rpms/kea
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import CS git kea-3.0.3-1.el10_2

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-07-14 09:01:42 -04:00
parent a103f432ea
commit a86c71d838
13 changed files with 168 additions and 2084 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -1,2 +1,2 @@
kea-3.0.1.tar.xz
kea-3.0.3.tar.xz
keama-4.5.0.tar.gz

180
CVE-2025-11232.patch
View File

@ -1,180 +0,0 @@
diff --git a/src/bin/dhcp4/dhcp4_messages.mes b/src/bin/dhcp4/dhcp4_messages.mes
index 1deb2e6074..b359d09616 100644
--- a/src/bin/dhcp4/dhcp4_messages.mes
+++ b/src/bin/dhcp4/dhcp4_messages.mes
@@ -164,6 +164,20 @@ This debug message is issued when the server starts processing the Hostname
option sent in the client's query. The argument includes the client and
transaction identification information.
+% DHCP4_CLIENT_HOSTNAME_SCRUBBED_EMPTY %1: sanitizing client's Hostname option '%2' yielded an empty string
+Logged at debug log level 50.
+This debug message is issued when the result of sanitizing the
+hostname option(12) sent by the client is an empty string. When this occurs
+the server will ignore the hostname option. The arguments include the
+client and the hostname option it sent.
+
+% DHCP4_CLIENT_FQDN_SCRUBBED_EMPTY %1: sanitizing client's FQDN option '%2' yielded an empty string
+Logged at debug log level 50.
+This debug message is issued when the result of sanitizing the
+FQDN option(81) sent by the client is an empty string. When this occurs
+the server will ignore the FQDN option. The arguments include the
+client and the FQDN option it sent.
+
% DHCP4_CLIENT_NAME_PROC_FAIL %1: failed to process the fqdn or hostname sent by a client: %2
Logged at debug log level 55.
This debug message is issued when the DHCP server was unable to process the
diff --git a/src/bin/dhcp4/dhcp4_srv.cc b/src/bin/dhcp4/dhcp4_srv.cc
index 0701ed41e9..a6be662889 100644
--- a/src/bin/dhcp4/dhcp4_srv.cc
+++ b/src/bin/dhcp4/dhcp4_srv.cc
@@ -2714,8 +2714,15 @@ Dhcpv4Srv::processClientFqdnOption(Dhcpv4Exchange& ex) {
} else {
// Adjust the domain name based on domain name value and type sent by the
// client and current configuration.
- d2_mgr.adjustDomainName<Option4ClientFqdn>(*fqdn, *fqdn_resp,
- *(ex.getContext()->getDdnsParams()));
+ try {
+ d2_mgr.adjustDomainName<Option4ClientFqdn>(*fqdn, *fqdn_resp,
+ *(ex.getContext()->getDdnsParams()));
+ } catch (const FQDNScrubbedEmpty& scrubbed) {
+ LOG_DEBUG(ddns4_logger, DBG_DHCP4_DETAIL, DHCP4_CLIENT_FQDN_SCRUBBED_EMPTY)
+ .arg(ex.getQuery()->getLabel())
+ .arg(scrubbed.what());
+ return;
+ }
}
// Add FQDN option to the response message. Note that, there may be some
@@ -2857,7 +2864,15 @@ Dhcpv4Srv::processHostnameOption(Dhcpv4Exchange& ex) {
ex.getContext()->getDdnsParams()->getHostnameSanitizer();
if (sanitizer) {
- hostname = sanitizer->scrub(hostname);
+ auto tmp = sanitizer->scrub(hostname);
+ if (tmp.empty()) {
+ LOG_DEBUG(ddns4_logger, DBG_DHCP4_DETAIL, DHCP4_CLIENT_HOSTNAME_SCRUBBED_EMPTY)
+ .arg(ex.getQuery()->getLabel())
+ .arg(hostname);
+ return;
+ }
+
+ hostname = tmp;
}
// Convert hostname to lower case.
diff --git a/src/bin/dhcp6/dhcp6_messages.mes b/src/bin/dhcp6/dhcp6_messages.mes
index fff50ed367..79fc984ff5 100644
--- a/src/bin/dhcp6/dhcp6_messages.mes
+++ b/src/bin/dhcp6/dhcp6_messages.mes
@@ -1167,3 +1167,10 @@ such modification. The clients will remember previous server-id, and will
use it to extend their leases. As a result, they will have to go through
a rebinding phase to re-acquire their leases and associate them with a
new server id.
+
+% DHCP6_CLIENT_FQDN_SCRUBBED_EMPTY %1: sanitizing client's FQDN option '%2' yielded an empty string
+Logged at debug log level 50.
+This debug message is issued when the result of sanitizing the
+FQDN option(39) sent by the client is an empty string. When this occurs
+the server will ignore the FQDN option. The arguments include the
+client and the FQDN option it sent.
diff --git a/src/bin/dhcp6/dhcp6_srv.cc b/src/bin/dhcp6/dhcp6_srv.cc
index 417960b126..f999c3178f 100644
--- a/src/bin/dhcp6/dhcp6_srv.cc
+++ b/src/bin/dhcp6/dhcp6_srv.cc
@@ -2332,7 +2332,14 @@ Dhcpv6Srv::processClientFqdn(const Pkt6Ptr& question, const Pkt6Ptr& answer,
} else {
// Adjust the domain name based on domain name value and type sent by
// the client and current configuration.
- d2_mgr.adjustDomainName<Option6ClientFqdn>(*fqdn, *fqdn_resp, *ddns_params);
+ try {
+ d2_mgr.adjustDomainName<Option6ClientFqdn>(*fqdn, *fqdn_resp, *ddns_params);
+ } catch(const FQDNScrubbedEmpty& scrubbed) {
+ LOG_DEBUG(ddns6_logger, DBG_DHCP6_DETAIL, DHCP6_CLIENT_FQDN_SCRUBBED_EMPTY)
+ .arg(question->getLabel())
+ .arg(scrubbed.what());
+ return;
+ }
}
// Once we have the FQDN setup to use it for the lease hostname. This
diff --git a/src/lib/dhcpsrv/d2_client_mgr.cc b/src/lib/dhcpsrv/d2_client_mgr.cc
index 84ee11d9fb..54c815176e 100644
--- a/src/lib/dhcpsrv/d2_client_mgr.cc
+++ b/src/lib/dhcpsrv/d2_client_mgr.cc
@@ -186,10 +186,15 @@ std::string
D2ClientMgr::qualifyName(const std::string& partial_name,
const DdnsParams& ddns_params,
const bool trailing_dot) const {
+ if (partial_name.empty()) {
+ isc_throw(BadValue, "D2ClientMgr::qualifyName"
+ " - partial_name cannot be an empty string");
+ }
+
std::ostringstream gen_name;
gen_name << partial_name;
std::string suffix = ddns_params.getQualifyingSuffix();
- if (!suffix.empty() && partial_name.back() != '.') {
+ if (!suffix.empty() && (partial_name.back() != '.')) {
bool suffix_present = true;
std::string str = gen_name.str();
auto suffix_rit = suffix.rbegin();
@@ -241,7 +246,7 @@ D2ClientMgr::qualifyName(const std::string& partial_name,
// If the trailing dot should not be appended but it is present,
// remove it.
if ((len > 0) && (str[len - 1] == '.')) {
- gen_name.str(str.substr(0,len-1));
+ gen_name.str(str.substr(0, len-1));
}
}
diff --git a/src/lib/dhcpsrv/d2_client_mgr.h b/src/lib/dhcpsrv/d2_client_mgr.h
index 7344f19a40..238fd0a415 100644
--- a/src/lib/dhcpsrv/d2_client_mgr.h
+++ b/src/lib/dhcpsrv/d2_client_mgr.h
@@ -30,6 +30,14 @@
namespace isc {
namespace dhcp {
+/// @brief Exception thrown when host name sanitizing reduces
+/// the domain name to an empty string.
+class FQDNScrubbedEmpty : public Exception {
+public:
+ FQDNScrubbedEmpty(const char* file, size_t line, const char* what) :
+ isc::Exception(file, line, what) { }
+};
+
/// @brief Defines the type for D2 IO error handler.
/// This callback is invoked when a send to kea-dhcp-ddns completes with a
/// failed status. This provides the application layer (Kea) with a means to
@@ -197,6 +205,7 @@ public:
/// suffix itself is empty (i.e. "").
///
/// @return std::string containing the qualified name.
+ /// @throw BadValue if partial_name is empty.
std::string qualifyName(const std::string& partial_name,
const DdnsParams& ddns_params,
const bool trailing_dot) const;
@@ -264,6 +273,9 @@ public:
/// @param ddns_params DDNS behavioral configuration parameters
/// @tparam T FQDN Option class containing the FQDN data such as
/// dhcp::Option4ClientFqdn or dhcp::Option6ClientFqdn
+ ///
+ /// @throw FQDNScrubbedEmpty if hostname sanitizing reduces the input domain
+ /// name to an empty string.
template <class T>
void adjustDomainName(const T& fqdn, T& fqdn_resp,
const DdnsParams& ddns_params);
@@ -515,7 +527,12 @@ D2ClientMgr::adjustDomainName(const T& fqdn, T& fqdn_resp, const DdnsParams& ddn
ss << sanitizer->scrub(label);
}
- client_name = ss.str();
+ std::string clean_name = ss.str();
+ if (clean_name.empty() || clean_name == ".") {
+ isc_throw(FQDNScrubbedEmpty, client_name);
+ }
+
+ client_name = clean_name;
}
// If the supplied name is partial, qualify it by adding the suffix.

1827
CVE-2026-3608.patch
View File

File diff suppressed because it is too large Load Diff

16
kea-3.0.1.tar.xz.asc
View File

@ -1,16 +0,0 @@
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEAlmjO19aOkRmzzRcel4ITKylGIQFAmil4+0ACgkQel4ITKyl
GIRxlg//f+A5yEQ6RKl0DOJfQIKKPZ9SL/2a04q6Gcay2ghUl8LZOiiO98RYicyV
PmrsY/5/nuJmLPRSPKt/pmosfgZUbWK9yuKOoBrfu0KZfQWMX+1ZJIfagY47PCvU
RKtT50+iPOsYZAtuRw8faO8g/rdgl1vMreSIjCPZTG1R4qZkQXNnwhNRV7O3pzsr
wSndDINLvjQoYYbklKpUszoBNppXzBCegzVFjcIjNOSta2U8xEPGQ7sv2JvKkaYf
bVjzKuoEVn0YkkAdf7C7vLotl4UZESNo/w+DcRbrbq/FYpT1R8YWzVAJtqJCVNFI
q0WqlK5/G2/4giAveSWzuX0dnk+OZ5kQrd323Ol6MlM/O4ymkHK7OJrcxLLrEyIC
OnRNWQqVzJddmUTOntvoLk90wJ9yF1jrdM+S3xTpOJzhnfRoFuioZ7njjfGTyskR
Nlt4DX3wGsg0quDQfQJAf1z1qk651/OIF27KThj5jNOPB5eWz4YjJBht9T+eHlcS
kOsNwnKtdZe+KiGeFCsfWU7wOR65w4kQXoH1ruFqVa44ZZKUvzDi4fiJYYfJLedJ
FfBx3c65B0COk+3kOWjAV1F+Zaf0PlrEnb75zbN0O4BrztPL12HhDtjF+CbAuOG2
k4ZpogxZ0Q6MhiQjGFiFMs2PN2FlgiaL2zbKKG/KIjUzPnog60c=
=1ZFT
-----END PGP SIGNATURE-----

16
kea-3.0.3.tar.xz.asc Normal file
View File

@ -0,0 +1,16 @@
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE2mo1COZypJ3Tgq/ZW49NkbiO2QkFAmm6cKwACgkQW49NkbiO
2QmL/w/+O7Ijj50yoo0wXKJ/e9JCoyXXKzTGcUGjtUzhWy2pXM+mwm8rig85MBp+
z073nVsez997lE40O77J1y+XjzL5HZrdlTtDxMnBr3CcHqUkW/jw4UbNo2QLOMXN
UQDx98Z7hTZdwSg527oaQr/zi13JcKtPt3KTJIoKX7SMXtLN8zDdIFXtSmS5Jz7L
QhXSmaXyKHGe16y5TMrN89Qync2fWhXo9pd91VN88yREhkUbPLHUek5JmpGnZyNz
L1wZI6PjdiqPd3ytMQrZ4Aop/CY44wE44gqiYBeoWpaRQCAZUFVssrQR1MURwL/b
9Mp2GmeG7sfhyD3pK1yRdfBBn64SPlV4Fx8GSapFYw2ifM1GJp20eIfqrOLJNM/o
+13hTivcPStVmpAcx2pzg1THHYK4/+XGq7ntrtWNyBEbxN6KhJDrhbSBmpp3J/nz
72kVHgg0vf6f611STEBlMvDirkDCzLmss6B8FL3sAIX/KNKqZX4qu6mzOMAjGmPw
GwRHiVoOpu4nrQataSLYr/qbpsblhKcLqQR2AolOAYIgPNUtFjFKGTiwfyjOoMCJ
zwQMyscCshcS8vFx2F5rxetwWsaqQVu4UEhEJRKl00ivG0QfBcmI0aoM1VvUt/Qz
IiwMJ+v3Jx8Nn+LYYDmT0WJFn18IZDfi0rWIysvUWDNUXOxPQZs=
=1b96
-----END PGP SIGNATURE-----

11
kea-ctrl-agent.service
View File

@ -6,13 +6,14 @@ After=network-online.target
After=time-sync.target
[Service]
Type=notify
User=kea
Environment="KEA_PIDFILE_DIR=/run/kea"
Environment="KEA_LOCKFILE_DIR=/run/kea"
#Environment="KEA_PIDFILE_DIR=/var/run/kea"
#Environment="KEA_LOCKFILE_DIR=/var/run/kea"
#Environment="KEA_LOGGER_DESTINATION=/var/log/kea/early-startup.log"
Environment="KEA_DHCP_DATA_DIR=/var/lib/kea"
Environment="KEA_LOG_FILE_DIR=/var/log/kea"
Environment="KEA_CONTROL_SOCKET_DIR=/run/kea"
#Environment="KEA_DHCP_DATA_DIR=/var/lib/kea"
#Environment="KEA_LOG_FILE_DIR=/var/log/kea"
#Environment="KEA_CONTROL_SOCKET_DIR=/var/run/kea"
ConfigurationDirectory=kea
ConfigurationDirectoryMode=0750
RuntimeDirectory=kea

11
kea-dhcp-ddns.service
View File

@ -6,14 +6,15 @@ After=network-online.target
After=time-sync.target
[Service]
Type=notify
User=kea
AmbientCapabilities=CAP_NET_BIND_SERVICE
Environment="KEA_PIDFILE_DIR=/run/kea"
Environment="KEA_LOCKFILE_DIR=/run/kea"
#Environment="KEA_PIDFILE_DIR=/var/run/kea"
#Environment="KEA_LOCKFILE_DIR=/var/run/kea"
#Environment="KEA_LOGGER_DESTINATION=/var/log/kea/early-startup.log"
Environment="KEA_DHCP_DATA_DIR=/var/lib/kea"
Environment="KEA_LOG_FILE_DIR=/var/log/kea"
Environment="KEA_CONTROL_SOCKET_DIR=/run/kea"
#Environment="KEA_DHCP_DATA_DIR=/var/lib/kea"
#Environment="KEA_LOG_FILE_DIR=/var/log/kea"
#Environment="KEA_CONTROL_SOCKET_DIR=/var/run/kea"
ConfigurationDirectory=kea
ConfigurationDirectoryMode=0750
RuntimeDirectory=kea

10
kea-dhcp4.service
View File

@ -9,12 +9,12 @@ After=time-sync.target
Type=notify
User=kea
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_RAW
Environment="KEA_PIDFILE_DIR=/run/kea"
Environment="KEA_LOCKFILE_DIR=/run/kea"
#Environment="KEA_PIDFILE_DIR=/var/run/kea"
#Environment="KEA_LOCKFILE_DIR=/var/run/kea"
#Environment="KEA_LOGGER_DESTINATION=/var/log/kea/early-startup.log"
Environment="KEA_DHCP_DATA_DIR=/var/lib/kea"
Environment="KEA_LOG_FILE_DIR=/var/log/kea"
Environment="KEA_CONTROL_SOCKET_DIR=/run/kea"
#Environment="KEA_DHCP_DATA_DIR=/var/lib/kea"
#Environment="KEA_LOG_FILE_DIR=/var/log/kea"
#Environment="KEA_CONTROL_SOCKET_DIR=/var/run/kea"
ConfigurationDirectory=kea
ConfigurationDirectoryMode=0750
RuntimeDirectory=kea

10
kea-dhcp6.service
View File

@ -9,12 +9,12 @@ After=time-sync.target
Type=notify
User=kea
AmbientCapabilities=CAP_NET_BIND_SERVICE
Environment="KEA_PIDFILE_DIR=/run/kea"
Environment="KEA_LOCKFILE_DIR=/run/kea"
#Environment="KEA_PIDFILE_DIR=/var/run/kea"
#Environment="KEA_LOCKFILE_DIR=/var/run/kea"
#Environment="KEA_LOGGER_DESTINATION=/var/log/kea/early-startup.log"
Environment="KEA_DHCP_DATA_DIR=/var/lib/kea"
Environment="KEA_LOG_FILE_DIR=/var/log/kea"
Environment="KEA_CONTROL_SOCKET_DIR=/run/kea"
#Environment="KEA_DHCP_DATA_DIR=/var/lib/kea"
#Environment="KEA_LOG_FILE_DIR=/var/log/kea"
#Environment="KEA_CONTROL_SOCKET_DIR=/var/run/kea"
ConfigurationDirectory=kea
ConfigurationDirectoryMode=0750
RuntimeDirectory=kea

108
kea-sd-daemon.patch
View File

@ -36,7 +36,7 @@ index 42ccf28..cc6354a 100644
#mesondefine LIBC_MUSL
diff --git a/meson.build b/meson.build
index 66e7fd0..dc86d89 100644
index 8ed5b2d..df4f125 100644
--- a/meson.build
+++ b/meson.build
@@ -100,6 +100,7 @@ krb5_opt = get_option('krb5')
@ -61,7 +61,7 @@ index 66e7fd0..dc86d89 100644
# Google Test
GTEST_DEP = dependency(
'gtest',
@@ -867,6 +875,11 @@ else
@@ -886,6 +894,11 @@ else
report_conf_data.set('SYSREPOCPP_VERSION', 'no')
report_conf_data.set('SYSREPOCPP_PREFIX', 'no')
endif
@ -85,6 +85,110 @@ index 5c222d5..3ecd2e1 100644
# Options for enabling testing code (not real features).
option(
diff --git a/src/bin/agent/ca_process.cc b/src/bin/agent/ca_process.cc
index f01dd97..4793067 100644
--- a/src/bin/agent/ca_process.cc
+++ b/src/bin/agent/ca_process.cc
@@ -18,6 +18,10 @@
#include <util/filesystem.h>
#include <boost/pointer_cast.hpp>
+#ifdef HAVE_LIBSYSTEMD_DAEMON
+#include <systemd/sd-daemon.h>
+#endif
+
using namespace isc::asiolink;
using namespace isc::config;
using namespace isc::data;
@@ -42,7 +46,15 @@ CtrlAgentProcess::init() {
void
CtrlAgentProcess::run() {
+
LOG_INFO(agent_logger, CTRL_AGENT_STARTED).arg(VERSION);
+#ifdef HAVE_LIBSYSTEMD_DAEMON
+ // Notify systemd about the same
+ sd_notifyf(0, "READY=1\n"
+ "STATUS=Processing requests...\n"
+ "MAINPID=%lu",
+ (unsigned long) getpid());
+#endif
LOG_WARN(agent_logger, CTRL_AGENT_IS_DEPRECATED);
diff --git a/src/bin/agent/meson.build b/src/bin/agent/meson.build
index c6afbfa..2d30179 100644
--- a/src/bin/agent/meson.build
+++ b/src/bin/agent/meson.build
@@ -1,3 +1,8 @@
+kea_ctrl_agent_dependencies = [CRYPTO_DEP]
+if SYSTEMD_DEP.found()
+ kea_ctrl_agent_dependencies += [SYSTEMD_DEP]
+endif
+
agent_lib = static_library(
'agent',
'agent_lexer.cc',
@@ -17,7 +22,7 @@ agent_lib = static_library(
executable(
'kea-ctrl-agent',
'main.cc',
- dependencies: [CRYPTO_DEP],
+ dependencies: kea_ctrl_agent_dependencies,
include_directories: [include_directories('.')] + INCLUDES,
install: true,
install_dir: SBINDIR,
diff --git a/src/bin/d2/d2_process.cc b/src/bin/d2/d2_process.cc
index 7db49a3..cdb9cef 100644
--- a/src/bin/d2/d2_process.cc
+++ b/src/bin/d2/d2_process.cc
@@ -21,6 +21,10 @@
#include <hooks/hooks_manager.h>
#include <util/filesystem.h>
+#ifdef HAVE_LIBSYSTEMD_DAEMON
+#include <systemd/sd-daemon.h>
+#endif
+
using namespace isc::asiolink;
using namespace isc::config;
using namespace isc::data;
@@ -95,6 +99,13 @@ D2Process::init() {
void
D2Process::run() {
LOG_INFO(d2_logger, DHCP_DDNS_STARTED).arg(VERSION);
+#ifdef HAVE_LIBSYSTEMD_DAEMON
+ // Notify systemd about the same
+ sd_notifyf(0, "READY=1\n"
+ "STATUS=Dispatching packets...\n"
+ "MAINPID=%lu",
+ (unsigned long) getpid());
+#endif
if (!PathChecker::shouldEnforceSecurity()) {
LOG_WARN(d2_logger, DHCP_DDNS_SECURITY_CHECKS_DISABLED);
diff --git a/src/bin/d2/meson.build b/src/bin/d2/meson.build
index 012b40d..3aff0c1 100644
--- a/src/bin/d2/meson.build
+++ b/src/bin/d2/meson.build
@@ -1,3 +1,8 @@
+kea_ddns_dependencies = [CRYPTO_DEP]
+if SYSTEMD_DEP.found()
+ kea_ddns_dependencies += [SYSTEMD_DEP]
+endif
+
d2_lib = static_library(
'd2',
'check_exists_add.cc',
@@ -21,7 +26,7 @@ d2_lib = static_library(
executable(
'kea-dhcp-ddns',
'main.cc',
- dependencies: [CRYPTO_DEP],
+ dependencies: kea_ddns_dependencies,
include_directories: [include_directories('.')] + INCLUDES,
install: true,
install_dir: SBINDIR,
diff --git a/src/bin/dhcp4/main.cc b/src/bin/dhcp4/main.cc
index 4f88e29..5581b7a 100644
--- a/src/bin/dhcp4/main.cc

58
kea.spec
View File

@ -1,15 +1,15 @@
## START: Set by rpmautospec
## (rpmautospec version 0.8.3)
## (rpmautospec version 0.8.1)
## RPMAUTOSPEC: autorelease, autochangelog
%define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
release_number = 3;
release_number = 1;
base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
print(release_number + base_release_number - 1);
}%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
## END: Set by rpmautospec
Name: kea
Version: 3.0.1
Version: 3.0.3
Release: %autorelease
Summary: DHCPv4, DHCPv6 and DDNS server from ISC
License: MPL-2.0 AND BSL-1.0
@ -44,16 +44,6 @@ Source15: systemd-tmpfiles.conf
Source16: systemd-sysusers.conf
Patch1: kea-sd-daemon.patch
# https://issues.redhat.com/browse/RHEL-125048
# Based on:
# https://gitlab.isc.org/isc-projects/kea/-/commit/92b65b2345e07d826b56ffd65cf47538f1c7a271
Patch2: CVE-2025-11232.patch
# https://redhat.atlassian.net/browse/RHEL-159879
# Based on:
# https://gitlab.isc.org/isc-projects/kea/-/commit/6ef02087bdf0f5158ad0654d9bdc30c166241e19
# https://gitlab.isc.org/isc-projects/kea/-/commit/316e8d04aedf9392bf9a2edcb35bf2a719c17b13
# https://gitlab.isc.org/isc-projects/kea/-/commit/f1647a5b6d531c1cac4063bef22c4d97568a788e
Patch3: CVE-2026-3608.patch
BuildRequires: boost-devel
# %%meson -D crypto=openssl
@ -188,8 +178,6 @@ export KEA_PKG_TYPE_IN_CONFIGURE="rpm"
-D postgresql=enabled \
-D systemd=enabled
# Messages need to be regenerated by kea-msg-compiler for CVE-2025-11232.patch
%meson_build messages
%meson_build
%meson_build doc
@ -281,25 +269,6 @@ install -dm 0750 %{buildroot}%{_localstatedir}/log/kea/
%sysusers_create_compat %{S:16}
%post
# Kea runs under kea user instead of root now, but if its files got altered, their new
# ownership&permissions won't get changed so fix them to prevent startup failures
[ "`stat --format '%U:%G' %{_rundir}/kea/logger_lockfile 2>&1 | grep root:root`" = "root:root" ] \
&& chown kea:kea %{_rundir}/kea/logger_lockfile
[ "`stat --format '%U:%G' %{_sharedstatedir}/kea/kea-leases4.csv* 2>&1 | grep root:root | head -1`" = "root:root" ] \
&& chown kea:kea %{_sharedstatedir}/kea/kea-leases4.csv* && chmod 0640 %{_sharedstatedir}/kea/kea-leases4.csv*
[ "`stat --format '%U:%G' %{_sharedstatedir}/kea/kea-leases6.csv* 2>&1 | grep root:root | head -1`" = "root:root" ] \
&& chown kea:kea %{_sharedstatedir}/kea/kea-leases6.csv* && chmod 0640 %{_sharedstatedir}/kea/kea-leases6.csv*
[ "`stat --format '%U:%G' %{_sharedstatedir}/kea/kea-dhcp6-serverid 2>&1 | grep root:root`" = "root:root" ] \
&& chown kea:kea %{_sharedstatedir}/kea/kea-dhcp6-serverid
[ "`stat --format '%U:%G' %{_sysconfdir}/kea/kea*.conf 2>&1 | grep root:root | head -1`" = "root:root" ] \
&& chown root:kea %{_sysconfdir}/kea/kea*.conf && chmod 0640 %{_sysconfdir}/kea/kea*.conf
# Remove /tmp/ from socket-name for existing configurations to fix CVE-2025-32802
for i in kea-ctrl-agent.conf kea-dhcp4.conf kea-dhcp6.conf kea-dhcp-ddns.conf; do
if [ -n "`grep '\"socket-name\": \"/tmp/' %{_sysconfdir}/kea/$i`" ]; then
sed -i.CVE-2025-32802.bak 's#\("socket-name": "/tmp/\)\(.*\)#"socket-name": "\2#g' %{_sysconfdir}/kea/$i
fi
done
# Set a pseudo-random password for default config to secure fresh install and allow CA startup without user intervention
if [[ ! -s %{_sysconfdir}/kea/kea-api-password && -n `grep '"password-file": "kea-api-password"' %{_sysconfdir}/kea/kea-ctrl-agent.conf` ]]; then
(umask 0027; head -c 32 /dev/urandom | base64 > %{_sysconfdir}/kea/kea-api-password)
@ -431,7 +400,7 @@ fi
%{_libdir}/libkea-database.so.76*
%{_libdir}/libkea-dhcp_ddns.so.68*
%{_libdir}/libkea-dhcp.so.109*
%{_libdir}/libkea-dhcpsrv.so.130*
%{_libdir}/libkea-dhcpsrv.so.131*
%{_libdir}/libkea-dns.so.71*
%{_libdir}/libkea-eval.so.84*
%{_libdir}/libkea-exceptions.so.45*
@ -454,10 +423,25 @@ fi
%changelog
## START: Generated by rpmautospec
* Fri Mar 27 2026 Martin Osvald <mosvald@redhat.com> - 3.0.1-3
* Tue Jun 30 2026 Martin Osvald <mosvald@redhat.com> - 3.0.3-1
- New version 3.0.3
- Fixes CVE-2026-3608
* Thu Oct 30 2025 Martin Osvald <mosvald@redhat.com> - 3.0.1-2
* Mon Jan 12 2026 Martin Osvald <mosvald@redhat.com> - 3.0.2-5
- Do not set environmental variables to prevent clashes with compilation
time settings
* Fri Jan 09 2026 Martin Osvald <mosvald@redhat.com> - 3.0.2-4
- Create /var/lib/kea through systemd-tmpfiles
* Fri Jan 09 2026 Martin Osvald <mosvald@redhat.com> - 3.0.2-3
- Fix files owned by usbmon in image mode
* Sun Dec 07 2025 Martin Osvald <mosvald@redhat.com> - 3.0.2-2
- Support for sending startup notifications to systemd II
* Thu Oct 30 2025 Martin Osvald <mosvald@redhat.com> - 3.0.2-1
- New version 3.0.2
- Fixes CVE-2025-11232
* Tue Sep 02 2025 Martin Osvald <mosvald@redhat.com> - 3.0.1-1

2
sources
View File

@ -1,2 +1,2 @@
SHA512 (kea-3.0.1.tar.xz) = 84e2164aa91c95b2e6e65994a2327fa1233c82b06af69312f55464119d4edc6151a4662a54f4a3ae83e0487dac7b25c5e59e60bcbed653fd30fb32ae7cacddf3
SHA512 (kea-3.0.3.tar.xz) = 38dff3a089b76d043c0bd1cc1bbf480b71b627d101954eb2d8200bce507dcd43e8a1cbdb5b55b7f425424a156ec56e36af52b6c591ecf6c80c29b58875b5b585
SHA512 (keama-4.5.0.tar.gz) = 2e48987e21999718be7ceb5b604be672c84666b07dde9545285ff7146ab6825e81af1ec3b5a4b50f20e61b40ed11b0254e3705cc580bb85de24b77ee8cbca162

1
systemd-tmpfiles.conf
View File

@ -2,3 +2,4 @@
# See tmpfiles.d(5) for details
d /run/kea 0750 kea kea -
d /var/lib/kea 0750 kea kea -