| Message ID | 1653381225-6080-1-git-send-email-wangmy@fujitsu.com |
|---|---|
| State | Accepted, archived |
| Commit | d2ae8b85c71be2e9e332b1ef0a2d3083b30c63e6 |
| Headers | show |
| Series | bind: upgrade 9.18.2 -> 9.18.3 | expand |
Hi Steve, On 5/24/22 16:33, wangmy wrote: > Changelog: > ========== > [security] > Fix a crash in DNS-over-HTTPS (DoH) code caused by > premature TLS stream socket object deletion. > (CVE-2022-1183) [GL #3216] There is a CVE fix in this minor update. Is there any plan to backport it to kirkstone ? Thanks, Yi > > [bug] > RPZ NSIP and NSDNAME rule processing didn't handle stub > and static-stub zones at or above the query name. This > has now been addressed. [GL #3232] > Fixed a deadlock that could occur if an rndc > connection arrived during the shutdown of network > interfaces. [GL #3272] > > Refactor the fctx_done() function to set fctx to > NULL after detaching, so that reference counting > errors will be easier to avoid. [GL #2969] > > udp_recv() in dispatch could trigger an INSIST when the > callback's result indicated success but the response > was canceled in the meantime. [GL #3300] > > Work around a jemalloc quirk which could trigger an > out-of-memory condition in named over time. [GL #3287] > > If there was a pending negative cache DS entry, > validations depending upon it could fail. [GL #3279] > > dig returned a 0 exit status on UDP connection failure. > [GL #3235] > > Fix an assertion failure when using dig with +nssearch > and +tcp options by starting the next query in the > send_done() callback (like in the UDP mode) instead > of doing that recursively in start_tcp(). Also > ensure that queries interrupted while connecting > are detached properly. [GL #3144] > > Don't remove CDS/CDNSKEY DELETE records on zone sign > when using 'auto-dnssec maintain;'. [GL #2931] > > [contrib] > Avoid name space collision in dlz modules by prefixing > functions with 'dlz_'. [GL !5778] > > dlz: Add FALLTHROUGH and UNREACHABLE macros. [GL #3306] > > [func] > Add new named command-line option -C to print built-in > defaults. [GL #1326] > > Introduce the concept of broken catalog zones described > in the DNS catalog zones draft version 5 document. > [GL #3224] > > Add DNS Extended Errors when stale answers are returned > from cache. [GL #2267] > > Implement support for catalog zones change of ownership > (coo) mechanism described in the DNS catalog zones draft > version 5 document. [GL #3223] > > Implement support for catalog zones options new syntax > based on catalog zones custom properties with "ext" > suffix described in the DNS catalog zones draft version > 5 document. [GL #3222] > > Implement reference counting for TLS contexts and > allow reloading of TLS certificates on reconfiguration > without destroying the underlying TCP listener sockets > for TLS-based DNS transports. [GL #3122] > Add support for remote TLS certificates > verification, both to BIND and dig, making it possible > to implement Strict and Mutual TLS authentication, > as described in RFC 9103, Section 9.3. [GL #3163] > > [cleanup] > Remove use of exclusive mode in ns_interfacemgr in > favor of rwlocked access to localhost and localnets > members of dns_aclenv_t structure. [GL #3229] > > Remove the task exclusive mode use in ns_clientmgr. > [GL #3230] > > Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> > --- > .../0001-avoid-start-failure-with-bind-user.patch | 0 > .../0001-named-lwresd-V-and-start-log-hide-build-options.patch | 0 > .../bind-ensure-searching-for-json-headers-searches-sysr.patch | 0 > .../bind/{bind-9.18.2 => bind-9.18.3}/bind9 | 0 > .../bind/{bind-9.18.2 => bind-9.18.3}/conf.patch | 0 > .../bind/{bind-9.18.2 => bind-9.18.3}/generate-rndc-key.sh | 0 > .../init.d-add-support-for-read-only-rootfs.patch | 0 > .../make-etc-initd-bind-stop-work.patch | 0 > .../bind/{bind-9.18.2 => bind-9.18.3}/named.service | 0 > .../bind/{bind_9.18.2.bb => bind_9.18.3.bb} | 2 +- > 10 files changed, 1 insertion(+), 1 deletion(-) > rename meta/recipes-connectivity/bind/{bind-9.18.2 => bind-9.18.3}/0001-avoid-start-failure-with-bind-user.patch (100%) > rename meta/recipes-connectivity/bind/{bind-9.18.2 => bind-9.18.3}/0001-named-lwresd-V-and-start-log-hide-build-options.patch (100%) > rename meta/recipes-connectivity/bind/{bind-9.18.2 => bind-9.18.3}/bind-ensure-searching-for-json-headers-searches-sysr.patch (100%) > rename meta/recipes-connectivity/bind/{bind-9.18.2 => bind-9.18.3}/bind9 (100%) > rename meta/recipes-connectivity/bind/{bind-9.18.2 => bind-9.18.3}/conf.patch (100%) > rename meta/recipes-connectivity/bind/{bind-9.18.2 => bind-9.18.3}/generate-rndc-key.sh (100%) > rename meta/recipes-connectivity/bind/{bind-9.18.2 => bind-9.18.3}/init.d-add-support-for-read-only-rootfs.patch (100%) > rename meta/recipes-connectivity/bind/{bind-9.18.2 => bind-9.18.3}/make-etc-initd-bind-stop-work.patch (100%) > rename meta/recipes-connectivity/bind/{bind-9.18.2 => bind-9.18.3}/named.service (100%) > rename meta/recipes-connectivity/bind/{bind_9.18.2.bb => bind_9.18.3.bb} (98%) > > diff --git a/meta/recipes-connectivity/bind/bind-9.18.2/0001-avoid-start-failure-with-bind-user.patch b/meta/recipes-connectivity/bind/bind-9.18.3/0001-avoid-start-failure-with-bind-user.patch > similarity index 100% > rename from meta/recipes-connectivity/bind/bind-9.18.2/0001-avoid-start-failure-with-bind-user.patch > rename to meta/recipes-connectivity/bind/bind-9.18.3/0001-avoid-start-failure-with-bind-user.patch > diff --git a/meta/recipes-connectivity/bind/bind-9.18.2/0001-named-lwresd-V-and-start-log-hide-build-options.patch b/meta/recipes-connectivity/bind/bind-9.18.3/0001-named-lwresd-V-and-start-log-hide-build-options.patch > similarity index 100% > rename from meta/recipes-connectivity/bind/bind-9.18.2/0001-named-lwresd-V-and-start-log-hide-build-options.patch > rename to meta/recipes-connectivity/bind/bind-9.18.3/0001-named-lwresd-V-and-start-log-hide-build-options.patch > diff --git a/meta/recipes-connectivity/bind/bind-9.18.2/bind-ensure-searching-for-json-headers-searches-sysr.patch b/meta/recipes-connectivity/bind/bind-9.18.3/bind-ensure-searching-for-json-headers-searches-sysr.patch > similarity index 100% > rename from meta/recipes-connectivity/bind/bind-9.18.2/bind-ensure-searching-for-json-headers-searches-sysr.patch > rename to meta/recipes-connectivity/bind/bind-9.18.3/bind-ensure-searching-for-json-headers-searches-sysr.patch > diff --git a/meta/recipes-connectivity/bind/bind-9.18.2/bind9 b/meta/recipes-connectivity/bind/bind-9.18.3/bind9 > similarity index 100% > rename from meta/recipes-connectivity/bind/bind-9.18.2/bind9 > rename to meta/recipes-connectivity/bind/bind-9.18.3/bind9 > diff --git a/meta/recipes-connectivity/bind/bind-9.18.2/conf.patch b/meta/recipes-connectivity/bind/bind-9.18.3/conf.patch > similarity index 100% > rename from meta/recipes-connectivity/bind/bind-9.18.2/conf.patch > rename to meta/recipes-connectivity/bind/bind-9.18.3/conf.patch > diff --git a/meta/recipes-connectivity/bind/bind-9.18.2/generate-rndc-key.sh b/meta/recipes-connectivity/bind/bind-9.18.3/generate-rndc-key.sh > similarity index 100% > rename from meta/recipes-connectivity/bind/bind-9.18.2/generate-rndc-key.sh > rename to meta/recipes-connectivity/bind/bind-9.18.3/generate-rndc-key.sh > diff --git a/meta/recipes-connectivity/bind/bind-9.18.2/init.d-add-support-for-read-only-rootfs.patch b/meta/recipes-connectivity/bind/bind-9.18.3/init.d-add-support-for-read-only-rootfs.patch > similarity index 100% > rename from meta/recipes-connectivity/bind/bind-9.18.2/init.d-add-support-for-read-only-rootfs.patch > rename to meta/recipes-connectivity/bind/bind-9.18.3/init.d-add-support-for-read-only-rootfs.patch > diff --git a/meta/recipes-connectivity/bind/bind-9.18.2/make-etc-initd-bind-stop-work.patch b/meta/recipes-connectivity/bind/bind-9.18.3/make-etc-initd-bind-stop-work.patch > similarity index 100% > rename from meta/recipes-connectivity/bind/bind-9.18.2/make-etc-initd-bind-stop-work.patch > rename to meta/recipes-connectivity/bind/bind-9.18.3/make-etc-initd-bind-stop-work.patch > diff --git a/meta/recipes-connectivity/bind/bind-9.18.2/named.service b/meta/recipes-connectivity/bind/bind-9.18.3/named.service > similarity index 100% > rename from meta/recipes-connectivity/bind/bind-9.18.2/named.service > rename to meta/recipes-connectivity/bind/bind-9.18.3/named.service > diff --git a/meta/recipes-connectivity/bind/bind_9.18.2.bb b/meta/recipes-connectivity/bind/bind_9.18.3.bb > similarity index 98% > rename from meta/recipes-connectivity/bind/bind_9.18.2.bb > rename to meta/recipes-connectivity/bind/bind_9.18.3.bb > index 1c77aceb9f..b511b77f2e 100644 > --- a/meta/recipes-connectivity/bind/bind_9.18.2.bb > +++ b/meta/recipes-connectivity/bind/bind_9.18.3.bb > @@ -20,7 +20,7 @@ SRC_URI = "https://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.xz \ > file://0001-avoid-start-failure-with-bind-user.patch \ > " > > -SRC_URI[sha256sum] = "2e4b38779bba0a23ee634fdf7c525fd9794c41d692bfd83cda25823a2a3ed969" > +SRC_URI[sha256sum] = "0ad8da773bd93cba0ef66cc81999698ebdf9c3e51faed5e5c8c1eb75cad2ae6f" > > UPSTREAM_CHECK_URI = "https://ftp.isc.org/isc/bind9/" > # follow the ESV versions divisible by 2 > > -=-=-=-=-=-=-=-=-=-=-=- > Links: You receive all messages sent to this group. > View/Reply Online (#166051): https://lists.openembedded.org/g/openembedded-core/message/166051 > Mute This Topic: https://lists.openembedded.org/mt/91307116/3616783 > Group Owner: openembedded-core+owner@lists.openembedded.org > Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [yi.zhao@windriver.com] > -=-=-=-=-=-=-=-=-=-=-=- >
On Sun, Jul 17, 2022 at 8:42 PM Yi Zhao <yi.zhao@windriver.com> wrote: > > Hi Steve, > > > On 5/24/22 16:33, wangmy wrote: > > Changelog: > > ========== > > [security] > > Fix a crash in DNS-over-HTTPS (DoH) code caused by > > premature TLS stream socket object deletion. > > (CVE-2022-1183) [GL #3216] > > > There is a CVE fix in this minor update. Is there any plan to backport > it to kirkstone ? Since this is a stable branch update I can take it. I'll add it to my next patch set for testing. Steve > > > > [bug] > > RPZ NSIP and NSDNAME rule processing didn't handle stub > > and static-stub zones at or above the query name. This > > has now been addressed. [GL #3232] > > Fixed a deadlock that could occur if an rndc > > connection arrived during the shutdown of network > > interfaces. [GL #3272] > > > > Refactor the fctx_done() function to set fctx to > > NULL after detaching, so that reference counting > > errors will be easier to avoid. [GL #2969] > > > > udp_recv() in dispatch could trigger an INSIST when the > > callback's result indicated success but the response > > was canceled in the meantime. [GL #3300] > > > > Work around a jemalloc quirk which could trigger an > > out-of-memory condition in named over time. [GL #3287] > > > > If there was a pending negative cache DS entry, > > validations depending upon it could fail. [GL #3279] > > > > dig returned a 0 exit status on UDP connection failure. > > [GL #3235] > > > > Fix an assertion failure when using dig with +nssearch > > and +tcp options by starting the next query in the > > send_done() callback (like in the UDP mode) instead > > of doing that recursively in start_tcp(). Also > > ensure that queries interrupted while connecting > > are detached properly. [GL #3144] > > > > Don't remove CDS/CDNSKEY DELETE records on zone sign > > when using 'auto-dnssec maintain;'. [GL #2931] > > > > [contrib] > > Avoid name space collision in dlz modules by prefixing > > functions with 'dlz_'. [GL !5778] > > > > dlz: Add FALLTHROUGH and UNREACHABLE macros. [GL #3306] > > > > [func] > > Add new named command-line option -C to print built-in > > defaults. [GL #1326] > > > > Introduce the concept of broken catalog zones described > > in the DNS catalog zones draft version 5 document. > > [GL #3224] > > > > Add DNS Extended Errors when stale answers are returned > > from cache. [GL #2267] > > > > Implement support for catalog zones change of ownership > > (coo) mechanism described in the DNS catalog zones draft > > version 5 document. [GL #3223] > > > > Implement support for catalog zones options new syntax > > based on catalog zones custom properties with "ext" > > suffix described in the DNS catalog zones draft version > > 5 document. [GL #3222] > > > > Implement reference counting for TLS contexts and > > allow reloading of TLS certificates on reconfiguration > > without destroying the underlying TCP listener sockets > > for TLS-based DNS transports. [GL #3122] > > Add support for remote TLS certificates > > verification, both to BIND and dig, making it possible > > to implement Strict and Mutual TLS authentication, > > as described in RFC 9103, Section 9.3. [GL #3163] > > > > [cleanup] > > Remove use of exclusive mode in ns_interfacemgr in > > favor of rwlocked access to localhost and localnets > > members of dns_aclenv_t structure. [GL #3229] > > > > Remove the task exclusive mode use in ns_clientmgr. > > [GL #3230] > > > > Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> > > --- > > .../0001-avoid-start-failure-with-bind-user.patch | 0 > > .../0001-named-lwresd-V-and-start-log-hide-build-options.patch | 0 > > .../bind-ensure-searching-for-json-headers-searches-sysr.patch | 0 > > .../bind/{bind-9.18.2 => bind-9.18.3}/bind9 | 0 > > .../bind/{bind-9.18.2 => bind-9.18.3}/conf.patch | 0 > > .../bind/{bind-9.18.2 => bind-9.18.3}/generate-rndc-key.sh | 0 > > .../init.d-add-support-for-read-only-rootfs.patch | 0 > > .../make-etc-initd-bind-stop-work.patch | 0 > > .../bind/{bind-9.18.2 => bind-9.18.3}/named.service | 0 > > .../bind/{bind_9.18.2.bb => bind_9.18.3.bb} | 2 +- > > 10 files changed, 1 insertion(+), 1 deletion(-) > > rename meta/recipes-connectivity/bind/{bind-9.18.2 => bind-9.18.3}/0001-avoid-start-failure-with-bind-user.patch (100%) > > rename meta/recipes-connectivity/bind/{bind-9.18.2 => bind-9.18.3}/0001-named-lwresd-V-and-start-log-hide-build-options.patch (100%) > > rename meta/recipes-connectivity/bind/{bind-9.18.2 => bind-9.18.3}/bind-ensure-searching-for-json-headers-searches-sysr.patch (100%) > > rename meta/recipes-connectivity/bind/{bind-9.18.2 => bind-9.18.3}/bind9 (100%) > > rename meta/recipes-connectivity/bind/{bind-9.18.2 => bind-9.18.3}/conf.patch (100%) > > rename meta/recipes-connectivity/bind/{bind-9.18.2 => bind-9.18.3}/generate-rndc-key.sh (100%) > > rename meta/recipes-connectivity/bind/{bind-9.18.2 => bind-9.18.3}/init.d-add-support-for-read-only-rootfs.patch (100%) > > rename meta/recipes-connectivity/bind/{bind-9.18.2 => bind-9.18.3}/make-etc-initd-bind-stop-work.patch (100%) > > rename meta/recipes-connectivity/bind/{bind-9.18.2 => bind-9.18.3}/named.service (100%) > > rename meta/recipes-connectivity/bind/{bind_9.18.2.bb => bind_9.18.3.bb} (98%) > > > > diff --git a/meta/recipes-connectivity/bind/bind-9.18.2/0001-avoid-start-failure-with-bind-user.patch b/meta/recipes-connectivity/bind/bind-9.18.3/0001-avoid-start-failure-with-bind-user.patch > > similarity index 100% > > rename from meta/recipes-connectivity/bind/bind-9.18.2/0001-avoid-start-failure-with-bind-user.patch > > rename to meta/recipes-connectivity/bind/bind-9.18.3/0001-avoid-start-failure-with-bind-user.patch > > diff --git a/meta/recipes-connectivity/bind/bind-9.18.2/0001-named-lwresd-V-and-start-log-hide-build-options.patch b/meta/recipes-connectivity/bind/bind-9.18.3/0001-named-lwresd-V-and-start-log-hide-build-options.patch > > similarity index 100% > > rename from meta/recipes-connectivity/bind/bind-9.18.2/0001-named-lwresd-V-and-start-log-hide-build-options.patch > > rename to meta/recipes-connectivity/bind/bind-9.18.3/0001-named-lwresd-V-and-start-log-hide-build-options.patch > > diff --git a/meta/recipes-connectivity/bind/bind-9.18.2/bind-ensure-searching-for-json-headers-searches-sysr.patch b/meta/recipes-connectivity/bind/bind-9.18.3/bind-ensure-searching-for-json-headers-searches-sysr.patch > > similarity index 100% > > rename from meta/recipes-connectivity/bind/bind-9.18.2/bind-ensure-searching-for-json-headers-searches-sysr.patch > > rename to meta/recipes-connectivity/bind/bind-9.18.3/bind-ensure-searching-for-json-headers-searches-sysr.patch > > diff --git a/meta/recipes-connectivity/bind/bind-9.18.2/bind9 b/meta/recipes-connectivity/bind/bind-9.18.3/bind9 > > similarity index 100% > > rename from meta/recipes-connectivity/bind/bind-9.18.2/bind9 > > rename to meta/recipes-connectivity/bind/bind-9.18.3/bind9 > > diff --git a/meta/recipes-connectivity/bind/bind-9.18.2/conf.patch b/meta/recipes-connectivity/bind/bind-9.18.3/conf.patch > > similarity index 100% > > rename from meta/recipes-connectivity/bind/bind-9.18.2/conf.patch > > rename to meta/recipes-connectivity/bind/bind-9.18.3/conf.patch > > diff --git a/meta/recipes-connectivity/bind/bind-9.18.2/generate-rndc-key.sh b/meta/recipes-connectivity/bind/bind-9.18.3/generate-rndc-key.sh > > similarity index 100% > > rename from meta/recipes-connectivity/bind/bind-9.18.2/generate-rndc-key.sh > > rename to meta/recipes-connectivity/bind/bind-9.18.3/generate-rndc-key.sh > > diff --git a/meta/recipes-connectivity/bind/bind-9.18.2/init.d-add-support-for-read-only-rootfs.patch b/meta/recipes-connectivity/bind/bind-9.18.3/init.d-add-support-for-read-only-rootfs.patch > > similarity index 100% > > rename from meta/recipes-connectivity/bind/bind-9.18.2/init.d-add-support-for-read-only-rootfs.patch > > rename to meta/recipes-connectivity/bind/bind-9.18.3/init.d-add-support-for-read-only-rootfs.patch > > diff --git a/meta/recipes-connectivity/bind/bind-9.18.2/make-etc-initd-bind-stop-work.patch b/meta/recipes-connectivity/bind/bind-9.18.3/make-etc-initd-bind-stop-work.patch > > similarity index 100% > > rename from meta/recipes-connectivity/bind/bind-9.18.2/make-etc-initd-bind-stop-work.patch > > rename to meta/recipes-connectivity/bind/bind-9.18.3/make-etc-initd-bind-stop-work.patch > > diff --git a/meta/recipes-connectivity/bind/bind-9.18.2/named.service b/meta/recipes-connectivity/bind/bind-9.18.3/named.service > > similarity index 100% > > rename from meta/recipes-connectivity/bind/bind-9.18.2/named.service > > rename to meta/recipes-connectivity/bind/bind-9.18.3/named.service > > diff --git a/meta/recipes-connectivity/bind/bind_9.18.2.bb b/meta/recipes-connectivity/bind/bind_9.18.3.bb > > similarity index 98% > > rename from meta/recipes-connectivity/bind/bind_9.18.2.bb > > rename to meta/recipes-connectivity/bind/bind_9.18.3.bb > > index 1c77aceb9f..b511b77f2e 100644 > > --- a/meta/recipes-connectivity/bind/bind_9.18.2.bb > > +++ b/meta/recipes-connectivity/bind/bind_9.18.3.bb > > @@ -20,7 +20,7 @@ SRC_URI = "https://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.xz \ > > file://0001-avoid-start-failure-with-bind-user.patch \ > > " > > > > -SRC_URI[sha256sum] = "2e4b38779bba0a23ee634fdf7c525fd9794c41d692bfd83cda25823a2a3ed969" > > +SRC_URI[sha256sum] = "0ad8da773bd93cba0ef66cc81999698ebdf9c3e51faed5e5c8c1eb75cad2ae6f" > > > > UPSTREAM_CHECK_URI = "https://ftp.isc.org/isc/bind9/" > > # follow the ESV versions divisible by 2 > > > > > > > > -=-=-=-=-=-=-=-=-=-=-=- > Links: You receive all messages sent to this group. > View/Reply Online (#168192): https://lists.openembedded.org/g/openembedded-core/message/168192 > Mute This Topic: https://lists.openembedded.org/mt/91307116/3617601 > Group Owner: openembedded-core+owner@lists.openembedded.org > Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [sakoman@gmail.com] > -=-=-=-=-=-=-=-=-=-=-=- >
diff --git a/meta/recipes-connectivity/bind/bind-9.18.2/0001-avoid-start-failure-with-bind-user.patch b/meta/recipes-connectivity/bind/bind-9.18.3/0001-avoid-start-failure-with-bind-user.patch similarity index 100% rename from meta/recipes-connectivity/bind/bind-9.18.2/0001-avoid-start-failure-with-bind-user.patch rename to meta/recipes-connectivity/bind/bind-9.18.3/0001-avoid-start-failure-with-bind-user.patch diff --git a/meta/recipes-connectivity/bind/bind-9.18.2/0001-named-lwresd-V-and-start-log-hide-build-options.patch b/meta/recipes-connectivity/bind/bind-9.18.3/0001-named-lwresd-V-and-start-log-hide-build-options.patch similarity index 100% rename from meta/recipes-connectivity/bind/bind-9.18.2/0001-named-lwresd-V-and-start-log-hide-build-options.patch rename to meta/recipes-connectivity/bind/bind-9.18.3/0001-named-lwresd-V-and-start-log-hide-build-options.patch diff --git a/meta/recipes-connectivity/bind/bind-9.18.2/bind-ensure-searching-for-json-headers-searches-sysr.patch b/meta/recipes-connectivity/bind/bind-9.18.3/bind-ensure-searching-for-json-headers-searches-sysr.patch similarity index 100% rename from meta/recipes-connectivity/bind/bind-9.18.2/bind-ensure-searching-for-json-headers-searches-sysr.patch rename to meta/recipes-connectivity/bind/bind-9.18.3/bind-ensure-searching-for-json-headers-searches-sysr.patch diff --git a/meta/recipes-connectivity/bind/bind-9.18.2/bind9 b/meta/recipes-connectivity/bind/bind-9.18.3/bind9 similarity index 100% rename from meta/recipes-connectivity/bind/bind-9.18.2/bind9 rename to meta/recipes-connectivity/bind/bind-9.18.3/bind9 diff --git a/meta/recipes-connectivity/bind/bind-9.18.2/conf.patch b/meta/recipes-connectivity/bind/bind-9.18.3/conf.patch similarity index 100% rename from meta/recipes-connectivity/bind/bind-9.18.2/conf.patch rename to meta/recipes-connectivity/bind/bind-9.18.3/conf.patch diff --git a/meta/recipes-connectivity/bind/bind-9.18.2/generate-rndc-key.sh b/meta/recipes-connectivity/bind/bind-9.18.3/generate-rndc-key.sh similarity index 100% rename from meta/recipes-connectivity/bind/bind-9.18.2/generate-rndc-key.sh rename to meta/recipes-connectivity/bind/bind-9.18.3/generate-rndc-key.sh diff --git a/meta/recipes-connectivity/bind/bind-9.18.2/init.d-add-support-for-read-only-rootfs.patch b/meta/recipes-connectivity/bind/bind-9.18.3/init.d-add-support-for-read-only-rootfs.patch similarity index 100% rename from meta/recipes-connectivity/bind/bind-9.18.2/init.d-add-support-for-read-only-rootfs.patch rename to meta/recipes-connectivity/bind/bind-9.18.3/init.d-add-support-for-read-only-rootfs.patch diff --git a/meta/recipes-connectivity/bind/bind-9.18.2/make-etc-initd-bind-stop-work.patch b/meta/recipes-connectivity/bind/bind-9.18.3/make-etc-initd-bind-stop-work.patch similarity index 100% rename from meta/recipes-connectivity/bind/bind-9.18.2/make-etc-initd-bind-stop-work.patch rename to meta/recipes-connectivity/bind/bind-9.18.3/make-etc-initd-bind-stop-work.patch diff --git a/meta/recipes-connectivity/bind/bind-9.18.2/named.service b/meta/recipes-connectivity/bind/bind-9.18.3/named.service similarity index 100% rename from meta/recipes-connectivity/bind/bind-9.18.2/named.service rename to meta/recipes-connectivity/bind/bind-9.18.3/named.service diff --git a/meta/recipes-connectivity/bind/bind_9.18.2.bb b/meta/recipes-connectivity/bind/bind_9.18.3.bb similarity index 98% rename from meta/recipes-connectivity/bind/bind_9.18.2.bb rename to meta/recipes-connectivity/bind/bind_9.18.3.bb index 1c77aceb9f..b511b77f2e 100644 --- a/meta/recipes-connectivity/bind/bind_9.18.2.bb +++ b/meta/recipes-connectivity/bind/bind_9.18.3.bb @@ -20,7 +20,7 @@ SRC_URI = "https://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.xz \ file://0001-avoid-start-failure-with-bind-user.patch \ " -SRC_URI[sha256sum] = "2e4b38779bba0a23ee634fdf7c525fd9794c41d692bfd83cda25823a2a3ed969" +SRC_URI[sha256sum] = "0ad8da773bd93cba0ef66cc81999698ebdf9c3e51faed5e5c8c1eb75cad2ae6f" UPSTREAM_CHECK_URI = "https://ftp.isc.org/isc/bind9/" # follow the ESV versions divisible by 2
Changelog: ========== [security] Fix a crash in DNS-over-HTTPS (DoH) code caused by premature TLS stream socket object deletion. (CVE-2022-1183) [GL #3216] [bug] RPZ NSIP and NSDNAME rule processing didn't handle stub and static-stub zones at or above the query name. This has now been addressed. [GL #3232] Fixed a deadlock that could occur if an rndc connection arrived during the shutdown of network interfaces. [GL #3272] Refactor the fctx_done() function to set fctx to NULL after detaching, so that reference counting errors will be easier to avoid. [GL #2969] udp_recv() in dispatch could trigger an INSIST when the callback's result indicated success but the response was canceled in the meantime. [GL #3300] Work around a jemalloc quirk which could trigger an out-of-memory condition in named over time. [GL #3287] If there was a pending negative cache DS entry, validations depending upon it could fail. [GL #3279] dig returned a 0 exit status on UDP connection failure. [GL #3235] Fix an assertion failure when using dig with +nssearch and +tcp options by starting the next query in the send_done() callback (like in the UDP mode) instead of doing that recursively in start_tcp(). Also ensure that queries interrupted while connecting are detached properly. [GL #3144] Don't remove CDS/CDNSKEY DELETE records on zone sign when using 'auto-dnssec maintain;'. [GL #2931] [contrib] Avoid name space collision in dlz modules by prefixing functions with 'dlz_'. [GL !5778] dlz: Add FALLTHROUGH and UNREACHABLE macros. [GL #3306] [func] Add new named command-line option -C to print built-in defaults. [GL #1326] Introduce the concept of broken catalog zones described in the DNS catalog zones draft version 5 document. [GL #3224] Add DNS Extended Errors when stale answers are returned from cache. [GL #2267] Implement support for catalog zones change of ownership (coo) mechanism described in the DNS catalog zones draft version 5 document. [GL #3223] Implement support for catalog zones options new syntax based on catalog zones custom properties with "ext" suffix described in the DNS catalog zones draft version 5 document. [GL #3222] Implement reference counting for TLS contexts and allow reloading of TLS certificates on reconfiguration without destroying the underlying TCP listener sockets for TLS-based DNS transports. [GL #3122] Add support for remote TLS certificates verification, both to BIND and dig, making it possible to implement Strict and Mutual TLS authentication, as described in RFC 9103, Section 9.3. [GL #3163] [cleanup] Remove use of exclusive mode in ns_interfacemgr in favor of rwlocked access to localhost and localnets members of dns_aclenv_t structure. [GL #3229] Remove the task exclusive mode use in ns_clientmgr. [GL #3230] Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> --- .../0001-avoid-start-failure-with-bind-user.patch | 0 .../0001-named-lwresd-V-and-start-log-hide-build-options.patch | 0 .../bind-ensure-searching-for-json-headers-searches-sysr.patch | 0 .../bind/{bind-9.18.2 => bind-9.18.3}/bind9 | 0 .../bind/{bind-9.18.2 => bind-9.18.3}/conf.patch | 0 .../bind/{bind-9.18.2 => bind-9.18.3}/generate-rndc-key.sh | 0 .../init.d-add-support-for-read-only-rootfs.patch | 0 .../make-etc-initd-bind-stop-work.patch | 0 .../bind/{bind-9.18.2 => bind-9.18.3}/named.service | 0 .../bind/{bind_9.18.2.bb => bind_9.18.3.bb} | 2 +- 10 files changed, 1 insertion(+), 1 deletion(-) rename meta/recipes-connectivity/bind/{bind-9.18.2 => bind-9.18.3}/0001-avoid-start-failure-with-bind-user.patch (100%) rename meta/recipes-connectivity/bind/{bind-9.18.2 => bind-9.18.3}/0001-named-lwresd-V-and-start-log-hide-build-options.patch (100%) rename meta/recipes-connectivity/bind/{bind-9.18.2 => bind-9.18.3}/bind-ensure-searching-for-json-headers-searches-sysr.patch (100%) rename meta/recipes-connectivity/bind/{bind-9.18.2 => bind-9.18.3}/bind9 (100%) rename meta/recipes-connectivity/bind/{bind-9.18.2 => bind-9.18.3}/conf.patch (100%) rename meta/recipes-connectivity/bind/{bind-9.18.2 => bind-9.18.3}/generate-rndc-key.sh (100%) rename meta/recipes-connectivity/bind/{bind-9.18.2 => bind-9.18.3}/init.d-add-support-for-read-only-rootfs.patch (100%) rename meta/recipes-connectivity/bind/{bind-9.18.2 => bind-9.18.3}/make-etc-initd-bind-stop-work.patch (100%) rename meta/recipes-connectivity/bind/{bind-9.18.2 => bind-9.18.3}/named.service (100%) rename meta/recipes-connectivity/bind/{bind_9.18.2.bb => bind_9.18.3.bb} (98%)