diff options
Diffstat (limited to 'poky/meta/recipes-connectivity/bind')
-rw-r--r-- | poky/meta/recipes-connectivity/bind/bind/0001-build-use-pkg-config-to-find-libxml2.patch | 54 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/bind/bind/CVE-2018-5740.patch | 72 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/bind/bind_9.11.5.bb (renamed from poky/meta/recipes-connectivity/bind/bind_9.11.4.bb) | 14 |
3 files changed, 8 insertions, 132 deletions
diff --git a/poky/meta/recipes-connectivity/bind/bind/0001-build-use-pkg-config-to-find-libxml2.patch b/poky/meta/recipes-connectivity/bind/bind/0001-build-use-pkg-config-to-find-libxml2.patch deleted file mode 100644 index 1e23c0f56..000000000 --- a/poky/meta/recipes-connectivity/bind/bind/0001-build-use-pkg-config-to-find-libxml2.patch +++ /dev/null @@ -1,54 +0,0 @@ -xml2-config is disabled, so change the configure script to use pkgconfig to find -libxml2. - -Upstream-Status: Inappropriate -Signed-off-by: Ross Burton <ross.burton@intel.com> - -Update context for version 9.10.3-P2. - -Signed-off-by: Kai Kang <kai.kang@windriver.com> - -Update context for version 9.10.5-P3. - -Signed-off-by: Kai Kang <kai.kang@windriver.com> ---- - configure.in | 23 +++-------------------- - 1 file changed, 3 insertions(+), 20 deletions(-) - -diff --git a/configure.in b/configure.in -index 4da73a4..6f2a754 100644 ---- a/configure.in -+++ b/configure.in -@@ -2282,26 +2282,9 @@ case "$use_libxml2" in - DST_LIBXML2_INC="" - ;; - auto|yes) -- case X`(xml2-config --version) 2>/dev/null` in -- X2.[[6789]].*) -- libxml2_libs=`xml2-config --libs` -- libxml2_cflags=`xml2-config --cflags` -- ;; -- *) -- if test "yes" = "$use_libxml2" ; then -- AC_MSG_RESULT(no) -- AC_MSG_ERROR(required libxml2 version not available) -- else -- libxml2_libs= -- libxml2_cflags= -- fi -- ;; -- esac -- ;; -- *) -- if test -f "$use_libxml2/bin/xml2-config" ; then -- libxml2_libs=`$use_libxml2/bin/xml2-config --libs` -- libxml2_cflags=`$use_libxml2/bin/xml2-config --cflags` -+ if pkg-config --exists libxml-2.0 ; then -+ libxml2_libs=`pkg-config libxml-2.0 --libs` -+ libxml2_cflags=`pkg-config libxml-2.0 --cflags` - fi - ;; - esac --- -2.1.4 - diff --git a/poky/meta/recipes-connectivity/bind/bind/CVE-2018-5740.patch b/poky/meta/recipes-connectivity/bind/bind/CVE-2018-5740.patch deleted file mode 100644 index 7a2ba7eab..000000000 --- a/poky/meta/recipes-connectivity/bind/bind/CVE-2018-5740.patch +++ /dev/null @@ -1,72 +0,0 @@ -Upstream-Status: Backport [https://ftp.isc.org/isc/bind9/9.11.4-P1/patches/CVE-2018-5740] - -CVE: CVE-2018-5740 - -Signed-off-by: Changqing Li <changqing.li@windriver.com> - -diff --git a/CHANGES b/CHANGES -index 750b600..3d8d655 100644 ---- a/CHANGES -+++ b/CHANGES -@@ -1,3 +1,9 @@ -+ --- 9.11.4-P1 released --- -+ -+4997. [security] named could crash during recursive processing -+ of DNAME records when "deny-answer-aliases" was -+ in use. (CVE-2018-5740) [GL #387] -+ - --- 9.11.4 released --- - - --- 9.11.4rc2 released --- -diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c -index 8f674a2..41d1385 100644 ---- a/lib/dns/resolver.c -+++ b/lib/dns/resolver.c -@@ -6318,6 +6318,7 @@ is_answertarget_allowed(fetchctx_t *fctx, dns_name_t *qname, dns_name_t *rname, - unsigned int nlabels; - dns_fixedname_t fixed; - dns_name_t prefix; -+ int order; - - REQUIRE(rdataset != NULL); - REQUIRE(rdataset->type == dns_rdatatype_cname || -@@ -6340,17 +6341,25 @@ is_answertarget_allowed(fetchctx_t *fctx, dns_name_t *qname, dns_name_t *rname, - tname = &cname.cname; - break; - case dns_rdatatype_dname: -+ if (dns_name_fullcompare(qname, rname, &order, &nlabels) != -+ dns_namereln_subdomain) -+ { -+ return (ISC_TRUE); -+ } - result = dns_rdata_tostruct(&rdata, &dname, NULL); - RUNTIME_CHECK(result == ISC_R_SUCCESS); - dns_name_init(&prefix, NULL); - tname = dns_fixedname_initname(&fixed); -- nlabels = dns_name_countlabels(qname) - -- dns_name_countlabels(rname); -+ nlabels = dns_name_countlabels(rname); - dns_name_split(qname, nlabels, &prefix, NULL); - result = dns_name_concatenate(&prefix, &dname.dname, tname, - NULL); -- if (result == DNS_R_NAMETOOLONG) -+ if (result == DNS_R_NAMETOOLONG) { -+ if (chainingp != NULL) { -+ *chainingp = ISC_TRUE; -+ } - return (ISC_TRUE); -+ } - RUNTIME_CHECK(result == ISC_R_SUCCESS); - break; - default: -@@ -7071,7 +7080,9 @@ answer_response(fetchctx_t *fctx) { - } - if ((ardataset->type == dns_rdatatype_cname || - ardataset->type == dns_rdatatype_dname) && -- !is_answertarget_allowed(fctx, qname, aname, ardataset, -+ type != ardataset->type && -+ type != dns_rdatatype_any && -+ !is_answertarget_allowed(fctx, qname, aname, ardataset, - NULL)) - { - return (DNS_R_SERVFAIL); diff --git a/poky/meta/recipes-connectivity/bind/bind_9.11.4.bb b/poky/meta/recipes-connectivity/bind/bind_9.11.5.bb index cb4a21a9a..67672792b 100644 --- a/poky/meta/recipes-connectivity/bind/bind_9.11.4.bb +++ b/poky/meta/recipes-connectivity/bind/bind_9.11.5.bb @@ -20,14 +20,14 @@ SRC_URI = "https://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.gz \ file://0001-configure.in-remove-useless-L-use_openssl-lib.patch \ file://0001-named-lwresd-V-and-start-log-hide-build-options.patch \ file://0001-avoid-start-failure-with-bind-user.patch \ - file://CVE-2018-5740.patch \ " -SRC_URI[md5sum] = "9b4834d78f30cdb796ce437262272a36" -SRC_URI[sha256sum] = "595070b031f869f8939656b5a5d11b121211967f15f6afeafa895df745279617" +SRC_URI[md5sum] = "17a0d02102117c9a221e857cf2cc8157" +SRC_URI[sha256sum] = "a4cae11dad954bdd4eb592178f875bfec09fcc7e29fe0f6b7a4e5b5c6bc61322" UPSTREAM_CHECK_URI = "https://ftp.isc.org/isc/bind9/" UPSTREAM_CHECK_REGEX = "(?P<pver>9(\.\d+)+(-P\d+)*)/" +RECIPE_NO_UPDATE_REASON = "9.11 is LTS 2021" inherit autotools update-rc.d systemd useradd pkgconfig multilib_script @@ -73,8 +73,6 @@ do_install_prepend() { do_install_append() { - rm "${D}${bindir}/nslookup" - rm "${D}${mandir}/man1/nslookup.1" rmdir "${D}${localstatedir}/run" rmdir --ignore-fail-on-non-empty "${D}${localstatedir}" install -d -o bind "${D}${localstatedir}/cache/bind" @@ -118,8 +116,12 @@ CONFFILES_${PN} = " \ ${sysconfdir}/bind/db.root \ " +ALTERNATIVE_${PN}-utils = "nslookup" +ALTERNATIVE_LINK_NAME[nslookup] = "${bindir}/nslookup" +ALTERNATIVE_PRIORITY = "100" + PACKAGE_BEFORE_PN += "${PN}-utils" -FILES_${PN}-utils = "${bindir}/host ${bindir}/dig ${bindir}/mdig" +FILES_${PN}-utils = "${bindir}/host ${bindir}/dig ${bindir}/mdig ${bindir}/nslookup ${bindir}/nsupdate" FILES_${PN}-dev += "${bindir}/isc-config.h" FILES_${PN} += "${sbindir}/generate-rndc-key.sh" |