diff --git a/security/openvas/Makefile b/security/openvas/Makefile index 8786d9135330..de63c8d92032 100644 --- a/security/openvas/Makefile +++ b/security/openvas/Makefile @@ -1,41 +1,44 @@ PORTNAME= openvas -DISTVERSION= 21.4.4 +DISTVERSION= 22.4.0 DISTVERSIONPREFIX= v CATEGORIES= security MAINTAINER= acm@FreeBSD.org COMMENT= Open vulnerability assessment scanner LICENSE= GPLv2+ BUILD_DEPENDS= flex:textproc/flex LIB_DEPENDS= libgvm_base.so:security/gvm-libs \ libgcrypt.so:security/libgcrypt \ libpcap.so.1:net/libpcap \ libksba.so:security/libksba \ libgpgme.so:security/gpgme \ libssh.so:security/libssh \ libgnutls.so:security/gnutls \ libnetsnmp.so:net-mgmt/net-snmp RUN_DEPENDS= redis-server:databases/redis \ snmpget:net-mgmt/net-snmp \ rsync:net/rsync \ nmap:security/nmap \ ${PYTHON_PKGNAMEPREFIX}impacket>=0:net/py-impacket@${PY_FLAVOR} USE_GITHUB= yes GH_ACCOUNT= greenbone GH_PROJECT= ${PORTNAME}-scanner USES= bison cmake gnome pkgconfig python:3.5+ USE_GNOME= glib20 USERS= gvm GROUPS= ${USERS} post-patch: @${REINPLACE_CMD} -e 's|g_pattern_match_string|g_pattern_spec_match_string|g' ${WRKSRC}/misc/strutils.c + @${REINPLACE_CMD} -e 's|-Wunused-but-set-variable|-Wunused-variable|g' ${WRKSRC}/nasl/nasl_grammar.y + @${REINPLACE_CMD} -e 's|#include ||g' ${WRKSRC}/src/attack.c ${WRKSRC}/src/nasl_plugins.c + @${REINPLACE_CMD} -e 's|#include |#include |g' ${WRKSRC}//src/pluginload.c post-install: @${MKDIR} ${STAGEDIR}/var/run/ospd .include diff --git a/security/openvas/distinfo b/security/openvas/distinfo index 3e1a580b3e4a..b3485668aca5 100644 --- a/security/openvas/distinfo +++ b/security/openvas/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1646618189 -SHA256 (greenbone-openvas-scanner-v21.4.4_GH0.tar.gz) = 94af7113c8f16754eebf0a7e26c231586e3c2b70342d818d20cf24be4f40c578 -SIZE (greenbone-openvas-scanner-v21.4.4_GH0.tar.gz) = 460601 +TIMESTAMP = 1659314127 +SHA256 (greenbone-openvas-scanner-v22.4.0_GH0.tar.gz) = 232a64206f2ce17633ea16951b91d5d8743b174afd521f6318961353aadf8268 +SIZE (greenbone-openvas-scanner-v22.4.0_GH0.tar.gz) = 478488 diff --git a/security/openvas/files/patch-nasl_nasl_frame_forgery.c b/security/openvas/files/patch-nasl_nasl_frame_forgery.c index 51d880b7f29e..19f03c3450b8 100644 --- a/security/openvas/files/patch-nasl_nasl_frame_forgery.c +++ b/security/openvas/files/patch-nasl_nasl_frame_forgery.c @@ -1,209 +1,209 @@ --- nasl/nasl_frame_forgery.c 2022-04-12 18:39:11.965973000 -0500 +++ nasl/nasl_frame_forgery.c 2022-04-12 22:42:28.026027000 -0500 @@ -33,12 +33,17 @@ #include #include +#if defined(linux) #include +#include +#endif #include #include #include -#include +#include #include +#include +#include #include #include #include @@ -51,6 +56,13 @@ */ #define G_LOG_DOMAIN "lib misc" +#if defined(__FreeBSD__) +#define ETH_ALEN ETHER_ADDR_LEN +#define ETH_P_ARP ETHERTYPE_ARP +#define ETH_P_ALL 0x0003 +#define ETH_HLEN ETHER_HDR_LEN +#endif + struct pseudo_eth_arp { struct arphdr arp_header; @@ -63,7 +75,11 @@ struct pseudo_frame { +#if defined(__FreeBSD__) + struct ether_header framehdr; +#else struct ethhdr framehdr; +#endif u_char *payload; } __attribute__ ((packed)); @@ -95,7 +111,23 @@ * @param[in] ifindex The interface index to be use for capturing. * @param[in] ether_dst_addr The dst MAC address. */ + +#if defined(__FreeBSD__) static void +prepare_sockaddr_ll (struct sockaddr_dl *addr, int ifindex, + const u_char *ether_dst_addr) +{ + struct sockaddr_dl *sdl = (struct sockaddr_dl *)addr; + + sdl->sdl_family = AF_LINK; + sdl->sdl_index = ifindex; + sdl->sdl_alen = ETHER_ADDR_LEN; -+ sdl->sdl_type = htons (ETH_P_ALL); ++ sdl->sdl_type = ETH_P_ALL; + + memcpy (sdl->sdl_data + sdl->sdl_nlen, ether_dst_addr, ETHER_ADDR_LEN); +} +#else +static void prepare_sockaddr_ll (struct sockaddr_ll *soc_addr_ll, int ifindex, const u_char *ether_dst_addr) { @@ -105,6 +137,7 @@ soc_addr_ll->sll_protocol = htons (ETH_P_ALL); memcpy (soc_addr_ll->sll_addr, ether_dst_addr, ETHER_ADDR_LEN); } +#endif /** @brief Prepare message header to be sent with sendmsg(). * @@ -113,6 +146,7 @@ * @param[in] payload The payload, a datalink layer frame with payload * @param[in] payload_sz The payload size. */ +#if !defined(__FreeBSD__) static void prepare_message (u_char *msg, struct sockaddr_ll *soc_addr_ll, u_char *payload, int payload_sz) @@ -135,7 +169,31 @@ memcpy (msg, (u_char *) message, sizeof (struct msghdr) + payload_sz); g_free (message); } +#else +static void +prepare_message (u_char *msg, struct sockaddr_dl *soc_addr_dl, u_char *payload, + int payload_sz) +{ + struct iovec iov; + struct msghdr *message; + iov.iov_base = payload; + iov.iov_len = payload_sz; + + message = g_malloc0 (sizeof (struct msghdr) + payload_sz); + + message->msg_name = soc_addr_dl; + message->msg_namelen = sizeof (struct sockaddr_dl); + message->msg_iov = &iov; + message->msg_iovlen = 1; + message->msg_control = 0; + message->msg_controllen = 0; + + memcpy (msg, (u_char *) message, sizeof (struct msghdr) + payload_sz); + g_free (message); +} +#endif + /** @brief Send a frame and listen to the answer * * @param[in]frame The frame to be sent. @@ -163,7 +221,11 @@ int answer_sz = -1; // Create the raw socket +#if defined(__FreeBSD__) + soc = socket (AF_INET, SOCK_RAW, htons (ETH_P_ALL)); +#else soc = socket (AF_PACKET, SOCK_RAW, htons (ETH_P_ALL)); +#endif if (soc == -1) { g_debug ("%s: %s", __func__, strerror (errno)); @@ -181,8 +243,12 @@ u_char dst_haddr[ETHER_ADDR_LEN]; memcpy (&dst_haddr, (struct pseudo_frame *) frame, ETHER_ADDR_LEN); +#if defined(__FreeBSD__) + struct sockaddr_dl soc_addr; +#else struct sockaddr_ll soc_addr; - memset (&soc_addr, '\0', sizeof (struct sockaddr_ll)); +#endif + memset (&soc_addr, '\0', sizeof (struct sockaddr_dl)); prepare_sockaddr_ll (&soc_addr, ifindex, dst_haddr); /* Init capture */ @@ -193,7 +259,7 @@ struct in_addr sin, this_host; memset (&sin, '\0', sizeof (struct in_addr)); memset (&this_host, '\0', sizeof (struct in_addr)); - sin.s_addr = ipaddr->s6_addr32[3]; + sin.s_addr = ipaddr->s6_addr[12]; bpf = init_capture_device (sin, this_host, filter); } else @@ -249,10 +315,15 @@ *frame = (struct pseudo_frame *) g_malloc0 (sizeof (struct pseudo_frame) + payload_sz); - +#if defined(__FreeBSD__) + memcpy ((*frame)->framehdr.ether_dhost, ether_dst_addr, ETHER_ADDR_LEN); + memcpy ((*frame)->framehdr.ether_shost, ether_src_addr, ETHER_ADDR_LEN); + (*frame)->framehdr.ether_type = htons (ether_proto); +#else memcpy ((*frame)->framehdr.h_dest, ether_dst_addr, ETHER_ADDR_LEN); memcpy ((*frame)->framehdr.h_source, ether_src_addr, ETHER_ADDR_LEN); (*frame)->framehdr.h_proto = htons (ether_proto); +#endif (*frame)->payload = payload; frame_sz = ETH_HLEN + payload_sz; @@ -416,21 +487,24 @@ strncpy (ifr.ifr_name, if_name, sizeof (ifr.ifr_name) - 1); g_free (if_name); ifr.ifr_name[sizeof (ifr.ifr_name) - 1] = '\0'; - +#if defined(__FreeBSD__) + sock = socket(AF_INET, SOCK_DGRAM, 0); +#else sock = socket (PF_INET, SOCK_STREAM, 0); +#endif if (-1 == sock) { perror ("socket() "); return -1; } - if (-1 == ioctl (sock, SIOCGIFHWADDR, &ifr)) + if (-1 == ioctl (sock, SIOCGIFCONF, &ifr)) { - g_debug ("%s: ioctl(SIOCGIFHWADDR)", __func__); + g_debug ("%s: ioctl(SIOCGIFCONF)", __func__); return -1; } - memcpy (mac, (u_char *) ifr.ifr_hwaddr.sa_data, ETHER_ADDR_LEN); + memcpy (mac, (u_char *) ifr.ifr_data, ETHER_ADDR_LEN); close (sock); return 0; @@ -504,7 +578,7 @@ return retc; memset (&dst_inaddr, '\0', sizeof (struct in_addr)); - dst_inaddr.s_addr = dst->s6_addr32[3]; + dst_inaddr.s_addr = dst->s6_addr[12]; routethrough (&dst_inaddr, &src_inaddr); ipv4_as_ipv6 (&src_inaddr, &src); diff --git a/security/openvas/files/patch-src_CMakeLists.txt b/security/openvas/files/patch-src_CMakeLists.txt index a16cfea800e4..054b24b3335d 100644 --- a/security/openvas/files/patch-src_CMakeLists.txt +++ b/security/openvas/files/patch-src_CMakeLists.txt @@ -1,13 +1,23 @@ ---- src/CMakeLists.txt 2020-08-11 07:00:25.000000000 -0500 -+++ src/CMakeLists.txt 2021-01-04 19:20:27.629700000 -0500 -@@ -228,8 +228,8 @@ +--- src/CMakeLists.txt 2022-07-18 04:07:38.000000000 -0500 ++++ sc/CMakeLists.txt 2022-07-31 19:53:15.521197000 -0500 +@@ -30,7 +30,9 @@ + pkg_check_modules (LIBGVM_BOREAS REQUIRED libgvm_boreas>=22.4) + pkg_check_modules (LIBGVM_UTIL REQUIRED libgvm_util>=22.4) + pkg_check_modules (GLIB REQUIRED glib-2.0>=2.42) ++if (NOT ${CMAKE_SYSTEM_NAME} MATCHES "FreeBSD") + pkg_check_modules (LIBBSD REQUIRED libbsd) ++endif() + + message (STATUS "Looking for libgcrypt...") + find_library (GCRYPT gcrypt) +@@ -230,8 +232,8 @@ PERMISSIONS OWNER_EXECUTE OWNER_READ OWNER_WRITE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE) -install (FILES ${CMAKE_BINARY_DIR}/src/openvas_log.conf - DESTINATION ${OPENVAS_SYSCONF_DIR}) +install (FILES ${CMAKE_BINARY_DIR}/src/openvas_log.conf.sample + DESTINATION "${OPENVAS_SYSCONF_DIR}") install (FILES ${CMAKE_BINARY_DIR}/tools/greenbone-nvt-sync DESTINATION ${BINDIR} diff --git a/security/openvas/files/patch-src_main.c b/security/openvas/files/patch-src_main.c new file mode 100644 index 000000000000..0e0411d8035a --- /dev/null +++ b/security/openvas/files/patch-src_main.c @@ -0,0 +1,16 @@ +--- src/main.c 2022-07-18 04:07:38.000000000 -0500 ++++ src/main.c 2022-07-31 21:37:38.265241000 -0500 +@@ -35,7 +35,13 @@ + * @return EXIT_SUCCESS on success, EXIT_FAILURE on failure. + */ + int ++#if defined(__FreeBSD__) ++main (int argc, char **argv) ++{ ++ return openvas (argc, argv); ++#else + main (int argc, char **argv, char *env[]) + { + return openvas (argc, argv, env); ++#endif + } diff --git a/security/openvas/files/patch-src_openvas.c b/security/openvas/files/patch-src_openvas.c new file mode 100644 index 000000000000..cf3bb71d8026 --- /dev/null +++ b/security/openvas/files/patch-src_openvas.c @@ -0,0 +1,31 @@ +--- src/openvas.c 2022-07-31 21:26:36.888737000 -0500 ++++ src/openvas.c 2022-07-31 21:28:05.607778000 -0500 +@@ -44,7 +44,7 @@ + #include "sighand.h" /* for openvas_signal */ + #include "utils.h" /* for store_file */ + +-#include /* for proctitle_init */ ++#include /* for proctitle_init */ + #include /* for errno() */ + #include /* for open() */ + #include /* for gcry_control */ +@@ -468,11 +468,19 @@ + * @param argv Argument vector. + */ + int ++#if defined(__FreeBSD__) ++openvas (int argc, char *argv[]) ++ ++{ ++ int err; ++#else + openvas (int argc, char *argv[], char *env[]) ++ + { + int err; + + setproctitle_init (argc, argv, env); ++#endif + gcrypt_init (); + + static gboolean display_version = FALSE; diff --git a/security/openvas/files/patch-src_openvas.h b/security/openvas/files/patch-src_openvas.h new file mode 100644 index 000000000000..f385cb98afee --- /dev/null +++ b/security/openvas/files/patch-src_openvas.h @@ -0,0 +1,13 @@ +--- src/openvas.h 2022-07-31 21:28:34.160685000 -0500 ++++ src/openvas.h 2022-07-31 21:29:05.831561000 -0500 +@@ -26,6 +26,10 @@ + #define _OPENVAS_H + + int ++#if defined(__FreeBSD__) ++openvas (int, char **); ++#else + openvas (int, char **, char **); ++#endif + + #endif /* not _OPENVAS_H */ diff --git a/security/openvas/files/patch-src_pluginscheduler.c b/security/openvas/files/patch-src_pluginscheduler.c index 839bbd874c93..16335ac743a7 100644 --- a/security/openvas/files/patch-src_pluginscheduler.c +++ b/security/openvas/files/patch-src_pluginscheduler.c @@ -1,29 +1,14 @@ ---- src/pluginscheduler.c 2020-08-11 07:00:25.000000000 -0500 -+++ src/pluginscheduler.c 2021-01-04 18:10:12.943469000 -0500 -@@ -33,7 +33,7 @@ +--- src/pluginscheduler.c 2022-07-18 04:07:38.000000000 -0500 ++++ src/pluginscheduler.c 2022-07-31 19:38:07.076865000 -0500 +@@ -33,7 +33,11 @@ #include #include /* for prefs_get() */ #include /* for nvticache_t */ --#include ++#include ++#if !defined(__FreeBSD__) + #include ++#endif +#include #include /* for strcmp() */ #undef G_LOG_DOMAIN -@@ -325,7 +325,7 @@ - plugins_scheduler_free (ret); - return NULL; - } -- malloc_trim (0); -+// malloc_trim (0); - return ret; - } - -@@ -427,7 +427,7 @@ - element = element->next; - } - } -- malloc_trim (0); -+// malloc_trim (0); - } - - struct scheduler_plugin * diff --git a/security/openvas/files/patch-src_sighand.c b/security/openvas/files/patch-src_sighand.c deleted file mode 100644 index 724185542aa7..000000000000 --- a/security/openvas/files/patch-src_sighand.c +++ /dev/null @@ -1,11 +0,0 @@ ---- src/sighand.c 2022-05-19 23:34:53.324417000 -0500 -+++ src/sighand.c 2022-05-19 23:35:02.138680000 -0500 -@@ -119,7 +119,7 @@ - strings = backtrace_symbols (array, ret); - g_warning ("%s", message); - -- for (left = 0; left < 10; left++) -+ for (left = 0; left < ret; left++) - g_warning ("%s\n", strings[left]); - - g_free (strings); diff --git a/security/openvas/files/patch-tools_greenbone-nvt-sync.in b/security/openvas/files/patch-tools_greenbone-nvt-sync.in index a2a18e9668e6..3ea8874e455d 100644 --- a/security/openvas/files/patch-tools_greenbone-nvt-sync.in +++ b/security/openvas/files/patch-tools_greenbone-nvt-sync.in @@ -1,55 +1,33 @@ ---- tools/greenbone-nvt-sync.in 2021-04-15 09:39:00.000000000 -0500 -+++ tools/greenbone-nvt-sync.in 2021-06-15 16:41:18.698165000 -0500 -@@ -87,10 +87,10 @@ - LOG_CMD="logger -t $SCRIPT_NAME" +--- tools/greenbone-nvt-sync.in 2022-07-18 04:07:38.000000000 -0500 ++++ tools/greenbone-nvt-sync.in 2022-07-31 19:51:15.176021000 -0500 +@@ -98,10 +98,10 @@ + [ -z "$RSYNC_DOMAIN" ] && RSYNC_DOMAIN=feed.community.greenbone.net check_logger () { - logger --socket-error=on -p daemon.info -t $SCRIPT_NAME "Checking logger" --no-act 1>/dev/null 2>&1 -+ logger -p daemon.info -t $SCRIPT_NAME "Checking logger" 1>/dev/null 2>&1 ++ logger -p daemon.info -t $SCRIPT_NAME "Checking logger" 1>/dev/null 2>&1 if [ $? -gt 0 ] then - LOG_CMD="logger --socket-error=off -s -t $SCRIPT_NAME" + LOG_CMD="logger -s -t $SCRIPT_NAME" $LOG_CMD -p daemon.warning "The log facility is not working as expected. All messages will be written to the standard error stream." fi } -@@ -202,7 +202,7 @@ - SYNC_TMP_DIR=/tmp - # If we have mktemp, create a temporary dir (safer) - if [ -n "`which mktemp`" ]; then -- SYNC_TMP_DIR=`mktemp -t -d greenbone-nvt-sync.XXXXXXXXXX` || { echo "ERROR: Cannot create temporary directory for file download" >&2; exit 1 ; } -+ SYNC_TMP_DIR=`mktemp -d /tmp/greenbone-nvt-sync.XXXXXXXXXX` || { echo "ERROR: Cannot create temporary directory for file download" >&2; exit 1 ; } - trap "rm -rf $SYNC_TMP_DIR" EXIT HUP INT TRAP TERM - fi - else -@@ -437,7 +437,7 @@ +@@ -448,7 +448,7 @@ log_err "rsync failed, aborting synchronization." exit 1 fi -- eval "cd \"$NVT_DIR\" ; md5sum -c --status \"$NVT_DIR/md5sums\"" -+ eval "cd \"$NVT_DIR\" ; xargs -n 2 md5 -c < \"$NVT_DIR/md5sums\" > /dev/null" +- eval "cd \"$NVT_DIR\" ; sha256sum -c --status \"$NVT_DIR/sha256sums\"" ++ eval "cd \"$NVT_DIR\" ; xargs -n 2 sha256sum -c < \"$NVT_DIR/sha256sums\" > /dev/null" if [ $? -ne 0 ] ; then if [ -n "$retried" ] then -@@ -471,10 +471,10 @@ - - do_self_test () - { -- MD5SUM_AVAIL=`command -v md5sum` -+ MD5SUM_AVAIL=`command -v md5` - if [ $? -ne 0 ] ; then - SELFTEST_FAIL=1 -- stderr_write "The md5sum binary could not be found." -+ stderr_write "The md5 binary could not be found." - fi - - RSYNC_AVAIL=`command -v rsync` -@@ -512,7 +512,7 @@ +@@ -523,7 +523,7 @@ log_write "Feed is already current, skipping synchronization." else ( - chmod +660 $OPENVAS_FEED_LOCK_PATH + chmod 660 $OPENVAS_FEED_LOCK_PATH flock -n 9 if [ $? -eq 1 ] ; then log_warning "Another process related to the feed update is already running" diff --git a/security/openvas/pkg-plist b/security/openvas/pkg-plist index 26895d331121..8ac19bef60b4 100644 --- a/security/openvas/pkg-plist +++ b/security/openvas/pkg-plist @@ -1,23 +1,23 @@ bin/greenbone-nvt-sync bin/openvas-nasl bin/openvas-nasl-lint @sample %%ETCDIR%%/openvas_log.conf.sample lib/libopenvas_misc.so -lib/libopenvas_misc.so.21 -lib/libopenvas_misc.so.21.4.4 +lib/libopenvas_misc.so.22 +lib/libopenvas_misc.so.22.4.0 lib/libopenvas_nasl.so -lib/libopenvas_nasl.so.21 -lib/libopenvas_nasl.so.21.4.4 +lib/libopenvas_nasl.so.22 +lib/libopenvas_nasl.so.22.4.0 sbin/openvas share/man/man1/openvas-nasl-lint.1.gz share/man/man1/openvas-nasl.1.gz share/man/man8/greenbone-nvt-sync.8.gz share/man/man8/openvas.8.gz @dir %%ETCDIR%%/gnupg @dir %%DATADIR%% @dir /var/lib @dir(gvm,gvm,750) /var/lib/openvas/gnupg @dir(gvm,gvm,750) /var/lib/openvas/plugins @dir(gvm,gvm,750) /var/lib/openvas @dir(gvm,gvm,750) /var/log/gvm @dir(gvm,gvm,750) /var/run/ospd