v.ims.1 - Bump version

Fix for rhbz #2140705

.gitignore

@@ -11,3 +11,6 @@
 /frr-8.2.tar.gz
 /frr-8.2.2.tar.gz
 /frr-8.3.1.tar.gz
+/frr-8.4.tar.gz
+/frr-8.4.1.tar.gz
+/frr-8.4.2.tar.gz

0000-remove-babeld-and-ldpd.patch

@@ -27,3 +27,29 @@ index 5be3264..33abc1d 100644
  	lib/Makefile \
  	nhrpd/Makefile \
  	ospf6d/Makefile \
+diff --git a/tools/etc/frr/daemons b/tools/etc/frr/daemons
+index 8aa0887..c92dcca 100644
+--- a/tools/etc/frr/daemons
++++ b/tools/etc/frr/daemons
+@@ -22,10 +22,8 @@ ripngd=no
+ isisd=no
+ pimd=no
+ pim6d=no
+-ldpd=no
+ nhrpd=no
+ eigrpd=no
+-babeld=no
+ sharpd=no
+ pbrd=no
+ bfdd=no
+@@ -48,10 +46,8 @@ ripngd_options=" -A ::1"
+ isisd_options="  -A 127.0.0.1"
+ pimd_options="   -A 127.0.0.1"
+ pim6d_options="  -A ::1"
+-ldpd_options="   -A 127.0.0.1"
+ nhrpd_options="  -A 127.0.0.1"
+ eigrpd_options=" -A 127.0.0.1"
+-babeld_options=" -A 127.0.0.1"
+ sharpd_options=" -A 127.0.0.1"
+ pbrd_options="   -A 127.0.0.1"
+ staticd_options="-A 127.0.0.1"

0004-fips-mode.patch

@@ -101,3 +101,15 @@ index 5bb81ef..02a09ef 100644
  	nb_cli_enqueue_change(vty, "./authentication-scheme/mode", NB_OP_MODIFY,
  			      strmatch(mode, "md5") ? "md5" : "plain-text");
  	if (strmatch(mode, "md5"))
+diff --git a/lib/zebra.h b/lib/zebra.h
+index 53ae5b4..930307f 100644
+--- a/lib/zebra.h
++++ b/lib/zebra.h
+@@ -114,6 +114,7 @@
+ #ifdef CRYPTO_OPENSSL
+ #include <openssl/evp.h>
+ #include <openssl/hmac.h>
++#include <openssl/fips.h>
+ #endif
+
+ #include "openbsd-tree.h"

0006-ospf-api.patch

@@ -1,25 +0,0 @@
-diff --git a/ospfd/ospf_spf.c b/ospfd/ospf_spf.c
-index 74a5674..aec9037 100644
---- a/ospfd/ospf_spf.c
-+++ b/ospfd/ospf_spf.c
-@@ -48,7 +48,10 @@
- #include "ospfd/ospf_sr.h"
- #include "ospfd/ospf_ti_lfa.h"
- #include "ospfd/ospf_errors.h"
-+
-+#ifdef SUPPORT_OSPF_API
- #include "ospfd/ospf_apiserver.h"
-+#endif
- 
- /* Variables to ensure a SPF scheduled log message is printed only once */
- 
-@@ -1897,7 +1900,9 @@ static void ospf_spf_calculate_schedule_worker(struct thread *thread)
- 	/* Update all routers routing table */
- 	ospf->oall_rtrs = ospf->all_rtrs;
- 	ospf->all_rtrs = all_rtrs;
-+#ifdef SUPPORT_OSPF_API
- 	ospf_apiserver_notify_reachable(ospf->oall_rtrs, ospf->all_rtrs);
-+#endif
- 
- 	/* Free old ABR/ASBR routing table */
- 	if (ospf->old_rtrs)

frr.spec

@@ -1,3 +1,5 @@
+%global dist .ims.1%{?dist}
+
 %global frr_libdir %{_libexecdir}/frr
 
 %global _hardened_build 1
@@ -6,7 +8,7 @@
 %bcond_without selinux
 
 Name:           frr
-Version:        8.3.1
+Version:        8.4.2
 Release:        1%{?dist}
 Summary:        Routing daemon
 License:        GPLv2+
@@ -24,7 +26,6 @@ Patch0002:      0002-enable-openssl.patch
 Patch0003:      0003-disable-eigrp-crypto.patch
 Patch0004:      0004-fips-mode.patch
 Patch0005:      0005-remove-grpc-test.patch
-Patch0006:      0006-ospf-api.patch
 
 BuildRequires:  autoconf
 BuildRequires:  automake
@@ -66,7 +67,7 @@ Requires(postun): systemd
 Requires(preun): systemd
 
 %if 0%{?with_selinux}
-Requires: (%{name}-selinux if selinux-policy-%{selinuxtype})
+Requires: (%{name}-selinux = %{version}-%{release} if selinux-policy-%{selinuxtype})
 %endif
 
 Obsoletes:      quagga < 1.2.4-17
@@ -109,7 +110,7 @@ autoreconf -ivf
     --sysconfdir=%{_sysconfdir}/frr \
     --libdir=%{_libdir}/frr \
     --libexecdir=%{_libexecdir}/frr \
-    --localstatedir=%{_localstatedir}/run/frr \
+    --localstatedir=/run/frr \
     --enable-multipath=64 \
     --enable-vtysh=yes \
     --disable-ospfclient \
@@ -126,6 +127,7 @@ autoreconf -ivf
     --disable-babeld \
     --with-moduledir=%{_libdir}/frr/modules \
     --with-crypto=openssl \
+    --with-vici-socket=/run/strongswan/charon.vici \
     --enable-fpm \
     --enable-grpc
 
@@ -213,6 +215,11 @@ fi
 %post selinux
 %selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
 %selinux_relabel_post -s %{selinuxtype}
+#/var/tmp and /var/run need to be relabeled as well if FRR is running before upgrade
+if [ $1 == 2 ]; then
+    %{_sbindir}/restorecon -R /var/tmp/frr &> /dev/null
+    %{_sbindir}/restorecon -R /var/run/frr &> /dev/null
+fi
 
 %postun selinux
 if [ $1 -eq 0 ]; then
@@ -234,10 +241,14 @@ rm tests/lib/*grpc*
 %dir %attr(755,frr,frr) %{_localstatedir}/log/frr
 %dir %attr(755,frr,frr) /run/frr
 %{_infodir}/*info*
-%{_mandir}/man*/*
+%{_mandir}/man1/frr.1*
+%{_mandir}/man1/vtysh.1*
+%{_mandir}/man8/frr-*.8*
+%{_mandir}/man8/mtracebis.8*
 %dir %{frr_libdir}/
 %{frr_libdir}/*
-%{_bindir}/*
+%{_bindir}/mtracebis
+%{_bindir}/vtysh
 %dir %{_libdir}/frr
 %{_libdir}/frr/*.so.*
 %dir %{_libdir}/frr/modules
@@ -259,6 +270,33 @@ rm tests/lib/*grpc*
 %endif
 
 %changelog
+* Thu Jan 12 2023 Michal Ruprich <mruprich@redhat.com> - 8.4.2-1
+- New version 8.4.2
+
+* Fri Nov 25 2022 Michal Ruprich <mruprich@redhat.com> - 8.4.1-1
+- New version 8.4.1
+- Fix for rhbz #2140705
+
+* Thu Nov 10 2022 Michal Ruprich <mruprich@redhat.com> - 8.4-1
+- New version 8.4
+
+* Thu Sep 22 2022 Michal Ruprich <mruprich@redhat.com> - 8.3.1-6
+- Rebuilding because of weird abseil-cpp version mismatch in the compose (rhbz #2128691)
+
+* Fri Sep 16 2022 Michal Ruprich <mruprich@redhat.com> - 8.3.1-5
+- Adding SELinux rule to enable zebra to write to sysctl_net_t
+- Adding SELinux rule to enable bgpd to call name_connect to bgp_port_t
+
+* Fri Sep 09 2022 Michal Ruprich <mruprich@redhat.com> - 8.3.1-4
+- Adding a couple of rules to tackle AVCs
+
+* Fri Sep 09 2022 Michal Ruprich <mruprich@redhat.com> - 8.3.1-3
+- Resolves: #2124254 - frr can no longer update routes
+
+* Wed Sep 07 2022 Michal Ruprich <mruprich@redhat.com> - 8.3.1-2
+- Resolves: #2124253 - SELinux is preventing zebra from setattr access on the directory frr
+- Better handling FRR files during upgrade
+
 * Tue Sep 06 2022 Michal Ruprich <mruprich@redhat.com> - 8.3.1-1
 - New version 8.3.1
 

frr.te

@@ -31,9 +31,9 @@ files_pid_file(frr_var_run_t)
 #
 # frr local policy
 #
-allow frr_t self:capability { chown dac_override dac_read_search kill net_bind_service net_raw setgid setuid };
+allow frr_t self:capability { chown dac_override dac_read_search kill net_bind_service net_raw setgid setuid net_admin };
 allow frr_t self:netlink_route_socket rw_netlink_socket_perms;
-allow frr_t self:packet_socket create;
+allow frr_t self:packet_socket { create setopt };
 allow frr_t self:process { setcap setpgid };
 allow frr_t self:rawip_socket create_socket_perms;
 allow frr_t self:tcp_socket { connect connected_stream_socket_perms };
@@ -68,7 +68,7 @@ allow frr_t frr_exec_t:dir search_dir_perms;
 can_exec(frr_t, frr_exec_t)
 
 kernel_read_network_state(frr_t)
-kernel_read_net_sysctls(frr_t)
+kernel_rw_net_sysctls(frr_t)
 kernel_read_system_state(frr_t)
 
 auth_use_nsswitch(frr_t)
@@ -80,8 +80,10 @@ corenet_udp_bind_bfd_control_port(frr_t)
 corenet_udp_bind_bfd_echo_port(frr_t)
 corenet_udp_bind_bfd_multi_port(frr_t)
 corenet_tcp_bind_bgp_port(frr_t)
+corenet_tcp_connect_bgp_port(frr_t)
 corenet_tcp_bind_cmadmin_port(frr_t)
 corenet_udp_bind_cmadmin_port(frr_t)
+corenet_tcp_bind_generic_port(frr_t)
 corenet_tcp_bind_firepower_port(frr_t)
 corenet_tcp_bind_priority_e_com_port(frr_t)
 corenet_udp_bind_router_port(frr_t)
@@ -112,3 +114,7 @@ optional_policy(`
 optional_policy(`
 	networkmanager_read_state(frr_t)
 ')
+
+optional_policy(`
+        userdom_admin_home_dir_filetrans(frr_t, frr_conf_t, file, ".history_frr")
+')

sources

@@ -1,2 +1,2 @@
-SHA512 (frr-8.3.1.tar.gz) = a15b53c98c9739f316663c723c35954284b63ffd49cf88e22d3ac82e66a4b63ffc5f43a8d622f531d129436464fdbfcf103b2866240762510ec490c03563a8ae
+SHA512 (frr-8.4.2.tar.gz) = 1079bf3f597cc21ccbc37c5617cfb95f6e066de2a726a9b8ffb5825f92af3049d0e19ef4e9944a9e11dabc4309c56f0ab22e4c9188f5008ebcea47e0428f3ff0
 SHA512 (remove-babeld-ldpd.sh) = a5bf67a3722cb20d43cef1dac28f839db68df73a1b7d34d8438e4f9366da3b67d85c1f44281f93434e8dd8ebcb2d3dc258b77eaa5627475b7395d207f020839d