Index: infrastructure/db/user.list
===================================================================
RCS file: /cvs/ports/infrastructure/db/user.list,v
retrieving revision 1.388
diff -u -p -r1.388 user.list
--- infrastructure/db/user.list 27 May 2021 14:51:12 -0000 1.388
+++ infrastructure/db/user.list 6 Jul 2021 13:57:43 -0000
@@ -376,3 +376,4 @@ id user group port
865 _vger _vger net/vger
866 _navidrome _navidrome audio/navidrome
867 _notify_push www/nextcloud_notify_push
+868 _igmpproxy _igmpproxy net/igmpproxy
Index: net/igmpproxy/Makefile
===================================================================
RCS file: /cvs/ports/net/igmpproxy/Makefile,v
retrieving revision 1.21
diff -u -p -r1.21 Makefile
--- net/igmpproxy/Makefile 19 Jan 2021 10:50:12 -0000 1.21
+++ net/igmpproxy/Makefile 6 Jul 2021 13:57:43 -0000
@@ -2,11 +2,12 @@
COMMENT = multicast router utilizing IGMP forwarding
-VERSION = 0.3
-REVISION = 0
-DISTNAME = igmpproxy-${VERSION}
+GH_ACCOUNT = pali
+GH_PROJECT = igmpproxy
+GH_COMMIT = 0e7186b300c063ef4015f1551100765ef5537d4c
+DISTNAME = igmpproxy-0.3.20210705
+
CATEGORIES = net
-MASTER_SITES = https://github.com/pali/igmpproxy/releases/download/${VERSION}/
HOMEPAGE = https://github.com/pali/igmpproxy/
@@ -15,15 +16,18 @@ PERMIT_PACKAGE = Yes
WANTLIB = c
-USE_GMAKE = Yes
+MAKE_FLAGS = CFLAGS="${CFLAGS} -Wall" \
+ LDFLAGS="${LDFLAGS}"
-CFLAGS += -Wall
-MAKE_FLAGS = LDFLAGS="${LDFLAGS}"
-DEBUG_PACKAGES = ${BUILD_PACKAGES}
+CONFIGURE_STYLE = autoreconf
-NO_TEST = Yes
+DEBUG_PACKAGES = ${BUILD_PACKAGES}
-CONFIGURE_STYLE = gnu
+AUTOCONF_VERSION = 2.63
+AUTOMAKE_VERSION = 1.12
+AUTORECONF = ./autogen.sh
+
+NO_TEST = Yes
do-install:
${INSTALL_PROGRAM} ${WRKSRC}/src/igmpproxy ${PREFIX}/sbin
Index: net/igmpproxy/distinfo
===================================================================
RCS file: /cvs/ports/net/igmpproxy/distinfo,v
retrieving revision 1.3
diff -u -p -r1.3 distinfo
--- net/igmpproxy/distinfo 12 Jan 2021 17:59:49 -0000 1.3
+++ net/igmpproxy/distinfo 6 Jul 2021 13:57:43 -0000
@@ -1,2 +1,2 @@
-SHA256 (igmpproxy-0.3.tar.gz) = 0fwkTLL7v5n3IL2j6EH+WezptpGQc3kLS4knObG4ROs=
-SIZE (igmpproxy-0.3.tar.gz) = 168403
+SHA256 (igmpproxy-0.3.20210705-0e7186b3.tar.gz) = DDFIU7dWYhfJngPYrN1INdRysZqXAleYLp334ii8ofs=
+SIZE (igmpproxy-0.3.20210705-0e7186b3.tar.gz) = 43316
Index: net/igmpproxy/patches/patch-igmpproxy_conf
===================================================================
RCS file: net/igmpproxy/patches/patch-igmpproxy_conf
diff -N net/igmpproxy/patches/patch-igmpproxy_conf
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ net/igmpproxy/patches/patch-igmpproxy_conf 6 Jul 2021 13:57:43 -0000
@@ -0,0 +1,15 @@
+$OpenBSD$
+
+Index: igmpproxy.conf
+--- igmpproxy.conf.orig
++++ igmpproxy.conf
+@@ -18,6 +18,9 @@
+ #
+ ########################################################
+
++chroot /var/empty
++user _igmpproxy
++
+ ##------------------------------------------------------
+ ## Enable Quickleave mode (Sends Leave instantly)
+ ##------------------------------------------------------
Index: net/igmpproxy/patches/patch-src_config_c
===================================================================
RCS file: /cvs/ports/net/igmpproxy/patches/patch-src_config_c,v
retrieving revision 1.2
diff -u -p -r1.2 patch-src_config_c
--- net/igmpproxy/patches/patch-src_config_c 19 Jan 2021 10:50:12 -0000 1.2
+++ net/igmpproxy/patches/patch-src_config_c 6 Jul 2021 13:57:43 -0000
@@ -3,7 +3,7 @@ $OpenBSD: patch-src_config_c,v 1.2 2021/
Index: src/config.c
--- src/config.c.orig
+++ src/config.c
-@@ -430,3 +430,21 @@ struct SubnetList *parseSubnetAddress(char *addrstr) {
+@@ -455,3 +455,21 @@ struct SubnetList *parseSubnetAddress(char *addrstr) {
return tmpSubnet;
}
Index: net/igmpproxy/patches/patch-src_igmpproxy_c
===================================================================
RCS file: /cvs/ports/net/igmpproxy/patches/patch-src_igmpproxy_c,v
retrieving revision 1.1
diff -u -p -r1.1 patch-src_igmpproxy_c
--- net/igmpproxy/patches/patch-src_igmpproxy_c 12 Jan 2021 17:59:49 -0000 1.1
+++ net/igmpproxy/patches/patch-src_igmpproxy_c 6 Jul 2021 13:57:43 -0000
@@ -19,7 +19,7 @@ Index: src/igmpproxy.c
static const char Usage[] =
"Usage: igmpproxy [-h] [-n] [-d] [-v [-v]] <configfile>\n"
"\n"
-@@ -123,6 +120,25 @@ int main( int ArgCn, char *ArgVc[] ) {
+@@ -126,6 +123,25 @@ int main( int ArgCn, char *ArgVc[] ) {
openlog("igmpproxy", LOG_PID, LOG_USER);
@@ -45,25 +45,7 @@ Index: src/igmpproxy.c
// Write debug notice with file path...
my_log(LOG_DEBUG, 0, "Searching for config file at '%s'" , configFilePath);
-@@ -142,16 +158,8 @@ int main( int ArgCn, char *ArgVc[] ) {
-
- if ( !NotAsDaemon ) {
-
-- // Only daemon goes past this line...
-- if (fork()) exit(0);
--
-- // Detach daemon from terminal
-- if ( close( 0 ) < 0 || close( 1 ) < 0 || close( 2 ) < 0
-- || open( "/dev/null", 0 ) != 0 || dup2( 0, 1 ) < 0 || dup2( 0, 2 ) < 0
-- || setpgid( 0, 0 ) < 0
-- ) {
-+ if ( daemon(1, 0 ) < 0 )
- my_log( LOG_ERR, errno, "failed to detach daemon" );
-- }
- }
-
- // Go to the main loop.
-@@ -207,6 +215,8 @@ int igmpProxyInit(void) {
+@@ -238,6 +254,8 @@ int igmpProxyInit(void) {
}
for ( Ix = 0; (Dp = getIfByIx(Ix)); Ix++ ) {
Index: net/igmpproxy/patches/patch-src_igmpproxy_h
===================================================================
RCS file: /cvs/ports/net/igmpproxy/patches/patch-src_igmpproxy_h,v
retrieving revision 1.1
diff -u -p -r1.1 patch-src_igmpproxy_h
--- net/igmpproxy/patches/patch-src_igmpproxy_h 12 Jan 2021 17:59:49 -0000 1.1
+++ net/igmpproxy/patches/patch-src_igmpproxy_h 6 Jul 2021 13:57:43 -0000
@@ -11,7 +11,7 @@ Index: src/igmpproxy.h
#include <errno.h>
#include <stdarg.h>
-@@ -60,6 +59,8 @@
+@@ -63,6 +62,8 @@
#include <netinet/in.h>
#include <arpa/inet.h>
@@ -20,7 +20,7 @@ Index: src/igmpproxy.h
/*
* Limit on length of route data
*/
-@@ -218,6 +219,7 @@ int getVifIx( struct IfDesc *IfDp );
+@@ -223,6 +224,7 @@ int getVifIx( struct IfDesc *IfDp );
int loadConfig(char *configFile);
void configureVifs(void);
struct Config *getCommonConfig(void);
Index: net/igmpproxy/pkg/PLIST
===================================================================
RCS file: /cvs/ports/net/igmpproxy/pkg/PLIST,v
retrieving revision 1.5
diff -u -p -r1.5 PLIST
--- net/igmpproxy/pkg/PLIST 12 Jan 2021 17:59:50 -0000 1.5
+++ net/igmpproxy/pkg/PLIST 6 Jul 2021 13:57:43 -0000
@@ -1,4 +1,6 @@
@comment $OpenBSD: PLIST,v 1.5 2021/01/12 17:59:50 sthen Exp $
+@newgroup _igmpproxy:868
+@newuser _igmpproxy:868:868:daemon:IGMP multicast routing daemon:/var/empty:/sbin/nologin
@rcscript ${RCDIR}/igmpproxy
@man man/man5/igmpproxy.conf.5
@man man/man8/igmpproxy.8
Index: net/igmpproxy/pkg/README
===================================================================
RCS file: /cvs/ports/net/igmpproxy/pkg/README,v
retrieving revision 1.7
diff -u -p -r1.7 README
--- net/igmpproxy/pkg/README 4 Sep 2018 12:46:17 -0000 1.7
+++ net/igmpproxy/pkg/README 6 Jul 2021 13:57:43 -0000
@@ -20,3 +20,12 @@ Start igmpproxy at boot time in the usua
PF must be configured so that control packets (proto igmp) and
data packets (destination address within 224.0.0.0/4) are passed.
+
+Running igmpproxy in chroot
+---------------------------
+igmpproxy can run as an unprivileged user inside chroot when the
+chroot and user options are used. To chroot igmpproxy, use the
+following as part of your configuration file:
+
+ chroot /var/empty
+ user _igmpproxy
Index: net/igmpproxy/pkg/igmpproxy.rc
===================================================================
RCS file: /cvs/ports/net/igmpproxy/pkg/igmpproxy.rc,v
retrieving revision 1.2
diff -u -p -r1.2 igmpproxy.rc
--- net/igmpproxy/pkg/igmpproxy.rc 11 Jan 2018 19:27:05 -0000 1.2
+++ net/igmpproxy/pkg/igmpproxy.rc 6 Jul 2021 13:57:43 -0000
@@ -3,6 +3,7 @@
# $OpenBSD: igmpproxy.rc,v 1.2 2018/01/11 19:27:05 rpe Exp $
daemon="${TRUEPREFIX}/sbin/igmpproxy"
+daemon_flags="${SYSCONFDIR}/igmpproxy.conf"
. /etc/rc.d/rc.subr
On Fri 02/07/2021 21:56, Bjorn Ketelaars wrote:
> Enclosed is a diff for net/igmpproxy, which puts igmpproxy in an
> unprivileged chroot after startup. I'm currently discussing a more
> extensive diff with upstream.
>
> We normally do not add features to our ports, but I was wondering if
> this addition makes sense to commit as it increases security a bit.
>
> Run tested on amd64 in combination with an iptv setup.
>
> While here add daemon_flags="${SYSCONFDIR}/igmpproxy.conf" to
> igmpproxy.rc as igmpproxy will complain if no configuration file is
> given.
>
> Thoughts/tests/comments/OK?
New diff attached as upstream has taken the improvement...after some
changes. Instead of enforcing priv drop, it is optional. It can be set
via the configuration file.
Attached diff:
- Takes the first free id from user.list
- Updates igmpproxy to HEAD, which is the version in ports plus the priv
drop stuff
- Explains what to do in README
- Sets 'daemon_flags' in igmpproxy.rc
Unless there is any objection I will commit later this week.
No comments:
Post a Comment