From 0881f01c5b1f1e7fd613b36880f89b379879b856 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Wed, 30 Mar 2022 20:39:03 +0200 Subject: [PATCH 1/4] dhcp: 4.4.2-P1 -> 4.4.3 https://downloads.isc.org/isc/dhcp/4.4.3/dhcp-4.4.3-RELNOTES --- pkgs/tools/networking/dhcp/default.nix | 18 ++---------------- 1 file changed, 2 insertions(+), 16 deletions(-) diff --git a/pkgs/tools/networking/dhcp/default.nix b/pkgs/tools/networking/dhcp/default.nix index 10418d978105..b2d33d0fe3ee 100644 --- a/pkgs/tools/networking/dhcp/default.nix +++ b/pkgs/tools/networking/dhcp/default.nix @@ -5,11 +5,11 @@ stdenv.mkDerivation rec { pname = "dhcp"; - version = "4.4.2-P1"; + version = "4.4.3"; src = fetchurl { url = "https://ftp.isc.org/isc/dhcp/${version}/${pname}-${version}.tar.gz"; - sha256 = "06jsr0cg5rsmyibshrpcb9za0qgwvqccashdma7mlm1rflrh8pmh"; + sha256 = "sha256-Dj7GtMKgXsAUiHS82ZmmbQVRg3jXdCH2B/sLydATWBg="; }; patches = @@ -18,20 +18,6 @@ stdenv.mkDerivation rec { # patch, the hostname doesn't get set properly if the old # hostname (i.e. before reboot) is equal to the new hostname. ./set-hostname.patch - - (fetchpatch { - # upstream build fix against -fno-common compilers like >=gcc-10 - url = "https://gitlab.isc.org/isc-projects/dhcp/-/commit/6c7e61578b1b449272dbb40dd8b98d03dad8a57a.patch"; - sha256 = "1g37ix0yf9zza8ri8bg438ygcjviniblfyb20y4gzc8lysy28m8b"; - }) - - # Fix parallel build failure, the patch is pending upstream inclusion: - # https://gitlab.isc.org/isc-projects/dhcp/-/merge_requests/76 - (fetchpatch { - name = "parallel-make.patch"; - url = "https://gitlab.isc.org/isc-projects/dhcp/-/commit/46d101b97c5a3b19a3f63f7b60e5f88994a64e22.patch"; - sha256 = "1y3nsmqjzcg4bhp1xmqp47v7rkl3bpcildkx6mlrg255yvxapmdp"; - }) ]; nativeBuildInputs = [ perl makeWrapper ]; From a2c379d4b6df39bb5a0355bb4bb68cc3f75f4cc7 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Wed, 30 Mar 2022 20:39:55 +0200 Subject: [PATCH 2/4] dhcp: make client and relay component optional and mark the package with knownVulnerabilities when they are enabled. Closes: #163472 --- pkgs/tools/networking/dhcp/default.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/pkgs/tools/networking/dhcp/default.nix b/pkgs/tools/networking/dhcp/default.nix index b2d33d0fe3ee..1d1a01d17cfa 100644 --- a/pkgs/tools/networking/dhcp/default.nix +++ b/pkgs/tools/networking/dhcp/default.nix @@ -1,6 +1,10 @@ { stdenv, fetchurl, fetchpatch, perl, file, nettools, iputils, iproute2, makeWrapper , coreutils, gnused, openldap ? null , buildPackages, lib + +# client and relay are end of life, remove after 4.4.3 +, withClient ? false +, withRelay ? false }: stdenv.mkDerivation rec { @@ -63,6 +67,10 @@ stdenv.mkDerivation rec { --replace /sbin/ip ${iproute2}/sbin/ip wrapProgram "$out/sbin/dhclient-script" --prefix PATH : \ "${nettools}/bin:${nettools}/sbin:${iputils}/bin:${coreutils}/bin:${gnused}/bin" + '' + lib.optionalString (!withClient) '' + rm $out/sbin/{dhclient,dhclient-script,.dhclient-script-wrapped} + '' + lib.optionalString (!withRelay) '' + rm $out/sbin/dhcrelay ''; preConfigure = @@ -89,5 +97,6 @@ stdenv.mkDerivation rec { homepage = "https://www.isc.org/dhcp/"; license = licenses.mpl20; platforms = platforms.unix; + knownVulnerabilities = lib.optional (withClient || withRelay) "The client and relay component of the dhcp package have reached their end of life"; }; } From a31f123c1cb68e107f54d1a54500de6ba8b9b0ef Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Wed, 30 Mar 2022 20:43:16 +0200 Subject: [PATCH 3/4] networkmanager: remove dhcp and pass dhcpcd instead The ISC DHCP client has reached its end of life. --- nixos/modules/services/networking/networkmanager.nix | 3 +-- pkgs/tools/networking/networkmanager/default.nix | 8 ++++---- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/nixos/modules/services/networking/networkmanager.nix b/nixos/modules/services/networking/networkmanager.nix index 7a9d9e5428a7..f14eea50ada7 100644 --- a/nixos/modules/services/networking/networkmanager.nix +++ b/nixos/modules/services/networking/networkmanager.nix @@ -237,7 +237,7 @@ in { }; dhcp = mkOption { - type = types.enum [ "dhclient" "dhcpcd" "internal" ]; + type = types.enum [ "dhcpcd" "internal" ]; default = "internal"; description = '' Which program (or internal library) should be used for DHCP. @@ -497,7 +497,6 @@ in { "d /etc/ipsec.d 0700 root root -" "d /var/lib/NetworkManager-fortisslvpn 0700 root root -" - "d /var/lib/dhclient 0755 root root -" "d /var/lib/misc 0755 root root -" # for dnsmasq.leases ]; diff --git a/pkgs/tools/networking/networkmanager/default.nix b/pkgs/tools/networking/networkmanager/default.nix index 2c984da87377..86195ba86923 100644 --- a/pkgs/tools/networking/networkmanager/default.nix +++ b/pkgs/tools/networking/networkmanager/default.nix @@ -12,7 +12,7 @@ , polkit , gnutls , ppp -, dhcp +, dhcpcd , iptables , nftables , python3 @@ -96,9 +96,9 @@ stdenv.mkDerivation rec { "-Dresolvconf=${openresolv}/bin/resolvconf" # DHCP clients - "-Ddhclient=${dhcp}/bin/dhclient" - # Upstream prefers dhclient, so don't add dhcpcd to the closure - "-Ddhcpcd=no" + # ISC DHCP client has reached it's end of life, so stop using it + "-Ddhclient=no" + "-Ddhcpcd=${dhcpcd}/bin/dhcpcd" "-Ddhcpcanon=no" # Miscellaneous From c6e3a81aea61b7e12560e1b346d285f90b70274d Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Wed, 30 Mar 2022 20:49:30 +0200 Subject: [PATCH 4/4] pipework: remove dhcp package Pipework can optionally use dhclient, but supports other dhcp clients as well, so we can safely remove it. --- pkgs/os-specific/linux/pipework/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/pipework/default.nix b/pkgs/os-specific/linux/pipework/default.nix index 33192392888a..ea274377ced9 100644 --- a/pkgs/os-specific/linux/pipework/default.nix +++ b/pkgs/os-specific/linux/pipework/default.nix @@ -1,5 +1,5 @@ { stdenv, lib, fetchFromGitHub, makeWrapper -, bridge-utils, iproute2, lxc, openvswitch, docker, busybox, dhcpcd, dhcp +, bridge-utils, iproute2, lxc, openvswitch, docker, busybox, dhcpcd }: stdenv.mkDerivation { @@ -15,7 +15,7 @@ stdenv.mkDerivation { installPhase = '' install -D pipework $out/bin/pipework wrapProgram $out/bin/pipework --prefix PATH : \ - ${lib.makeBinPath [ bridge-utils iproute2 lxc openvswitch docker busybox dhcpcd dhcp ]}; + ${lib.makeBinPath [ bridge-utils iproute2 lxc openvswitch docker busybox dhcpcd ]}; ''; meta = with lib; { description = "Software-Defined Networking tools for LXC";