net-analyzer/nagios-core: bring back the 3.x ebuild to save pnp4nagios.

I tried removing the old versions of nagios to address a CVE, but
net-analyzer/pnp4nagios on three arches requires nagios-3.x. I've
filed a keyword request for icinga (which can also satisfy the
dependency), and after those keywords are added and everything is
stabilized we can try this again.

Gentoo-Bug: 602216
Gentoo-Bug: 605724

Package-Manager: portage-2.3.0

6 files changed, 485 insertions, 0 deletions

diff --git a/net-analyzer/nagios-core/Manifest b/net-analyzer/nagios-core/Manifest
index 203f0f33615a..60c9c97f7e70 100644
--- a/net-analyzer/nagios-core/Manifest
+++ b/net-analyzer/nagios-core/Manifest
@@ -1,2 +1,3 @@
+DIST nagios-3.5.1.tar.gz 1763584 SHA256 ca9dd68234fa090b3c35ecc8767b2c9eb743977eaf32612fa9b8341cc00a0f99 SHA512 48e2ecb91002b08203937b12a438c87c62cd3c5c401a0ed9e861cd6d79074c7017ed373e9379f013d87dea1fd7cb8e3d85112d55c87ac91aed96b256868c112d WHIRLPOOL 2c02584702c64dbb0e353e34b758fab079eee0dc7a401e7b5947a21733758d3596401e5519e2dd7f05c89ee4835c21965d2718157fd9d6d3d20af9c853d688ca
 DIST nagios-4.2.4.tar.gz 11088206 SHA256 b0055c475683ce50d77b1536ff0cec9abf89139adecf771601fa021ef9a20b70 SHA512 1f060f3139db6f77f7ca218bb4befb631c08b0ccb1b2b85e4c06cfc94328b5d09cef9b547eb54617089334a1e36b881347dfbb98bcc88b9b38e878214f97883a WHIRLPOOL a3d5454c72ab38388e8071dca8a319c717bb22915cfd06243727eb33f7b8a93cc323531be1535d14e283335b9964762a2729f4605f76d9a01ff78bbe924053a7
 DIST nagios-core-gentoo-icons-20141125.tar 40960 SHA256 68b715f636eb291343cab3259862bbed8b6b898520b58df522438524de3d8761 SHA512 bf109879cddd6136b76baba55d0b60b2596e37431dcf5ce0905d34a9fa292ebf7e4bde82d9a084362c486e8fac344c76d88f9298b1b85541ed70ffd608493766 WHIRLPOOL 7ec3a944b2a659b456d3168818ca5b1af3a427436e6af2f3e5d6cba6fc7b1c7bad6f552301f064df31988865b3b32fd117d9e6f61c630d6d817a51cbbbcb331d
diff --git a/net-analyzer/nagios-core/files/99_nagios3.conf b/net-analyzer/nagios-core/files/99_nagios3.conf
new file mode 100644
index 000000000000..074f9ce5e4a9
--- /dev/null
+++ b/net-analyzer/nagios-core/files/99_nagios3.conf
@@ -0,0 +1,15 @@
+<IfDefine NAGIOS>
+	ScriptAlias /nagios/cgi-bin/ /usr/lib/nagios/cgi-bin/
+	<Directory "/usr/lib/nagios/cgi-bin/">
+		AllowOverride AuthConfig
+		Options ExecCGI
+		Order allow,deny
+		Allow from all
+	</Directory>
+	Alias /nagios /usr/share/nagios/htdocs
+	<Directory "/usr/share/nagios/htdocs">
+		AllowOverride AuthConfig
+		Order allow,deny
+		Allow from all
+	</Directory>
+</IfDefine>
diff --git a/net-analyzer/nagios-core/files/lighttpd_nagios3-r1.conf b/net-analyzer/nagios-core/files/lighttpd_nagios3-r1.conf
new file mode 100644
index 000000000000..6e2577029aca
--- /dev/null
+++ b/net-analyzer/nagios-core/files/lighttpd_nagios3-r1.conf
@@ -0,0 +1,24 @@
+server.modules += ("mod_cgi")
+server.modules += ("mod_auth")
+server.modules += ("mod_alias")
+
+auth.require += ( "/nagios" =>
+  (
+    "method"  => "digest",
+    "realm"   => "nagios",
+    "require" => "valid-user"
+  )
+)
+
+$HTTP["url"] =~ "^/nagios/cgi-bin/" {
+  dir-listing.activate = "disable"
+  cgi.assign = (
+    ".pl"  => "/usr/bin/perl",
+    ".cgi" => ""
+  )
+}
+
+alias.url += (
+  "/nagios/cgi-bin" => "/usr/lib/nagios/cgi-bin",
+  "/nagios"         => "/usr/share/nagios/htdocs"
+)
diff --git a/net-analyzer/nagios-core/files/nagios-core-3.5.1-process_cgivars.patch b/net-analyzer/nagios-core/files/nagios-core-3.5.1-process_cgivars.patch
new file mode 100644
index 000000000000..9d9536747794
--- /dev/null
+++ b/net-analyzer/nagios-core/files/nagios-core-3.5.1-process_cgivars.patch
@@ -0,0 +1,175 @@
+commit d97e03f32741a7d851826b03ed73ff4c9612a866
+Author: Eric Stanley <estanley@nagios.com>
+Date:   Fri Dec 20 13:14:30 2013 -0600
+
+    CGIs: Fixed minor vulnerability where a custom query could crash the CGI.
+    
+    Most CGIs previously incremented the input variable counter twice when
+    it encountered a long key value. This could cause the CGI to read past
+    the end of the list of CGI variables. This commit removes the second
+    increment, removing the possibility of reading past the end of the list
+    of CGI variables.
+
+diff --git a/cgi/avail.c b/cgi/avail.c
+index 76afd86..64eaadc 100644
+--- a/cgi/avail.c
++++ b/cgi/avail.c
+@@ -1096,7 +1096,6 @@ int process_cgivars(void) {
+ 
+ 		/* do some basic length checking on the variable identifier to prevent buffer overflows */
+ 		if(strlen(variables[x]) >= MAX_INPUT_BUFFER - 1) {
+-			x++;
+ 			continue;
+ 			}
+ 
+diff --git a/cgi/cmd.c b/cgi/cmd.c
+index fa6cf5a..50504eb 100644
+--- a/cgi/cmd.c
++++ b/cgi/cmd.c
+@@ -311,7 +311,6 @@ int process_cgivars(void) {
+ 
+ 		/* do some basic length checking on the variable identifier to prevent buffer overflows */
+ 		if(strlen(variables[x]) >= MAX_INPUT_BUFFER - 1) {
+-			x++;
+ 			continue;
+ 			}
+ 
+diff --git a/cgi/config.c b/cgi/config.c
+index f061b0f..3360e70 100644
+--- a/cgi/config.c
++++ b/cgi/config.c
+@@ -344,7 +344,6 @@ int process_cgivars(void) {
+ 
+ 		/* do some basic length checking on the variable identifier to prevent buffer overflows */
+ 		if(strlen(variables[x]) >= MAX_INPUT_BUFFER - 1) {
+-			x++;
+ 			continue;
+ 			}
+ 
+diff --git a/cgi/extinfo.c b/cgi/extinfo.c
+index 62a1b18..5113df4 100644
+--- a/cgi/extinfo.c
++++ b/cgi/extinfo.c
+@@ -591,7 +591,6 @@ int process_cgivars(void) {
+ 
+ 		/* do some basic length checking on the variable identifier to prevent buffer overflows */
+ 		if(strlen(variables[x]) >= MAX_INPUT_BUFFER - 1) {
+-			x++;
+ 			continue;
+ 			}
+ 
+diff --git a/cgi/histogram.c b/cgi/histogram.c
+index 4616541..f6934d0 100644
+--- a/cgi/histogram.c
++++ b/cgi/histogram.c
+@@ -1060,7 +1060,6 @@ int process_cgivars(void) {
+ 
+ 		/* do some basic length checking on the variable identifier to prevent buffer overflows */
+ 		if(strlen(variables[x]) >= MAX_INPUT_BUFFER - 1) {
+-			x++;
+ 			continue;
+ 			}
+ 
+diff --git a/cgi/notifications.c b/cgi/notifications.c
+index 8ba11c1..461ae84 100644
+--- a/cgi/notifications.c
++++ b/cgi/notifications.c
+@@ -327,7 +327,6 @@ int process_cgivars(void) {
+ 
+ 		/* do some basic length checking on the variable identifier to prevent buffer overflows */
+ 		if(strlen(variables[x]) >= MAX_INPUT_BUFFER - 1) {
+-			x++;
+ 			continue;
+ 			}
+ 
+diff --git a/cgi/outages.c b/cgi/outages.c
+index 426ede6..cb58dee 100644
+--- a/cgi/outages.c
++++ b/cgi/outages.c
+@@ -225,7 +225,6 @@ int process_cgivars(void) {
+ 
+ 		/* do some basic length checking on the variable identifier to prevent buffer overflows */
+ 		if(strlen(variables[x]) >= MAX_INPUT_BUFFER - 1) {
+-			x++;
+ 			continue;
+ 			}
+ 
+diff --git a/cgi/status.c b/cgi/status.c
+index 3253340..4ec1c92 100644
+--- a/cgi/status.c
++++ b/cgi/status.c
+@@ -567,7 +567,6 @@ int process_cgivars(void) {
+ 
+ 		/* do some basic length checking on the variable identifier to prevent buffer overflows */
+ 		if(strlen(variables[x]) >= MAX_INPUT_BUFFER - 1) {
+-			x++;
+ 			continue;
+ 			}
+ 
+diff --git a/cgi/statusmap.c b/cgi/statusmap.c
+index ea48368..2580ae5 100644
+--- a/cgi/statusmap.c
++++ b/cgi/statusmap.c
+@@ -400,7 +400,6 @@ int process_cgivars(void) {
+ 
+ 		/* do some basic length checking on the variable identifier to prevent buffer overflows */
+ 		if(strlen(variables[x]) >= MAX_INPUT_BUFFER - 1) {
+-			x++;
+ 			continue;
+ 			}
+ 
+diff --git a/cgi/statuswml.c b/cgi/statuswml.c
+index bd8cea2..d25abef 100644
+--- a/cgi/statuswml.c
++++ b/cgi/statuswml.c
+@@ -226,8 +226,13 @@ int process_cgivars(void) {
+ 
+ 	for(x = 0; variables[x] != NULL; x++) {
+ 
++		/* do some basic length checking on the variable identifier to prevent buffer overflows */
++		if(strlen(variables[x]) >= MAX_INPUT_BUFFER - 1) {
++			continue;
++			}
++
+ 		/* we found the hostgroup argument */
+-		if(!strcmp(variables[x], "hostgroup")) {
++		else if(!strcmp(variables[x], "hostgroup")) {
+ 			display_type = DISPLAY_HOSTGROUP;
+ 			x++;
+ 			if(variables[x] == NULL) {
+diff --git a/cgi/summary.c b/cgi/summary.c
+index 126ce5e..749a02c 100644
+--- a/cgi/summary.c
++++ b/cgi/summary.c
+@@ -725,7 +725,6 @@ int process_cgivars(void) {
+ 
+ 		/* do some basic length checking on the variable identifier to prevent buffer overflows */
+ 		if(strlen(variables[x]) >= MAX_INPUT_BUFFER - 1) {
+-			x++;
+ 			continue;
+ 			}
+ 
+diff --git a/cgi/trends.c b/cgi/trends.c
+index b35c18e..895db01 100644
+--- a/cgi/trends.c
++++ b/cgi/trends.c
+@@ -1263,7 +1263,6 @@ int process_cgivars(void) {
+ 
+ 		/* do some basic length checking on the variable identifier to prevent buffer overflows */
+ 		if(strlen(variables[x]) >= MAX_INPUT_BUFFER - 1) {
+-			x++;
+ 			continue;
+ 			}
+ 
+diff --git a/contrib/daemonchk.c b/contrib/daemonchk.c
+index 78716e5..9bb6c4b 100644
+--- a/contrib/daemonchk.c
++++ b/contrib/daemonchk.c
+@@ -174,7 +174,6 @@ static int process_cgivars(void) {
+ 
+ 		/* do some basic length checking on the variable identifier to prevent buffer overflows */
+ 		if(strlen(variables[x]) >= MAX_INPUT_BUFFER - 1) {
+-			x++;
+ 			continue;
+ 			}
+ 		}
diff --git a/net-analyzer/nagios-core/files/nagios3 b/net-analyzer/nagios-core/files/nagios3
new file mode 100644
index 000000000000..48b4f46eea3e
--- /dev/null
+++ b/net-analyzer/nagios-core/files/nagios3
@@ -0,0 +1,53 @@
+#!/sbin/openrc-run
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+extra_commands="checkconfig"
+extra_started_commands="reload"
+
+nagios_config="/etc/nagios/nagios.cfg"
+nagios_cmdfile="/var/nagios/rw/nagios.cmd"
+
+command="/usr/sbin/nagios"
+command_args="-d ${nagios_config}"
+pidfile="/var/nagios/nagios.lock"
+start_stop_daemon_args="-e HOME=/var/nagios/home"
+
+depend() {
+	need net
+	use dns logger firewall
+	after mysql postgresql
+}
+
+reload()
+{
+	checkconfig || return 1
+	ebegin "Reloading configuration"
+	start-stop-daemon --signal HUP --pidfile ${pidfile}
+	eend $?
+}
+
+checkconfig() {
+	ebegin "Verifying config files"
+
+	# Silent Check
+	/usr/sbin/nagios -v ${nagios_config} &>/dev/null && return 0
+
+	# Now we know there's problem - run again and display errors
+	/usr/sbin/nagios -v ${nagios_config}
+	eend $? "Configuration Error. Please fix your configfile"
+}
+
+start_pre() {
+	checkconfig || return 1
+
+	touch /var/nagios/nagios.log /var/nagios/status.sav
+	chown nagios:nagios /var/nagios/nagios.log /var/nagios/status.sav
+	rm -f ${nagios_cmdfile}
+}
+
+stop_post() {
+	rm -f /var/nagios/status.log /var/nagios/nagios.tmp ${pidfile} \
+		${nagios_cmdfile}
+}
diff --git a/net-analyzer/nagios-core/nagios-core-3.5.1.ebuild b/net-analyzer/nagios-core/nagios-core-3.5.1.ebuild
new file mode 100644
index 000000000000..a6e24f3b43d5
--- /dev/null
+++ b/net-analyzer/nagios-core/nagios-core-3.5.1.ebuild
@@ -0,0 +1,217 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+EAPI=5
+
+inherit depend.apache eutils multilib toolchain-funcs user
+
+MY_P=${PN/-core}-${PV}
+DESCRIPTION="Nagios Core - Check daemon, CGIs, docs"
+HOMEPAGE="http://www.nagios.org/"
+SRC_URI="mirror://sourceforge/nagios/${MY_P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="alpha amd64 ~arm ~arm64 hppa ppc ppc64 sparc x86"
+IUSE="debug lighttpd perl +web vim-syntax"
+DEPEND="virtual/mailx
+	web? (
+		>=media-libs/gd-1.8.3-r5[jpeg,png]
+		lighttpd? ( www-servers/lighttpd dev-lang/php[cgi] )
+		apache2? ( || ( dev-lang/php[apache2] dev-lang/php[cgi] ) )
+	)
+	perl? ( >=dev-lang/perl-5.6.1-r7:= )"
+RDEPEND="${DEPEND}
+	!net-analyzer/nagios-imagepack
+	vim-syntax? ( app-vim/nagios-syntax )"
+
+want_apache2
+
+S="${WORKDIR}/${PN/-core}"
+
+pkg_setup() {
+	depend.apache_pkg_setup
+
+	enewgroup nagios
+	enewuser nagios -1 /bin/bash /var/nagios/home nagios
+}
+
+src_prepare() {
+	epatch "${FILESDIR}/${PN}-3.5.1-process_cgivars.patch"
+	local strip="$(echo '$(MAKE) strip-post-install')"
+	sed -i -e "s:${strip}::" {cgi,base}/Makefile.in || die "sed failed in Makefile.in"
+}
+
+src_configure() {
+	local myconf
+
+	if use perl ; then
+		myconf="${myconf} --enable-embedded-perl --with-perlcache"
+	fi
+
+	if use debug; then
+		myconf="${myconf} --enable-DEBUG0"
+		myconf="${myconf} --enable-DEBUG1"
+		myconf="${myconf} --enable-DEBUG2"
+		myconf="${myconf} --enable-DEBUG3"
+		myconf="${myconf} --enable-DEBUG4"
+		myconf="${myconf} --enable-DEBUG5"
+	fi
+
+	if use !apache2 && use !lighttpd ; then
+		myconf="${myconf} --with-command-group=nagios"
+	else
+		if use apache2 ; then
+			myconf="${myconf} --with-command-group=apache"
+			myconf="${myconf} --with-httpd-conf=/etc/apache2/conf.d"
+		elif use lighttpd ; then
+			myconf="${myconf} --with-command-group=lighttpd"
+		fi
+	fi
+
+	econf ${myconf} \
+		--prefix=/usr \
+		--bindir=/usr/sbin \
+		--sbindir=/usr/$(get_libdir)/nagios/cgi-bin \
+		--datadir=/usr/share/nagios/htdocs \
+		--localstatedir=/var/nagios \
+		--sysconfdir=/etc/nagios \
+		--libexecdir=/usr/$(get_libdir)/nagios/plugins
+}
+
+src_compile() {
+	emake CC=$(tc-getCC) nagios
+
+	if use web ; then
+		# Only compile the CGI's if "web" useflag is set.
+		emake CC=$(tc-getCC) DESTDIR="${D}" cgis
+	fi
+}
+
+src_install() {
+	dodoc Changelog INSTALLING LEGAL README UPGRADING
+
+	if ! use web ; then
+		sed -i -e 's/cd $(SRC_CGI) && $(MAKE) $@/# line removed due missing web use flag/' \
+			-e 's/cd $(SRC_HTM) && $(MAKE) $@/# line removed due missing web use flag/' \
+			-e 's/$(MAKE) install-exfoliation/# line removed due missing web use flag/' \
+			Makefile
+	fi
+
+	sed -i -e 's/^contactgroups$//g' Makefile
+
+	emake DESTDIR="${D}" install
+	emake DESTDIR="${D}" install-config
+	emake DESTDIR="${D}" install-commandmode
+	if use web; then
+		emake DESTDIR="${D}" install-classicui
+	fi
+
+	newinitd "${FILESDIR}"/nagios3 nagios
+	newconfd "${FILESDIR}"/conf.d nagios
+
+	# Apache Module
+	if use web ; then
+		if use apache2 ; then
+			insinto "${APACHE_MODULES_CONFDIR}"
+			doins "${FILESDIR}"/99_nagios3.conf
+	    elif use lighttpd ; then
+			insinto /etc/lighttpd
+			newins "${FILESDIR}/lighttpd_nagios3-r1.conf" nagios.conf
+		else
+			ewarn "${CATEGORY}/${PF} only supports Apache-2.x or Lighttpd webserver"
+			ewarn "out-of-the-box. Since you are not using one of them, you"
+			ewarn "have to configure your webserver accordingly yourself."
+		fi
+
+	fi
+
+	for dir in etc/nagios var/nagios ; do
+		chown -R nagios:nagios "${D}/${dir}" || die "Failed chown of ${D}/${dir}"
+	done
+
+	dosbin p1.pl
+
+	chown -R root:root "${D}"/usr/$(get_libdir)/nagios
+	find "${D}"/usr/$(get_libdir)/nagios -type d -print0 | xargs -0 chmod 755
+	find "${D}"/usr/$(get_libdir)/nagios/cgi-bin -type f -print0 | xargs -0 chmod 755
+
+	keepdir /etc/nagios
+	keepdir /var/nagios
+	keepdir /var/nagios/archives
+	keepdir /var/nagios/rw
+	keepdir /var/nagios/spool/checkresults
+
+	if use !apache2 && use !lighttpd; then
+		chown -R nagios:nagios "${D}"/var/nagios/rw || die "Failed chown of ${D}/var/nagios/rw"
+	else
+		if use apache2 ; then
+			chown -R nagios:apache "${D}"/var/nagios/rw || die "Failed chown of ${D}/var/nagios/rw"
+		elif use lighttpd ; then
+			chown -R nagios:lighttpd "${D}"/var/nagios/rw || die "Failed chown of ${D}/var/nagios/rw"
+		fi
+	fi
+
+	chmod ug+s "${D}"/var/nagios/rw || die "Failed Chmod of ${D}/var/nagios/rw"
+	chmod 0750 "${D}"/etc/nagios || die "Failed chmod of ${D}/etc/nagios"
+}
+
+pkg_postinst() {
+	elog "If you want nagios to start at boot time"
+	elog "remember to execute:"
+	elog "  rc-update add nagios default"
+	elog
+
+	if use web ; then
+		elog "This does not include cgis that are perl-dependent"
+		elog "Currently traceroute.cgi is perl-dependent"
+		elog "To have ministatus.cgi requires copying of ministatus.c"
+		elog "to cgi directory for compiling."
+
+		elog "Note that the user your webserver is running at needs"
+		elog "read-access to /etc/nagios."
+		elog
+
+		if use apache2 || use lighttpd ; then
+			elog "There are several possible solutions to accomplish this,"
+			elog "choose the one you are most comfortable with:"
+			elog
+			if use apache2 ; then
+				elog "	usermod -G nagios apache"
+				elog "or"
+				elog "	chown nagios:apache /etc/nagios"
+				elog
+				elog "Also edit /etc/conf.d/apache2 and add \"-D NAGIOS\""
+			elif use lighttpd ; then
+				elog "  usermod -G nagios lighttpd "
+				elog "or"
+				elog "  chown nagios:lighttpd /etc/nagios"
+			fi
+			elog
+			elog "That will make nagios's web front end visable via"
+			elog "http://localhost/nagios/"
+			elog
+		else
+			elog "IMPORTANT: Do not forget to add the user your webserver"
+			elog "is running as to the nagios group!"
+		fi
+
+	else
+		elog "Please note that you have installed Nagios without web interface."
+		elog "Please don't file any bugs about having no web interface when you do this."
+		elog "Thank you!"
+	fi
+
+	elog
+	elog "If your kernel has /proc protection, nagios"
+	elog "will not be happy as it relies on accessing the proc"
+	elog "filesystem. You can fix this by adding nagios into"
+	elog "the group wheel, but this is not recomended."
+	elog
+}
+
+pkg_postinst() {
+	einfo "Fixing permissions"
+	chown nagios:nagios "${ROOT}"var/nagios
+}