Thursday, August 29, 2019

SECURITY UPDATE: net/kea. Tests/feedback needed.

I noticed there was a security update for net/kea and then noticed
that the port is rather outdated. I don't use it myself (and config is a
bit fiddly) so I haven't tested beyond building.

Is anyone still using it? If so, please test and report back.

If not, I propose removing the port until a maintainer or at least someone
who can test updates is found.

Index: Makefile
===================================================================
RCS file: /cvs/ports/net/kea/Makefile,v
retrieving revision 1.16
diff -u -p -r1.16 Makefile
--- Makefile 12 Jul 2019 20:48:29 -0000 1.16
+++ Makefile 29 Aug 2019 11:37:36 -0000
@@ -2,35 +2,21 @@

COMMENT= high-performance and extensible DHCP server engine from ISC

-VERSION= 1.2.0
+VERSION= 1.6.0

DISTNAME= kea-${VERSION}
PKGNAME= ${DISTNAME:S/-P/pl/}
-REVISION= 4

-SHARED_LIBS += kea-asiodns 0.0 # 0.0
-SHARED_LIBS += kea-asiolink 2.0 # 4.0
-SHARED_LIBS += kea-cc 1.0 # 2.0
-SHARED_LIBS += kea-cfgclient 1.0 # 3.0
-SHARED_LIBS += kea-cryptolink 1.0 # 2.0
-SHARED_LIBS += kea-dhcp++ 2.0 # 5.0
-SHARED_LIBS += kea-dhcp_ddns 0.2 # 1.2
-SHARED_LIBS += kea-dhcpsrv 2.0 # 7.0
-SHARED_LIBS += kea-dns++ 1.0 # 1.1
-SHARED_LIBS += kea-eval 2.0 # 5.0
-SHARED_LIBS += kea-exceptions 0.0 # 0.0
-SHARED_LIBS += kea-hooks 2.0 # 3.0
-SHARED_LIBS += kea-http 0.0 # 0.0
-SHARED_LIBS += kea-log 2.0 # 3.0
-SHARED_LIBS += kea-process 0.0 # 0.0
-SHARED_LIBS += kea-stats 0.0 # 1.0
-SHARED_LIBS += kea-threads 1.0 # 1.0
-SHARED_LIBS += kea-util-io 0.0 # 0.0
-SHARED_LIBS += kea-util 1.1 # 2.1
+.for i in kea-exceptions kea-util kea-util-io kea-threads kea-log \
+ kea-cryptolink kea-dns++ kea-asiolink kea-cc kea-database kea-hooks \
+ kea-dhcp++ kea-cfgclient kea-stats kea-asiodns kea-dhcp_ddns \
+ kea-eval kea-process kea-dhcpsrv kea-http
+SHARED_LIBS += $i 3.0
+.endfor

CATEGORIES= net

-HOMEPAGE= http://kea.isc.org/
+HOMEPAGE= https://kea.isc.org/

# MPL 2.0
PERMIT_PACKAGE= Yes
@@ -58,18 +44,14 @@ FLAVOR?=

.if ${FLAVOR:Mmysql}
WANTLIB += mysqlclient ssl z
-
LIB_DEPENDS+= databases/mariadb
-
CONFIGURE_ARGS+= --with-dhcp-mysql=${LOCALBASE}/bin/mysql_config
.endif

.if ${FLAVOR:Mpostgresql}
WANTLIB += pq ssl
-
BUILD_DEPENDS+= databases/postgresql,-server
LIB_DEPENDS+= databases/postgresql
-
CONFIGURE_ARGS+= --with-dhcp-pgsql=${LOCALBASE}/bin/pg_config
.endif

Index: distinfo
===================================================================
RCS file: /cvs/ports/net/kea/distinfo,v
retrieving revision 1.4
diff -u -p -r1.4 distinfo
--- distinfo 27 Aug 2017 11:14:51 -0000 1.4
+++ distinfo 29 Aug 2019 11:37:36 -0000
@@ -1,2 +1,2 @@
-SHA256 (kea-1.2.0.tar.gz) = ItFZRbE2ALVsNyE3l8ofPumFHmEZEgrq4IAzxMxS0Sk=
-SIZE (kea-1.2.0.tar.gz) = 5720941
+SHA256 (kea-1.6.0.tar.gz) = RO1IxynkYY//zwCGUptGn3IymQmDGHsvcfzonxrG4nA=
+SIZE (kea-1.6.0.tar.gz) = 7154301
Index: patches/patch-src_bin_keactrl_kea-ca_conf_pre
===================================================================
RCS file: patches/patch-src_bin_keactrl_kea-ca_conf_pre
diff -N patches/patch-src_bin_keactrl_kea-ca_conf_pre
--- patches/patch-src_bin_keactrl_kea-ca_conf_pre 27 Aug 2017 11:14:51 -0000 1.1
+++ /dev/null 1 Jan 1970 00:00:00 -0000
@@ -1,19 +0,0 @@
-$OpenBSD: patch-src_bin_keactrl_kea-ca_conf_pre,v 1.1 2017/08/27 11:14:51 sthen Exp $
-
-Index: src/bin/keactrl/kea-ca.conf.pre
---- src/bin/keactrl/kea-ca.conf.pre.orig
-+++ src/bin/keactrl/kea-ca.conf.pre
-@@ -11,11 +11,11 @@
- "control-sockets": {
- "dhcp4-server": {
- "socket-type": "unix",
-- "socket-name": "/tmp/kea-dhcp4-ctrl.sock"
-+ "socket-name": "@localstatedir@/run/kea/kea-dhcp4-ctrl.sock"
- },
- "dhcp6-server": {
- "socket-type": "unix",
-- "socket-name": "/tmp/kea-dhcp6-ctrl.sock"
-+ "socket-name": "@localstatedir@/run/kea/kea-dhcp6-ctrl.sock"
- }
- },
-
Index: patches/patch-src_bin_keactrl_kea-ctrl-agent_conf_pre
===================================================================
RCS file: patches/patch-src_bin_keactrl_kea-ctrl-agent_conf_pre
diff -N patches/patch-src_bin_keactrl_kea-ctrl-agent_conf_pre
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ patches/patch-src_bin_keactrl_kea-ctrl-agent_conf_pre 29 Aug 2019 11:37:36 -0000
@@ -0,0 +1,33 @@
+$OpenBSD$
+
+Index: src/bin/keactrl/kea-ctrl-agent.conf.pre
+--- src/bin/keactrl/kea-ctrl-agent.conf.pre.orig
++++ src/bin/keactrl/kea-ctrl-agent.conf.pre
+@@ -26,15 +26,15 @@
+ "control-sockets": {
+ "dhcp4": {
+ "socket-type": "unix",
+- "socket-name": "/tmp/kea-dhcp4-ctrl.sock"
++ "socket-name": ""@localstatedir@/run/kea/kea-dhcp4-ctrl.sock"
+ },
+ "dhcp6": {
+ "socket-type": "unix",
+- "socket-name": "/tmp/kea-dhcp6-ctrl.sock"
++ "socket-name": ""@localstatedir@/run/kea/kea-dhcp6-ctrl.sock"
+ },
+ "d2": {
+ "socket-type": "unix",
+- "socket-name": "/tmp/kea-dhcp-ddns-ctrl.sock"
++ "socket-name": ""@localstatedir@/run/kea/kea-dhcp-ddns-ctrl.sock"
+ }
+ },
+
+@@ -67,7 +67,7 @@
+ // - syslog (logs to syslog)
+ // - syslog:name (logs to syslog using specified name)
+ // Any other value is considered a name of a time
+- "output": "@localstatedir@/log/kea-ctrl-agent.log"
++ "output": "syslog:daemon"
+
+ // Shorter log pattern suitable for use with systemd,
+ // avoids redundant information
Index: patches/patch-src_bin_keactrl_kea-dhcp-ddns_conf_pre
===================================================================
RCS file: patches/patch-src_bin_keactrl_kea-dhcp-ddns_conf_pre
diff -N patches/patch-src_bin_keactrl_kea-dhcp-ddns_conf_pre
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ patches/patch-src_bin_keactrl_kea-dhcp-ddns_conf_pre 29 Aug 2019 11:37:36 -0000
@@ -0,0 +1,23 @@
+$OpenBSD$
+
+Index: src/bin/keactrl/kea-dhcp-ddns.conf.pre
+--- src/bin/keactrl/kea-dhcp-ddns.conf.pre.orig
++++ src/bin/keactrl/kea-dhcp-ddns.conf.pre
+@@ -23,7 +23,7 @@
+ "port": 53001,
+ "control-socket": {
+ "socket-type": "unix",
+- "socket-name": "/tmp/kea-dhcp-ddns-ctrl.sock"
++ "socket-name": ""@localstatedir@/run/kea/kea-dhcp-ddns-ctrl.sock"
+ },
+ "tsig-keys": [],
+ "forward-ddns" : {},
+@@ -44,7 +44,7 @@
+ // - syslog (logs to syslog)
+ // - syslog:name (logs to syslog using specified name)
+ // Any other value is considered a name of a time
+- "output": "@localstatedir@/log/kea-ddns.log"
++ "output": "syslog:daemon"
+
+ // Shorter log pattern suitable for use with systemd,
+ // avoids redundant information
Index: patches/patch-src_bin_keactrl_kea-dhcp4_conf_pre
===================================================================
RCS file: patches/patch-src_bin_keactrl_kea-dhcp4_conf_pre
diff -N patches/patch-src_bin_keactrl_kea-dhcp4_conf_pre
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ patches/patch-src_bin_keactrl_kea-dhcp4_conf_pre 29 Aug 2019 11:37:36 -0000
@@ -0,0 +1,23 @@
+$OpenBSD$
+
+Index: src/bin/keactrl/kea-dhcp4.conf.pre
+--- src/bin/keactrl/kea-dhcp4.conf.pre.orig
++++ src/bin/keactrl/kea-dhcp4.conf.pre
+@@ -49,7 +49,7 @@
+ // more. For detailed description, see Sections 8.8, 16 and 15.
+ "control-socket": {
+ "socket-type": "unix",
+- "socket-name": "/tmp/kea-dhcp4-ctrl.sock"
++ "socket-name": ""@localstatedir@/run/kea/kea-dhcp4-ctrl.sock"
+ },
+
+ // Use Memfile lease database backend to store leases in a CSV file.
+@@ -428,7 +428,7 @@
+ // - syslog (logs to syslog)
+ // - syslog:name (logs to syslog using specified name)
+ // Any other value is considered a name of a time
+- "output": "@localstatedir@/log/kea-dhcp4.log"
++ "output": "syslog:daemon"
+
+ // Shorter log pattern suitable for use with systemd,
+ // avoids redundant information
Index: patches/patch-src_bin_keactrl_kea-dhcp6_conf_pre
===================================================================
RCS file: patches/patch-src_bin_keactrl_kea-dhcp6_conf_pre
diff -N patches/patch-src_bin_keactrl_kea-dhcp6_conf_pre
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ patches/patch-src_bin_keactrl_kea-dhcp6_conf_pre 29 Aug 2019 11:37:36 -0000
@@ -0,0 +1,23 @@
+$OpenBSD$
+
+Index: src/bin/keactrl/kea-dhcp6.conf.pre
+--- src/bin/keactrl/kea-dhcp6.conf.pre.orig
++++ src/bin/keactrl/kea-dhcp6.conf.pre
+@@ -43,7 +43,7 @@
+ // description, see Sections 9.12, 16 and 15.
+ "control-socket": {
+ "socket-type": "unix",
+- "socket-name": "/tmp/kea-dhcp6-ctrl.sock"
++ "socket-name": ""@localstatedir@/run/kea/kea-dhcp6-ctrl.sock"
+ },
+
+ // Use Memfile lease database backend to store leases in a CSV file.
+@@ -353,7 +353,7 @@
+ // - syslog (logs to syslog)
+ // - syslog:name (logs to syslog using specified name)
+ // Any other value is considered a name of a time
+- "output": "@localstatedir@/log/kea-dhcp6.log"
++ "output": "syslog:daemon"
+
+ // Shorter log pattern suitable for use with systemd,
+ // avoids redundant information
Index: patches/patch-src_bin_keactrl_kea-netconf_conf_pre
===================================================================
RCS file: patches/patch-src_bin_keactrl_kea-netconf_conf_pre
diff -N patches/patch-src_bin_keactrl_kea-netconf_conf_pre
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ patches/patch-src_bin_keactrl_kea-netconf_conf_pre 29 Aug 2019 11:37:36 -0000
@@ -0,0 +1,30 @@
+$OpenBSD$
+
+Index: src/bin/keactrl/kea-netconf.conf.pre
+--- src/bin/keactrl/kea-netconf.conf.pre.orig
++++ src/bin/keactrl/kea-netconf.conf.pre
+@@ -30,13 +30,13 @@
+ "dhcp4": {
+ "control-socket": {
+ "socket-type": "unix",
+- "socket-name": "/tmp/kea-dhcp4-ctrl.sock"
++ "socket-name": ""@localstatedir@/run/kea/kea-dhcp4-ctrl.sock"
+ }
+ },
+ "dhcp6": {
+ "control-socket": {
+ "socket-type": "unix",
+- "socket-name": "/tmp/kea-dhcp6-ctrl.sock"
++ "socket-name": ""@localstatedir@/run/kea/kea-dhcp6-ctrl.sock"
+ }
+ }
+ },
+@@ -69,7 +69,7 @@
+ // - syslog (logs to syslog)
+ // - syslog:name (logs to syslog using specified name)
+ // Any other value is considered a name of a time
+- "output": "@localstatedir@/log/kea-netconf.log"
++ "output": "syslog:daemon"
+
+ // Shorter log pattern suitable for use with systemd,
+ // avoids redundant information
Index: patches/patch-src_bin_keactrl_kea_conf_pre
===================================================================
RCS file: patches/patch-src_bin_keactrl_kea_conf_pre
diff -N patches/patch-src_bin_keactrl_kea_conf_pre
--- patches/patch-src_bin_keactrl_kea_conf_pre 27 Aug 2017 11:14:51 -0000 1.1
+++ /dev/null 1 Jan 1970 00:00:00 -0000
@@ -1,70 +0,0 @@
-$OpenBSD: patch-src_bin_keactrl_kea_conf_pre,v 1.1 2017/08/27 11:14:51 sthen Exp $
-
-Index: src/bin/keactrl/kea.conf.pre
---- src/bin/keactrl/kea.conf.pre.orig
-+++ src/bin/keactrl/kea.conf.pre
-@@ -45,7 +45,7 @@
- // more. For detailed description, see Sections 8.8, 16 and 15.
- "control-socket": {
- "socket-type": "unix",
-- "socket-name": "/tmp/kea-dhcp4-ctrl.sock"
-+ "socket-name": "@localstatedir@/run/kea/kea-dhcp4-ctrl.sock"
- },
-
- // Use Memfile lease database backend to store leases in a CSV file.
-@@ -57,7 +57,8 @@
- "lease-database": {
- // Memfile is the simplest and easiest backend to use. It's a in-memory
- // C++ database that stores its state in CSV file.
-- "type": "memfile"
-+ "type": "memfile",
-+ "lfc-interval": 3600
- },
-
- // Kea allows storing host reservations in a database. If your network is
-@@ -427,7 +428,7 @@
- // description, see Sections 9.12, 16 and 15.
- "control-socket": {
- "socket-type": "unix",
-- "socket-name": "/tmp/kea-dhcp6-ctrl.sock"
-+ "socket-name": "@localstatedir@/run/kea/kea-dhcp6-ctrl.sock"
- },
-
- // Use Memfile lease database backend to store leases in a CSV file.
-@@ -437,7 +438,8 @@
- // There are dedicated examples for each backend. See Section 8.2.2 "Lease
- // Storage" for details.
- "lease-database": {
-- "type": "memfile"
-+ "type": "memfile",
-+ "lfc-interval": 3600
- },
-
- // Kea allows storing host reservations in a database. If your network is
-@@ -753,7 +755,7 @@
- // - syslog (logs to syslog)
- // - syslog:name (logs to syslog using specified name)
- // Any other value is considered a name of a time
-- "output": "@localstatedir@/log/kea-dhcp4.log"
-+ "output": "syslog:daemon"
-
- // This governs whether the log output is flushed to disk after
- // every write.
-@@ -782,7 +784,7 @@
- "name": "kea-dhcp6",
- "output_options": [
- {
-- "output": "@localstatedir@/log/kea-dhcp6.log"
-+ "output": "syslog:daemon"
- }
- ],
- "severity": "INFO",
-@@ -793,7 +795,7 @@
- "name": "kea-dhcp-ddns",
- "output_options": [
- {
-- "output": "@localstatedir@/log/kea-ddns.log"
-+ "output": "syslog:daemon"
- }
- ],
- "severity": "INFO",
Index: patches/patch-src_bin_keactrl_keactrl_conf_in
===================================================================
RCS file: /cvs/ports/net/kea/patches/patch-src_bin_keactrl_keactrl_conf_in,v
retrieving revision 1.1
diff -u -p -r1.1 patch-src_bin_keactrl_keactrl_conf_in
--- patches/patch-src_bin_keactrl_keactrl_conf_in 27 Aug 2017 11:14:51 -0000 1.1
+++ patches/patch-src_bin_keactrl_keactrl_conf_in 29 Aug 2019 11:37:36 -0000
@@ -3,9 +3,9 @@ $OpenBSD: patch-src_bin_keactrl_keactrl_
Index: src/bin/keactrl/keactrl.conf.in
--- src/bin/keactrl/keactrl.conf.in.orig
+++ src/bin/keactrl/keactrl.conf.in
-@@ -2,6 +2,9 @@
- # the startup, shutdown, reconfiguration and gathering the status
- # of the Kea's processes.
+@@ -4,6 +4,9 @@
+
+ # Note that control agent must be launched after servers and netconf last.

+# Log to syslog.
+KEA_LOGGER_DESTINATION=syslog:daemon
Index: patches/patch-src_bin_keactrl_keactrl_in
===================================================================
RCS file: patches/patch-src_bin_keactrl_keactrl_in
diff -N patches/patch-src_bin_keactrl_keactrl_in
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ patches/patch-src_bin_keactrl_keactrl_in 29 Aug 2019 11:37:36 -0000
@@ -0,0 +1,14 @@
+$OpenBSD$
+
+Index: src/bin/keactrl/keactrl.in
+--- src/bin/keactrl/keactrl.in.orig
++++ src/bin/keactrl/keactrl.in
+@@ -333,7 +333,7 @@ run_conditional() {
+ # to the default file.
+ if [ -z "${KEA_LOGGER_DESTINATION}" ]; then
+ prefix=@prefix@
+- export KEA_LOGGER_DESTINATION=@localstatedir@/log/kea.log
++ export KEA_LOGGER_DESTINATION=syslog:daemon
+ fi
+
+ command=${1}
Index: patches/patch-src_lib_asiolink_io_service_h
===================================================================
RCS file: patches/patch-src_lib_asiolink_io_service_h
diff -N patches/patch-src_lib_asiolink_io_service_h
--- patches/patch-src_lib_asiolink_io_service_h 31 Jan 2018 22:29:09 -0000 1.1
+++ /dev/null 1 Jan 1970 00:00:00 -0000
@@ -1,22 +0,0 @@
-$OpenBSD: patch-src_lib_asiolink_io_service_h,v 1.1 2018/01/31 22:29:09 rsadowski Exp $
-
-fix build with boost 1.66
-- use io_context instead of io_service
-commit 17ed090beb6cefa78e29a95c645eb6da4edf8
-
-Index: src/lib/asiolink/io_service.h
---- src/lib/asiolink/io_service.h.orig
-+++ src/lib/asiolink/io_service.h
-@@ -11,7 +11,12 @@
-
- namespace boost {
- namespace asio {
-+#if BOOST_VERSION < 106600
- class io_service;
-+#else
-+ class io_context;
-+ typedef io_context io_service;
-+

No comments:

Post a Comment