[#3831] Checkpoint: fixes

[#3831] Checkpoint: code done, UTs to be updated

[#3831] Restricted cache-write

[#3831] update CA default config and fix dhcp examples

[#3831] Spelling

[#3831] Fixed UT build and minor nits

modified:   doc/sphinx/arm/dhcp6-srv.rst
modified:   doc/sphinx/arm/logging.rst
modified:   src/bin/d2/tests/d2_process_tests.sh.in
modified:   src/bin/dhcp4/tests/dhcp4_process_tests.sh.in
modified:   src/bin/dhcp6/json_config_parser.cc
modified:   src/bin/dhcp6/tests/dhcp6_process_tests.sh.in
modified:   src/hooks/dhcp/forensic_log/libloadtests/load_unload_unittests.cc
modified:   src/lib/dhcpsrv/tests/cfgmgr_unittest.cc
modified:   src/lib/hooks/hooks_parser.cc
modified:   src/lib/process/log_parser.cc
modified:   src/lib/process/log_parser.h
modified:   src/lib/testutils/env_var_wrapper.h
modified:   src/lib/util/filesystem.cc

[#3831] Added path validation, updated tests

/src/hooks/dhcp/forensic_log/libloadtests/load_unload_unittests.cc
    Updated tests

/src/hooks/dhcp/forensic_log/rotating_file.cc
    RotatingFile::apply{) - fetch default from singleton

/src/hooks/dhcp/forensic_log/tests/legal_log_mgr_unittests.cc
    TEST_F(LegalLogMgrTest, pathValidation)
    TEST_F(LegalLogMgrTest, pathEnvVarOverride) - new tests

/src/lib/dhcpsrv/legal_log_mgr.*
    LegalLogMgr::parseFile() - validate path

Updated the ARM.

[#3831] Initial pieces for legal log restriction

/src/lib/dhcpsrv/Makefile.am
   Changed LEGAL_LOG_DIR to use log vs lib

/src/lib/dhcpsrv/legal_log_mgr.*
    LegalLogMgr - added PathChecker singleton and funcs

/src/lib/dhcpsrv/meson.build
   Defined LEGAL_LOG_DIR

/src/lib/util/filesystem.*
    PathChecker::validateDirectory() - new func

/src/lib/util/tests/filesystem_unittests.cc
    TEST(PathChecker, validateDirectoryEnforcePath)
    TEST(PathChecker, validateDirectoryEnforcePathFalse) - new tests

[#3831] leaseX-write restricted to supported path

modified:   hooks-lease-cmds.rst
modified:   ../../../src/hooks/dhcp/lease_cmds/lease_cmds.cc
modified:   ../../../src/hooks/dhcp/lease_cmds/libloadtests/lease_cmds4_unittest.cc
modified:   ../../../src/hooks/dhcp/lease_cmds/libloadtests/lease_cmds6_unittest.cc

[#3831] C++17 clang fixes

[#3831] Spelling

[#3831] Remove paths from output in conf files

modified:   src/bin/keactrl/kea-ctrl-agent.conf.pre
modified:   src/bin/keactrl/kea-dhcp-ddns.conf.pre
modified:   src/bin/keactrl/kea-dhcp4.conf.pre
modified:   src/bin/keactrl/kea-dhcp6.conf.pre
modified:   src/bin/keactrl/kea-netconf.conf.pre

[#3831] Fix netconf UT test

/src/bin/netconf/tests/shtests/netconf_tests.sh.in
- export KEA_LOG_FILE_DIR

[#3831] Fix log path in UTs

/doc/sphinx/arm/logging.rst
    Updated logging section

/src/bin/admin/tests/memfile_tests.sh.in
/src/bin/shell/tests/shell_dhcp4_process_tests.sh.in
/src/bin/shell/tests/shell_dhcp6_process_tests.sh.in
    export KEA_LOG_FILE_DIR

/src/lib/dhcpsrv/memfile_lease_mgr.cc
    Memfile_LeaseMgr::factory() - fix throw to preserve error txt

/src/lib/process/Makefile.am
    Define LOGFILE_DIR

{3831] Logger output path restricted

Initial implementaion, still need docs and
autotools changes

meson.build
    Appended "kea" to LOGDIR

/src/bin/agent/tests/ca_process_tests.sh.in
/src/bin/d2/tests/d2_process_tests.sh.in
/src/bin/dhcp4/tests/dhcp4_process_tests.sh.in
/src/bin/dhcp6/tests/dhcp6_process_tests.sh.in
    export KEA_LOG_FILE_DIR

/src/bin/dhcp4/tests/ctrl_dhcp4_srv_unittest.cc
/src/bin/dhcp4/tests/http_control_socket_unittest.cc
/src/bin/dhcp6/tests/ctrl_dhcp6_srv_unittest.cc
/src/bin/dhcp6/tests/http_control_socket_unittest.cc
    Updated tests

/src/bin/dhcp6/tests/dhcp6_test_utils.*
    Added log path stuff to BaseServerTest

/src/bin/keactrl/tests/keactrl_tests.sh.in
/src/bin/shell/tests/ca_basic_auth_tests.sh.in
/src/bin/shell/tests/d2_basic_auth_tests.sh.in
/src/bin/shell/tests/dhcp4_basic_auth_tests.sh.in
/src/bin/shell/tests/dhcp6_basic_auth_tests.sh.in
/src/bin/shell/tests/shell_ca_process_tests.sh.in
/src/bin/shell/tests/shell_d2_process_tests.sh.in
/src/bin/shell/tests/tls_ca_process_tests.sh.in
/src/bin/shell/tests/tls_d2_process_tests.sh.in
/src/bin/shell/tests/tls_dhcp4_process_tests.sh.in
/src/bin/shell/tests/tls_dhcp6_process_tests.sh.in

/src/lib/process/log_parser.*
    Added  PathChecker singleton,
    LogConfigParser::getLogPath()
    LogConfigParser::validatePath()
    LogConfigParser::parseOutputOptions() - throws if
    output uses an invalid path

/src/lib/process/meson.build
    Defines LOGFILE_DIR

/src/lib/process/tests/log_parser_unittests.cc
    Updated tests

[#3831] Added data-directory in sample keywords

[#3831] Nits

[#3831] Minor nits

[#3831] Addressed further comments

/doc/examples/kea6/all-keys-netconf.json
/doc/examples/kea6/all-keys.json
    removed data-directory

/doc/sphinx/arm/dhcp6-srv.rst
    Updated ARM

/src/bin/dhcp6/dhcp6_messages.*
    Changed DHCP6_DATA_DIRECTORY_DEPRECATED

/src/bin/dhcp6/json_config_parser.cc
    Removed dirExists() function
    parsing logic errors on invalid data-directory

/src/bin/dhcp6/tests/config_parser_unittest.cc
    Updated data-directory tests

Other minor cleanups

[#3831] Removed extra end of line

[#3831] Removed extra blank line

[#3831] Added missing spaces

[#3831] spelling

[#3831] Addressed preliminary comments

Changes to be committed:
modified:   src/lib/dhcpsrv/cfgmgr.h
modified:   src/lib/hooks/tests/hooks_manager_unittest.cc
modified:   src/lib/testutils/meson.build
modified:   src/lib/util/tests/filesystem_unittests.cc

[#3831] Updated ARM

modified:   doc/sphinx/api-files.txt
modified:   doc/sphinx/arm/dhcp4-srv.rst
modified:   doc/sphinx/kea-messages.rst

[#3831] Adde env_var_wrapper.cc to meson.build

modified:   src/lib/testutils/meson.build

[#3831] Error on bad lease file path

/doc/examples/kea4/all-keys-netconf.json
/doc/examples/kea4/all-keys.json
/doc/examples/kea4/dhcpv4-over-dhcpv6.json
/doc/examples/kea6/all-keys-netconf.json
/doc/examples/kea6/all-keys.json
/doc/examples/kea6/dhcpv4-over-dhcpv6.json
    Remove "/tmp" from lease file names

/src/bin/admin/tests/memfile_tests.sh.in
/src/bin/dhcp4/tests/dhcp4_process_tests.sh.in
/src/bin/dhcp6/tests/dhcp6_process_tests.sh.in
    export KEA_DHCP_DATA_DIR

/src/bin/shell/tests/dhcp4_basic_auth_tests.sh.in
/src/bin/shell/tests/dhcp6_basic_auth_tests.sh.in

/src/bin/shell/tests/shell_dhcp4_process_tests.sh.in
/src/bin/shell/tests/shell_dhcp6_process_tests.sh.in

/src/bin/shell/tests/tls_dhcp4_process_tests.sh.in
/src/bin/shell/tests/tls_dhcp6_process_tests.sh.in

/src/lib/dhcpsrv/dhcpsrv_messages.*
    Replace WARN message with DHCPSRV_MEMFILE_FAILED_TO_OPEN error

/src/lib/dhcpsrv/memfile_lease_mgr.cc
    Memfile_LeaseMgr::getDefaultLeaseFilePath()
    - uses CfgMgr::getDataDir()
    Memfile_LeaseMgr::initLeaseFilePath()
     - call CfgMgr::validatePath() without try-catch
    Memfile_LeaseMgr::factory()
    - log error and rethrow

/src/lib/dhcpsrv/tests/cfgmgr_unittest.cc
    Added use of EnvVarWrapper

/src/lib/dhcpsrv/tests/memfile_lease_mgr_unittest.cc
    Updated tests
    TEST_F(MemfileLeaseMgrTest, defaultDataDir)
    TEST_F(MemfileLeaseMgrTest, dataDirEnvVarOverride)
    TEST_F(MemfileLeaseMgrTest, dataDirExplicitOveride)
    - new tests

/src/lib/testutils/Makefile.am
   Added env_var_wrapper.*

[#3831] Fix UT Makefile.am files

[#3831] Replaced CfgMgr::data_dir_ with PathChecker

/src/bin/dhcp4/tests/dhcp4_test_utils.cc
    UpdatedModified BaseServerTest

/src/bin/dhcp4/tests/meson.build
    Added DHCP_DATA_DIR

/src/bin/dhcp6/dhcp6_messages.*
    DHCP6_DATA_DIRECTORY_DEPRECATED - new message

/src/bin/dhcp6/dhcp6_parser.yy
    Add warning to data_dir parsing

/src/bin/dhcp6/json_config_parser.cc
    Emit a warning if config contains data-directory

/src/bin/dhcp6/tests/Makefile.am
    Added DHCP_DATA_DIR

/src/bin/dhcp6/tests/config_parser_unittest.cc
    TEST_F(Dhcp6ParserTest, testDataDir) - updated test

/src/bin/dhcp6/tests/dhcp6_test_utils.cc
    UpdatedModified BaseServerTest

/src/bin/dhcp6/tests/hooks_unittest.cc
    LoadUnloadDhcpv6SrvTest now derives from BaseServerTest

/src/bin/dhcp6/tests/meson.build
    Added DHCP_DATA_DIR

/src/lib/dhcpsrv/cfgmgr.*
    Replace Optional<string> datadir_ with PathChecker
    data_dir_checker_

    CfgMgr::getDataDir() - updated
    CfgMgr::validatePath() - added

/src/lib/dhcpsrv/srv_config.cc
    SrvConfig::toElement() - remove output of  data-directory

/src/lib/dhcpsrv/tests/Makefile.am
    Added DHCP_DATA_DIR

/src/lib/dhcpsrv/tests/cfg_duid_unittest.cc
    Updated absolutePath()

/src/lib/dhcpsrv/tests/cfgmgr_unittest.cc
    Updated tests

/src/lib/dhcpsrv/tests/csv_lease_file4_unittest.cc
/src/lib/dhcpsrv/tests/csv_lease_file6_unittest.cc
/src/lib/dhcpsrv/tests/lease_file_loader_unittest.cc
/src/lib/dhcpsrv/tests/memfile_lease_mgr_unittest.cc
    Updated absolutePath()

/src/lib/dhcpsrv/tests/meson.build
    Added DHCP_DATA_DIR

[#3831] Refactored FileManager into PathChecker

Refactored to internally support env variable and explicit paths
modified:
    src/lib/hooks/hooks_parser.cc
    src/lib/hooks/hooks_parser.h
    src/lib/util/filesystem.cc
    src/lib/util/filesystem.h
    src/lib/util/tests/filesystem_unittests.cc

[#3830] Fixed netconf UT tests

/src/bin/netconf/tests/Makefile.am
/src/bin/netconf/tests/meson.build
    Added NETCONF_HOOKS_TEST_PATH

/src/bin/netconf/tests/netconf_cfg_mgr_unittests.cc
    NetconfParserTest - added set and reset of hooks path
    TEST_F(NetconfParserTest, configParseHooks) - call setHooksTestPath()

[#3832] Meson: Add install_umask=0027

This makes directories 750 and files 640 by default.

[#3832] Reindented

[#3832] Extra fix

[#3832] Added umask to admin and keactrl

[#3832] Added umask 0027 setting

[#3832] Checkpoint: removed #3050 and fixes

[#3830] Removed obsolete UT

modified:   dhcp_parsers_unittest.cc

[#3830] Fix release mention in ARM

modified:   hooks.rst

[#3830] Addressed further review comments

    Minor cleanup and fixed hooks partesr UTs
modified:   src/lib/hooks/hooks_parser.h
modified:   src/lib/hooks/tests/hooks_manager_unittest.cc

[#3830] Small fixes

[#3830] Updated the ARM

[#3830] Addressed review comments

src/lib/util/filesystem.cc
    Replaced use of std::filesystem with isc:util::Path

src/lib/hooks/hooks_parser.cc
src/lib/hooks/hooks_parser.h
    HooksLibrariesParser::getHooksPath() - provides the
    ability to set it to an explicit value

Updated A LOT of UTs:

src/bin/agent/tests/ca_cfg_mgr_unittests.cc
src/bin/agent/tests/ca_process_tests.sh.in
src/bin/agent/tests/get_config_unittest.cc
src/bin/agent/tests/test_callout_libraries.h.in
src/bin/d2/tests/d2_cfg_mgr_unittests.cc
src/bin/d2/tests/d2_process_tests.sh.in
src/bin/d2/tests/d2_process_unittests.cc
src/bin/d2/tests/get_config_unittest.cc
src/bin/d2/tests/test_callout_libraries.h.in
src/bin/d2/tests/test_configured_libraries.h.in
src/bin/dhcp4/tests/config_parser_unittest.cc
src/bin/dhcp4/tests/ctrl_dhcp4_srv_unittest.cc
src/bin/dhcp4/tests/dhcp4_process_tests.sh.in
src/bin/dhcp4/tests/hooks_unittest.cc
src/bin/dhcp4/tests/http_control_socket_unittest.cc
src/bin/dhcp4/tests/test_libraries.h.in
src/bin/dhcp6/tests/config_parser_unittest.cc
src/bin/dhcp6/tests/ctrl_dhcp6_srv_unittest.cc
src/bin/dhcp6/tests/dhcp6_process_tests.sh.in
src/bin/dhcp6/tests/hooks_unittest.cc
src/bin/dhcp6/tests/http_control_socket_unittest.cc
src/bin/dhcp6/tests/test_libraries.h.in
src/lib/dhcpsrv/tests/dhcp_parsers_unittest.cc
src/lib/dhcpsrv/tests/test_libraries.h.in
src/lib/hooks/tests/Makefile.am
src/lib/hooks/tests/hooks_manager_unittest.cc
src/lib/hooks/tests/test_libraries.h.in
src/lib/process/cfgrpt/tests/config_report_unittests.cc
src/lib/util/tests/filesystem_unittests.cc

[#3830] Updated ChangeLog

[#3830] Fix ChangeLog spaces

[#3830] Added ChangeLog entry file

new file:   3830-CVE-2025-32801-Allow-loading-hook--ibraries-only-from-default-path

[#3830] Updated ARM

modified:   doc/sphinx/arm/hooks.rst
modified:   src/lib/hooks/tests/hooks_manager_unittest.cc
modified:   src/lib/util/tests/filesystem_unittests.cc

[#3830] Hook libraries must load from default hook dir

/src/lib/util/filesystem.*
    FileManager::validatePath() - new class and function

/src/lib/hooks/hooks_parser.*
    HooksLibrariesParser::validatePath() - new wrapper around FileManager::validatePath()
    HooksLibrariesParser::parse() - now uses validatePath()

/src/lib/hooks/tests/hooks_manager_unittest.cc
    TEST(HooksParser, validatePathEnforcePath)
    TEST(HooksParser, validatePathEnforcePathFalse) - new tests

/src/lib/util/tests/filesystem_unittests.cc
    TEST(FileManager, validatePathEnforcePath)
    TEST(FileManager, validatePathEnforcePathFalse) - new tests

[#3789] Extend the change to upgrade scripts down to Kea 2.6

[#3789] Extend the change to upgrade scripts down to Kea 2.6

[#3789] Check only major version in upgrade scripts to allow for intermediary backported schema changes

[#3734] Replace non-POSIX "cp -T"

[#3866] Meson: Fix SOURCE_OF_INSTALLATION when git is not installed

[#3866] Meson: disable b_lundef to fix sanitizers

[#3866] Meson: reinstall.sh now looks into the srcdir for YANG modules

[#3870] Forward port Suzanne's fixes from #3869

[#3868] bump up version in meson.build

[#3864] More release changes

[#3864] release changes

[#3863] lib version bump up

[#3763] Add ChangeLog entry

[#3763] Add precautionary continue handlers to lease AUPD triggers

[#3732] Meson: Fix devel docs

[#3732] Do not run fuzz jobs on MR creation

[#3732] Meson: Fix devel

[#3732] Fix tee in ld.so.conf in fuzzing

[#3732] Switch Clusterfuzzlite to Meson

[#3732] Do not run fuzz jobs on MR creation

[#3732] Meson: Create HTML devel docs in build directory not in source directory

[#3732] Fix NETCONF rpaths

[#3732] Meson: Make gtest simple dependency + fallback

The gtest.cc compiler check misleadingly fails on some systems...

[#3732] Migrate tools/print-generated-files.sh away from autotools

[#3732] Meson: Remove GTEST_DEP from src/lib/process

[#3732] Meson: Fix GTest detection

[#3732] Meson: Fix postgresql fallback

[#3732] Fix meson.sh

[#3732] Meson: further increase test timeouts

[#3732] Meson: Report shell tests as xml in builddir by default

[#3732] Meson: Make kea-dhcp-tests sequential

IfaceMgr tests can be conflicting.

[#3732] Meson: Fix localstatedir when prefix is default

[#3732] Meson: Install fuzz/input

[#3732] Meson: Fix small inconsistency in yang scripts towards autotools

[#3732] Meson: Fix hardcoded tarball in version in some places

[#3732] Address review

[#3732] Meson: Add gtest.cc compiler check to detect crashes

[#3732] Add note to devel docs recommending Meson 1.8.0

[#3732] Add note to devel docs about gtest.wrap

[#3732] Switch docs from Autotools to Meson

[#3812] Hammer: Make sure we account for the case when hammer is called on another Kea source tree when installing SSL keys

[#3812] Hammer: Remove openssl command altogether

[#3812] Hammer: Fix openssl command

Co-authored by: Marcin Godzina <mgodzina@isc.org>

[#3812] Hammer: Overwrite SSL key only if command succeeded

[#3732] Switch CodeQL to Meson

[#3812] Hammer: tar.gz -> tar.xz

[#3812] Add comment to Hammer

[#3812] Add note about Meson version installed by Hammer

[#3812] Add ChangeLog entry

[#3812] Bump up googletest version to 1.16.0

[#3812] hammer.py: workaround for netconf rpath not working

[#3812] hammer.py: Add venv mode to install_meson