Resolves: #1983278 - ospfd crashes in route_node_delete with assertion fail

Fixing permissions on config files in /etc/frr
Enabling integrated configuration option for frr
2021-07-20 10:46:22 +02:00 · 2021-04-23 12:40:22 +02:00 · 2021-03-16 12:38:18 +01:00 · 2021-02-16 17:16:40 +01:00
20 changed files with 315 additions and 1087 deletions
--- a/.fmf/version
+++ b/.fmf/version
@@ -1 +0,0 @@
-1
--- a/.gitignore
+++ b/.gitignore
@@ -6,18 +6,3 @@
 /frr-7.4.tar.gz
 /frr-7.5.tar.gz
 /frr-7.5.1.tar.gz
-/frr-8.0.tar.gz
-/frr-8.0.1.tar.gz
-/frr-8.2.tar.gz
-/frr-8.2.2.tar.gz
-/frr-8.3.1.tar.gz
-/frr-8.4.tar.gz
-/frr-8.4.1.tar.gz
-/frr-8.4.2.tar.gz
-/frr-8.5.tar.gz
-/frr-8.5.1.tar.gz
-/frr-8.5.2.tar.gz
-/frr-9.0.1.tar.gz
-/frr-9.1.tar.gz
-/frr-10.0.1.tar.gz
-/frr-10.1.tar.gz
--- a/0000-remove-babeld-and-ldpd.patch
+++ b/0000-remove-babeld-and-ldpd.patch
@@ -16,9 +16,9 @@ index 5be3264..33abc1d 100644
 	snapcraft/helpers \
 	snapcraft/snap \
 -	babeld/Makefile \
- 	mgmtd/Makefile \
 	bgpd/Makefile \
 	bgpd/rfp-example/librfp/Makefile \
+ 	bgpd/rfp-example/rfptest/Makefile \
@@ -193,7 +190,6 @@ EXTRA_DIST += \
 	fpm/Makefile \
 	grpc/Makefile \
@@ -27,29 +27,3 @@ index 5be3264..33abc1d 100644
 	lib/Makefile \
 	nhrpd/Makefile \
 	ospf6d/Makefile \
-diff --git a/tools/etc/frr/daemons b/tools/etc/frr/daemons
-index 8aa0887..c92dcca 100644
--- a/tools/etc/frr/daemons
-+++ b/tools/etc/frr/daemons
-@@ -22,10 +22,8 @@ ripngd=no
- isisd=no
- pimd=no
- pim6d=no
-ldpd=no
- nhrpd=no
- eigrpd=no
-babeld=no
- sharpd=no
- pbrd=no
- bfdd=no
-@@ -48,10 +46,8 @@ ripngd_options=" -A ::1"
- isisd_options="  -A 127.0.0.1"
- pimd_options="   -A 127.0.0.1"
- pim6d_options="  -A ::1"
-ldpd_options="   -A 127.0.0.1"
- nhrpd_options="  -A 127.0.0.1"
- eigrpd_options=" -A 127.0.0.1"
-babeld_options=" -A 127.0.0.1"
- sharpd_options=" -A 127.0.0.1"
- pbrd_options="   -A 127.0.0.1"
- staticd_options="-A 127.0.0.1"
--- a/0001-use-python3.patch
+++ b/0001-use-python3.patch
@@ -0,0 +1,20 @@
+diff --git a/tools/frr-reload.py b/tools/frr-reload.py
+index 208fb11..0692adc 100755
+--- a/tools/frr-reload.py
+++ b/tools/frr-reload.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
+#!/usr/bin/python3
+ # Frr Reloader
+ # Copyright (C) 2014 Cumulus Networks, Inc.
+ #
+diff --git a/tools/generate_support_bundle.py b/tools/generate_support_bundle.py
+index 540b7a1..0876ebb 100755
+--- a/tools/generate_support_bundle.py
+++ b/tools/generate_support_bundle.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
+#!/usr/bin/python3
+ 
+ ########################################################
+ ### Python Script to generate the FRR support bundle ###
--- a/0002-enable-openssl.patch
+++ b/0002-enable-openssl.patch
@@ -8,8 +8,8 @@ index 0b7af18..0533e24 100644
 	lib/log_vty.c \
 -	lib/md5.c \
 	lib/memory.c \
- 	lib/mgmt_be_client.c \
- 	lib/mgmt_fe_client.c \
+ 	lib/mlag.c \
+ 	lib/module.c \
@@ -64,7 +64,6 @@ lib_libfrr_la_SOURCES = \
 	lib/routemap_northbound.c \
 	lib/sbuf.c \
@@ -19,15 +19,15 @@ index 0b7af18..0533e24 100644
 	lib/skiplist.c \
 	lib/sockopt.c \
@@ -170,7 +170,6 @@ pkginclude_HEADERS += \
- 	lib/link_state.h \
+ 	lib/linklist.h \
 	lib/log.h \
 	lib/log_vty.h \
 -	lib/md5.h \
 	lib/memory.h \
- 	lib/mgmt.pb-c.h \
- 	lib/mgmt_be_client.h \
+ 	lib/module.h \
+ 	lib/monotime.h \
@@ -191,7 +190,6 @@ pkginclude_HEADERS += \
- 	lib/route_opaque.h \
+ 	lib/routemap.h \
 	lib/sbuf.h \
 	lib/seqlock.h \
 -	lib/sha256.h \
--- a/0004-fips-mode.patch
+++ b/0004-fips-mode.patch
@@ -2,20 +2,9 @@ diff --git a/ospfd/ospf_vty.c b/ospfd/ospf_vty.c
 index 631465f..e084ff3 100644
 --- a/ospfd/ospf_vty.c
 +++ b/ospfd/ospf_vty.c
-@@ -7,6 +7,10 @@
- #include <zebra.h>
- #include <string.h>
- 
-+#ifdef CRYPTO_OPENSSL
-+#include <openssl/fips.h>
-+#endif
-+
- #include "printfrr.h"
- #include "monotime.h"
- #include "memory.h"
@@ -1136,6 +1136,11 @@ DEFUN (ospf_area_vlink,
- 		vl_config.keychain = argv[idx+1]->arg;
- 	} else if (argv_find(argv, argc, "message-digest", &idx)) {
+ 
+ 	if (argv_find(argv, argc, "message-digest", &idx)) {
 		/* authentication message-digest */
 +		if(FIPS_mode())
 +		{
@@ -52,7 +41,7 @@ index 631465f..e084ff3 100644
 +		}
 		SET_IF_PARAM(params, auth_type);
 		params->auth_type = OSPF_AUTH_CRYPTOGRAPHIC;
- 		UNSET_IF_PARAM(params, keychain_name);
+ 		return CMD_SUCCESS;
@@ -6971,6 +6990,11 @@ DEFUN (ip_ospf_message_digest_key,
        "The OSPF password (key)\n"
        "Address of interface\n")
@@ -69,17 +58,6 @@ diff --git a/isisd/isis_circuit.c b/isisd/isis_circuit.c
 index 81b4b39..cce33d9 100644
 --- a/isisd/isis_circuit.c
 +++ b/isisd/isis_circuit.c
-@@ -13,6 +13,10 @@
- #include <netinet/if_ether.h>
- #endif
- 
-+#ifdef CRYPTO_OPENSSL
-+#include <openssl/fips.h>
-+#endif
-+
- #include "log.h"
- #include "memory.h"
- #include "vrf.h"
@@ -1318,6 +1318,10 @@ static int isis_circuit_passwd_set(struct isis_circuit *circuit,
 		return ferr_code_bug(
 			"circuit password too long (max 254 chars)");
@@ -95,17 +73,6 @@ diff --git a/isisd/isisd.c b/isisd/isisd.c
 index 419127c..a6c36af 100644
 --- a/isisd/isisd.c
 +++ b/isisd/isisd.c
-@@ -9,6 +9,10 @@
- 
- #include <zebra.h>
- 
-+#ifdef CRYPTO_OPENSSL
-+#include <openssl/fips.h>
-+#endif
-+
- #include "frrevent.h"
- #include "vty.h"
- #include "command.h"
@@ -1638,6 +1638,10 @@ static int isis_area_passwd_set(struct isis_area *area, int level,
 		if (len > 254)
 			return -1;
@@ -121,17 +88,6 @@ diff --git a/ripd/rip_cli.c b/ripd/rip_cli.c
 index 5bb81ef..02a09ef 100644
 --- a/ripd/rip_cli.c
 +++ b/ripd/rip_cli.c
-@@ -7,6 +7,10 @@
- 
- #include <zebra.h>
- 
-+#ifdef CRYPTO_OPENSSL
-+#include <openssl/fips.h>
-+#endif
-+
- #include "if.h"
- #include "if_rmap.h"
- #include "vrf.h"
@@ -796,6 +796,12 @@ DEFPY (ip_rip_authentication_mode,
 			value = "20";
 	}
--- a/0005-icc-options.patch
+++ b/0005-icc-options.patch
@@ -0,0 +1,52 @@
+From 4e90d19ea3de6b8938d097d84f6df3fcf6eb0422 Mon Sep 17 00:00:00 2001
+From: Mark Stapp <mjs@voltanet.io>
+Date: Mon, 15 Feb 2021 13:59:02 -0500
+Subject: [PATCH] build: detect ICC, only try ICC options if ICC
+
+Some ICC command-line options can cause confusion for other
+compilers; test for ICC specifically, and only try to use those
+options if ICC is being used.
+
+Signed-off-by: Mark Stapp <mjs@voltanet.io>
+---
+ configure.ac | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 266f37a1129..f3d1f38986a 100755
+--- a/configure.ac
+++ b/configure.ac
+@@ -191,6 +191,11 @@ CXXFLAGS="$orig_cxxflags"
+ AC_PROG_CC_C99
+ dnl NB: see C11 below
+ 
+dnl Some special handling for ICC later on
+if test "$CC" = "icc"; then
+    cc_is_icc="yes"
+fi
+
+ PKG_PROG_PKG_CONFIG
+ 
+ dnl it's 2019, sed is sed.
+@@ -252,7 +257,9 @@ AC_DEFUN([AC_LINK_IFELSE_FLAGS], [{
+ 
+ dnl ICC won't bail on unknown options without -diag-error 10006
+ dnl need to do this first so we get useful results for the other options
+-AC_C_FLAG([-diag-error 10006])
+if test "$cc_is_icc" = "yes"; then
+    AC_C_FLAG([-diag-error 10006])
+fi
+ 
+ dnl AC_PROG_CC_C99 may change CC to include -std=gnu99 or something
+ ac_cc="$CC"
+@@ -335,7 +342,9 @@ AC_SUBST([CXX_COMPAT_CFLAGS])
+ dnl ICC emits a broken warning for const char *x = a ? "b" : "c";
+ dnl for some reason the string consts get 'promoted' to char *,
+ dnl triggering a const to non-const conversion warning.
+-AC_C_FLAG([-diag-disable 3179])
+if test "$cc_is_icc" = "yes"; then
+    AC_C_FLAG([-diag-disable 3179])
+fi
+ 
+ if test "$enable_werror" = "yes" ; then
+   WERROR="-Werror"
--- a/0005-remove-grpc-test.patch
+++ b/0005-remove-grpc-test.patch
@@ -1,27 +0,0 @@
-diff --git a/tests/lib/subdir.am b/tests/lib/subdir.am
-index 7b5eaa4..5c82f69 100644
--- a/tests/lib/subdir.am
-+++ b/tests/lib/subdir.am
-@@ -18,22 +18,6 @@ tests_lib_test_frrscript_SOURCES = tests/lib/test_frrscript.c
- 	test -e tests/lib/script1.lua || \
- 	$(INSTALL_SCRIPT) $< tests/lib/script1.lua
- 
-##############################################################################
-GRPC_TESTS_LDADD = mgmtd/libmgmt_be_nb.la staticd/libstatic.a grpc/libfrrgrpc_pb.la $(GRPC_LIBS) $(ALL_TESTS_LDADD) $(LIBYANG_LIBS) -lm
-
-if GRPC
-check_PROGRAMS += tests/lib/test_grpc
-endif
-tests_lib_test_grpc_CXXFLAGS = $(WERROR) $(TESTS_CXXFLAGS)
-tests_lib_test_grpc_CPPFLAGS = $(TESTS_CPPFLAGS)
-tests_lib_test_grpc_LDADD = $(GRPC_TESTS_LDADD)
-tests_lib_test_grpc_SOURCES = tests/lib/test_grpc.cpp
-nodist_tests_lib_test_grpc_SOURCES = \
-	yang/frr-bfdd.yang.c \
-	yang/frr-staticd.yang.c \
-	# end
-
-
- ##############################################################################
- if ZEROMQ
- check_PROGRAMS += tests/lib/test_zmq
--- a/0006-move-to-libexec.patch
+++ b/0006-move-to-libexec.patch
@@ -0,0 +1,17 @@
+diff --git a/tools/frr.service b/tools/frr.service
+index aa45f42..402def8 100644
+--- a/tools/frr.service
+++ b/tools/frr.service
+@@ -17,9 +17,9 @@ WatchdogSec=60s
+ RestartSec=5
+ Restart=on-abnormal
+ LimitNOFILE=1024
+-ExecStart=/usr/lib/frr/frrinit.sh start
+-ExecStop=/usr/lib/frr/frrinit.sh stop
+-ExecReload=/usr/lib/frr/frrinit.sh reload
+ExecStart=/usr/libexec/frr/frrinit.sh start
+ExecStop=/usr/libexec/frr/frrinit.sh stop
+ExecReload=/usr/libexec/frr/frrinit.sh reload
+ 
+ [Install]
+ WantedBy=multi-user.target
--- a/0006-noprefixroute-network-manager.patch
+++ b/0006-noprefixroute-network-manager.patch
@@ -1,167 +0,0 @@
--- b/tests/topotests/zebra_multiple_connected/test_zebra_multiple_connected.py
-+++ a/tests/topotests/zebra_multiple_connected/test_zebra_multiple_connected.py
-@@ -144,23 +144,6 @@
-     assert result is None, "Kernel route is missing from zebra"
- 
- 
-def test_zebra_noprefix_connected():
-    "Test that a noprefixroute created does not create a connected route"
-
-    tgen = get_topogen()
-    if tgen.routers_have_failure():
-        pytest.skip(tgen.errors)
-
-    router = tgen.gears["r1"]
-    router.run("ip addr add 192.168.44.1/24 dev r1-eth1 noprefixroute")
-    expected = "% Network not in table"
-    test_func = partial(
-        topotest.router_output_cmp, router, "show ip route 192.168.44.0/24", expected
-    )
-    result, diff = topotest.run_and_expect(test_func, "", count=20, wait=1)
-    assert result, "Connected Route should not have been added"
-
-
- if __name__ == "__main__":
-     args = ["-s"] + sys.argv[1:]
-     sys.exit(pytest.main(args))
--- b/zebra/if_netlink.c
-+++ a/zebra/if_netlink.c
-@@ -1423,9 +1423,6 @@
- 	if (kernel_flags & IFA_F_SECONDARY)
- 		dplane_ctx_intf_set_secondary(ctx);
- 
-	if (kernel_flags & IFA_F_NOPREFIXROUTE)
-		dplane_ctx_intf_set_noprefixroute(ctx);
-
- 	/* Label */
- 	if (tb[IFA_LABEL]) {
- 		label = (char *)RTA_DATA(tb[IFA_LABEL]);
--- b/zebra/zebra_dplane.c
-+++ a/zebra/zebra_dplane.c
-@@ -230,7 +230,6 @@
- #define DPLANE_INTF_BROADCAST   (1 << 2)
- #define DPLANE_INTF_HAS_DEST    DPLANE_INTF_CONNECTED
- #define DPLANE_INTF_HAS_LABEL   (1 << 4)
-#define DPLANE_INTF_NOPREFIXROUTE (1 << 5)
- 
- 	/* Interface address/prefix */
- 	struct prefix prefix;
-@@ -2542,13 +2541,6 @@
- 	return (ctx->u.intf.flags & DPLANE_INTF_CONNECTED);
- }
- 
-bool dplane_ctx_intf_is_noprefixroute(const struct zebra_dplane_ctx *ctx)
-{
-	DPLANE_CTX_VALID(ctx);
-
-	return (ctx->u.intf.flags & DPLANE_INTF_NOPREFIXROUTE);
-}
-
- bool dplane_ctx_intf_is_secondary(const struct zebra_dplane_ctx *ctx)
- {
- 	DPLANE_CTX_VALID(ctx);
-@@ -2577,13 +2569,6 @@
- 	ctx->u.intf.flags |= DPLANE_INTF_SECONDARY;
- }
- 
-void dplane_ctx_intf_set_noprefixroute(struct zebra_dplane_ctx *ctx)
-{
-	DPLANE_CTX_VALID(ctx);
-
-	ctx->u.intf.flags |= DPLANE_INTF_NOPREFIXROUTE;
-}
-
- void dplane_ctx_intf_set_broadcast(struct zebra_dplane_ctx *ctx)
- {
- 	DPLANE_CTX_VALID(ctx);
--- b/zebra/zebra_dplane.h
-+++ a/zebra/zebra_dplane.h
-@@ -658,8 +658,6 @@
- void dplane_ctx_intf_set_connected(struct zebra_dplane_ctx *ctx);
- bool dplane_ctx_intf_is_secondary(const struct zebra_dplane_ctx *ctx);
- void dplane_ctx_intf_set_secondary(struct zebra_dplane_ctx *ctx);
-bool dplane_ctx_intf_is_noprefixroute(const struct zebra_dplane_ctx *ctx);
-void dplane_ctx_intf_set_noprefixroute(struct zebra_dplane_ctx *ctx);
- bool dplane_ctx_intf_is_broadcast(const struct zebra_dplane_ctx *ctx);
- void dplane_ctx_intf_set_broadcast(struct zebra_dplane_ctx *ctx);
- const struct prefix *dplane_ctx_get_intf_addr(
--- b/lib/if.h
-+++ a/lib/if.h
-@@ -434,8 +434,6 @@
- #define ZEBRA_IFA_SECONDARY    (1 << 0)
- #define ZEBRA_IFA_PEER         (1 << 1)
- #define ZEBRA_IFA_UNNUMBERED   (1 << 2)
-#define ZEBRA_IFA_NOPREFIXROUTE (1 << 3)
-
- 	/* N.B. the ZEBRA_IFA_PEER flag should be set if and only if
- 	   a peer address has been configured.  If this flag is set,
- 	   the destination field must contain the peer address.
--- b/zebra/connected.c
-+++ a/zebra/connected.c
-@@ -282,15 +282,13 @@
- 			return;
- 	}
- 
-+	rib_add(afi, SAFI_UNICAST, zvrf->vrf->vrf_id, ZEBRA_ROUTE_CONNECT, 0,
-+		flags, &p, NULL, &nh, 0, zvrf->table_id, metric, 0, 0, 0,
-+		false);
-	if (!CHECK_FLAG(ifc->flags, ZEBRA_IFA_NOPREFIXROUTE)) {
-		rib_add(afi, SAFI_UNICAST, zvrf->vrf->vrf_id,
-			ZEBRA_ROUTE_CONNECT, 0, flags, &p, NULL, &nh, 0,
-			zvrf->table_id, metric, 0, 0, 0, false);
- 
-+	rib_add(afi, SAFI_MULTICAST, zvrf->vrf->vrf_id, ZEBRA_ROUTE_CONNECT, 0,
-+		flags, &p, NULL, &nh, 0, zvrf->table_id, metric, 0, 0, 0,
-+		false);
-		rib_add(afi, SAFI_MULTICAST, zvrf->vrf->vrf_id,
-			ZEBRA_ROUTE_CONNECT, 0, flags, &p, NULL, &nh, 0,
-			zvrf->table_id, metric, 0, 0, 0, false);
-	}
- 
- 	if (install_local) {
- 		rib_add(afi, SAFI_UNICAST, zvrf->vrf->vrf_id, ZEBRA_ROUTE_LOCAL,
-@@ -483,15 +481,11 @@
- 	 * Same logic as for connected_up(): push the changes into the
- 	 * head.
- 	 */
-+	rib_delete(afi, SAFI_UNICAST, zvrf->vrf->vrf_id, ZEBRA_ROUTE_CONNECT, 0,
-+		   0, &p, NULL, &nh, 0, zvrf->table_id, 0, 0, false);
-	if (!CHECK_FLAG(ifc->flags, ZEBRA_IFA_NOPREFIXROUTE)) {
-		rib_delete(afi, SAFI_UNICAST, zvrf->vrf->vrf_id,
-			   ZEBRA_ROUTE_CONNECT, 0, 0, &p, NULL, &nh, 0,
-			   zvrf->table_id, 0, 0, false);
- 
-+	rib_delete(afi, SAFI_MULTICAST, zvrf->vrf->vrf_id, ZEBRA_ROUTE_CONNECT,
-+		   0, 0, &p, NULL, &nh, 0, zvrf->table_id, 0, 0, false);
-		rib_delete(afi, SAFI_MULTICAST, zvrf->vrf->vrf_id,
-			   ZEBRA_ROUTE_CONNECT, 0, 0, &p, NULL, &nh, 0,
-			   zvrf->table_id, 0, 0, false);
-	}
- 
- 	if (remove_local) {
- 		rib_delete(afi, SAFI_UNICAST, zvrf->vrf->vrf_id,
--- b/zebra/interface.c
-+++ a/zebra/interface.c
-@@ -1317,9 +1317,6 @@
- 	if (dplane_ctx_intf_is_secondary(ctx))
- 		SET_FLAG(flags, ZEBRA_IFA_SECONDARY);
- 
-	if (dplane_ctx_intf_is_noprefixroute(ctx))
-		SET_FLAG(flags, ZEBRA_IFA_NOPREFIXROUTE);
-
- 	/* Label? */
- 	if (dplane_ctx_intf_has_label(ctx))
- 		label = dplane_ctx_get_intf_label(ctx);
-@@ -2337,12 +2334,6 @@
- 	else if (CHECK_FLAG(connected->flags, ZEBRA_IFA_SECONDARY))
- 		vty_out(vty, " secondary");
- 
-	if (json)
-		json_object_boolean_add(json_addr, "noPrefixRoute",
-					CHECK_FLAG(connected->flags, ZEBRA_IFA_NOPREFIXROUTE));
-	else if (CHECK_FLAG(connected->flags, ZEBRA_IFA_NOPREFIXROUTE))
-		vty_out(vty, " noprefixroute");
-
- 	if (json)
- 		json_object_boolean_add(
- 			json_addr, "unnumbered",
--- a/0007-ospfd-crash.patch
+++ b/0007-ospfd-crash.patch
@@ -0,0 +1,108 @@
+From 4f08c715db6893ff439d0a39bf4506cd26256d13 Mon Sep 17 00:00:00 2001
+From: Igor Ryzhov <iryzhov@nfware.com>
+Date: Fri, 18 Jun 2021 13:06:13 +0300
+Subject: [PATCH] lib: remove pure attribute from functions that modify memory
+
+Almost all functions currently marked with pure attribute acquire a
+route_node lock. By marking them pure we allow compiler to optimize the
+code and not call them when it already knows the return value. This is
+completely incorrect.
+
+Only two of eleven functions can be marked as pure. And they still won't
+be optimized because they are never called from the same function twice.
+Let's remove the ext_pure macro completely to reduce the chance of
+repeating this mistake in the future.
+
+Fixes #8866, #8809, #8595, #6992.
+
+Signed-off-by: Igor Ryzhov <iryzhov@nfware.com>
+---
+ lib/compiler.h |  9 ---------
+ lib/table.h    | 44 ++++++++++++++++++++------------------------
+ 2 files changed, 20 insertions(+), 33 deletions(-)
+
+diff --git a/lib/compiler.h b/lib/compiler.h
+index bbfe01b569c..e805eb8be48 100644
+--- a/lib/compiler.h
+++ b/lib/compiler.h
+@@ -123,15 +123,6 @@ extern "C" {
+ #define assume(x)
+ #endif
+ 
+-/* pure = function does not modify memory & return value is the same if
+- * memory hasn't changed (=> allows compiler to optimize)
+- *
+- * Mostly autodetected by the compiler if function body is available (i.e.
+- * static inline functions in headers).  Since that implies it should only be
+- * used in headers for non-inline functions, the "extern" is included here.
+- */
+-#define ext_pure	extern __attribute__((pure))
+-
+ /* for helper functions defined inside macros */
+ #define macro_inline	static inline __attribute__((unused))
+ #define macro_pure	static inline __attribute__((unused, pure))
+diff --git a/lib/table.h b/lib/table.h
+index 7e383dce808..5dec69ee7ea 100644
+--- a/lib/table.h
+++ b/lib/table.h
+@@ -197,29 +197,25 @@ static inline void route_table_set_info(struct route_table *table, void *d)
+ 	table->info = d;
+ }
+ 
+-/* ext_pure => extern __attribute__((pure))
+- *   does not modify memory (but depends on mem), allows compiler to optimize
+- */
+-
+ extern void route_table_finish(struct route_table *table);
+-ext_pure struct route_node *route_top(struct route_table *table);
+-ext_pure struct route_node *route_next(struct route_node *node);
+-ext_pure struct route_node *route_next_until(struct route_node *node,
+-					     const struct route_node *limit);
+extern struct route_node *route_top(struct route_table *table);
+extern struct route_node *route_next(struct route_node *node);
+extern struct route_node *route_next_until(struct route_node *node,
+					   const struct route_node *limit);
+ extern struct route_node *route_node_get(struct route_table *table,
+ 					 union prefixconstptr pu);
+-ext_pure struct route_node *route_node_lookup(struct route_table *table,
+-					      union prefixconstptr pu);
+-ext_pure struct route_node *route_node_lookup_maynull(struct route_table *table,
+-						      union prefixconstptr pu);
+-ext_pure struct route_node *route_node_match(struct route_table *table,
+-					     union prefixconstptr pu);
+-ext_pure struct route_node *route_node_match_ipv4(struct route_table *table,
+-						  const struct in_addr *addr);
+-ext_pure struct route_node *route_node_match_ipv6(struct route_table *table,
+-						  const struct in6_addr *addr);
+-
+-ext_pure unsigned long route_table_count(struct route_table *table);
+extern struct route_node *route_node_lookup(struct route_table *table,
+					    union prefixconstptr pu);
+extern struct route_node *route_node_lookup_maynull(struct route_table *table,
+						    union prefixconstptr pu);
+extern struct route_node *route_node_match(struct route_table *table,
+					   union prefixconstptr pu);
+extern struct route_node *route_node_match_ipv4(struct route_table *table,
+						const struct in_addr *addr);
+extern struct route_node *route_node_match_ipv6(struct route_table *table,
+						const struct in6_addr *addr);
+
+extern unsigned long route_table_count(struct route_table *table);
+ 
+ extern struct route_node *route_node_create(route_table_delegate_t *delegate,
+ 					    struct route_table *table);
+@@ -228,10 +224,10 @@ extern void route_node_destroy(route_table_delegate_t *delegate,
+ 			       struct route_table *table,
+ 			       struct route_node *node);
+ 
+-ext_pure struct route_node *route_table_get_next(struct route_table *table,
+-						 union prefixconstptr pu);
+-ext_pure int route_table_prefix_iter_cmp(const struct prefix *p1,
+-					 const struct prefix *p2);
+extern struct route_node *route_table_get_next(struct route_table *table,
+					       union prefixconstptr pu);
+extern int route_table_prefix_iter_cmp(const struct prefix *p1,
+				       const struct prefix *p2);
+ 
+ /*
+  * Iterator functions.
--- a/frr-sysusers.conf
+++ b/frr-sysusers.conf
@@ -1,4 +0,0 @@
-#Type Name   ID     GECOS                        Home directory  Shell
-g     frrvty -
-u     frr    -      "FRRouting routing suite"    /var/run/frr    /sbin/nologin
-m     frr    frrvty
--- a/frr.fc
+++ b/frr.fc
@@ -1,30 +0,0 @@
-/usr/libexec/frr/(.*)?              gen_context(system_u:object_r:frr_exec_t,s0)
-
-/usr/lib/systemd/system/frr.*   gen_context(system_u:object_r:frr_unit_file_t,s0)
-
-/etc/frr(/.*)?                  gen_context(system_u:object_r:frr_conf_t,s0)
-
-/var/log/frr(/.*)?              gen_context(system_u:object_r:frr_log_t,s0)
-/var/tmp/frr(/.*)?              gen_context(system_u:object_r:frr_tmp_t,s0)
-/var/lib/frr(/.*)?              gen_context(system_u:object_r:frr_var_lib_t,s0)
-
-/run/lock/subsys/bfdd       --  gen_context(system_u:object_r:frr_lock_t,s0)
-/run/lock/subsys/bgpd       --  gen_context(system_u:object_r:frr_lock_t,s0)
-/run/lock/subsys/eigrpd     --  gen_context(system_u:object_r:frr_lock_t,s0)
-/run/lock/subsys/fabricd    --  gen_context(system_u:object_r:frr_lock_t,s0)
-/run/lock/subsys/isisd      --  gen_context(system_u:object_r:frr_lock_t,s0)
-/run/lock/subsys/nhrpd      --  gen_context(system_u:object_r:frr_lock_t,s0)
-/run/lock/subsys/ospf6d     --  gen_context(system_u:object_r:frr_lock_t,s0)
-/run/lock/subsys/ospfd      --  gen_context(system_u:object_r:frr_lock_t,s0)
-/run/lock/subsys/pbrd       --  gen_context(system_u:object_r:frr_lock_t,s0)
-/run/lock/subsys/pimd       --  gen_context(system_u:object_r:frr_lock_t,s0)
-/run/lock/subsys/ripd       --  gen_context(system_u:object_r:frr_lock_t,s0)
-/run/lock/subsys/ripngd     --  gen_context(system_u:object_r:frr_lock_t,s0)
-/run/lock/subsys/staticd    --  gen_context(system_u:object_r:frr_lock_t,s0)
-/run/lock/subsys/zebra      --  gen_context(system_u:object_r:frr_lock_t,s0)
-/run/lock/subsys/vrrpd      --  gen_context(system_u:object_r:frr_lock_t,s0)
-/run/lock/subsys/pathd      --  gen_context(system_u:object_r:frr_lock_t,s0)
-
-/run/frr(/.*)?              gen_context(system_u:object_r:frr_var_run_t,s0)
-
-/usr/bin/vtysh              --  gen_context(system_u:object_r:frr_exec_t,s0)
--- a/frr.if
+++ b/frr.if
@@ -1,214 +0,0 @@
-## <summary>policy for frr</summary>
-
-########################################
-## <summary>
-##	Execute frr_exec_t in the frr domain.
-## </summary>
-## <param name="domain">
-## <summary>
-##	Domain allowed to transition.
-## </summary>
-## </param>
-#
-interface(`frr_domtrans',`
-	gen_require(`
-		type frr_t, frr_exec_t;
-	')
-
-	corecmd_search_bin($1)
-	domtrans_pattern($1, frr_exec_t, frr_t)
-')
-
-######################################
-## <summary>
-##	Execute frr in the caller domain.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`frr_exec',`
-	gen_require(`
-		type frr_exec_t;
-	')
-
-	corecmd_search_bin($1)
-	can_exec($1, frr_exec_t)
-')
-
-########################################
-## <summary>
-##	Read frr's log files.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-## <rolecap/>
-#
-interface(`frr_read_log',`
-	gen_require(`
-		type frr_log_t;
-	')
-
-	read_files_pattern($1, frr_log_t, frr_log_t)
-	optional_policy(`
-		logging_search_logs($1)
-	')
-')
-
-########################################
-## <summary>
-##	Append to frr log files.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`frr_append_log',`
-	gen_require(`
-		type frr_log_t;
-	')
-
-	append_files_pattern($1, frr_log_t, frr_log_t)
-	optional_policy(`
-		logging_search_logs($1)
-	')
-')
-
-########################################
-## <summary>
-##	Manage frr log files
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`frr_manage_log',`
-	gen_require(`
-		type frr_log_t;
-	')
-
-	manage_dirs_pattern($1, frr_log_t, frr_log_t)
-	manage_files_pattern($1, frr_log_t, frr_log_t)
-	manage_lnk_files_pattern($1, frr_log_t, frr_log_t)
-	optional_policy(`
-		logging_search_logs($1)
-	')
-')
-
-########################################
-## <summary>
-##	Read frr PID files.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`frr_read_pid_files',`
-	gen_require(`
-		type frr_var_run_t;
-	')
-
-	files_search_pids($1)
-	read_files_pattern($1, frr_var_run_t, frr_var_run_t)
-')
-
-########################################
-## <summary>
-##	All of the rules required to administrate
-##	an frr environment
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`frr_admin',`
-	gen_require(`
-		type frr_t;
-		type frr_log_t;
-		type frr_var_run_t;
-	')
-
-	allow $1 frr_t:process { signal_perms };
-	ps_process_pattern($1, frr_t)
-
-	tunable_policy(`deny_ptrace',`',`
-		allow $1 frr_t:process ptrace;
-	')
-
-	admin_pattern($1, frr_log_t)
-
-	files_search_pids($1)
-	admin_pattern($1, frr_var_run_t)
-	optional_policy(`
-		logging_search_logs($1)
-	')
-	optional_policy(`
-		systemd_passwd_agent_exec($1)
-		systemd_read_fifo_file_passwd_run($1)
-	')
-')
-
-########################################
-#
-# Interface compatibility blocks
-#
-# The following definitions ensure compatibility with distribution policy
-# versions that do not contain given interfaces (epel, or older Fedora
-# releases).
-# Each block tests for existence of given interface and defines it if needed.
-#
-
-######################################
-## <summary>
-##	Watch ifconfig_var_run_t directories
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-ifndef(`sysnet_watch_ifconfig_run_dirs',`
-	interface(`sysnet_watch_ifconfig_run_dirs',`
-		gen_require(`
-			type ifconfig_var_run_t;
-		')
-
-		watch_dirs_pattern($1, ifconfig_var_run_t, ifconfig_var_run_t)
-	')
-')
-
-########################################
-## <summary>
-##	Read ifconfig_var_run_t files and link files
-## </summary>
-## <param name="domain">
-##	<summary>
-##      Domain allowed access.
-##	</summary>
-## </param>
-#
-ifndef(`sysnet_read_ifconfig_run_files',`
-	interface(`sysnet_read_ifconfig_run_files',`
-		gen_require(`
-			type ifconfig_var_run_t;
-		')
-
-		list_dirs_pattern($1, ifconfig_var_run_t, ifconfig_var_run_t)
-		read_files_pattern($1, ifconfig_var_run_t, ifconfig_var_run_t)
-		read_lnk_files_pattern($1, ifconfig_var_run_t, ifconfig_var_run_t)
-	')
-')
--- a/frr.spec
+++ b/frr.spec
@@ -1,115 +1,75 @@
-%global dist .ims.1%{?dist}
-
-%global frr_libdir %{_libexecdir}/frr
+%global frrversion	7.5.1
+%global frr_libdir /usr/libexec/frr

 %global _hardened_build 1
-%global selinuxtype targeted
 %define _legacy_common_support 1

-%bcond grpc %{undefined rhel}
-%bcond selinux 1
-
-Name:           frr
-Version:        10.1
-Release:        4%{?dist}
-Summary:        Routing daemon
-License:        GPL-2.0-or-later AND ISC AND LGPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND (GPL-2.0-or-later  OR ISC) AND MIT
-URL:            http://www.frrouting.org
-Source0:        https://github.com/FRRouting/frr/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz
-Source1:        %{name}-tmpfiles.conf
-Source2:        %{name}-sysusers.conf
-#Decentralized SELinux policy
-Source3:        frr.fc
-Source4:        frr.te
-Source5:        frr.if
-
-Patch0000:      0000-remove-babeld-and-ldpd.patch
-Patch0002:      0002-enable-openssl.patch
-Patch0003:      0003-disable-eigrp-crypto.patch
-Patch0004:      0004-fips-mode.patch
-Patch0005:      0005-remove-grpc-test.patch
-Patch0006:      0006-noprefixroute-network-manager.patch
-
-BuildRequires:  autoconf
-BuildRequires:  automake
-BuildRequires:  bison >= 2.7
-BuildRequires:  c-ares-devel
-BuildRequires:  flex
-BuildRequires:  gcc
-BuildRequires:  gcc-c++
-BuildRequires:  git-core
-BuildRequires:  groff
-%if %{with grpc}
-BuildRequires:  grpc-devel
-BuildRequires:  grpc-plugins
-%endif
-BuildRequires:  json-c-devel
-BuildRequires:  libcap-devel
-BuildRequires:  libtool
-BuildRequires:  libyang-devel >= 2.0.0
-BuildRequires:  make
-BuildRequires:  ncurses
-BuildRequires:  ncurses-devel
-BuildRequires:  net-snmp-devel
-BuildRequires:  pam-devel
-BuildRequires:  patch
-BuildRequires:  perl-XML-LibXML
-BuildRequires:  perl-generators
-BuildRequires:  python3-devel
-BuildRequires:  python3-pytest
-BuildRequires:  python3-sphinx
-BuildRequires:  readline-devel
-BuildRequires:  systemd-devel
-BuildRequires:  systemd-rpm-macros
-BuildRequires:  texinfo
-BuildRequires:  protobuf-c-devel
-
-Requires:       ncurses
-Requires:       net-snmp
-Requires(post): hostname
-%{?sysusers_requires_compat}
-Requires(post): systemd
+Name: frr
+Version: 7.5.1
+Release: 3%{?checkout}%{?dist}
+Summary: Routing daemon
+License: GPLv2+
+URL: http://www.frrouting.org
+Source0: https://github.com/FRRouting/frr/releases/download/%{name}-%{frrversion}/%{name}-%{frrversion}.tar.gz
+Source1: %{name}-tmpfiles.conf
+BuildRequires: perl-generators
+BuildRequires: gcc
+BuildRequires: gcc-c++
+BuildRequires: net-snmp-devel
+BuildRequires: texinfo 
+BuildRequires: libcap-devel
+BuildRequires: autoconf
+BuildRequires: automake
+BuildRequires: libtool
+BuildRequires: patch
+BuildRequires: groff
+BuildRequires: readline-devel
+BuildRequires: ncurses
+BuildRequires: ncurses-devel
+BuildRequires: pam-devel
+BuildRequires: c-ares-devel
+BuildRequires: bison >= 2.7
+BuildRequires: flex
+BuildRequires: perl-XML-LibXML
+BuildRequires: python3-devel
+BuildRequires: python3-sphinx
+BuildRequires: python3-pytest
+BuildRequires: systemd-devel
+BuildRequires: grpc-plugins
+BuildRequires: grpc-devel
+BuildRequires: readline
+BuildRequires: git-core
+BuildRequires: json-c-devel
+BuildRequires: systemd
+BuildRequires: libyang-devel >= 0.16.74
+BuildRequires: make
+Requires: net-snmp ncurses
+Requires(post): systemd /sbin/install-info hostname
+Requires(preun): systemd /sbin/install-info
 Requires(postun): systemd
-Requires(preun): systemd
+Provides: routingdaemon = %{version}-%{release}
+Conflicts: quagga

-%if 0%{?with_selinux}
-Requires: (%{name}-selinux = %{version}-%{release} if selinux-policy-%{selinuxtype})
-%endif
-
-Obsoletes:      quagga < 1.2.4-17
-Provides:       routingdaemon = %{version}-%{release}
+Patch0000: 0000-remove-babeld-and-ldpd.patch
+Patch0001: 0001-use-python3.patch
+Patch0002: 0002-enable-openssl.patch
+Patch0003: 0003-disable-eigrp-crypto.patch
+Patch0004: 0004-fips-mode.patch
+Patch0005: 0005-icc-options.patch
+Patch0006: 0006-move-to-libexec.patch
+Patch0007: 0007-ospfd-crash.patch

 %description
 FRRouting is free software that manages TCP/IP based routing protocols. It takes
 a multi-server and multi-threaded approach to resolve the current complexity
 of the Internet.

-FRRouting supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR,
-EIGRP and BFD.
+FRRouting supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

 FRRouting is a fork of Quagga.

-%if 0%{?with_selinux}
-%package selinux
-Summary:  Selinux policy for FRR
-BuildArch:  noarch
-Requires:  selinux-policy-%{selinuxtype}
-Requires(post):  selinux-policy-%{selinuxtype}
-BuildRequires:  selinux-policy-devel
-%{?selinux_requires}
-
-%description selinux
-SELinux policy modules for FRR package
-
-%endif
-
 %prep
 %autosetup -S git
-#Selinux
-mkdir selinux
-cp -p %{SOURCE3} %{SOURCE4} %{SOURCE5} selinux
-# C++14 or later needed for abseil-cpp 20230125; string_view needs C++17:
-sed -r -i 's/(AX_CXX_COMPILE_STDCXX\(\[)11(\])/\117\2/' configure.ac

 %build
 autoreconf -ivf
@@ -119,7 +79,7 @@ autoreconf -ivf
    --sysconfdir=%{_sysconfdir}/frr \
    --libdir=%{_libdir}/frr \
    --libexecdir=%{_libexecdir}/frr \
-    --localstatedir=/run/frr \
+    --localstatedir=%{_localstatedir}/run/frr \
    --enable-multipath=64 \
    --enable-vtysh=yes \
    --disable-ospfclient \
@@ -135,68 +95,61 @@ autoreconf -ivf
    --disable-ldpd \
    --disable-babeld \
    --with-moduledir=%{_libdir}/frr/modules \
-    --with-yangmodelsdir=%{_datadir}/frr-yang/ \
    --with-crypto=openssl \
-    --with-vici-socket=/run/strongswan/charon.vici \
    --enable-fpm \
-    %{?with_grpc:--enable-grpc}
+    --enable-grpc

 %make_build MAKEINFO="makeinfo --no-split" PYTHON=%{__python3}

-# Build info documentation
-%make_build -C doc info
-
-#SELinux policy
-%if 0%{?with_selinux}
-make -C selinux -f %{_datadir}/selinux/devel/Makefile %{name}.pp
-bzip2 -9 selinux/%{name}.pp
-%endif
+pushd doc
+make info
+popd

 %install
-mkdir -p %{buildroot}%{_sysconfdir}/{frr,rc.d/init.d,sysconfig,logrotate.d,pam.d,default} \
-         %{buildroot}%{_localstatedir}/log/frr %{buildroot}%{_infodir} \
+mkdir -p %{buildroot}/etc/{frr,rc.d/init.d,sysconfig,logrotate.d,pam.d,default} \
+         %{buildroot}/var/log/frr %{buildroot}%{_infodir} \
         %{buildroot}%{_unitdir}

 mkdir -p -m 0755 %{buildroot}%{_libdir}/frr
 mkdir -p %{buildroot}%{_tmpfilesdir}
-mkdir -p %{buildroot}%{_sysusersdir}

 %make_install

 # Remove this file, as it is uninstalled and causes errors when building on RH9
-rm -rf %{buildroot}%{_infodir}/dir
+rm -rf %{buildroot}/usr/share/info/dir

 install -p -m 644 %{SOURCE1} %{buildroot}%{_tmpfilesdir}/%{name}.conf
-install -p -m 644 %{SOURCE2} %{buildroot}%{_sysusersdir}/%{name}.conf
-install -p -m 644 tools/etc/frr/daemons %{buildroot}%{_sysconfdir}/frr/daemons
-install -p -m 644 tools/frr.service %{buildroot}%{_unitdir}/frr.service
-install -p -m 755 tools/frrinit.sh %{buildroot}%{frr_libdir}/frr
-install -p -m 755 tools/frrcommon.sh %{buildroot}%{frr_libdir}/frrcommon.sh
-install -p -m 755 tools/watchfrr.sh %{buildroot}%{frr_libdir}/watchfrr.sh
+install -p -m 644 %{_builddir}/%{name}-%{frrversion}/tools/etc/frr/daemons %{buildroot}/etc/frr/daemons
+install -p -m 644 %{_builddir}/%{name}-%{frrversion}/tools/frr.service %{buildroot}%{_unitdir}/frr.service
+install -p -m 755 %{_builddir}/%{name}-%{frrversion}/tools/frrinit.sh %{buildroot}%{frr_libdir}/frr
+install -p -m 755 %{_builddir}/%{name}-%{frrversion}/tools/frrcommon.sh %{buildroot}%{frr_libdir}/frrcommon.sh
+install -p -m 755 %{_builddir}/%{name}-%{frrversion}/tools/watchfrr.sh %{buildroot}%{frr_libdir}/watchfrr.sh

-install -p -m 644 redhat/frr.logrotate %{buildroot}%{_sysconfdir}/logrotate.d/frr
-install -p -m 644 redhat/frr.pam %{buildroot}%{_sysconfdir}/pam.d/frr
+install -p -m 644 %{_builddir}/%{name}-%{frrversion}/redhat/frr.logrotate %{buildroot}/etc/logrotate.d/frr
+install -p -m 644 %{_builddir}/%{name}-%{frrversion}/redhat/frr.pam %{buildroot}/etc/pam.d/frr
 install -d -m 775 %{buildroot}/run/frr

-%if 0%{?with_selinux}
-install -D -m 644 selinux/%{name}.pp.bz2 \
-  %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
-install -D -m 644 selinux/%{name}.if %{buildroot}%{_datadir}/selinux/devel/include/distributed/%{name}.if
-%endif
-
-# Delete libtool archives
-find %{buildroot} -type f -name "*.la" -delete -print
+rm %{buildroot}%{_libdir}/frr/*.la
+rm %{buildroot}%{_libdir}/frr/modules/*.la

 #Upstream does not maintain a stable API, these headers from -devel subpackage are no longer needed
 rm %{buildroot}%{_libdir}/frr/*.so
 rm -r %{buildroot}%{_includedir}/frr/

 %pre
-%sysusers_create_compat %{SOURCE2}
+getent group frrvty >/dev/null 2>&1 || groupadd -r frrvty >/dev/null 2>&1 || :
+getent group frr >/dev/null 2>&1 || groupadd -r frr >/dev/null 2>&1 || :
+getent passwd frr >/dev/null 2>&1 || useradd -M -r -g frr -s /sbin/nologin \
+ -c "FRRouting routing suite" -d %{_localstatedir}/run/frr frr || :
+usermod -aG frrvty frr

 %post
 %systemd_post frr.service

+if [ -f %{_infodir}/%{name}.inf* ]; then
+    install-info %{_infodir}/frr.info %{_infodir}/dir || :
+fi
+
 # Create dummy files if they don't exist so basic functions can be used.
 if [ ! -e %{_sysconfdir}/frr/frr.conf ]; then
    echo "hostname `hostname`" > %{_sysconfdir}/frr/frr.conf
@@ -211,297 +164,68 @@ if [ ! -e %{_sysconfdir}/frr/vtysh.conf ]; then
    chown frr:frrvty %{_sysconfdir}/frr/vtysh.conf
 fi

+
 %postun
 %systemd_postun_with_restart frr.service

 %preun
 %systemd_preun frr.service

-#SELinux
-%if 0%{?with_selinux}
-%pre selinux
-%selinux_relabel_pre -s %{selinuxtype}
-
-%post selinux
-%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
-%selinux_relabel_post -s %{selinuxtype}
-#/var/tmp and /var/run need to be relabeled as well if FRR is running before upgrade
-if [ $1 == 2 ]; then
-    %{_sbindir}/restorecon -R /var/tmp/frr &> /dev/null
-    %{_sbindir}/restorecon -R /var/run/frr &> /dev/null
-fi
-
-%postun selinux
+#only when removing frr
 if [ $1 -eq 0 ]; then
-    %selinux_modules_uninstall -s %{selinuxtype} %{name}
-    %selinux_relabel_post -s %{selinuxtype}
+	if [ -f %{_infodir}/%{name}.inf* ]; then
+    	install-info --delete %{_infodir}/frr.info %{_infodir}/dir || :
+	fi
 fi

-%endif
-
 %check
-#this should be temporary, the grpc test is just badly designed
-rm tests/lib/*grpc*
-%make_build check PYTHON=%{__python3}
+make check PYTHON=%{__python3}

 %files
+%defattr(-,root,root)
 %license COPYING
+%doc zebra/zebra.conf.sample
+%doc isisd/isisd.conf.sample
+%doc ripd/ripd.conf.sample
+%doc bgpd/bgpd.conf.sample*
+%doc ospfd/ospfd.conf.sample
+%doc ospf6d/ospf6d.conf.sample
+%doc ripngd/ripngd.conf.sample
+%doc pimd/pimd.conf.sample
 %doc doc/mpls
 %dir %attr(750,frr,frr) %{_sysconfdir}/frr
-%dir %attr(755,frr,frr) %{_localstatedir}/log/frr
+%dir %attr(755,frr,frr) /var/log/frr
 %dir %attr(755,frr,frr) /run/frr
 %{_infodir}/*info*
-%{_mandir}/man1/frr.1*
-%{_mandir}/man1/vtysh.1*
-%{_mandir}/man8/frr-*.8*
-%{_mandir}/man8/mtracebis.8*
+%{_mandir}/man*/*
 %dir %{frr_libdir}/
 %{frr_libdir}/*
-%{_bindir}/mtracebis
-%{_bindir}/vtysh
+%{_bindir}/*
 %dir %{_libdir}/frr
 %{_libdir}/frr/*.so.*
 %dir %{_libdir}/frr/modules
 %{_libdir}/frr/modules/*
-%config(noreplace) %attr(644,root,root) %{_sysconfdir}/logrotate.d/frr
-%config(noreplace) %attr(644,frr,frr) %{_sysconfdir}/frr/daemons
-%config(noreplace) %{_sysconfdir}/pam.d/frr
+%config(noreplace) %attr(644,root,root) /etc/logrotate.d/frr
+%config(noreplace) %attr(644,frr,frr) /etc/frr/daemons
+%config(noreplace) /etc/pam.d/frr
 %{_unitdir}/*.service
-%dir %{_datadir}/frr-yang
-%{_datadir}/frr-yang/*.yang
+%dir /usr/share/yang
+/usr/share/yang/*.yang
 %{_tmpfilesdir}/%{name}.conf
-%{_sysusersdir}/%{name}.conf
-
-%if 0%{?with_selinux}
-%files selinux
-%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.*
-%{_datadir}/selinux/devel/include/distributed/%{name}.if
-%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name}
-%endif

 %changelog
-* Tue Sep 10 2024 Michal Ruprich <mruprich@redhat.com> - 10.1-4
- Resolves: #2311119 - Multiple AVCs for accessing lib_t in FRR-10.1
- Resolves: #2311120 - AVCs for using a netlink socket in FRR
-
-* Sun Aug 25 2024 Benjamin A. Beasley <code@musicinmybrain.net> - 10.1-3
- Rebuilt for abseil-cpp-20240722.0
-
-* Thu Aug 15 2024 Michal Ruprich <mruprich@redhat.com> - 10.1-2
- Rebuilding for the libre soname bump
-
-* Mon Aug 12 2024 Michal Ruprich <mruprich@redhat.com> - 10.1-1
- New version 10.1
-
-* Wed Jul 31 2024 Michal Ruprich <mruprich@redhat.com> - 10.0.1-1
- New version 10.0.1
-
-* Wed Jul 17 2024 Fedora Release Engineering <releng@fedoraproject.org> - 9.1-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Wed Apr 17 2024 Michal Ruprich <mruprich@redhat.com> - 9.1-4
- Moving yang modules to frr specific dir to avoid conflicts
- Adding rpminspect.yaml
-
-* Sat Feb 24 2024 Paul Wouters <paul.wouters@aiven.io> - 9.1-3
- Rebuild for libre2.so.11 bump
-
-* Sun Feb 04 2024 Benjamin A. Beasley <code@musicinmybrain.net> - 9.1-2
- Rebuilt for abseil-cpp-20240116.0
-
-* Thu Jan 25 2024 Michal Ruprich <mruprich@redhat.com> - 9.1-1
- New version 9.1
-
-* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 9.0.1-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Fri Jan 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 9.0.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Mon Oct 16 2023 Michal Ruprich <mruprich@redhat.com> - 9.0.1-1
- New version 9.0.1
-
-* Fri Sep 01 2023 Michal Ruprich <mruprich@redhat.com> - 8.5.2-4
- Adding a couple of SELinux rules, includes fix for rhbz#2149299
-
-* Wed Aug 30 2023 Benjamin A. Beasley <code@musicinmybrain.net> - 8.5.2-3
- Rebuilt for abseil-cpp 20230802.0
-
-* Wed Jul 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 8.5.2-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Fri Jun 30 2023 Michal Ruprich <mruprich@redhat.com> - 8.5.2-1
- New version 8.5.2
- Fixing some rpmlint warnings
-
-* Mon Jun 26 2023 Michal Ruprich <mruprich@redhat.com> - 8.5.1-4
- Resolves: #2216073 - SELinux is preventing FRR-Zebra to access to network namespaces.
-
-* Mon Jun 05 2023 Yaakov Selkowitz <yselkowi@redhat.com> - 8.5.1-3
- Disable grpc in RHEL builds
-
-* Fri May 19 2023 Petr Pisar <ppisar@redhat.com> - 8.5.1-2
- Rebuild against rpm-4.19 (https://fedoraproject.org/wiki/Changes/RPM-4.19)
-
-* Wed Apr 26 2023 Michal Ruprich <mruprich@redhat.com> - 8.5.1-1
- New version 8.5.1
-
-* Wed Apr 12 2023 Michal Ruprich <mruprich@redhat.com> - 8.5-1
- New version 8.5
-
-* Thu Mar 23 2023 Michal Ruprich <mruprich@redhat.com> - 8.4.2-5
- Rebuilding for new abseil-cpp version
-
-* Wed Mar 22 2023 Michal Ruprich <mruprich@redhat.com> - 8.4.2-4
- SPDX migration
-
-* Wed Mar 08 2023 Benjamin A. Beasley <code@musicinmybrain.net> - 8.4.2-3
- Build as C++17, required by abseil-cpp 20230125
-
-* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 8.4.2-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Thu Jan 12 2023 Michal Ruprich <mruprich@redhat.com> - 8.4.2-1
- New version 8.4.2
-
-* Fri Nov 25 2022 Michal Ruprich <mruprich@redhat.com> - 8.4.1-1
- New version 8.4.1
- Fix for rhbz #2140705
-
-* Thu Nov 10 2022 Michal Ruprich <mruprich@redhat.com> - 8.4-1
- New version 8.4
-
-* Fri Sep 16 2022 Michal Ruprich <mruprich@redhat.com> - 8.3.1-5
- Adding SELinux rule to enable zebra to write to sysctl_net_t
- Adding SELinux rule to enable bgpd to call name_connect to bgp_port_t
-
-* Fri Sep 09 2022 Michal Ruprich <mruprich@redhat.com> - 8.3.1-4
- Fixing an error in post scriptlet
-
-* Fri Sep 09 2022 Michal Ruprich <mruprich@redhat.com> - 8.3.1-3
- Resolves: #2124254 - frr can no longer update routes
-
-* Wed Sep 07 2022 Michal Ruprich <mruprich@redhat.com> - 8.3.1-2
- Resolves: #2124253 - SELinux is preventing zebra from setattr access on the directory frr
- Better handling FRR files during upgrade
-
-* Tue Sep 06 2022 Michal Ruprich <mruprich@redhat.com> - 8.3.1-1
- New version 8.3.1
-
-* Mon Aug 22 2022 Michal Ruprich <mruprich@redhat.com> - 8.2.2-10
- Rebuilding for new abseil-cpp and grpc updates
-
-* Wed Aug 10 2022 Michal Ruprich <mruprich@redhat.com> - 8.2.2-9
- Adding vrrpd and pathd as daemons to the policy
-
-* Wed Aug 10 2022 Michal Ruprich <mruprich@redhat.com> - 8.2.2-8
- Finalizing SELinux policy
-
-* Tue Aug 02 2022 Michal Ruprich <mruprich@redhat.com> - 8.2.2-7
- Fixing wrong path for vtysh in frr.fc
-
-* Fri Jul 29 2022 Benjamin A. Beasley <code@musicinmybrain.net> - 8.2.2-6
- Rebuild with abseil-cpp-20211102.0-4.fc37 (RHBZ#2108658)
-
-* Wed Jul 27 2022 Michal Ruprich - 8.2.2-5
- Packaging SELinux policy for FRR
-
-* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 8.2.2-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Tue May 17 2022 Michal Ruprich <mruprich@redhat.com> - 8.2.2-3
- Rebuild for grpc-1.46.1
-
-* Mon Apr 11 2022 Michal Ruprich <mruprich@redhat.com> - 8.2.2-2
- Fix for CVE-2022-16126
-
-* Tue Mar 15 2022 Michal Ruprich <mruprich@redhat.com> - 8.2.2-1
- New version 8.2.2
-
-* Thu Mar 10 2022 Michal Ruprich <mruprich@redhat.com> - 8.2-2
- Rebuild for abseil-cpp 20211102.0
-
-* Wed Mar 09 2022 Michal Ruprich <mruprich@redhat.com> - 8.2-1
- New version 8.2 (rhbz#2020439)
- Resolves: #2011868 - systemctl frr reload does not stop daemons that are not enabled in /etc/frr/daemons
-
-* Tue Feb 01 2022 Michal Ruprich <mruprich@redhat.com> - 8.0.1-11
- Rebuilding for FTBFS in Rawhide(rhbz#2045399)
-
-* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 8.0.1-10
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Sat Jan 08 2022 Miro Hrončok <mhroncok@redhat.com> - 8.0.1-9
- Rebuilt for libre2.so.9
-
-* Sat Nov 06 2021 Adrian Reber <adrian@lisas.de> - 8.0.1-8
- Rebuilt for protobuf 3.19.0
-
-* Mon Oct 25 2021 Adrian Reber <adrian@lisas.de> - 8.0.1-7
- Rebuilt for protobuf 3.18.1
-
-* Fri Oct 15 2021 Michal Ruprich <mruprich@redhat.com> - 8.0.1-6
- Obsoleting quagga so that it may be retired
-
-* Thu Oct 07 2021 Michal Ruprich <mruprich@redhat.com> - 8.0.1-5
- Rebuilding for grpc 1.41
-
-* Thu Sep 30 2021 Michal Ruprich <mruprich@redhat.com> - 8.0.1-4
- Rebuild for new version of libyang
-
-* Sat Sep 18 2021 Benjamin A. Beasley <code@musicinmybrain.net> - 8.0.1-3
- Rebuild for grpc 1.40
-
-* Thu Sep 16 2021 Sahana Prasad <sahana@redhat.com> - 8.0.1-2
- Rebuilt with OpenSSL 3.0.0
-
-* Thu Sep 16 2021 Michal Ruprich <mruprich@redhat.com> - 8.0.1-1
- New version 8.0.1
-
-* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 8.0-2
- Rebuilt with OpenSSL 3.0.0
-
-* Wed Aug 11 2021 Michal Ruprich <mruprich@redhat.com> - 8.0-1
- New version 8.0
-
-* Wed Aug 04 2021 Benjamin A. Beasley <code@musicinmybrain.net> - 7.5.1-9
- Rebuild for grpc 1.39
-
-* Wed Jul 21 2021 Fedora Release Engineering <releng@fedoraproject.org> - 7.5.1-8
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Tue Jul 20 2021 Michal Ruprich <mruprich@redhat.com> - 7.5.1-7
+* Tue Jul 20 2021 Michal Ruprich <mruprich@redhat.com> - 7.5.1-3
 - Resolves: #1983278 - ospfd crashes in route_node_delete with assertion fail

-* Sat Jul 10 2021 Björn Esser <besser82@fedoraproject.org> - 7.5.1-6
- Rebuild for versioned symbols in json-c
-
-* Wed Jul 07 2021 Neal Gompa <ngompa@datto.com> - 7.5.1-5
- Clean up the spec file for legibility and modern spec standards
- Remove unneeded info scriptlets
- Use systemd-sysusers for frr user and frrvty group
- Use git-core instead of git for applying patches
- Drop redundant build dependencies
-
-* Wed Jul 07 2021 Michal Ruprich <mruprich@redhat.com> - 7.5.1-4
- Rebuild for newer abseil-cpp
-
-* Tue May 11 2021 Benjamin A. Beasley <code@musicinmybrain.net> - 7.5.1-3
- Rebuild for grpc 1.37
-
 * Fri Apr 23 2021 Michal Ruprich <mruprich@redhat.com> - 7.5.1-2
 - Fixing permissions on config files in /etc/frr
 - Enabling integrated configuration option for frr

-* Fri Mar 12 2021 Michal Ruprich <mruprich@redhat.com> - 7.5.1-1
+* Tue Mar 16 2021 Michal Ruprich <mruprich@redhat.com> - 7.5.1-1
 - New version 7.5.1
 - Enabling grpc, adding hostname for post scriptlet
 - Moving files to libexec due to selinux issues

-* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 7.5-4
- Rebuilt for updated systemd-rpm-macros
-  See https://pagure.io/fesco/issue/2583.
-
 * Tue Feb 16 2021 Michal Ruprich <mruprich@redhat.com> - 7.5-3
 - Fixing FTBS - icc options are confusing the new gcc

@@ -568,3 +292,4 @@ rm tests/lib/*grpc*

 * Wed Jun 19 2019 Michal Ruprich <mruprich@redhat.com> - 7.0-2
 - Initial build
+
--- a/frr.te
+++ b/frr.te
@@ -1,137 +0,0 @@
-policy_module(frr, 1.0.0)
-
-########################################
-#
-# Declarations
-#
-
-type frr_t;
-type frr_exec_t;
-init_daemon_domain(frr_t, frr_exec_t)
-
-type frr_log_t;
-logging_log_file(frr_log_t)
-
-type frr_tmp_t;
-files_tmp_file(frr_tmp_t)
-
-type frr_lock_t;
-files_lock_file(frr_lock_t)
-
-type frr_conf_t;
-files_config_file(frr_conf_t)
-
-type frr_unit_file_t;
-systemd_unit_file(frr_unit_file_t)
-
-type frr_var_run_t;
-files_pid_file(frr_var_run_t)
-
-type frr_var_lib_t;
-files_type(frr_var_lib_t)
-
-########################################
-#
-# frr local policy
-#
-allow frr_t self:capability { chown dac_override dac_read_search kill net_bind_service net_raw setgid setuid net_admin sys_admin };
-allow frr_t self:netlink_route_socket rw_netlink_socket_perms;
-allow frr_t self:netlink_generic_socket create;
-allow frr_t self:netlink_generic_socket setopt;
-allow frr_t self:netlink_generic_socket getopt;
-allow frr_t self:netlink_generic_socket getattr;
-allow frr_t self:netlink_generic_socket bind;
-allow frr_t self:packet_socket create_socket_perms;
-allow frr_t self:process { setcap setpgid };
-allow frr_t self:rawip_socket create_socket_perms;
-allow frr_t self:tcp_socket { connect connected_stream_socket_perms };
-allow frr_t self:udp_socket create_socket_perms;
-allow frr_t self:unix_stream_socket connectto;
-
-allow frr_t frr_conf_t:dir list_dir_perms;
-manage_files_pattern(frr_t, frr_conf_t, frr_conf_t)
-read_lnk_files_pattern(frr_t, frr_conf_t, frr_conf_t)
-
-manage_dirs_pattern(frr_t, frr_log_t, frr_log_t)
-manage_files_pattern(frr_t, frr_log_t, frr_log_t)
-manage_lnk_files_pattern(frr_t, frr_log_t, frr_log_t)
-logging_log_filetrans(frr_t, frr_log_t, { dir file lnk_file })
-
-manage_dirs_pattern(frr_t, frr_var_lib_t, frr_var_lib_t)
-manage_files_pattern(frr_t, frr_var_lib_t, frr_var_lib_t)
-files_var_lib_filetrans(frr_t, frr_var_lib_t, { dir file })
-
-allow frr_t frr_tmp_t:file map;
-manage_dirs_pattern(frr_t, frr_tmp_t, frr_tmp_t)
-manage_files_pattern(frr_t, frr_tmp_t, frr_tmp_t)
-files_tmp_filetrans(frr_t, frr_tmp_t, { file dir })
-
-manage_files_pattern(frr_t, frr_lock_t, frr_lock_t)
-manage_lnk_files_pattern(frr_t, frr_lock_t, frr_lock_t)
-files_lock_filetrans(frr_t, frr_lock_t, { file lnk_file })
-
-manage_dirs_pattern(frr_t, frr_var_run_t, frr_var_run_t)
-manage_files_pattern(frr_t, frr_var_run_t, frr_var_run_t)
-manage_lnk_files_pattern(frr_t, frr_var_run_t, frr_var_run_t)
-manage_sock_files_pattern(frr_t, frr_var_run_t, frr_var_run_t)
-files_pid_filetrans(frr_t, frr_var_run_t, { dir file lnk_file })
-
-allow frr_t frr_exec_t:dir search_dir_perms;
-can_exec(frr_t, frr_exec_t)
-
-kernel_read_network_state(frr_t)
-kernel_rw_net_sysctls(frr_t)
-kernel_read_system_state(frr_t)
-kernel_request_load_module(frr_t)
-
-auth_use_nsswitch(frr_t)
-
-corecmd_exec_bin(frr_t)
-
-corenet_tcp_bind_appswitch_emp_port(frr_t)
-corenet_udp_bind_bfd_control_port(frr_t)
-corenet_udp_bind_bfd_echo_port(frr_t)
-corenet_udp_bind_bfd_multi_port(frr_t)
-corenet_tcp_bind_bgp_port(frr_t)
-corenet_tcp_connect_bgp_port(frr_t)
-corenet_tcp_bind_cmadmin_port(frr_t)
-corenet_udp_bind_cmadmin_port(frr_t)
-corenet_tcp_bind_firepower_port(frr_t)
-corenet_tcp_bind_generic_port(frr_t)
-corenet_tcp_bind_priority_e_com_port(frr_t)
-corenet_udp_bind_router_port(frr_t)
-corenet_tcp_bind_qpasa_agent_port(frr_t)
-corenet_tcp_bind_smntubootstrap_port(frr_t)
-corenet_tcp_bind_versa_tek_port(frr_t)
-corenet_tcp_bind_zebra_port(frr_t)
-
-domain_use_interactive_fds(frr_t)
-
-fs_read_nsfs_files(frr_t)
-
-sysnet_exec_ifconfig(frr_t)
-sysnet_read_ifconfig_run_files(frr_t)
-sysnet_watch_ifconfig_run_dirs(frr_t)
-
-ipsec_domtrans_mgmt(frr_t)
-
-userdom_read_admin_home_files(frr_t)
-
-optional_policy(`
-	logging_send_syslog_msg(frr_t)
-')
-
-optional_policy(`
-	modutils_exec_kmod(frr_t)
-	modutils_getattr_module_deps(frr_t)
-	modutils_read_module_config(frr_t)
-	modutils_read_module_deps_files(frr_t)
-')
-
-optional_policy(`
-	networkmanager_read_state(frr_t)
-')
-
-optional_policy(`
-	userdom_admin_home_dir_filetrans(frr_t, frr_conf_t, file, ".history_frr")
-')
--- a/gating.yaml
+++ b/gating.yaml
@@ -1,16 +0,0 @@
--- !Policy
-product_versions:
-  - fedora-*
-decision_contexts: [bodhi_update_push_testing]
-subject_type: koji_build
-rules:
-  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
- 
-#gating rawhide
--- !Policy
-product_versions:
-  - fedora-*
-decision_contexts: [bodhi_update_push_stable]
-subject_type: koji_build
-rules:
-  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
--- a/plans/all.fmf
+++ b/plans/all.fmf
@@ -1,6 +0,0 @@
-summary: Test plan with all Fedora tests
-discover:
-       how: fmf
-       url: https://src.fedoraproject.org/tests/frr.git
-execute:
-       how: tmt
--- a/rpminspect.yaml
+++ b/rpminspect.yaml
@@ -1,7 +0,0 @@
---
-runpath:
-    allowed_paths:
-        - /usr/lib64/frr
-        - /usr/lib/frr
-inspections:
-    badfuncs: off
--- a/2
+++ b/2
@@ -1,2 +1,2 @@
-SHA512 (frr-10.1.tar.gz) = 7484238a502ab12f178e4a210e6e4a33d0ce53edbb49b127fdc3167e31dd61c1122c1ef2d30e4bcb83b7f520b37fb9ad73e2a6a16790b608b1adf2e23b556445
+SHA512 (frr-7.5.1.tar.gz) = 1c27420594e52647090da3556e5c62d6f916903c4fa86e5110f1e86152f07d3ce4252bc859d36c9d218dc96a80b245c8b9eee97f370d818cb39be187b6c3546e
 SHA512 (remove-babeld-ldpd.sh) = a5bf67a3722cb20d43cef1dac28f839db68df73a1b7d34d8438e4f9366da3b67d85c1f44281f93434e8dd8ebcb2d3dc258b77eaa5627475b7395d207f020839d
Author	SHA1	Message	Date
Michal Ruprich	332c451e3a	Resolves: #1983278 - ospfd crashes in route_node_delete with assertion fail	2021-07-20 10:46:22 +02:00
Michal Ruprich	9eaa9e4216	Fixing permissions on config files in /etc/frr Enabling integrated configuration option for frr	2021-04-23 12:40:22 +02:00
Michal Ruprich	81310f26e9	New version 7.5.1 Enabling grpc, adding hostname for post scriptlet Moving files to libexec due to selinux issues	2021-03-16 12:38:18 +01:00
Michal Ruprich	810b00e1fe	Fixing FTBS - icc options are confusing the new gcc	2021-02-16 17:16:40 +01:00