.c */
+ #if defined (USE_SOCKET_SEND) || defined (USE_SOCKET_RECEIVE) \
diff --git a/src/patches/dhcp/dhcp-manpages.patch b/src/patches/dhcp/dhcp-manpages.patch
new file mode 100644
index 0000000..dde16c7
--- /dev/null
+++ b/src/patches/dhcp/dhcp-manpages.patch
@@ -0,0 +1,157 @@
+diff -up dhcp-4.3.0a1/client/dhclient-script.8.man dhcp-4.3.0a1/client/dhclient-script.8
+--- dhcp-4.3.0a1/client/dhclient-script.8.man 2013-12-11 01:01:02.000000000 +0100
++++ dhcp-4.3.0a1/client/dhclient-script.8 2013-12-19 15:27:17.617118805 +0100
+@@ -48,7 +48,7 @@ customizations are needed, they should b
+ exit hooks provided (see HOOKS for details). These hooks will allow the
+ user to override the default behaviour of the client in creating a
+ .B /etc/resolv.conf
+-file.
++file, and to handle DHCP options not handled by default.
+ .PP
+ No standard client script exists for some operating systems, even though
+ the actual client may work, so a pioneering user may well need to create
+@@ -92,6 +92,26 @@ present. The
+ .B ETCDIR/dhclient-exit-hooks
+ script can modify the valid of exit_status to change the exit status
+ of dhclient-script.
++.PP
++Immediately after dhclient brings an interface UP with a new IP address,
++subnet mask, and routes, in the REBOOT/BOUND states, it will check for the
++existence of an executable
++.B ETCDIR/dhclient-up-hooks
++script, and source it if found. This script can handle DHCP options in
++the environment that are not handled by default. A per-interface.
++.B ETCDIR/dhclient-${IF}-up-hooks
++script will override the generic script and be sourced when interface
++$IF has been brought up.
++.PP
++Immediately before dhclient brings an interface DOWN, removing its IP
++address, subnet mask, and routes, in the STOP/RELEASE states, it will
++check for the existence of an executable
++.B ETCDIR/dhclient-down-hooks
++script, and source it if found. This script can handle DHCP options in
++the environment that are not handled by default. A per-interface
++.B ETCDIR/dhclient-${IF}-down-hooks
++script will override the generic script and be sourced when interface
++$IF is about to be brought down.
+ .SH OPERATION
+ When dhclient needs to invoke the client configuration script, it
+ defines a set of variables in the environment, and then invokes
+diff -up dhcp-4.3.0a1/client/dhclient.conf.5.man dhcp-4.3.0a1/client/dhclient.conf.5
+--- dhcp-4.3.0a1/client/dhclient.conf.5.man 2013-12-11 01:01:02.000000000 +0100
++++ dhcp-4.3.0a1/client/dhclient.conf.5 2013-12-19 15:27:17.617118805 +0100
+@@ -202,7 +202,8 @@ responding to the client send the client
+ options. Only the option names should be specified in the request
+ statement - not option parameters. By default, the DHCPv4 client
+ requests the subnet-mask, broadcast-address, time-offset, routers,
+-domain-name, domain-name-servers and host-name options while the DHCPv6
++domain-search, domain-name, domain-name-servers, host-name, nis-domain,
++nis-servers, ntp-servers and interface-mtu options while the DHCPv6
+ client requests the dhcp6 name-servers and domain-search options. Note
+ that if you enter a \'request\' statement, you over-ride these defaults
+ and these options will not be requested.
+@@ -688,6 +689,17 @@ know the DHCP service(s) anycast MAC add
+ client. The \fIlink-type\fR and \fImac-address\fR parameters are configured
+ in a similar manner to the \fBhardware\fR statement.
+ .PP
++ \fBbootp-broadcast-always;\fR
++.PP
++The
++.B bootp-broadcast-always
++statement instructs dhclient to always set the bootp broadcast flag in
++request packets, so that servers will always broadcast replies.
++This is equivalent to supplying the dhclient -B argument, and has
++the same effect as specifying 'always-broadcast' in the server's dhcpd.conf.
++This option is provided as an extension to enable dhclient to work
++on IBM s390 Linux guests.
++.PP
+ .SH SAMPLE
+ The following configuration file is used on a laptop running NetBSD
+ 1.3. The laptop has an IP alias of 192.5.5.213, and has one
+@@ -713,7 +725,7 @@ interface "ep0" {
+ supersede domain-search "fugue.com", "rc.vix.com", "home.vix.com";
+ prepend domain-name-servers 127.0.0.1;
+ request subnet-mask, broadcast-address, time-offset, routers,
+- domain-name, domain-name-servers, host-name;
++ domain-search, domain-name, domain-name-servers, host-name;
+ require subnet-mask, domain-name-servers;
+ script "CLIENTBINDIR/dhclient-script";
+ media "media 10baseT/UTP", "media 10base2/BNC";
+diff -up dhcp-4.3.0a1/common/dhcp-options.5.man dhcp-4.3.0a1/common/dhcp-options.5
+--- dhcp-4.3.0a1/common/dhcp-options.5.man 2013-12-11 01:25:12.000000000 +0100
++++ dhcp-4.3.0a1/common/dhcp-options.5 2013-12-19 15:27:17.618118791 +0100
+@@ -914,6 +914,21 @@ classless IP routing - it does not inclu
+ classless IP routing is now the most widely deployed routing standard,
+ this option is virtually useless, and is not implemented by any of the
+ popular DHCP clients, for example the Microsoft DHCP client.
++.PP
++NOTE to Fedora dhclient users:
++.br
++dhclient-script interprets trailing 0 octets of the target as indicating
++the subnet class of the route, so for the following static-routes value:
++.br
++ option static-routes 172.0.0.0 172.16.2.254,
++.br
++ 192.168.0.0 192.168.2.254;
++.br
++dhclient-script will create routes:
++.br
++ 172/8 via 172.16.2.254 dev $interface
++.br
++ 192.168/16 via 192.168.2.254 dev $interface
+ .RE
+ .PP
+ .nf
+diff -up dhcp-4.3.0a1/server/dhcpd.conf.5.man dhcp-4.3.0a1/server/dhcpd.conf.5
+--- dhcp-4.3.0a1/server/dhcpd.conf.5.man 2013-12-13 21:49:44.000000000 +0100
++++ dhcp-4.3.0a1/server/dhcpd.conf.5 2013-12-19 15:30:14.266670962 +0100
+@@ -527,6 +527,9 @@ pool {
+ };
+ .fi
+ .PP
++Dynamic BOOTP leases are not compatible with failover, and, as such,
++you need to disallow BOOTP in pools that you are using failover for.
++.PP
+ The server currently does very little sanity checking, so if you
+ configure it wrong, it will just fail in odd ways. I would recommend
+ therefore that you either do failover or don't do failover, but don't
+@@ -541,9 +544,9 @@ primary server might look like this:
+ failover peer "foo" {
+ primary;
+ address anthrax.rc.vix.com;
+- port 519;
++ port 647;
+ peer address trantor.rc.vix.com;
+- peer port 520;
++ peer port 847;
+ max-response-delay 60;
+ max-unacked-updates 10;
+ mclt 3600;
+@@ -1241,7 +1244,7 @@ the zone containing PTR records - for IS
+ .PP
+ .nf
+ key DHCP_UPDATER {
+- algorithm HMAC-MD5.SIG-ALG.REG.INT;
++ algorithm hmac-md5;
+ secret pRP5FapFoJ95JEL06sv4PQ==;
+ };
+
+@@ -1264,7 +1267,7 @@ dhcpd.conf file:
+ .PP
+ .nf
+ key DHCP_UPDATER {
+- algorithm HMAC-MD5.SIG-ALG.REG.INT;
++ algorithm hmac-md5;
+ secret pRP5FapFoJ95JEL06sv4PQ==;
+ };
+
+@@ -2539,7 +2542,8 @@ statement
+ The \fInext-server\fR statement is used to specify the host address of
+ the server from which the initial boot file (specified in the
+ \fIfilename\fR statement) is to be loaded. \fIServer-name\fR should
+-be a numeric IP address or a domain name.
++be a numeric IP address or a domain name. If no \fInext-server\fR statement
++applies to a given client, the address 0.0.0.0 is used.
+ .RE
+ .PP
+ The
diff --git a/src/patches/dhcp/dhcp-paranoia.patch b/src/patches/dhcp/dhcp-paranoia.patch
new file mode 100644
index 0000000..0f2db8c
--- /dev/null
+++ b/src/patches/dhcp/dhcp-paranoia.patch
@@ -0,0 +1,156 @@
+diff -up dhcp-4.3.1b1/client/dhclient.c.dlTsyN dhcp-4.3.1b1/client/dhclient.c
+--- dhcp-4.3.1b1/client/dhclient.c.dlTsyN 2014-07-10 17:49:49.882925843 +0200
++++ dhcp-4.3.1b1/client/dhclient.c 2014-07-10 17:50:26.922402550 +0200
+@@ -1748,11 +1748,6 @@ int write_host (host)
+ return 0;
+ }
+
+-void db_startup (testp)
+- int testp;
+-{
+-}
+-
+ void bootp (packet)
+ struct packet *packet;
+ {
+diff -up dhcp-4.3.1b1/includes/dhcpd.h.dlTsyN dhcp-4.3.1b1/includes/dhcpd.h
+--- dhcp-4.3.1b1/includes/dhcpd.h.dlTsyN 2014-07-10 17:48:03.798424601 +0200
++++ dhcp-4.3.1b1/includes/dhcpd.h 2014-07-10 17:50:26.923402536 +0200
+@@ -2866,7 +2866,11 @@ void commit_leases_timeout (void *);
+ void commit_leases_readerdry(void *);
+ int commit_leases (void);
+ int commit_leases_timed (void);
++#if defined (PARANOIA)
++void db_startup (int, uid_t, gid_t);
++#else
+ void db_startup (int);
++#endif /* PARANOIA */
+ int new_lease_file (void);
+ int group_writer (struct group_object *);
+ int write_ia(const struct ia_xx *);
+diff -up dhcp-4.3.1b1/server/confpars.c.dlTsyN dhcp-4.3.1b1/server/confpars.c
+--- dhcp-4.3.1b1/server/confpars.c.dlTsyN 2014-07-10 17:39:25.801764596 +0200
++++ dhcp-4.3.1b1/server/confpars.c 2014-07-10 17:50:26.924402522 +0200
+@@ -219,7 +219,11 @@ void trace_conf_input (trace_type_t *tty
+ }
+
+ if (!leaseconf_initialized && ttype == trace_readleases_type) {
++#if defined (PARANOIA)
++ db_startup (0, 0, 0);
++#else
+ db_startup (0);
++#endif /* PARANOIA */
+ leaseconf_initialized = 1;
+ postdb_startup ();
+ }
+diff -up dhcp-4.3.1b1/server/db.c.dlTsyN dhcp-4.3.1b1/server/db.c
+--- dhcp-4.3.1b1/server/db.c.dlTsyN 2014-07-10 17:39:25.801764596 +0200
++++ dhcp-4.3.1b1/server/db.c 2014-07-10 17:50:26.925402508 +0200
+@@ -42,6 +42,10 @@ static int counting = 0;
+ static int count = 0;
+ TIME write_time;
+ int lease_file_is_corrupt = 0;
++#if defined (PARANOIA)
++uid_t global_set_uid = 0;
++gid_t global_set_gid = 0;
++#endif /* PARANOIA */
+
+ /* Write a single binding scope value in parsable format.
+ */
+@@ -1046,8 +1050,11 @@ int commit_leases_timed()
+ return (1);
+ }
+
+-void db_startup (testp)
+- int testp;
++#if defined (PARANOIA)
++void db_startup (int testp, uid_t set_uid, gid_t set_gid)
++#else
++void db_startup (int testp)
++#endif /* PARANOIA */
+ {
+ isc_result_t status;
+
+@@ -1066,6 +1073,11 @@ void db_startup (testp)
+ }
+ #endif
+
++#if defined (PARANOIA)
++ global_set_uid = set_uid;
++ global_set_gid = set_gid;
++#endif /* PARANOIA */
++
+ #if defined (TRACING)
+ /* If we're playing back, there is no lease file, so we can't
+ append it, so we create one immediately (maybe this isn't
+@@ -1128,6 +1140,17 @@ int new_lease_file ()
+ log_error ("Can't create new lease file: %m");
+ return 0;
+ }
++
++#if defined (PARANOIA)
++ if (global_set_uid && !geteuid() &&
++ global_set_gid && !getegid())
++ if (fchown(db_fd, global_set_uid, global_set_gid)) {
++ log_fatal ("Can't chown new lease file: %m");
++ close(db_fd);
++ goto fdfail;
++ }
++#endif /* PARANOIA */
++
+ if ((new_db_file = fdopen(db_fd, "we")) == NULL) {
+ log_error("Can't fdopen new lease file: %m");
+ close(db_fd);
+diff -up dhcp-4.3.1b1/server/dhcpd.8.dlTsyN dhcp-4.3.1b1/server/dhcpd.8
+--- dhcp-4.3.1b1/server/dhcpd.8.dlTsyN 2014-07-02 19:58:39.000000000 +0200
++++ dhcp-4.3.1b1/server/dhcpd.8 2014-07-10 17:50:26.925402508 +0200
+@@ -82,6 +82,18 @@ dhcpd - Dynamic Host Configuration Proto
+ .I trace-output-file
+ ]
+ [
++.B -user
++.I user
++]
++[
++.B -group
++.I group
++]
++[
++.B -chroot
++.I dir
++]
++[
+ .B -play
+ .I trace-playback-file
+ ]
+@@ -269,6 +281,15 @@ lease file.
+ .TP
+ .BI --version
+ Print version number and exit.
++.TP
++.BI \-user \ user
++Setuid to user after completing privileged operations, such as creating sockets that listen on privileged ports.
++.TP
++.BI \-group \ group
++Setgid to group after completing privileged operations, such as creating sockets that listen on privileged ports.
++.TP
++.BI \-chroot \ dir
++Chroot to directory after processing the command line arguments, but before reading the configuration file.
+ .PP
+ .I Modifying default file locations:
+ The following options can be used to modify the locations
+diff -up dhcp-4.3.1b1/server/dhcpd.c.dlTsyN dhcp-4.3.1b1/server/dhcpd.c
+--- dhcp-4.3.1b1/server/dhcpd.c.dlTsyN 2014-07-10 17:39:25.802764582 +0200
++++ dhcp-4.3.1b1/server/dhcpd.c 2014-07-10 17:52:35.341588248 +0200
+@@ -628,7 +628,11 @@ main(int argc, char **argv) {
+ group_write_hook = group_writer;
+
+ /* Start up the database... */
++#if defined (PARANOIA)
++ db_startup (lftest, set_uid, set_gid);
++#else
+ db_startup (lftest);
++#endif /* PARANOIA */
+
+ if (lftest)
+ exit (0);
diff --git a/src/patches/dhcp/dhcp-paths.patch b/src/patches/dhcp/dhcp-paths.patch
new file mode 100644
index 0000000..2f43e51
--- /dev/null
+++ b/src/patches/dhcp/dhcp-paths.patch
@@ -0,0 +1,44 @@
+--- expanded_org/includes/dhcpd.h Wed Aug 06 23:35:02 2014
++++ expanded_patched_51_4_2_0_paths_patch/includes/dhcpd.h Mon Feb 16 13:22:11 2015
+@@ -1424,15 +1424,15 @@
+ #else /* !DEBUG */
+
+ #ifndef _PATH_DHCPD_CONF
+-#define _PATH_DHCPD_CONF "/etc/dhcpd.conf"
++#define _PATH_DHCPD_CONF "/etc/dhcp/dhcpd.conf"
+ #endif /* DEBUG */
+
+ #ifndef _PATH_DHCPD_DB
+-#define _PATH_DHCPD_DB LOCALSTATEDIR"/db/dhcpd.leases"
++#define _PATH_DHCPD_DB LOCALSTATEDIR"/dhcpd/dhcpd.leases"
+ #endif
+
+ #ifndef _PATH_DHCPD6_DB
+-#define _PATH_DHCPD6_DB LOCALSTATEDIR"/db/dhcpd6.leases"
++#define _PATH_DHCPD6_DB LOCALSTATEDIR"/dhcpd/dhcpd6.leases"
+ #endif
+
+ #ifndef _PATH_DHCPD_PID
+@@ -1446,7 +1446,7 @@
+ #endif /* DEBUG */
+
+ #ifndef _PATH_DHCLIENT_CONF
+-#define _PATH_DHCLIENT_CONF "/etc/dhclient.conf"
++#define _PATH_DHCLIENT_CONF "/etc/dhcp/dhclient.conf"
+ #endif
+
+ #ifndef _PATH_DHCLIENT_SCRIPT
+@@ -1462,11 +1462,11 @@
+ #endif
+
+ #ifndef _PATH_DHCLIENT_DB
+-#define _PATH_DHCLIENT_DB LOCALSTATEDIR"/db/dhclient.leases"
++#define _PATH_DHCLIENT_DB LOCALSTATEDIR"/dhclient/dhclient.leases"
+ #endif
+
+ #ifndef _PATH_DHCLIENT6_DB
+-#define _PATH_DHCLIENT6_DB LOCALSTATEDIR"/db/dhclient6.leases"
++#define _PATH_DHCLIENT6_DB LOCALSTATEDIR"/dhclient/dhclient6.leases"
+ #endif
+
+ #ifndef _PATH_RESOLV_CONF
diff --git a/src/patches/dhcp/dhcp-release-by-ifup.patch b/src/patches/dhcp/dhcp-release-by-ifup.patch
new file mode 100644
index 0000000..677eb5c
--- /dev/null
+++ b/src/patches/dhcp/dhcp-release-by-ifup.patch
@@ -0,0 +1,85 @@
+diff -up dhcp-4.3.0a1/client/dhclient.c.ifup dhcp-4.3.0a1/client/dhclient.c
+--- dhcp-4.3.0a1/client/dhclient.c.ifup 2013-12-19 14:53:08.817760677 +0100
++++ dhcp-4.3.0a1/client/dhclient.c 2013-12-19 15:05:16.290518574 +0100
+@@ -521,9 +521,81 @@ main(int argc, char **argv) {
+ }
+ }
+ fclose(pidfd);
++ } else {
++ /* handle release for interfaces requested with Red Hat
++ * /sbin/ifup - pidfile will be /var/run/dhclient-$interface.pid
++ */
++
++ if ((path_dhclient_pid == NULL) || (*path_dhclient_pid == '\0'))
++ path_dhclient_pid = "/var/run/dhclient.pid";
++
++ char *new_path_dhclient_pid;
++ struct interface_info *ip;
++ int pdp_len = strlen(path_dhclient_pid), pfx, dpfx;
++
++ /* find append point: beginning of any trailing '.pid'
++ * or '-$IF.pid' */
++ for (pfx=pdp_len; (pfx >= 0) && (path_dhclient_pid[pfx] != '.') && (path_dhclient_pid[pfx] != '/'); pfx--);
++ if (pfx == -1)
++ pfx = pdp_len;
++
++ if (path_dhclient_pid[pfx] == '/')
++ pfx += 1;
++
++ for (dpfx=pfx; (dpfx >= 0) && (path_dhclient_pid[dpfx] != '-') && (path_dhclient_pid[dpfx] != '/'); dpfx--);
++ if ((dpfx > -1) && (path_dhclient_pid[dpfx] != '/'))
++ pfx = dpfx;
++
++ for (ip = interfaces; ip; ip = ip->next) {
++ if (interfaces_requested && (ip->flags & (INTERFACE_REQUESTED))) {
++ int n_len = strlen(ip->name);
++
++ new_path_dhclient_pid = (char*) malloc(pfx + n_len + 6);
++ strncpy(new_path_dhclient_pid, path_dhclient_pid, pfx);
++ sprintf(new_path_dhclient_pid + pfx, "-%s.pid", ip->name);
++
++ if ((pidfd = fopen(new_path_dhclient_pid, "r")) != NULL) {
++ e = fscanf(pidfd, "%ld\n", &temp);
++ oldpid = (pid_t)temp;
++
++ if (e != 0 && e != EOF) {
++ if (oldpid) {
++ if (kill(oldpid, SIGTERM) == 0)
++ unlink(path_dhclient_pid);
++ }
++ }
++
++ fclose(pidfd);
++ }
++
++ free(new_path_dhclient_pid);
++ }
++ }
++ }
++ } else {
++ FILE *pidfp = NULL;
++ long temp = 0;
++ pid_t dhcpid = 0;
++ int dhc_running = 0;
++ char procfn[256] = "";
++
++ if ((pidfp = fopen(path_dhclient_pid, "r")) != NULL) {
++ if ((fscanf(pidfp, "%ld", &temp)==1) && ((dhcpid=(pid_t)temp) > 0)) {
++ snprintf(procfn,256,"/proc/%u",dhcpid);
++ dhc_running = (access(procfn, F_OK) == 0);
++ }
++
++ fclose(pidfp);
++ }
++
++ if (dhc_running) {
++ log_fatal("dhclient(%u) is already running - exiting. ", dhcpid);
++ return(1);
+ }
+ }
+
++ write_client_pid_file();
++
+ if (!quiet) {
+ log_info("%s %s", message, PACKAGE_VERSION);
+ log_info(copyright);
diff --git a/src/patches/dhcp/dhcp-remove-bind.patch b/src/patches/dhcp/dhcp-remove-bind.patch
new file mode 100644
index 0000000..5ab0338
--- /dev/null
+++ b/src/patches/dhcp/dhcp-remove-bind.patch
@@ -0,0 +1,192 @@
+diff -up dhcp-4.3.1b1/client/Makefile.am.brGmwh dhcp-4.3.1b1/client/Makefile.am
+--- dhcp-4.3.1b1/client/Makefile.am.brGmwh 2014-07-02 19:58:38.000000000 +0200
++++ dhcp-4.3.1b1/client/Makefile.am 2014-07-10 17:36:30.484250976 +0200
+@@ -10,8 +10,8 @@ dhclient_SOURCES = clparse.c dhclient.c
+ scripts/bsdos scripts/freebsd scripts/linux scripts/macos \
+ scripts/netbsd scripts/nextstep scripts/openbsd \
+ scripts/solaris scripts/openwrt
+-dhclient_LDADD = ../common/libdhcp.a ../omapip/libomapi.a ../bind/lib/libirs.a \
+- ../bind/lib/libdns.a ../bind/lib/libisccfg.a ../bind/lib/libisc.a
++dhclient_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \
++ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+ man_MANS = dhclient.8 dhclient-script.8 dhclient.conf.5 dhclient.leases.5
+ EXTRA_DIST = $(man_MANS)
+
+diff -up dhcp-4.3.1b1/common/tests/Makefile.am.brGmwh dhcp-4.3.1b1/common/tests/Makefile.am
+--- dhcp-4.3.1b1/common/tests/Makefile.am.brGmwh 2014-07-10 17:36:30.485250962 +0200
++++ dhcp-4.3.1b1/common/tests/Makefile.am 2014-07-10 17:38:04.010924566 +0200
+@@ -13,21 +13,20 @@ ATF_TESTS += alloc_unittest dns_unittest
+ alloc_unittest_SOURCES = test_alloc.c $(top_srcdir)/tests/t_api_dhcp.c
+ alloc_unittest_LDADD = $(ATF_LDFLAGS)
+ alloc_unittest_LDADD += ../libdhcp.a \
+- ../../omapip/libomapi.a ../../bind/lib/libirs.a \
+- ../../bind/lib/libdns.a ../../bind/lib/libisccfg.a ../../bind/lib/libisc.a
++ ../../omapip/libomapi.a \
++ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+
+ dns_unittest_SOURCES = dns_unittest.c $(top_srcdir)/tests/t_api_dhcp.c
+ dns_unittest_LDADD = $(ATF_LDFLAGS)
+ dns_unittest_LDADD += ../libdhcp.a \
+- ../../omapip/libomapi.a ../../bind/lib/libirs.a \
+- ../../bind/lib/libdns.a ../../bind/lib/libisccfg.a ../../bind/lib/libisc.a
++ ../../omapip/libomapi.a \
++ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+
+ misc_unittest_SOURCES = misc_unittest.c $(top_srcdir)/tests/t_api_dhcp.c
+ misc_unittest_LDADD = $(ATF_LDFLAGS)
+ misc_unittest_LDADD += ../libdhcp.a \
+- ../../omapip/libomapi.a ../../bind/lib/libirs.a \
+- ../../bind/lib/libdns.a ../../bind/lib/libisccfg.a ../../bind/lib/libisc.a
+-
++ ../../omapip/libomapi.a \
++ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+ check: $(ATF_TESTS)
+ atf-run | atf-report
+
+diff -up dhcp-4.3.1b1/configure.ac.brGmwh dhcp-4.3.1b1/configure.ac
+--- dhcp-4.3.1b1/configure.ac.brGmwh 2014-07-02 20:01:26.000000000 +0200
++++ dhcp-4.3.1b1/configure.ac 2014-07-10 17:36:30.485250962 +0200
+@@ -562,20 +562,37 @@ AC_CHECK_MEMBER(struct msghdr.msg_contro
+
+ libbind=
+ AC_ARG_WITH(libbind,
+- AS_HELP_STRING([--with-libbind=PATH],[bind includes and libraries are in PATH
+- (default is ./bind)]),
++ AS_HELP_STRING([--with-libbind=PATH],[bind includes are in PATH
++ (default is ./bind/includes)]),
+ use_libbind="$withval", use_libbind="no")
+ case "$use_libbind" in
++yes|no)
++ libbind="\${top_srcdir}/bind/include"
++ ;;
++*)
++ libbind="$use_libbind"
++ ;;
++esac
++
++BIND9_LIBDIR='-L$(top_builddir)/bind/lib'
++AC_ARG_WITH(libbind-libs,
++ AC_HELP_STRING([--with-libbind-libs=PATH],
++ [bind9 export libraries are in PATH]),
++ [libbind_libs="$withval"], [libbind_libs='no'])
++case "$libbind_libs" in
+ yes)
+- libbind="\${top_srcdir}/bind"
++ AC_MSG_ERROR([Specify path to bind9 libraries])
+ ;;
+ no)
+- libbind="\${top_srcdir}/bind"
++ BUNDLED_BIND=yes
+ ;;
+ *)
+- libbind="$use_libbind"
++ BIND9_LIBDIR="-L$libbind_libs"
++ BUNDLED_BIND=no
+ ;;
+ esac
++AM_CONDITIONAL([BUNDLED_BIND], [test "$BUNDLED_BIND" = yes])
++AC_SUBST([BIND9_LIBDIR])
+
+ # OpenLDAP support.
+ AC_ARG_WITH(ldap,
+@@ -610,7 +627,7 @@ fi
+ CFLAGS="$CFLAGS $STD_CWARNINGS"
+
+ # Try to add the bind include directory
+-CFLAGS="$CFLAGS -I$libbind/include"
++CFLAGS="$CFLAGS -I$libbind"
+
+ case "$host" in
+ *-darwin*)
+diff -up dhcp-4.3.1b1/dhcpctl/Makefile.am.brGmwh dhcp-4.3.1b1/dhcpctl/Makefile.am
+--- dhcp-4.3.1b1/dhcpctl/Makefile.am.brGmwh 2014-07-02 19:58:38.000000000 +0200
++++ dhcp-4.3.1b1/dhcpctl/Makefile.am 2014-07-10 17:36:30.485250962 +0200
+@@ -6,12 +6,9 @@ EXTRA_DIST = $(man_MANS)
+
+ omshell_SOURCES = omshell.c
+ omshell_LDADD = libdhcpctl.a ../common/libdhcp.a ../omapip/libomapi.a \
+- ../bind/lib/libirs.a ../bind/lib/libdns.a \
+- ../bind/lib/libisccfg.a ../bind/lib/libisc.a
+-
++ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+ libdhcpctl_a_SOURCES = dhcpctl.c callback.c remote.c
+
+ cltest_SOURCES = cltest.c
+ cltest_LDADD = libdhcpctl.a ../common/libdhcp.a ../omapip/libomapi.a \
+- ../bind/lib/libirs.a ../bind/lib/libdns.a \
+- ../bind/lib/libisccfg.a ../bind/lib/libisc.a
++ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+diff -up dhcp-4.3.1b1/Makefile.am.brGmwh dhcp-4.3.1b1/Makefile.am
+--- dhcp-4.3.1b1/Makefile.am.brGmwh 2014-07-02 19:58:38.000000000 +0200
++++ dhcp-4.3.1b1/Makefile.am 2014-07-10 17:36:30.484250976 +0200
+@@ -25,7 +25,13 @@ EXTRA_DIST = RELNOTES LICENSE \
+ bind/Makefile bind/bind.tar.gz bind/version.tmp \
+ common/tests/Atffile server/tests/Atffile
+
+-SUBDIRS = bind includes tests common dst omapip client dhcpctl relay server
++if BUNDLED_BIND
++SUBDIRS = bind
++else
++SUBDIRS =
++endif
++
++SUBDIRS += includes tests common dst omapip client dhcpctl relay server
+
+ nobase_include_HEADERS = dhcpctl/dhcpctl.h
+
+diff -up dhcp-4.3.1b1/omapip/Makefile.am.brGmwh dhcp-4.3.1b1/omapip/Makefile.am
+--- dhcp-4.3.1b1/omapip/Makefile.am.brGmwh 2014-07-02 19:58:39.000000000 +0200
++++ dhcp-4.3.1b1/omapip/Makefile.am 2014-07-10 17:36:30.486250948 +0200
+@@ -10,6 +10,5 @@ man_MANS = omapi.3
+ EXTRA_DIST = $(man_MANS)
+
+ svtest_SOURCES = test.c
+-svtest_LDADD = libomapi.a ../bind/lib/libirs.a ../bind/lib/libdns.a \
+- ../bind/lib/libisccfg.a ../bind/lib/libisc.a
+-
++svtest_LDADD = libomapi.a \
++ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+diff -up dhcp-4.3.1b1/relay/Makefile.am.brGmwh dhcp-4.3.1b1/relay/Makefile.am
+--- dhcp-4.3.1b1/relay/Makefile.am.brGmwh 2014-07-02 19:58:39.000000000 +0200
++++ dhcp-4.3.1b1/relay/Makefile.am 2014-07-10 17:36:30.486250948 +0200
+@@ -3,8 +3,7 @@ AM_CPPFLAGS = -DLOCALSTATEDIR='"@localst
+ sbin_PROGRAMS = dhcrelay
+ dhcrelay_SOURCES = dhcrelay.c
+ dhcrelay_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \
+- ../bind/lib/libirs.a ../bind/lib/libdns.a \
+- ../bind/lib/libisccfg.a ../bind/lib/libisc.a
++ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+ man_MANS = dhcrelay.8
+ EXTRA_DIST = $(man_MANS)
+
+diff -up dhcp-4.3.1b1/server/Makefile.am.brGmwh dhcp-4.3.1b1/server/Makefile.am
+--- dhcp-4.3.1b1/server/Makefile.am.brGmwh 2014-07-02 19:58:39.000000000 +0200
++++ dhcp-4.3.1b1/server/Makefile.am 2014-07-10 17:36:30.486250948 +0200
+@@ -13,10 +13,8 @@ dhcpd_SOURCES = dhcpd.c dhcp.c bootp.c c
+ dhcpv6.c mdb6.c ldap.c ldap_casa.c
+
+ dhcpd_CFLAGS = $(LDAP_CFLAGS)
+-dhcpd_LDADD = ../common/libdhcp.a ../omapip/libomapi.a \
+- ../dhcpctl/libdhcpctl.a ../bind/lib/libirs.a \
+- ../bind/lib/libdns.a ../bind/lib/libisccfg.a ../bind/lib/libisc.a
+-
++dhcpd_LDADD = ../common/libdhcp.a ../omapip/libomapi.a ../dhcpctl/libdhcpctl.a \
++ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+ man_MANS = dhcpd.8 dhcpd.conf.5 dhcpd.leases.5
+ EXTRA_DIST = $(man_MANS)
+
+diff -up dhcp-4.3.1b1/server/tests/Makefile.am.brGmwh dhcp-4.3.1b1/server/tests/Makefile.am
+--- dhcp-4.3.1b1/server/tests/Makefile.am.brGmwh 2014-07-02 19:58:40.000000000 +0200
++++ dhcp-4.3.1b1/server/tests/Makefile.am 2014-07-10 17:36:30.486250948 +0200
+@@ -18,9 +18,8 @@ DHCPSRC = ../dhcp.c ../bootp.c ../confpa
+ ../ldap.c ../ldap_casa.c ../dhcpd.c
+
+ DHCPLIBS = $(top_builddir)/common/libdhcp.a $(top_builddir)/omapip/libomapi.a \
+- $(top_builddir)/dhcpctl/libdhcpctl.a $(top_builddir)/bind/lib/libirs.a \
+- $(top_builddir)/bind/lib/libdns.a $(top_builddir)/bind/lib/libisccfg.a \
+- $(top_builddir)/bind/lib/libisc.a
++ $(top_builddir)/dhcpctl/libdhcpctl.a \
++ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+
+ ATF_TESTS =
+ TESTS =
diff --git a/src/patches/dhcp/dhcp-rfc3442-classless-static-routes.patch b/src/patches/dhcp/dhcp-rfc3442-classless-static-routes.patch
new file mode 100644
index 0000000..94ed5ba
--- /dev/null
+++ b/src/patches/dhcp/dhcp-rfc3442-classless-static-routes.patch
@@ -0,0 +1,405 @@
+diff -up dhcp-4.3.0rc1/client/clparse.c.rfc3442 dhcp-4.3.0rc1/client/clparse.c
+--- dhcp-4.3.0rc1/client/clparse.c.rfc3442 2014-01-29 10:05:48.474400352 +0100
++++ dhcp-4.3.0rc1/client/clparse.c 2014-01-29 10:05:48.517399955 +0100
+@@ -31,7 +31,7 @@
+
+ struct client_config top_level_config;
+
+-#define NUM_DEFAULT_REQUESTED_OPTS 14
++#define NUM_DEFAULT_REQUESTED_OPTS 15
+ struct option *default_requested_options[NUM_DEFAULT_REQUESTED_OPTS + 1];
+
+ static void parse_client_default_duid(struct parse *cfile);
+@@ -84,7 +84,11 @@ isc_result_t read_client_conf ()
+ dhcp_universe.code_hash, &code, 0, MDL);
+
+ /* 4 */
+- code = DHO_ROUTERS;
++ /* The Classless Static Routes option code MUST appear in the parameter
++ * request list prior to both the Router option code and the Static
++ * Routes option code, if present. (RFC3442)
++ */
++ code = DHO_CLASSLESS_STATIC_ROUTES;
+ option_code_hash_lookup(&default_requested_options[3],
+ dhcp_universe.code_hash, &code, 0, MDL);
+
+@@ -138,6 +142,11 @@ isc_result_t read_client_conf ()
+ option_code_hash_lookup(&default_requested_options[13],
+ dhcp_universe.code_hash, &code, 0, MDL);
+
++ /* 15 */
++ code = DHO_ROUTERS;
++ option_code_hash_lookup(&default_requested_options[14],
++ dhcp_universe.code_hash, &code, 0, MDL);
++
+ for (code = 0 ; code < NUM_DEFAULT_REQUESTED_OPTS ; code++) {
+ if (default_requested_options[code] == NULL)
+ log_fatal("Unable to find option definition for "
+diff -up dhcp-4.3.0rc1/common/dhcp-options.5.rfc3442 dhcp-4.3.0rc1/common/dhcp-options.5
+--- dhcp-4.3.0rc1/common/dhcp-options.5.rfc3442 2014-01-29 10:05:48.466400426 +0100
++++ dhcp-4.3.0rc1/common/dhcp-options.5 2014-01-29 10:05:48.518399945 +0100
+@@ -111,6 +111,26 @@ hexadecimal, separated by colons. For e
+ or
+ option dhcp-client-identifier 43:4c:49:45:54:2d:46:4f:4f;
+ .fi
++.PP
++The
++.B destination-descriptor
++describe the IP subnet number and subnet mask
++of a particular destination using a compact encoding. This encoding
++consists of one octet describing the width of the subnet mask,
++followed by all the significant octets of the subnet number.
++The following table contains some examples of how various subnet
++number/mask combinations can be encoded:
++.nf
++.sp 1
++Subnet number Subnet mask Destination descriptor
++0 0 0
++10.0.0.0 255.0.0.0 8.10
++10.0.0.0 255.255.255.0 24.10.0.0
++10.17.0.0 255.255.0.0 16.10.17
++10.27.129.0 255.255.255.0 24.10.27.129
++10.229.0.128 255.255.255.128 25.10.229.0.128
++10.198.122.47 255.255.255.255 32.10.198.122.47
++.fi
+ .SH SETTING OPTION VALUES USING EXPRESSIONS
+ Sometimes it's helpful to be able to set the value of a DHCP option
+ based on some value that the client has sent. To do this, you can
+@@ -972,6 +992,29 @@ dhclient-script will create routes:
+ .RE
+ .PP
+ .nf
++.B option \fBclassless-static-routes\fR \fIdestination-descriptor ip-address\fR
++ [\fB,\fR \fIdestination-descriptor ip-address\fR...]\fB;\fR
++.fi
++.RS 0.25i
++.PP
++This option (see RFC3442) specifies a list of classless static routes
++that the client should install in its routing cache.
++.PP
++This option can contain one or more static routes, each of which
++consists of a destination descriptor and the IP address of the router
++that should be used to reach that destination.
++.PP
++Many clients may not implement the Classless Static Routes option.
++DHCP server administrators should therefore configure their DHCP
++servers to send both a Router option and a Classless Static Routes
++option, and should specify the default router(s) both in the Router
++option and in the Classless Static Routes option.
++.PP
++If the DHCP server returns both a Classless Static Routes option and
++a Router option, the DHCP client ignores the Router option.
++.RE
++.PP
++.nf
+ .B option \fBstreettalk-directory-assistance-server\fR \fIip-address\fR
+ [\fB,\fR \fIip-address\fR...]\fB;\fR
+ .fi
+diff -up dhcp-4.3.0rc1/common/inet.c.rfc3442 dhcp-4.3.0rc1/common/inet.c
+--- dhcp-4.3.0rc1/common/inet.c.rfc3442 2014-01-26 19:40:44.000000000 +0100
++++ dhcp-4.3.0rc1/common/inet.c 2014-01-29 10:05:48.519399936 +0100
+@@ -521,6 +521,60 @@ free_iaddrcidrnetlist(struct iaddrcidrne
+ return ISC_R_SUCCESS;
+ }
+
++static const char *
++inet_ntopdd(const unsigned char *src, unsigned srclen, char *dst, size_t size)
++{
++ char tmp[sizeof("32.255.255.255.255")];
++ int len;
++
++ switch (srclen) {
++ case 2:
++ len = sprintf (tmp, "%u.%u", src[0], src[1]);
++ break;
++ case 3:
++ len = sprintf (tmp, "%u.%u.%u", src[0], src[1], src[2]);
++ break;
++ case 4:
++ len = sprintf (tmp, "%u.%u.%u.%u", src[0], src[1], src[2], src[3]);
++ break;
++ case 5:
++ len = sprintf (tmp, "%u.%u.%u.%u.%u", src[0], src[1], src[2], src[3], src[4]);
++ break;
++ default:
++ return NULL;
++ }
++ if (len < 0)
++ return NULL;
++
++ if (len > size) {
++ errno = ENOSPC;
++ return NULL;
++ }
++
++ return strcpy (dst, tmp);
++}
++
++/* pdestdesc() turns an iaddr structure into a printable dest. descriptor */
++const char *
++pdestdesc(const struct iaddr addr) {
++ static char pbuf[sizeof("255.255.255.255.255")];
++
++ if (addr.len == 0) {
++ return "<null destination descriptor>";
++ }
++ if (addr.len == 1) {
++ return "0";
++ }
++ if ((addr.len >= 2) && (addr.len <= 5)) {
++ return inet_ntopdd(addr.iabuf, addr.len, pbuf, sizeof(pbuf));
++ }
++
++ log_fatal("pdestdesc():%s:%d: Invalid destination descriptor length %d.",
++ MDL, addr.len);
++ /* quell compiler warnings */
++ return NULL;
++}
++
+ /* piaddr() turns an iaddr structure into a printable address. */
+ /* XXX: should use a const pointer rather than passing the structure */
+ const char *
+diff -up dhcp-4.3.0rc1/common/options.c.rfc3442 dhcp-4.3.0rc1/common/options.c
+--- dhcp-4.3.0rc1/common/options.c.rfc3442 2014-01-26 19:40:44.000000000 +0100
++++ dhcp-4.3.0rc1/common/options.c 2014-01-29 10:05:48.520399927 +0100
+@@ -707,7 +707,11 @@ cons_options(struct packet *inpacket, st
+ * packet.
+ */
+ priority_list[priority_len++] = DHO_SUBNET_MASK;
+- priority_list[priority_len++] = DHO_ROUTERS;
++ if (lookup_option(&dhcp_universe, cfg_options,
++ DHO_CLASSLESS_STATIC_ROUTES))
++ priority_list[priority_len++] = DHO_CLASSLESS_STATIC_ROUTES;
++ else
++ priority_list[priority_len++] = DHO_ROUTERS;
+ priority_list[priority_len++] = DHO_DOMAIN_NAME_SERVERS;
+ priority_list[priority_len++] = DHO_HOST_NAME;
+ priority_list[priority_len++] = DHO_FQDN;
+@@ -1688,6 +1692,7 @@ const char *pretty_print_option (option,
+ unsigned long tval;
+ isc_boolean_t a_array = ISC_FALSE;
+ int len_used;
++ unsigned int octets = 0;
+
+ if (emit_commas)
+ comma = ',';
+@@ -1696,6 +1701,7 @@ const char *pretty_print_option (option,
+
+ memset (enumbuf, 0, sizeof enumbuf);
+
++ if (option->format[0] != 'R') { /* see explanation lower */
+ /* Figure out the size of the data. */
+ for (l = i = 0; option -> format [i]; i++, l++) {
+ if (l >= sizeof(fmtbuf) - 1)
+@@ -1870,6 +1876,33 @@ const char *pretty_print_option (option,
+ if (numhunk < 0)
+ numhunk = 1;
+
++ } else { /* option->format[i] == 'R') */
++ /* R (destination descriptor) has variable length.
++ * We can find it only in classless static route option,
++ * so we are for sure parsing classless static route option now.
++ * We go through whole the option to check whether there are no
++ * missing/extra bytes.
++ * I didn't find out how to improve the existing code and that's the
++ * reason for this separate 'else' where I do my own checkings.
++ * I know it's little bit unsystematic, but it works.
++ */
++ numhunk = 0;
++ numelem = 2; /* RI */
++ fmtbuf[0]='R'; fmtbuf[1]='I'; fmtbuf[2]=0;
++ for (i =0; i < len; i = i + octets + 5) {
++ if (data[i] > 32) { /* subnet mask width */
++ log_error ("wrong subnet mask width in destination descriptor");
++ break;
++ }
++ numhunk++;
++ octets = ((data[i]+7) / 8);
++ }
++ if (i != len) {
++ log_error ("classless static routes option has wrong size or "
++ "there's some garbage in format");
++ }
++ }
++
+ /* Cycle through the array (or hunk) printing the data. */
+ for (i = 0; i < numhunk; i++) {
+ if ((a_array == ISC_TRUE) && (i != 0) && (numelem > 0)) {
+@@ -2025,6 +2058,20 @@ const char *pretty_print_option (option,
+ strcpy(op, piaddr(iaddr));
+ dp += 4;
+ break;
++
++ case 'R':
++ if (dp[0] <= 32)
++ iaddr.len = (((dp[0]+7)/8)+1);
++ else {
++ log_error ("wrong subnet mask width in destination descriptor");
++ return "<error>";
++ }
++
++ memcpy(iaddr.iabuf, dp, iaddr.len);
++ strcpy(op, pdestdesc(iaddr));
++ dp += iaddr.len;
++ break;
++
+ case '6':
+ iaddr.len = 16;
+ memcpy(iaddr.iabuf, dp, 16);
+diff -up dhcp-4.3.0rc1/common/parse.c.rfc3442 dhcp-4.3.0rc1/common/parse.c
+--- dhcp-4.3.0rc1/common/parse.c.rfc3442 2014-01-29 10:05:48.491400195 +0100
++++ dhcp-4.3.0rc1/common/parse.c 2014-01-29 10:05:48.522399908 +0100
+@@ -335,6 +335,39 @@ int parse_ip_addr (cfile, addr)
+ }
+
+ /*
++ * destination-descriptor :== NUMBER DOT NUMBER |
++ * NUMBER DOT NUMBER DOT NUMBER |
++ * NUMBER DOT NUMBER DOT NUMBER DOT NUMBER |
++ * NUMBER DOT NUMBER DOT NUMBER DOT NUMBER DOT NUMBER
++ */
++
++int parse_destination_descriptor (cfile, addr)
++ struct parse *cfile;
++ struct iaddr *addr;
++{
++ unsigned int mask_width, dest_dest_len;
++ addr -> len = 0;
++ if (parse_numeric_aggregate (cfile, addr -> iabuf,
++ &addr -> len, DOT, 10, 8)) {
++ mask_width = (unsigned int)addr->iabuf[0];
++ dest_dest_len = (((mask_width+7)/8)+1);
++ if (mask_width > 32) {
++ parse_warn (cfile,
++ "subnet mask width (%u) greater than 32.", mask_width);
++ }
++ else if (dest_dest_len != addr->len) {
++ parse_warn (cfile,
++ "destination descriptor with subnet mask width %u "
++ "should have %u octets, but has %u octets.",
++ mask_width, dest_dest_len, addr->len);
++ }
++
++ return 1;
++ }
++ return 0;
++}
++
++/*
+ * Return true if every character in the string is hexadecimal.
+ */
+ static int
+@@ -713,8 +746,10 @@ unsigned char *parse_numeric_aggregate (
+ if (count) {
+ token = peek_token (&val, (unsigned *)0, cfile);
+ if (token != separator) {
+- if (!*max)
++ if (!*max) {
++ *max = count;
+ break;
++ }
+ if (token != RBRACE && token != LBRACE)
+ token = next_token (&val,
+ (unsigned *)0,
+@@ -1654,6 +1689,9 @@ int parse_option_code_definition (cfile,
+ case IP_ADDRESS:
+ type = 'I';
+ break;
++ case DESTINATION_DESCRIPTOR:
++ type = 'R';
++ break;
+ case IP6_ADDRESS:
+ type = '6';
+ break;
+@@ -5071,6 +5109,15 @@ int parse_option_token (rv, cfile, fmt,
+ }
+ break;
+
++ case 'R': /* destination descriptor */
++ if (!parse_destination_descriptor (cfile, &addr)) {
++ return 0;
++ }
++ if (!make_const_data (&t, addr.iabuf, addr.len, 0, 1, MDL)) {
++ return 0;
++ }
++ break;
++
+ case '6': /* IPv6 address. */
+ if (!parse_ip6_addr(cfile, &addr)) {
+ return 0;
+@@ -5348,6 +5395,13 @@ int parse_option_decl (oc, cfile)
+ goto exit;
+ len = ip_addr.len;
+ dp = ip_addr.iabuf;
++ goto alloc;
++
++ case 'R': /* destination descriptor */
++ if (!parse_destination_descriptor (cfile, &ip_addr))
++ goto exit;
++ len = ip_addr.len;
++ dp = ip_addr.iabuf;
+
+ alloc:
+ if (hunkix + len > sizeof hunkbuf) {
+diff -up dhcp-4.3.0rc1/common/tables.c.rfc3442 dhcp-4.3.0rc1/common/tables.c
+--- dhcp-4.3.0rc1/common/tables.c.rfc3442 2014-01-29 10:05:48.485400250 +0100
++++ dhcp-4.3.0rc1/common/tables.c 2014-01-29 10:06:25.724038563 +0100
+@@ -46,6 +46,7 @@ HASH_FUNCTIONS (option_code, const unsig
+ Format codes:
+
+ I - IPv4 address
++ R - destination descriptor (RFC3442)
+ 6 - IPv6 address
+ l - 32-bit signed integer
+ L - 32-bit unsigned integer
+@@ -214,6 +215,7 @@ static struct option dhcp_options[] = {
+ #endif
+ { "subnet-selection", "I", &dhcp_universe, 118, 1 },
+ { "domain-search", "D", &dhcp_universe, 119, 1 },
++ { "classless-static-routes", "RIA", &dhcp_universe, 121, 1 },
+ { "vivco", "Evendor-class.", &dhcp_universe, 124, 1 },
+ { "vivso", "Evendor.", &dhcp_universe, 125, 1 },
+ #if 0
+diff -up dhcp-4.3.0rc1/includes/dhcpd.h.rfc3442 dhcp-4.3.0rc1/includes/dhcpd.h
+--- dhcp-4.3.0rc1/includes/dhcpd.h.rfc3442 2014-01-29 10:05:48.470400389 +0100
++++ dhcp-4.3.0rc1/includes/dhcpd.h 2014-01-29 10:05:48.525399881 +0100
+@@ -2725,6 +2725,7 @@ isc_result_t range2cidr(struct iaddrcidr
+ const struct iaddr *lo, const struct iaddr *hi);
+ isc_result_t free_iaddrcidrnetlist(struct iaddrcidrnetlist **result);
+ const char *piaddr (struct iaddr);
++const char *pdestdesc (struct iaddr);
+ char *piaddrmask(struct iaddr *, struct iaddr *);
+ char *piaddrcidr(const struct iaddr *, unsigned int);
+ u_int16_t validate_port(char *);
+@@ -2934,6 +2935,7 @@ void parse_client_lease_declaration (str
+ int parse_option_decl (struct option_cache **, struct parse *);
+ void parse_string_list (struct parse *, struct string_list **, int);
+ int parse_ip_addr (struct parse *, struct iaddr *);
++int parse_destination_descriptor (struct parse *, struct iaddr *);
+ int parse_ip_addr_with_subnet(struct parse *, struct iaddrmatch *);
+ void parse_reject_statement (struct parse *, struct client_config *);
+
+diff -up dhcp-4.3.0rc1/includes/dhcp.h.rfc3442 dhcp-4.3.0rc1/includes/dhcp.h
+--- dhcp-4.3.0rc1/includes/dhcp.h.rfc3442 2014-01-26 19:40:44.000000000 +0100
++++ dhcp-4.3.0rc1/includes/dhcp.h 2014-01-29 10:05:48.524399890 +0100
+@@ -159,6 +159,7 @@ struct dhcp_packet {
+ #define DHO_ASSOCIATED_IP 92
+ #define DHO_SUBNET_SELECTION 118 /* RFC3011! */
+ #define DHO_DOMAIN_SEARCH 119 /* RFC3397 */
++#define DHO_CLASSLESS_STATIC_ROUTES 121 /* RFC3442 */
+ #define DHO_VIVCO_SUBOPTIONS 124
+ #define DHO_VIVSO_SUBOPTIONS 125
+
+diff -up dhcp-4.3.0rc1/includes/dhctoken.h.rfc3442 dhcp-4.3.0rc1/includes/dhctoken.h
+--- dhcp-4.3.0rc1/includes/dhctoken.h.rfc3442 2014-01-29 10:05:48.435400713 +0100
++++ dhcp-4.3.0rc1/includes/dhctoken.h 2014-01-29 10:05:48.526399871 +0100
+@@ -368,7 +368,8 @@ enum dhcp_token {
+ POOL6 = 669,
+ V6RELAY = 670,
+ V6RELOPT = 671,
+- BOOTP_BROADCAST_ALWAYS = 672
++ BOOTP_BROADCAST_ALWAYS = 672,
++ DESTINATION_DESCRIPTOR = 673
+ };
+
+ #define is_identifier(x) ((x) >= FIRST_TOKEN && \
diff --git a/src/patches/dhcp/dhcp-sendDecline.patch b/src/patches/dhcp/dhcp-sendDecline.patch
new file mode 100644
index 0000000..e683366
--- /dev/null
+++ b/src/patches/dhcp/dhcp-sendDecline.patch
@@ -0,0 +1,231 @@
+diff -up dhcp-4.3.0a1/client/dhc6.c.sendDecline dhcp-4.3.0a1/client/dhc6.c
+--- dhcp-4.3.0a1/client/dhc6.c.sendDecline 2013-12-11 01:25:12.000000000 +0100
++++ dhcp-4.3.0a1/client/dhc6.c 2013-12-19 15:56:18.297660118 +0100
+@@ -96,6 +96,8 @@ void do_select6(void *input);
+ void do_refresh6(void *input);
+ static void do_release6(void *input);
+ static void start_bound(struct client_state *client);
++static void start_decline6(struct client_state *client);
++static void do_decline6(void *input);
+ static void start_informed(struct client_state *client);
+ void informed_handler(struct packet *packet, struct client_state *client);
+ void bound_handler(struct packet *packet, struct client_state *client);
+@@ -2017,6 +2019,7 @@ start_release6(struct client_state *clie
+ cancel_timeout(do_select6, client);
+ cancel_timeout(do_refresh6, client);
+ cancel_timeout(do_release6, client);
++ cancel_timeout(do_decline6, client);
+ client->state = S_STOPPED;
+
+ /*
+@@ -2650,6 +2653,7 @@ dhc6_check_reply(struct client_state *cl
+ break;
+
+ case S_STOPPED:
++ case S_DECLINED:
+ action = dhc6_stop_action;
+ break;
+
+@@ -2751,6 +2755,7 @@ dhc6_check_reply(struct client_state *cl
+ break;
+
+ case S_STOPPED:
++ case S_DECLINED:
+ /* Nothing critical to do at this stage. */
+ break;
+
+@@ -3741,17 +3746,23 @@ reply_handler(struct packet *packet, str
+ cancel_timeout(do_select6, client);
+ cancel_timeout(do_refresh6, client);
+ cancel_timeout(do_release6, client);
++ cancel_timeout(do_decline6, client);
+
+ /* If this is in response to a Release/Decline, clean up and return. */
+- if (client->state == S_STOPPED) {
+- if (client->active_lease == NULL)
+- return;
++ if ((client->state == S_STOPPED) ||
++ (client->state == S_DECLINED)) {
++
++ if (client->active_lease != NULL) {
++ dhc6_lease_destroy(&client->active_lease, MDL);
++ client->active_lease = NULL;
++ /* We should never wait for nothing!? */
++ if (stopping_finished())
++ exit(0);
++ }
++
++ if (client->state == S_DECLINED)
++ start_init6(client);
+
+- dhc6_lease_destroy(&client->active_lease, MDL);
+- client->active_lease = NULL;
+- /* We should never wait for nothing!? */
+- if (stopping_finished())
+- exit(0);
+ return;
+ }
+
+@@ -4279,7 +4290,11 @@ start_bound(struct client_state *client)
+ dhc6_marshall_values("new_", client, lease, ia, addr);
+ script_write_requested6(client);
+
+- script_go(client);
++ // when script returns 3, DAD failed
++ if (script_go(client) == 3) {
++ start_decline6(client);
++ return;
++ }
+ }
+
+ /* XXX: maybe we should loop on the old values instead? */
+@@ -4327,6 +4342,149 @@ start_bound(struct client_state *client)
+ dhc6_check_times(client);
+ }
+
++/*
++ * Decline addresses.
++ */
++void
++start_decline6(struct client_state *client)
++{
++ /* Cancel any pending transmissions */
++ cancel_timeout(do_confirm6, client);
++ cancel_timeout(do_select6, client);
++ cancel_timeout(do_refresh6, client);
++ cancel_timeout(do_release6, client);
++ cancel_timeout(do_decline6, client);
++ client->state = S_DECLINED;
++
++ if (client->active_lease == NULL)
++ return;
++
++ /* Set timers per RFC3315 section 18.1.7. */
++ client->IRT = DEC_TIMEOUT * 100;
++ client->MRT = 0;
++ client->MRC = DEC_MAX_RC;
++ client->MRD = 0;
++
++ dhc6_retrans_init(client);
++ client->v6_handler = reply_handler;
++
++ client->refresh_type = DHCPV6_DECLINE;
++ do_decline6(client);
++}
++
++/*
++ * do_decline6() creates a Decline packet and transmits it.
++ */
++static void
++do_decline6(void *input)
++{
++ struct client_state *client;
++ struct data_string ds;
++ int send_ret;
++ struct timeval elapsed, tv;
++
++ client = input;
++
++ if ((client->active_lease == NULL) || !active_prefix(client))
++ return;
++
++ if ((client->MRC != 0) && (client->txcount > client->MRC)) {
++ log_info("Max retransmission count exceeded.");
++ goto decline_done;
++ }
++
++ /*
++ * Start_time starts at the first transmission.
++ */
++ if (client->txcount == 0) {
++ client->start_time.tv_sec = cur_tv.tv_sec;
++ client->start_time.tv_usec = cur_tv.tv_usec;
++ }
++
++ /* elapsed = cur - start */
++ elapsed.tv_sec = cur_tv.tv_sec - client->start_time.tv_sec;
++ elapsed.tv_usec = cur_tv.tv_usec - client->start_time.tv_usec;
++ if (elapsed.tv_usec < 0) {
++ elapsed.tv_sec -= 1;
++ elapsed.tv_usec += 1000000;
++ }
++
++ memset(&ds, 0, sizeof(ds));
++ if (!buffer_allocate(&ds.buffer, 4, MDL)) {
++ log_error("Unable to allocate memory for Decline.");
++ goto decline_done;
++ }
++
++ ds.data = ds.buffer->data;
++ ds.len = 4;
++ ds.buffer->data[0] = DHCPV6_DECLINE;
++ memcpy(ds.buffer->data + 1, client->dhcpv6_transaction_id, 3);
++
++ /* Form an elapsed option. */
++ /* Maximum value is 65535 1/100s coded as 0xffff. */
++ if ((elapsed.tv_sec < 0) || (elapsed.tv_sec > 655) ||
++ ((elapsed.tv_sec == 655) && (elapsed.tv_usec > 350000))) {
++ client->elapsed = 0xffff;
++ } else {
++ client->elapsed = elapsed.tv_sec * 100;
++ client->elapsed += elapsed.tv_usec / 10000;
++ }
++
++ client->elapsed = htons(client->elapsed);
++
++ log_debug("XMT: Forming Decline.");
++ make_client6_options(client, &client->sent_options,
++ client->active_lease, DHCPV6_DECLINE);
++ dhcpv6_universe.encapsulate(&ds, NULL, NULL, client, NULL,
++ client->sent_options, &global_scope,
++ &dhcpv6_universe);
++
++ /* Append IA's (but don't release temporary addresses). */
++ if (wanted_ia_na &&
++ dhc6_add_ia_na(client, &ds, client->active_lease,
++ DHCPV6_DECLINE) != ISC_R_SUCCESS) {
++ data_string_forget(&ds, MDL);
++ goto decline_done;
++ }
++ if (wanted_ia_pd &&
++ dhc6_add_ia_pd(client, &ds, client->active_lease,
++ DHCPV6_DECLINE) != ISC_R_SUCCESS) {
++ data_string_forget(&ds, MDL);
++ goto decline_done;
++ }
++
++ /* Transmit and wait. */
++ log_info("XMT: Decline on %s, interval %ld0ms.",
++ client->name ? client->name : client->interface->name,
++ (long int)client->RT);
++
++ send_ret = send_packet6(client->interface, ds.data, ds.len,
++ &DHCPv6DestAddr);
++ if (send_ret != ds.len) {
++ log_error("dhc6: sendpacket6() sent %d of %d bytes",
++ send_ret, ds.len);
++ }
++
++ data_string_forget(&ds, MDL);
++
++ /* Wait RT */
++ tv.tv_sec = cur_tv.tv_sec + client->RT / 100;
++ tv.tv_usec = cur_tv.tv_usec + (client->RT % 100) * 10000;
++ if (tv.tv_usec >= 1000000) {
++ tv.tv_sec += 1;
++ tv.tv_usec -= 1000000;
++ }
++ add_timeout(&tv, do_decline6, client, NULL, NULL);
++ dhc6_retrans_advance(client);
++ return;
++
++decline_done:
++ dhc6_lease_destroy(&client->active_lease, MDL);
++ client->active_lease = NULL;
++ start_init6(client);
++ return;
++}
++
+ /* While bound, ignore packets. In the future we'll want to answer
+ * Reconfigure-Request messages and the like.
+ */
diff --git a/src/patches/dhcp/dhcp-sharedlib.patch b/src/patches/dhcp/dhcp-sharedlib.patch
new file mode 100644
index 0000000..abb2acc
--- /dev/null
+++ b/src/patches/dhcp/dhcp-sharedlib.patch
@@ -0,0 +1,107 @@
+diff -up dhcp-4.3.1b1/common/tests/Makefile.am.uCWMBl dhcp-4.3.1b1/common/tests/Makefile.am
+--- dhcp-4.3.1b1/common/tests/Makefile.am.uCWMBl 2014-07-10 17:38:10.779828569 +0200
++++ dhcp-4.3.1b1/common/tests/Makefile.am 2014-07-10 17:38:21.355678580 +0200
+@@ -13,19 +13,19 @@ ATF_TESTS += alloc_unittest dns_unittest
+ alloc_unittest_SOURCES = test_alloc.c $(top_srcdir)/tests/t_api_dhcp.c
+ alloc_unittest_LDADD = $(ATF_LDFLAGS)
+ alloc_unittest_LDADD += ../libdhcp.a \
+- ../../omapip/libomapi.a \
++ ../../omapip/libomapi.la \
+ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+
+ dns_unittest_SOURCES = dns_unittest.c $(top_srcdir)/tests/t_api_dhcp.c
+ dns_unittest_LDADD = $(ATF_LDFLAGS)
+-dns_unittest_LDADD += ../libdhcp.a \
++dns_unittest_LDADD += ../libdhcp.la \
+ ../../omapip/libomapi.a \
+ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+
+ misc_unittest_SOURCES = misc_unittest.c $(top_srcdir)/tests/t_api_dhcp.c
+ misc_unittest_LDADD = $(ATF_LDFLAGS)
+ misc_unittest_LDADD += ../libdhcp.a \
+- ../../omapip/libomapi.a \
++ ../../omapip/libomapi.la \
+ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+ check: $(ATF_TESTS)
+ atf-run | atf-report
+diff -up dhcp-4.3.1b1/configure.ac.uCWMBl dhcp-4.3.1b1/configure.ac
+--- dhcp-4.3.1b1/configure.ac.uCWMBl 2014-07-10 17:38:10.766828753 +0200
++++ dhcp-4.3.1b1/configure.ac 2014-07-10 17:38:10.779828569 +0200
+@@ -39,7 +39,8 @@ fi
+ # Use this to define _GNU_SOURCE to pull in the IPv6 Advanced Socket API.
+ AC_USE_SYSTEM_EXTENSIONS
+
+-AC_PROG_RANLIB
++# Use libtool to simplify building of shared libraries
++AC_PROG_LIBTOOL
+ AC_CONFIG_HEADERS([includes/config.h])
+
+ # we sometimes need to know byte order for building packets
+diff -up dhcp-4.3.1b1/dhcpctl/Makefile.am.uCWMBl dhcp-4.3.1b1/dhcpctl/Makefile.am
+--- dhcp-4.3.1b1/dhcpctl/Makefile.am.uCWMBl 2014-07-10 17:36:30.485250962 +0200
++++ dhcp-4.3.1b1/dhcpctl/Makefile.am 2014-07-10 17:38:10.780828554 +0200
+@@ -1,14 +1,14 @@
+ bin_PROGRAMS = omshell
+-lib_LIBRARIES = libdhcpctl.a
++lib_LTLIBRARIES = libdhcpctl.la
+ noinst_PROGRAMS = cltest
+ man_MANS = omshell.1 dhcpctl.3
+ EXTRA_DIST = $(man_MANS)
+
+ omshell_SOURCES = omshell.c
+-omshell_LDADD = libdhcpctl.a ../common/libdhcp.a ../omapip/libomapi.a \
++omshell_LDADD = libdhcpctl.la ../common/libdhcp.a ../omapip/libomapi.la \
+ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+-libdhcpctl_a_SOURCES = dhcpctl.c callback.c remote.c
++libdhcpctl_la_SOURCES = dhcpctl.c callback.c remote.c
+
+ cltest_SOURCES = cltest.c
+-cltest_LDADD = libdhcpctl.a ../common/libdhcp.a ../omapip/libomapi.a \
++cltest_LDADD = libdhcpctl.la ../common/libdhcp.a ../omapip/libomapi.la \
+ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+diff -up dhcp-4.3.1b1/omapip/Makefile.am.uCWMBl dhcp-4.3.1b1/omapip/Makefile.am
+--- dhcp-4.3.1b1/omapip/Makefile.am.uCWMBl 2014-07-10 17:36:30.486250948 +0200
++++ dhcp-4.3.1b1/omapip/Makefile.am 2014-07-10 17:38:10.780828554 +0200
+@@ -1,7 +1,7 @@
+-lib_LIBRARIES = libomapi.a
++lib_LTLIBRARIES = libomapi.la
+ noinst_PROGRAMS = svtest
+
+-libomapi_a_SOURCES = protocol.c buffer.c alloc.c result.c connection.c \
++libomapi_la_SOURCES = protocol.c buffer.c alloc.c result.c connection.c \
+ errwarn.c listener.c dispatch.c generic.c support.c \
+ handle.c message.c convert.c hash.c auth.c inet_addr.c \
+ array.c trace.c toisc.c iscprint.c isclib.c
+@@ -10,5 +10,5 @@ man_MANS = omapi.3
+ EXTRA_DIST = $(man_MANS)
+
+ svtest_SOURCES = test.c
+-svtest_LDADD = libomapi.a \
++svtest_LDADD = libomapi.la \
+ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+diff -up dhcp-4.3.1b1/server/Makefile.am.uCWMBl dhcp-4.3.1b1/server/Makefile.am
+--- dhcp-4.3.1b1/server/Makefile.am.uCWMBl 2014-07-10 17:36:30.486250948 +0200
++++ dhcp-4.3.1b1/server/Makefile.am 2014-07-10 17:38:10.780828554 +0200
+@@ -13,7 +13,7 @@ dhcpd_SOURCES = dhcpd.c dhcp.c bootp.c c
+ dhcpv6.c mdb6.c ldap.c ldap_casa.c
+
+ dhcpd_CFLAGS = $(LDAP_CFLAGS)
+-dhcpd_LDADD = ../common/libdhcp.a ../omapip/libomapi.a ../dhcpctl/libdhcpctl.a \
++dhcpd_LDADD = ../common/libdhcp.a ../omapip/libomapi.la ../dhcpctl/libdhcpctl.la \
+ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+ man_MANS = dhcpd.8 dhcpd.conf.5 dhcpd.leases.5
+ EXTRA_DIST = $(man_MANS)
+diff -up dhcp-4.3.1b1/server/tests/Makefile.am.uCWMBl dhcp-4.3.1b1/server/tests/Makefile.am
+--- dhcp-4.3.1b1/server/tests/Makefile.am.uCWMBl 2014-07-10 17:36:30.486250948 +0200
++++ dhcp-4.3.1b1/server/tests/Makefile.am 2014-07-10 17:38:10.780828554 +0200
+@@ -17,8 +17,8 @@ DHCPSRC = ../dhcp.c ../bootp.c ../confpa
+ ../ddns.c ../dhcpleasequery.c ../dhcpv6.c ../mdb6.c \
+ ../ldap.c ../ldap_casa.c ../dhcpd.c
+
+-DHCPLIBS = $(top_builddir)/common/libdhcp.a $(top_builddir)/omapip/libomapi.a \
+- $(top_builddir)/dhcpctl/libdhcpctl.a \
++DHCPLIBS = $(top_builddir)/common/libdhcp.a $(top_builddir)/omapip/libomapi.la \
++ $(top_builddir)/dhcpctl/libdhcpctl.la \
+ $(BIND9_LIBDIR) -lirs -ldns -lisccfg -lisc
+
+ ATF_TESTS =
diff --git a/src/patches/dhcp/dhcp-stateless-DUID-LLT.patch b/src/patches/dhcp/dhcp-stateless-DUID-LLT.patch
new file mode 100644
index 0000000..a7f22b5
--- /dev/null
+++ b/src/patches/dhcp/dhcp-stateless-DUID-LLT.patch
@@ -0,0 +1,48 @@
+From 61fa3dd9e789997f66e848c7e3fb2f554ee374e2 Mon Sep 17 00:00:00 2001
+From: Jiri Popelka <jpopelka(a)redhat.com>
+Date: Thu, 18 Dec 2014 11:53:26 +0100
+Subject: [PATCH] Write DUID_LLT even in stateless mode.
+
+By default, DHCPv6 dhclient creates DUID-LL
+if it is running in stateless mode (-6 -S) and
+doesn't write it into leases file, most likely
+because the DUID-LL is always generated the same.
+
+It's however possible to specify DUID to be of type LLT instead of LL
+with '-D LLT'. Rfc 3315 says that:
+'Clients and servers using this type of DUID MUST
+store the DUID-LLT in stable storage.'
+That's not fulfiled in this case (-6 -S -D LLT),
+because it's generated each time again.
+
+It's not a big deal because the server doesn't store any
+info about 'stateless' clients, so it doesn't matter
+that the DUID-LLT is different each time.
+But there's a TAHI test which tests this, i.e. that
+DUID-LLT is still the same even in stateless mode.
+It's a test DHCP_CONF.7.1.9, part B.
+https://www.ipv6ready.org/docs/Phase2_DHCPv6_Conformance_Latest.pdf
+
+Signed-off-by: Jiri Popelka <jpopelka(a)redhat.com>
+---
+ client/dhclient.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/client/dhclient.c b/client/dhclient.c
+index 5ef59cd..026e3fe 100644
+--- a/client/dhclient.c
++++ b/client/dhclient.c
+@@ -788,7 +788,9 @@ void run_stateless(int exit_mode)
+ if (default_duid.buffer != NULL)
+ data_string_forget(&default_duid, MDL);
+
+- form_duid(&default_duid, MDL);
++ if (form_duid(&default_duid, MDL) == ISC_R_SUCCESS &&
++ duid_type == DUID_LLT)
++ write_duid(&default_duid);
+ }
+
+ /* Start a configuration state machine. */
+--
+2.1.0
+
diff --git a/src/patches/dhcp/dhcp-unicast-bootp.patch b/src/patches/dhcp/dhcp-unicast-bootp.patch
new file mode 100644
index 0000000..a0db9de
--- /dev/null
+++ b/src/patches/dhcp/dhcp-unicast-bootp.patch
@@ -0,0 +1,101 @@
+diff -up dhcp-4.3.0a1/server/bootp.c.unicast dhcp-4.3.0a1/server/bootp.c
+--- dhcp-4.3.0a1/server/bootp.c.unicast 2013-12-11 01:25:12.000000000 +0100
++++ dhcp-4.3.0a1/server/bootp.c 2013-12-19 15:12:12.974671154 +0100
+@@ -59,6 +59,7 @@ void bootp (packet)
+ char msgbuf [1024];
+ int ignorep;
+ int peer_has_leases = 0;
++ int norelay = 0;
+
+ if (packet -> raw -> op != BOOTREQUEST)
+ return;
+@@ -74,7 +75,7 @@ void bootp (packet)
+ ? inet_ntoa (packet -> raw -> giaddr)
+ : packet -> interface -> name);
+
+- if (!locate_network (packet)) {
++ if ((norelay = locate_network (packet)) == 0) {
+ log_info ("%s: network unknown", msgbuf);
+ return;
+ }
+@@ -396,6 +397,15 @@ void bootp (packet)
+
+ goto out;
+ }
++ } else if (norelay == 2) {
++ to.sin_addr = raw.ciaddr;
++ to.sin_port = remote_port;
++ if (fallback_interface) {
++ result = send_packet (fallback_interface, NULL, &raw,
++ outgoing.packet_length, from,
++ &to, &hto);
++ goto out;
++ }
+
+ /* If it comes from a client that already knows its address
+ and is not requesting a broadcast response, and we can
+diff -up dhcp-4.3.0a1/server/dhcp.c.unicast dhcp-4.3.0a1/server/dhcp.c
+--- dhcp-4.3.0a1/server/dhcp.c.unicast 2013-12-13 21:50:38.000000000 +0100
++++ dhcp-4.3.0a1/server/dhcp.c 2013-12-19 15:12:12.975671140 +0100
+@@ -4627,6 +4627,7 @@ int locate_network (packet)
+ struct data_string data;
+ struct subnet *subnet = (struct subnet *)0;
+ struct option_cache *oc;
++ int norelay = 0;
+
+ /* See if there's a Relay Agent Link Selection Option, or a
+ * Subnet Selection Option. The Link-Select and Subnet-Select
+@@ -4642,12 +4643,24 @@ int locate_network (packet)
+ from the interface, if there is one. If not, fail. */
+ if (!oc && !packet -> raw -> giaddr.s_addr) {
+ if (packet -> interface -> shared_network) {
+- shared_network_reference
+- (&packet -> shared_network,
+- packet -> interface -> shared_network, MDL);
+- return 1;
++ struct in_addr any_addr;
++ any_addr.s_addr = INADDR_ANY;
++
++ if (!packet -> packet_type && memcmp(&packet -> raw -> ciaddr, &any_addr, 4)) {
++ struct iaddr cip;
++ memcpy(cip.iabuf, &packet -> raw -> ciaddr, 4);
++ cip.len = 4;
++ if (!find_grouped_subnet(&subnet, packet->interface->shared_network, cip, MDL))
++ norelay = 2;
++ }
++
++ if (!norelay) {
++ shared_network_reference(&packet -> shared_network, packet -> interface -> shared_network, MDL);
++ return 1;
++ }
++ } else {
++ return 0;
+ }
+- return 0;
+ }
+
+ /* If there's an option indicating link connection, and it's valid,
+@@ -4670,7 +4683,10 @@ int locate_network (packet)
+ data_string_forget (&data, MDL);
+ } else {
+ ia.len = 4;
+- memcpy (ia.iabuf, &packet -> raw -> giaddr, 4);
++ if (norelay)
++ memcpy (ia.iabuf, &packet->raw->ciaddr, 4);
++ else
++ memcpy (ia.iabuf, &packet->raw->giaddr, 4);
+ }
+
+ /* If we know the subnet on which the IP address lives, use it. */
+@@ -4678,7 +4694,10 @@ int locate_network (packet)
+ shared_network_reference (&packet -> shared_network,
+ subnet -> shared_network, MDL);
+ subnet_dereference (&subnet, MDL);
+- return 1;
++ if (norelay)
++ return norelay;
++ else
++ return 1;
+ }
+
+ /* Otherwise, fail. */
diff --git a/src/patches/dhcp/dhcp-xen-checksum.patch b/src/patches/dhcp/dhcp-xen-checksum.patch
new file mode 100644
index 0000000..eabc3c1
--- /dev/null
+++ b/src/patches/dhcp/dhcp-xen-checksum.patch
@@ -0,0 +1,251 @@
+diff -up dhcp-4.3.0rc1/common/bpf.c.xen dhcp-4.3.0rc1/common/bpf.c
+--- dhcp-4.3.0rc1/common/bpf.c.xen 2014-01-29 10:03:27.503941664 +0100
++++ dhcp-4.3.0rc1/common/bpf.c 2014-01-29 10:03:37.564812175 +0100
+@@ -481,7 +481,7 @@ ssize_t receive_packet (interface, buf,
+ /* Decode the IP and UDP headers... */
+ offset = decode_udp_ip_header(interface, interface->rbuf,
+ interface->rbuf_offset,
+- from, hdr.bh_caplen, &paylen);
++ from, hdr.bh_caplen, &paylen, 0);
+
+ /* If the IP or UDP checksum was bad, skip the packet... */
+ if (offset < 0) {
+diff -up dhcp-4.3.0rc1/common/dlpi.c.xen dhcp-4.3.0rc1/common/dlpi.c
+--- dhcp-4.3.0rc1/common/dlpi.c.xen 2014-01-25 05:18:03.000000000 +0100
++++ dhcp-4.3.0rc1/common/dlpi.c 2014-01-29 10:03:27.503941664 +0100
+@@ -691,7 +691,7 @@ ssize_t receive_packet (interface, buf,
+ length -= offset;
+ #endif
+ offset = decode_udp_ip_header (interface, dbuf, bufix,
+- from, length, &paylen);
++ from, length, &paylen, 0);
+
+ /*
+ * If the IP or UDP checksum was bad, skip the packet...
+diff -up dhcp-4.3.0rc1/common/lpf.c.xen dhcp-4.3.0rc1/common/lpf.c
+--- dhcp-4.3.0rc1/common/lpf.c.xen 2014-01-25 05:18:03.000000000 +0100
++++ dhcp-4.3.0rc1/common/lpf.c 2014-01-29 10:03:27.504941651 +0100
+@@ -29,14 +29,15 @@
+
+ #include "dhcpd.h"
+ #if defined (USE_LPF_SEND) || defined (USE_LPF_RECEIVE)
++#include <sys/socket.h>
+ #include <sys/uio.h>
+ #include <errno.h>
+
+ #include <asm/types.h>
+ #include <linux/filter.h>
+ #include <linux/if_ether.h>
++#include <linux/if_packet.h>
+ #include <netinet/in_systm.h>
+-#include <net/if_packet.h>
+ #include "includes/netinet/ip.h"
+ #include "includes/netinet/udp.h"
+ #include "includes/netinet/if_ether.h"
+@@ -51,6 +52,19 @@
+ /* Reinitializes the specified interface after an address change. This
+ is not required for packet-filter APIs. */
+
++#ifndef PACKET_AUXDATA
++#define PACKET_AUXDATA 8
++
++struct tpacket_auxdata
++{
++ __u32 tp_status;
++ __u32 tp_len;
++ __u32 tp_snaplen;
++ __u16 tp_mac;
++ __u16 tp_net;
++};
++#endif
++
+ #ifdef USE_LPF_SEND
+ void if_reinitialize_send (info)
+ struct interface_info *info;
+@@ -73,10 +87,14 @@ int if_register_lpf (info)
+ struct interface_info *info;
+ {
+ int sock;
+- struct sockaddr sa;
++ union {
++ struct sockaddr_ll ll;
++ struct sockaddr common;
++ } sa;
++ struct ifreq ifr;
+
+ /* Make an LPF socket. */
+- if ((sock = socket(PF_PACKET, SOCK_PACKET,
++ if ((sock = socket(PF_PACKET, SOCK_RAW,
+ htons((short)ETH_P_ALL))) < 0) {
+ if (errno == ENOPROTOOPT || errno == EPROTONOSUPPORT ||
+ errno == ESOCKTNOSUPPORT || errno == EPFNOSUPPORT ||
+@@ -91,11 +109,17 @@ int if_register_lpf (info)
+ log_fatal ("Open a socket for LPF: %m");
+ }
+
++ memset (&ifr, 0, sizeof ifr);
++ strncpy (ifr.ifr_name, (const char *)info -> ifp, sizeof ifr.ifr_name);
++ ifr.ifr_name[IFNAMSIZ-1] = '\0';
++ if (ioctl (sock, SIOCGIFINDEX, &ifr))
++ log_fatal ("Failed to get interface index: %m");
++
+ /* Bind to the interface name */
+ memset (&sa, 0, sizeof sa);
+- sa.sa_family = AF_PACKET;
+- strncpy (sa.sa_data, (const char *)info -> ifp, sizeof sa.sa_data);
+- if (bind (sock, &sa, sizeof sa)) {
++ sa.ll.sll_family = AF_PACKET;
++ sa.ll.sll_ifindex = ifr.ifr_ifindex;
++ if (bind (sock, &sa.common, sizeof sa)) {
+ if (errno == ENOPROTOOPT || errno == EPROTONOSUPPORT ||
+ errno == ESOCKTNOSUPPORT || errno == EPFNOSUPPORT ||
+ errno == EAFNOSUPPORT || errno == EINVAL) {
+@@ -177,9 +201,18 @@ static void lpf_gen_filter_setup (struct
+ void if_register_receive (info)
+ struct interface_info *info;
+ {
++ int val;
++
+ /* Open a LPF device and hang it on this interface... */
+ info -> rfdesc = if_register_lpf (info);
+
++ val = 1;
++ if (setsockopt (info -> rfdesc, SOL_PACKET, PACKET_AUXDATA, &val,
++ sizeof val) < 0) {
++ if (errno != ENOPROTOOPT)
++ log_fatal ("Failed to set auxiliary packet data: %m");
++ }
++
+ #if defined (HAVE_TR_SUPPORT)
+ if (info -> hw_address.hbuf [0] == HTYPE_IEEE802)
+ lpf_tr_filter_setup (info);
+@@ -301,7 +334,6 @@ ssize_t send_packet (interface, packet,
+ double hh [16];
+ double ih [1536 / sizeof (double)];
+ unsigned char *buf = (unsigned char *)ih;
+- struct sockaddr_pkt sa;
+ int result;
+ int fudge;
+
+@@ -322,17 +354,7 @@ ssize_t send_packet (interface, packet,
+ (unsigned char *)raw, len);
+ memcpy (buf + ibufp, raw, len);
+
+- /* For some reason, SOCK_PACKET sockets can't be connected,
+- so we have to do a sentdo every time. */
+- memset (&sa, 0, sizeof sa);
+- sa.spkt_family = AF_PACKET;
+- strncpy ((char *)sa.spkt_device,
+- (const char *)interface -> ifp, sizeof sa.spkt_device);
+- sa.spkt_protocol = htons(ETH_P_IP);
+-
+- result = sendto (interface -> wfdesc,
+- buf + fudge, ibufp + len - fudge, 0,
+- (const struct sockaddr *)&sa, sizeof sa);
++ result = write (interface -> wfdesc, buf + fudge, ibufp + len - fudge);
+ if (result < 0)
+ log_error ("send_packet: %m");
+ return result;
+@@ -349,14 +371,35 @@ ssize_t receive_packet (interface, buf,
+ {
+ int length = 0;
+ int offset = 0;
++ int nocsum = 0;
+ unsigned char ibuf [1536];
+ unsigned bufix = 0;
+ unsigned paylen;
++ unsigned char cmsgbuf[CMSG_LEN(sizeof(struct tpacket_auxdata))];
++ struct iovec iov = {
++ .iov_base = ibuf,
++ .iov_len = sizeof ibuf,
++ };
++ struct msghdr msg = {
++ .msg_iov = &iov,
++ .msg_iovlen = 1,
++ .msg_control = cmsgbuf,
++ .msg_controllen = sizeof(cmsgbuf),
++ };
++ struct cmsghdr *cmsg;
+
+- length = read (interface -> rfdesc, ibuf, sizeof ibuf);
++ length = recvmsg (interface -> rfdesc, &msg, 0);
+ if (length <= 0)
+ return length;
+
++ for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg)) {
++ if (cmsg->cmsg_level == SOL_PACKET &&
++ cmsg->cmsg_type == PACKET_AUXDATA) {
++ struct tpacket_auxdata *aux = (void *)CMSG_DATA(cmsg);
++ nocsum = aux->tp_status & TP_STATUS_CSUMNOTREADY;
++ }
++ }
++
+ bufix = 0;
+ /* Decode the physical header... */
+ offset = decode_hw_header (interface, ibuf, bufix, hfrom);
+@@ -373,7 +416,7 @@ ssize_t receive_packet (interface, buf,
+
+ /* Decode the IP and UDP headers... */
+ offset = decode_udp_ip_header (interface, ibuf, bufix, from,
+- (unsigned)length, &paylen);
++ (unsigned)length, &paylen, nocsum);
+
+ /* If the IP or UDP checksum was bad, skip the packet... */
+ if (offset < 0)
+diff -up dhcp-4.3.0rc1/common/nit.c.xen dhcp-4.3.0rc1/common/nit.c
+--- dhcp-4.3.0rc1/common/nit.c.xen 2014-01-26 19:40:44.000000000 +0100
++++ dhcp-4.3.0rc1/common/nit.c 2014-01-29 10:03:27.504941651 +0100
+@@ -363,7 +363,7 @@ ssize_t receive_packet (interface, buf,
+
+ /* Decode the IP and UDP headers... */
+ offset = decode_udp_ip_header (interface, ibuf, bufix,
+- from, length, &paylen);
++ from, length, &paylen, 0);
+
+ /* If the IP or UDP checksum was bad, skip the packet... */
+ if (offset < 0)
+diff -up dhcp-4.3.0rc1/common/packet.c.xen dhcp-4.3.0rc1/common/packet.c
+--- dhcp-4.3.0rc1/common/packet.c.xen 2013-12-11 01:01:02.000000000 +0100
++++ dhcp-4.3.0rc1/common/packet.c 2014-01-29 10:03:27.504941651 +0100
+@@ -226,7 +226,7 @@ ssize_t
+ decode_udp_ip_header(struct interface_info *interface,
+ unsigned char *buf, unsigned bufix,
+ struct sockaddr_in *from, unsigned buflen,
+- unsigned *rbuflen)
++ unsigned *rbuflen, int nocsum)
+ {
+ unsigned char *data;
+ struct ip ip;
+@@ -337,7 +337,7 @@ decode_udp_ip_header(struct interface_in
+ 8, IPPROTO_UDP + ulen))));
+
+ udp_packets_seen++;
+- if (usum && usum != sum) {
++ if (!nocsum && usum && usum != sum) {
+ udp_packets_bad_checksum++;
+ if (udp_packets_seen > 4 &&
+ (udp_packets_seen / udp_packets_bad_checksum) < 2) {
+diff -up dhcp-4.3.0rc1/common/upf.c.xen dhcp-4.3.0rc1/common/upf.c
+--- dhcp-4.3.0rc1/common/upf.c.xen 2014-01-26 19:40:44.000000000 +0100
++++ dhcp-4.3.0rc1/common/upf.c 2014-01-29 10:03:27.505941638 +0100
+@@ -314,7 +314,7 @@ ssize_t receive_packet (interface, buf,
+
+ /* Decode the IP and UDP headers... */
+ offset = decode_udp_ip_header (interface, ibuf, bufix,
+- from, length, &paylen);
++ from, length, &paylen, 0);
+
+ /* If the IP or UDP checksum was bad, skip the packet... */
+ if (offset < 0)
+diff -up dhcp-4.3.0rc1/includes/dhcpd.h.xen dhcp-4.3.0rc1/includes/dhcpd.h
+--- dhcp-4.3.0rc1/includes/dhcpd.h.xen 2014-01-29 10:03:27.489941844 +0100
++++ dhcp-4.3.0rc1/includes/dhcpd.h 2014-01-29 10:03:27.506941626 +0100
+@@ -2861,7 +2861,7 @@ ssize_t decode_hw_header (struct interfa
+ unsigned, struct hardware *);
+ ssize_t decode_udp_ip_header (struct interface_info *, unsigned char *,
+ unsigned, struct sockaddr_in *,
+- unsigned, unsigned *);
++ unsigned, unsigned *, int);
+
+ /* ethernet.c */
+ void assemble_ethernet_header (struct interface_info *, unsigned char *,
hooks/post-receive
--
IPFire 2.x development tree
1
0
[git.ipfire.org] IPFire 2.x development tree branch, next, updated. c366dbb4337921e3e581498bc2b85f787a6913f4
by gitï¼ ipfire.org 17 Mar '15
by gitï¼ ipfire.org 17 Mar '15
17 Mar '15
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, next has been updated
via c366dbb4337921e3e581498bc2b85f787a6913f4 (commit)
via 0fbf41404c75702d73b5234c6dde210c346ae0e6 (commit)
from c98cc4ae90643b9a43431be5de7d821c110267c0 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit c366dbb4337921e3e581498bc2b85f787a6913f4
Merge: c98cc4a 0fbf414
Author: Arne Fitzenreiter <arne_f(a)ipfire.org>
Date: Tue Mar 17 14:09:05 2015 +0100
Merge branch 'master' into next
-----------------------------------------------------------------------
Summary of changes:
config/rootfiles/{oldcore/85 => core/88}/exclude | 0
config/rootfiles/{oldcore/60 => core/88}/filelists/files | 0
config/rootfiles/{oldcore/81 => core/88}/filelists/openssh | 0
config/rootfiles/{oldcore/87 => core/88}/filelists/openssl | 0
.../rootfiles/{oldcore/87 => core/88}/filelists/openssl-compat | 0
config/rootfiles/{oldcore/87 => core/88}/meta | 0
config/rootfiles/{oldcore/81 => core/88}/update.sh | 10 +++++-----
7 files changed, 5 insertions(+), 5 deletions(-)
copy config/rootfiles/{oldcore/85 => core/88}/exclude (100%)
copy config/rootfiles/{oldcore/60 => core/88}/filelists/files (100%)
copy config/rootfiles/{oldcore/81 => core/88}/filelists/openssh (100%)
copy config/rootfiles/{oldcore/87 => core/88}/filelists/openssl (100%)
copy config/rootfiles/{oldcore/87 => core/88}/filelists/openssl-compat (100%)
copy config/rootfiles/{oldcore/87 => core/88}/meta (100%)
copy config/rootfiles/{oldcore/81 => core/88}/update.sh (95%)
Difference in files:
diff --git a/config/rootfiles/core/88/exclude b/config/rootfiles/core/88/exclude
new file mode 100644
index 0000000..18e9b4d
--- /dev/null
+++ b/config/rootfiles/core/88/exclude
@@ -0,0 +1,20 @@
+boot/config.txt
+etc/collectd.custom
+etc/ipsec.conf
+etc/ipsec.secrets
+etc/ipsec.user.conf
+etc/ipsec.user.secrets
+etc/localtime
+etc/shadow
+etc/ssh/ssh_config
+etc/ssh/sshd_config
+etc/ssl/openssl.cnf
+etc/sudoers
+etc/sysconfig/firewall.local
+etc/sysconfig/rc.local
+etc/udev/rules.d/30-persistent-network.rules
+srv/web/ipfire/html/proxy.pac
+var/ipfire/ovpn
+var/log/cache
+var/state/dhcp/dhcpd.leases
+var/updatecache
diff --git a/config/rootfiles/core/88/filelists/files b/config/rootfiles/core/88/filelists/files
new file mode 100644
index 0000000..409e5fe
--- /dev/null
+++ b/config/rootfiles/core/88/filelists/files
@@ -0,0 +1,2 @@
+etc/system-release
+etc/issue
diff --git a/config/rootfiles/core/88/filelists/openssh b/config/rootfiles/core/88/filelists/openssh
new file mode 120000
index 0000000..d8c77fd
--- /dev/null
+++ b/config/rootfiles/core/88/filelists/openssh
@@ -0,0 +1 @@
+../../../common/openssh
\ No newline at end of file
diff --git a/config/rootfiles/core/88/filelists/openssl b/config/rootfiles/core/88/filelists/openssl
new file mode 120000
index 0000000..e011a92
--- /dev/null
+++ b/config/rootfiles/core/88/filelists/openssl
@@ -0,0 +1 @@
+../../../common/openssl
\ No newline at end of file
diff --git a/config/rootfiles/core/88/filelists/openssl-compat b/config/rootfiles/core/88/filelists/openssl-compat
new file mode 120000
index 0000000..c9fa421
--- /dev/null
+++ b/config/rootfiles/core/88/filelists/openssl-compat
@@ -0,0 +1 @@
+../../../common/openssl-compat
\ No newline at end of file
diff --git a/config/rootfiles/core/88/meta b/config/rootfiles/core/88/meta
new file mode 100644
index 0000000..d547fa8
--- /dev/null
+++ b/config/rootfiles/core/88/meta
@@ -0,0 +1 @@
+DEPS=""
diff --git a/config/rootfiles/core/88/update.sh b/config/rootfiles/core/88/update.sh
new file mode 100644
index 0000000..6ef1f48
--- /dev/null
+++ b/config/rootfiles/core/88/update.sh
@@ -0,0 +1,57 @@
+#!/bin/bash
+############################################################################
+# #
+# This file is part of the IPFire Firewall. #
+# #
+# IPFire is free software; you can redistribute it and/or modify #
+# it under the terms of the GNU General Public License as published by #
+# the Free Software Foundation; either version 3 of the License, or #
+# (at your option) any later version. #
+# #
+# IPFire is distributed in the hope that it will be useful, #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
+# GNU General Public License for more details. #
+# #
+# You should have received a copy of the GNU General Public License #
+# along with IPFire; if not, write to the Free Software #
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA #
+# #
+# Copyright (C) 2014 IPFire-Team <info(a)ipfire.org>. #
+# #
+############################################################################
+#
+. /opt/pakfire/lib/functions.sh
+/usr/local/bin/backupctrl exclude >/dev/null 2>&1
+
+# Remove old core updates from pakfire cache to save space...
+core=88
+for (( i=1; i<=$core; i++ ))
+do
+ rm -f /var/cache/pakfire/core-upgrade-*-$i.ipfire
+done
+
+# Stop services
+
+# Remove old files
+
+# Extract files
+extract_files
+
+# Start services
+
+# Update Language cache
+#perl -e "require '/var/ipfire/lang.pl'; &Lang::BuildCacheLang"
+
+
+sync
+
+# This update need a reboot...
+#touch /var/run/need_reboot
+
+# Finish
+/etc/init.d/fireinfo start
+sendprofile
+
+# Don't report the exitcode last command
+exit 0
hooks/post-receive
--
IPFire 2.x development tree
1
0