v10.3

Resolves: #2311120 - AVCs for using a netlink socket in FRR

.gitignore

@@ -22,5 +22,3 @@
 /frr-10.0.1.tar.gz
 /frr-10.1.tar.gz
 /frr-10.2.tar.gz
-/frr-10.2.1.tar.gz
-/frr-10.3.tar.gz

0006-autorp-segfault.patch

@@ -0,0 +1,41 @@
+From 37b88191fb4736ff0a1e565fc22003d0ab853ea2 Mon Sep 17 00:00:00 2001
+From: Donald Sharp <sharpd@nvidia.com>
+Date: Wed, 4 Dec 2024 10:47:33 -0500
+Subject: [PATCH] pimd: Prevent crash of pim when auto-rp's socket is not
+ initialized
+
+If the socket associated with the auto-rp fails to initialize then
+the memory for the auto-rp is just dropped on the floor.  Additionally
+any type of attempt at using the feature will just cause pimd to crash,
+when the pointer is derefed.  Since it is derefed all over the place
+without checking.
+
+Clearly if you cannot bind/use the socket let's allow continuation.
+
+Fixes: #17540
+Signed-off-by: Donald Sharp <sharpd@nvidia.com>
+---
+ pimd/pim_autorp.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/pimd/pim_autorp.c b/pimd/pim_autorp.c
+index 3fb10f4..91ed005 100644
+--- a/pimd/pim_autorp.c
++++ b/pimd/pim_autorp.c
+@@ -1014,12 +1014,14 @@ void pim_autorp_init(struct pim_instance *pim)
+ 	autorp->announce_interval = DEFAULT_ANNOUNCE_INTERVAL;
+ 	autorp->announce_holdtime = DEFAULT_ANNOUNCE_HOLDTIME;
+ 
++	pim->autorp = autorp;
++
+ 	if (!pim_autorp_socket_enable(autorp)) {
+-		zlog_err("%s: AutoRP failed to initialize", __func__);
++		zlog_err("%s: AutoRP failed to initialize, feature will not work correctly",
++				__func__);
+ 		return;
+ 	}
+ 
+-	pim->autorp = autorp;
+ 	if (PIM_DEBUG_AUTORP)
+ 		zlog_debug("%s: AutoRP Initialized", __func__);
+ 

0006-s390x-endianness-test.patch

@@ -1,16 +0,0 @@
-diff --git a/tests/lib/northbound/test_oper_data.c b/tests/lib/northbound/test_oper_data.c
-index 0b334c6..f66b78d 100644
---- a/tests/lib/northbound/test_oper_data.c
-+++ b/tests/lib/northbound/test_oper_data.c
-@@ -253,9 +253,10 @@ static enum nb_error frr_test_module_c2cont_c2value_get(const struct nb_node *nb
- 							struct lyd_node *parent)
- {
- 	const struct lysc_node *snode = nb_node->snode;
--	uint32_t value = 0xAB010203;
-+	uint32_t value = htole32(0xAB010203);
- 	LY_ERR err;
- 
-+	/* Note that this api expects 'value' to be in little-endian form */
- 	err = lyd_new_term_bin(parent, snode->module, snode->name, &value, sizeof(value),
- 			       LYD_NEW_PATH_UPDATE, NULL);
- 	assert(err == LY_SUCCESS);

frr.spec

@@ -10,7 +10,7 @@
 %bcond selinux 1
 
 Name:           frr
-Version:        10.3.1
+Version:        10.3
 Release:        1%{?dist}
 Summary:        Routing daemon
 License:        GPL-2.0-or-later AND ISC AND LGPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND (GPL-2.0-or-later  OR ISC) AND MIT
@@ -28,12 +28,7 @@ Patch0002:      0002-enable-openssl.patch
 Patch0003:      0003-disable-eigrp-crypto.patch
 Patch0004:      0004-fips-mode.patch
 Patch0005:      0005-remove-grpc-test.patch
-Patch0006:      0006-s390x-endianness-test.patch
-
-# https://fedoraproject.org/wiki/Changes/EncourageI686LeafRemoval
-%if %{undefined fc40} && %{undefined fc41}
-ExcludeArch:       %{ix86}
-%endif
+Patch0006:      0006-autorp-segfault.patch
 
 BuildRequires:  autoconf
 BuildRequires:  automake
@@ -51,7 +46,6 @@ BuildRequires:  grpc-plugins
 BuildRequires:  json-c-devel
 BuildRequires:  libcap-devel
 BuildRequires:  libtool
-BuildRequires:  libxcrypt-devel
 BuildRequires:  libyang-devel >= 2.0.0
 BuildRequires:  make
 BuildRequires:  ncurses
@@ -118,8 +112,6 @@ cp -p %{SOURCE3} %{SOURCE4} %{SOURCE5} selinux
 sed -r -i 's/(AX_CXX_COMPILE_STDCXX\(\[)11(\])/\117\2/' configure.ac
 
 %build
-#hopefully just temporary due to rhbz#2327314
-export LDFLAGS="%{build_ldflags} -Wl,-z,noseparate-code"
 autoreconf -ivf
 
 %configure \
@@ -288,21 +280,6 @@ rm tests/lib/*grpc*
 %endif
 
 %changelog
-* Mon Jun 02 2025 Michal Ruprich <mruprich@redhat.com> - 10.3
-- New version 10.3
-
-* Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 10.2.1-2
-- Add explicit BR: libxcrypt-devel
-
-* Thu Jan 30 2025 Michal Ruprich <mruprich@redhat.com> - 10.2.1-1
-- New version 10.2.1
-
-* Thu Jan 16 2025 Fedora Release Engineering <releng@fedoraproject.org> - 10.2-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Sat Jan 04 2025 Benjamin A. Beasley <code@musicinmybrain.net> - 10.2-3
-- Drop i686 support (leaf package)
-
 * Thu Dec 05 2024 Michal Ruprich <mruprich@redhat.com> - 10.2-2
 - Resolves: rhbz#2329643 - upgrading frr to 10.2 causes pimd crashes
 

frr.te

@@ -98,7 +98,6 @@ corenet_tcp_bind_cmadmin_port(frr_t)
 corenet_udp_bind_cmadmin_port(frr_t)
 corenet_tcp_bind_firepower_port(frr_t)
 corenet_tcp_bind_generic_port(frr_t)
-corenet_udp_bind_generic_port(frr_t)
 corenet_tcp_bind_priority_e_com_port(frr_t)
 corenet_udp_bind_router_port(frr_t)
 corenet_tcp_bind_qpasa_agent_port(frr_t)

sources

@@ -1,2 +1,2 @@
-SHA512 (frr-10.3.tar.gz) = 6ea651f20c3957f5a7523e7cb316327ac5914154a31ed92e8ac5bb55e75eab2e1da3ddf255de5e669906946caa5c82b78bb769c3869e2f800f5bd3782963198c
+SHA512 (frr-10.2.tar.gz) = 40a0e1f1a7f2cc137aac6e838b2f865b93fdc1cd6bd0f6c5b15b4507cbff87cb60092682e45aca68633cb053fb2ce663386edb78e5d3c5f890f4666e871ab8c5
 SHA512 (remove-babeld-ldpd.sh) = a5bf67a3722cb20d43cef1dac28f839db68df73a1b7d34d8438e4f9366da3b67d85c1f44281f93434e8dd8ebcb2d3dc258b77eaa5627475b7395d207f020839d