Compare commits

..

12 Commits

Author SHA1 Message Date
Zoran Peričić
9f47d698f5 v.ims.1 - Bump version 2023-01-25 18:37:31 +01:00
cb7be7535f nhrp: configure strongswan vici path 2023-01-25 18:37:31 +01:00
Michal Ruprich
12cd4431e4 New version 8.4.2 2023-01-12 16:29:19 +01:00
Michal Ruprich
858f96ce3e New version 8.4.1
Fix for rhbz #2140705
2022-11-25 18:07:53 +01:00
Michal Ruprich
519e1a5f6a New version 8.4 2022-11-10 10:31:46 +01:00
Michal Ruprich
964a13758e Rebuilding because of weird abseil-cpp version mismatch in the compose (rhbz #2128691) 2022-09-22 10:10:15 +02:00
Michal Ruprich
a5ca1b7fce Adding SELinux rule to enable zebra to write to sysctl_net_t
Adding SELinux rule to enable bgpd to call name_connect to bgp_port_t
2022-09-16 16:02:34 +02:00
Michal Ruprich
8c46bbbf5c Adding a couple of rules to tackle AVCs 2022-09-09 19:07:50 +02:00
Michal Ruprich
61a4e5aa67 Resolves: #2124254 - frr can no longer update routes 2022-09-09 16:11:03 +02:00
Michal Ruprich
2462abb0da Resolves: #2124253 - SELinux is preventing zebra from setattr access on the directory frr
Better handling FRR files during upgrade
2022-09-07 11:48:06 +02:00
Michal Ruprich
c4595285be Forgot to add a patch 2022-09-06 13:31:47 +02:00
Michal Ruprich
879b7a1f73 New version 8.3.1 2022-09-06 13:26:06 +02:00
10 changed files with 47 additions and 183 deletions

5
.gitignore vendored
View File

@@ -14,8 +14,3 @@
/frr-8.4.tar.gz
/frr-8.4.1.tar.gz
/frr-8.4.2.tar.gz
/frr-8.5.tar.gz
/frr-8.5.1.tar.gz
/frr-8.5.2.tar.gz
/frr-9.0.1.tar.gz
/frr-9.1.tar.gz

View File

@@ -16,9 +16,9 @@ index 5be3264..33abc1d 100644
snapcraft/helpers \
snapcraft/snap \
- babeld/Makefile \
mgmtd/Makefile \
bgpd/Makefile \
bgpd/rfp-example/librfp/Makefile \
bgpd/rfp-example/rfptest/Makefile \
@@ -193,7 +190,6 @@ EXTRA_DIST += \
fpm/Makefile \
grpc/Makefile \

View File

@@ -8,8 +8,8 @@ index 0b7af18..0533e24 100644
lib/log_vty.c \
- lib/md5.c \
lib/memory.c \
lib/mgmt_be_client.c \
lib/mgmt_fe_client.c \
lib/mlag.c \
lib/module.c \
@@ -64,7 +64,6 @@ lib_libfrr_la_SOURCES = \
lib/routemap_northbound.c \
lib/sbuf.c \
@@ -24,8 +24,8 @@ index 0b7af18..0533e24 100644
lib/log_vty.h \
- lib/md5.h \
lib/memory.h \
lib/mgmt.pb-c.h \
lib/mgmt_be_client.h \
lib/module.h \
lib/monotime.h \
@@ -191,7 +190,6 @@ pkginclude_HEADERS += \
lib/route_opaque.h \
lib/sbuf.h \

View File

@@ -3,8 +3,8 @@ index 631465f..e084ff3 100644
--- a/ospfd/ospf_vty.c
+++ b/ospfd/ospf_vty.c
@@ -1136,6 +1136,11 @@ DEFUN (ospf_area_vlink,
vl_config.keychain = argv[idx+1]->arg;
} else if (argv_find(argv, argc, "message-digest", &idx)) {
if (argv_find(argv, argc, "message-digest", &idx)) {
/* authentication message-digest */
+ if(FIPS_mode())
+ {
@@ -41,7 +41,7 @@ index 631465f..e084ff3 100644
+ }
SET_IF_PARAM(params, auth_type);
params->auth_type = OSPF_AUTH_CRYPTOGRAPHIC;
UNSET_IF_PARAM(params, keychain_name);
return CMD_SUCCESS;
@@ -6971,6 +6990,11 @@ DEFUN (ip_ospf_message_digest_key,
"The OSPF password (key)\n"
"Address of interface\n")

View File

@@ -3,8 +3,8 @@ index 7b5eaa4..5c82f69 100644
--- a/tests/lib/subdir.am
+++ b/tests/lib/subdir.am
@@ -18,18 +18,6 @@ tests_lib_test_frrscript_SOURCES = tests/lib/test_frrscript.c
test -e tests/lib/script1.lua || \
$(INSTALL_SCRIPT) $< tests/lib/script1.lua
EXTRA_DIST += tests/lib/test_frrscript.py
-##############################################################################
-GRPC_TESTS_LDADD = staticd/libstatic.a grpc/libfrrgrpc_pb.la -lgrpc++ -lprotobuf $(ALL_TESTS_LDADD) $(LIBYANG_LIBS) -lm

34
frr.fc
View File

@@ -1,4 +1,4 @@
/usr/libexec/frr/(.*)? gen_context(system_u:object_r:frr_exec_t,s0)
/usr/libexec/frr(/.*)? gen_context(system_u:object_r:frr_exec_t,s0)
/usr/lib/systemd/system/frr.* gen_context(system_u:object_r:frr_unit_file_t,s0)
@@ -7,23 +7,21 @@
/var/log/frr(/.*)? gen_context(system_u:object_r:frr_log_t,s0)
/var/tmp/frr(/.*)? gen_context(system_u:object_r:frr_tmp_t,s0)
/run/lock/subsys/bfdd -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/bgpd -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/eigrpd -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/fabricd -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/isisd -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/nhrpd -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/ospf6d -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/ospfd -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/pbrd -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/pimd -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/ripd -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/ripngd -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/staticd -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/zebra -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/vrrpd -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/pathd -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/bfdd -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/bgpd -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/eigrpd -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/fabricd -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/isisd -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/nhrpd -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/ospf6d -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/ospfd -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/pbrd -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/pimd -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/ripd -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/ripngd -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/staticd -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/zebra -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/frr(/.*)? gen_context(system_u:object_r:frr_var_run_t,s0)
/var/run/frr(/.*)? gen_context(system_u:object_r:frr_var_run_t,s0)
/usr/bin/vtysh -- gen_context(system_u:object_r:frr_exec_t,s0)

52
frr.if
View File

@@ -160,55 +160,3 @@ interface(`frr_admin',`
systemd_read_fifo_file_passwd_run($1)
')
')
########################################
#
# Interface compatibility blocks
#
# The following definitions ensure compatibility with distribution policy
# versions that do not contain given interfaces (epel, or older Fedora
# releases).
# Each block tests for existence of given interface and defines it if needed.
#
######################################
## <summary>
## Watch ifconfig_var_run_t directories
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
ifndef(`sysnet_watch_ifconfig_run_dirs',`
interface(`sysnet_watch_ifconfig_run_dirs',`
gen_require(`
type ifconfig_var_run_t;
')
watch_dirs_pattern($1, ifconfig_var_run_t, ifconfig_var_run_t)
')
')
########################################
## <summary>
## Read ifconfig_var_run_t files and link files
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
ifndef(`sysnet_read_ifconfig_run_files',`
interface(`sysnet_read_ifconfig_run_files',`
gen_require(`
type ifconfig_var_run_t;
')
list_dirs_pattern($1, ifconfig_var_run_t, ifconfig_var_run_t)
read_files_pattern($1, ifconfig_var_run_t, ifconfig_var_run_t)
read_lnk_files_pattern($1, ifconfig_var_run_t, ifconfig_var_run_t)
')
')

104
frr.spec
View File

@@ -5,15 +5,13 @@
%global _hardened_build 1
%global selinuxtype targeted
%define _legacy_common_support 1
%bcond grpc %{undefined rhel}
%bcond selinux 1
%bcond_without selinux
Name: frr
Version: 9.1
Release: 3%{?dist}
Version: 8.4.2
Release: 1%{?dist}
Summary: Routing daemon
License: GPL-2.0-or-later AND ISC AND LGPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND (GPL-2.0-or-later OR ISC) AND MIT
License: GPLv2+
URL: http://www.frrouting.org
Source0: https://github.com/FRRouting/frr/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz
Source1: %{name}-tmpfiles.conf
@@ -38,10 +36,8 @@ BuildRequires: gcc
BuildRequires: gcc-c++
BuildRequires: git-core
BuildRequires: groff
%if %{with grpc}
BuildRequires: grpc-devel
BuildRequires: grpc-plugins
%endif
BuildRequires: json-c-devel
BuildRequires: libcap-devel
BuildRequires: libtool
@@ -61,7 +57,6 @@ BuildRequires: readline-devel
BuildRequires: systemd-devel
BuildRequires: systemd-rpm-macros
BuildRequires: texinfo
BuildRequires: protobuf-c-devel
Requires: ncurses
Requires: net-snmp
@@ -83,18 +78,17 @@ FRRouting is free software that manages TCP/IP based routing protocols. It takes
a multi-server and multi-threaded approach to resolve the current complexity
of the Internet.
FRRouting supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR,
EIGRP and BFD.
FRRouting supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.
FRRouting is a fork of Quagga.
%if 0%{?with_selinux}
%package selinux
Summary: Selinux policy for FRR
BuildArch: noarch
Requires: selinux-policy-%{selinuxtype}
Requires(post): selinux-policy-%{selinuxtype}
BuildRequires: selinux-policy-devel
Summary: Selinux policy for FRR
BuildArch: noarch
Requires: selinux-policy-%{selinuxtype}
Requires(post): selinux-policy-%{selinuxtype}
BuildRequires: selinux-policy-devel
%{?selinux_requires}
%description selinux
@@ -107,8 +101,6 @@ SELinux policy modules for FRR package
#Selinux
mkdir selinux
cp -p %{SOURCE3} %{SOURCE4} %{SOURCE5} selinux
# C++14 or later needed for abseil-cpp 20230125; string_view needs C++17:
sed -r -i 's/(AX_CXX_COMPILE_STDCXX\(\[)11(\])/\117\2/' configure.ac
%build
autoreconf -ivf
@@ -137,7 +129,7 @@ autoreconf -ivf
--with-crypto=openssl \
--with-vici-socket=/run/strongswan/charon.vici \
--enable-fpm \
%{?with_grpc:--enable-grpc}
--enable-grpc
%make_build MAKEINFO="makeinfo --no-split" PYTHON=%{__python3}
@@ -178,7 +170,7 @@ install -d -m 775 %{buildroot}/run/frr
%if 0%{?with_selinux}
install -D -m 644 selinux/%{name}.pp.bz2 \
%{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
%{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
install -D -m 644 selinux/%{name}.if %{buildroot}%{_datadir}/selinux/devel/include/distributed/%{name}.if
%endif
@@ -278,64 +270,6 @@ rm tests/lib/*grpc*
%endif
%changelog
* Wed Apr 10 2024 Michal Ruprich <mruprich@redhat.com> - 9.1-3
- Resolves: #2273524 - frr fails to start: SELinux is preventing watchfrr from create access on the sock_file
* Sun Feb 04 2024 Benjamin A. Beasley <code@musicinmybrain.net> - 9.1-2
- Rebuilt for abseil-cpp-20240116.0
* Thu Jan 25 2024 Michal Ruprich <mruprich@redhat.com> - 9.1-1
- New version 9.1
* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 9.0.1-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Fri Jan 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 9.0.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Mon Oct 16 2023 Michal Ruprich <mruprich@redhat.com> - 9.0.1-1
- New version 9.0.1
* Fri Sep 01 2023 Michal Ruprich <mruprich@redhat.com> - 8.5.2-4
- Adding a couple of SELinux rules, includes fix for rhbz#2149299
* Wed Aug 30 2023 Benjamin A. Beasley <code@musicinmybrain.net> - 8.5.2-3
- Rebuilt for abseil-cpp 20230802.0
* Wed Jul 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 8.5.2-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
* Fri Jun 30 2023 Michal Ruprich <mruprich@redhat.com> - 8.5.2-1
- New version 8.5.2
- Fixing some rpmlint warnings
* Mon Jun 26 2023 Michal Ruprich <mruprich@redhat.com> - 8.5.1-4
- Resolves: #2216073 - SELinux is preventing FRR-Zebra to access to network namespaces.
* Mon Jun 05 2023 Yaakov Selkowitz <yselkowi@redhat.com> - 8.5.1-3
- Disable grpc in RHEL builds
* Fri May 19 2023 Petr Pisar <ppisar@redhat.com> - 8.5.1-2
- Rebuild against rpm-4.19 (https://fedoraproject.org/wiki/Changes/RPM-4.19)
* Wed Apr 26 2023 Michal Ruprich <mruprich@redhat.com> - 8.5.1-1
- New version 8.5.1
* Wed Apr 12 2023 Michal Ruprich <mruprich@redhat.com> - 8.5-1
- New version 8.5
* Thu Mar 23 2023 Michal Ruprich <mruprich@redhat.com> - 8.4.2-5
- Rebuilding for new abseil-cpp version
* Wed Mar 22 2023 Michal Ruprich <mruprich@redhat.com> - 8.4.2-4
- SPDX migration
* Wed Mar 08 2023 Benjamin A. Beasley <code@musicinmybrain.net> - 8.4.2-3
- Build as C++17, required by abseil-cpp 20230125
* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 8.4.2-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
* Thu Jan 12 2023 Michal Ruprich <mruprich@redhat.com> - 8.4.2-1
- New version 8.4.2
@@ -346,12 +280,15 @@ rm tests/lib/*grpc*
* Thu Nov 10 2022 Michal Ruprich <mruprich@redhat.com> - 8.4-1
- New version 8.4
* Thu Sep 22 2022 Michal Ruprich <mruprich@redhat.com> - 8.3.1-6
- Rebuilding because of weird abseil-cpp version mismatch in the compose (rhbz #2128691)
* Fri Sep 16 2022 Michal Ruprich <mruprich@redhat.com> - 8.3.1-5
- Adding SELinux rule to enable zebra to write to sysctl_net_t
- Adding SELinux rule to enable bgpd to call name_connect to bgp_port_t
* Fri Sep 09 2022 Michal Ruprich <mruprich@redhat.com> - 8.3.1-4
- Fixing an error in post scriptlet
- Adding a couple of rules to tackle AVCs
* Fri Sep 09 2022 Michal Ruprich <mruprich@redhat.com> - 8.3.1-3
- Resolves: #2124254 - frr can no longer update routes
@@ -363,15 +300,6 @@ rm tests/lib/*grpc*
* Tue Sep 06 2022 Michal Ruprich <mruprich@redhat.com> - 8.3.1-1
- New version 8.3.1
* Mon Aug 22 2022 Michal Ruprich <mruprich@redhat.com> - 8.2.2-10
- Rebuilding for new abseil-cpp and grpc updates
* Wed Aug 10 2022 Michal Ruprich <mruprich@redhat.com> - 8.2.2-9
- Adding vrrpd and pathd as daemons to the policy
* Wed Aug 10 2022 Michal Ruprich <mruprich@redhat.com> - 8.2.2-8
- Finalizing SELinux policy
* Tue Aug 02 2022 Michal Ruprich <mruprich@redhat.com> - 8.2.2-7
- Fixing wrong path for vtysh in frr.fc

13
frr.te
View File

@@ -31,9 +31,9 @@ files_pid_file(frr_var_run_t)
#
# frr local policy
#
allow frr_t self:capability { chown dac_override dac_read_search kill net_bind_service net_raw setgid setuid net_admin sys_admin };
allow frr_t self:capability { chown dac_override dac_read_search kill net_bind_service net_raw setgid setuid net_admin };
allow frr_t self:netlink_route_socket rw_netlink_socket_perms;
allow frr_t self:packet_socket create_socket_perms;
allow frr_t self:packet_socket { create setopt };
allow frr_t self:process { setcap setpgid };
allow frr_t self:rawip_socket create_socket_perms;
allow frr_t self:tcp_socket { connect connected_stream_socket_perms };
@@ -70,7 +70,6 @@ can_exec(frr_t, frr_exec_t)
kernel_read_network_state(frr_t)
kernel_rw_net_sysctls(frr_t)
kernel_read_system_state(frr_t)
kernel_request_load_module(frr_t)
auth_use_nsswitch(frr_t)
@@ -84,8 +83,8 @@ corenet_tcp_bind_bgp_port(frr_t)
corenet_tcp_connect_bgp_port(frr_t)
corenet_tcp_bind_cmadmin_port(frr_t)
corenet_udp_bind_cmadmin_port(frr_t)
corenet_tcp_bind_firepower_port(frr_t)
corenet_tcp_bind_generic_port(frr_t)
corenet_tcp_bind_firepower_port(frr_t)
corenet_tcp_bind_priority_e_com_port(frr_t)
corenet_udp_bind_router_port(frr_t)
corenet_tcp_bind_qpasa_agent_port(frr_t)
@@ -98,10 +97,6 @@ domain_use_interactive_fds(frr_t)
fs_read_nsfs_files(frr_t)
sysnet_exec_ifconfig(frr_t)
sysnet_read_ifconfig_run_files(frr_t)
sysnet_watch_ifconfig_run_dirs(frr_t)
ipsec_domtrans_mgmt(frr_t)
userdom_read_admin_home_files(frr_t)
@@ -121,5 +116,5 @@ optional_policy(`
')
optional_policy(`
userdom_admin_home_dir_filetrans(frr_t, frr_conf_t, file, ".history_frr")
userdom_admin_home_dir_filetrans(frr_t, frr_conf_t, file, ".history_frr")
')

View File

@@ -1,2 +1,2 @@
SHA512 (frr-9.1.tar.gz) = 5e77de9d26275ac8babd3bd467fe05c7fb6fa50c80fe61e13057784945372debe24f44557d9d52e76e2e785919cdfb4d5a80e7b2a06558f2a52745d0e0b92766
SHA512 (frr-8.4.2.tar.gz) = 1079bf3f597cc21ccbc37c5617cfb95f6e066de2a726a9b8ffb5825f92af3049d0e19ef4e9944a9e11dabc4309c56f0ab22e4c9188f5008ebcea47e0428f3ff0
SHA512 (remove-babeld-ldpd.sh) = a5bf67a3722cb20d43cef1dac28f839db68df73a1b7d34d8438e4f9366da3b67d85c1f44281f93434e8dd8ebcb2d3dc258b77eaa5627475b7395d207f020839d