[packages/arpwatch] Updated to 3.9
arekm
arekm at pld-linux.org
Sun Aug 16 20:24:01 CEST 2026
commit cbfcf960e0cec86640ba4d23294c9e57e5f2b0fd
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date: Sun Aug 16 20:03:39 2026 +0200
Updated to 3.9
Patches mostly from Fedora (some changed).
arpwatch-arp2ethers.patch | 16 ++++
arpwatch-arpfetch.patch | 12 +++
arpwatch-bogon.patch | 24 ++++++
arpwatch-c99.patch | 20 +++++
arpwatch-exit.patch | 15 ++++
arpwatch-freebsd.patch | 22 ++++++
arpwatch-man.patch | 75 ++++++++++++++++++
arpwatch-nolocal.patch | 14 ++++
arpwatch-opt.patch | 11 ---
arpwatch-path.patch | 39 ++++++++++
arpwatch-quiet.patch | 15 ++++
arpwatch-time.patch | 16 ++++
arpwatch-user.patch | 139 +++++++++++++++++++++++++++++++++
arpwatch.spec | 122 +++++++++++++++++++----------
arpwatch.sysconfig | 4 +
arpwatch at .service | 17 ++++
dmassagevendor | 192 ----------------------------------------------
dmassagevendor.8 | 40 ----------
18 files changed, 510 insertions(+), 283 deletions(-)
---
diff --git a/arpwatch.spec b/arpwatch.spec
index ea84a20..c047dbe 100644
--- a/arpwatch.spec
+++ b/arpwatch.spec
@@ -1,28 +1,46 @@
+#
+# oui.csv is published without a version, so it is snapshotted by date
+%define ouidate 20260816
+#
Summary: Arpwatch monitors changes in ethernet/ip address pairings
Summary(pl.UTF-8): Arpwatch monitoruje zmiany w parach adresów ethernet/ip
Summary(ru.UTF-8): Инструмент для отслеживания IP адресов в локальной сети
Summary(uk.UTF-8): Інструмент для відслідковування IP адрес в локальній мережі
Name: arpwatch
-Version: 2.1a15
-Release: 6
+Version: 3.9
+Release: 1
Epoch: 2
-License: GPL
+License: BSD
Group: Networking/Daemons
-Source0: ftp://ftp.ee.lbl.gov/%{name}-%{version}.tar.gz
-# Source0-md5: cebfeb99c4a7c2a6cee2564770415fe7
+Source0: https://ee.lbl.gov/downloads/%{name}/%{name}-%{version}.tar.gz
+# Source0-md5: 2989e0dea96bb28ab24c30efebe55a33
Source1: %{name}.init
Source2: %{name}.sysconfig
-Source3: dmassagevendor
-Source4: dmassagevendor.8
-Source5: https://ftp.debian.org/debian/pool/main/a/arpwatch/arpwatch_2.1a15-8.debian.tar.xz
-# Source5-md5: 5e1a6414ae8cb98af3e0691be062a3d5
-Patch0: %{name}-opt.patch
-BuildRequires: autoconf
-BuildRequires: automake
+Source3: %{name}@.service
+Source4: https://standards-oui.ieee.org/oui/oui.csv?/oui-%{ouidate}.csv
+# Source4-md5: 411302ab553163fc88effb8c3c842951
+Patch0: %{name}-time.patch
+Patch1: %{name}-c99.patch
+Patch2: %{name}-user.patch
+Patch3: %{name}-exit.patch
+Patch4: %{name}-bogon.patch
+Patch5: %{name}-freebsd.patch
+Patch6: %{name}-man.patch
+Patch7: %{name}-arp2ethers.patch
+Patch8: %{name}-arpfetch.patch
+Patch9: %{name}-path.patch
+Patch10: %{name}-quiet.patch
+Patch11: %{name}-nolocal.patch
+URL: https://ee.lbl.gov/
+BuildRequires: autoconf >= 2.71
BuildRequires: libpcap-devel
-BuildRequires: rpmbuild(macros) >= 1.268
+BuildRequires: python3
+BuildRequires: rpmbuild(macros) >= 1.671
Requires(post,preun): /sbin/chkconfig
+Requires(post,postun): systemd-units >= 38
Requires: rc-scripts >= 0.2.0
+Requires: smtpdaemon
+Requires: systemd-units >= 38
BuildRoot: %{tmpdir}/%{name}-%{version}-root-%(id -u -n)
%description
@@ -46,60 +64,84 @@ Dodatkowo tworzona jest baza par adresów ethernet/IP.
допомогою e-mail.
%prep
-%setup -q -a5
-for p in $(cat debian/patches/series); do
- patch -p1 < "debian/patches/$p" || exit 1
-done
+%setup -q
%patch -P0 -p1
+%patch -P1 -p1
+%patch -P2 -p1
+%patch -P3 -p1
+%patch -P4 -p1
+%patch -P5 -p1
+%patch -P6 -p1
+%patch -P7 -p1
+%patch -P8 -p1
+%patch -P9 -p1
+%patch -P10 -p1
+%patch -P11 -p1
+
+# the database directory is hardwired in the manuals and scripts
+%{__sed} -i -e 's|/usr/local/arpwatch|/var/lib/%{name}|g' *.8.in *.sh.in *.sh
%build
-cp -f /usr/share/automake/config.sub .
-%{__aclocal}
%{__autoconf}
-%configure
+%configure \
+ PYTHON=%{__python3} \
+ --with-sendmail=/usr/lib/sendmail
%{__make} \
- ARPDIR=/var/lib/arpwatch
+ ARPDIR=/var/lib/%{name}
+
+# upstream fetches oui.csv over the network, which is not available here
+%{__python3} massagevendor.py < %{SOURCE4} > ethercodes.dat
%install
rm -rf $RPM_BUILD_ROOT
-install -d $RPM_BUILD_ROOT{/var/lib/arpwatch,/etc/{rc.d/init.d,sysconfig}} \
- $RPM_BUILD_ROOT{%{_sbindir},%{_mandir}/man8,%{_var}/lib/%{name}}
+install -d $RPM_BUILD_ROOT{/etc/{rc.d/init.d,sysconfig},%{systemdunitdir}} \
+ $RPM_BUILD_ROOT{%{_sbindir},%{_mandir}/man8,/var/lib/%{name}}
-%{__make} install install-man \
+%{__make} install \
DESTDIR=$RPM_BUILD_ROOT
+# make install uses 555, which keeps debuginfo extraction from writing
+chmod 755 $RPM_BUILD_ROOT%{_sbindir}/arp{snmp,watch}
+
install arp2ethers arpfetch $RPM_BUILD_ROOT%{_sbindir}
+install massagevendor.py $RPM_BUILD_ROOT%{_sbindir}/massagevendor
install bihourly.sh $RPM_BUILD_ROOT%{_sbindir}/bihourly
-install *.{awk,dat} massagevendor{,-old} %{SOURCE3} $RPM_BUILD_ROOT/var/lib/arpwatch
-install *.8 %{SOURCE4} $RPM_BUILD_ROOT%{_mandir}/man8
-install ethercodes.dat $RPM_BUILD_ROOT%{_var}/lib/%{name}
+install *.awk $RPM_BUILD_ROOT/var/lib/%{name}
+install -m 644 arp.dat ethercodes.dat $RPM_BUILD_ROOT/var/lib/%{name}
-install %{SOURCE1} $RPM_BUILD_ROOT/etc/rc.d/init.d/arpwatch
-install %{SOURCE2} $RPM_BUILD_ROOT/etc/sysconfig/arpwatch
+install %{SOURCE1} $RPM_BUILD_ROOT/etc/rc.d/init.d/%{name}
+install %{SOURCE2} $RPM_BUILD_ROOT/etc/sysconfig/%{name}
+install -m 644 %{SOURCE3} $RPM_BUILD_ROOT%{systemdunitdir}/%{name}@.service
%clean
rm -rf $RPM_BUILD_ROOT
%post
-/sbin/chkconfig --add arpwatch
-%service arpwatch restart "arpwatch daemon"
+/sbin/chkconfig --add %{name}
+%service %{name} restart "arpwatch daemon"
+%systemd_reload
%preun
if [ "$1" = "0" ]; then
- %service arpwatch stop
- /sbin/chkconfig --del arpwatch
+ %service -q %{name} stop
+ /sbin/chkconfig --del %{name}
+fi
+
+%postun
+if [ "$1" = "0" ]; then
+ %systemd_reload
fi
%files
%defattr(644,root,root,755)
%doc README CHANGES
-%attr(754,root,root) /etc/rc.d/init.d/arpwatch
+%attr(754,root,root) /etc/rc.d/init.d/%{name}
%attr(755,root,root) %{_sbindir}/*
-%config(noreplace) %verify(not md5 mtime size) /etc/sysconfig/arpwatch
+%config(noreplace) %verify(not md5 mtime size) /etc/sysconfig/%{name}
+%{systemdunitdir}/%{name}@.service
%{_mandir}/man8/*
-%attr(750,daemon,root) %dir /var/lib/arpwatch
-%attr(644,daemon,root) %config(noreplace) %verify(not md5 mtime size) /var/lib/arpwatch/arp.dat
-%attr(755,daemon,root) /var/lib/arpwatch/*.awk
-%attr(755,daemon,root) /var/lib/arpwatch/*massagevendor*
-/var/lib/arpwatch/ethercodes.dat
+%attr(750,daemon,root) %dir /var/lib/%{name}
+%attr(644,daemon,root) %config(noreplace) %verify(not md5 mtime size) /var/lib/%{name}/arp.dat
+%attr(755,daemon,root) /var/lib/%{name}/*.awk
+/var/lib/%{name}/ethercodes.dat
diff --git a/arpwatch-arp2ethers.patch b/arpwatch-arp2ethers.patch
new file mode 100644
index 0000000..72f964b
--- /dev/null
+++ b/arpwatch-arp2ethers.patch
@@ -0,0 +1,16 @@
+The obsolete +N key syntax is a zero-based field offset, so +2 is -k 3.
+
+Origin: Fedora, sent upstream 2021-04-24; their version used -k 2, which
+sorts on the ip address instead of the timestamp.
+
+--- arpwatch-3.9.orig/arp2ethers 2013-02-16 09:10:28.000000000 +0100
++++ arpwatch-3.9/arp2ethers 2026-08-16 19:34:20.389504004 +0200
+@@ -13,7 +13,7 @@
+ # - sort
+ #
+
+-sort +2rn arp.dat |
++sort -k 3rn arp.dat |
+ awk 'NF == 4 { print }' |
+ awk -f p.awk |
+ egrep -v '\.[0-9][0-9]*$' |
diff --git a/arpwatch-arpfetch.patch b/arpwatch-arpfetch.patch
new file mode 100644
index 0000000..ca87973
--- /dev/null
+++ b/arpwatch-arpfetch.patch
@@ -0,0 +1,12 @@
+Drop a stray rm of a variable that is never set.
+
+Origin: Fedora, sent upstream 2021-04-24.
+
+--- arpwatch-3.9.orig/arpfetch 2013-02-16 09:10:28.000000000 +0100
++++ arpwatch-3.9/arpfetch 2026-08-16 19:34:20.402723222 +0200
+@@ -29,5 +29,3 @@
+ ea = $2
+ print ea "\t" ip
+ }'
+-
+-rm -f ${t1}
diff --git a/arpwatch-bogon.patch b/arpwatch-bogon.patch
new file mode 100644
index 0000000..06fc580
--- /dev/null
+++ b/arpwatch-bogon.patch
@@ -0,0 +1,24 @@
+Correctly handle -n 0/32 so that reporting of bogons from 0.0.0.0 can be
+turned off.
+
+Origin: Fedora, sent upstream 2021-04-24.
+
+--- arpwatch-3.9.orig/arpwatch.c 2023-12-03 19:10:05.000000000 +0100
++++ arpwatch-3.9/arpwatch.c 2026-08-16 19:34:20.361099292 +0200
+@@ -826,10 +826,12 @@
+
+ /* XXX hack */
+ n = ntohl(inet_addr(tstr));
+- while ((n & 0xff000000) == 0) {
+- n <<= 8;
+- if (n == 0)
+- return (0);
++ if (n || width != 32) {
++ while ((n & 0xff000000) == 0) {
++ n <<= 8;
++ if (n == 0)
++ return (0);
++ }
+ }
+ n = htonl(n);
+
diff --git a/arpwatch-c99.patch b/arpwatch-c99.patch
new file mode 100644
index 0000000..9fec37c
--- /dev/null
+++ b/arpwatch-c99.patch
@@ -0,0 +1,20 @@
+_getshort() is a glibc function that has not been declared by the installed
+headers for many years; use ns_get16() instead.
+
+Origin: Fedora, sent upstream 2023-02-01.
+
+--- arpwatch-3.9.orig/dns.c 2023-09-05 19:50:56.000000000 +0200
++++ arpwatch-3.9/dns.c 2026-08-16 19:34:20.319202788 +0200
+@@ -115,10 +115,10 @@
+ (u_char *)cp, (char *)bp, buflen)) < 0)
+ break;
+ cp += n;
+- type = _getshort(cp);
++ type = ns_get16(cp);
+ cp += sizeof(u_short); /* class */
+ cp += sizeof(u_short) + sizeof(u_int32_t);
+- n = _getshort(cp);
++ n = ns_get16(cp);
+ cp += sizeof(u_short);
+ if (type == T_HINFO) {
+ /* Unpack */
diff --git a/arpwatch-exit.patch b/arpwatch-exit.patch
new file mode 100644
index 0000000..2f0e3d7
--- /dev/null
+++ b/arpwatch-exit.patch
@@ -0,0 +1,15 @@
+Termination by the INT/TERM handler is a successful exit.
+
+Origin: Fedora, sent upstream 2021-04-24.
+
+--- arpwatch-3.9.orig/arpwatch.c 2023-12-03 19:10:05.000000000 +0100
++++ arpwatch-3.9/arpwatch.c 2026-08-16 19:34:20.348837391 +0200
+@@ -915,7 +915,7 @@
+ {
+ lg(LOG_DEBUG, "exiting");
+ checkpoint(0);
+- exit(1);
++ exit(0);
+ }
+
+ void
diff --git a/arpwatch-freebsd.patch b/arpwatch-freebsd.patch
new file mode 100644
index 0000000..3e8cad4
--- /dev/null
+++ b/arpwatch-freebsd.patch
@@ -0,0 +1,22 @@
+HAVE_FREEBSD_TRUE/HAVE_FREEBSD_FALSE are substituted but never assigned, so
+the FreeBSD rc.d script gets installed on every platform.
+
+--- arpwatch-3.9.orig/configure.in 2024-01-21 23:07:05.000000000 +0100
++++ arpwatch-3.9/configure.in 2026-08-16 19:38:45.589822987 +0200
+@@ -206,6 +206,16 @@
+ ln -s lbl/gnuc.h gnuc.h
+ fi
+
++case "${target_os}" in
++freebsd*)
++ HAVE_FREEBSD_TRUE=
++ HAVE_FREEBSD_FALSE='#'
++ ;;
++*)
++ HAVE_FREEBSD_TRUE='#'
++ HAVE_FREEBSD_FALSE=
++ ;;
++esac
+ AC_SUBST([HAVE_FREEBSD_FALSE])
+ AC_SUBST([HAVE_FREEBSD_TRUE])
+ AC_SUBST([LBL_LIBS])
diff --git a/arpwatch-man.patch b/arpwatch-man.patch
new file mode 100644
index 0000000..139003e
--- /dev/null
+++ b/arpwatch-man.patch
@@ -0,0 +1,75 @@
+Fix section numbers in man page cross references.
+
+Origin: Fedora, sent upstream 2021-04-24.
+
+--- arpwatch-3.9.orig/arpwatch.8.in 2023-12-03 01:48:53.000000000 +0100
++++ arpwatch-3.9/arpwatch.8.in 2026-08-16 19:34:20.374313035 +0200
+@@ -126,9 +126,9 @@
+ .Fl r
+ flag is used to specify a savefile
+ (perhaps created by
+-.Xr tcpdump 1
++.Xr tcpdump 8
+ or
+-.Xr pcapture 1 )
++.Xr pcapture 8 )
+ to read from instead
+ of reading from the network. In this case
+ .Nm
+@@ -172,9 +172,9 @@
+ .Pp
+ .Sh "REPORT MESSAGES"
+ Here's a quick list of the report messages generated by
+-.Xr arpwatch 1
++.Xr arpwatch 8
+ (and
+-.Xr arpsnmp 1 ) :
++.Xr arpsnmp 8 ) :
+ .Pp
+ .Bl -tag -width xxx
+ .It Ic "new activity"
+@@ -232,9 +232,9 @@
+ .Sh "SEE ALSO"
+ .Xr arpsnmp 8 ,
+ .Xr arp 8 ,
+-.Xr bpf 4 ,
+-.Xr tcpdump 1 ,
+-.Xr pcapture 1 ,
++.Xr bpf 2 ,
++.Xr tcpdump 8 ,
++.Xr pcapture 8 ,
+ .Xr pcap 3
+ .Sh AUTHORS
+ .An Craig Leres
+--- arpwatch-3.9.orig/arpsnmp.8.in 2019-12-01 20:01:07.000000000 +0100
++++ arpwatch-3.9/arpsnmp.8.in 2026-08-16 19:34:20.373939840 +0200
+@@ -45,7 +45,7 @@
+ and reports certain changes via email.
+ .Nm
+ reads information from a file (usually generated by
+-.Xr snmpwalk 3 ) .
++.Xr snmpwalk 1 ) .
+ .Pp
+ The format of the input file is the same as
+ .Ar arp.dat ;
+@@ -119,9 +119,9 @@
+ .Pp
+ .Sh "REPORT MESSAGES"
+ See the
+-.Xr arpwatch 1
++.Xr arpwatch 8
+ man page for details on the report messages generated by
+-.Xr arpsnmp 1 .
++.Xr arpsnmp 8 .
+ .Sh FILES
+ .Bl -tag -width ".Pa /usr/local/arpwatch" -compact
+ .It Pa /usr/local/arpwatch
+@@ -132,7 +132,7 @@
+ vendor ethernet block list
+ .Sh "SEE ALSO"
+ .Xr arpwatch 8 ,
+-.Xr snmpwalk 8 ,
++.Xr snmpwalk 1 ,
+ .Xr arp 8 ,
+ .Sh AUTHORS
+ .An Craig Leres
diff --git a/arpwatch-nolocal.patch b/arpwatch-nolocal.patch
new file mode 100644
index 0000000..13b675f
--- /dev/null
+++ b/arpwatch-nolocal.patch
@@ -0,0 +1,14 @@
+Do not force /usr/local/include and /usr/local/lib into the build; on a
+developer box they shadow the libraries the package was built against.
+
+--- arpwatch-3.9.orig/aclocal.m4 2023-09-05 19:40:09.000000000 +0200
++++ arpwatch-3.9/aclocal.m4 2026-08-16 20:19:09.030178271 +0200
+@@ -84,8 +84,6 @@
+ CC=cc
+ export CC
+ fi
+- $2="$$2 -I/usr/local/include"
+- LDFLAGS="$LDFLAGS -L/usr/local/lib"
+ if test "$GCC" != yes ; then
+ AC_MSG_CHECKING(that $CC handles ansi prototypes)
+ AC_CACHE_VAL(ac_cv_lbl_cc_ansi_prototypes,
diff --git a/arpwatch-opt.patch b/arpwatch-opt.patch
deleted file mode 100644
index 65a0b60..0000000
--- a/arpwatch-opt.patch
+++ /dev/null
@@ -1,11 +0,0 @@
-diff -urN arpwatch-2.1a10.org/aclocal.m4 arpwatch-2.1a10/aclocal.m4
---- arpwatch-2.1a10.org/aclocal.m4 Sun Jan 7 13:45:01 2001
-+++ arpwatch-2.1a10/aclocal.m4 Sun Jan 7 13:46:39 2001
-@@ -47,7 +47,6 @@
- AC_BEFORE([$0], [AC_LBL_FIXINCLUDES])
- AC_BEFORE([$0], [AC_LBL_DEVEL])
- AC_ARG_WITH(gcc, [ --without-gcc don't use gcc])
-- $1="-O"
- $2=""
- if test "${srcdir}" != "." ; then
- $2="-I\$(srcdir)"
diff --git a/arpwatch-path.patch b/arpwatch-path.patch
new file mode 100644
index 0000000..d7a4438
--- /dev/null
+++ b/arpwatch-path.patch
@@ -0,0 +1,39 @@
+Do not prepend /usr/local to PATH in the shipped scripts.
+
+Origin: Fedora, sent upstream 2021-04-24.
+
+--- arpwatch-3.9.orig/arpfetch 2013-02-16 09:10:28.000000000 +0100
++++ arpwatch-3.9/arpfetch 2026-08-16 19:34:20.414989622 +0200
+@@ -4,8 +4,6 @@
+ # arpfetch - collect arp data from a cisco using net-snmp
+ #
+
+-export PATH="/usr/local/bin:${PATH}"
+-
+ prog=`basename $0`
+
+ if [ $# -ne 2 ]; then
+--- arpwatch-3.9.orig/bihourly.sh 2016-09-17 04:40:54.000000000 +0200
++++ arpwatch-3.9/bihourly.sh 2026-08-16 19:34:20.415334547 +0200
+@@ -3,9 +3,6 @@
+ #
+ # bihourly arpwatch job
+ #
+-PATH=${PATH}:/usr/local/sbin
+-export PATH
+-#
+ cd /usr/local/arpwatch
+ #
+ list="`cat list`"
+--- arpwatch-3.9.orig/update-ethercodes.sh.in 2025-10-23 21:32:08.000000000 +0200
++++ arpwatch-3.9/update-ethercodes.sh.in 2026-08-16 19:34:20.415660555 +0200
+@@ -6,9 +6,6 @@
+
+ prog="`basename $0`"
+
+-PATH=/usr/local/bin:${PATH}
+-export PATH
+-
+ t1=`mktemp /tmp/${prog}.1.XXXXXX`
+
+ trap 'rm -f ${t1}; exit 1' 1 2 3 15 EXIT
diff --git a/arpwatch-quiet.patch b/arpwatch-quiet.patch
new file mode 100644
index 0000000..083976c
--- /dev/null
+++ b/arpwatch-quiet.patch
@@ -0,0 +1,15 @@
+The quiet flag is advertised as -q in the option string, the usage message
+and the manual, but the switch handles it as -a, so -q only prints usage
+and the quiet variable can never be set. arpsnmp.c gets this right.
+
+--- arpwatch-3.9.orig/arpwatch.c 2023-12-03 19:10:05.000000000 +0100
++++ arpwatch-3.9/arpwatch.c 2026-08-16 20:19:09.029540698 +0200
+@@ -252,7 +252,7 @@
+ rfilename = optarg;
+ break;
+
+- case 'a':
++ case 'q':
+ ++quiet;
+ break;
+
diff --git a/arpwatch-time.patch b/arpwatch-time.patch
new file mode 100644
index 0000000..7297f47
--- /dev/null
+++ b/arpwatch-time.patch
@@ -0,0 +1,16 @@
+configure no longer defines TIME_WITH_SYS_TIME (autoconf 2.71 dropped
+AC_HEADER_TIME), which left time(), gmtime() and localtime() implicitly
+declared. <time.h> and <sys/time.h> may be included together everywhere.
+
+--- arpwatch-3.9.orig/report.c 2023-09-05 19:50:56.000000000 +0200
++++ arpwatch-3.9/report.c 2026-08-16 19:34:27.631641402 +0200
+@@ -59,9 +59,7 @@
+ #include <stdlib.h>
+ #include <string.h>
+ #include <syslog.h>
+-#ifdef TIME_WITH_SYS_TIME
+ #include <time.h>
+-#endif
+ #include <unistd.h>
+
+ #include "gnuc.h"
diff --git a/arpwatch-user.patch b/arpwatch-user.patch
new file mode 100644
index 0000000..632c60a
--- /dev/null
+++ b/arpwatch-user.patch
@@ -0,0 +1,139 @@
+Add, and document, a -u argument to drop root privileges after the sockets
+have been opened. Also drops supplementary groups (CVE-2012-2653).
+
+Origin: Fedora, sent upstream 2021-04-24.
+
+--- arpwatch-3.9.orig/arpwatch.c 2023-12-03 19:10:05.000000000 +0100
++++ arpwatch-3.9/arpwatch.c 2026-08-16 19:34:20.333163717 +0200
+@@ -72,6 +72,8 @@
+ #include <syslog.h>
+ #include <unistd.h>
+
++#include <grp.h>
++#include <pwd.h>
+ #include <pcap.h>
+
+ #include "gnuc.h"
+@@ -172,6 +174,24 @@
+ int toskip(u_int32_t);
+ void usage(void) __attribute__((noreturn));
+
++void dropprivileges(const char* user)
++{
++ struct passwd* const pw = getpwnam(user);
++ if (pw) {
++ if (setgid(pw->pw_gid) != 0 || setgroups(0, NULL) != 0 ||
++ setuid(pw->pw_uid) != 0) {
++ lg(LOG_ERR, "Couldn't change to '%.32s' uid=%d gid=%d",
++ user, pw->pw_uid, pw->pw_gid);
++ exit(1);
++ }
++ } else {
++ lg(LOG_ERR, "Couldn't find user '%.32s' in /etc/passwd",
++ user);
++ exit(1);
++ }
++ lg(LOG_DEBUG, "Running as uid=%d gid=%d", getuid(), getgid());
++}
++
+ int
+ main(int argc, char **argv)
+ {
+@@ -183,6 +203,7 @@
+ char *interface, *rfilename;
+ struct bpf_program code;
+ char errbuf[PCAP_ERRBUF_SIZE];
++ char* serveruser = NULL;
+
+ if (argv[0] == NULL)
+ prog = "arpwatch";
+@@ -200,7 +221,7 @@
+ interface = NULL;
+ rfilename = NULL;
+ pd = NULL;
+- while ((op = getopt(argc, argv, "CdD:Ff:i:n:NpP:qr:svw:W:x:zZ")) != EOF)
++ while ((op = getopt(argc, argv, "CdD:Ff:i:n:NpP:qr:svw:W:x:zZu:")) != EOF)
+ switch (op) {
+
+ case 'C':
+@@ -285,6 +306,17 @@
+ zeropad = 1;
+ break;
+
++ case 'u':
++ if (optarg) {
++ /* no need to strdup() a pointer into the
++ * original arguments vector */
++ serveruser = optarg;
++ } else {
++ fprintf(stderr, "%s: Need username after -u\n", prog);
++ usage();
++ }
++ break;
++
+ default:
+ usage();
+ }
+@@ -381,6 +413,11 @@
+ }
+ }
+
++ /* Explicit user change (privilege drop) with -u? */
++ if (serveruser) {
++ dropprivileges(serveruser);
++ }
++
+ /*
+ * Revert to non-privileged user after opening sockets
+ * (not needed on most systems).
+@@ -944,6 +981,7 @@
+ "usage: %s [-CdFNpqsvzZ] [-D arpdir] [-f datafile]"
+ " [-i interface]\n\t"
+ " [-P pidfile] [-w watcher at email] [-W watchee at email]\n\t"
+- " [-n net[/width]] [-x net[/width]] [-r file]\n", prog);
++ " [-n net[/width]] [-x net[/width]] [-r file] [-u username]\n",
++ prog);
+ exit(1);
+ }
+--- arpwatch-3.9.orig/arpwatch.8.in 2023-12-03 01:48:53.000000000 +0100
++++ arpwatch-3.9/arpwatch.8.in 2026-08-16 19:34:20.332594915 +0200
+@@ -43,6 +43,7 @@
+ .Op Fl n Ar net[/width]
+ .Op Fl x Ar net[/width]
+ .Op Fl r Ar file
++.Op Fl u Ar username
+ .Sh DESCRIPTION
+ .Nm
+ keeps track of ethernet/ip address pairings. It syslogs activity
+@@ -137,13 +138,30 @@
+ Note that an empty
+ .Ar arp.dat
+ file must be created before the first time you run
+-.Fl arpwatch .
++.Nm .
++Also, the default directory (where
++.Ar arp.dat
++is stored) must be owned by
++.Ar username
++if the
++.Fl u
++flag is used.
+ .Pp
+ The
+ .Fl s
+ flag suppresses reports sent by email.
+ .Pp
+ The
++.Fl u
++flag causes
++.Nm
++to drop root privileges and change user ID to
++.Ar username
++and group ID to that of the primary group of
++.Ar username .
++This is recommended for security reasons.
++.Pp
++The
+ .Fl v
+ flag disables the reporting of VRRP/CARP ethernet prefixes as
+ described in RFC5798 (@MACZERO at 0:@MACZERO at 0:5e:@MACZERO at 0:@MACZERO at 1:xx).
diff --git a/arpwatch.sysconfig b/arpwatch.sysconfig
index 5651739..ca6d97d 100644
--- a/arpwatch.sysconfig
+++ b/arpwatch.sysconfig
@@ -1,6 +1,10 @@
# Define nice level for arpwatch
SERVICE_RUN_NICE_LEVEL="+5"
+# Options for the arpwatch@<interface> systemd units. The init script ignores
+# this and builds its own option list from the settings below.
+ARPWATCH_OPTS=""
+
#GLOBAL_OPTIONS=""
# Name of monitored interfaces
diff --git a/arpwatch at .service b/arpwatch at .service
new file mode 100644
index 0000000..1d2aef3
--- /dev/null
+++ b/arpwatch at .service
@@ -0,0 +1,17 @@
+[Unit]
+Description=Ethernet/IP address pairing monitor on %I
+Documentation=man:arpwatch(8)
+After=network.target sys-subsystem-net-devices-%i.device
+BindsTo=sys-subsystem-net-devices-%i.device
+
+[Service]
+Type=simple
+Restart=on-failure
+RestartSec=2
+EnvironmentFile=-/etc/sysconfig/arpwatch
+# arpwatch refuses to start when its database is missing
+ExecStartPre=/bin/sh -c 'test -f /var/lib/arpwatch/%I.dat || /usr/bin/install -m 644 -o daemon -g root /dev/null /var/lib/arpwatch/%I.dat'
+ExecStart=/usr/sbin/arpwatch -F -u daemon -i %I -f /var/lib/arpwatch/%I.dat $ARPWATCH_OPTS
+
+[Install]
+WantedBy=multi-user.target sys-subsystem-net-devices-%i.device
diff --git a/dmassagevendor b/dmassagevendor
deleted file mode 100644
index 9fe9ba2..0000000
--- a/dmassagevendor
+++ /dev/null
@@ -1,192 +0,0 @@
-#!/usr/bin/perl -w
-# massagevendor.pl: v0.03 2002/03/07 KELEMEN Peter <fuji at debian.org>
-# This program is part of the arpwatch Debian package.
-
-# Compile Ethernet vendor code listings from different sources into internal
-# format used by arpwatch(8).
-
-# Ethernet vendor listings recognized:
-# IEEE OUI: http://standards.ieee.org/regauth/oui/oui.txt
-# CaveBear: http://map-ne.com/Ethernet/Ethernet.txt
-
-use Getopt::Long;
-use strict;
-use vars qw($opt_output $opt_ieee $opt_cavebear $opt_firstword $opt_help $opt_version);
-
-my $VERSION = q(0.03);
-
-$opt_output = 'ethercodes.dat';
-$opt_ieee = 'oui.txt';
-$opt_cavebear = 'Ethernet.txt';
-$opt_firstword = 0;
-$opt_help = 0;
-$opt_version = 0;
-
-my $time = time();
-
-GetOptions(qw(output=s ieee=s cavebear=s firstword help version));
-version() if $opt_version;
-usage() if $opt_help;
-
-open(IEEE, '<' . $opt_ieee) || die "$opt_ieee: $!\n";
-open(CAVEBEAR, '<' . $opt_cavebear) || die "$opt_cavebear: $!\n";
-open(OUTPUT, '>' . $opt_output) || die "$opt_output: $!\n";
-
-my ($prefix, $vendor);
-my %ieee = ();
-my %cavebear = ();
-
-# Process IEEE OUI listing.
-while (<IEEE>) {
- next unless /^[[:xdigit:]]{2}-[[:xdigit:]]{2}-[[:xdigit:]]{2}\s/;
- chomp;
- ($prefix, $vendor) = m/^([[:xdigit:]]{2}-[[:xdigit:]]{2}-[[:xdigit:]]{2})\s+\([^(]+\)\s+(.*)$/;
- $prefix =~ s/-//g;
- $ieee{mangle_prefix($prefix)} = mangle_vendor($vendor);
-}
-
-# Process CaveBear Ethernet vendor codes.
-while (<CAVEBEAR>) {
- next unless /^[0-9A-F]{6}\s/;
- s/\r//g;
- chomp;
- ($prefix, $vendor) = m/^([0-9A-F]{6})\s+(.*)$/;
- $vendor =~ s/\s{2,}/ /g;
- $vendor =~ s/([a-z])([A-Z])/$1 $2/g;
- $cavebear{mangle_prefix($prefix)} = $vendor;
-}
-print STDERR scalar keys %ieee, " (IEEE), ", scalar keys %cavebear, " (CaveBear).\n";
-
-# Attempt to merge.
-my $equal = 0;
-my $first_word = 0;
-my $merged = 0;
-my $c_only = 0;
-foreach (sort keys %cavebear) {
- if (exists $ieee{$_}) {
-
- my ($i, $c);
-
- # Treat as equal if sanitized vendor name equals.
- $i = lc($ieee{$_});
- $c = lc($cavebear{$_});
- $i =~ s/\W//g;
- $c =~ s/\W//g;
- if ($i eq $c) {
- ++$equal;
- next;
- }
-
- if ($opt_firstword) {
- # Treat as equal if first word matches.
- $i = lc($ieee{$_});
- $c = lc($cavebear{$_});
- $i =~ s/(\w+).*/$1/;
- $c =~ s/(\w+).*/$1/;
- if (0 and $i eq $c) {
- $i =~ s/\W//g;
- $c =~ s/\W//g;
- if (length($c) >= length($i)) {
- $ieee{$_} = $cavebear{$_};
- }
- ++$first_word;
- next;
- }
- }
-
- # At this point we're helpless; simple heuristics could not
- # determine if the two vendors were the same. Merge them.
- # Always use vendor name from IEEE, add vendor name from
- # CaveBear in brackets ([]).
- $ieee{$_} .= " [" . $cavebear{$_} . ']';
- $ieee{$_} =~ s/\t/; /g;
- ++$merged;
- } else {
- $ieee{$_} = $cavebear{$_};
- ++$c_only;
- }
-}
-
-foreach (sort keys %ieee) {
- print OUTPUT "$_\t$ieee{$_}\n";
-}
-close(OUTPUT);
-close(IEEE);
-close(CAVEBEAR);
-
-$time = time()-$time;
-print scalar keys %ieee, " total. (processed in $time seconds)\n";
-print STDERR $equal, " equal, ", $first_word, " equal based on company name.\n";
-print STDERR $merged, " merged, ", $c_only, " listed only by CaveBear.\n";
-
-# Mangle prefix code. Wish there was some standard notation...
-sub mangle_prefix {
- my $prefix = lc(shift); # Lowercase.
-
- # Extract XX:XX:XX MAC address prefix.
- @_ = $prefix =~ m/^([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})$/;
-
- map { s/^0//; } @_; # Strip leading zeros.
- return join(':', @_);
-}
-
-# Mangle vendor name since the IEEE listing is really carelessly compiled.
-# Heavy heuristics here, you've been warned.
-sub mangle_vendor {
- my $vendor = shift;
- $vendor =~ s/^\W+//; # Strip leading garbage.
- $vendor =~ s/\s{2,}/ /g; # Condense whitespace.
- $vendor =~ s/ \W$//; # Strip trailing garbage.
- $vendor =~ s/(\w{4,})/\u\L$1/g; # Capitalize words 4 or more chars.
-
- # Heuristics to uc() abbreviations longer than 4 characters.
- $vendor =~ s/^(Ecci|Ris(c|q)|Seel|Uunet)$/\U$1/g;
-
- # Heuristics to lc() abbreviations shorter than 4 characters.
- $vendor =~ s/\b(COM?|IN(C|T)|LTD|DIV|SYS|PUB|IND|PT(Y|E)|LAB|TEC|SEL|EON)\b/\u\L$1/g;
-
- # Lowercase ordinary words.
- $vendor =~ s/\b(BAY|THE|ZUR|END|ONE|SAN|SUN|NET|WAY|TOP|BOX)/\u\L$1/g;
- $vendor =~ s/\b(BUG|BUS|PIG|TEN|LAW|NOT|SEA|LEE)\b/\u\L$1/g;
-
- # Lowercase French words and abbreviations.
- $vendor =~ s/\b(LA|LE|SOC|FA)\b/\u\L$1/g;
-
- # Lowercase English, French, German and Spanish conjunctions.
- $vendor =~ s/\b(AND|OF|TO|IN|FOR)\b/\L$1/g;
- $vendor =~ s/\b(DES|UND|DE|DI|DU)\b/\L$1/g;
-
- $vendor =~ s/\b((L|D)')/\L$1/g; # Lowercase French prefixes.
- $vendor =~ s/('[A-Z])\b/\L$1/g; # Lowercase letters following an "'".
- $vendor =~ s/\bGmbh\b/GmbH/g; # Treat GmbH specially.
-
- return $vendor;
-}
-
-sub version {
- print <<EOF
-massagevendor $VERSION
-Copyright (C) 2000-2001 KELEMEN Peter <fuji\@debian.org>
-EOF
- ;
- exit(0);
-}
-
-sub usage {
- print <<EOF
-Massage IEEE OUI listing and Cavebear Ethernet vendor database into arpwatch(8) format.
-
-Usage: massagevendor [--ieee=<file>] [--cavebear=<file>] [--output=<file>] [--help] [--firstword]
-
-Options:
- --ieee=<file> Read IEEE OUI listing from this file [oui.txt]
- --cavebear=<file> Read Cavebear Ethernet vendor info from here [Ethernet.txt]
- --output=<file> Write massaged output to this file [ethercodes.dat]
- --firstword Enable equality heuristics based on he first word of
- a vendor's name. This might produce unwanted results.
- --help You are reading this now.
-
-EOF
- ;
- exit(0);
-}
diff --git a/dmassagevendor.8 b/dmassagevendor.8
deleted file mode 100644
index d5fe3d9..0000000
--- a/dmassagevendor.8
+++ /dev/null
@@ -1,40 +0,0 @@
-.\" DO NOT MODIFY THIS FILE! It was generated by help2man 1.24.
-.TH DMASSAGEVENDOR "8" "April 2001" "dmassagevendor 0.02" FSF
-.SH NAME
-dmassagevendor \- convert the ethernet vendor codes master list to arpwatch format
-.SH SYNOPSIS
-.B dmassagevendor
-[\fI--ieee=<file>\fR] [\fI--cavebear=<file>\fR] [\fI--output=<file>\fR] [\fI--help\fR] [\fI--firstword\fR]
-.SH DESCRIPTION
-Massage IEEE OUI listing and Cavebear Ethernet vendor database into arpwatch(8) format.
-This program has been written for the same purpose as the
-.B massagevendor
-program in the
-.B arpwatch
-Debian package.
-.SH OPTIONS
-.TP
-\fB\-\-ieee=\fR<file>
-Read IEEE OUI listing from this file [oui.txt]
-.TP
-\fB\-\-cavebear=\fR<file>
-Read Cavebear Ethernet vendor info from here [Ethernet.txt]
-.TP
-\fB\-\-output=\fR<file>
-Write massaged output to this file [ethercodes.dat]
-.TP
-\fB\-\-firstword\fR
-Enable equality heuristics based on he first word of
-a vendor's name. This might produce unwanted results.
-.TP
-\fB\-\-help\fR
-You are reading this now.
-.SH "SEE ALSO"
-.na
-.nh
-.BR massagevendor(8),
-.BR arpwatch(8)
-.ad
-.hy
-.SH COPYRIGHT
-Copyright \(co 2000-2001 KELEMEN Peter <fuji at debian.org>
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/arpwatch.git/commitdiff/cbfcf960e0cec86640ba4d23294c9e57e5f2b0fd
More information about the pld-cvs-commit
mailing list