From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 632C8139085 for ; Sat, 14 Jan 2017 23:30:44 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 9C262E0DD2; Sat, 14 Jan 2017 23:30:43 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 63AF0E0DD2 for ; Sat, 14 Jan 2017 23:30:43 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 099E234112A for ; Sat, 14 Jan 2017 23:30:42 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 491542749 for ; Sat, 14 Jan 2017 23:30:40 +0000 (UTC) From: "Michael Orlitzky" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Michael Orlitzky" Message-ID: <1484436604.808f26f5899a40b08c1497b1ca97e08fa6add947.mjo@gentoo> Subject: [gentoo-commits] repo/gentoo:master commit in: net-analyzer/nagios-core/files/, net-analyzer/nagios-core/ X-VCS-Repository: repo/gentoo X-VCS-Files: net-analyzer/nagios-core/Manifest net-analyzer/nagios-core/files/99_nagios3.conf net-analyzer/nagios-core/files/lighttpd_nagios3-r1.conf net-analyzer/nagios-core/files/nagios-core-3.5.1-process_cgivars.patch net-analyzer/nagios-core/files/nagios3 net-analyzer/nagios-core/nagios-core-3.5.1.ebuild X-VCS-Directories: net-analyzer/nagios-core/ net-analyzer/nagios-core/files/ X-VCS-Committer: mjo X-VCS-Committer-Name: Michael Orlitzky X-VCS-Revision: 808f26f5899a40b08c1497b1ca97e08fa6add947 X-VCS-Branch: master Date: Sat, 14 Jan 2017 23:30:40 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 5723cccd-1f11-4891-b627-40bdb9df9e7d X-Archives-Hash: b53b1b75c0efed0dba0373431c680504 commit: 808f26f5899a40b08c1497b1ca97e08fa6add947 Author: Michael Orlitzky gentoo org> AuthorDate: Sat Jan 14 23:29:43 2017 +0000 Commit: Michael Orlitzky gentoo org> CommitDate: Sat Jan 14 23:30:04 2017 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=808f26f5 net-analyzer/nagios-core: bring back the 3.x ebuild to save pnp4nagios. I tried removing the old versions of nagios to address a CVE, but net-analyzer/pnp4nagios on three arches requires nagios-3.x. I've filed a keyword request for icinga (which can also satisfy the dependency), and after those keywords are added and everything is stabilized we can try this again. Gentoo-Bug: 602216 Gentoo-Bug: 605724 Package-Manager: portage-2.3.0 net-analyzer/nagios-core/Manifest | 1 + net-analyzer/nagios-core/files/99_nagios3.conf | 15 ++ .../nagios-core/files/lighttpd_nagios3-r1.conf | 24 +++ .../files/nagios-core-3.5.1-process_cgivars.patch | 175 +++++++++++++++++ net-analyzer/nagios-core/files/nagios3 | 53 +++++ net-analyzer/nagios-core/nagios-core-3.5.1.ebuild | 217 +++++++++++++++++++++ 6 files changed, 485 insertions(+) diff --git a/net-analyzer/nagios-core/Manifest b/net-analyzer/nagios-core/Manifest index 203f0f3..60c9c97 100644 --- a/net-analyzer/nagios-core/Manifest +++ b/net-analyzer/nagios-core/Manifest @@ -1,2 +1,3 @@ +DIST nagios-3.5.1.tar.gz 1763584 SHA256 ca9dd68234fa090b3c35ecc8767b2c9eb743977eaf32612fa9b8341cc00a0f99 SHA512 48e2ecb91002b08203937b12a438c87c62cd3c5c401a0ed9e861cd6d79074c7017ed373e9379f013d87dea1fd7cb8e3d85112d55c87ac91aed96b256868c112d WHIRLPOOL 2c02584702c64dbb0e353e34b758fab079eee0dc7a401e7b5947a21733758d3596401e5519e2dd7f05c89ee4835c21965d2718157fd9d6d3d20af9c853d688ca DIST nagios-4.2.4.tar.gz 11088206 SHA256 b0055c475683ce50d77b1536ff0cec9abf89139adecf771601fa021ef9a20b70 SHA512 1f060f3139db6f77f7ca218bb4befb631c08b0ccb1b2b85e4c06cfc94328b5d09cef9b547eb54617089334a1e36b881347dfbb98bcc88b9b38e878214f97883a WHIRLPOOL a3d5454c72ab38388e8071dca8a319c717bb22915cfd06243727eb33f7b8a93cc323531be1535d14e283335b9964762a2729f4605f76d9a01ff78bbe924053a7 DIST nagios-core-gentoo-icons-20141125.tar 40960 SHA256 68b715f636eb291343cab3259862bbed8b6b898520b58df522438524de3d8761 SHA512 bf109879cddd6136b76baba55d0b60b2596e37431dcf5ce0905d34a9fa292ebf7e4bde82d9a084362c486e8fac344c76d88f9298b1b85541ed70ffd608493766 WHIRLPOOL 7ec3a944b2a659b456d3168818ca5b1af3a427436e6af2f3e5d6cba6fc7b1c7bad6f552301f064df31988865b3b32fd117d9e6f61c630d6d817a51cbbbcb331d diff --git a/net-analyzer/nagios-core/files/99_nagios3.conf b/net-analyzer/nagios-core/files/99_nagios3.conf new file mode 100644 index 00000000..074f9ce --- /dev/null +++ b/net-analyzer/nagios-core/files/99_nagios3.conf @@ -0,0 +1,15 @@ + + ScriptAlias /nagios/cgi-bin/ /usr/lib/nagios/cgi-bin/ + + AllowOverride AuthConfig + Options ExecCGI + Order allow,deny + Allow from all + + Alias /nagios /usr/share/nagios/htdocs + + AllowOverride AuthConfig + Order allow,deny + Allow from all + + diff --git a/net-analyzer/nagios-core/files/lighttpd_nagios3-r1.conf b/net-analyzer/nagios-core/files/lighttpd_nagios3-r1.conf new file mode 100644 index 00000000..6e25770 --- /dev/null +++ b/net-analyzer/nagios-core/files/lighttpd_nagios3-r1.conf @@ -0,0 +1,24 @@ +server.modules += ("mod_cgi") +server.modules += ("mod_auth") +server.modules += ("mod_alias") + +auth.require += ( "/nagios" => + ( + "method" => "digest", + "realm" => "nagios", + "require" => "valid-user" + ) +) + +$HTTP["url"] =~ "^/nagios/cgi-bin/" { + dir-listing.activate = "disable" + cgi.assign = ( + ".pl" => "/usr/bin/perl", + ".cgi" => "" + ) +} + +alias.url += ( + "/nagios/cgi-bin" => "/usr/lib/nagios/cgi-bin", + "/nagios" => "/usr/share/nagios/htdocs" +) diff --git a/net-analyzer/nagios-core/files/nagios-core-3.5.1-process_cgivars.patch b/net-analyzer/nagios-core/files/nagios-core-3.5.1-process_cgivars.patch new file mode 100644 index 00000000..9d95367 --- /dev/null +++ b/net-analyzer/nagios-core/files/nagios-core-3.5.1-process_cgivars.patch @@ -0,0 +1,175 @@ +commit d97e03f32741a7d851826b03ed73ff4c9612a866 +Author: Eric Stanley +Date: Fri Dec 20 13:14:30 2013 -0600 + + CGIs: Fixed minor vulnerability where a custom query could crash the CGI. + + Most CGIs previously incremented the input variable counter twice when + it encountered a long key value. This could cause the CGI to read past + the end of the list of CGI variables. This commit removes the second + increment, removing the possibility of reading past the end of the list + of CGI variables. + +diff --git a/cgi/avail.c b/cgi/avail.c +index 76afd86..64eaadc 100644 +--- a/cgi/avail.c ++++ b/cgi/avail.c +@@ -1096,7 +1096,6 @@ int process_cgivars(void) { + + /* do some basic length checking on the variable identifier to prevent buffer overflows */ + if(strlen(variables[x]) >= MAX_INPUT_BUFFER - 1) { +- x++; + continue; + } + +diff --git a/cgi/cmd.c b/cgi/cmd.c +index fa6cf5a..50504eb 100644 +--- a/cgi/cmd.c ++++ b/cgi/cmd.c +@@ -311,7 +311,6 @@ int process_cgivars(void) { + + /* do some basic length checking on the variable identifier to prevent buffer overflows */ + if(strlen(variables[x]) >= MAX_INPUT_BUFFER - 1) { +- x++; + continue; + } + +diff --git a/cgi/config.c b/cgi/config.c +index f061b0f..3360e70 100644 +--- a/cgi/config.c ++++ b/cgi/config.c +@@ -344,7 +344,6 @@ int process_cgivars(void) { + + /* do some basic length checking on the variable identifier to prevent buffer overflows */ + if(strlen(variables[x]) >= MAX_INPUT_BUFFER - 1) { +- x++; + continue; + } + +diff --git a/cgi/extinfo.c b/cgi/extinfo.c +index 62a1b18..5113df4 100644 +--- a/cgi/extinfo.c ++++ b/cgi/extinfo.c +@@ -591,7 +591,6 @@ int process_cgivars(void) { + + /* do some basic length checking on the variable identifier to prevent buffer overflows */ + if(strlen(variables[x]) >= MAX_INPUT_BUFFER - 1) { +- x++; + continue; + } + +diff --git a/cgi/histogram.c b/cgi/histogram.c +index 4616541..f6934d0 100644 +--- a/cgi/histogram.c ++++ b/cgi/histogram.c +@@ -1060,7 +1060,6 @@ int process_cgivars(void) { + + /* do some basic length checking on the variable identifier to prevent buffer overflows */ + if(strlen(variables[x]) >= MAX_INPUT_BUFFER - 1) { +- x++; + continue; + } + +diff --git a/cgi/notifications.c b/cgi/notifications.c +index 8ba11c1..461ae84 100644 +--- a/cgi/notifications.c ++++ b/cgi/notifications.c +@@ -327,7 +327,6 @@ int process_cgivars(void) { + + /* do some basic length checking on the variable identifier to prevent buffer overflows */ + if(strlen(variables[x]) >= MAX_INPUT_BUFFER - 1) { +- x++; + continue; + } + +diff --git a/cgi/outages.c b/cgi/outages.c +index 426ede6..cb58dee 100644 +--- a/cgi/outages.c ++++ b/cgi/outages.c +@@ -225,7 +225,6 @@ int process_cgivars(void) { + + /* do some basic length checking on the variable identifier to prevent buffer overflows */ + if(strlen(variables[x]) >= MAX_INPUT_BUFFER - 1) { +- x++; + continue; + } + +diff --git a/cgi/status.c b/cgi/status.c +index 3253340..4ec1c92 100644 +--- a/cgi/status.c ++++ b/cgi/status.c +@@ -567,7 +567,6 @@ int process_cgivars(void) { + + /* do some basic length checking on the variable identifier to prevent buffer overflows */ + if(strlen(variables[x]) >= MAX_INPUT_BUFFER - 1) { +- x++; + continue; + } + +diff --git a/cgi/statusmap.c b/cgi/statusmap.c +index ea48368..2580ae5 100644 +--- a/cgi/statusmap.c ++++ b/cgi/statusmap.c +@@ -400,7 +400,6 @@ int process_cgivars(void) { + + /* do some basic length checking on the variable identifier to prevent buffer overflows */ + if(strlen(variables[x]) >= MAX_INPUT_BUFFER - 1) { +- x++; + continue; + } + +diff --git a/cgi/statuswml.c b/cgi/statuswml.c +index bd8cea2..d25abef 100644 +--- a/cgi/statuswml.c ++++ b/cgi/statuswml.c +@@ -226,8 +226,13 @@ int process_cgivars(void) { + + for(x = 0; variables[x] != NULL; x++) { + ++ /* do some basic length checking on the variable identifier to prevent buffer overflows */ ++ if(strlen(variables[x]) >= MAX_INPUT_BUFFER - 1) { ++ continue; ++ } ++ + /* we found the hostgroup argument */ +- if(!strcmp(variables[x], "hostgroup")) { ++ else if(!strcmp(variables[x], "hostgroup")) { + display_type = DISPLAY_HOSTGROUP; + x++; + if(variables[x] == NULL) { +diff --git a/cgi/summary.c b/cgi/summary.c +index 126ce5e..749a02c 100644 +--- a/cgi/summary.c ++++ b/cgi/summary.c +@@ -725,7 +725,6 @@ int process_cgivars(void) { + + /* do some basic length checking on the variable identifier to prevent buffer overflows */ + if(strlen(variables[x]) >= MAX_INPUT_BUFFER - 1) { +- x++; + continue; + } + +diff --git a/cgi/trends.c b/cgi/trends.c +index b35c18e..895db01 100644 +--- a/cgi/trends.c ++++ b/cgi/trends.c +@@ -1263,7 +1263,6 @@ int process_cgivars(void) { + + /* do some basic length checking on the variable identifier to prevent buffer overflows */ + if(strlen(variables[x]) >= MAX_INPUT_BUFFER - 1) { +- x++; + continue; + } + +diff --git a/contrib/daemonchk.c b/contrib/daemonchk.c +index 78716e5..9bb6c4b 100644 +--- a/contrib/daemonchk.c ++++ b/contrib/daemonchk.c +@@ -174,7 +174,6 @@ static int process_cgivars(void) { + + /* do some basic length checking on the variable identifier to prevent buffer overflows */ + if(strlen(variables[x]) >= MAX_INPUT_BUFFER - 1) { +- x++; + continue; + } + } diff --git a/net-analyzer/nagios-core/files/nagios3 b/net-analyzer/nagios-core/files/nagios3 new file mode 100644 index 00000000..48b4f46 --- /dev/null +++ b/net-analyzer/nagios-core/files/nagios3 @@ -0,0 +1,53 @@ +#!/sbin/openrc-run +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Id$ + +extra_commands="checkconfig" +extra_started_commands="reload" + +nagios_config="/etc/nagios/nagios.cfg" +nagios_cmdfile="/var/nagios/rw/nagios.cmd" + +command="/usr/sbin/nagios" +command_args="-d ${nagios_config}" +pidfile="/var/nagios/nagios.lock" +start_stop_daemon_args="-e HOME=/var/nagios/home" + +depend() { + need net + use dns logger firewall + after mysql postgresql +} + +reload() +{ + checkconfig || return 1 + ebegin "Reloading configuration" + start-stop-daemon --signal HUP --pidfile ${pidfile} + eend $? +} + +checkconfig() { + ebegin "Verifying config files" + + # Silent Check + /usr/sbin/nagios -v ${nagios_config} &>/dev/null && return 0 + + # Now we know there's problem - run again and display errors + /usr/sbin/nagios -v ${nagios_config} + eend $? "Configuration Error. Please fix your configfile" +} + +start_pre() { + checkconfig || return 1 + + touch /var/nagios/nagios.log /var/nagios/status.sav + chown nagios:nagios /var/nagios/nagios.log /var/nagios/status.sav + rm -f ${nagios_cmdfile} +} + +stop_post() { + rm -f /var/nagios/status.log /var/nagios/nagios.tmp ${pidfile} \ + ${nagios_cmdfile} +} diff --git a/net-analyzer/nagios-core/nagios-core-3.5.1.ebuild b/net-analyzer/nagios-core/nagios-core-3.5.1.ebuild new file mode 100644 index 00000000..a6e24f3 --- /dev/null +++ b/net-analyzer/nagios-core/nagios-core-3.5.1.ebuild @@ -0,0 +1,217 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Id$ + +EAPI=5 + +inherit depend.apache eutils multilib toolchain-funcs user + +MY_P=${PN/-core}-${PV} +DESCRIPTION="Nagios Core - Check daemon, CGIs, docs" +HOMEPAGE="http://www.nagios.org/" +SRC_URI="mirror://sourceforge/nagios/${MY_P}.tar.gz" + +LICENSE="GPL-2" +SLOT="0" +KEYWORDS="alpha amd64 ~arm ~arm64 hppa ppc ppc64 sparc x86" +IUSE="debug lighttpd perl +web vim-syntax" +DEPEND="virtual/mailx + web? ( + >=media-libs/gd-1.8.3-r5[jpeg,png] + lighttpd? ( www-servers/lighttpd dev-lang/php[cgi] ) + apache2? ( || ( dev-lang/php[apache2] dev-lang/php[cgi] ) ) + ) + perl? ( >=dev-lang/perl-5.6.1-r7:= )" +RDEPEND="${DEPEND} + !net-analyzer/nagios-imagepack + vim-syntax? ( app-vim/nagios-syntax )" + +want_apache2 + +S="${WORKDIR}/${PN/-core}" + +pkg_setup() { + depend.apache_pkg_setup + + enewgroup nagios + enewuser nagios -1 /bin/bash /var/nagios/home nagios +} + +src_prepare() { + epatch "${FILESDIR}/${PN}-3.5.1-process_cgivars.patch" + local strip="$(echo '$(MAKE) strip-post-install')" + sed -i -e "s:${strip}::" {cgi,base}/Makefile.in || die "sed failed in Makefile.in" +} + +src_configure() { + local myconf + + if use perl ; then + myconf="${myconf} --enable-embedded-perl --with-perlcache" + fi + + if use debug; then + myconf="${myconf} --enable-DEBUG0" + myconf="${myconf} --enable-DEBUG1" + myconf="${myconf} --enable-DEBUG2" + myconf="${myconf} --enable-DEBUG3" + myconf="${myconf} --enable-DEBUG4" + myconf="${myconf} --enable-DEBUG5" + fi + + if use !apache2 && use !lighttpd ; then + myconf="${myconf} --with-command-group=nagios" + else + if use apache2 ; then + myconf="${myconf} --with-command-group=apache" + myconf="${myconf} --with-httpd-conf=/etc/apache2/conf.d" + elif use lighttpd ; then + myconf="${myconf} --with-command-group=lighttpd" + fi + fi + + econf ${myconf} \ + --prefix=/usr \ + --bindir=/usr/sbin \ + --sbindir=/usr/$(get_libdir)/nagios/cgi-bin \ + --datadir=/usr/share/nagios/htdocs \ + --localstatedir=/var/nagios \ + --sysconfdir=/etc/nagios \ + --libexecdir=/usr/$(get_libdir)/nagios/plugins +} + +src_compile() { + emake CC=$(tc-getCC) nagios + + if use web ; then + # Only compile the CGI's if "web" useflag is set. + emake CC=$(tc-getCC) DESTDIR="${D}" cgis + fi +} + +src_install() { + dodoc Changelog INSTALLING LEGAL README UPGRADING + + if ! use web ; then + sed -i -e 's/cd $(SRC_CGI) && $(MAKE) $@/# line removed due missing web use flag/' \ + -e 's/cd $(SRC_HTM) && $(MAKE) $@/# line removed due missing web use flag/' \ + -e 's/$(MAKE) install-exfoliation/# line removed due missing web use flag/' \ + Makefile + fi + + sed -i -e 's/^contactgroups$//g' Makefile + + emake DESTDIR="${D}" install + emake DESTDIR="${D}" install-config + emake DESTDIR="${D}" install-commandmode + if use web; then + emake DESTDIR="${D}" install-classicui + fi + + newinitd "${FILESDIR}"/nagios3 nagios + newconfd "${FILESDIR}"/conf.d nagios + + # Apache Module + if use web ; then + if use apache2 ; then + insinto "${APACHE_MODULES_CONFDIR}" + doins "${FILESDIR}"/99_nagios3.conf + elif use lighttpd ; then + insinto /etc/lighttpd + newins "${FILESDIR}/lighttpd_nagios3-r1.conf" nagios.conf + else + ewarn "${CATEGORY}/${PF} only supports Apache-2.x or Lighttpd webserver" + ewarn "out-of-the-box. Since you are not using one of them, you" + ewarn "have to configure your webserver accordingly yourself." + fi + + fi + + for dir in etc/nagios var/nagios ; do + chown -R nagios:nagios "${D}/${dir}" || die "Failed chown of ${D}/${dir}" + done + + dosbin p1.pl + + chown -R root:root "${D}"/usr/$(get_libdir)/nagios + find "${D}"/usr/$(get_libdir)/nagios -type d -print0 | xargs -0 chmod 755 + find "${D}"/usr/$(get_libdir)/nagios/cgi-bin -type f -print0 | xargs -0 chmod 755 + + keepdir /etc/nagios + keepdir /var/nagios + keepdir /var/nagios/archives + keepdir /var/nagios/rw + keepdir /var/nagios/spool/checkresults + + if use !apache2 && use !lighttpd; then + chown -R nagios:nagios "${D}"/var/nagios/rw || die "Failed chown of ${D}/var/nagios/rw" + else + if use apache2 ; then + chown -R nagios:apache "${D}"/var/nagios/rw || die "Failed chown of ${D}/var/nagios/rw" + elif use lighttpd ; then + chown -R nagios:lighttpd "${D}"/var/nagios/rw || die "Failed chown of ${D}/var/nagios/rw" + fi + fi + + chmod ug+s "${D}"/var/nagios/rw || die "Failed Chmod of ${D}/var/nagios/rw" + chmod 0750 "${D}"/etc/nagios || die "Failed chmod of ${D}/etc/nagios" +} + +pkg_postinst() { + elog "If you want nagios to start at boot time" + elog "remember to execute:" + elog " rc-update add nagios default" + elog + + if use web ; then + elog "This does not include cgis that are perl-dependent" + elog "Currently traceroute.cgi is perl-dependent" + elog "To have ministatus.cgi requires copying of ministatus.c" + elog "to cgi directory for compiling." + + elog "Note that the user your webserver is running at needs" + elog "read-access to /etc/nagios." + elog + + if use apache2 || use lighttpd ; then + elog "There are several possible solutions to accomplish this," + elog "choose the one you are most comfortable with:" + elog + if use apache2 ; then + elog " usermod -G nagios apache" + elog "or" + elog " chown nagios:apache /etc/nagios" + elog + elog "Also edit /etc/conf.d/apache2 and add \"-D NAGIOS\"" + elif use lighttpd ; then + elog " usermod -G nagios lighttpd " + elog "or" + elog " chown nagios:lighttpd /etc/nagios" + fi + elog + elog "That will make nagios's web front end visable via" + elog "http://localhost/nagios/" + elog + else + elog "IMPORTANT: Do not forget to add the user your webserver" + elog "is running as to the nagios group!" + fi + + else + elog "Please note that you have installed Nagios without web interface." + elog "Please don't file any bugs about having no web interface when you do this." + elog "Thank you!" + fi + + elog + elog "If your kernel has /proc protection, nagios" + elog "will not be happy as it relies on accessing the proc" + elog "filesystem. You can fix this by adding nagios into" + elog "the group wheel, but this is not recomended." + elog +} + +pkg_postinst() { + einfo "Fixing permissions" + chown nagios:nagios "${ROOT}"var/nagios +}