summaryrefslogtreecommitdiffstats
path: root/meta/recipes-connectivity/bind/bind/0001-fix-enforcement-of-tcp-clients-v1.patch
diff options
context:
space:
mode:
authorAlexander Kanavin <alex.kanavin@gmail.com>2020-07-09 00:07:56 +0300
committerRichard Purdie <richard.purdie@linuxfoundation.org>2020-08-04 23:17:37 +0100
commit77d5709875401ecb23925675a8c33b31336f0953 (patch)
treec219e2a61d128260361dd4a066b870b6cc64a997 /meta/recipes-connectivity/bind/bind/0001-fix-enforcement-of-tcp-clients-v1.patch
parent0d6a0b9c7f246ac58812064f7ab74e0c74ebbffa (diff)
downloadpoky-77d5709875401ecb23925675a8c33b31336f0953.tar.gz
bind: update 9.11.5-P4 -> 9.11.13
Drop backports. Drop 0001-gen.c-extend-DIRNAMESIZE-from-256-to-512.patch and 0001-lib-dns-gen.c-fix-too-long-error.patch as problem is fixed upstream. (From OE-Core rev: 6965ec5c491e71d5951dfb58fc060bd0b717e33d) (From OE-Core rev: 3f723af6059fbfed6dac0c281f212b9a02c3e026) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-connectivity/bind/bind/0001-fix-enforcement-of-tcp-clients-v1.patch')
-rw-r--r--meta/recipes-connectivity/bind/bind/0001-fix-enforcement-of-tcp-clients-v1.patch60
1 files changed, 0 insertions, 60 deletions
diff --git a/meta/recipes-connectivity/bind/bind/0001-fix-enforcement-of-tcp-clients-v1.patch b/meta/recipes-connectivity/bind/bind/0001-fix-enforcement-of-tcp-clients-v1.patch
deleted file mode 100644
index 48ae125f84..0000000000
--- a/meta/recipes-connectivity/bind/bind/0001-fix-enforcement-of-tcp-clients-v1.patch
+++ /dev/null
@@ -1,60 +0,0 @@
1Backport patch to fix CVE-2018-5743.
2
3Ref:
4https://security-tracker.debian.org/tracker/CVE-2018-5743
5
6CVE: CVE-2018-5743
7Upstream-Status: Backport [https://gitlab.isc.org/isc-projects/bind9/commit/ec2d50d]
8
9Signed-off-by: Kai Kang <kai.kang@windriver.com>
10
11From ec2d50da8d81814640e28593d912f4b96c7efece Mon Sep 17 00:00:00 2001
12From: =?UTF-8?q?Witold=20Kr=C4=99cicki?= <wpk@isc.org>
13Date: Thu, 3 Jan 2019 14:17:43 +0100
14Subject: [PATCH 1/6] fix enforcement of tcp-clients (v1)
15
16tcp-clients settings could be exceeded in some cases by
17creating more and more active TCP clients that are over
18the set quota limit, which in the end could lead to a
19DoS attack by e.g. exhaustion of file descriptors.
20
21If TCP client we're closing went over the quota (so it's
22not attached to a quota) mark it as mortal - so that it
23will be destroyed and not set up to listen for new
24connections - unless it's the last client for a specific
25interface.
26
27(cherry picked from commit f97131d21b97381cef72b971b157345c1f9b4115)
28(cherry picked from commit 9689ffc485df8f971f0ad81ab8ab1f5389493776)
29---
30 bin/named/client.c | 13 ++++++++++++-
31 1 file changed, 12 insertions(+), 1 deletion(-)
32
33diff --git a/bin/named/client.c b/bin/named/client.c
34index d482da7121..0739dd48af 100644
35--- a/bin/named/client.c
36+++ b/bin/named/client.c
37@@ -421,8 +421,19 @@ exit_check(ns_client_t *client) {
38 isc_socket_detach(&client->tcpsocket);
39 }
40
41- if (client->tcpquota != NULL)
42+ if (client->tcpquota != NULL) {
43 isc_quota_detach(&client->tcpquota);
44+ } else {
45+ /*
46+ * We went over quota with this client, we don't
47+ * want to restart listening unless this is the
48+ * last client on this interface, which is
49+ * checked later.
50+ */
51+ if (TCP_CLIENT(client)) {
52+ client->mortal = true;
53+ }
54+ }
55
56 if (client->timerset) {
57 (void)isc_timer_reset(client->timer,
58--
592.20.1
60