.gitignore

@@ -1,2 +1 @@
-/mrtg-2.17.7.tar.gz
+SOURCES/mrtg-2.17.7.tar.gz
-/mrtg-2.17.7.tar.gz.md5

.mrtg.metadata

@@ -0,0 +1 @@
+c8d6134dd22b9a62e5924faf42d7779bbd1d33ff SOURCES/mrtg-2.17.7.tar.gz

SOURCES/mrtg-2.17.7-traffic-sum-man-option.patch

@@ -0,0 +1,12 @@
+diff -up mrtg-2.17.7/bin/mrtg-traffic-sum.orig mrtg-2.17.7/bin/mrtg-traffic-sum
+--- mrtg-2.17.7/bin/mrtg-traffic-sum.orig	2018-10-18 12:21:12.616589922 +0200
++++ mrtg-2.17.7/bin/mrtg-traffic-sum	2018-10-18 12:23:10.852648709 +0200
+@@ -58,7 +58,7 @@ sub mailout($$);
+ sub main()
+ {
+     # parse options
+-    GetOptions(\%opt, 'min=i','help|h', 'catch=s', 'email=s','version','range=s','units=s') or exit(1);
++    GetOptions(\%opt, 'min=i','help|h', 'catch=s', 'email=s','version','range=s','units=s','man') or exit(1);
+     if($opt{help})     { pod2usage(1) }
+     if($opt{man})      { pod2usage(-exitstatus => 0, -verbose => 2) }
+     if($opt{version})  { print "mrtg-traffic-sum $Revision\n"; exit(0) }

SOURCES/mrtg-2.17.7.tar.gz.md5

@@ -0,0 +1 @@
+eada3870c0419e425299401486600d95  mrtg-2.17.7.tar.gz

SOURCES/mrtg.service

@@ -17,7 +17,6 @@
 
 [Unit]
 Description=Multi-router Traffic Grapher
-After=syslog.target
 
 [Service]
 Environment=LANG=C
@@ -30,7 +29,6 @@ ExecStart=/usr/bin/mrtg /etc/mrtg/mrtg.cfg --lock-file /var/lock/mrtg/mrtg_l --c
 # - RunAsDaemon: no; (periodic invocation) :
 #Type=oneshot
 Type=simple
-StandardOutput=syslog
 
 [Install]
 WantedBy=multi-user.target

SOURCES/mrtg.tmpfiles

@@ -0,0 +1,4 @@
+d /var/lock/mrtg 0755 root root -
+d /var/lib/mrtg 0755 root root -
+# populate /var/www/mrtg with content from /usr/share/factory/var/www/mrtg
+C /var/www/mrtg - - - -

SPECS/mrtg.spec

@@ -1,12 +1,13 @@
 %global _use_internal_dependency_generator 0
 
 %global contentdir       %{_localstatedir}/www/%{name}
+%global factory_contentdir     %{_datadir}/factory/var/www/%{name}
 %global libdir           %{_localstatedir}/lib/mrtg
 
 Summary:   Multi Router Traffic Grapher
 Name:      mrtg
 Version:   2.17.7
-Release:   1%{?dist}.1
+Release:   12%{?dist}
 URL:       http://oss.oetiker.ch/mrtg/
 Source0:   http://oss.oetiker.ch/mrtg/pub/mrtg-%{version}.tar.gz
 Source1:   http://oss.oetiker.ch/mrtg/pub/mrtg-%{version}.tar.gz.md5
@@ -28,19 +29,20 @@ Patch0:    mrtg-2.15.0-lib64.patch
 Patch1:    mrtg-2.17.2-socket6-fix.patch
 # Patch2: some devices return 2**32-2 on ifSpeed (e. g. IBM FibreChannel switches)
 Patch2:    mrtg-2.17.4-cfgmaker-ifhighspeed.patch
-# https://issues.redhat.com/browse/RHEL-236037
+# Patch3: fixes 'man' option in mrtg-traffic-sum, see rhbz#1612188
-# https://github.com/oetiker/mrtg/commit/30e19216bfadc0148f347cb0a42fd5e2016e6269
+Patch3:    mrtg-2.17.7-traffic-sum-man-option.patch
-Patch3:    mrtg-2.17.7-CVE-2026-72694.patch
 License:   GPLv2+
-Group:     Applications/Internet
 Requires(post): systemd-units
 Requires(preun): systemd-units
 Requires(postun): systemd-units
-Requires:  perl-Socket6 perl-IO-Socket-INET6
+Requires:  perl-Socket6 perl-IO-Socket-INET6 perl-locale
 Requires:  gd
+BuildRequires: make
 BuildRequires: gd-devel, libpng-devel
 BuildRequires: perl-generators
 BuildRequires: systemd-units
+BuildRequires: systemd-rpm-macros
+BuildRequires: gcc
 
 %global __find_requires %{SOURCE3}
 %global __find_provides %{SOURCE6}
@@ -52,10 +54,10 @@ images which provide a LIVE visual representation of this traffic.
 
 %prep
 %setup -q
-%patch0 -p1 -b .lib64
+%patch -P 0 -p1 -b .lib64
-%patch1 -p1 -b .socket6
+%patch -P 1 -p1 -b .socket6
-%patch2 -p1 -b .ifhighspeed
+%patch -P 2 -p1 -b .ifhighspeed
-%patch3 -p1 -b .CVE-2026-72694
+%patch -P 3 -p1 -b .traffic-sum-man-option
 
 for i in doc/mrtg-forum.1 doc/mrtg-squid.1 CHANGES; do
     iconv -f iso-8859-1 -t utf-8 < "$i" > "${i}_"
@@ -80,13 +82,11 @@ rm -rf   $RPM_BUILD_ROOT
 make install DESTDIR=$RPM_BUILD_ROOT
 
 mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/mrtg
-mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/lib/mrtg
+mkdir -p $RPM_BUILD_ROOT%{factory_contentdir}
-mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/lock/mrtg
-mkdir -p $RPM_BUILD_ROOT%{contentdir}
 mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.d
 
-install -m 644 images/*   $RPM_BUILD_ROOT%{contentdir}/
+install -m 644 images/*   $RPM_BUILD_ROOT%{factory_contentdir}/
-sed 's,@CONTENTDIR@,%{contentdir},g; s,@LIBDIR@,%{_localstatedir}/lib/mrtg,g' \
+sed 's,@CONTENTDIR@,%{contentdir},g; s,@LIBDIR@,%{libdir},g' \
     %{SOURCE2} > $RPM_BUILD_ROOT%{_sysconfdir}/mrtg/mrtg.cfg
 chmod 644 $RPM_BUILD_ROOT%{_sysconfdir}/mrtg/mrtg.cfg
 
@@ -108,14 +108,13 @@ done
 sed -i 's;@@lib@@;%{_lib};g' "$RPM_BUILD_ROOT"%{_mandir}/man1/*.1
 
 %post
-install -d -m 0755 -o root -g root /var/lock/mrtg
 restorecon /var/lock/mrtg
 %systemd_post mrtg.service
 
 %preun
 if [ $1 -eq 0 ]; then
   # Package removal, not upgrade
-  rm -rf /var/lock/mrtg
+  rm -rf %{_localstatedir}/lock/mrtg
 fi
 %systemd_preun mrtg.service
 
@@ -128,28 +127,73 @@ fi
 %dir %{_sysconfdir}/mrtg
 %config(noreplace) %{_sysconfdir}/mrtg/mrtg.cfg
 %config(noreplace) %{_sysconfdir}/httpd/conf.d/mrtg.conf
-%{contentdir}
+%{factory_contentdir}
 %{_bindir}/*
 %{_libdir}/mrtg2
 %exclude %{_libdir}/mrtg2/Pod
 %{_mandir}/*/*
 %exclude %{_datadir}/mrtg2/icons
 %exclude %{_datadir}/doc/mrtg2
-%dir %{_localstatedir}/lib/mrtg
+%ghost %attr(0755,root,root) %dir %{libdir}
+%ghost %attr(0755,root,root) %dir %{contentdir}
 %{_tmpfilesdir}/mrtg.conf
-%ghost /var/lock/mrtg
+%ghost %attr(0755,root,root) %dir %{_localstatedir}/lock/mrtg
 %{_unitdir}/mrtg.service
 %{_unitdir}/mrtg.timer
 
 %changelog
-* Tue Aug 11 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.17.7-1.1
+* Mon Jan 26 2026 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.17.7-12
-- Fix CVE-2026-72694: symlink-following chown in PID file handling
+- Add support for Image Mode
-  Resolves: RHEL-236037
+  Resolves: RHEL-142950
 
-* Mon Aug 13 2018 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.17.7-1
+* Mon Feb 05 2024 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.17.7-11
+- Remove obsolete syslog references from service file
+  Resolves: RHEL-19644
+
+* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 2.17.7-10
+- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
+  Related: rhbz#1991688
+
+* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 2.17.7-9
+- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
+
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.7-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Mon Nov 09 2020 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.17.7-7
+- Add Requires perl-locale
+  Resolves: #1895580
+
+* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.7-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.7-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.7-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.7-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Thu Oct 18 2018 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.17.7-2
+- Fix mrtg-traffic-sum incorrectly ignores 'man' option
+  Resolves: #1612188
+
+* Thu Aug 09 2018 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.17.7-1
 - Use %%license
 - Update to mrtg-2.17.7
-  Resolves: #1615340
+  Resolves: #1600933
+
+* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.4-24
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Thu Feb 22 2018 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.17.4-23
+- Add BuildRequires gcc
+- Remove Group tag
+
+* Thu Feb 08 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.4-22
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
 
 * Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.4-21
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild

mrtg-2.17.7-CVE-2026-72694.patch

@@ -1,113 +0,0 @@
-From d165b744f0ef0fa713e4b1cf4635422fffae9c73 Mon Sep 17 00:00:00 2001
-From: Tobias Oetiker <tobi@oetiker.ch>
-Date: Tue, 30 Jun 2026 23:34:40 +0200
-Subject: [PATCH] Fix symlink-following chown of pid file in daemon mode
- (CWE-59) (#123)
-
-When mrtg is started as root in daemon mode (--daemon --user), it
-created the pid file and chown'ed it to the target user *before*
-dropping privileges. Both create_pid()'s `-e`/`open(">...")` and the
-subsequent `chown` follow symlinks, so a local attacker who can
-pre-place a symlink at the pid path (e.g. a pid file in a writable
-directory) could make root chown an arbitrary existing file to the
-daemon user, or create a root-owned file at an attacker-chosen path.
-
-Rather than reorder the privilege drop (which would break the common
-case of a root-owned pid directory, where the unprivileged daemon
-cannot create the file itself), keep creating the file while
-privileged but do it safely:
-
-- create_pid() refuses symlinks and creates the file with
-  O_WRONLY|O_CREAT|O_EXCL, closing the symlink-follow / TOCTOU window.
-- It chowns the open filehandle (fchown) instead of the path, so the
-  ownership change cannot be redirected through a swapped-in symlink.
-  The caller no longer does a separate path-based chown.
-- demonize_me()'s later pid write refuses symlinks too.
-
-Reported by Aisle Research via Vitezslav Crhonek.
-
-Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
----
- bin/mrtg              |  8 +++++---
- lib/mrtg2/MRTG_lib.pm | 32 ++++++++++++++++++++++++++------
- 2 files changed, 31 insertions(+), 9 deletions(-)
-
-diff --git a/bin/mrtg b/bin/mrtg
-index c332665..fc6cdcb 100755
---- a/bin/mrtg
-+++ b/bin/mrtg
-@@ -222,9 +222,11 @@ sub main {
- 
-     # Run as a daemon, specified on command line (required for FHS compliant daemon)
-     if (defined $opts{"daemon"}) {
--	# Create a pidfile, then chown it so we can use it once we change user
--	&create_pid($pidfile);
--	chown $uid, $gid, $pidfile;
-+	# Create the pidfile securely and, while still privileged, hand it to
-+	# the user we are about to become so the daemon can update it later.
-+	# create_pid refuses symlinks and chowns the open handle (not the path),
-+	# so a hostile pid path cannot be used to chown an arbitrary file.
-+	&create_pid($pidfile, $uid, $gid);
-     }
- 
-     ($(,$)) = ($gid,$gid) ;
-diff --git a/lib/mrtg2/MRTG_lib.pm b/lib/mrtg2/MRTG_lib.pm
-index ff3d7e1..140f0b0 100644
---- a/lib/mrtg2/MRTG_lib.pm
-+++ b/lib/mrtg2/MRTG_lib.pm
-@@ -16,6 +16,7 @@ package MRTG_lib;
- 
- require 5.005;
- use strict;
-+use Fcntl qw(O_WRONLY O_CREAT O_EXCL);
- use vars qw($OS $SL $PS @EXPORT @ISA $VERSION %timestrpospattern);
- 
- 
-@@ -1208,14 +1209,31 @@ sub expistr ($) {
-     return "$wday, $mday $month ".($year+1900)." $hour:$min:$sec GMT";
- }
- 
--sub create_pid ($) {
--    my $pidfile = shift;
-+sub create_pid ($;$$) {
-+    my ($pidfile, $uid, $gid) = @_;
-     return if ($OS eq 'NT' );
-+
-+    # Security: refuse to operate on a symlink. When mrtg is started as root
-+    # in daemon mode with a writable pid path, an attacker who pre-places a
-+    # symlink here could otherwise make us create or chown an arbitrary file
-+    # (CWE-59). A plain stat/-e on the path would follow the link, so check
-+    # the link itself first.
-+    if (-l $pidfile) {
-+        warn "refusing to use pid file $pidfile: it is a symbolic link\n";
-+        return;
-+    }
-     return if -e $pidfile;
--    if ( open(PIDFILE,">$pidfile")) {
--         close PIDFILE;
-+
-+    # O_CREAT|O_EXCL creates the file atomically and fails if anything
-+    # (including a symlink that was raced in after the check above) already
-+    # exists at the path, closing the symlink-follow / TOCTOU window.
-+    if ( sysopen(my $fh, $pidfile, O_WRONLY|O_CREAT|O_EXCL, 0644) ) {
-+         # chown the open handle (fchown) rather than the path, so the
-+         # ownership change cannot be redirected through a swapped-in symlink.
-+         chown $uid, $gid, $fh if defined $uid and defined $gid;
-+         close $fh;
-     } else {
--         warn "cannot write to $pidfile: $!\n";
-+         warn "cannot create pid file $pidfile: $!\n";
-     }
- }
- 
-@@ -1261,7 +1279,9 @@ sub demonize_me ($) {
-             } else {
-                 if (defined $pidfile){
-                    $main::Cleanfile3 = $pidfile;
--                   if (open(PIDFILE,">$pidfile")) {
-+                   if (-l $pidfile) {
-+                        warn "refusing to write pid file $pidfile: it is a symbolic link\n";
-+                   } elsif (open(PIDFILE,">$pidfile")) {
-                         print PIDFILE "$$\n";
-                         close PIDFILE;
-                    } else {

mrtg.crond.in

@@ -1 +0,0 @@
-*/5 * * * * root LANG=C LC_ALL=C @bindir@/mrtg @sysconfdir@/mrtg/mrtg.cfg --lock-file @localstatedir@/lock/mrtg/mrtg_l --confcache-file @localstatedir@/lib/mrtg/mrtg.ok

mrtg.tmpfiles

@@ -1 +0,0 @@
-d /var/lock/mrtg 0755 root root -

sources

@@ -1,2 +0,0 @@
-SHA512 (mrtg-2.17.7.tar.gz) = b25ab38416213bc5128612724530f36f4a855bb66a65f8bbe4bdafef05d2688eed68f5c3df1e13193102507a4114e71ec226ad32dd6b4d3ae2e2291320d8e768
-SHA512 (mrtg-2.17.7.tar.gz.md5) = 146bf77c985e54e949daceb3bfe2b7c8f67f7f1c495a3e666957a91514c6fcadeb02ecc5d42d8536fef1b9e70779018736ffe602c216f6c283c9f784f0cad50f